SafetyPage

Lab system cards and frameworks · Article · Anthropic

Redacted Risk Report, August 2026

14 Aug 2026

Read at anthropic.com ↗Read at sourceAll rights reserved

Outline · 186 pages

  1. Risk Report: August 2026p. 1
  2. 1 Introduction and executive summaryp. 7
  3. 1.1 Structure of the reportp. 8
  4. 1.2 Executive summary of findingsp. 9
  5. 1.3 Changes to our RSP since the most recent Risk Reportp. 13
  6. 1.3.1 Updated threshold for automation of AI R&Dp. 13
  7. 1.3.2 Updated threshold for development of novel biological and chemical weaponsp. 14
  8. 1.3.3 Coverage dates of risk reportsp. 14
  9. 1.3.4 Redaction scope and transparencyp. 15
  10. 1.3.5 Governance and review changes around Risk Reportsp. 15
  11. 1.4 Notes on coverage of unreleased modelsp. 15
  12. 2 Autonomy threat model 1: Misalignment in high-stakes settingsp. 17
  13. 2.1 Overviewp. 17
  14. 2.2 Threat modelp. 18
  15. 2.2.1 Specific pathwaysp. 20
  16. 2.3 Relevant AI modelsp. 20
  17. 2.4 Summary and methodologyp. 20
  18. 2.5 Definitionsp. 22
  19. 2.6 Claims and core argumentp. 25
  20. 2.7 Claim 1: Models are unlikely to have strong covert capabilitiesp. 27
  21. 2.8 Claim 2: Expected harm from known misalignment is lowp. 36
  22. 2.9 Claim 3: Unknown severe pervasive misalignment is very unlikelyp. 39
  23. 2.9.1 Claim 3.1: Experience with prior Anthropic models suggests that unknown severe pervasive misalignment is unlikely in covered modelsp. 39
  24. 2.9.2 Claim 3.2: Our experience with adversarially-designed training processes suggests that unknown severe pervasive misalignment is somewhat unlikely in covered modelsp. 40
  25. 2.9.3 Claim 3.3: It is somewhat unlikely that the specific training processes used to train the covered models produced unknown pervasive misalignmentp. 41
  26. 2.9.4 Claim 3.4: The presence of unknown severe pervasive misalignment is unlikely given our alignment assessmentp. 45
  27. 2.10 Claim 4: Expected harm from unknown severe context-dependent misalignment is lowp. 51
  28. 2.11 Claim 5: Catastrophic harm from known misalignment and unknown context-dependent misalignment is likely to be mitigatedp. 53
  29. 2.11.1 Claim 5.1: Catastrophic harm from reversible threats other than diffuse sandbagging, emerging from internal usage, and caused by known or context-dependent misalignment, is likely to be mitigatedp. 54
  30. 2.11.2 Claim 5.2: Catastrophic harm from diffuse sandbagging caused by known or context-dependent misalignment is likely to be mitigatedp. 60
  31. 2.11.3 Claim 5.3: Catastrophic harm from irreversible threats, emerging from internal usage, and caused by known or context-dependent misalignment is likely to be mitigatedp. 60
  32. 2.11.4 Claim 5.4: Catastrophic harm from external usage caused by known or context-dependent misalignment is unlikely compared with internal usage, and somewhat likely to be mitigatedp. 62
  33. 2.12 Claim 6: Catastrophic harm from unknown pervasive misalignment is somewhat likely to be mitigatedp. 63
  34. 2.13 Claim 7: Threat modeling is sufficientp. 63
  35. 2.14 Claim 8: Risk from deliberately engineered misalignment is lowp. 65
  36. 2.15 Pathway-specific risk assessmentsp. 65
  37. 2.16 Limitationsp. 67
  38. 2.16.1 Models might have stronger covert capabilities than we believep. 67
  39. 2.16.2 Relevant capabilities and propensities might change suddenly with scalep. 68
  40. 2.16.3 Evaluation awareness may be more prevalent than we believep. 68
