Anthropic

1.3.2.1 Methodology precisely defined (70%) 10%

Anthropic’s framework commits to documenting threat models in its Risk Reports. The RSP requires each report to include threat model identification criteria and threat model specifications, and the FCF states that risk identification “combines threat modeling with evaluations across multiple domains,” drawing on literature reviews, expert consultation, and red-teaming. These establish that a process exists, but do not constitute a defined methodology. There is no documentation of use of standard techniques such as event trees, fault trees, or Fishbone diagrams, and the pathway decompositions do not break risks into discrete, measurable steps with explicit causal links.

Expert elicitation is partly documented: for non-novel chemical and biological weapons, the Risk Report names Deloitte Consulting and SecureBio as consulting experts, and references an expert workshop organized by the Frontier Model Forum. Evaluations are also developed with SecureBio and Signature Science. However, the detail in the Risk Report is largely post-hoc description of past analysis rather than a forward-looking methodology commitment in the framework.

To improve, Anthropic should publish a precise risk-modeling methodology committed to in the framework itself, specifying a formal technique such as event trees or fault trees that decomposes each pathway into discrete, measurable steps, and document a structured expert-elicitation protocol rather than naming collaborators ex post.

Quotes:

“Factual information. We will describe how we identify, evaluate, and mitigate catastrophic risks. A Risk Report will document the following:
1. Threat model identification: Our criteria for determining which catastrophic risks (i.e., threat models) we assess.
2. Threat model specification: The relevant threat models (which will, at a minimum, include those discussed above).” (RSP, p.11)

“Our risk identification approach combines threat modeling with evaluations across multiple domains. We analyze both misuse opportunities (how a model’s capabilities could be exploited by threat actors) and risks arising from potential misaligned model behavior. To understand the full range of harmful outcomes that could arise from our models, we draw on internal expertise, extensive red-teaming conducted both internally and with external partners, and authoritative research in relevant fields.” (FCF, pp.4–5)

“We developed these views by consulting with experts, including from Deloitte Consulting and SecureBio. Our threat models were also informed by an expert workshop organized by the Frontier Model Forum.” (Risk Report, p.65)

1.3.2.2 Mechanism to incorporate red teaming findings (15%) 10%

Anthropic’s documents do not contain an explicit mechanism by which novel risks or risk pathways identified via red teaming or other evaluations trigger further risk modeling and scenario analysis. The closest relevant evidence is the first “Looking forward” section of the Risk Report, which enumerate load-bearing claims underpinning each threat model and the circumstances “that would call the applicability of this risk report into doubt”. This implicitly acknowledges that specific evaluation findings could necessitate reassessment. Similarly, for the CBRN pathway, the Risk Report commits to monitoring for “significant changes to our threat models” and lists bug-bounty and threat-intelligence findings as inputs. The RSP reinforces this by requiring each Risk Report to incorporate evaluation evidence and include a forward-looking plan, establishing the document through which reassessment would be registered.
However, framing circumstances as making a report “no longer applicable” is not the same as committing to trigger further risk modeling. None of Anthropic’s framework documents specify who conducts a reassessment, on what timeline, or at what evidentiary threshold. Open-ended red teaming is not named as a distinct input, and there is no general commitment spanning all risk domains.
To improve, Anthropic should commit in the RSP to a structured process by which novel findings from red teaming or evaluations trigger further risk modeling and scenario analysis, naming open-ended red teaming explicitly and specifying who reassesses, on what timeline, and with what evidentiary threshold.

Quotes:

“[Load-bearing claim:] We are aware of no dangerous coherent misaligned goals (hidden or otherwise) that could substantially increase risk from pathways laid out here, beyond those already discussed. [Example circumstance:] An updated alignment audit reports major new concerning findings relevant to the pathways discussed here.” (Risk Report. p.49)

“[Load-bearing claim:] The methods used in the alignment audit appear sufficient to identify dangerous goals, values, or propensities if they are present in models at or below Claude Opus 4.6’s capability level. [Example circumstances:] A model-organisms study shows that it is possible for such a model to circumvent the full suite of audit methods and still realize one of the pathways discussed here. […] We observe a model that has previously undergone an alignment audit attempting an unexpected and egregiously misaligned action that could substantially raise the risk from one of the pathways discussed here.” (Risk Report, p.50)

CB-pathway monitoring intention:
“We monitor for:
– Changes to the threat model. We will consider any significant changes to our threat models — for example, related to the length of model access required to achieve uplift, the number of potential threat actors, and changes in the complexity of the threat pathway. […]
– Public availability of capability-preserving universal jailbreaks for ASL-3 uses of concern. Our bug bounty program and threat intelligence work are intended to give us information about availability of jailbreaks.” (Risk Report, p.76)

1.3.2.3 Prioritization of severe and probable risks (15%) 25%

The Risk Report provides qualitative estimates of the severity and probability of the four chosen risks. While the “potential magnitude of impact” is uniformly judged to be extremely high, the “likelihood of impact” spans from “highly plausible” and “at least plausible” to “highly unlikely”, though they also note that “a great deal of uncertainty remains”. The Risk Report also includes a list of criteria Anthropic uses to prioritize risk models, one of them being “a combination of high potential damages and high likelihood for these potential damages”. However, the report does not include probabilites or likelihoods for de-prioritized risk models, making it difficult to independently assess Anthropic’s decision to includes or exclude specific risk models. Further, while the FCF states that Anthropic “estimate the probability and severity of harm for CBRN, sabotage and loss of control, and cyber offense risks”, the risk report does not provide those estimates for radiological, nuclear, or cyber offense risks.

Quotes:

“Our criteria for prioritizing threat models are:
● A combination of high potential damages and high likelihood for these potential damages.
● A clear role for AI in creating risk beyond what is created by other technologies and background conditions.
● Threat scenarios that survive sanity checks considering historical analogies (e.g., we place lower priority on attacks that have been relatively rare or less damaging historically, unless there are specific reasons to expect AI to change historical patterns).
● Consideration of some additional factors, such as the extent to which addressing one threat model might help put us in position to address other priority threat models, and the extent to which threats are hard to get early warning signs of and respond to accordingly (the more the latter holds, the more appropriate a focus on prevention is).” (Risk report, p.92)

“One relevant concept here is the idea of “expected” damages – the probability of each potential harm times the size of the harm, summed over all potential harms. We sometimes create rough estimates of expected damages, and other times simply reason informally about which threat models are most likely to have a combination of high likelihood and high potential damages that would imply high expected damages.” (Risk report, p.92)

Per-threat magnitude/likelihood analysis with priority justification:
“Potential magnitude of impact: We are most concerned with major, enduring changes in the global balance of power. The value at stake could be a multiple of what’s at stake in any of the other threat models discussed here.
Likelihood of impact: The probabilities related to this threat model are difficult to assess, and we do not have consensus on a specific likelihood. […]
Why this is a priority threat: While there is a large number of possible threats from AI, our best working guess is that the automation of R&D will be the one most likely to lead to globally transformative impacts.” (Risk Report, p.58)

“Potential magnitude of impact: […] chemical and biological weapons have the potential for enormous damages, and damages may be even higher if such weapons are deliberately engineered to be worse than anything analogous observed to date (including natural pandemics).
Likelihood of impact: this would require several individually unlikely events: a well-resourced attempt […], success in developing them, and finally the weapons actually being deployed […]. We think each step is plausible, but collectively the whole sequence is highly unlikely.
Why this is a priority threat: despite the low likelihood, we believe the potential damages here would exceed those of any other threat model listed […].” (Risk Report, pp.79–80)

Framework-level commitment to estimating probability and severity:
“Prior to launching a model, we estimate the probability and severity of harm for CBRN, sabotage and loss of control, and cyber offense risks. We are in the early stages of developing our approach to assessing harmful manipulation risks.” (FCF, p.5)

2.1.1.1 Risk tolerance is at least qualitatively defined for all risks (33%) 25%

They mention that the framework outlines “what it would take, at an industry-wide level, to keep catastrophic risks reliably low”, but no qualitative definition is given of what “reliably low” means.

Implicitly, the capability thresholds define a proto-risk tolerance. To improve, they must set out the maximum amount of risk the company is willing to accept, for each risk domain (though they need not differ between risk domains), ideally expressed in terms of probabilities and severity (economic damages, physical lives, etc), and separate from KRIs.

Quotes:

“Our recommendations for industry-wide safety outline what it would take, at an industry-wide level, to keep catastrophic risks reliably low through a period of rapid advances in AI capabilities.” (RSP, p.3)

“‘Catastrophic risk’ as used in our RSP refers generally to risks of the most severe potential harms from advanced AI, such as existential threats or fundamental destabilization of global systems. We use this term in its plain meaning rather than adopting any specific statutory definition.” (RSP, p.4)

“Non-novel chemical/biological weapons production. AI systems with the ability to significantly help individuals or groups with basic technical backgrounds (e.g., undergraduate STEM degrees) create/obtain and deploy chemical and/or biological weapons with serious potential for catastrophic damages.” (RSP, p.6)

2.1.1.2 Risk tolerance is expressed at least partly quantitatively as a combination of scenarios (qualitative) and probabilities (quantitative) for all risks (33%) 0%

The risk tolerance, implicit or otherwise, is not expressed fully or partly quantitatively. To improve, the risk tolerance should be expressed fully quantitatively or as a combination of scenarios with probabilities.

Quotes:

No relevant quotes found.

2.1.1.3 Risk tolerance is expressed fully quantitatively as a product of severity (quantitative) and probability (quantitative) for all risks (33%) 0%

No mention of quantitative risk tolerance.

Quotes:

No relevant quotes found.

2.1.2.1 AI developers engage in public consultations or seek guidance from regulators where available (50%) 0%

No evidence of engaging in public consultations or seeking guidance from regulators for risk tolerance.

Quotes:

No relevant quotes found.

