Anthropic activates AI Safety Level 3 protections

Background

Anthropic's Responsible Scaling Policy (RSP) sets out a ladder of AI Safety Levels. Each level bundles two kinds of protection: deployment measures, which govern how a model may be released and used, and security measures, which concern protecting the model itself. Which protections apply depends on what the model can do; a level is meant to be switched on when capabilities approach a threshold written down in advance, so that safeguards are in place before the risk arrives. Writing the thresholds down early is the point: it moves the judgement to a moment when there is less pressure to argue that a particular model is safe enough.

Under ASL-3, the deployment measures are aimed at limiting misuse for chemical, biological, radiological and nuclear (CBRN) weapons ^[1]. The companion ASL-3 Security Standard addresses a different threat: people with inside access to a model or its weights. The standard's scope is written in terms of how sophisticated such an insider is, and whether a state is behind them ^[2].

What happened

On 22 May 2025 Anthropic activated ASL-3 deployment and security protections together with the launch of Claude Opus 4 ^[1]. The company called the step precautionary and provisional. The stated reason was continued improvement in CBRN-related knowledge and capabilities ^[1].

At the same time, Anthropic said it had not determined that Claude Opus 4 definitively crossed the threshold requiring ASL-3 ^[1]. The protection therefore came before a firm finding that it was mandatory, rather than after one. Anthropic also ruled out that Claude Sonnet 4, the other model released in the same launch, needed ASL-3 protections ^[1]. The two models were assessed separately and treated differently under the same policy.

Key details

The policy text had been adjusted shortly before. RSP version 2.2 took effect on 14 May 2025, eight days ahead of the launch. It was a minor revision, and what it amended was a footnote — the footnote that sets the scope of the ASL-3 Security Standard ^[2].

Before the revision, the exclusion in that footnote covered only highly sophisticated state-compromised insiders. After it, the exclusion covered both sophisticated and state-compromised insiders ^[2]. The set of insiders named in the exclusion was therefore widened: previously an insider had to meet both conditions to fall outside the standard's scope, afterwards meeting either one was enough. In practice the footnote marks where the security standard stops applying, so a change of this kind alters the ground the standard is written to cover. The revision was made in a single footnote, not in the main body of the policy.

Why it matters

Three things about this episode are worth keeping in view.

First, it shows what a precautionary activation looks like in practice. The policy's trigger is a determination that a model has crossed a capability threshold, and here the company said it had not made that determination, yet switched the protections on anyway ^[1]. The level therefore functioned as an operating condition for a release, not as a label attached after the fact.

Second, it shows that the policy document is itself a moving part. A footnote revised eight days before a launch decided which insiders the ASL-3 Security Standard covered ^[2]. Anyone asking what constraints applied to a given model has to read the version of the policy in force on that day, not merely the headline level.

Third, it locates the concern in a specific category. The ASL-3 deployment measures address misuse for CBRN weapons ^[1], not risk in general. And because one model in the launch carried the protections while the other did not ^[1], the episode illustrates that these judgements are made model by model rather than once for a whole product line.