Anthropic Responsible Scaling Policy v3 Drops Unilateral Pause

A rewrite, not a revision

On February 24, 2026, Anthropic published version 3.0 of its Responsible Scaling Policy (RSP). The RSP is the voluntary framework the company uses to manage catastrophic risks from frontier AI systems.11 The company's own changelog calls it a comprehensive rewrite, not an incremental update.12 The same day, Holden Karnofsky posted a long essay on LessWrong explaining his personal reasons for the change. He wrote that he had pushed for it for about a year and led the drafting. That post set the terms of a debate in AI safety circles that is still going on months later.

The core change is easy to state. The old RSP defined capability thresholds and the safeguards each one required, and it committed Anthropic to pausing development or deployment if it could not put those safeguards in place in time.14 Version 3.0 removes that implied pause. In its place come three things: a set of industry-wide recommendations, a Frontier Safety Roadmap of public but non-binding goals, and recurring Risk Reports subject to external review.1416 The reading here is that this change matters more than anything else in the document. Anthropic has moved from a commitment-based theory of safety to a transparency-based one, and it has said so fairly openly.

What the new policy actually contains

The policy now separates two sets of mitigations. One set is what Anthropic says it will do whatever its competitors do. The other is a broader map of the capabilities and mitigations the company thinks would keep risk low if the whole industry adopted it.11 The unilateral list is modest. Its main item is keeping the ASL-3 protections Anthropic switched on in May 2025: classifier guards, access controls and security controls aimed at chemical and biological weapons misuse.1416 Stronger measures, such as RAND Security Level 4 protection against weight theft by state-level attackers, now appear only as industry-wide recommendations.

The new transparency system is built around Risk Reports, which are due every three to six months. They will cover all publicly deployed models, plus internal models when Anthropic judges they add significant extra risk.14 In some circumstances, outside reviewers chosen for expertise and freedom from major conflicts of interest will get unredacted or lightly redacted access and publish their critiques.11 The Roadmap sets goals in four areas: security, alignment, safeguards and policy. Examples include "moonshot" security R&D and automated red-teaming meant to outperform the hundreds of people in Anthropic's public bug bounty program.16

The threat categories have also changed. Chemical and biological risks are now split into "novel" and "non-novel" weapons. Radiological and nuclear risks are gone, as are references to cyber operations, and the policy does not explain why.14 A new category covers high-stakes sabotage opportunities inside AI companies.3 The top threshold is automated R&D, defined as a model that could compress two years of 2018–2024 AI progress into one year.14

Anthropic's case: ambiguity, politics, and collective action

Anthropic's explanation is frank about what has not worked. It says pre-set capability thresholds turned out to be much more ambiguous than expected. Its models now pass most quick biology tests, so the company can no longer argue convincingly that risk is low. But those tests also don't show that risk is high, and wet-lab studies take so long that newer models are out before results arrive. The company also points to slow government action and an anti-regulatory political climate. It warns that the stronger safeguards in its earlier plans may be impossible for one company to achieve without collective action.

Karnofsky's essay adds an argument about incentives. He says the old framework encouraged poor planning for ASL-4 and ASL-5. Meeting standards against state-backed attackers on roughly two-year timelines looked impossible without a years-long slowdown, and that put pressure on risk assessments to understate capability thresholds. He says unilateral commitments were never a good idea, and he takes responsibility for the impression that the RSP bound Anthropic "to the mast."1 His central claim is that specific, achievable goals will work better as a forcing function than distant absolute-risk targets. He compares it to running a 5K: you go faster chasing a personal record than chasing a world record.1

In LessWrong comments, he also offered a blunter explanation. He said the RSP model depended heavily on being turned into regulation, and since that now looks extremely unlikely, v3 relies on transparency instead.19

The critics: a matter of broken promises

The main objection is about trust, not technical design. LessWrong's Oliver Habryka wrote that Anthropic employees had told him on more than a dozen occasions that the RSP was binding. He said people who suggested the escape clause would ever be used were often dismissed, and he described the change as a meaningful broken promise. Another commenter said that calling the change a natural step for a "living document" is misleading. They argued that the if-then pause structure was the main safety rationale for RSPs and that Anthropic staff had defended it strongly.

Zvi Mowshowitz has written the most extensive critique. He says Anthropic has largely given up hard barriers to release in favor of arguments it finds reasonable itself.18 In a follow-up analysis, he notes there is no pre-deployment gate and that the company can change the content at any time, so the policy ultimately rests on trusting Anthropic.3 He also argues that the safeguards tied to the automated R&D threshold do not address the central danger of fast, recursive capability gains. And he questions dropping cybersecurity as a category when OpenAI and Google still treat it as a key threat.3 He notes that mainstream coverage, including a Wall Street Journal story, described the update as Anthropic scaling back its safety commitments. In his view that framing oversimplified things but was not wrong.

There is a regulatory angle too. One LessWrong commenter pointed out that California's SB 53 and New York's RAISE Act require developers to have safety frameworks and to follow them. They argued that Anthropic is now the first company whose framework, when "followed," does not bind it to any commitments.19

Where the analysts converge

The most useful outside assessment comes from the Centre for the Governance of AI. Its authors say their first reaction was negative, mainly because the pause commitment was dropped. After a closer reading they became more positive, concluding that the Risk Reports and Roadmap add significant value and that being honest about limits is better than keeping promises that won't be kept. A later version of the analysis keeps that view but adds that the new tools still depend largely on self-reporting. GovAI also identifies a change in the baseline. Before, Anthropic started with demanding mitigations and would lower them only if competitors fell short. Now it starts lower and will strengthen them only if others do, or if it has a clear lead.14

The sources broadly agree on the facts: the pause language is gone, the ASL-3 protections remain, and the transparency machinery is new. They disagree on what to make of it. Supporters see it as an honest correction, and critics see it as abandoning a promise. Some secondary summaries also describe the threshold structure differently from the policy text. One vendor guide, for example, says the AI R&D threshold was split in two20, while GovAI reports that several thresholds were merged into a single compressed-progress threshold.14 Readers should rely on the primary document.

The policy keeps moving

Version 3.0 has not stayed fixed. Anthropic has since released versions 3.1 through 3.4. These clarify that the R&D threshold means doubling aggregate AI progress, not researcher productivity. They also give the Long-Term Benefit Trust power to request external review and approve reviewers, and revise the chemical/biological and automated R&D thresholds.12 Version 3.4 reduces internal distribution of unredacted Risk Reports from all regular-clearance staff to at least 200 employees.12 Version 3.1 added language saying Anthropic may consider pausing even when its formal triggers are not met.15 That is a gesture toward the old principle, but it is not a commitment.

The verdict

Anthropic's diagnosis is believable. The evaluation science really is ambiguous, and the expected regulation has not arrived. Karnofsky's point that a commitment nobody believes will be honored is worse than none deserves to be taken seriously. Still, the critics have the stronger argument on accountability. Under the old RSP, outsiders had a way to hold Anthropic to its word. Under v3, the main tool is publicity. Risk Reports and external review are only worth as much as their honesty and timing, and even GovAI's favorable assessment concedes that they rely on self-reporting.

The test to watch is concrete. Will a Risk Report ever conclude that a model should not ship, and will an external reviewer ever be allowed to say so publicly? Until either happens, RSP v3 is best understood as a sincere transparency regime that has replaced a safety brake.