# Agent safety needs real-world testing beyond labs and evals

Markdown copy of https://realalpha.app/s/agent-safety-needs-real-world-testing-beyond-labs-and-evals/ on Real Alpha, the best minutes from long interviews with the people building AI. Cite and link the page, not this copy.

- Speaker: [Boris Cherny](https://realalpha.app/builders/boris-cherny/) · Boris Cherny is creator and head of Claude Code at Anthropic. · Created Claude Code at Anthropic and leads its team; previously spent about five years at Meta.
- Host: [Lenny Rachitsky](https://realalpha.app/people/lenny-rachitsky/) · Host, Lenny's Podcast · Spent seven years at Airbnb; his product newsletter has over 1M subscribers.
- Show: Lenny's Podcast
- Episode: [Head of Claude Code: What happens after coding is solved | Boris Cherny](https://realalpha.app/v/We7BZVKbCVw/), Feb 19, 2026
- Moment: 54:21 to 59:45 of the episode (5 min), playing on https://realalpha.app/s/agent-safety-needs-real-world-testing-beyond-labs-and-evals/; the episode from there: https://realalpha.app/v/We7BZVKbCVw/?t=3261

## Takeaways

1. Interpretability and evaluations are only two layers of safety.
2. Claude Code ran inside Anthropic for four or five months before release.
3. Real-world use can expose behavior synthetic tests miss.

## About this segment

Boris Cherny describes safety as model interpretability, controlled evaluations, and observing agents in real use. Claude Code was tested internally for four or five months before release, while real-world feedback helps surface risks.

From “Head of Claude Code: What happens after coding is solved | Boris Cherny”, Feb 19, 2026. [Watch the full episode](https://realalpha.app/v/We7BZVKbCVw/)

## Transcript

Transcribed by machine (Whisper) from the episode’s audio, so a word may be off here and there.

[54:27](https://realalpha.app/v/We7BZVKbCVw/?t=3267) didn't really know. Let's put it out there and see what people do with it. Yeah. And for anthropic as a safety lab, the other dimension of that is safety. Because when you think about model safety, there's a bunch of different ways to study it. Sort of the lowest level is alignment and mechanistic interpretability. So this is when we train the model, we want to make sure that it's safe. We at this point have pretty sophisticated technology to understand what's happening in the neurons to trace it. And so for example, if there's a neuron related to deception, we're starting to get to the point where we can monitor it and understand that it's activating.

[55:00](https://realalpha.app/v/We7BZVKbCVw/?t=3300) And so this is just this alignment. This is mechanistic interpretability. It's like the lowest layer. The second layer is evals. And this is essentially a laboratory setting. The model is in a petri dish and you study it and you put in a synthetic situation and just say, okay, like model, what do you do? And are you doing the right thing? Is it aligned? Is it safe? And then the third layer is seeing how the model behaves in the wild. And as the model gets more sophisticated, this becomes so important because it might look very good on these first two layers, but not great on the third one. We released Claude Code really early because we wanted to study safety. And we actually used it within Anthropic for I think four or five months or something before we released it, because we weren't really sure. Like this is the first agent that, you know, the first big agent

[55:44](https://realalpha.app/v/We7BZVKbCVw/?t=3344) that I think folks had released at that point. It was definitely the first, you know, coding agent that became broadly used. And so we weren't sure if it was safe. And so we actually had to study it internally for a long time before we felt good about that. And even since, you know, there's a lot that we've learned about alignment. There's a lot that we've learned about safety that we've been able to put back into the model, back into the product. And for co-work, it's pretty similar.

[56:06](https://realalpha.app/v/We7BZVKbCVw/?t=3366) The model's in this new setting. It's doing these tasks that are not engineering tasks. It's an agent that's acting on your behalf. It looks good on alignment. It looks good on evals. We tried it internally. It looks good. We tried it with a few customers. It looks good. Now we have to make sure it's safe in the real world. And so that's why we release a little early. That's why we call it a research preview. But yeah, it's constantly improving. And this is really the only way to make sure that over the long term, the model is aligned and it's doing the right things. It's such a wild space that you work in where there's this insane competition and pace. At the same time, there's this fear that if you get, you know, the God can escape and cause damage and just finding that balance must be so challenging. What I'm hearing is there's kind of

[56:49](https://realalpha.app/v/We7BZVKbCVw/?t=3409) these three layers and I know there's like, this could be a whole podcast conversation is how you all think about the safety piece. But just what I'm hearing is there's these three layers you work with. There's kind of like observing the model thinking and operating. There's tests, evals that tell you this is doing bad things and then releasing it early. I haven't actually heard a ton about that first piece. That is so cool. So you guys can, there's an observability tool that can let you peek inside the model's brain and see how it's thinking and where it's heading.

[57:16](https://realalpha.app/v/We7BZVKbCVw/?t=3436) Yeah, you should at some point have Chris Ola on the podcast because he's just the industry expert on this. He invented this field of, we call it mechanistic interpretability. And the idea is, you know, like at its core, like what is your brain? Like what are, what is it? It's like, it's a bunch of neurons that are connected. And so what you can do is like in a human brain or animal brain, you can study it at this kind of mechanistic level to understand what the neurons are doing. It turns out surprisingly, a lot of this does translate to models also. So model neurons are not the same as animal neurons, but they behave similarly in a lot of ways.

[57:50](https://realalpha.app/v/We7BZVKbCVw/?t=3470) And so we've been able to learn just a ton about the way these neurons work, about, you know, this layer or this neuron maps to this concept, how particular concepts are encoded, how the model does planning, how it thinks ahead. You know, like a long time ago, we weren't sure if the model is just predicting the next token or is doing something a little bit deeper. Now I think there's actually quite strong evidence that it is doing something a little bit deeper.

[58:13](https://realalpha.app/v/We7BZVKbCVw/?t=3493) And then the structures that way to do this are pretty sophisticated now, where as the models get bigger, it's not just like a single neuron that corresponds to a concept. A single neuron might correspond to a dozen concepts. And if it's activated together with other neurons, this is called superposition. And together, it represents this more sophisticated concept. And it's just something we're learning about all the time.

[58:35](https://realalpha.app/v/We7BZVKbCVw/?t=3515) You know, for anthropic, as we think about the way this space evolves, doing this in a way that is safe and good for the world is just this is the reason that we exist. And this is the reason that everyone is adanthropic. Everyone that is here, this is the reason why they're here. So a lot of this work, we actually open source, we publish it a lot. And, you know, we publish very freely to talk about this, just so we can inspire other labs that are working on similar things to do it in a way that's safe. And this is something that we've been doing for CloudCode.

[59:04](https://realalpha.app/v/We7BZVKbCVw/?t=3544) Also, we call this the race to the top internally. And so for Cloud Code, for example, we released an open source sandbox. And this is a sandbox they can run the agent in. And it just makes sure that there are certain boundaries and it can't access everything on your system. And we made that open source. And it actually works with any agent, not just Cloud Code, because we wanted to make it really easy for others to do the same thing.

[59:28](https://realalpha.app/v/We7BZVKbCVw/?t=3568) So this is just the same principle, race to the top. We want to make sure this thing goes well. And this is just the, this is the lever that we have. Incredible. Okay. I definitely want to spend more time on that. I will follow up with this suggestion.