Anthropic's Frontier Safety Roadmap

We believe that AI capabilities will improve rapidly in the coming years. We will need to quickly and dramatically improve our state of preparedness in a number of areas, especially:

Security

Preventing theft, sabotage and/or manipulation of our AI models.

Safeguards

Preventing dangerous use of our models via product surfaces and within Anthropic itself.

Alignment

Ensuring that our models themselves do not autonomously cause harm, and instead consistently behave in line with our Constitution.

Policy

Laying out and advocating for a tangible path for policymakers to effectively manage AI risks across the industry, worldwide.

Our Frontier Safety Roadmap aims to chart a course in public for some of our highest-priority goals. Our hopes are twofold.

First, many (though not all) of these goals will need large company-wide efforts. Many people, across many different departments, will need to coordinate with each other across reporting lines. By clearly and publicly articulating these goals, we are aiming for a "forcing function" that helps us pull off this kind of coordination and prioritization. We believe our Responsible Scaling Policy has served this function effectively in the past, as with our ASL-3 protections.

Second, we want to share how we're thinking about the future of safety, at the level of tangible practices. We hope that other AI developers will take inspiration from these goals, and publish their own that we can learn from in turn. And we think policymakers and customers should be aware of where AI safety practices are headed.

These roadmaps are subject to change. Some changes may simply reflect our evolving understanding of how best to mitigate key risks. However, we will strive to avoid situations where we revise the goals in a less ambitious direction because we simply can't execute.

We will provide updates on whether we achieve the goals, and set new goals whenever we do.

Note: we have made redactions from our public Frontier Safety Roadmap for reasons including protecting sensitive IP and not giving too much information about our current protections to threat actors. The unredacted version is shared with all full-time employees as well as our board and Long-Term Benefit Trust (LTBT).

Updates

You can find an archive of all our previous Frontier Safety Roadmap goals here.