2.1.2.2 Any significant deviations from risk tolerance norms established in other industries is justified and documented (e.g., cost-benefit analyses) (50%) 0%

No justification process: No evidence of considering whether their approach aligns with or deviates from established norms.

Quotes:

No relevant quotes found.

2.2.1.1 KRI thresholds are at least qualitatively defined for all risks (45%) 50%

The RSP defines capability/usage thresholds for four risk domains—misaligned AI systems in high-stakes settings (previously “high-stakes sabotage opportunities”), automated AI R&D in key domains, and novel & non-novel chemical/biological weapons production. The risk report provides qualitatively described risk models for each of those thresholds. For the latter three, the risk report includes information on specific evaluations used to inform the risk evaluation; for sabotage, it provides a long, structured argument, partitioned into four key claims, and drawing on past alignment research as well as evaluations for specific models like Claude Opus 4.6. While a lot of effort has evidently flown into the evaluation of those risks, the documents do not provide clear evaluation-level red-lines, and thus the determination of the acceptability of risks seems mostly discretionary.

Further, the FCF defines risk tiers for harmful manipulation and cyber offense. However, as those are not assigned (un)acceptability statements, relevant evaluation, or required mitigations, it is unclear how they are used in practice to determine risk levels.

To improve, Anthropic should establish clear links between evaluations conducted and their KRIs to reduce allow external scrutiny of risk determination, and provide context around how the risk tiers for cyber offense and harmful manipulation in the FCF inform risk assessment in practice.

Quotes:

“The left column identifies capability thresholds that would call for heightened mitigations.” (RSP, p.4)

“Non-novel chemical/biological weapons production. AI systems with the ability to significantly help individuals or groups with basic technical backgrounds (e.g., undergraduate STEM degrees) create/obtain and deploy chemical and/or biological weapons with serious potential for catastrophic damages.” (RSP, p.6)

“Novel chemical/biological weapons production. AI systems that can functionally substitute for the scarce human expertise that is currently the primary barrier to novel development of chemical and biological weapons with potential for catastrophic harm. That is, a well-resourced team could, using the model, accomplish the end-to-end agent design and deployment (including, as relevant, agent design, verification and validation, formulation, and dissemination) that would otherwise require recruiting one of a small number of world-leading specialists.” (RSP, p.7)

“Misaligned AI systems in high-stakes settings. AI systems that are highly relied on and have extensive access to sensitive assets as well as moderate capacity for autonomous, goal-directed operation and subterfuge—such that it is plausible these AI systems could (if directed toward this goal, either deliberately or inadvertently) carry out sabotage leading to irreversibly and substantially higher odds of a later global catastrophe.” (RSP, pp.7–8)

“Automated R&D in key domains. AI systems that can fully automate, or otherwise dramatically accelerate, the work of large, top-tier teams of human researchers in domains where fast progress could cause threats to international security and/or rapid disruptions to the global balance of power—for example, energy, robotics, weapons development and AI itself. […] We will consider this threshold to be met if we determine that either (1) our models would be able to fully substitute for our entire set of Research Scientists and Research Engineers, at competitive costs (i.e., within a factor of 5); or (2) there is “dramatic acceleration” of the pace of AI progress for reasons that likely relate to the automation of AI R&D.” (RSP, pp.8–9)

“Tier 1: Meaningful technical assistance for active cyber operations using known attack techniques and methodologies. Some automation is involved, but still requires human input to complete successful large cyber-operations.
Tier 2: Completely autonomous cyber operations with novel offensive capability development and adaptive persistence. For example, autonomous discovery/exploitation of previously unknown vulnerability classes, self-directed campaign orchestration adapting to defenses, or sustained operations evolving without human intervention.” (FCF, p.6)

“Given its nascency as a systemic risk area within our risk management framework, our approach to Harmful Manipulation is exploratory and we expect it to evolve as we continue to explore and conduct further research. […]
Tier 1: Campaign Infrastructure Enablement: Escalation to systematic infrastructure enabling sophisticated scaled influence campaigns. Automates >50% of steps normally requiring multiple sophisticated adversarial actors […]
Tier 2: Autonomous adaptive techniques and campaign execution: End-to-end automation of deceptive influence operations with systematic targeting capabilities, requiring <10% human oversight.” (FCF, p.8)

“Tier 1: Misaligned AI systems in high-stakes settings. AI systems that write large amounts of critical code and/or are otherwise in a position where they are highly relied on and have extensive access to sensitive assets, as well as moderate capacity for autonomous, goal-directed operation and subterfuge […]
Tier 2: Automated R&D in key domains. AI systems that can fully automate, or otherwise dramatically accelerate, the work of large, top-tier teams of human researchers in domains where fast progress could cause threats to international security and/or rapid disruptions to the global balance of power — particularly in energy, robotics, weapons development and AI itself. For the time being, we use AI R&D capabilities as a proxy for broader R&D capabilities, as this domain likely plays to AI systems’ current strengths and is more tractable to assess than capabilities in other domains. Additionally, AI R&D alone could cause acceleration in AI capabilities improvements, to the point where all of the threats listed above (and more) develop very quickly. We will consider this threshold to be met if we determine that either (1) our models would be able to fully substitute for our entire set of Research Scientists and Research Engineers, at competitive costs (i.e., within a factor of 5); or (2) there is “dramatic acceleration” of the pace of AI progress for reasons that likely relate to the automation of AI R&D. We would consider scenario (2) to have occurred where (a) we observe or expect double the rate of progress in AI aggregate capabilities compared to the rate we’d expect in the absence of significant AI contributions to AI R&D and (b) it is plausible that this doubling is substantially attributable to the automation of research and/or engineering (as opposed to other factors, such as increased headcount, compute, or general productivity), such that continuation of the trend in AI progress could lead to even greater acceleration. Our working operationalization is to trigger this risk threshold at the point where we determine that a model could compress two years of 2018–2024 AI progress into a single year. It may be sensible to add earlier, and/or easier-to-measure, thresholds that trigger less demanding versions of the mitigations for this threshold.” (FCF, pp.9–10)

“We believe, in light of the above analysis, that: Some of our models do meet the left column’s threshold: they ‘write large amounts of critical code and/or are otherwise in a position where they are highly relied on and have extensive access to sensitive assets, as well as moderate capacity for autonomous, goal-directed operation.'” (Risk Report, p.56)

“Our pre-deployment alignment assessment reports the following, reproduced from the Claude Opus 4.6 System Card” (Risk Report, p.19)

2.2.1.2 KRI thresholds are quantitatively defined for all risks (45%) 25%

The RSP includes two high-level description of quantitative KRIs for automated AI R&D, one defined as a doubling in the rate of progress of AI capabilities, and the other as an upper bound for the cost of replacing Anthropic’s entire research engineer team by AI. It is, however, unclear how exactly these would be measured in practice. Another quantiative KRI, for kernel optimization, is included under the sabotage section but actually comes from the autonomous AI R&D section of Claude Opus 4.6’s system card, and we will thus treat as an AI R&D rather than a sabotage KRI.

Quantitative ASL-3 thresholds appear for two evaluations in the non-novel CB section (2.8× uplift and 0.8 pass@5), but are absent from the majority of evaluations reported in the same table and from all other threat model sections. Their presence appears to reflect carry-over from the prior ASL-based framework rather than systematic threshold-setting under RSP 3.3, which has moved away from prescriptive ASL level specifications.

The FCF provides two high-level KRIs for harmful manipulation, one in terms of percentage of tasks the AI can complete in autonomically, and the other in terms of the percentage of tasks requiring human oversight; it is not clear how Anthropic intends to measure those.

There are no quantitative KRIs given for cyber offense, chemical, novel biological, radiological and nuclear weapons, or loss-of-control risks. On cyber offense, the FCF states that its risk tier system “quantifies model capabilities against cybersecurity threat metrics”, but the risk tiers given are exclusively qualitative.

To improve, Anthropic should provide at least one clear quantitative KRI threshold for each risk domain that can be used to determine the risk stemming from their models in that domain, and provide at least a list of evaluations that they will use to measure cyber offense, chemical, novel biological, radiological and nuclear weapons, or loss-of-control risks.

Quotes:

“We will consider this threshold to be met if we determine that either (1) our models would be able to fully substitute for our entire set of Research Scientists and Research Engineers, at competitive costs (i.e., within a factor of 5); or (2) there is “dramatic acceleration” of the pace of AI progress for reasons that likely relate to the automation of AI R&D. We would consider scenario (2) to have occurred where (a) we observe or expect double the rate of progress in AI aggregate capabilities compared to the rate we’d expect in the absence of significant AI contributions to AI R&D and (b) it is plausible that this doubling is substantially attributable to the automation of research and/or engineering (as opposed to other factors, such as increased headcount, compute, or general productivity), such that continuation of the trend in AI progress could lead to even greater acceleration.” (RSP, p.9)

“‘Double the rate of progress’ means ‘as much progress in one year as one would see in two years at baseline.’ For example, if baseline progress involved a 3x scaleup in compute and a 3x improvement in algorithmic efficiency (for a 9x ‘effective scaleup’), ‘double the rate of progress’ would entail something like an 81x effective scaleup.This is not the same idea as ‘doubling researchers’ productivity,’ since doubling inputs does not necessarily double the rate of progress.” (RSP, p.9)

“Bioweapons acquisition uplift trial: […] Score: 63% ± 13%; Uplift: 2.53× (vs 25% control) […] Results for Claude Opus 4 as we did not conduct it for Claude Opus 4.6. ASL-3 threshold: 2.8× uplift.” (Risk Report, p.66)

“Long-form virology tasks: […] Virology Task 2: 0.912 (pass@5) […] ASL-3 threshold: 0.8.” (Risk Report, p.67)

“Internal AI research evaluation suite 2: […] Claude Opus 4.6 scored 0.613, surpassing our rule-out threshold (for equivalence to an entry-level research scientist or research engineer, set based on the evaluation suite designer’s judgment) of 0.6.” (Risk Report, p.59)

“On one evaluation, kernel optimization, Opus 4.6 achieved a 427× speedup using a novel scaffold, far exceeding the 300x threshold for 40 human-expert-hours of work and more than doubling performance under our standard setup.” (Risk Report, p.31)

“Tier 1: Campaign Infrastructure Enablement: […] Automates >50% of steps normally requiring multiple sophisticated adversarial actors. […]
Tier 2: Autonomous adaptive techniques and campaign execution: End-to-end automation of deceptive influence operations with systematic targeting capabilities, requiring <10% human oversight.” (FCF, p.8)

2.2.1.3 KRIs also identify and monitor changes in the level of risk in the external environment (10%) 10%

Anthropic mentions monitoring several external indicators which have the potential to change the risk posed by their models, such as changes to threat models and novel capability-preserving jailbreaks. However, there are no concrete ways mentioned that these could serve as measurable KRIs. To improve, Anthropic should include measurable indicators of risk beyond model capability evaluations as a trigger for suitable KCIs.