  41. 2.16.4 There may be forms of context-dependent misalignment that are harder to find and more harmful than we expectp. 68
  42. 2.17 Considerations outside the scope of this sectionp. 69
  43. 2.18 Pre-internal-deployment review processp. 70
  44. 2.19 Overall assessment of riskp. 71
  45. 2.20 Claude’s review of this risk assessmentp. 72
  46. 2.21 Looking forwardp. 74
  47. 2.22 Models other than Mythos 5 and Model 2p. 75
  48. 2.23 Appendix: Detailed description of internal usage monitoringp. 76
  49. 2.23.1 Asynchronous monitoringp. 76
  50. 2.23.1.1 Automated offline monitoring overviewp. 76
  51. 2.23.1.2 Automated offline monitoring evaluationsp. 78
  52. 2.23.1.3 Offline monitoring during training and evaluationsp. 81
  53. 2.23.1.4 Other forms of asynchronous monitoringp. 81
  54. 2.23.2 Blocking interventionsp. 82
  55. 2.23.2.1 Model weight securityp. 82
  56. 2.23.2.2 Sandboxing in training and evaluationsp. 82
  57. 2.23.2.3 PR reviewsp. 83
  58. 2.23.2.4 Sandboxing and blocking classifiers in internal deploymentsp. 83
  59. 2.23.3 Important limitations of our model-external risk mitigationsp. 83
  60. 2.23.4 Changes to risk mitigations since our previous risk reportp. 84
  61. 2.24 Appendix: Details of power seeking environment evaluationp. 84
  62. 2.25 Appendix: Active research into reward hacking generalizationp. 86
  63. 2.25.1 Setupp. 87
  64. 2.25.2 Evaluation behaviorp. 87
  65. 3 Autonomy threat model 2: Risks from automated R&Dp. 93
  66. 3.1 Overviewp. 93
  67. 3.2 Threat modelp. 94
  68. 3.3 Relevant AI modelsp. 96
  69. 3.4 Substitution of our AI models for Anthropic researchersp. 97
  70. 3.4.1 Failure modes from internal usep. 98
  71. 3.4.2 Researcher surveyp. 99
  72. 3.4.3 CoBenchp. 99
  73. 3.5 Acceleration of AI progress due to automated AI R&Dp. 101
  74. 3.5.1 AECI capability trajectoryp. 102
  75. 3.5.2 Conclusions on the overall degree of AI R&D accelerationp. 103
  76. 3.6 Automated R&D in other domainsp. 103
  77. 3.6.1 Introductionp. 103
  78. 3.6.2 Roboticsp. 105
  79. 3.6.3 Biotechnologyp. 105
  80. 3.6.4 Energyp. 106
  81. 3.6.5 Semiconductorsp. 108
  82. 3.6.6 Weapons developmentp. 108
  83. 3.6.7 Neurotechnologyp. 109
  84. 3.6.8 Nanotechnologyp. 110
  85. 3.7 Our risk mitigationsp. 110
  86. 3.7.1 Changes to risk mitigations since our previous risk reportp. 110
  87. 3.8 Overall assessment of riskp. 112
  88. 3.9 Looking forwardp. 112
  89. 3.10 Connection to our recommendations for industry-wide safetyp. 113
  90. 4 Chemical and biological weapons productionp. 115
  91. 4.1 Overviewp. 115
  92. 4.2 Threat modelsp. 116
  93. 4.2.1 CB-1 threat modelp. 116
  94. 4.2.2 CB-2 threat modelp. 118
  95. 4.2.3 Timescale and scope of upliftp. 121
  96. 4.3 Relevant AI modelsp. 122
  97. 4.4 Current state of model capabilitiesp. 123
  98. 4.4.1 Notes on how we weigh evidencep. 123
  99. 4.4.2 CB-1 evidencep. 123
  100. 4.4.2.1 General update from a randomized controlled trial on uplift from AI modelsp. 124
  101. 4.4.3 CB-2 evidence for Mythos Preview, Fable 5, and Mythos 5p. 125
  102. 4.4.4 CB-2 evidence for Opus 4.8 and other Opus and Sonnet modelsp. 128
  103. 4.5 Our risk mitigationsp. 130
  104. 4.5.1 Robustness levels: Level 1, Level 2, Level 3p. 132
  105. 4.5.2 Coverage levelsp. 133
  106. 4.5.2.1 Extension in coverage since our prior Risk Reportp. 133
  107. 4.5.2.2 Wider coverage of CB classifiers for Fable 5p. 134
