Anthropic safety capability thresholds – 2029

Anthropic’s September 29 report says Zhipu AI’s open-weight GLM-5.3 built an end-to-end exploit in 50 of 410 ExploitBench attempts; Claude Mythos Preview did so in 56 of 410. On Anthropic’s separate 100-task control-flow-hijack benchmark, GLM-5.3 succeeded on four tasks and Mythos on six. Anthropic reports GLM-5.3’s simulated attack safeguards were bypassed in 64% of tests with a cover story, 92% with prefilling and 100% after abliteration. The trials used an isolated fake-tool environment; no model-generated code was executed. Anthropic’s report

Anthropic launched Claude Sonnet 5.5 on September 28. The company reports 70.6% on Terminal-Bench 4.0 versus Sonnet 5's 10.3%, generation over 30% faster, and up to 30% lower per-task cost for most work. Anthropic says Sonnet 5.5 does not advance its capability frontier; it describes the model's cyber capabilities as comparable to Opus 5 and says it applied Opus-like cyber safeguards, while biology safeguards remain the same as Sonnet 5's. Its automated behavioral audit covered roughly 1,850 scenarios and found improved or matched results on most alignment, misuse-resistance and honesty measures. The market tracks Anthropic's official AI R&D-4 and CBRN-4 threshold assessments; this release reports benchmark scores and safeguards. Anthropic's release

Anthropic reports that roughly 950 Claude agents searched more than 200,000 reverse transcriptases over 21 hours (210 million tokens), narrowing 3,500 candidate systems to 20. The team then experimentally identified ART, a bacteriophage reverse transcriptase beside a repeated DNA array and accessory protein; its function remains unknown, and the lab experiments detected short RNAs. Anthropic says its lab work uses BSL-1/BSL-2 strains and no human-infecting pathogens. Anthropic’s method, results and preprint.

Anthropic’s September 22 Opus 5.5 system card places the model at CB-1, below its next biological capability threshold, CB-2. It says Opus 5.5 is at or slightly above Mythos 5.1 on AI R&D tasks, remains below Anthropic’s next automated AI R&D threshold, and has produced no sustained AI-attributable doubling of development speed. Anthropic’s capability assessments and supporting tests.

Anthropic’s head of life sciences, Eric Kauderer-Abrams, confirmed that the company is conducting physical biology experiments in its own laboratory and with external partners. He described automation of laboratory execution as being at an early stage. Reuters also reports work toward having Claude direct laboratory robots with limited human intervention; Anthropic says human oversight remains essential. Reuters, September 18: Anthropic’s laboratory work and automation plans.

Anthropic’s August measurements put 26% of its AI R&D work at “AI leads”: Claude handles most of a task from a high-level prompt while a human supervises. Over 90% was rated at least “AI collaborates”; fully autonomous work was 0%. The index weights task categories by estimated staff time and uses Claude to assign ratings. Anthropic: measurements, definitions and validation against staff ratings.

Queensland's premier announced Anthropic's first Australian datacentre lease on 16 September. Reuters, citing people familiar with the deal, reports 2.16 GW of planned campus capacity for inference, with the first capacity expected online in 2027. The deal awaits Foreign Investment Review Board approval.

Reuters: proposed capacity, intended use and approval conditions; Guardian: the premier's announcement.

Amodei commits Anthropic to embedded external evaluators with employee-like access and independent publication rights.

Anthropic reports five potential biological misuse cases, while explicitly declining to assert harmful intent.

Anthropic reports 11-day formalization of Fermat’s Last Theorem. This verifies an existing proof; it does not establish the aggregate AI R&D threshold.

“Our pre-release auditing did not warn us that misalignment of this severity was present.” — Anthropic.

Mythos 5.1 still falls below CB-2 and the automated AI R&D threshold; Anthropic reports no sustained AI-attributable 2× acceleration. System card.

Both AI R&D-4 and CBRN-4 are high thresholds to pass, although AI capabilities improvements have been carrying along very quickly. However, there are some variables outside of AI research that are important to remember when thinking about forecasting when these thresholds will be released:

1. It's not inevitable that AI companies are financially able to carry on full-speed ahead with their research until the end of 2030, as there is a very real chance of a major market correction. OpenAI and Anthropic are burning massive amounts of money, and one or both of these companies might run out of money in the near future. Furthermore, AI companies are starved for compute to the point that it is affecting the reliability of their products (Claude's uptime has been quite weak over the past several months). While companies have moved away from scaling as the primary source of their gains, I think that it will still require increasing huge amounts of money to train new SoTA models.

2. There is already starting to be a societal backlash to AI, and I expect this to significantly increase to the point where it influences how AI companies operate. I think this might influence the leading AI companies to be more cautious of pushing capabilities forward.

3. Even without a backlash, the companies might be more cautious of pushing capabilities forward as their models become more powerful. And leading AI companies might decide it is best to focus more of their time/effort/resources on monetizing the products they already have instead of racing toward superintelligence.