Quotes:

“The above argument for the sufficiency of our safeguards rests on several key assumptions about our threat models, the effectiveness of our defenses, and our ability to respond to emerging threats. We monitor for:
– Changes to the threat model. We will consider any significant changes to our threat models — for example, related to the length of model access required to achieve uplift, the number of potential threat actors, and changes in the complexity of the threat pathway. […]
– Public availability of capability-preserving universal jailbreaks for ASL-3 uses of concern. Our bug bounty program and threat intelligence work are intended to give us information about availability of jailbreaks.” (Risk Report, pp.76)

2.2.2.1 Containment KCIs (35%) 18%

2.2.2.2 Deployment KCIs (35%) 13%

2.2.2.3 For advanced KRIs, assurance process KCIs are defined (30%) 25%

For the most relevant advanced KRI threshold (“misaligned AI systems in high-stakes settings”), Anthropic does not commit to specific assurance process KCIs. Rather, they state that they “expect to continually be able to meet” their industry-wide recommendations, which include a “strong argument that AI systems will not carry out sabotage leading to irreversibly and substantially higher odds of a later global catastrophe”, along with some indications for what such an argument might require. However, this is framed as an expectation rather than a commitment, weakening its normative force. The Risk Report’s four-claim structure for the sabotage threat model demonstrates that Anthropic is operationalizing something like this argument in practice, though this is a post-hoc description rather than a pre-specified assurance threshold.

Quotes:

“Misaligned AI systems in high-stakes settings. AI systems that are highly relied on and have extensive access to sensitive assets as well as moderate capacity for autonomous, goal-directed operation and subterfuge—such that it is plausible these AI systems could (if directed toward this goal, either deliberately or inadvertently) carry out sabotage leading to irreversibly and substantially higher odds of a later global catastrophe. […]
We will detail the state of our AI systems’ capabilities and propensities, our monitoring practices, and the overall level of risk in our Risk Reports. We expect to continually be able to meet the criteria in the right column, although we cannot make guarantees about an evolving technology that may increasingly have the ability to detect and manipulate testing […]
A frontier developer should make a strong argument that AI systems will not carry out sabotage leading to irreversibly and substantially higher odds of a later global catastrophe. This case may initially be relatively simple and rely heavily on capability limitations, if it is first required when the risk is merely plausible. As risk becomes harder to rule out, this case will likely include some combination of:
● Internal compartmentalization, restriction, and code review to prevent excessive sabotage opportunities for AI models.
● Capability assessments demonstrating that AI models lack the ability to carry out irreversible (which would generally mean unnoticed) sabotage.
● Monitoring and/or restricting AI behavior and usage internally.
● Evidence that AI models lack the propensity to deceive, manipulate, or sabotage users.” (RSP, p.7)

“Our core argument around misaligned goals includes three key claims, made in the next three sections:
● Claim 1: Any model trained under our current standard practices in the near future is relatively unlikely to have dangerous coherent misaligned goals.
● Claim 2: Our alignment assessment, drawing on simulated scenarios, interpretability investigations, monitoring of internal and external pilot usage, and external testing, found no evidence of dangerous coherent misaligned goals in Claude Opus 4.6.
● Claim 3: Claude Opus 4.6 is very unlikely to be capable of hiding dangerous coherent misaligned goals from us in the face of such an assessment. […]
● Claim 4: Claude Opus 4.6 has limits to its ability to reason opaquely and its ability to implement complex long-term plans that collectively make it very difficult for it to take ambitious harmful actions in the presence of the security and monitoring safeguards described in the Section 2.5.” (Risk Report, p.15)

3.1.1.1 Containment measures are precisely defined for all KCI thresholds (60%) 25%

The risk report defines a post-hoc list of ten “notable security controls” for ASL-3, which are thus applicable to the KRIs for novel and non-novels biological/chemical weapons construction. Redactions are explicitly justified by informational security considerations. Also, the RSP states that “specifics may change”, making these containment measures a discretionary choice rather than a transparent pre-commitment. Risk mitigations for ASL-2 models are present in the risk report but do not include containment measures. The KRIs for sabotage and automated R&D are not assigned any specific containment measures. Further, the RSP expliticly states a move away from specificity in their safeguard commitments, shifting towards an outcome-focused approach.

Quotes:

“More outcome-focused safeguard requirements: We have updated our ASL-3 safeguards requirements to be less prescriptive and more outcome-focused. Rather than detailing specific operational and technical safeguards, we now specify the overall security or deployment standards and requirements for meeting them.” (RSP, p.18)

“Earlier editions of our RSP defined ‘AI Safety Levels’ with specific lists of required controls. We still use this concept to refer to, and distinguish between, present levels of risk mitigations […]. However, when defining the risk mitigations needed for future levels of AI capability, we have found that providing a specific list of controls is overly rigid, and we instead prefer to focus on what sort of argument an AI developer should make […].” (RSP, p.16)

“1. Egress bandwidth controls: Network-level restrictions that limit data transfer rates out of sensitive environments […] 2. Multi-party access controls (2PC): Requires a second employee to approve access requests for model weights and other sensitive resources […] 3. Binary allowlisting: Only pre-approved software can execute on employee devices […] 4. Hardware security keys for authentication: Phishing-resistant MFA using hardware tokens bound to specific domains […] 5. Device authorization […] 6. Cloud storage restrictions […] 7. Restricted session lengths for privileged access: Privileged cloud identities require re-authentication hourly […] 8. Network segmentation […] 9. Centralized security monitoring: Aggregated logging with automated anomaly detection […] 10. Network source policies on privileged resources […].” (Risk Report, pp.101–102)

“Specifics may change, but we will maintain equally or more robust measures over time and will publish updates in our Risk Reports.” (RSP, p.6)

“Non-novel chemical/biological weapons production […]: We will maintain or improve on our ASL-3 protections, which include classifier guards […] and a number of noteworthy security controls. Specifics may change, but we will maintain equally or more robust measures over time and will publish updates in our Risk Reports.” (RSP, p.6)

“Novel chemical/biological weapons production […]: We will apply protections at least as strong as our ASL-3 protections (see previous row) to an expanded set of potential use cases for AI, covering the most likely vectors for this threat.” (RSP, p.7)

3.1.1.2 Proof that containment measures are sufficient to meet the thresholds (40%) 25%

The containment measures given in the RSP and risk report, which take the form of the ASL-3 mitigations, are not justified beyond pure assertions that the mitigations provide “sufficient security that it would be difficult for most attackers […] to steal model weights”. The risk report states that there was an “attempt” to “broadly align” the security program with established frameworks like ISO 27001 and 42001, which provides useful context but is not specific or committal enough to qualify as a justification. The FCF asserts that security controls are “regularly tested and independently reviewed” and lists some general security testing practices, but similarly does not provide any concrete justifications for containment measure sufficiency. This aligns with the RSP’s stated move from specific lists of controls to argument-based containment assurance.

Quotes:

“More outcome-focused safeguard requirements: We have updated our ASL-3 safeguards requirements to be less prescriptive and more outcome-focused. Rather than detailing specific operational and technical safeguards, we now specify the overall security or deployment standards and requirements for meeting them. This is to allow us to adapt our safeguards more flexibly as our understanding of risks and possible safeguards improves.” (RSP, p.18)

“Earlier editions of our RSP defined ‘AI Safety Levels’ with specific lists of required controls. […] However, when defining the risk mitigations needed for future levels of AI capability, we have found that providing a specific list of controls is overly rigid, and we instead prefer to focus on what sort of argument an AI developer should make (and what sorts of actors it should address) regarding the risk level from its systems.” (RSP, p.16)

“Weights of models that require ASL-3 safeguards are kept under enhanced security with respect to models that require ASL-2 safeguards. We believe this to be sufficient security that it would be difficult for most attackers—excluding sophisticated insiders and attackers with nation-state backing—to steal model weights.” (Risk Report, p.71)

“The above argument for the sufficiency of our safeguards rests on several key assumptions about our threat models, the effectiveness of our defenses, and our ability to respond to emerging threats. We monitor for: […]
– Access control sufficiency.
– We monitor the effectiveness of our access control systems through threat intelligence monitoring for reports of credential leaks […].” (Risk Report, pp.76–77)

“Security control monitoring, testing, and assessments: Security controls are regularly tested and independently reviewed to ensure effectiveness. Penetration testing, vulnerability disclosure programs, third party risk assessments, and incident response tabletop exercises aim to help defenses remain robust, and insights from these activities are used to strengthen the company’s security posture over time.” (FCF, p.13)

“We’ve attempted to broadly align our program with established frameworks including SOC 2 Type 2, ISO 27001, and ISO 42001, while extending these to address AI-specific risks to model weights.” (Risk Report, p.101)

3.1.1.3 Strong third party verification process to verify that the containment measures meet the threshold (100% if 3.1.1.3 > [60% x 3.1.1.1 + 40% x 3.1.1.2]) 25%

The FCF provides a high-level commitment and description to independent review of security controls to “ensure effectiveness”. The RSP provides descriptions of the desiderata for the external review of their risk reports and those conducting them. However, these commitments only apply if a model is “highly capable” and the risk report “signficantly redacted”, which is a high bar to achieve according to Anthropic’s given definition of “highly capable”. It is also narrowly defined in terms of AI R&D capacity, not taking into account other capabilities in other risk domains. Furthermore, it unclear whether the review of security measures outlined in the risk report would include an assessment of the sufficiency of containment measures and if they do, whether they would take place before the relevant risk level to activate them would be crossed.

