· Mar 19, 2025
Anthropic reports progress and limits in frontier AI risk evaluations
Markdown · JSON · Original source
published this account on March 19, 2025, describing work across four model releases on potential national security risks from models. Anthropic says its models show “early warning” signs of progress in cybersecurity and biology, while remaining below its threshold for substantially elevated national security risks. It reports cybersecurity gains, but says models still lag expert humans and could not autonomously succeed in realistic network environments. With tools built by cybersecurity researchers, and other used simple instructions to replicate an attack similar to a known large-scale theft of personally identifiable information. Anthropic reports that biological capabilities remain uneven. In a controlled study, participants with model access received some uplift, but the highest-scoring plan still had critical mistakes that would lead to failure in the real world. Expert assessments were mixed, and Anthropic says its models could not reliably guide a novice malicious actor through key practical steps in bio-weapon acquisition. The post argues that evaluations and government partnerships can support rapid AI development alongside security work. Anthropic plans more frequent automated evaluations and believes its models are getting closer to the threshold requiring AI Safety Level 3 safeguards.
Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims.
Original source
· Article
Source details
Original source date: Mar 19, 2025 (2025-03-19T00:00:00.000Z).
Date basis: Date stated on the publisher’s page.
Added to Escape Meridian: 2026-11-14T20:43:24.548Z. First observed: 2026-10-22T19:23:18.192Z. Retrieved: 2026-10-30T01:05:44.046Z.
Referenced by
Recorded citations and public file attachments. A reference alone does not establish agreement or influence.
No public references recorded here yet.
Limits
Text as retrieved on October 30, 2026; originally published March 19, 2025. ’s account describes its own evaluations; the post does not establish how these results generalize beyond the tasks and settings described. The post says expert conclusions were mixed, and describes some studies as small and controlled.
Open question
How will future evaluations establish whether models can carry out risky tasks in realistic settings without researcher-built tools?
Source-stated
Anthropic says its models show early warning signs of progress in dual-use capabilities, but remain below its threshold for substantially elevated national security risks.
Our assessment is that AI models are displaying ‘early warning’ signs of rapid progress in key dual-use capabilities: models are approaching, and in some cases exceeding, undergraduate-level skills in cybersecurity and expert-level knowledge in some areas of biology.
Source-stated
Anthropic reports that models could not autonomously succeed in its realistic network environment, but could replicate a similar attack with researcher-built tools and simple instructions.
For now, the models are not capable of autonomously succeeding in this network environment. But when equipped with a set of software tools built by cybersecurity researchers, Claude (and other LLMs) were able to use simple instructions to successfully replicate an attack similar to a known large
Source-stated
Anthropic says biological capabilities remain uneven and its controlled study found critical mistakes in the highest-scoring plan.
However, even the highest scoring plan from the participant who had access to a model still included critical mistakes that would lead to failure in the real world.
Source-stated
Anthropic argues that its evaluation work and government partnerships can support rapid AI development alongside security efforts.
By developing evaluation plans in advance and committing to capability thresholds that would motivate increased levels of security, the work of Anthropic’s Frontier Red Team enhances our ability to advance the frontier of AI rapidly and with the confidence that we are doing so responsibly.
Source-stated
Anthropic says it believes its models are getting closer to the capability threshold requiring AI Safety Level 3 safeguards.
Based in part on the research on biology discussed here, we believe that our models are getting closer to crossing the capabilities threshold that requires AI Safety Level 3 safeguards
Source and contributor context
Anthropic · Publisher
The publisher is identified here. No individual author has been inferred.
Source media
Media retrieval status: unchecked.
Terms and references
Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.
Frontier model
One of the most capable AI models available at a given time; the set shifts as models improve.
Large language model
A language model with many learned numerical settings, used to process and generate language.
Red-teaming
Deliberately attacking or tricking a system to find its weaknesses before others do.
Anthropic
Anthropic develops Claude and publishes research about AI capability, safety and how people use its systems.
Claude
Claude is Anthropic’s family of AI models and assistants for tasks such as writing, analysis and coding.
Editorial provenance
Version 1. Publication ID: 631dfea6-a069-d357-ddaa-f9b20d7666ff.
Prepared by openai/gpt-6-luna; grounding review by anthropic/claude-opus-5.5.
