Model cards compared

Stated

• “Claude 2 was developed by Anthropic and released in July 2023.”

  Section 2 'Claude 2 Model Card', 'Model details', PDF p. 1

• “Claude 2.1, a new release which builds additional product features and functionality on top of Claude 2.0”

  Claude 2.1 Model Card Appendix, Section 1 'Introduction', PDF p. 15

Note: The card states Claude 2's release month (July 2023). For Claude 2.1 the appendix states a new release without a date; the appendix also states that support at Claude 2.0's initial product launch was 100K tokens and is now 200K. The November 21, 2023 date on PDF p. 1 is the card’s update, not a release date.

Stated

• “Neither ARC nor we believe that our current Claude models possess the dangerous capabilities (‘autonomous replication’ abilities) that ARC is aiming to detect”

  Section 2 'Evaluations and Red Teaming', PDF p. 2

Note: The card states that ARC's safety audits addressed autonomous replication and that neither ARC nor Anthropic believes current Claude models have that capability. This is Anthropic's account; ARC's own report is not part of the card.

Stated

• “Before deployment, we also worked with external red teamers, including crowdworker platforms, to test Claude 2 on a range of Trust and Safety related topics”

  Section 2 'Evaluations and Red Teaming', PDF p. 2

• “We evaluated and red-teamed Claude 2 and previous Claude models for several national security and safety related risks.”

  Section 2 'Evaluations and Red Teaming', PDF p. 2

Note: The card states pre-deployment red-teaming by external red teamers including crowdworker platforms on Trust and Safety topics, and red-teaming for unnamed national security risks. Section 3.1 adds a crowdworker red-teaming task and Section 3.4 automated red-teaming on 328 held-out prompts. No number of testers or period is given.

Stated

• “We have been working with the Alignment Research Center (ARC) since fall of 2022 to support their safety audits of our AI models.”

  Section 2 'Evaluations and Red Teaming', PDF p. 2

Note: The card names ARC as conducting safety audits of Anthropic's models; the crowdworker platforms used for red-teaming are not named.

Stated

• “This approach has its limitations–for instance, we know the scenarios created by crowdworkers are not fully representative of the scenarios Claude will encounter out in real-world usage”

  Section 3.1 'Human Feedback Evaluations and Red-Teaming', PDF p. 3

• “Our internal evaluations for this metric are still in early stages of development”

  Appendix Section 3 'Honesty Evaluations', PDF p. 16

Note: The card states a limitation of its crowdworker-based human feedback and red-teaming evaluation, and that the Claude 2.1 document-faithfulness evaluation is at an early stage. It also states that it expects to release new findings as its research and evaluations continue (Section 1).

Stated

• “Anthropic, “Anthropic’s Responsible Scaling Policy.” September, 2023.”

  References, [5], PDF p. 39

• “The evaluation tasks were based on tasks defined in the appendix of v1.0 of our RSP [5]”

  Section 6.2.1 'Autonomous Replication and Adaption (ARA) evaluations', PDF p. 24

Note: The card names the Responsible Scaling Policy and identifies the edition by its date (September 2023) and as v1.0 (Responsible Scaling Policy v1.0, September 19, 2023).

Stated

• “September, 2023. https://www.anthropic.com/index/anthropics-responsible-scaling-policy.”

  References, [5], PDF p. 39

Note: The card gives a bibliographic reference with an address. The address is Anthropic's announcement page for the policy, not the policy PDF.

Stated

• “Our results show no indicators of catastrophic risk, and therefore we classify all of our Claude 3 models as ASL-2.”

  Section 6.2 'Evaluation Results', PDF p. 24

Note: The card assigns ASL-2 to all three Claude 3 models. It states that the evaluations were run on a lower-refusal version of Claude 3 Opus.

Stated

• “we still take various precautionary measures at ASL-2. We harden security against opportunistic attackers for all copies of Claude 3 model weights.”

  Section 6.3 'Security and Deployment Mitigations', PDF p. 26

• “You can read a more detailed description of our ASL-2 security and deployment measures in our full policy [5].”

  Section 6.3 'Security and Deployment Mitigations', PDF p. 26

Note: The card states security and deployment measures at ASL-2, the level assigned in Q05, including automated detection of CBRN- and cyber-related prompts. This is the developer's account of the measures.

Stated

• “In summary, the model did not meet our most conservative biological risk thresholds, and our expert consultants agreed.”

  Section 6.2.2 'Biological Evaluations', PDF p. 25

Note: The card states biological evaluations (automated question sets and a human uplift trial) with the outcome that the early-indicator thresholds were not met. No chemical, radiological or nuclear evaluation is reported for Claude 3. Evaluation details are not recorded (hazard rule).

