On May 22, 2025, Anthropic announced that it is deploying Claude Opus 4 under the AI Safety Level 3 (ASL‑3) Deployment and Security Standards described in its Responsible Scaling Policy (RSP). The company framed the move as a precautionary, provisional decision while it continues to assess Opus 4’s capabilities related to chemical, biological, radiological, and nuclear (CBRN) risks.
Why ASL‑3 now?
Anthropic states it has not yet concluded whether Claude Opus 4 definitively crosses the Capability Thresholds that would require ASL‑3 protections. However, because CBRN‑related capabilities and knowledge have continued to improve, it was not possible to rule out ASL‑3‑level risks for Opus 4 as clearly as for prior models. Anthropic also says it has ruled out the need for ASL‑4 for Claude Opus 4 and ruled out ASL‑3 for Claude Sonnet 4.
The RSP principle is that increasingly capable models warrant stronger deployment and security protections. Until now Anthropic’s models have been deployed with baseline AI Safety Level 2 (ASL‑2) protections, which include training models to refuse dangerous CBRN requests and defenses against opportunistic attempts to steal model weights.
Deployment measures
ASL‑3 deployment measures are narrowly targeted at preventing the model from assisting in CBRN‑weapons‑related tasks of concern, especially extended end‑to‑end workflows that would be additive to what is possible without large language models. A principal focus is reducing the risk of universal jailbreaks — systematic attacks that could enable consistent extraction of workflow‑enhancing CBRN information.
Anthropic describes a three‑part approach:
- Making the system harder to jailbreak: they implemented Constitutional Classifiers—real‑time classifier guards trained on synthetic data representing harmful and harmless CBRN prompts and completions—which monitor inputs and outputs and block a narrow class of harmful CBRN information. Pre‑production testing indicated a substantial reduction in jailbreak success with only moderate added compute overhead.
- Detecting jailbreaks: a broader monitoring system has been instituted, including a bug bounty program that stress‑tests the Constitutional Classifiers, offline classification systems, and leverages threat‑intelligence partnerships to rapidly identify potential universal jailbreaks enabling CBRN misuse.
- Iteratively improving defenses: when jailbreaks are found, Anthropic plans to generate synthetic jailbreak examples resembling discovered attacks and use those data to retrain classifiers and remediate vulnerabilities quickly.
The company says these measures are focused on CBRN risks and do not aim to address unrelated jailbreaks or to prevent extraction of commonly available single facts (although they may incidentally do so). Anthropic expects new jailbreaks will emerge and that defenses must be iteratively improved.
Security controls
Security measures center on protecting model weights—the numerical parameters that would allow bypassing deployment protections if exfiltrated. Anthropic reports deploying more than 100 different security controls combining preventive and detection mechanisms, primarily addressing threats from sophisticated non‑state actors across initial entry, lateral movement, and final extraction stages.
Examples of controls include two‑party authorization for model weight access, enhanced change management protocols, and endpoint software controls such as binary allowlisting—practices aligned with other security‑conscious organizations.
A distinctive control is preliminary egress bandwidth limits: these restrict outbound network traffic from secure environments where model weights reside. Because model weights are large, limiting outbound bandwidth creates a detection advantage: unusual bandwidth usage can trigger blocking and investigation, and over time rate limits may make exfiltrating weights before detection very difficult even if other defenses are compromised. Implementing egress controls has also improved Anthropic’s understanding and governance of outbound data flows, benefiting their detection and response capabilities.
Anthropic says it will continue to refine egress controls, mitigations for sophisticated insider threats, and its overall security posture.
Conclusions and next steps
Anthropic acknowledges that deciding which deployment and security measures to apply to frontier AI models is not a solved problem. Operating under ASL‑3 will provide practical experience that can surface new issues and opportunities. The company plans to work with other AI industry actors, Claude users, and government and civil society partners to improve protection methods, and it has published a detailed report accompanying the announcement.
Anthropic will continue to evaluate Claude Opus 4’s CBRN capabilities; if it concludes the model has not exceeded the relevant Capability Thresholds, it may remove or adjust ASL‑3 protections accordingly.