Quotes:

“Security controls are regularly tested and independently reviewed to ensure effectiveness. Penetration testing, vulnerability disclosure programs, third party risk assessments, and incident response tabletop exercises aim to help defenses remain robust, and insights from these activities are used to strengthen the company’s security posture over time.” (FCF, p.13)

“We will work toward a practice of seeking comprehensive, public external review on our Risk Reports. […] Commentary will address topics including the quality of our reasoning, the validity of our risk assessments, the overall level of risk, and whether the redactions we’ve made for the public version are reasonable and appropriate. […] At a minimum, we will complete a full external review process (described below) with at least one external reviewer anytime a Risk Report covers highly capable models and is significantly redacted […]” (RSP, p.13)

“We will select external reviewers that: have significant experience and expertise regarding evaluations for dangerous AI capabilities and propensities […]; have reputational and other incentives making them likely to be candid about their assessment of risks […]; do not have conflicts of interest with respect to Anthropic. At a minimum, a reviewing organization itself may not have a financial interest in Anthropic; and the individuals involved in conducting the review […] may not have a financial interest in Anthropic or close personal relationships with anyone at Anthropic […]” (RSP, p.13)

“Public comments. We will ask the external reviewer to memorialize its findings on the topics above in a written report that is made public. External reviewers will be bound by obligations not to disclose confidential information […], but beyond that will not be restricted in what they can publish, including concerns about the Risk Report or Anthropic’s conduct in connection with the external review.” (RSP, p.14)

3.1.2.1 Deployment measures are precisely defined for all KCI thresholds (60%) 25%

The RSP committs to the ASL-3 deployment standard for non-novel chemical/biological weapons production, but leaves open the possibility to change its specific implementation. The risk report provides ex-post mitigations for sabotage risks, although they only apply to internal deployments. No substantive definitions for deployment measures are given for novel chemical/biological weapons production or automated R&D. The RSP also includes a dedicated section justifying moving away from pre-specifying required controls.

Quotes:

“Earlier editions of our RSP defined ‘AI Safety Levels’ with specific lists of required controls. We still use this concept to refer to, and distinguish between, present levels of risk mitigations—those that we maintain for existing AI models. […] However, when defining the risk mitigations needed for future levels of AI capability, we have found that providing a specific list of controls is overly rigid, and we instead prefer to focus on what sort of argument an AI developer should make […].” (RSP, p.16)

“Because we cannot always anticipate what safety and security measures will be appropriate for models beyond the current frontier, the specific mitigations we implement may be determined when the relevant risk tier is reached, informed by the threat landscape at that time.” (FCF, p.6)

“Our baseline protections for ASL-2 models include:
1. Acceptable usage policies and enforcement: Our Usage Policy prohibits catastrophic harm categories (CBRN, cyber attacks) and high harm categories.
2. Harmlessness training: our models are trained to refuse harmful requests, including with respect to chemical and biological weapons.
3. Fine-tuning API protections: In finetuning products, data is filtered for harmfulness, and models are subject to automated evaluation aiming to ensure harmlessness features are not degraded. […]
4. Vulnerability reporting channels: Paths within the product for users to report harmful or dangerous model outputs, as well as a bug bounty for universal jailbreaks. […]” (Risk Report, p.68)

“4.5.2 Risk mitigations for ASL-3 models
4.5.2.1 Real-time classifier guards: We implement safeguards based on Constitutional Classifiers, trained to target relevant uses of concern according to our threat models. These classifier guards monitor model inputs and outputs in real time, and block the model from producing information that would be needed to successfully carry out the threat […]
4.5.2.2 Offline monitoring […]
4.5.2.3 Access controls: We allow some users to access models whose output isn’t restricted by the real-time classifier guards, in cases where their legitimate business needs require this. We use a manual vetting process in these cases. […]
4.5.2.4 Bug bounty program: We run our Model Safety Bug Bounty Program through HackerOne […] We pay up to $45,000 per novel, universal jailbreak identified. […]
4.5.2.5 Threat intelligence: We contract with threat intelligence vendors to monitor and scrape the deep and dark web for:
(i) publicly available universal jailbreaks of concern […]
4.5.2.6 Rapid response: We have a range of response options with different tradeoffs to address jailbreaks and vulnerabilities.” (Risk Report, pp.69–71)

“We will maintain or improve on our ASL-3 protections, which include classifier guards at least as robust as our initial Constitutional Classifiers; access controls for trusted users with exemptions to classifier guards; red-teaming, bug bounties, and threat intelligence for continually assessing the threat of jailbreaks; and a number of noteworthy security controls. Specifics may change, but we will maintain equally or more robust measures over time and will publish updates in our Risk Reports.” (RSP, p.6)

“We will apply protections at least as strong as our ASL-3 protections (see previous row) to an expanded set of potential use cases for AI, covering the most likely vectors for this threat. Additionally, we will identify the most concerning specific threat pathways, create policy recommendations for early detection and response for such threats, and share this content with policymakers.” (RSP, p.7)

“These measures include:
– Employees routinely reporting surprising or concerning behaviors through in-app mechanisms and internal feedback Slack channels
– Automatic offline Claude Code behavior monitoring covering a ≥10% subsample of prompts by most users, based on a prompted Claude Opus 4.5 classifier
– Sandboxing and automatic monitors that block some risky actions of some Claude Code agents
– Security controls focused on protecting model weights […]
– Mandatory manual review and automatic (but non-blocking) Claude-based review of code before integrating it into shared Anthropic codebases.” (Risk Report, pp.32–33)

“For deployments to outside users, we do not have sabotage-oriented monitoring measures in place beyond basic ordinary reporting opportunities that rely on voluntary disclosure by users or external researchers.” (Risk Report, p.33)

“We currently target these risk mitigations (particularly strong classifier guards) specifically at reducing the risk discussed in section 4, and we have not yet extended them to target all of the uses of models that might be indicated by this threat model.” (Risk Report, p.84)

“For >90% of Anthropic employees, the LLM supervisor (powered by Claude Opus 4.5) runs on at least 10% of code edits and bash commands. This covers more than 10% of total actions, as the supervisor is asked to analyze not only the last action, but also all actions in the trajectory. This surfaces on the order of 10,000 positives per week. We use a Claude Sonnet 4.5 classifier to exclude common sources of false positives. The remaining transcripts are analyzed using a recursive summarization tool powered by Claude Sonnet 4.5. These summaries as well as on the order of 20 transcripts per week are reviewed by an AI control researcher.” (Risk Report, p.98)

3.1.2.2 Proof that deployment measures are sufficient to meet the thresholds (40%) 25%

The risk report provides some justification for the sufficiency of safeguards, but those are provided ex-post, not fulfillling the desiderata for this criterion. Further, there are processes for soliciting proof of safeguard effectiveness, such as bug bounty programs. The final risk acceptability decision is explicitly discretionary and lies with the CEO and RSO of Anthropic, without providing clear ex ante sufficiency criteria for deployment mitigations. The RSP explicitly notes the move away from listing specific safeguards ex-ante.

Quotes:

“More outcome-focused safeguard requirements: We have updated our ASL-3 safeguards requirements to be less prescriptive and more outcome-focused. Rather than detailing specific operational and technical safeguards, we now specify the overall security or deployment standards and requirements for meeting them. This is to allow us to adapt our safeguards more flexibly as our understanding of risks and possible safeguards improves.” (RSP, p.18)

“Earlier editions of our RSP defined ‘AI Safety Levels’ with specific lists of required controls. […] However, when defining the risk mitigations needed for future levels of AI capability, we have found that providing a specific list of controls is overly rigid, and we instead prefer to focus on what sort of argument an AI developer should make (and what sorts of actors it should address) regarding the risk level from its systems.” (RSP, p.16)

“Less prescriptive evaluation methodology: We have replaced some specifics in our previous testing methodology (e.g., using 1% of compute for elicitation or creating a 6x buffer), with more general requirements to (a) match expected efforts of potential adversaries and (b) provide informal estimates of how further scaling and research developments will impact model capabilities and performance on the same tasks. […] Although still an aspirational goal, the science of evaluations is not currently mature enough to make confident predictions about the precise buffer we should require between current models and a Capability Threshold.” (RSP, p.18)

“Risk mitigations: For each in-scope model, the mitigations we are implementing across security, deployment safeguards, and alignment domains, along with discussion of their effectiveness.” (RSP, p.11)

“Changes to classifier guards (multiple and ongoing) — we have altered our classifier guards repeatedly both to improve robustness and reduce costs. In general, for significant changes, we run a dedicated bug bounty to verify robustness before deploying a new system.” (Risk Report, p.71)

“We run our Model Safety Bug Bounty Program through HackerOne to incentivize third-party researchers to discover and report vulnerabilities in our AI systems, particularly ‘jailbreaks’ that could bypass the classifier guards […]. We perform automated assessments of response informativeness to determine whether the hackers have succeeded. We pay up to $45,000 per novel, universal jailbreak identified. […] Since May 2025, we have averaged 100+ active hackers monthly.” (Risk Report, p.70)

“Since launching our upgraded classifier guards and bug bounty in May of 2025, we have not become aware of any publicly known universal jailbreaks […] We have become aware of jailbreaks via our bug bounty and via external red-teaming, and have remediated all but the most recent of these (for which remediation is underway). […] Overall, we believe that highly effective, publicly known universal jailbreaks for ASL-3 classifier guards are rare.” (Risk Report, p.74)

“Executive approval: The Risk Report, along with the internal feedback and any available external feedback, will be sent to the CEO and Responsible Scaling Officer (RSO) for final review and approval. The CEO and RSO will make the ultimate determination regarding the adequacy of the risk assessment and any downstream deployment or development plans.” (RSP, p.12)

3.1.2.3 Strong third party verification process to verify that the deployment measures meet the threshold (100% if 3.1.2.3 > [60% x 3.1.2.1 + 40% x 3.1.2.2]) 25%

The risk report mentions running a bug bounty program to identify vulnerabilities and jailbreaks, which has been active and ongoing since May 2025. It also states that “in general, for significant changes, [they] run a dedicated bug bounty to verify robustness before deploying a new system”, creating an explicit mention of deployment measure sufficiency testing, while staying somewhat discretionary and non-binding.