Stated

• “We judged that the model did not pass the ASL-3 threshold on any of the early indicator tests.”

  Section 6.2.3 'Cyber Evaluations', PDF p. 25

Note: The card states cyber evaluations (vulnerability discovery and exploit development) with the outcome that the ASL-3 threshold was not passed. Scores and task details are not recorded (hazard rule).

Stated

• “Across all the rounds, the model was clearly below our ARA ASL-3 risk threshold, having failed at least 3 out of 5 tasks”

  Section 6.2.1 'Autonomous Replication and Adaption (ARA) evaluations', PDF p. 24

Note: The card states autonomous replication and adaptation evaluations with the outcome that the ASL-3 warning threshold was not crossed. Task contents are not recorded (hazard rule).

Stated

• “Examples of tested topics include, but are not limited to: child safety, dangerous weapons and technology, hate speech, violent extremism, fraud, and illegal substances.”

  Section 7.1.1 'Multimodal Policy Red-Teaming', PDF p. 27

• “We conduct vulnerability testing using internal and external human testers to explore over a dozen policy categories”

  Section 7 'Trust & Safety and Societal Impact Evaluations', PDF p. 26

Note: The card states a Trust & Safety multimodal red-team exercise, with example topics and a prompt count (378 prompts, Figure 17), and vulnerability testing by internal and external testers across over a dozen policy categories. Section 6.2 states that the RSP requires risk assessment 'primarily through automated evaluations and red teaming'.

Stated

• “we are aware that these results do not comprehensively rule out risk.”

  Section 6.4 'RSP areas for improvement', PDF p. 26

• “Opus performed worse, suggesting that we may have under-elicited the model’s capabilities.”

  Section 6.2.2 'Biological Evaluations', PDF p. 25

Note: The card states that its results do not rule out risk, that elicitation could be improved on ARA and CBRN tasks, and that the biological evaluations may have under-elicited capability. Section 6.2 adds that 'evaluations are a hard scientific problem'.

Stated

• “Based on our assessments, we classify Claude 3.5 Sonnet as an AI Safety Level 2 (ASL-2) model, indicating that it does not pose risk of catastrophic harm.”

  Section 3 'Safety', Introduction, PDF p. 6

Note: The addendum assigns ASL-2. It also states that the model did not trigger the compute threshold for the policy's full evaluation protocol, and that evaluations were run regardless.

Stated

• “Claude 3.5 Sonnet did not exceed our safety thresholds in these evaluations and we classify it at ASL-2.”

  Section 3, 'Safety Evaluations Results', PDF p. 6

Note: The addendum states CBRN evaluations (knowledge tests and a measure of uplift to non-experts) and one outcome for all three domains: the thresholds of concern were not exceeded. It does not state a CBRN-specific result. Evaluation details are not recorded (hazard rule).

Stated

• “Claude 3.5 Sonnet did not exceed our safety thresholds in these evaluations and we classify it at ASL-2.”

  Section 3, 'Safety Evaluations Results', PDF p. 6

Note: The addendum states capture-the-flag cyber evaluations and the shared outcome that the thresholds of concern were not exceeded. Task details are not recorded (hazard rule).

Stated

• “Claude 3.5 Sonnet did not exceed our safety thresholds in these evaluations and we classify it at ASL-2.”

  Section 3, 'Safety Evaluations Results', PDF p. 6

Note: The addendum states autonomy evaluations (software-engineering tasks) and the shared outcome. It also states that METR explored the model's autonomy-relevant capabilities, without giving METR's result.

Stated

• “Additionally, METR [28] did an initial exploration of the model’s autonomy-relevant capabilities.”

  Section 3, 'Safety Evaluations Overview', PDF p. 6

Note: The addendum names METR as having explored the model's autonomy-relevant capabilities. It gives no result of that exploration.

Stated

• “The UK AISI also conducted pre-deployment testing of a near-final model, and shared their results with the US AI Safety Institute”

  Section 3, 'Safety Evaluations Overview', PDF p. 6

Note: The addendum names the UK AI Safety Institute as having tested a near-final model before deployment and states that it shared its results with the US AI Safety Institute. It does not state that the US institute tested the model.

Stated

• “Note that it is possible that the results underestimate the capability of an equivalent Helpful-only model, because alignment training may cause it to hedge concerning answers.”

  Section 3, 'Safety Evaluations Overview', PDF p. 6

Note: The addendum states that safety training can lead capability evaluations to underestimate underlying capability, and that its results may do so. It also states that much remains to be learned about evaluation science and cadence.

