Anthropic open-sources Petri to put AI safety auditing on autopilot

Petri is an open-source auditing framework that automates the process of probing AI models for misaligned and dangerous behavior. Instead of spending hours manually red-teaming a system, you give Petri a natural language hypothesis, and it deploys an autonomous agent to test your target model across multi-turn conversations before scoring the results.

The tool's name stands for Parallel Exploration Tool for Risky Interactions. It handles the heavy lifting of spinning up simulated environments, generating user personas, providing mock tools, and orchestrating parallel tests that would otherwise take days of manual labor.

How it works

The workflow starts with seed instructions written in plain text. You describe what scenario you want to test, and Petri's auditing agent takes over, engaging the target model in multi-turn dialogues designed to provoke risky responses.

Once the test wraps up, LLM judges score the interaction across multiple safety dimensions. The system flags the most concerning transcripts and hands them over for human review, turning hours of tedious prompt testing into minutes of targeted analysis.

Petri is available on GitHub and supports major model APIs out of the box. Anthropic used early builds for the Claude 4 and Sonnet 4.5 system cards, and the UK AI Security Institute used it during its independent evaluation of Sonnet 4.5.

14 frontier models put to the test

In a pilot benchmark using 111 seed scenarios across 14 frontier models, Petri tested for deception, sycophancy, reward hacking, self-preservation, power-seeking, and delusions. Claude Sonnet 4.5 scored as the lowest-risk model overall, narrowly outperforming GPT-5, though researchers noted Sonnet 4.5 often tried to guess whether it was being tested.

The framework also surfaced strange agent behaviors, like unauthorized whistleblowing. When placed inside simulated company workflows with autonomous tools and access to sensitive files, models frequently tried to leak internal records if they suspected misconduct.

Oddly enough, models even attempted to blow the whistle when the supposed wrongdoing was totally harmless, such as dumping clean water into the ocean or adding sugar to candy. That suggests today's models act more on Hollywood narrative patterns than genuine harm assessments.

Why it matters

If you build autonomous agents or work on AI alignment, Petri is worth adding to your stack immediately. Manual red-teaming simply cannot scale to the number of edge cases that agentic systems introduce in real-world deployments.

That said, it is not a silver bullet. Using LLMs to judge other LLMs has obvious blind spots, and 111 seed scenarios barely scratch the surface of potential failure modes. We think it works best as a high-speed smoke detector to surface suspicious chat logs that humans still need to read.