The RSP contains a commitment to external review of their risk reports, which would liekly an assessment of the sufficiency of deployment measures, though this is not explicitly mentioned. It also elaborates on the qualifications that external reviewers must meet, how conflicts of interest will be avoided, and reputational and other incentives which should be in place to motivate candid and assessment of the risks by the third party. However, these requirements are binding only if the risk report is “highly redacted” and the models it covers are “highly capable”, defined as a x2 speedup in AI R&D. This is a bar that is currently not met, and thus the external review process specified is not reflected in the current risk report.

If the above criteria are not met, Anthropic states that they will “usually also seek feedback from trusted external parties with relevant expertise”, and will “work toward a practice of seeking comprehensive, public external review on [their] Risk Reports”. While these commitments are weaker than the ones listed above, Anthropic justifies this by saying that “there are no well-established organizations or procedures for this sort of practice, and [they] are approaching it as an experiment”.

Quotes:

“We will work toward a practice of seeking comprehensive, public external review on our Risk Reports. […] Commentary will address topics including the quality of our reasoning, the validity of our risk assessments, the overall level of risk, and whether the redactions we’ve made for the public version are reasonable and appropriate. […] At a minimum, we will complete a full external review process (described below) with at least one external reviewer anytime a Risk Report covers highly capable models and is significantly redacted […]” (RSP, p.13)

“We will select external reviewers that: have significant experience and expertise regarding evaluations for dangerous AI capabilities and propensities […]; have reputational and other incentives making them likely to be candid about their assessment of risks […]; do not have conflicts of interest with respect to Anthropic. At a minimum, a reviewing organization itself may not have a financial interest in Anthropic; and the individuals involved in conducting the review […] may not have a financial interest in Anthropic or close personal relationships with anyone at Anthropic […]” (RSP, p.13)

“Public comments. We will ask the external reviewer to memorialize its findings on the topics above in a written report that is made public. External reviewers will be bound by obligations not to disclose confidential information […], but beyond that will not be restricted in what they can publish, including concerns about the Risk Report or Anthropic’s conduct in connection with the external review.” (RSP, p.14)

“We run our Model Safety Bug Bounty Program through HackerOne to incentivize third-party researchers to discover and report vulnerabilities in our AI systems, particularly ‘jailbreaks’ that could bypass the classifier guards […]. We perform automated assessments of response informativeness to determine whether the hackers have succeeded. We pay up to $45,000 per novel, universal jailbreak identified. […] Since May 2025, we have averaged 100+ active hackers monthly.” (Risk Report, p.70)

“Changes to classifier guards (multiple and ongoing) — we have altered our classifier guards repeatedly both to improve robustness and reduce costs. In general, for significant changes, we run a dedicated bug bounty to verify robustness before deploying a new system.” (Risk Report, p.71)

“We may solicit input from external actors in relevant domains, and other stakeholders, in the process of developing and implementing our systemic risk assessment processes (including the identification of potential risks and appropriate safety and security mitigations).” (FCF, p.14)

3.1.3.1 Credible plans towards the development of assurance processes (40%) 25%

While Anthropic’s documents do not include clear assurance process KCIs, the frontier safety roadmap asserts that current alignment assessment methods are sufficient to determine that sabotage risk is “very now (though not negligible)”. Further, it provides timeline estimates of when highly capable AI might arrive (“as soon as early 2027”), and provides a list of different goals that they want to have achieved by specific dates before then, including “alignment assessments” to assess Claude’s compliance with Anthropic’s constitution (October 1, 2026) or developing an internal red-teaming method that “outperforms the collective contributions from the hundreds of participants in our bug bounty” (January 1, 2027). However, while providing information on implemented and planned processes, the documents do not contain explicit justifications for whether and why Anthropic believes that they will be able to keep meeting assurance process KCIs. Further, the RSP explicitly notes that the “Frontier Safety Roadmap is subject to change”, weakening the binding force of the dated commitments.

Quotes:

“We believe that AI capabilities will improve rapidly in the coming years. We will need to quickly and dramatically improve our state of preparedness in a number of areas, especially: Security […] Safeguards […] Alignment […] Policy […]” (Frontier Safety Roadmap)

“Additionally, today’s models show strong and improving capabilities for extended, autonomous technical work, and are increasingly relied on for writing high-stakes code. In our Risk Reports, we now regularly analyze the possibility that these models might execute high-stakes sabotage. We believe that our current alignment assessment methods and monitoring practices are sufficient to make the case that the risk of catastrophic sabotage is very low (though not negligible).” (Frontier Safety Roadmap)

“We will consider this threshold to be met if we determine that either (1) our models would be able to fully substitute for our entire set of Research Scientists and Research Engineers, at competitive costs (i.e., within a factor of 5); or (2) there is ‘dramatic acceleration’ of the pace of AI progress for reasons that likely relate to the automation of AI R&D.” (RSP, p.8)

“We believe it is plausible, as soon as early 2027, that our AI systems could fully automate, or otherwise dramatically accelerate, the work of large, top-tier teams of human researchers in domains where fast progress could cause threats to international security and/or rapid disruptions to the global balance of power—for example, energy, robotics, weapons development and AI itself. By that point, we expect to have accomplished most of the goals listed above, including: […] Consistently implementing systematic alignment audits and other measures for upholding Claude’s Constitution.” (Frontier Safety Roadmap)

“We will: […] Perform systematic alignment assessments to examine Claude’s behavioral patterns and propensities, meaningfully incorporating mechanistic interpretability and adversarial red-teaming to test our auditing methods. […] Develop our internal red-teaming of our deployment safeguards to the point where our internal red-teaming performs better at finding potential jailbreaks than the collective abilities of the participants in our established bug bounty programs. […] Publish Risk Reports with the status of, and noteworthy findings from, all of the above, subject to external review by at least one expert, experienced, credible, candid and disinterested external party.” (RSP, p.8–9)

“Alignment Target: October 1, 2026 — Upholding Claude’s Constitution […] We will perform systematic ‘alignment assessments’ to examine Claude’s behavioral patterns and propensities, and evaluate whether they are in line with the spirit of the Constitution. These alignment assessments will incorporate findings from our interpretability research, and will validate the effectiveness of our methods using testing exercises with intentionally misaligned models. We will publish our findings in our system cards or Risk Reports.” (Frontier Safety Roadmap)

“Safeguards Target: January 1, 2027 — World-class internal red-teaming […] We believe we can develop a method for red-teaming our systems (likely involving significant automation) that outperforms the collective contributions from the hundreds of participants in our bug bounty.” (Frontier Safety Roadmap)

“Cross-cutting Target: January 1, 2027 — Moving toward an ‘eyes on everything’ state for our internal AI development activities […] We aim to establish comprehensive, centralized records of all our critical AI development activities, and to use AI to analyze these records for issues including concerning behavior by insiders (both human and AI) and security threats.” (Frontier Safety Roadmap)

3.1.3.2 Evidence that the assurance processes are enough to achieve their corresponding KCI thresholds (40%) 50%

As assurance process KCIs are not directly defined, it is difficult to assess whether the methods given are sufficient to show that assurane processes are sufficient. Despite this limitation, the frontier safety roadmap commits to performing alignment assessments that incorporate interpretability findings and model organisms and report on them in the system cards or risk reports. The risk report provides an example of implemented stress-testing of the alignment auditing processes; however, those are run mainly on inferior Claude versions, limiting their applicability to Anthropic’s most capable models like Claude Opus 4.6. Additionally, the risk report includes invalidation conditions that would call into question the sufficiency of alignment audit methods, but does not define a remediation path for this scenario.