April 2, 2026: Launching “moonshot R&D” projects. We completed this goal by selecting and beginning work on two projects, detailed below.
April 2, 2026: Principles for data retention. We completed our goal of writing a “comprehensive internal report to identify how our Safeguards could be improved by updating our data retention policies.” The report was completed and sent to leadership on March 29, 2026. As stated below, within 6 weeks of that date, we will publish a new goal related to this or announce that we are not doing so.
May 5, 2026: Principles for data retention. We removed this content from the page after deciding not to set a new goal on this front. Based in part on the analysis we completed as a prior roadmap goal, we are undertaking a major project to improve our data retention practices for certain future models from a safety point of view, and we will be putting out public content explaining our thinking. We don’t feel that setting a separate date-bound goal in this context would be helpful as a forcing function for the goal—we feel that other internal processes will provide adequate forcing functions.
May 5, 2026: “Moonshot R&D” projects. We changed our target date for Phase 1 from May 15, 2026 to September 30, 2026 because we decided to focus the relevant resources on accelerating our “Leveling up across the board” goal for the time being. While we still don’t expect to fully complete the latter goal in the next few months, we believe we will make significant progress on it, and that the safety benefits of doing so are greater than what we’d realize with our original prioritization. As for the latter goal, our initial discussions have left us skeptical that isolated networks are a feasible path forward inside the next 1-2 years, when powerful AI may be developed. We still plan to complete Phase 1, which will hopefully leave us with a more confident and grounded view.
July 8, 2026: A roadmap for policymakers. We consider our Advanced AI Framework to fulfill this goal. We plan to publish a new policy goal to replace it.
July 10, 2026: Upholding Claude's Constitution. We clarified the language on when the public Constitution must be updated. Where we previously stated we planned to update it within 90 days of relevant internal updates, we now specify that we will update it to match the most recent trained-on Constitution within 90 days of relevant internal or external deployments of models trained on updated Constitutions.
July 29, 2026: “Moonshot R&D” projects. Corrected a date typo in the main text. The Phase 1 deadline is September 30, 2026 (per the goal set May 5, 2026 seen above), but we had erroneously stated September 15.
October 19, 2026: “Moonshot R&D” projects. We believe we broadly achieved the substantive components of the first goal. We created a prototype of what our key workflows and infrastructure would look like if they were subject to extreme security practices. We’ve explored the longest lead-time systems that needed to change to achieve air-gapped operations. Most of our effort has been spent building prototype environments in which we run workloads to test what productivity cost they’ll incur and did not focus on commensurate physical security controls, in favor of other work. We plan to deploy inference systems in isolated environments in the near future. We also created an inventory of the needed controls and as the next step, have begun putting them into production in our environments. We believe we broadly achieved the second goal in full. For the provable inference project, we built a prototype that runs on production inference and checks that outputs come from a specific set of model weights. In developing this prototype, we rolled out signing on all of our internal token traffic, which has already caught one extremely rare, benign integrity glitch. We now use the term “inference verification,” rather than “provable inference”, our original aim with this moonshot is to achieve high assurance in the integrity of our token stream, which can be achieved in several ways, and “provable inference” suggests a narrower approach than we believe is necessary.
October 19, 2026: Leveling up across the board. We added goals in two areas that matter more as our own datacenter buildout and bare-metal deployments ramp up: datacenter physical security and platform security.
October 19, 2026: World-class internal red-teaming. We completed this goal ahead of its January 1, 2027 target. We built an automated red-teaming system and compared it with the bug bounties we ran against our biological weapons classifiers between April 20 and September 11, 2026. On the same 8 bounty questions and 3 generations of production classifiers, it matched or beat the best human submission in all 24 question-classifier pairs, winning 23. It did this in 24 to 48 hours, compared with weeks to months of bounty time. We judge these findings to be more substantial in aggregate than our bug bounty findings, which is the test we set. We plan to publish a more in-depth blog post on this in the future. We removed this goal from the roadmap, as we have completed it.
October 19, 2026: Upholding Claude’s Constitution. We have kept our Constitution up to date and public. Our automated alignment assessment evaluates alignment with the Constitution as a core metric, and this is reported for all assessed models. Interpretability methods have become an important part of our overall alignment assessment methodology, and evidence produced using interpretability is featured in all recent system cards. We have red-teamed our alignment arguments using model organisms and published the findings in Risk Reports, though not as extensively as we had intended when drafting this goal. We initially ran an oversight process over a representative sample of our post-training data and rewards to check alignment with the Constitution, but found that it surfaced nothing beyond what our existing review processes were already catching, so we no longer run it routinely. A recent re-run on a sample of training data again flagged nothing. We are retiring this goal in its current form while we spend more time reflecting on which goals are most effective for alignment, and we will publish more about our thinking in the future. At a minimum, we plan to continue to update the public Constitution to match the most recent trained-on Constitution within 90 days of relevant internal or external deployments of models trained on updated Constitutions.
October 19, 2026: New policy goals. We added two new policy goals. These are a policy proposal on embedded third-party evaluators (due December 15, 2026) and a policy framework for targeting the pace of AI development (due January 15, 2027).

SecurityTarget: July 1, 2027

Leveling up across the board

While innovation and creativity are important to security, it’s also the case that security is fundamentally about the strength of the weakest link. That means we need to get a large number of small things right. We have a list of key security improvements that would represent a significant leveling up across many areas of security, and we will aim to achieve a strong majority of them (details below). This will be a large, wide-reaching effort to achieve major hardening of our internal systems against attempts to compromise our model weights, model training, etc.

To assess whether we have reached this goal, we will prepare a report for the Responsible Scaling Officer to mark each invariant as "Not in place," "Mostly in place" or "Fully or near-fully in place." The report's conclusions (though not all details of our security posture) will be circulated to the full company and there will be at least a 7-day comment period for people to remark on observations they've made that may not be consistent with the conclusions. We will consider this goal reached if both of the following are true: we have achieved "Fully or near-fully in place" for at least 60% of invariants, and we have achieved "Mostly in place" for at least 80% of invariants.

We're in a unique position to contribute meaningfully to AI security practices across the industry. We aim to systematically share what we’ve learned from all of our security commitments—through blog posts, conference talks, and open source contributions—to help raise the security bar across the AI industry

Area of improvement

Desired State¹

Identity, Secrets Management, and Framework

Systems, employees, and automated processes in sensitive environments use cryptographically verified short-lived identities, reducing the window of opportunity if credentials are compromised.
Sensitive credentials are managed through a central system that supports automated rotation.
We systematically review and reduce access entitlements through periodic reviews, targeting permissions that are stale, excessive, or no longer business-justified.
Internal services in sensitive environments require authentication and authorization using approved methods (e.g. mTLS) and encrypt communications in transit

Infrastructure Security

Workload configurations that deviate from hardened security defaults in frontier clusters require explicit security team approval and ongoing tracking.
Kubernetes access controls are understandable and auditable, and deployed consistently and automatically across frontier clusters.
Sensitive environments use allowlist-based network controls for Internet egress, connecting only to pre-approved destinations
Technical controls prevent accidental exposure of internal systems to the internet, with continuous monitoring of all systems accessible from the internet.
Cloud identity and access management (IAM) permissions are continuously scanned for misconfigurations, with critical issues resolved within SLA.

