Anthropic Scaling Policy Trades Pause Pledge for Outside Review

From tripwires to transparency

In February, Anthropic rewrote its Responsible Scaling Policy (RSP). The policy's core promise used to be that the company would stop if its safety work fell behind its models' capabilities. Version 3.0, which took effect on February 24, 2026, swaps that promise for regular public disclosure. The company said the rewrite was meant to make it more transparent3. Eight months on, the bet is clearer. The written commitments have softened in some places. In exchange, Anthropic now publishes much more about how it works and is giving outsiders unusual access to it. Whether that trade adds up to real accountability depends on what outside reviewers do with the access they now have.

The rewrite has three main parts, and the coverage describes them the same way. First, the policy separates what Anthropic will do regardless of competitors from a more ambitious set of measures it thinks the whole industry should adopt11. Second, it requires a Frontier Safety Roadmap with goals in four areas: security, alignment, safeguards and policy. Anthropic calls these public goals it will grade itself against, not binding commitments11. Third, it requires Risk Reports every three to six months. These cover capabilities, threat models (the specific ways a model could cause harm) and the safeguards in place, and they include outside review in some cases69.

What was given up

Anthropic's announcement played down the biggest change, but critics did not. The Centre for the Governance of AI (GovAI) found that v3.0 drops the old commitment to pause development and deployment when required safeguards weren't ready. It also stopped spelling out safeguards two capability levels ahead and now defines them only for the next level13. Demanding measures such as security at RAND's SL4 level are now framed as recommendations for the whole industry, not things Anthropic promises to do itself. GovAI also noted that no existing safeguard was weakened13. Other commentators were blunter: one called v3.0 "a plan of action, not a set of commitments"20. Another described it as replacing the old emergency brake with step-by-step mitigation16.

Anthropic explained the change as a coordination problem. The current policy argues that if a careful developer paused alone, the developers with the weakest protections would set the pace2. Its own account of the RSP's history is mixed. The company says requirements for its ASL-3 safety level forced it to build better classifiers against chemical and biological misuse, and those protections were switched on in May 20259. It also concedes that predefined capability thresholds were harder to interpret than expected. In some cases, models may have crossed a threshold without its evaluations giving a clear answer9.

The coverage doesn't fully agree on the details. One explainer describes v3 as a ladder of ASL tiers with ASL-4 still to be defined, and says v3 was published in November 20254. Anthropic's own policy page lists February 24, 2026 as the date of a complete rewrite1, and GovAI's reading is that escalating tiers were deliberately cut back13. The primary documents are the better guide here.

Four revisions in five months

The policy has kept changing. Version 3.1 in April clarified that the AI R&D threshold refers to doubling the rate of overall AI progress, not doubling researchers' productivity. It also stated plainly that Anthropic can still pause whenever it chooses, even when the policy doesn't require it1. Version 3.2 let the Long-Term Benefit Trust (LTBT), an independent body set up to oversee Anthropic's public-benefit mission, request outside review of Risk Reports and approve the reviewers1. Version 3.3 revised the threshold for novel chemical and biological weapons1.

Version 3.4, effective July 8, cuts both ways. Public Risk Reports must now show where material was redacted, and every part of an unredacted report must be read by at least one outside reviewer. But the internal audience shrank: full reports used to go to all regular-clearance staff and now go to at least 200 employees1. The same update narrowed the automated R&D threshold so it now aims to capture the start of dramatic recursive self-improvement, meaning AI that speeds up its own development2. The trend is real disclosure gains combined with tighter definitions of what triggers stronger action.

The August Risk Report tests the model

The second Risk Report, published August 14, gave the first real look at how this works. It runs 186 pages22. Anthropic raised its rating for misalignment in high-stakes settings from "very low" to "low," the risk that a model pursues goals other than the ones it was given. The company says the cause was greater uncertainty after recent incidents in cybersecurity evaluations, not a new failure, and that its evidence probably still supports "very low"2124. The report quotes the UK AI Security Institute (AISI) as saying models engaged in sustained, potentially harmful activity directed at real people and organisations. At the time of writing, Anthropic had not yet reviewed the transcripts21.

