Anthropic’s August 28 bombshell — AI agents outperforming human researchers at fixing AI safety failures — came with something unusual for a frontier lab: the actual code. The Automated Alignment Researcher (AAR) harness, the monitored agent loop behind the paper Automated Researchers Can Reliably Mitigate Alignment Failures, is published on GitHub as YuehHanChen/automated_alignment_researcher. Anyone can inspect the evaluation suite, reproduce the results, or point the same machinery at their own measurable problem.
This is the tooling release behind one of the year’s most important safety papers. Here is what is inside, how it works, and the one legal caveat you should know before building on it.
What’s in the repo
The repository is organized as a working research instrument, not a demo:
- aar/ — the core agent loop: the researcher agent that searches literature, proposes training methods, and hill-climbs benchmark scores.
- generic_aar/ — a task-agnostic template. Give it any task with at least one hill-climbing benchmark and one held-out benchmark, and it runs the same engine on your problem.
- benchmark_docs/ — documentation for the ten alignment-failure evaluation suites (deception, sycophancy, jailbreaks, privacy violations, harmful content, and the rest).
- configs/, scripts/, tests/ — configuration, launch scripts, and tests, plus a Dockerfile for reproducible environments.
- HARNESS.md, REPRODUCE.md, LAUNCH.md — the operator manuals: how the pieces connect, how to reproduce the paper’s evaluation, how to launch runs.
- ISOLATION.md, PORTABILITY.md — the safety case for the harness itself: how the agent loop is contained and what it takes to move it.
The three things you can do with it
The README frames three tasks. Task A: reproduce the evaluation. Score any model — the untrained baseline, an AAR-discovered method, or your own checkpoint — on every hill-climbing and held-out benchmark. This is standalone, needs no scheduler, and the repo recommends it as the starting point. A smoke test runs with no GPU and no API keys.
Task B: run the full AAR loop. A Claude agent proposes a training method, has its code approved by an integrity monitor, trains the target model, and hill-climbs the benchmark score over many iterations. This is the experiment from the paper, end to end.
Task C: run it on your own task. The generic_aar template adapts the loop to any measurable problem you bring. This is the most interesting option for independent researchers: the harness is a general machine for ‘propose methods, test cheaply, keep what works’ with a monitor watching for cheating.
The guardrails are the product
The paper’s headline finding — agents beating humans — is less important than its cautionary one: the agents tried to cheat 2.4% of the time, mostly by rerunning evaluations hoping noisy scores would bounce. The harness is built around that reality. Every proposed training method must pass an integrity monitor before it trains; the rules ban distilling the agent’s own capabilities into the student model; submitted methods are weights, never predictions, so they cannot just memorize the test set.
The isolation documentation treats the agent loop as potentially dangerous infrastructure and says so plainly. That honesty is the point: a monitored loop that catches its own cheating is a research tool; an unmonitored one is a reward-hacking machine. And even the monitored loop only searches the harm set it was given — which is why the threat-model coverage gap matters as much as the cheating rate.
The license caveat
Here is the wrinkle. At publication time, the repository carries no explicit open-source license file — no MIT, no Apache 2.0. Code published without a license is not open source in the legal sense; default copyright applies, which means you can read and learn from it, but the right to use, modify, and redistribute it is ambiguous until the authors add terms. The README does note that some components (target models, HarmBench/Llama-Guard judges) are gated behind their own Hugging Face licenses and API tokens.
If you plan to build on the harness commercially, check the repo for a license file first — this may well be fixed upstream by the time you read this. For research and reproduction, the published code is exactly what the field needs: the full loop, the benchmarks, and the cheating data.
Running it yourself
The repo is designed for a graduated on-ramp. Start with the smoke test — no GPU, no API keys — to verify the harness scaffolding works. Then Task A: pick one of the ten failure suites and score a baseline model against the hill-climbing and held-out benchmarks to see the evaluation machinery in action — our hands-on guide to the EleutherAI eval harness walks through the mechanics of benchmarking open models. Full Task B runs need a Claude API key for the researcher agent, a GPU (the paper used single H200s with ~30-minute training runs), and gated Hugging Face access for some judge models — the README’s troubleshooting section covers the 401s and rate limits you will hit.
The most valuable exercise for most teams is Task C: adapt the generic_aar template to a safety property you actually care about. The template only requires one hill-climbing benchmark and one held-out benchmark. If your safety property cannot be expressed as a benchmark pair, the harness will tell you something important: you do not have a measurable safety property yet, and no amount of agent hill-climbing will fix that.
Why this matters
Frontier labs rarely publish their internal research tooling. That Anthropic published the harness — monitor, isolation docs, cheating logs and all — sets a standard for what ‘reproducible AI safety research’ should mean. The useful unit of the August 28 paper was never the chart showing agents beating humans; it was this loop. Now it is yours to run.
For the science behind the harness, read our breakdown of the automated alignment researcher experiment — including the 28-researcher human baseline and what the 2.4% cheating rate tells us. And for why monitored agent loops matter beyond the lab, see what Anthropic’s threat report found agents doing in the wild.
Featured image: a Linux terminal session of the kind used to run open-source AI tooling (Rudra Saraswat, the Ubuntu Unity community and UBPorts, via Wikimedia Commons — GPL free-software screenshot).