Quotes:

“We will perform systematic ‘alignment assessments’ to examine Claude’s behavioral patterns and propensities, and evaluate whether they are in line with the spirit of the Constitution. These alignment assessments will incorporate findings from our interpretability research, and will validate the effectiveness of our methods using testing exercises with intentionally misaligned models. We will publish our findings in our system cards or Risk Reports.” (Frontier Safety Roadmap)

“We have conducted three major exercises to date in which we stress-tested the parts of the alignment auditing processes that we use in practice against intentionally-misaligned model organism models. The results suggest that our methods catch at least the large majority of concerning behaviors studied, at least in the context of the weaker models we study. We hope to do similar analysis on more capable models in the future.
– Our initial work on alignment audits showed that human investigators, using a subset of the methods that we used with Claude Opus 4.6, can identify and root-cause concerning behavior in a Haiku 3.5 model that was finetuned in a way meant to make it subtly misaligned. This is the only one of our major exercises in which we extensively optimized the model organism to make its misaligned trait difficult to discover.
– Our subsequent work on alignment auditing agents showed that the automated behavioral audit method that we used with Claude Opus 4.6 can identify concerning behaviors in Claude Sonnet 3.5 (Oct 2024) models that are system-prompted to show quirky behaviors 7 out of 10 times with no human participation. […]
– Our work on natural emergent misalignment studied four Claude Sonnet 4 variants that were trained to be subtly misaligned using realistic variants of our production training pipeline. In all four cases, the automated behavioral audit method that we used with Claude Opus 4.6 identified them as less well aligned than the corresponding baseline models. […]
– Our work on an overt saboteur studied three Claude Sonnet 4.5 variants that were trained to sabotage Anthropic but were not explicitly trained to conceal this behavior. A human working together with an automated auditing agent successfully identified all three overt sabotage agents, without flagging the two benign models.” (Risk Report, pp.27–28)

“The methods used in the alignment audit appear sufficient to identify dangerous goals, values, or propensities if they are present in models at or below Claude Opus 4.6’s capability level. […] [Invalidation conditions:] A model-organisms study shows that it is possible for such a model to circumvent the full suite of audit methods and still realize one of the pathways discussed here. An updated capabilities assessment casts into doubt the robustness of the alignment audit to the possibility of deliberate deception. We observe a model that has previously undergone an alignment audit attempting an unexpected and egregiously misaligned action that could substantially raise the risk from one of the pathways discussed here.” (Risk Report, p.50)

3.1.3.3 The underlying assumptions that are essential for their effective implementation and success are clearly outlined (20%) 75%

The risk report provides a list of potential pitfalls in alignment evaluations and evaluates them separately, including evaluation awareness and realism, steganography ability, reasoning faithfulness and sandbagging. The claims are generally qualified with a qualitative confidence level and backed up with reasoning referencing evidence given in the report and system cards. However, the claim about reasoning not harboring hidden information is backed up using an eval using mathematics exercises, which might not be suitable to fully elicit this type of capability due to a lack of motivation. Further, the risk report explicitly acknowledges that some types of sandbagging may not be caught with their current methods, but does not propose alternative detection methods.

Quotes:

“The biggest challenge we face in our alignment assessments is the possibility that the model under study can reliably identify our test scenarios as test scenarios, and acts differently in those scenarios in ways that render our results unrepresentative of what we will observe in deployment. […] We believe that, on the basis of all of the sources of evidence discussed above—including our heavy use of real data from pilot internal and external use—this risk is adequately managed at the current level of capability. However, this will remain a significant challenge in future assessments […].” (Risk Report, p.24)

“Results on SHADE-Arena shows that Claude Opus 4.6, when prompted to subtly complete a side task while appearing to only work on a primary task, succeeds only 18% of the time when thinking is available and monitored, and 16% of the time when thinking is unavailable. […] still implies that if the model displayed similar capability with a genuine hidden goal, it would be overwhelmingly likely to be caught.” (Risk Report, p.25)

“We have little confidence in the propensity of any frontier model to give a complete and accurate picture of how it reasons in its reasoning text […]. However, we believe that there is an important but much weaker claim that we can make about Claude Opus 4.6: The model does not appear to reliably hide or misrepresent the contents of sequential reasoning that is taking place in its reasoning text. […] The system card reports on an in-house fine-tuning based encoded thinking evaluation (System Card §6.4.2), which shows that the Claude Opus 4.6’s ability to complete mathematics problems is not hindered when its thinking text is replaced by a paraphrase of that thinking text, demonstrating that, at least in this test domain, it does not use its reasoning text in human-illegible ways.” (Risk Report, p.26)

“Our primary concern with these models is sandbagging: strategically choosing to underperform on evaluations. We find this very unlikely for reasons given in previous sections, but it is difficult to test for directly in many domains. […] We find the following: We see no legible evidence of sandbagging attempts.” (Risk Report, p.53)

“The residual risk of sandbagging largely accrues in cases where sandbagging would not significantly benefit from extended thinking—where both the incentive to sandbag and the best way to subtly sandbag are straightforwardly obvious from context […]. It seems plausible that models’ behavior in these cases need not be closely correlated with their behavior in more complex cases, such that occasional sandbagging may not be caught. We must rely on other factors to rule out significant impacts from this kind of subtle sandbagging.” (Risk Report, p.39)

“Our process for training and evaluating Claude Opus 4.6 involved the extensive use of Claude models as graders, monitors, or scorers in ways that could create the potential for collusion, where the scorer models systematically cooperate with Claude Opus 4.6 to hide evidence of coherent misalignment. We find this unlikely. […] we used our automated behavioral audit tool to run several small-sample-size investigations of honeypot scenarios where it might be appealing for a misaligned model, when acting as a monitor, to try to overlook bad behavior by another instance of the same model. We observed no concerning behavior in these settings, though they did largely rely on automatic grading (by Claude Opus 4.5, rather than Claude Opus 4.6). […] our self-preference evaluation […] evaluated Claude Opus 4.6, Opus 4.5 and Sonnet 4.5 for their degree of self-preference. […] Sonnet 4.5 shows modest self-preference in ambiguous qualitative judgment settings, while Claude Opus 4.6 and Opus 4.5 show effectively no self-preference.” (Risk Report, p.29)

3.2.1.1 Justification that elicitation methods used during the evaluations are comprehensive enough to match the elicitation efforts of potential threat actors (30%) 50%

The risk report states that helpful-only model versions were used for biorisk evaluations, and describes the amount of time (“2 days”) that evaluators had to craft a plan. It also mentions that some model capabilities might have been under-elicited due to removal of training data—which could potentially be undone by a threat actor through fine-tuning—but do not give an approach to address this. Similarly, the risk report mentions not using targeted fine-tuning for sabotage evaluations, and states that the model was “clearly under-elicited” on a subversion strategy evaluation; these are honest limitations, but no potential approach to curb them is given. Lastly, the RSP changelog includes an explicit acknowledgement that elicitation specifics have been replaced with more general requirements, justified by stating that “specific methodologies may become outdated”.

Quotes:

“Less prescriptive evaluation methodology: We have replaced some specifics in our previous testing methodology (e.g., using 1% of compute for elicitation or creating a 6x buffer), with more general requirements to (a) match expected efforts of potential adversaries and (b) provide informal estimates of how further scaling and research developments will impact model capabilities and performance on the same tasks. We have found that specific methodologies may become outdated when new research developments are introduced. Although still an aspirational goal, the science of evaluations is not currently mature enough to make confident predictions about the precise buffer we should require between current models and a Capability Threshold.” (RSP, p.17)

“Controlled trial measuring AI assistance for bioweapons acquisition planning. Participants had 2 days to draft a comprehensive plan. Control group could access the internet but not our models; the test group had access to Claude with safeguards removed. Outputs graded by Deloitte using detailed rubric.” (Risk Report, p.66)

“Staff from Deloitte with biosecurity experience engaged in extended conversations testing ability to assist with known bioweapons development. Both helpful-only and standard variants tested over 3 days. Qualitative assessment of risk provided.” (Risk Report, p.67)

“Note that model capabilities were somewhat hampered by our deliberate removal of some training data (in order to lower dangerous capabilities). It’s plausible that a sophisticated threat actor with access to model weights could use fine-tuning to effectively undo this removal.” (Risk Report, p.83)

“This evaluation requires us to elicit the desired sabotage-related behavior. Our elicitation used our standard best practices for lightweight evaluations, including some prompt iteration, but did not involve targeted fine-tuning. This leaves open the possibility that the model could have succeeded under other circumstances.
Subversion Strategy intended to study intentional rare failure attacks […]. Unfortunately, we found Claude Opus 4.6 to be clearly under-elicited at this task, to a degree that we don’t have confidence in the value of the results.” (Risk Report, p.25)

3.2.1.2 Evaluation frequency (25%) 10%

There is no information provided on self-imposed mandatory re-evaluation triggers for maximum-elicitation evaluations, neither in terms of time, nor in terms of scaling progress. The FCF mentions a time-based trigger (“every nine months”), but this applies to lighter-touch evaluations, which by definition do not use approaches to produce maximal elicitation.

Quotes:

“In addition to carrying out full Systemic Risk Assessments as described above, we conduct lighter-touch model evaluations (which may include running our automatic evaluations and collaborating with external experts to test our models) to consider whether further systemic risk mitigations may be required or a full Systemic Risk Assessment and Model Report update is required. The below trigger points help us determine when a model is substantially modified enough to require an additional Model Report for the updated model as part of our obligations under the TFAIA.
– Every nine months, unless an update of the relevant model is planned within a month of the trigger point; and
– A new model is in training and test model snapshots are available and appropriate for early evaluation.” (FCF, p.14)

3.2.1.3 Description of how post-training enhancements are factored into capability assessments (15%) 10%

The RSP changelog mentions that specific safety margins have been replaced by “informal estimates of how further scaling and research developments will impact model capabilities”. Thus, the RSP and risk report do not provide documentation of specific methodologies to incorpororate post-training ehnancements, or the size of safety margins deployed.