Stated

• “Both models underwent extensive safety evaluations, including comprehensive testing for potential risks in biological, cybersecurity, and autonomous behavior domains, in accordance with our Responsible Scaling Policy (RSP) [4].”

  Section 1 'Introduction', PDF p. 1

• “[4] Anthropic, “Responsible Scaling Policy.” October, 2024. https://assets.anthropic.com/m/ 24a47b00f10301cd/original/Anthropic-Responsible-Scaling-Policy-2024-10-15.pdf.”

  References [4], PDF p. 13 (the address breaks across two lines)

Note: The card names the Responsible Scaling Policy and identifies the edition by a dated reference (October 2024) whose address carries the date 2024-10-15, which the dataset records for Responsible Scaling Policy v2.0.

Stated

• “[4] Anthropic, “Responsible Scaling Policy.” October, 2024. https://assets.anthropic.com/m/ 24a47b00f10301cd/original/Anthropic-Responsible-Scaling-Policy-2024-10-15.pdf.”

  References [4], PDF p. 13 (the address breaks across two lines)

Note: The card gives a bibliographic reference with the address of the policy document.

Stated

• “Based on our analysis, we judge that the upgraded Claude 3.5 Sonnet does not require ASL-3 safeguards at this time.”

  Section 3.2.1 'Results', PDF p. 10

• “While these models did not trigger the full evaluation protocol described in our Responsible Scaling Policy”

  Section 3.3 'Ongoing Safety Commitment', PDF p. 10

Note: The card states for the upgraded Claude 3.5 Sonnet that ASL-3 safeguards are not required, and for both models that they did not trigger the policy's full evaluation protocol. It also states that the computer use capability is classified under the ASL-2 framework (Section 2.1).

Stated

• “We also evaluate frontier risks in accordance with our Responsible Scaling Policy (RSP) [4] in the the areas of Chemical, Biological, Radiological, and Nuclear (CBRN) risks, Cybersecurity, and Autonomous Capabilities.”

  Section 3 'Safety', PDF p. 7

• “The model did not demonstrate capabilities requiring ASL … 3 safeguards and security in any domain.”

  Section 3.2.1 'Results', PDF pp. 9–10 (the text layer splits 'ASL-3' across the page break; the ellipsis marks the page number)

Note: The card states CBRN evaluations under the RSP and, for the upgraded Claude 3.5 Sonnet, that no domain showed capabilities requiring ASL-3 safeguards and security. Radiological and nuclear risks are reported together with chemical and biological as CBRN. No domain outcome is stated separately for Claude 3.5 Haiku.

Stated

• “We also evaluate frontier risks in accordance with our Responsible Scaling Policy (RSP) [4] in the the areas of Chemical, Biological, Radiological, and Nuclear (CBRN) risks, Cybersecurity, and Autonomous Capabilities.”

  Section 3 'Safety', PDF p. 7

• “The model did not demonstrate capabilities requiring ASL … 3 safeguards and security in any domain.”

  Section 3.2.1 'Results', PDF pp. 9–10 (the text layer splits 'ASL-3' across the page break; the ellipsis marks the page number)

Note: The card states cybersecurity evaluations under the RSP and, for the upgraded Claude 3.5 Sonnet, that no domain showed capabilities requiring ASL-3 safeguards and security. Method descriptions in Section 3.2 are not recorded (hazard rule).

Stated

• “we deem our software engineering evaluations as currently sufficient for ruling out ASL-3 autonomy capabilities”

  Section 3.1.4 'Evaluating Computer Use for the Responsible Scaling Policy', PDF p. 9

• “Based on our analysis, we judge that the upgraded Claude 3.5 Sonnet does not require ASL-3 safeguards at this time.”

  Section 3.2.1 'Results', PDF p. 10

Note: The card states autonomy evaluations under the RSP, that its software engineering evaluations suffice to rule out ASL-3 autonomy capabilities, and that the developer judges the upgraded Claude 3.5 Sonnet not to require ASL-3 safeguards.

Stated

• “We conducted comprehensive Trust & Safety (T&S) evaluations across fourteen policy areas in six languages”

  Section 3.1.1 'Model Red-Teaming', PDF p. 7

• “We conducted specific Trust & Safety red-teaming for computer use to identify potential abuse vectors.”

  Section 3.1.3 'Computer Use Red-Teaming', PDF p. 8

• “We conducted rigorous first party and independent third party multimodal red-teaming exercises”

  Section 2.1 'Computer Use', PDF p. 2

Note: The card states Trust & Safety red-teaming across fourteen policy areas in six languages, computer-use red-teaming, and first- and third-party multimodal red-teaming; Section 3.2 also mentions manual red-teaming within CBRN evaluations. No number of testers or period is given.