  108. 4.5.3 Evidence about robustness of classifiersp. 135
  109. 4.5.3.1 Ongoing bug bounty resultsp. 135
  110. 4.5.3.2 Notes on jailbreak methods that remain viable on at least some models in some casesp. 136
  111. 4.5.3.2.1 Boundary-point jailbreakingp. 136
  112. 4.5.3.2.2 UK AISI-sourced jailbreakp. 139
  113. 4.5.3.2.3 Coverage gap identified by both Anthropic and UK AISIp. 139
  114. 4.5.3.2.4 Bug-bounty-sourced jailbreakp. 139
  115. 4.5.4 Offline monitoringp. 139
  116. 4.5.5 Bioclassifier exemptionsp. 140
  117. 4.5.5.1 Exemptions for Mythos Preview, Mythos 5, and Fable 5p. 140
  118. 4.5.5.2 Exemptions for all other sub-Mythos-class commercial modelsp. 141
  119. 4.5.5.3 Access controls for other models not available for general accessp. 142
  120. 4.5.5.3.1 Helpful-only modelsp. 142
  121. 4.5.5.3.2 Claude Govp. 143
  122. 4.5.5.3.3 Pre-deployment access to unreleased modelsp. 143
  123. 4.5.5.4 Malicious access via prompt injectionp. 144
  124. 4.5.6 Threat intelligencep. 145
  125. 4.5.7 Model weight securityp. 146
  126. 4.5.8 Changes to our risk mitigations since our last Risk Reportp. 146
  127. 4.5.8.1 Slight relaxations to our model weight storage criteriap. 146
  128. 4.5.8.2 Incidents related to our classifiers and access controlsp. 147
  129. 4.5.8.2.1 Unauthorized Mythos Preview access on our human feedback platformsp. 147
  130. 4.5.8.2.2 All human feedback vendor traffic run without blocking biological classifiersp. 148
  131. 4.6 Overall assessment of riskp. 150
  132. 4.6.1 Risks from the CB-1 threat modelp. 150
  133. 4.6.2 Risks from the CB-2 threat modelp. 151
  134. 4.7 Looking forwardp. 153
  135. 4.8 Connection to our recommendations for industry-wide safetyp. 155
  136. 5 Cross-cutting contentp. 158
  137. 5.1 Acceleration dynamicsp. 158
  138. 5.1.1 Distillationp. 159
  139. 5.1.1.1 Introductionp. 159
  140. 5.1.1.2 Thinking and connector text summarizationp. 160
  141. 5.1.1.2.1 Mitigations for deliberate bypassesp. 163
  142. 5.1.2 Our overall state on acceleration dynamicsp. 163
  143. 5.2 Safety process failuresp. 163
  144. 5.2.1 Introductionp. 163
  145. 5.2.2 Partial refusals on safety work undermining stress-testing researchp. 164
  146. 5.2.3 Exposing chain-of-thought reasoning to grading pressurep. 165
  147. 5.2.4 Directly training on misaligned behavior during a production training runp. 166
  148. 5.2.5 An instance of unmonitored unrestricted agents with access to sensitive resourcesp. 167
  149. 5.2.6 Repeated training on alignment-faking transcript datasetsp. 168
  150. 5.3 Benefits from Anthropic’s operating as a frontier AI companyp. 169
  151. 5.3.1 Key examples of beneficial Anthropic activities and choices since our last Risk Reportp. 169
  152. 5.4 Overall risk assessment and risk-benefit determinationp. 173
  153. 5.5 Looking back on roadmap progress and AI development and deployment decisionsp. 174
  154. 5.5.1 Decisions to develop and deploy increasingly capable modelsp. 174
  155. 5.5.2 Updates on our Frontier Safety Roadmapp. 174
  156. 6 Appendicesp. 175
  157. 6.1 Threat model criteriap. 175
  158. 6.2 [Appendix redacted]p. 176
  159. 6.3 [Appendix redacted]p. 176
  160. 6.4 Model weight securityp. 176
  161. 6.4.1 Overviewp. 176
  162. 6.4.2 Notable security controlsp. 177
  163. 6.5 List of minor incidents related to our CB risk mitigationsp. 178
  164. 6.6 Our AI modelsp. 181
  165. 6.6.1 List of all Claude models, sorted by release datep. 185