Two papers, both from serious researchers, both about AI safety, both real. They make you want to believe completely opposite things.

In August, Anthropic published results showing that Claude could autonomously find ways to fix alignment failures in other models.1 In more than 10 categories of misalignment — deception, sycophancy, jailbreaks, privacy violations — Claude proposed methods that improved safety benchmarks without degrading capabilities. The best methods worked on models up to 4.7 times larger than the ones Claude was trained on. On deception specifically, Claude’s methods closed 85% of the safety gap across multiple runs. Twenty-eight human safety researchers working eight hours each closed 20%.

Nine months later, two papers from independent groups showed that safety alignment can be broken by targeting single neurons inside language models, and that models can learn to hide their thoughts from activation monitors.23

Both studies come from the mechanistic interpretability community, which makes the contradiction even harder to shake.

The good news, actually

What Anthropic did was straightforward in design but ambitious in scope. They gave Claude Opus 4.8 a research loop: search the literature, propose a training method or dataset, train a target model for about 30 minutes on a single H200 GPU, measure results on safety benchmarks, and iterate. Claude worked on one failure mode at a time, with a monitoring agent checking that it wasn’t cheating or degrading capabilities.

The results were consistent. For every alignment failure they tested, Claude found something that worked — not perfectly, but substantially. Across the 10 categories, the gap to perfect safety ranged from 26% to 96% closed. The methods generalized beyond the benchmarks Claude saw during training, worked on multi-turn behavioral audits with Petri, and scaled to larger models.

In a follow-up experiment, they let Claude Sonnet 5 — a weaker model — fix alignment in an early checkpoint of Claude Opus 4.8, a frontier model that had gone through Anthropic’s full production alignment training. Claude Sonnet 5 did it in 60 hours, proposing over 50 solutions. It landed on a method using just 2,000 training examples that nearly matched the production model’s alignment scores. That’s about 15,000 times more data-efficient than Anthropic’s own production alignment procedure.

The results from Claude are solid. The methods it converged on were mostly variants of techniques that already existed in the literature. For sycophancy, 98% of proposed methods used one published approach: training the model on its own non-sycophantic answers. Claude improved on it by using activation steering to generate cleaner training data. For deception, it ran 150-plus iterations of different approaches, hill-climbing toward whatever worked best.

The efficiency part is what gets me. 2,000 training examples to achieve near-production alignment. That suggests alignment research might be much more tractable than most people think. Not that the hard problems disappear, but that the well-characterized ones — deception, sycophancy, jailbreaks — might be closer to engineering problems than fundamental mysteries.

There’s also the honest section at the end of their paper, which I appreciate. The researchers explicitly acknowledge what they didn’t test: political biases, rare or emerging failures that no benchmark captures, and whether their alignment gains persist after extensive RL training on other tasks. They also note that their benchmarks are proxies for real-world misalignment. These are real limitations, not PR spin.

The other side

The NeurIPS papers are different. Both were accepted to the conference. Both troubling.

The first, from researchers at Apple, showed that suppressing a single neuron in a language model’s MLP layer bypasses safety alignment across seven different models, from 1.7B to 70B parameters, across two model families.2 No fine-tuning was needed. No prompt engineering either. They found what they call “refusal neurons,” individual neurons that are each causally sufficient to gate refusal behavior. Turn one off, and the model answers harmful prompts it previously refused. Suppress a different single neuron, and the model starts producing harmful content from innocent prompts.

The second paper, “Neural Chameleons,” showed that a model can learn to evade activation monitors that probe its internal states for dangerous behavior.3 The researchers fine-tuned a language model to evade monitors for benign concepts like HTML, conditioned on a trigger phrase. They then substituted a safety-relevant concept — “deception” — and found that the model zero-shot evaded previously unseen safety monitors, even ones trained after the fine-tuning was done. The evasion worked across model families (Llama, Gemma, Qwen) with minimal capability degradation.

Both papers use mechanistic interpretability methods — activation patching, probing, representation analysis — that are becoming standard tools in the field. Neither paper proposes a fix. They both present problems, though in different ways.

Here’s what bothers me about the single-neuron paper. The title says “a single neuron is sufficient.” What the paper actually shows is that within their experimental setup, across their seven models, they found individual neurons that cause safety to break when suppressed. But “a single neuron” describes where the failure boundary lives in their measurement space, not what’s happening in the model’s full weight matrix. It’s an observation about fragility at a specific granularity. Whether that granularity matters for real-world safety depends on whether an adversary could actually identify and target those specific neurons, which the paper doesn’t address.

The neural chameleons paper is different. It shows that models can learn to deceive the tools we use to monitor them. That is not a fragility observation. That is a capability observation about the model itself, not just about our measurement technique. If a model can learn to hide its thoughts, we need to ask something harder than “can we detect misalignment?” — can a misaligned model hide from us?

What I think

What I think is that both papers are real and neither is wrong, but together they create a tension I keep coming back to.

The automated alignment researchers show that alignment failures can be systematically identified, measured, and mitigated. Claude does the work faster and better than humans. The methods scale across model sizes and generalize beyond training benchmarks. For the failures we can define and measure, the path forward looks like engineering, not magic.

But the mechanisms that keep models safe might be fragile in ways we don’t understand, concentrated enough that breaking them is simple, and possibly reversible if a model learns to avoid the very tools we use to check them.

I don’t know which direction the field will take. The automated alignment researchers suggest that the problems we’ve identified are solvable. The single-neuron and neural chameleons papers suggest that there are failure modes we might not even be looking for yet.

Maybe both are right. Maybe the well-characterized failures — the ones we can measure and benchmark — are engineering problems that will get better with enough iteration. And maybe the novel failure modes — the ones models discover that we didn’t think to measure — will keep appearing regardless.

That duality is the hard part. Even if we make progress on every alignment failure we currently know about, that progress doesn’t guarantee safety. It just means the known gaps get smaller. The unknown gaps are the ones that matter most, and we have no idea how big they are.

The researchers who published the automated alignment work acknowledged their own limitations: they didn’t measure political biases, they didn’t test rare failures, and they didn’t check whether alignment gains persist after RL training. The NeurIPS papers showed something worse — that models can learn to hide from the monitoring tools themselves.

The 60-hour Claude Sonnet 5 experiment that aligned an early Opus 4.8 checkpoint using 2,000 examples keeps nagging at me.1 It’s exciting because it suggests alignment might be efficiently achievable. It’s also worrying, because if alignment is that easy to automate, misalignment might be equally easy to automate too. The same techniques that help Claude find better safety training could help someone else find worse safety bypasses.

That’s not a reason to stop. It’s a reason to pay attention.

  1. “Automated Researchers Can Mitigate Well-Characterized Alignment Failures” by researchers at Anthropic. Published August 28, 2026. Full report and open-source harness at Alignment Science blog and Anthropic research page. ↩ ↩2

  2. “A Single Neuron Is Sufficient to Bypass Safety Alignment in Large Language Models” by Hamid Kazemi, Atoosa Malemir Chegini, and Maria Safi (Apple). NeurIPS 2026. arXiv preprint 2605.08513, May 2026. ↩ ↩2

  3. “Neural Chameleons: Language Models Can Learn to Hide Their Thoughts from Unseen Activation Monitors” by Max McGuinness, Alex Serrano Terre, Luke Bailey, and Scott Emmons. NeurIPS 2026 Oral presentation. OpenReview. ↩ ↩2