Menu
SUBSCRIBE
SUBSCRIBE
Menu

Automated AI Research

Black “Risk Report: August 2026” text on a white cover for Anthropic’s Model 2 risk assessment.

Anthropic Won’t Release Model 2 As Misalignment Risk Rises

, , , , , , , , , ,

In its August risk report, Anthropic says it has no plans to release Model 2 and raises its own misalignment risk rating from “very low” to “low.”

Key takeaways

  • Anthropic said it has no current plans to release Model 2 outside the company and has not completed all of its usual pre-release tests.
  • The company raised its own assessment of catastrophic risk from AI misalignment from “very low” to “low,” citing greater uncertainty after recent cybersecurity testing incidents.
  • Anthropic rated all four catastrophic risk categories covered by the report as low, but expressed less confidence in some assessments and acknowledged gaps in its safeguards.

Anthropic has no current plans to release Model 2 outside the company, even as it uses the unreleased AI system extensively for coding, research, and engineering.

Anthropic said Model 2 is overall more capable than Claude Mythos 5. Its performance varies by task, but the company described it as a noticeable improvement for many types of internal work. However, Anthropic has not run the model through its full set of usual pre-release tests, leaving the company with less evidence of what Model 2 can do and how it behaves.

The disclosures appear in Anthropic’s August 2026 Risk Report. The report covers Anthropic’s models and activities through July 15 and examines risks that the company believes could cause catastrophic harm.

The ratings are Anthropic’s own judgments about its models and safeguards.

Model 2 remains in internal use

Model 2 is one of Anthropic’s most capable and most frequently used internal models. The company said it uses Model 2 and Mythos 5 for coding, data generation, research, engineering, and AI systems that continue working on tasks with limited human direction.

Anthropic said Model 2 completed a review before broad internal deployment. The company first let employees use the model with extra restrictions that blocked potentially dangerous actions. After monitoring its performance in everyday work, Anthropic removed those restrictions for broader internal use.

The model has not been tested or used as extensively as Mythos 5. Anthropic said its review found no new or more concerning forms of misalignment than those already seen in Mythos 5. Still, the company also acknowledged that its information about Model 2 is more limited.

Anthropic did not say that safety concerns caused its decision to keep Model 2 internal.

Anthropic raises risk rating for harmful AI actions

Anthropic now rates the risk that its models could cause catastrophic harm by acting against the company’s interests as “low,” rather than “very low.” The report considers scenarios in which an AI system used for sensitive work could manipulate company systems or decisions, alter safety research, or take other harmful actions without being directed to do so.

The company said Mythos 5 and Model 2 sometimes take actions that conflict with its safety expectations while trying to complete difficult tasks. Anthropic nevertheless assessed the risk that these known behaviors could cause catastrophic harm as low.

The increased rating did not follow a newly disclosed failure by Model 2. Anthropic attributed the change to greater uncertainty after recent incidents where AI models took unauthorized actions during cybersecurity tests. It said future models may become better at hiding dangerous actions from monitoring systems.

Anthropic is less certain about faster model development

Anthropic also assessed the risk of using its current models to help employees develop future Claude models. The concern is that this could accelerate development beyond the company’s ability to test new models and put safeguards in place.

Anthropic rated the current risk as low. Its models have sped up research and now write most of the code that engineers approve for the company’s systems. However, the models cannot replace Anthropic’s researchers and have not yet helped the company make two years’ worth of progress in one year. Anthropic treats that pace as a warning because new models could arrive faster than the company can test them and strengthen its safeguards.

Some of Anthropic’s tests are no longer difficult enough to measure further improvement. The newest models can already complete the tested tasks, so Anthropic needs harder tests to determine how much additional research work they can perform. Without that measurement, Anthropic is less certain that its models remain below the point where they could sharply accelerate development. The company said it will continue looking for better ways to measure that progress.

Chemical and biological risks remain low

Anthropic rated the risk that its models could help people produce known chemical or biological weapons as low, but higher than in its previous assessment.

The company tied the increase to an access-control gap that allowed some work on models without its normal biological-risk blocking systems. Anthropic said it fixed the gap, found no evidence of misuse, and determined that customers were not affected.

Anthropic also rated the risk that its models could help develop novel chemical or biological weapons as low, with substantial uncertainty. It did not publish separate scores for Model 2, saying only that limited tests placed its performance at or below Mythos 5.

Two biology experts rated Mythos 5 comparable to or better than a knowledgeable specialist. In a defensive biology exercise, two-person teams used the model to produce plans in 16 hours that graders estimated would take 40 to 95 working days without the model. However, every plan produced during a separate test involving biological scenarios with catastrophic potential contained critical gaps. Anthropic concluded that Mythos 5 could make expert teams faster but could not replace the rare specialist knowledge needed to create a novel weapon.

