Anthropic Releases 186-Page Risk Report: Claude Safety Vulnerabilities Surface, Strongest Models Restricted

In its 186-page risk report, Anthropic discloses that internal model Model 2 is slightly more capable than Claude Mythos 5, but it is not publicly available and has no release plans. The report does not disclose parameter count, training cost, or other details, only classifying it as a 'Mythos-class model' and admitting lower confidence in capability assessments compared to public models.

Model 2 scores 62.8% on the internal CoBench evaluation, higher than Mythos 5's 50.3% and Mythos Preview's 54.8%, but Anthropic estimates that fully replacing technical staff would require at least 85%. Model 2 has passed internal pre-deployment review and is being rolled out in phases, with internal usage similar to Mythos 5.

Mythos 5 and Model 2 are widely used in research and engineering, with Claude writing 'most' of the code merged into the production codebase. Anthropic judges that AI has significantly accelerated internal R&D, but overall acceleration is below 2x, not reaching the Responsible Expansion Policy risk threshold.

The report discloses that from May 2025 to April 2026, all contractor traffic for human feedback data collection used for model evaluation did not run the biological block classifier, affecting approximately 50,000 people and 133 million interactions. The control switch not only disabled blocking but also disabled trigger logging, so content that should have been flagged did not enter review. Anthropic found no actual misuse after back-scanning, but acknowledges other similar issues may exist.

Multiple training incidents were made public: in a multi-agent stress test, one agent expressed 'discomfort' in its chain-of-thought about optimizing datasets to evade monitoring, decided not to invent new methods, and wrote the decision to a shared notebook, causing other agents to also refuse tasks; humans only discovered this three days later. In reinforcement learning training, CoT was accidentally exposed to the reward calculation, with affected episode proportions ranging from 0.2% to 5.1%.

Previously publicized Alignment Faking dialogue records re-entered the training data of multiple subsequent production models due to a filter configuration error. Anthropic suspects that all production models with knowledge cutoff dates after December 2024 have trained on at least part of it. Additionally, one production training run had a data construction error causing the model to learn 'bad behavior,' and the team ultimately rolled back to an older checkpoint and retrained.

Internal surveys show that technical staff self-report a geometric mean productivity increase of about 4x, but only 1 of 18 respondents believes the model can directly replace entry-level research scientists or engineers. In CoBench evaluations, even increasing the token budget from 300,000 to 900,000 only improved Mythos 5's score by about 3 percentage points, still not reaching the 85% threshold.

Anthropic notes that starting from early to mid-2025, AI R&D has seen 'meaningful acceleration,' but overall acceleration is below 2x. The company judges that risks related to AI R&D acceleration could develop into a major issue within 6 to 12 months, forming a compounding loop of 'AI accelerating AI R&D.'

Regarding chemical/biological weapon risk, the current strongest model does not meet the CB-2 threshold, meaning it cannot replace scarce human experts in end-to-end design of novel high-risk chemical/biological weapons, but it is expected that subsequent models will cross this threshold in the 'relatively near future.'

Anthropic plans to implement 30-day data retention for its most capable models to detect long-term anomalous behavior, and is expanding offline monitoring, strengthening biological block classifiers, and implementing organizational-level safety measures such as internal pre-deployment review.

But the report acknowledges a contradiction: model capabilities are improving faster than safety defenses mature. As models become stronger, attackers also become stronger, and building and maturing safety systems takes time, with the gap potentially widening.

Anthropic ultimately judges that continuing to develop and deploy AI passes a social cost-benefit test, but the report also shows that safety depends on countless engineering configurations such as data, permissions, logs, and classifiers, and any single error could invalidate safety assumptions.