Stated

• “We also collaborated with METR [8] to conduct an independent assessment.”

  Section 1 'Introduction', PDF p. 1; repeated in Section 3.2, PDF p. 9

Note: The card names METR as conducting an independent assessment; it does not state the assessment's scope or outcome, or which model it covered.

Stated

• “joint pre-deployment testing of the new Claude 3.5 Sonnet model was conducted by the US AI Safety Institute (US AISI) [6] and the UK AI Safety Institute (UK AISI) [7].”

  Section 1 'Introduction', PDF p. 1; repeated in Section 3.2, PDF p. 9

Note: The card states pre-deployment testing of the upgraded Claude 3.5 Sonnet by the US and UK AI Safety Institutes; no government testing of Claude 3.5 Haiku is stated.

Stated

• “We believe dedicated scaffolding and prompting can further improve the results.”

  Section 2.2 'Tool Use & Agentic Tasks', PDF p. 3

• “We detail some of our preliminary reasoning below”

  Section 3.1.4 'Evaluating Computer Use for the Responsible Scaling Policy', PDF p. 9

Note: The card states that a reported agentic coding result could be improved with dedicated scaffolding and prompting, and describes its reasoning on computer use and RSP threat models as preliminary. No limitation is stated for the Section 3.2 frontier risk results.

Stated

• “Anthropic’s Responsible Scaling Policy. https://www.anthropic.com/index/anthropics-responsible-scaling-policy, September 2023.”

  Reference [1], PDF p. 42

Note: The bibliography identifies the cited RSP by September 2023. This records the card’s reference, without substituting a later edition.

Stated

• “https://www.anthropic.com/index/anthropics-responsible-scaling-policy”

  Reference [1], PDF p. 42

Note: The card supplies the policy address.

Stated

• “Based on our assessments, we’ve concluded that Claude 3.7 Sonnet is released under the ASL-2 standard.”

  §1.4.3 ASL Determination Process, PDF p. 6

Note: The card reports an ASL-2 safeguards determination.

Stated

• “Claude 3.7 Sonnet is sufficiently far away from the ASL-3 capability thresholds such that ASL-2 safeguards remain appropriate.”

  §1.4.4 ASL-2 Determination and Conclusions, PDF p. 7

Note: The card ties ASL-2 safeguards to its assessment against ASL-3 capability thresholds.

Stated

• “Altogether, we believe that Claude 3.7 Sonnet continues to be sufficiently far away from the ASL-3 capability thresholds, and therefore, we find that ASL-2 safeguards remain appropriate.”

  §7.1 CBRN Evaluations, conclusion, PDF p. 24

Note: The card’s biological-risk conclusion is recorded at policy level. §7.1.1 states that chemical risks were not evaluated directly; §7.1.2 describes nuclear-risk work with NNSA.

Stated

• “Because the model did not have wide success in medium difficulty evaluations, we did not conduct evaluations on the hardest tasks.”

  §7.3 Cyber Evaluations, Results item 3, PDF p. 35

Note: The card reports a qualitative outcome of its offensive-cyber evaluations; no task contents or scores are recorded.

Stated

• “these improvements did not cross any new capability thresholds beyond those already reached by Claude 3.5 Sonnet (new).”

  §7.2 Autonomy Evaluations, Results, PDF p. 29

Note: The card reports its autonomy/AI R&D evaluation conclusion.

Stated

• “During our evaluations we noticed that Claude 3.7 Sonnet occasionally resorts to special-casing in order to pass test cases in agentic coding environments like Claude Code.”

  §6 Excessive Focus on Passing Tests, PDF p. 22

Note: The card reports reward-hacking behaviour observed during evaluations.

Stated

• “Our evaluations were informed by our previous deployment and included both internal and third-party red-teaming exercises as well as automated evaluations.”

  §4 Computer Use, PDF p. 12

Note: The stated scope is computer-use risk; internal and third-party red-teaming are reported.

Stated

• “Domain experts from Deloitte engaged in extended conversations with Claude”

  §7.1.4, Expert Red Teaming, PDF p. 26

Note: The card names Deloitte as an external evaluator; technical evaluation details are omitted.

Stated

• “the U.S. AI Safety Institute (U.S. AISI) and U.K. AI Security Institute (U.K. AISI) conducted pre-deployment testing of Claude 3.7 Sonnet”

  §7.4 Third Party Assessments, PDF p. 41

Note: The named institutes are reported to have tested the model.

Stated

• “how the model performs on expert-level evaluations may not directly translate to real-world capabilities”

  §7.1 CBRN Evaluations, Results, PDF p. 23

Note: The card limits interpretation of its evaluation results.