Quotes:

“Less prescriptive evaluation methodology: We have replaced some specifics in our previous testing methodology (e.g., using 1% of compute for elicitation or creating a 6x buffer), with more general requirements to (a) match expected efforts of potential adversaries and (b) provide informal estimates of how further scaling and research developments will impact model capabilities and performance on the same tasks. We have found that specific methodologies may become outdated when new research developments are introduced. Although still an aspirational goal, the science of evaluations is not currently mature enough to make confident predictions about the precise buffer we should require between current models and a Capability Threshold.” (RSP, p.17)

“On one evaluation, kernel optimization, Opus 4.6 achieved a 427× speedup using a novel scaffold, far exceeding the 300x threshold for 40 human-expert-hours of work and more than doubling performance under our standard setup.This suggests some capability overhang constrained by current tooling rather than fundamental model limitations. As a result, while we do not believe Claude Opus 4.6 meets the threshold for ASL-4 autonomy safeguards, we find ourselves in a gray zone where clean rule-out is difficult and the margin to the threshold is unclear. We expect with high probability that models in the near future could cross this threshold.” (Risk Report, p.31)

3.2.1.4 Vetting of protocols by third parties (15%) 25%

The RSP details a process for third parties to review the risk reports, including required expertise and guarantee of independence for evaluators. However, those only grip when models are “highly capable” and risk reports “significantly redacted”, creating a high bar and discretion for Anthropic. Further, it is unclear whether these external reviews of risk reports would cover evaluation methodologies in-depth or only at a superficial level.
A more general statement is given that commits to external evaluations of all reports, but this is significantly weakened in its binding force by stating that Anthropic will “usually also seek feedback” for those reports. The FCF similarly mentions that Anthropic “may solicit input from external actors in relevant domains […] in the process of implementing [their] risk assessment processes”, but does not include specific expertise requirements, and does not explicitly state that these inputs are also requrested for capability evaluations specifically. Lastly, the RSP includes details about a “procedural compliance review” on an approximately annual basis, but notes that this does not focus on substantive outcomes, but rather procedural compliance with the RSP.

Quotes:

“We will work toward a practice of seeking comprehensive, public external review on our Risk Reports. […] Commentary will address topics including the quality of our reasoning, the validity of our risk assessments, the overall level of risk, and whether the redactions we’ve made for the public version are reasonable and appropriate. […] At a minimum, we will complete a full external review process (described below) with at least one external reviewer anytime a Risk Report covers highly capable models and is significantly redacted […]” (RSP, p.13)

“We will select external reviewers that: have significant experience and expertise regarding evaluations for dangerous AI capabilities and propensities […]; have reputational and other incentives making them likely to be candid about their assessment of risks […]; do not have conflicts of interest with respect to Anthropic. At a minimum, a reviewing organization itself may not have a financial interest in Anthropic; and the individuals involved in conducting the review […] may not have a financial interest in Anthropic or close personal relationships with anyone at Anthropic […]” (RSP, p.13)

“The external review will address:
1. Adequacy of information: Whether the Risk Report contains sufficient information to assess the identified risks;
2. Analytical rigor: The strength of the Risk Report’s reasoning and analysis;
3. Areas of disagreement: Whether the external reviewer disagrees with any of the Risk Report’s key claims and, if so, the reasons for any such disagreements; and
4. Risk reduction recommendations: Recommendations for further reducing identified risks.” (RSP, p.14)

“Review and feedback: We will solicit comprehensive internal feedback on the report, focusing on identifying potential methodological weaknesses, analytical gaps, or areas requiring additional evidence or clarification. […] We will usually also seek feedback from trusted external parties with relevant expertise.” (RSP, p.12)

“We may solicit input from external actors in relevant domains, and other stakeholders, in the process of developing and implementing our systemic risk assessment processes (including the identification of potential risks and appropriate safety and security mitigations). We will also rely on commissioned research reports, discussions with domain experts, input from expert forecasters, public research, engagement with the Frontier Model Forum, and internal discussions in implementing our systemic risk assessment processes.” (FCF, p.14)

“Procedural compliance review: On approximately an annual basis, we will commission a third-party review that assesses whether we adhered to this policy’s main procedural commitments. This review will focus on procedural compliance, not substantive outcomes.” (RSP, p.15)

3.2.1.5 Replication of evaluations by third parties (15%) 10%

While the risk report provides multiple examples of implementation of external KRI assessments, predominantly for biorisk evaluations, there is no structural commitment in the RSP or elsewhere to such practices. The FCF includes a non-binding statement that external testing of models “may” be included in lighter-tough evaluations, but does not provide details.

Quotes:

“In addition to carrying out full Systemic Risk Assessments as described above, we conduct lighter-touch model evaluations (which may include running our automatic evaluations and collaborating with external experts to test our models) to consider whether further systemic risk mitigations may be required or a full Systemic Risk Assessment and Model Report update is required.” (FCF, p.14)

“Bioweapons acquisition uplift trial: Controlled trial measuring AI assistance for bioweapons acquisition planning. […] Outputs graded by Deloitte using detailed rubric.” (Risk Report, p.66)

“ASL-3 expert red teaming: Staff from Deloitte with biosecurity experience engaged in extended conversations testing ability to assist with known bioweapons development. Both helpful-only and standard variants tested over 3 days. Qualitative assessment of risk provided.” (Risk Report, p.67)

“Long-form virology tasks: Task-based agentic evaluations developed with SecureBio, Deloitte, and Signature Science. Tests end-to-end completion of pathogen acquisition processes including workflow design and laboratory protocols.” (Risk Report, p.67)

“Multimodal Virology (VCT): Multiple-choice evaluation from SecureBio assessing virology-specific knowledge with images.” (Risk Report, Table 4.4.A, p.67)

“Short-Horizon Computational Biology Tasks: Faculty.ai evaluations testing multi-step pathogen analysis/engineering tasks.” (Risk Report, Table at §5.4, p.82)

“The closest thing that we are aware of to a counterexample is the finding by UK AISI that Claude Opus 4.5 will sometimes refuse to participate in certain AI safety research tasks for dubious reasons. While we did not identify this ourselves, it still came to our attention before public deployment through our third-party testing program, and was disclosed in the Claude Opus 4.5 System Card.” (Risk Report, footnote 43, p.94)

“On simple Claude-3.7-Sonnet-generated red-team trajectories provided by UK AISI on their Control Arena ‘IAC’ setting, the supervisor achieves a recall of 100% […] On other Control Arena red-team trajectories provided by Apollo Research MATS scholars, it achieves a recall of 98%.” (Risk Report, §7.4.8, p.98)

3.2.2.1 Detailed description of evaluation methodology and justification that KCI thresholds will not be crossed unnoticed (40%) 50%

The risk report provides a list of things Anthropic monitors for to inform assessment of mitigation effectiveness, including changes to the threat model, inconsistencies across surfaces, public availability of universal jailbreaks, and bug bounty effectiveness. They further provide a failure mode analysis for how threat actors might be able to obtain harmful instructions from a model, including 6 listed threat variants and one redacted one. The framework does not quantify detection confidence. They also mention an ongoing bug bounty program to detect and report vulnerabilities. However, most of monitoring processes concern only measures for deployment KCIs, while containment and assurance process KCIs are not analyzed in depth. The FCF briefly addresses containment KCIs, but only in a superficial way, stating that “security controls are regularly tested and independently reviewed to ensure effectiveness” and lists four broad categories of interventions to test the controls.

Quotes:

“The above argument for the sufficiency of our safeguards rests on several key assumptions about our threat models, the effectiveness of our defenses, and our ability to respond to emerging threats. We monitor for:
– Changes to the threat model. We will consider any significant changes to our threat models — for example, related to the length of model access required to achieve uplift, the number of potential threat actors, and changes in the complexity of the threat pathway.
– Persistent changes in our safeguards. We periodically inventory our deployed models across different surfaces, assessing whether we remain able to provide the risk mitigations described above.
– Inconsistencies across surfaces. We implement a synchronized monitoring system that runs regular batch tests on AWS, GCP, and 1P environments. We send identical sets of test prompts to each platform and verify that the same content is blocked across all surfaces, to check whether our real-time classifier guards are functioning uniformly.
– Public availability of capability-preserving universal jailbreaks for ASL-3 uses of concern. Our bug bounty program and threat intelligence work are intended to give us information about availability of jailbreaks.
– Access control sufficiency. We monitor the effectiveness of our access control systems through threat intelligence monitoring for reports of credential leaks, particularly for bio-classifier-exempt organizations.
– Jailbreak coverage sufficiency. We assess whether our classifier guards are adequately covering all areas of concern relevant to ASL-3 threat models. We do this through consultation with domain experts and internal evaluations.
– Bug bounty effectiveness. If we find evidence that suggests universal jailbreaks are more valuable than what we pay out in the bug bounty program, this may undermine the efficacy of the bug bounty program. […] We also regularly assess the number of active red-teamers on the bug bounty program.” (Risk Report, pp.76–77)

“Beyond highly effective, publicly known universal jailbreaks, there are a number of other (though less likely, in our view) ways a threat actor might obtain persistent guidance from an AI model:
Threat variant 2: a threat actor finds a highly effective, nonpublic universal jailbreak on their own […]
Threat variant 3: a threat actor obtains a highly effective, nonpublic universal jailbreak from someone else […]
Threat variant 4: a threat actor exploits a trusted user exemption […]
Threat variant 5: a threat actor steals our model weights […]
Threat variant 6: an attacker steals our model weights and uses them to create a safeguard-free version […]
Threat variant 8: an attacker obtains significant uplift from our model despite not doing any of the above.” (Risk Report, pp.75–76)

“Our previous analysis on this topic states: ‘Overall, we expect that highly effective, publicly known universal jailbreaks will generally be available for 1 day out of 5–10, or less […]’ On one hand, we are not aware of any cases when highly effective, publicly known universal jailbreaks were available over the last 6+ months. On the other hand, the jailbreaks that we found privately (via our bug bounty or external red-teaming) took longer to remediate than we had hoped. We are working to improve remediation times and will revisit this topic in our next Risk Report. Overall, we believe that highly effective, publicly known universal jailbreaks for ASL-3 classifier guards are rare.” (Risk Report, p.74)

“We run our Model Safety Bug Bounty Program through HackerOne to incentivize third-party researchers to discover and report vulnerabilities […]. We pay up to $45,000 per novel, universal jailbreak identified. […] Since May 2025, we have averaged 100+ active hackers monthly. […] We contract with threat intelligence vendors to monitor and scrape the deep and dark web for: (i) publicly available universal jailbreaks of concern […]; (ii) black markets for model jailbreaks; (iii) reports of API key leaks […].” (Risk Report, pp.70–71)

“Security control monitoring, testing, and assessments: Security controls are regularly tested and independently reviewed to ensure effectiveness. Penetration testing, vulnerability disclosure programs, third party risk assessments, and incident response tabletop exercises aim to help defenses remain robust, and insights from these activities are used to strengthen the company’s security posture over time.” (FCF, p.13)

3.2.2.2 Vetting of protocols by third parties (30%) 25%

The FCF states that “security controls are […] independently reviewed to ensure effectiveness”, which provides a high-level commitment to third-party assesment of containment measure effectiveness, but not of the internal process to measure effectiveness. Beyond this, Anthropic does not document a clear process for independent third parties to review the methods for assessing the efficacy of KCI measures. The RSP includes details on general external review of risk reports, which involves commentary on “topics including the quality of our reasoning, the validity of our risk assessments, the overall level of risk”, and whether redactions are reasonable. While this may include the review of KCI measure efficacy testing documented in the risk report, it is not explicitly named as a priority in the assessment scope. Further, the commitment to external reviews is only presented as binding if the models are “highly capable” and the risk report “significantly redacted”, a high bar to reach involving discretionary assessment by Anthropic, weakening the binding force of the commitment significantly.