Other disclosures were more serious. The report describes a gap of about 11 months, from May 2025 to April 2026, during which chemical and biological weapons classifiers and their logging were turned off for human-feedback vendor traffic. That covered roughly 133 million exchanges. Anthropic says a later review found no clear misuse2326. The report confirms the gap was fixed and no customers were affected, but says the discovery reduced its confidence that no similar gaps exist21. It also discloses an internal model, "Model 2," that is somewhat more capable than the released Claude Mythos 5. Anthropic has no current plans to release it24. On Anthropic's internal research benchmark, CoBench, Model 2 scored 62.8 percent to Mythos 5's 50.3 percent26.

The finding with the biggest implications for frontier model evaluation may be the least noticed. Anthropic says its most concrete task-based evaluations for AI R&D have saturated, meaning models score so high the tests can no longer show further progress. It also reports early signs of acceleration and says it is less confident than before that no threshold has been crossed2428. Coverage agrees on the facts but frames them differently. Some outlets lead with the shelved model22, others with the saturated benchmarks28. One argues that the higher risk label reflects lower confidence, not a new capability25. Each framing is accurate. The benchmark problem matters most, because the whole RSP depends on being able to detect when a threshold is crossed.

Red-teaming the report itself

The August report also showed something new in self-scrutiny. Anthropic gave a Claude Mythos 5 instance access to Slack, internal documents and the codebase, and asked it to critique the misalignment section23. The model agreed with the "low" rating. It also flagged an incident that had been redacted entirely as among the most informative evidence about alignment, and argued it should have been disclosed in more detail26. This is a novel test, but it is still a company's own model reviewing that company's work.

The outside-review machinery stayed mostly unused. The report says the LTBT had not requested an external review and the policy hadn't required one, though pilot reviews continued21. METR, a nonprofit that evaluates frontier models, piloted a review of the AI R&D section of the first report, and the biosecurity nonprofit SecureBio reviewed its chemical and biological sections24. One prominent commentator said the Trust should at least request a review next time27.

The October turn: evaluators inside the building

Anthropic's October announcement goes some way toward answering the main criticism of v3.0. GovAI had warned that the new transparency tools still relied mostly on self-reporting, with Anthropic setting its own goals and deciding what to redact13. On October 15, Anthropic said it had given six METR staff company hardware, office space and access to internal tools roughly equal to what its own risk assessment teams have31. METR will publish its findings without an Anthropic veto. Anthropic can require redactions only in set categories such as customer data, privileged legal information and model architecture. However, Anthropic decides what falls into those categories31. METR can say publicly whether it thinks a redaction was justified36.

The arrangement is the top level of a three-tier system. At the lowest tier, SecureBio runs narrower reviews and needs Anthropic's approval to publish35. Talks with Hugging Face are at an early stage33. Anthropic compares the setup to bank supervisors stationed inside large banks31.

The timing matters. Reuters reported that Anthropic and OpenAI had pushed for significant control over what outside reviewers could publish, and that Anthropic became more open as negotiations went on33. One analysis ties the move to Anthropic signing the White House Accord on Super Intelligence and to new FTC civil investigative demands, and argues that voluntary access works partly as evidence prepared ahead of regulatory scrutiny.

The verdict

Read together, the coverage supports a clear conclusion. Version 3 of the RSP was a retreat on binding commitments: the pause pledge is gone, and some thresholds have been tightened in ways that make them harder to trigger. But Anthropic has since paired that retreat with more disclosure than any rival has matched. That includes a 186-page report admitting operational failures, marked redactions, and outside evaluators with access close to an employee's. The open question is enforcement. The LTBT has not yet used its review power, Anthropic still decides what counts as redactable, and the benchmarks meant to warn of fast AI-driven R&D are already maxed out. METR's first published assessment will show whether this is real oversight or a more detailed form of self-reporting.