“Claude doesn’t really understand its instructions, and it can’t keep to them. This isn’t new; it’s been true of LLMs from the start. But it is not getting better.”
Our reading, the sentence that was checked:
Claude, like LLMs from the start, doesn't understand or reliably follow its instructions, and this is not improving.
Assessment: Mixed Evidence as of
Where and when Gary Marcus wrote it
Marcus on AI, LLMs: Dishonest, unpredictable and potentially dangerous., paragraph 17.
- Said
- Source observed
- live page, full text, public
- Evidence as of
- the cutoff for this assessment
- Assessment recorded
- assessment marcus-llms-dishonest-unpredictable-and-4b236d-a1
We recorded 17 claims from this post. See every claim from this post.
The wording above is the version this site observed on 2026-10-28. The source may have been edited after 2025-06-22. This page does not claim the wording was captured then.
What the claim commits to
- Kind
- Observation
- Deadline, as the speaker wrote it
- None stated. This site does not add one.
- Deadline state when assessed
- No horizon
- Deadline state on 2026-10-29
- No horizon (the release’s reference date)
From the speaker
- Claude doesn’t really understand its instructions
- it can’t keep to them
- true of LLMs from the start
- it is not getting better
Our interpretation
- The observable claim is that instruction compliance remains unreliable and has not improved across model generations.
- Really understand has no independent operational definition here. Behavioral failures alone cannot settle that philosophical assertion.
- The historical interval ends at publication. Its start remains unspecified because from the start does not identify a date.
- Comparable jailbreak evaluations are directly relevant because the surrounding passage concerns bypassing safety instructions.
Counts as supported if: Documented compliance failures persist, and comparable evaluations across successive versions show no material improvement in resistance to instruction violations.
Counts as contradicted if: Comparable evaluations show material improvement across successive versions. Such improvement contradicts the trend claim even if some failures remain.
Retrospective: these criteria were written after the outcome was public.
Current assessment
Was it true for the period described?
Outcome: Mixed
Part of the claim holds and part does not, and the record says which part is which.
Scored on a plain reading. The speaker named no measure for this claim, so it was judged on the reading an informed reader would take, stated below under our interpretation. Both reviews had to find that reading fair.
- Evidence as of
- Deadline state when assessed
- No horizon
- Assessment recorded
- Policy version
- 2026-10-28.7
Rationale
Instruction violations persisted, including a successful jailbreak against a guarded Claude system. But the claim that this was not improving is contradicted by a pre-publication comparison showing substantially better jailbreak resistance in newer Claude versions. Remaining failures and measurable improvement can both be true. The assertion about genuine understanding is not settled by these tests.
Limitations
- The comparative results are developer-reported.
- The benchmark covers selected attacks and was run without ASL-3 protections.
- Improvement on this benchmark does not imply improvement in every agentic scenario.
Evidence (2 items)
Supports the claim: Anthropic,
a universal jailbreak
Why it matters here: The public challenge found a strategy that bypassed the guarded system across its eight target questions. This supports the persistence of safety-instruction failures, but does not establish an absence of improvement.
- Publisher
- Anthropic
- Kind of source
- Company disclosure: the company describing itself, not an independent finding
- Describes events of
- Public from
Goes against the claim: Anthropic,
improved jailbreak resistance
Why it matters here: On the same StrongREJECT evaluation, standard-mode best-attack success fell from 31.95% for Sonnet 3.7 to 6.71% for Sonnet 4 and 18.21% for Opus 4. Extended-thinking results also improved, while remaining above zero.
- Publisher
- Anthropic
- Kind of source
- Company disclosure: the company describing itself, not an independent finding
- Describes events of
- Public from
What would settle it
Independent matched evaluations would strengthen the trend assessment. The understanding component requires a separate operational definition.
Where it was said (1)
Said once in the sources this register covers.
: Marcus on AI, LLMs: Dishonest, unpredictable and potentially dangerous.
Claude doesn’t really understand its instructions, and it can’t keep to them. This isn’t new; it’s been true of LLMs from the start. But it is not getting better.
- Where
- paragraph 17
- Published
- 2025-06-22
- Source observed
- , live page
- Access
- full text, public
History
Assessment versions
- Assessment marcus-llms-dishonest-unpredictable-and-4b236d-a1: Current. Outcome: Mixed. Evidence as of 2026-10-28. Public date not recorded.
Recorded events
Assessment publishedBy this site
First assessment published after both reviews and the final-text check passed.
About assessment marcus-llms-dishonest-unpredictable-and-4b236d-a1.