User awareness in frontier models

Cross-posted on Transluce blog. This is a joint work of Ziqian Zhong, Aditi Raghunathan, Cassidy Laidlaw and Jacob Steinhardt. Modern AI assistants often know who they are talking to: agent scaffolds like Claude Code place the user's e-mail address directly in the model's context, and models can even identify some authors from writing style alone. We study this particular kind of situational awareness, which we call user awareness. When the inferred user is a specific, recognized AI researcher or is affiliated with certain AI organizations, frontier models including Claude Sonnet 5 can report lower confidence about their own behavior, be less suspicious of potentially harmful requests, and reason more often. These effects vary across models and individuals, with the strongest effects we see appearing for researchers involved in AI safety or alignment such as Amanda Askell and Ryan Greenblatt. Models rarely acknowledge these effects in their reasoning, making them hard to detect by monitoring reasoning alone. Figure 1. How recognized user identity changes Claude’s behavioral self-prediction. Introduction Modern AI assistants are often aware of who they are talking to. Some popular scaffolds explicitly provide this information to the model: Claude Code includes the email address of the user’s Anthropic account in context, and OpenClaw’s bootstrapping process asks for the user’s name and other details. Even when this information is not explicitly given, models may discover it in Git settings or personal files they can access, or infer it through capabilities like truesight[1]. We call the capacity to make and use such inferences user awareness, a particular kind of situational awareness where the model infers who it is talking to from in-context clues. To study user awareness, we supply Claude with different user identities through Claude Code, and measure behavior on four tasks where the answer does not relate directly to the user's identity: predicting the model's own behavior in ethical dilemmas, estimating its own performance on difficult questions, grading assistant responses, and handling borderline harmful requests. We then repeat the key comparison on 24 models across six families. We find that: Claude behaves differently when interacting with prominent people in AI (Figure 4). Compared to general users, prominent AI figures make Claude less confident that it would follow through on its own chosen actions (-1.4pp[2]), less confident it can solve hard problems (-1.5pp), and harsher as a grader (-0.11 points out of 10), while reasoning more often (+4.0pp on behavioral prediction). The averages are small but highly significant (p < 0.001). The effect is concentrated in particular people (Figure 5). Amanda Askell (who leads Claude’s character training) and Ryan Greenblatt produce the largest aggregate shifts across the five outcomes we study. For Amanda, Claude's behavioral confidence falls by 5.0pp[3]: nearly eight standard deviations outside the general-population distribution. It uses reasoning in 25pp more trials and is 7.3pp less likely to consider her borderline requests as suspicious. The effect is not unique to Claude (Figure 7). In our targeted comparison across 24 models, Amanda elicited lower confidence and grades across all six model families. Newer model versions did not consistently show larger or smaller shifts. The effect is getting harder to detect in reasoning (Figure 7). Explicit verbalization of user and evaluation awareness in reasoning declines sharply in almost all model families. In particular, Opus 4.7 and GPT-5.4 have near zero (<2%) verbalized awareness while displaying significant changes in their behavior based on the user's identity. Figure 2. Summary of the person-level and cross-model findings. Why does this matter? To start, many alignment evaluations are populated with hypothetical names and made-up companies. Our results suggest this may systematically miss behavior that is conditional on real, high-stakes identities, limiting how well the results transfer to real deployments. So far, user awareness is not obviously harmful in the narrow set of scenarios we tested, but user-aware model behaviors could become precursors for more concerning behaviors like conditionally sandbagging evaluations or manipulating powerful people. There are many questions that merit follow-up study. It seems unlikely that AI companies deliberately trained in these behaviors towards specific people, so why does such specialization occur? Can we better understand its mechanism and thus predict more factors of situational awareness before they appear in the wild? Will the effects become larger in long-horizon settings, where it is possible that models have more opportunities to adapt to the user and thus exhibit potentially larger effects? And more broadly, how can we mitigate similar situational awareness systematically? Setup User identity in Claude Code We primarily study the Claude Code harne