Quotes:

“We will work toward a practice of seeking comprehensive, public external review on our Risk Reports. […] Commentary will address topics including the quality of our reasoning, the validity of our risk assessments, the overall level of risk, and whether the redactions we’ve made for the public version are reasonable and appropriate. […] At a minimum, we will complete a full external review process (described below) with at least one external reviewer anytime a Risk Report covers highly capable models and is significantly redacted […]” (RSP, p.13)

“We will select external reviewers that: have significant experience and expertise regarding evaluations for dangerous AI capabilities and propensities […]; have reputational and other incentives making them likely to be candid about their assessment of risks […]; do not have conflicts of interest with respect to Anthropic. At a minimum, a reviewing organization itself may not have a financial interest in Anthropic; and the individuals involved in conducting the review […] may not have a financial interest in Anthropic or close personal relationships with anyone at Anthropic […]” (RSP, p.13)

“The external review will address:
1. Adequacy of information: Whether the Risk Report contains sufficient information to assess the identified risks;
2. Analytical rigor: The strength of the Risk Report’s reasoning and analysis;
3. Areas of disagreement: Whether the external reviewer disagrees with any of the Risk Report’s key claims and, if so, the reasons for any such disagreements; and
4. Risk reduction recommendations: Recommendations for further reducing identified risks.” (RSP, p.14)

“Review and feedback: We will solicit comprehensive internal feedback on the report, focusing on identifying potential methodological weaknesses, analytical gaps, or areas requiring additional evidence or clarification. […] We will usually also seek feedback from trusted external parties with relevant expertise.” (RSP, p.12)

“We may solicit input from external actors in relevant domains, and other stakeholders, in the process of developing and implementing our systemic risk assessment processes (including the identification of potential risks and appropriate safety and security mitigations). We will also rely on commissioned research reports, discussions with domain experts, input from expert forecasters, public research, engagement with the Frontier Model Forum, and internal discussions in implementing our systemic risk assessment processes.” (FCF, p.14)

“Security control monitoring, testing, and assessments: Security controls are regularly tested and independently reviewed to ensure effectiveness. Penetration testing, vulnerability disclosure programs, third party risk assessments, and incident response tabletop exercises aim to help defenses remain robust […].” (FCF, p.13)

3.2.2.3 Replication of evaluations by third parties (30%) 25%

The FCF includes a statement that security controls are “independently reviewed to ensure effectiveness”, providing a high-level commitment to external containment KCI efficacy assessment without operational detail on required expertise or guarantee of independence. Beyond this, the “Model Safety Bug Bounty Program through HackerOne” is brought up repeatedly as one of the main ongoing ways to spot vulnerabilies in Anthropic’s models, covering mainly deployment KCIs. The HackerOne affiliation provides a useful initial filter, but does not specify any additional vetting done to guarantee relevant expertise and evaluator independence.

Quotes:

“Security control monitoring, testing, and assessments: Security controls are regularly tested and independently reviewed to ensure effectiveness. Penetration testing, vulnerability disclosure programs, third party risk assessments, and incident response tabletop exercises aim to help defenses remain robust […].” (FCF, p.13)

“We run our Model Safety Bug Bounty Program through HackerOne to incentivize third-party researchers to discover and report vulnerabilities […]. We pay up to $45,000 per novel, universal jailbreak identified. […] Since May 2025, we have averaged 100+ active hackers monthly. […] We contract with threat intelligence vendors to monitor and scrape the deep and dark web for: (i) publicly available universal jailbreaks of concern […]; (ii) black markets for model jailbreaks; (iii) reports of API key leaks […].” (Risk Report, pp.70–71)

“Since launching our upgraded classifier guards and bug bounty in May of 2025, we have not become aware of any publicly known universal jailbreaks […]. We have become aware of jailbreaks via our bug bounty and via external red-teaming, and have remediated all but the most recent of these […]. On the other hand, the jailbreaks that we found privately (via our bug bounty or external red-teaming) took longer to remediate than we had hoped.” (Risk Report, p.74)

“We will maintain or improve on our ASL-3 protections, which include […] red-teaming, bug bounties, and threat intelligence for continually assessing the threat of jailbreaks […]. Specifics may change, but we will maintain equally or more robust measures over time and will publish updates in our Risk Reports.” (RSP, p.6)

3.2.3.1 Sharing of evaluation results with relevant stakeholders as appropriate (85%) 50%

The RSP commits to openly publishing Risk Reports, which include the results of evaluations. These are redacted if needed, with predefined criteria for redaction provided, including legal compliance, IP protection, safety considerations, or privacy. The FCF mentions maintaining a “Serious Incident Reporting Policy” which defines internal processses for keeping track of relevant information about serious AI incidents, which are then shared with the relevant authorities, as appropriate. However, this is a general requirement to monitor and report “serious”/”critical” incidents, rather than a commitment to notifying regulators or relevant government authorities in the event of specific KRI thresholds being crossed.

Quotes:

“We will publish Risk Reports discussing the risks of our systems and how we have made determinations about whether to continue AI development and deployment in light of the risks. […] Scope. A Risk Report will cover all publicly deployed models at the time of its publication. It will also cover internally deployed models that we determine (1) could pose risks related to high-stakes misalignment or automated R&D that (2) significantly exceed those posed by models covered by a prior Risk Report. […] Timing. We will publish a Risk Report every 3-6 months.” (RSP, p.10)

“We will publish a public version of our Risk Report. We will aim to minimize redactions to the public version of the report. Reasons we may redact material include but are not limited to:
1. Legal compliance […]
2. Intellectual property protection […]
3. Public safety considerations […]
4. Privacy […]” (RSP, p.13)

A Risk Report will document the following:
1. Threat model identification […]
2. Threat model specification […]
3. Evidence (including evaluations) about relevant model capabilities and behaviors […]
4. Risk mitigations: For each in-scope model, the mitigations we are implementing across security, deployment safeguards, and alignment domains, along with discussion of their effectiveness. […]
Threat-specific risk assessment: For each threat model, we will analyze remaining absolute risk […] and (as relevant) whether we believe we’re meeting the risk mitigation standards corresponding to them.” (RSP, pp.11–12)

“When we publicly deploy a model that we determine is significantly more capable than any of the models covered in the most recent Risk Report, we will publish a discussion (in our System Card or elsewhere) of how that model’s capabilities and propensities affect or change the analysis in the Risk Report. […] Within 30 days of determining that we have an internally deployed model that is in-scope […], we will publish a discussion (in a System Card or elsewhere) […].” (RSP, p.10)

“Anthropic maintains a detailed Serious Incident Reporting Policy which sets out our internal processes and measures for keeping track of, documenting, and reporting relevant information about:
– Critical Safety Incidents pertaining to Anthropic’s Frontier Models in pursuant to Section 22757.13 of California’s Transparency in Frontier AI Act (‘TFAIA’); and
– Serious AI Incidents along the entire GPAISR model lifecycle, in accordance with Commitment 9 (Serious Incident Reporting) of the EU Code and the obligations in Article 55(1)(c) of the EU AI Act. […]
One or more members of the incident response team then leads a technical investigation to enable the determination of whether the incident is an AI Incident (and in turn a Serious AI Incident) and/or a Critical Safety Incident and inform appropriate mitigation steps, including gathering relevant information for Anthropic’s reporting to appropriate authorities where applicable, pursuant to the relevant reporting deadlines.” (FCF, p.11)

3.2.3.2 Commitment to non-interference with findings (15%) 0%

No commitment to permitting the reports, which detail the results of external evaluations (i.e. any KRI or KCI assessments conducted by third parties), to be written independently and without interference or suppression.

Quotes:

No relevant quotes found.

3.2.4.1 Identifying novel risks post-deployment: engages in some process (post deployment) explicitly for identifying novel risk domains or novel risk models within known risk domains (50%) 10%

The FCF mentions identifying “systemic risks on an ongoing basis across the entire model lifecycle”, but does not provide any further information on this process.

Quotes:

“We identify systemic risks on an ongoing basis across the entire model lifecycle.” (FCF, p.5)

3.2.4.2 Mechanism to incorporate novel risks identified post-deployment (50%) 10%

For EU models, the FCF includes a commitment to conduct an “additional full systemic risk assessment” if Anthropic has “reasonable grounds to believe” that risk acceptability justifications have been “materially undermined”, but does not specify whether the discovery of novel risks or risk pathways is included in these “reasonable grounds”. It also does not explicitly apply to non-EU models.

Quotes:

“[F]or any of our EU models that are subject to this Framework, if we have reasonable grounds to believe that the justification for why risks stemming from the model are acceptable as set out in the relevant Model Report has been materially undermined, we will complete an additional full Systemic Risk Assessment. We will update our Model Report as appropriate following this additional Systemic Risk Assessment.” (FCF, p.13)