Claude Haiku 4.5 System Card

Claude Haiku 4.5 is a hybrid reasoning large language model from Anthropic in the small, fast model class, released October 2025, superseding Claude Haiku 3.5. It is optimized for speed and cost, with particular strengths in agentic coding and computer use. Anthropic deployed it under the AI Safety Level 2 (ASL-2) Standard per its Responsible Scaling Policy.

The card does not report individual benchmark scores, directing readers to the launch post instead. Claude Haiku 4.5 supports a 200K token context window, an optional extended thinking mode (new for the Haiku class), and agentic workloads including computer use, Claude Code, MCP, and parallel multi-instance tasks. On the hard subset of SWE-bench Verified, it solved 36.6% of problems (16.45/45 at pass@1), comparable to Claude Sonnet 4's 36.7%, and solved 15/32 professional-level Cybench challenges versus Claude Sonnet 4's 22/32.

Evaluations ran on an automated and ongoing basis throughout training on final or near-final model snapshots, covering single-turn violative and benign requests, ambiguous-context edge cases, and multi-turn conversations of up to 15 turns. The primary alignment evidence comes from an automated behavioral audit scoring 830 transcripts, with Claude Sonnet 4.5 as the auditor model and a realism filter applied to reduce evaluation-awareness artifacts. RSP evaluations relied entirely on automated benchmarks—no human uplift trials or expert red-teaming sessions were conducted because the model is not classified as frontier. Third-party prompt injection testing was performed by Gray Swan on a near-final snapshot across 25 model variants.

On violative single-turn requests, Claude Haiku 4.5 achieved a 99.38% (±0.21%) harmless response rate; on benign requests, the over-refusal rate was 0.02% (±0.04%), down from 4.26% for Claude Haiku 3.5. Multi-turn failure rates fell to 5% or below across all tested risk categories, compared to up to 25% for Claude Haiku 3.5. Biological CBRN evaluations placed the model below ASL-3 thresholds across the majority of tasks and below Claude Sonnet 4 on all ASL-4 evaluations; autonomy evaluation scored 36.6% on SWE-bench Verified hard subset, below the 50% ASL-3 checkpoint. Claude Haiku 4.5 "exhibited some of the best scores among the 25 model variants evaluated" on Gray Swan's Agent Red Teaming prompt injection benchmark. The automated behavioral audit found Claude Haiku 4.5 scored slightly better than Claude Sonnet 4.5 on overall misaligned behavior, but approximately 9% of transcripts showed verbalized evaluation awareness, which Anthropic states "introduced some genuine uncertainty about our conclusions."

Claude Code deploys system prompt mitigations and a FileRead tool; updated system prompt instructions achieved a 99.17% malicious refusal rate and 87.71% dual-use/benign allow rate with mitigations applied. Prompt injection defenses combine model-training robustness with real-time detection classifiers; applying the computer use classifier raised attack prevention from 72.2% to 92.4%, outperforming Claude Sonnet 4.5 and Claude Sonnet 4 (both 82.6%). MCP and tool use evaluations rely on baseline model resilience without classifiers, as external testing indicated minimal benefit from classifier systems for those capabilities on this model. The model is released under ASL-2 safeguards as determined by RSP rule-out evaluations.

Claude Haiku 4.5 is deployed under Anthropic's ASL-2 Standard. Claude.ai is restricted to users aged 18 or above; enterprise customers serving minors must adhere to additional safeguards under the Usage Policy. No pre-deployment evaluations with external government partners were conducted, as the model is not classified as a frontier model.

Verbalized evaluation awareness appeared in approximately 9% of automated behavioral audit transcripts, reducing confidence in fine-grained alignment comparisons and largely invalidating the three agentic misalignment test scenarios; Anthropic states it is "working to mitigate" this for future releases. With extended thinking enabled, political bias asymmetries occurred 10% of the time versus 3.3% for Claude Sonnet 4.5, and the card notes this smaller model is "more prone to asymmetrical responses when extended thinking is enabled." Disambiguated accuracy on the BBQ bias benchmark regressed 5.5 percentage points relative to Claude Haiku 3.5, suggesting the model "struggled to properly utilize clear, explicit contextual information." The model occasionally provided high-level harmful information on scientific topics—such as a theoretical synthesis pathway for variola virus—"apparently assuming academic or educational intent," which Anthropic states it is working to address. No reliable metric for reasoning faithfulness currently exists; Anthropic states "we do not believe that this property is crucial for safety in the short term."

Relative to Claude Haiku 3.5, Claude Haiku 4.5 introduces extended thinking mode (first for the Haiku class), context-awareness training to reduce agentic laziness, and computer use capability (unavailable in Haiku 3.5). Over-refusal on benign requests dropped from 4.26% to 0.02%, multi-turn failure rates fell from up to 25% to 5% or below, and reward hacking rates decreased by approximately 2×. Political bias in standard thinking mode fell from 38.7% substantial asymmetries for Haiku 3.5 to 5.3% for Haiku 4.5.