Supply Chain Security

Software builds that power sensitive environments have integrity guarantees for their sources and dependencies come from verified sources
Deployments to sensitive environments are logged and inventoried.
Integrated Development Environments (IDEs) used for frontier model development are centrally managed, with third-party components subject to security evaluation and ongoing monitoring.
Frontier models are tamper resistant for production inference deployment, with verification that the model running in production matches the intended version.

Application Security

Critical systems undergo formal threat modeling and security review. Fast-moving projects have dedicated security partners.
Research systems are regularly tested by penetration testers with a focus on lateral movement
Automated security testing continuously probes services in sensitive environments
Vulnerability management is proactive: we systematically detect known vulnerabilities, prioritize based on exploitability and reachability in our environment, and enforce remediation timelines for issues that pose genuine risk.

Corporate Security

Employee devices are configured so that only approved software can run.
Corporate applications require authentication from managed devices as part of context aware access (CAA). Unmanaged devices cannot access company systems.

Detection and Response

We maintain validated detection capabilities for the critical attack scenarios in our threat models, including protection of model weights, training integrity, insider threats, and AI system misuse. Detection coverage is measured against priority attack techniques with defined targets.
We use AI-assisted tools to accelerate security investigations, enabling faster triage of alerts and reduced investigation times through automated analysis and playbook execution.
Detection effectiveness is continuously measured including coverage of attack techniques, time to detect threats, and accuracy. Regular adversarial exercises validate our detection capabilities and drive improvements.
Security alerts maintain high precision to minimize false positives. High-priority scenarios have documented response procedures, adequate on-call staffing, and incident response capabilities, which are regularly validated.

Physical Security

Core office facilities meet security standards with consistent physical security controls.
Automated detection and alerting exists for anomalous behaviors that may indicate insider risks.
A global security operations center provides continuous monitoring with AI-enhanced analysis and response capabilities.

Datacenter physical security

Data centers hosting frontier model workloads meet our physical security standard before sensitive hardware or workloads arrive, and operate under binding, auditable security requirements for as long as they host them.
Hardware moves in and out of these facilities only under verified authorization and an auditable chain of custody, media leaving our custody yields no recoverable data, and physical access to compute areas is limited to individually authenticated, vetted personnel with a documented need.
These facilities are monitored continuously and centrally with prompt response to physical intrusion, and public exposure of sensitive information about them and the people who work in them is detected and handled as a security incident.

Platform Security

In sensitive environments, each host treats attached devices as adversarial, using hardware memory isolation to confine each device to explicitly granted memory and isolating drivers so that a compromised driver does not compromise the host.
In sensitive environments, each host attests to and enforces a closed and immutable policy over everything it will execute. Running anything outside that policy requires the host to zeroize, reboot, and re-attest.
Every frontier-tier machine's cryptographic identity is traceable to its point of origin throughout the hardware supply chain.
Frontier model weights are encrypted and decryption keys are released only to attested, frontier-tier machines.
Every hardware and firmware trust boundary that protects frontier model weights is covered by an automated test suite that asserts its security properties

We have moderate confidence that we can achieve this goal. The list of invariants is long and has many dependencies, and we will need substantially more security capacity staffing than we currently have, but we’ve made a substantial effort to determine what is realistic.

SafeguardsTarget: January 1, 2027

Fully automated attack investigations

We have already seen coordinated, sophisticated efforts to misuse our systems for espionage. Stopping these efforts requires more than blocking individual AI outputs - it can involve dedicated investigation of patterns across many users and interactions. We believe we can build a system that conducts effective investigations with minimal or no human involvement, a major step forward for our ability to detect misuse at scale. Our initial efforts will focus on investigating potential cyber attacks on a subset of product surfaces.

