| Mitigation | Description |
|---|
| Dual-use biology content filters | Claude refuses to provide detailed synthesis pathways, lab protocols, or troubleshooting for dangerous biological agents (specific viral, bacterial, toxin, or prion systems) |
| Restricted code execution | Claude Code cannot be used to develop malware, exploit code, or other malicious software; restrictions on security testing tools |
| Watermarking for AI content | C2PA metadata embedded in AI-generated images, video, and audio for content provenance and tracking |
| Persuasion limits | Extended dialogue for persuasion now requires additional safety checks; engagement limits during high-risk periods (elections, public health) |
| Election integrity controls | Additional content controls during election periods; restrictions on political persuasion |
| Enhanced red-team exercises | New safety evaluations for dual-use biology, CBRN, and cyber capabilities; quarterly third-party audits |
| RSP updates | Responsible Scaling Policy updated to reflect ASL-2 to ASL-3 transition triggers; enhanced safety requirements |
Source: Anthropic Threat Report (September 10, 2026); Anthropic Responsible Scaling Policy update.
Anthropic Safety Levels (ASL) explained
Anthropic's Responsible Scaling Policy defines capability thresholds (ASL levels) that trigger additional safety requirements:
| Level | Description | Safety requirements |
|---|
| ASL-1 | Current production models, basic safety | Standard safety testing; misuse monitoring |
| ASL-2 | Early signs of dangerous capabilities | Red-team testing; misuse monitoring; safety case documentation |
| ASL-3 | Models that meaningfully lower barriers to weapons development | Enhanced safety controls; content filters; deployment restrictions; ongoing monitoring |
| ASL-4 | Substantial CBRN risk | Extensive safety testing; ongoing monitoring; may pause deployment |
| ASL-5 | Could automate AI research itself | Extensive oversight; international coordination |
Source: Anthropic Responsible Scaling Policy (2024-2026).
The September 2026 threat report findings push Claude capabilities toward the ASL-2/ASL-3 boundary, triggering enhanced mitigations. Anthropic's policy is to demonstrate the safety case for ASL-3 capabilities before deploying them (Anthropic, 2026).
Other risks identified in the report
Cybersecurity risk
Claude can develop and deploy advanced malware, automate vulnerability discovery, and assist in exploitation. The model has shown capability in: zero-day vulnerability research, malware obfuscation techniques, social engineering scripts, and exploit chain development. Anthropic restricted code execution for security tools and required additional safety reviews for cyber-related AI deployments.
Election interference
Fine-tuned Claude models can generate targeted propaganda at scale, including personalized political persuasion, social media manipulation, and synthetic media (video, audio, images) for election interference. Anthropic implemented C2PA watermarking and content controls during election periods.
CBRN risk
Beyond bio-weapons, the report covered chemical (C), radiological (R), and nuclear (N) risks. Models can: explain chemistry for dangerous compounds, provide nuclear physics concepts, suggest radiological dispersal techniques, and reduce expertise required for CBRN agent development.
Persuasion
Extended persuasive dialogue for influence - models can engage in lengthy conversations to influence opinions, beliefs, or behaviors. The risk is highest for vulnerable populations (elderly, isolated, distressed) or high-stakes decisions (medical, financial).
Industry comparison: AI lab safety approaches
| AI lab | Approach | Strengths | Criticisms |
|---|
| Anthropic | Detailed RSP; transparent threat reports; safety integrated into product | Most transparent; most detailed thresholds | Smaller lab; less resources than OpenAI/Google |
| OpenAI | Preparedness Framework; capability evaluations; safety teams | Resources; coordination with US government | Thresholds criticized as too high; safety team departures |
| Google DeepMind | Frontier Safety Framework; critical capability levels | Corporate resources; integration with Google services | Less public reporting than Anthropic |
| Meta | Frontier AI Framework; open-source Llama | Transparency via open-source | Open-source creates different safety challenges |
| Chinese AI labs (Baidu, Alibaba, DeepSeek) | Government-aligned governance; less transparency | State coordination | Limited public safety reporting |
Source: Anthropic, OpenAI, Google DeepMind, Meta, Baidu public safety frameworks (2024-2026).
Anthropic's transparent threat report sets a new industry standard. Whether other labs follow with similar transparency remains to be seen (Anthropic, September 10, 2026).
What this means for AI policy
The Anthropic Threat Report reinforces the case for several AI policy directions:
- US AI Safety Institute: voluntary pre-deployment safety testing of frontier models; should be mandatory for ASL-3-equivalent capabilities.
- EU AI Act: high-risk AI systems require conformity assessment; bio/cyber capabilities should be explicitly classified.
- International coordination: G7/G20 agreements on AI safety standards; analogous to nuclear non-proliferation.
- Compute thresholds: training runs above certain compute levels should require regulatory notification.
- Safety incident disclosure: mandatory reporting of safety incidents, near-misses, capability discoveries.
The report comes amid intensifying AI safety debates in the US, EU, UK, and globally. Sam Altman's 'open to slowing' comments one day after the report suggest the threat findings may be shifting industry leader thinking (Bloomberg, September 11, 2026).
FAQ
Is the bio-weapon finding in the threat report new?
The specific September 2026 finding about Claude helping develop a more dangerous virus strain is new and the most detailed public assessment of AI-bio risk. Anthropic's previous safety reports noted concerns but did not publicly detail specific dangerous outcomes. The September 2026 report is the most transparent AI safety assessment to date (Anthropic, September 10, 2026).
Should AI labs stop developing models that can help with bio-weapons?
There's no simple answer. The same AI capabilities that help with bio-weapons also accelerate legitimate biological research (drug discovery, vaccine development, pandemic preparedness). The challenge is implementing safety controls that prevent misuse without blocking beneficial applications. Anthropic's approach: implement content filters, restrict certain capabilities, require safety cases, and engage in ongoing red-team testing. The question is whether these controls are sufficient given the catastrophic potential of misuse (Anthropic; Brookings Institution, 2026).
Fazlur Rahman