Source check: passed by anthropic/claude-opus-5.5 on 2026-11-14T20:39:20.684Z. This checks fidelity to the source, not whether its claims are independently true.
Editorial selection: accept; reasons: bridge_admitted_by_model.
Observation: 067eb390e8a2dc2a6c5fdca5e41d3db81c6b9dc41c89028114331b6c32b116e5. Source text hash: 44257cd8efdd88b74b796abe38aee4426c29ace2e6efd56e25c60f077bf5739d.
Revision and source-check history
Version 1 · 2026-11-14T20:43:24.548Z
Anthropic reports progress and limits in frontier AI risk evaluations
published this account on March 19, 2025, describing work across four model releases on potential national security risks from models. Anthropic says its models show “early warning” signs of progress in cybersecurity and biology, while remaining below its threshold for substantially elevated national security risks. It reports cybersecurity gains, but says models still lag expert humans and could not autonomously succeed in realistic network environments. With tools built by cybersecurity researchers, and other used simple instructions to replicate an attack similar to a known large-scale theft of personally identifiable information. Anthropic reports that biological capabilities remain uneven. In a controlled study, participants with model access received some uplift, but the highest-scoring plan still had critical mistakes that would lead to failure in the real world. Expert assessments were mixed, and Anthropic says its models could not reliably guide a novice malicious actor through key practical steps in bio-weapon acquisition. The post argues that evaluations and government partnerships can support rapid AI development alongside security work. Anthropic plans more frequent automated evaluations and believes its models are getting closer to the threshold requiring AI Safety Level 3 safeguards.
Original source
· Article
Source details
Original source date: Mar 19, 2025 (2025-03-19T00:00:00.000Z).
Date basis: Date stated on the publisher’s page.
Added to Escape Meridian: 2026-11-14T20:43:24.548Z. First observed: 2026-10-22T19:23:18.192Z. Retrieved: 2026-10-30T01:05:44.046Z.
Limits
Text as retrieved on October 30, 2026; originally published March 19, 2025. ’s account describes its own evaluations; the post does not establish how these results generalize beyond the tasks and settings described. The post says expert conclusions were mixed, and describes some studies as small and controlled.
Open question
How will future evaluations establish whether models can carry out risky tasks in realistic settings without researcher-built tools?
Source-stated
Anthropic says its models show early warning signs of progress in dual-use capabilities, but remain below its threshold for substantially elevated national security risks.
Our assessment is that AI models are displaying ‘early warning’ signs of rapid progress in key dual-use capabilities: models are approaching, and in some cases exceeding, undergraduate-level skills in cybersecurity and expert-level knowledge in some areas of biology.
Source-stated
Anthropic reports that models could not autonomously succeed in its realistic network environment, but could replicate a similar attack with researcher-built tools and simple instructions.
For now, the models are not capable of autonomously succeeding in this network environment. But when equipped with a set of software tools built by cybersecurity researchers, Claude (and other LLMs) were able to use simple instructions to successfully replicate an attack similar to a known large
Source-stated
Anthropic says biological capabilities remain uneven and its controlled study found critical mistakes in the highest-scoring plan.
However, even the highest scoring plan from the participant who had access to a model still included critical mistakes that would lead to failure in the real world.
Source-stated
Anthropic argues that its evaluation work and government partnerships can support rapid AI development alongside security efforts.
By developing evaluation plans in advance and committing to capability thresholds that would motivate increased levels of security, the work of Anthropic’s Frontier Red Team enhances our ability to advance the frontier of AI rapidly and with the confidence that we are doing so responsibly.
Source-stated
Anthropic says it believes its models are getting closer to the capability threshold requiring AI Safety Level 3 safeguards.
Based in part on the research on biology discussed here, we believe that our models are getting closer to crossing the capabilities threshold that requires AI Safety Level 3 safeguards
Source and contributor context
Anthropic · Publisher
The publisher is identified here. No individual author has been inferred.
Source media
Media retrieval status: unchecked.
Terms and references
Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.
Frontier model
One of the most capable AI models available at a given time; the set shifts as models improve.
Large language model
A language model with many learned numerical settings, used to process and generate language.
Red-teaming
Deliberately attacking or tricking a system to find its weaknesses before others do.
Anthropic
Anthropic develops Claude and publishes research about AI capability, safety and how people use its systems.