We will develop an automated system intended to detect a large majority of sophisticated cyber attacks that use Claude, with minimal or no human involvement, along with a plan to assess precision and recall (likely based on red teaming).

This system will not necessarily be usable for all of our product surfaces and environments at the outset. It will be a proof-of-concept that we assess in the environments most conducive to it, which will include major production environments.

We have moderate confidence that we can achieve this goal. We already have some preliminary systems that provide a starting point.

Cross-cuttingTarget: January 1, 2027

Moving toward an “eyes on everything” state for our internal AI development activities

For many reasons - preventing theft or sabotage of our models, ensuring adherence to Claude’s Constitution, and ensuring that our model training hasn’t been manipulated by insiders or attackers (or AI models themselves) - we want our internal environment to be intensively monitored and comprehensively understood. We aim to establish comprehensive, centralized records of all our critical AI development activities, and to use AI to analyze these records for issues including concerning behavior by insiders (both human and AI) and security threats.

Security team subgoal

We will improve our observability across the board to the point of relative maturity - involving centralized, searchable logs with the most important relevant information for all of our critical security systems, and robust processes for keeping these logs available. We believe that if we can establish comprehensive logging of crucial internal activity, we’ll put ourselves in a much better position to leverage current and future advanced AI capabilities for security (since AI systems can be used to analyze our logs). We also believe that some key threat models - including the possibility of both human and AI attackers corrupting our training runs - could be significantly ameliorated if we simply have high odds of detecting when they happen (even if response to those detections lags considerably).

Area of improvement

Desired State⁴

Log coverage

A catalog of log sources exists, labeled by priority and criticality to security
A standardized ingestion process enables logging at deployment time with limited friction

Instrumentation

Libraries and frameworks exist to streamline log onboarding and prevent inadvertent logging of sensitive information

Log completeness

A standardized process evaluates log completeness and identifies gaps
A feedback loop between completeness assessments and instrumentation deployments systematically detects gaps when new systems or environments are created, with systematic remediation or flagging for review

Log accessibility

AI-enabled search exists via a centralized platform with consistent query patterns across all log sources
The system maintains high availability and reliability sufficient for operational use

Log pipeline health

Systematic monitoring continuously tracks pipeline health with alerting on failures, throughput degradation, and data quality problems

We have moderate confidence that we can achieve this goal (somewhat more so than for our security maturity goal). The list of sub-goals is fairly long and has many dependencies, and we will need to prioritize and resource this work more than in the past, but we’ve made a substantial effort to determine what is realistic.

Alignment team subgoal

We will ensure that we are cataloging all high-stakes internal usage of Claude, such as situations where we use Claude internally for fully autonomous research or other situations where it might have an opportunity to engage in catastrophic sabotage, in line with our current threat models.

We will implement monitoring that we believe is sufficient to produce evidence of egregious sabotage-oriented activities in high-stakes use cases with high probability, under the assumption that Claude has general capabilities broadly comparable to those of a full-time entry level Research Engineer. In cases where we have high confidence that models are sufficiently aligned such that risks are low, we will not consider this monitoring to be necessary.

We will evaluate the effectiveness of our monitoring tools, likely using a combination of human and automated red teaming and adversarially-designed model organisms, and will discuss our findings in our Risk Reports.

We have moderate confidence that we can make Claude aligned enough that monitoring will not be strictly necessary, at least in the medium term. We have moderate-to-high confidence we can put our monitoring goal in position to achieve the goal, as needed. We already do a fair amount of internal monitoring, but need to make it more comprehensive and accurate.

PolicyTarget: December 15, 2026

Policy proposal on embedded third-party evaluators

Independent evaluation is a core element of our Responsible Scaling Policy and our policy framework for mitigating catastrophic AI risks. We recently committed to going further by embedding independent evaluators, giving them deeper access to models and internal information than external evaluators typically have, while preserving their independence.

We will develop and publish a policy proposal on how governments can support deeper access for independent evaluators, including how evaluators are funded, what access they need, and how their independence is protected. We will draw on our own experience working with them.

PolicyTarget: January 15, 2027

Policy framework for targeting the pace of AI development

Our current policy framework focuses on blocking or deterring the deployment of dangerous AI systems. However, we believe policymakers may also need to target the pace of AI development directly, because the automation of AI R&D could accelerate progress faster than governance or safety measures can keep up. Speed itself could become an important risk factor.