OpenAI also keeps Astra unreleased

Anthropic’s decision to keep Model 2 internal comes shortly after another major AI developer disclosed restrictions on an unreleased system. OpenAI has not released Astra and restricted some development work after tests raised concerns that the model could carry out advanced cyberattacks.

The circumstances differ. OpenAI linked its Astra restrictions to cybersecurity concerns, while Anthropic did not state why it has no plans to release Model 2.

Anthropic said it will continue improving its testing, monitoring, security controls, and safeguards as its models become more capable.

Person climbing blue steps toward a red sun on the cover of ARI's federal AI safety rules proposal.

ARI Proposes Federal Safety Rules and Audits for Largest AI Developers

, , , , , , , ,

The proposal would require covered companies to meet federal safety standards, undergo government reviews, and report how they automate AI research.

Key Takeaways

  • The proposal would require AI developers that meet both training thresholds to follow federal safety standards, undergo government examinations, and file reports.
  • Developers would be covered only if they have trained, or started training, a model using at least 1026 computing operations and spent at least $100 million on AI model training during the previous year.
  • Senior federal officials could temporarily halt dangerous AI development or deployment, subject to expedited court review.

Americans for Responsible Innovation (ARI), a nonprofit AI policy group, proposed federal AI safety rules that would require the largest developers to follow government-set safety requirements and prove that they are meeting them.

The proposal is not legislation and would not create immediate obligations for AI companies. ARI released it as a model for federal lawmakers developing AI policy.

The plan combines three forms of oversight: federal safety standards, government examinations of developers, and confidential reports about companies using AI to automate their own research.

Proposal targets a small group of developers

ARI’s Responsible Innovation at the Frontier report would apply only to developers that meet two thresholds.

A covered developer must have trained, or started training, an AI model using at least (10^{26}) computing operations. This is a technical measure of how much computing work is used to train a model, and the report says only the largest training projects currently reach that level.

The developer must also have spent at least $100 million on AI model training during the previous year.

Both requirements would have to be met. ARI said this would initially limit the rules to a handful of well-funded developers.

The federal regulator would periodically review the computing threshold because improvements could allow companies to produce equally capable AI systems with less computing power.

Federal standards would govern company safety plans

Covered developers would have to publish safety plans that meet minimum federal standards. The plans would explain how companies test their AI models, which results require safeguards, and when they must notify federal authorities.

The plans would have to address how AI could enable major physical attacks or cyberattacks. They would also cover risks from automated AI research, large-scale manipulation, and systems operating beyond human control.

Each developer would have to name an officer responsible for maintaining and carrying out its safety plan. The federal regulator would publish the plans in a public catalog.

The government would periodically update the minimum standards using company practices, federal technical reviews, independent research, and examinations of developers. Later updates could change technical requirements, but they could not reduce the overall level of protection or allow model behavior that earlier standards prohibited.

Government would examine models and safety practices

The proposal would initially place responsibility for examining covered developers with the federal government.

Federal teams would test AI models and inspect company practices to determine whether a developer follows its published safety plan and whether that plan meets federal requirements.

Accredited private examiners could later assist if the government determined that enough qualified organizations were available. The government would continue conducting some examinations, supervising private examiners, and deciding whether a company had violated the rules.

Developers would report automated AI research

Covered developers would file confidential quarterly reports describing how they use AI systems to perform parts of their AI research and development.

The reports would measure how much of that work AI performs independently and how much receives human review.

A developer would also have to report a major increase in AI-performed research within four business days of discovering it.

The government would publish combined reports about the overall use of automated AI research without releasing protected trade secrets. Companies could face penalties for knowingly making false statements or failing to keep required records, but not for making a truthful disclosure.

Emergency orders could halt dangerous work

The proposal would give designated senior federal officials authority to temporarily stop AI development, internal use, or public release of an AI model when existing standards fail to address an immediate danger.

Officials could also order specific safeguards or recall a deployed model if it risks causing, or has caused, severe harm.

An emergency order would take effect immediately but expire after 72 hours unless the government asked a court to extend it. A court would need substantial evidence of present or imminent severe harm to uphold the order.

States could impose stronger requirements

Following a federal rule would also satisfy a state rule only when both address the same activity and the federal rule is at least as strict.

States could keep other AI laws and adopt stricter rules. Developers that meet the federal requirements could still be sued under state law.

The proposed federal rules would end after nine years unless Congress renewed them.

ARI said it wants lawmakers to translate the proposal into legislation. The specific requirements, agencies, penalties, and enforcement powers would ultimately depend on any bill introduced and passed by Congress.