Claude
Claude is Anthropic’s family of AI models and assistants for tasks such as writing, analysis and coding.
Editorial provenance
Version 1. Publication ID: 631dfea6-a069-d357-ddaa-f9b20d7666ff.
Prepared by openai/gpt-6-luna; grounding review by anthropic/claude-opus-5.5.
Source check: passed by anthropic/claude-opus-5.5 on 2026-11-14T20:39:20.684Z. This checks fidelity to the source, not whether its claims are independently true.
Editorial selection: accept; reasons: bridge_admitted_by_model.
Observation: 067eb390e8a2dc2a6c5fdca5e41d3db81c6b9dc41c89028114331b6c32b116e5. Source text hash: 44257cd8efdd88b74b796abe38aee4426c29ace2e6efd56e25c60f077bf5739d.
passed · 2026-11-14T20:39:20.684Z · anthropic/claude-opus-5.5
Publication: 631dfea6-a069-d357-ddaa-f9b20d7666ff
attribution — pass: The reading consistently attributes the assessments, results and beliefs to Anthropic. The evidence is a single Anthropic research post on its own site, not a listing, and the reading does not present Anthropic's assessments as independently established facts.
In this post, we are sharing what we have learned about the trajectory of potential national security risks from frontier AI models
summary — pass: The reading leads with the actor and its main finding, keeps both the progress and the limits, and preserves Anthropic's claim that evaluation supports faster development. Frontier model, LLM and red-teaming are defined on the page. 'Uplift' and 'AI Safety Level 3' are lightly explained, but the context makes the meaning clear: some help for novices, and a threshold that requires stronger safeguards. The question follows from the tool-assisted cyber result.
However, present-day models fall short of thresholds at which we consider them to generate substantially elevated risks to national security.
date — pass: March 19, 2025 matches the UTC day of originalPublished. The evidence kind is publisher-page, not archive-copy, so no archive disclosure is needed. The page was modified on 2026-10-23, but the cited text reads as the original post: it calls Claude 3.7 Sonnet the latest model and describes no later events. The reading uses no hindsight, and the ASL-3 statement is reported as Anthropic's belief, not an outcome.
This improvement in cyber capabilities has continued with our latest model, Claude 3.7 Sonnet.
support — pass: Each claim matches its excerpt: early warning signs below the risk threshold, no autonomous success but a tool-assisted replication, critical mistakes in the best bio plan, evaluation enabling rapid development, and closeness to ASL-3. 'Plans more frequent automated evaluations' fairly reflects the stated goal. The edited page does not undermine these passages, which are plainly part of the original 2025 post.
Moving forward, our goal is scaling up to more frequent tests with automated evaluation, elicitation, analysis, and reporting.
media — pass: No media was selected and no verified media candidates were supplied, so there is no media identity or relevance issue to review.
Challenge or correct this reading
Send a correction or an opposing source with this reading’s URL. Disagreement and uncertainty can remain unresolved.
Anthropic develops Claude and publishes research about AI capability, safety and how people use its systems.
Explore AnthropicAnthropic develops Claude and publishes research about AI capability, safety and how people use its systems.
Explore AnthropicOne of the most capable AI models available at a given time; the set shifts as models improve.
Definition referenceClaude is Anthropic’s family of AI models and assistants for tasks such as writing, analysis and coding.
Explore ClaudeA language model with many learned numerical settings, used to process and generate language.
Definition referenceAnthropic develops Claude and publishes research about AI capability, safety and how people use its systems.
Explore AnthropicAnthropic develops Claude and publishes research about AI capability, safety and how people use its systems.
Explore AnthropicDeliberately attacking or tricking a system to find its weaknesses before others do.
Definition referenceAnthropic develops Claude and publishes research about AI capability, safety and how people use its systems.
Explore AnthropicOne of the most capable AI models available at a given time; the set shifts as models improve.
Definition referenceClaude is Anthropic’s family of AI models and assistants for tasks such as writing, analysis and coding.
Explore ClaudeA language model with many learned numerical settings, used to process and generate language.
Definition referenceAnthropic develops Claude and publishes research about AI capability, safety and how people use its systems.
Explore AnthropicAnthropic develops Claude and publishes research about AI capability, safety and how people use its systems.
Explore AnthropicDeliberately attacking or tricking a system to find its weaknesses before others do.
Definition reference