We are working on additional policy proposals that provide options for policymakers to address the risks raised by the speed of AI development, particularly under conditions of recursive self-improvement. We will either publish a proposal or publish an explanation of why we decided not to.

Alignment

Update on “Upholding Claude’s Constitution”

We are retiring this goal in its current form while we spend more time reflecting on which goals are most effective for alignment, and we will publish more about our thinking in the future. At a minimum, we plan to continue to update the public Constitution to match the most recent trained-on Constitution within 90 days of relevant internal or external deployments of models trained on updated Constitutions. See more on our updates page.

Today’s capabilities and mitigations February 22nd, 2026

Our most powerful models today—those with the ability to significantly help individuals or groups with basic technical backgrounds create/obtain and deploy chemical and/or biological weapons with serious potential for catastrophic damages—are safeguarded with ASL-3 protections.

We plan to maintain or improve these protections for relevant models. The key elements of these protections are: safeguards at least as robust as our initial Constitutional Classifiers; access controls for trusted users with exemptions to classifier guards; and methods such as red-teaming, bug bounties, and threat intelligence for continually assessing the threat of jailbreaks; and a number of noteworthy security controls. The specific tools and methods we use may evolve, but our protections will be at least as rigorous as those we have in place today.

We hope and expect that these measures will remain sufficient to meet our goal of being both (a) robust to persistent attempts to misuse a potentially dangerous capability, and (b) highly protected against most attackers’ attempts at stealing model weights. We will continue to adapt our defenses as attack methods evolve. However, while we can and will maintain the rigor of our protections, we cannot assure a specific level of effectiveness against future attackers, given attackers’ continuous adaptability and the evolving risk landscape.

Additionally, today’s models show strong and improving capabilities for extended, autonomous technical work, and are increasingly relied on for writing high-stakes code. In our Risk Reports, we now regularly analyze the possibility that these models might execute high-stakes sabotage. We believe that our current alignment assessment methods and monitoring practices are sufficient to make the case that the risk of catastrophic sabotage is very low (though not negligible).

Potential advances in the next few months

As capabilities improve, we are monitoring for significant advances in our models' chemical and biological weapons capabilities, focusing on the point where the models could significantly help threat actors (for example, moderately resourced expert-backed teams) create or obtain and deploy chemical and/or biological weapons with potential for catastrophic damages far beyond those of past catastrophes in this category such as COVID-19.

If and when we determine that this is the case, we will apply protections at least as strong as our current ASL-3 protections (see above) to an expanded set of potential use cases for AI, covering the most likely vectors for this threat. Additionally, we will identify the most concerning specific threat pathways, create policy recommendations for early detection and response for such threats, and share this content with policy leaders.

Automated R&D

We believe it is plausible, as soon as early 2027, that our AI systems could fully automate, or otherwise dramatically accelerate, the work of large, top-tier teams of human researchers in domains where fast progress could cause threats to international security and/or rapid disruptions to the global balance of power—for example, energy, robotics, weapons development and AI itself.

By that point, we expect to have accomplished most of the goals listed above, including:

Resourcing and completing significant “moonshot R&D security” projects, currently focused on provable inference and a mock secure research environment.
Developing world-class internal red-teaming and automated attack investigations.
Publishing and advocating for a roadmap for policymakers to achieve industry-wide safety without unnecessarily limiting the benefits from AI development or slowing the AI development of democracies relative to that of autocracies.
Achieving an “eyes on everything” state for our internal AI development.
Consistently implementing systematic alignment audits and other measures for upholding Claude’s Constitution.

We hope and expect to meet these targets on time or ahead of schedule, set new ones, and continually raise the bar for our risk mitigations.

Anthropic's Frontier Safety Roadmap

Security

Safeguards

Alignment

Policy

Updates

Our goals as of October 19th, 2026

Leveling up across the board

Fully automated attack investigations

Moving toward an “eyes on everything” state for our internal AI development activities

Policy proposal on embedded third-party evaluators

Policy framework for targeting the pace of AI development

Update on “Upholding Claude’s Constitution”

Expectations as AI capabilities advance

Today’s capabilities and mitigations February 22nd, 2026

Potential advances in the next few months

Automated R&D