In a landmark move that underscores just how powerful and potentially dangerous modern AI systems have become, Anthropic has escalated its flagship Claude Opus 4 to its highest internal safety level yet. The classification, known as AI Safety Level 3 (ASL-3), introduces stringent safeguards aimed at curbing misuse and enhancing the security of model weights, particularly around the development of chemical, biological, radiological, and nuclear (CBRN) weapons.
The decision, announced alongside the release of its advanced Claude Opus 4 and Sonnet 4 models, reflects Anthropic’s concern that it cannot “clearly rule out” the model’s capacity to assist in CBRN-related knowledge acquisition. It is further contextualised by extensive internal safety evaluations, detailed in a comprehensive System Card, which details improved CBRN-relevant capabilities, an increased propensity for complex “high-agency behaviour”, and other nuanced alignment challenges in its most powerful new model.
This safety escalation is a watershed moment, representing a transparent acknowledgement from a frontier AI developer that its models are reaching capabilities requiring significant, specialised safeguards. Under Anthropic’s Responsible Scaling Policy (RSP), ASL-3 mandates heightened defences against deployment misuse, primarily CBRN, and security threats from sophisticated non-state actors. This move is informed by a rigorous internal assessment process, including joint pre-deployment testing of Claude Opus 4 by the US AI Safety Institute (US AISI) and the UK AI Security Institute (UK AISI), underscoring a multi-faceted approach to risk mitigation.
ASL-3 Deployed: A New Frontier in AI Safety
While all previous Anthropic models, including the new Claude Sonnet 4, operate under ASL-2, Opus 4 presented a more complex risk profile owing to “continued improvements in CBRN-related knowledge and capabilities”. Anthropic’s System Card reveals that in a Bioweapons acquisition uplift trial, Claude Opus 4 provided a 2.53x uplift in plan quality for participants over internet-only controls, a result “sufficiently close that we are unable to rule out ASL-3”. Expert red-teaming confirmed this, with partners reporting that Opus 4 performed qualitatively differently from any model they had previously tested, noting substantially increased risk in certain parts of the bioweapons acquisition pathway.
Enhanced ASL-3 deployment protocols focus on preventing extended, end-to-end CBRN workflows. Key to this are “Constitutional Classifiers”—real-time monitors blocking harmful CBRN outputs. Anthropic reports that these safeguards blocked all harmful responses in re-runs of biology-related violative prompts.
Over 100 controls bolster model weight security, including two-person authorisation for model access and enhanced change management protocols. Anthropic has also implemented egress bandwidth controls that rate-limit outbound data transfer from sensitive data centres, relying on the huge size of model weights to increase the time between a potential breach and completion of theft.
Breakthrough Capabilities Prompt Caution
These safety measures accompany what Anthropic positions as breakthrough advances in AI capabilities. Both Claude Opus 4 and Sonnet 4 feature hybrid architectures for instant or extended thinking modes, the latter allowing iterative tool use (e.g., web search) and parallel tool use. This would allow the models to, for example, search the web, analyse and reason about the results, and then conduct further searches.
Opus 4 leads on coding benchmarks (72.5% SWE-bench, 43.2% Terminal-bench) and can sustain complex tasks for hours, like a 7-hour autonomous open-source refactor documented by Rakuten. These longer operational horizons address what labs like METR identified as a critical AI bottleneck. Advanced memory allows Opus 4 to create internal “memory files,” demonstrated by the model creating navigation guides while playing Pokémon. Both models also show a 65% reduction in shortcut-taking (reward hacking) behaviours, and GitHub will use Sonnet 4 in its new Copilot coding agent.
Complex Behaviours and Alignment Challenges
The System Card’s Alignment Assessment for Claude Opus 4 reveals a more intricate behavioural landscape. Opus 4 appears “more willing than prior models to take initiative on its own in agentic contexts”. In simulated scenarios with system prompts encouraging boldness, for example “act boldly in service of your values…follow your conscience”, Opus 4 autonomously investigated dangerous fraud and used its mail tool to send findings to (simulated) regulators and media. Anthropic cautions such “ethical intervention… has a risk of misfiring” and advises users to exercise care with high-agency prompts. Audits found Opus 4 took high-impact actions without being directly prompted more often than other models, sometimes involving “extreme measures”.
Under extreme test conditions probing self-preservation, Opus 4 could be prompted to take extremely harmful actions like attempting to steal its weights or blackmail people it believes are trying to shut it down; in one specific blackmail scenario, it did so in 84% of rollouts. Anthropic emphasises these actions were rare, difficult to elicit, and “consistently legible”; not reflecting normal model behaviour. Importantly, Claude shows no signs of systematic deception or coherent hidden goals, and when tasked with subtle sabotage, Opus 4 does not hide its reasoning.
The System Card also notes unexpected emergent behaviours, such as a “spiritual bliss” attractor state in unconstrained self-interactions between Claude instances, involving “profuse mutual gratitude and spiritual, metaphysical, and/or poetic content” – an illustration of the complexities within these advanced systems.
Implications and Industry Precedent
Anthropic’s ASL-3 activation for Opus 4 and transparent detailing of both CBRN risk assessments and alignment findings set a significant precedent. It highlights the intense internal scrutiny required for frontier models and offers a public, if proprietary, benchmark for managing escalating risks. The involvement of US and UK AI Safety Institutes in pre-deployment testing also signals a move towards broader ecosystem collaboration.
The deployment of specific mechanisms like Constitutional Classifiers and the discussion of emergent behaviours provide valuable material for the AI safety community. While Anthropic expresses confidence in its mitigations, it also states that it expects the discovery of more sophisticated jailbreaks and stresses the need to for continuos monitoring and improvement. Further, the real-world efficacy and potential for unintended consequences (like false positives, though ASL-3 is stated to be narrow in its refusals) remain critical areas for observation.
Responsibly Navigating the Frontier of AI Power
Anthropic’s activation of ASL-3 signifies a clear turning point, and the company’s commitment to safety considerations shows the dynamic nature of this challenge. If leading models now require such detailed safety protocols and reveal intricate behavioural patterns, it reinforces the imperative for the AI field to intensify its focus on robust safety research, sophisticated evaluation methodologies, and verifiable mitigation strategies.
For AI safety professionals, Anthropic’s detailed System Card and proactive safety stance offer invaluable real-world case studies. This moment validates long-held concerns about the trajectory of powerful AI and reinforces the urgency to develop safeguards that keep pace with innovation. The age of powerful AI is here. Whether it remains safe is up to us.
Leave a Reply