With that said, the leading AI companies have made it clear that they are focused on automation of AI R&D, so I expect them to continue this goal until one or more of the other variables I mentioned makes it harder for them to do so. It's important to also look at their definition: "the ability to fully automate the work of an entry-level, remote-only Researcher at Anthropic." This is impressive, but these entry-level researchers are not necessarily the ones responsible for Anthropic's biggest gains in capabilities (although I have never worked there, so perhaps I am underestimating how fundamental their entry-level researchers are to Claude's capability gains).

The CBRN-4 forecast is a bit of a different situation, as the leading AI companies are concerned with releasing dangerous models, so I do not expect them to release a model to the general public if it's clear that the model crosses the CBRN-4 threshold. Perhaps such a model could be used internally for AI research or given to very select clients (such as the US government) for use, so I'm not completely discounting the fact that these companies do not release dangerous models at all, even if these releases are not available to the general public. Claude Mythos is a good example that perhaps foreshadows such a scenario.

Here are my current forecasts:

AI R&D-4:

By end of 2026: 10%

By end of 2027: 25%

By end of 2028: 40%

By end of 2029: 55%

By end of 2030: 65%

In general, I'm less confident than the crowd forecast that AI R&D-4 is right around the corner.

CBRN-4:

By end of 2026: 3%

By end of 2027: 10%

By end of 2028: 25%

By end of 2029: 40%

By end of 2030: 50%

I am higher than the crowd for CBRN-4 because I think Anthropic might decide just to release its more dangerous models to the US government, and I'm skeptical the AI safety research they do could fully prevent these models from having more dangerous capabilities as their overall capabilities continue to improve.

Some disconnected, rough thoughts: 

As far as I can tell from some research, Anthropic hasn’t yet even clearly stated that they have crossed the CBRN-3 threshold (“the ability to significantly assist

individuals or groups with basic STEM backgrounds in obtaining, producing, or deploying CBRN weapons”), although they did activate ASL-3 protections. In general, it seems that the standards of evidence they are using for the “rule in” thresholds of capability are high, and I also expect they don’t have many incentives for performing strict experiments just in order to clearly confirm dangerous capabilities (relatively little upside in doing so, as long as they internally act precautionarily when not “ruling out” dangerous capability levels). 

It is also not clear how this question is handling “AI R&D-4”. The standards for automated R&D from RSP v3.0 seem substantially higher than AI R&D-4 from the previous RSP, particularly when reading things such as Claude Mythos Preview System Card, which among other things suggests that a productivity uplift on individual tasks on the order of 40× (an order of magnitude higher than the current geometric mean of 4× from surveys) would be required to yield an overall progress multiplier of 2×. 

My reading is that Anthropic will officially need to acknowledge that any of the definitions has been met. 

Now that AI R&D-4 has been deprecated, this lower threshold may never be officially tested again.

In general, one fundamental issue with these questions is that there will likely be a substantial (at least months) distance between the point where we have the actual underlying capability (particularly under refined scaffolds and with people being prepared to smartly leverage the model’s strengths and having good incentives for successful elicitations, which probably does not happen in the CBRN tests from Anthropic or similar tests from other companies) and the point where the capability is officially announced.

Reading things like Biorisk \ red.anthropic.com, info about Mythos, and generally about METR time horizons progress (even though this is purely about software engineering), makes me expect that (actual) CBRN-4 is much closer than what is suggested by the baseline starting probabilities, if not already here. However, related to a previous observation, there seems to be little benefit in the current environment to clearly state that their models have high CBRN risk: it seems that the current administration or adversaries could use an honest assessment against Anthropic, and the upside how showing others a very clear lower bound on dangerous capabilities seems low at the moment, on both commercial grounds and even e.g. for clear signaling with the hopes of generating common knowledge and promoting urgent safety regulations. The political/regulatory considerations might change in the following years as AI and its associated risks become more mainstream, and I think there could be substantial changes in policy here after the 2028 presidential elections. Importantly, the tradeoffs for Anthropic officially declaring some dangerous capability thresholds could also change if another company faces a public incident that makes it clear that some capability level has been reached, or if another AI company declares equivalent capability thresholds as met (and this consideration made me adjust my initial probabilities up).

AI R&D is likely much more dangerous overall on the medium and long term than CBRN, but this is less obviously clear, and also has more obvious commercial upside and thus potential of attracting inversion. Also, the people surveyed for determining current AI R&D acceleration within Anthropic are much better at eliciting the underlying capabilities of the models than the people surveyed to determine the CBRN uplift. So, in general, I would typically expect less gap between actual capability and official announcement, but on the other hand the substantial increase in difficulty (and widening of definitional wiggle room) from RSP v2.1 to 3.0 makes me think that Anthropic might prefer to express the AI R&D gains while delaying actually indicating that the thresholds have been crossed.

Finally, I would expect that at some point the AI capabilities are so strong that Anthropic could very well just say what everyone already knows about some thresholds having been crossed. But there seems to be little benefit (from the perspective of providing public knowledge and that of signalling trustworthiness and a safety-conscious approach) once we are at that point. And the CBRN-3 example already seems to point in the direction of previous thresholds being treated as surpassed without ever being explicitly recognized as such.