Why Claude Opus 4 launched with stronger safety controls

On 22 May 2025, Anthropic released Claude Opus 4 with AI Safety Level 3 protections. The company had not established that the model required that level; its assessments left enough uncertainty to activate the safeguards as a precaution.[1]

The governing document was Responsible Scaling Policy version 2.2, effective eight days earlier. It required an affirmative assessment that a model was sufficiently below a relevant capability threshold to retain the lower protection level. If that case could not be made, the company would apply the stronger safeguards and assess whether an even higher standard was necessary. The consequence of uncertainty was therefore specified before the launch.[3]

What the capability assessment was asking

The Claude 4 system card describes a question about sustained assistance with dangerous work: could a model substantially help someone with basic technical knowledge through the steps involved in creating chemical, biological, radiological or nuclear weapons? Relevant evidence included scientific knowledge, practical problem-solving, tool use and assessments by outside specialists. A good answer to one technical question did not establish that the system could overcome the other bottlenecks in a complete project.[4]

The published results were mixed. Opus 4 had improved biological knowledge and some useful problem-solving abilities, while other tasks remained difficult. Anthropic reported that it could not confidently exclude the lower threshold and judged the model below the next one. Some evaluation details were withheld publicly because of their sensitivity. Readers can examine the assessment’s structure and disclosed evidence, but cannot independently reproduce the whole decision from the public card.[4]

A protection has to become an operating mechanism

The research behind Constitutional Classifiers explains how the first layer can work. A written set of permitted and restricted content categories guides the creation of synthetic prompts and replies. These examples are varied by language and style, then used to train classifiers that examine model inputs and outputs. Training also includes benign material, because a filter that blocks legitimate requests creates its own operational problem.[5]

Anthropic’s earlier classifier research used Claude 3.5 Sonnet, so its performance figures should not be read as measurements of the Opus 4 launch. The researchers acknowledged that new attacks could defeat the system and recommended additional defences. The mechanism can be adapted as weaknesses emerge, but the existence of a classifier does not settle whether the protection remains adequate over time.[5]

The policy also specified what happened if controls fell short

Under version 2.2, the CEO and Responsible Scaling Officer assessed the safeguards and shared a deployment decision and supporting reports with the board and Long-Term Benefit Trust. If required protections were unavailable, permitted interim measures included blocking responses or using a less capable model, with equivalent assurance. If those measures could not adequately reduce deployment risk, the policy required withdrawing the model and replacing it with one below the threshold. These were the policy’s fallback rules, not actions reported as part of this launch.[3]

Read the current policy separately

As checked on 12 October 2026, the latest policy is version 3.4, effective 8 July. It separates Anthropic’s own plans from recommendations it makes for the industry. Its Frontier Safety Roadmap contains public goals rather than binding commitments to achieve every milestone, and its regular Risk Reports explain how the company weighs capabilities, protections and benefits. The 2025 decision should therefore be understood under the rules that governed it.[6]

The current document still contains commitments to delay development or deployment in specified circumstances. One applies when Anthropic has clear evidence of a significant lead in highly capable models and needs a stronger case that catastrophic risk is contained. Another applies when Anthropic has strong evidence that all relevant competitors can demonstrate strong safety and it needs to match their overall protection. A separate commitment to pursue a competitor’s better mitigation does not necessarily require a delay. Those conditions matter when interpreting a promise about future releases.[6]

How to assess the evidence behind a release

The UK AI Security Institute’s safeguard-evaluation principles provide a useful way to examine such decisions. Start with what the safeguards are required to prevent, which actors they must resist and the assumptions about those actors. Then identify the controls, gather evidence of their effectiveness, arrange regular reassessment and explain why the whole package meets the requirement. External review can scrutinise that reasoning. The institute’s framework addresses misuse safeguards; it does not evaluate protections against theft of model weights.[7]

That approach gives readers concrete questions to bring to the next launch: what requirement applied, what evidence was gathered, which decision followed, and how will the conclusion be checked again? A threshold becomes meaningful when it connects an assessment to an action. The published record also needs enough detail for others to identify where that connection depends on judgment, incomplete evidence or a condition that could later change.[7]

Report an error or suggest a correction