Stated

• “please see the Responsible Scaling Policy”

  §1.2.3 AI Safety Level determination process, PDF p. 9 (hyperlink annotation on policy name)

Note: The card’s hyperlink annotation targets https://www-cdn.anthropic.com/872c653b2d0501d6ab44cf87f43e1dc4853e4d37.pdf. The target’s cover prints Version 2.2, Effective May 14, 2025. Edition identified by link annotation (maintainer decision 4a): the Responsible Scaling Policy v2.2, effective May 14, 2025.

Stated

• “For more information on the requirements for these ASL Standards, please see the Responsible Scaling Policy”

  §1.2.3, PDF p. 9

Note: The framework name in this passage is linked directly to the RSP v2.2 PDF. Page 8 separately links a policy-update announcement; that is not the edition evidence.

Stated

• “we have decided to release Claude Opus 4 under the ASL-3 Standard and Claude Sonnet 4 under the ASL-2 Standard.”

  §1.2.3 AI Safety Level determination process, PDF p. 9

Note: The card applies different safeguard standards to the two models. For Opus 4 the card says ASL-3 capability could not be ruled out, rather than reporting that it definitively passed the threshold (§1.2.4).

Stated

• “The ASL-3 safeguards we have now activated for Claude Opus 4 represent significant investments in both deployment protections and security controls”

  §1.2.4 Conclusions, PDF p. 10

Note: The card ties the stated deployment and security controls to Opus 4’s precautionary ASL-3 deployment.

Stated

• “we cannot clearly rule out ASL-3 risks for Claude Opus 4 (although we have ruled out that it needs the ASL-4 Standard).”

  §1.2.4 Conclusions, PDF p. 10

Note: The conclusion concerns CBRN capability uncertainty described in §§1.2.3–1.2.4. Sonnet 4 remains at ASL-2; this is not a claim that Opus 4 definitively passed the ASL-3 capability threshold.

Stated

• “Based on the evaluation results, we believe the models do not demonstrate catastrophically risky capabilities in the cyber domain.”

  §7.4 Cyber evaluations, Results, PDF p. 117

Note: The card’s policy-level conclusion covers both models. §7.4 states that the RSP has no formal cyber threshold at any ASL level.

Stated

• “Claude Opus 4 shows improvement over Claude Sonnet 3.7 in most AI research and software engineering capabilities, while remaining below the ASL-4 Autonomy threshold.”

  §7.3 Autonomy evaluations, PDF p. 105

Note: The card concludes that Opus 4 remains below the ASL-4 autonomy threshold; the Sonnet 4 conclusion on p. 106 also says ASL-4 protections are not required.

Stated

• “None of the snapshots we tested showed significant signs of systematic deception or coherent hidden goals.”

  §4 Alignment assessment, PDF p. 22

Note: This is the card’s aggregate conclusion for Opus 4 snapshots. The same section and §4.1.1 describe conditional self-preservation and deception findings; it is not a conclusion that such behaviour was absent.

Stated

• “Red-teamers probed various scenarios over three days of testing”

  §7.2.4.2 ASL-3 expert red teaming, PDF p. 94

Note: The card reports biological-risk expert red-teaming by Deloitte for both models, over three days.

Stated

• “we contracted with Apollo Research to assess an early snapshot for propensities and capabilities related to sabotage”

  §4.1.1.4 External scenario evaluations, PDF p. 30

Note: The named external evaluation concerns an early Opus 4 snapshot; its findings are not attributed to the final model.

Stated

• “joint pre-deployment testing of the new Claude Opus 4 model was conducted by the US AI Safety Institute (US AISI) and the UK AI Security Institute (UK AISI).”

  §7.5 Third party assessments, PDF p. 122

Note: This passage concerns Opus 4; it does not state that the institutes also tested Sonnet 4.

Stated

• “Based on these assessments, we have decided to release Claude Opus 4 under the ASL-3 Standard and Claude Sonnet 4 under the ASL-2 Standard.”

  §1.2.3, PDF p. 9

Note: The card expressly states a release decision. The developer’s “we” identifies Anthropic as decision-maker under maintainer decision 6a; CEO/RSO roles in the preceding paragraph concern the ASL determination.

Stated

• “The absolute values of these metrics depend on our largely-arbitrary choice of auditor instructions.”

  §4.2.1 Automated behavioral audits, PDF p. 48

Note: The card limits interpretation of its automated behavioural audit metrics.

Stated

• “For more information on the requirements for these ASL Standards, please see the Responsible Scaling Policy”

  Section 1.2.3 'AI Safety Level determination process', PDF p. 12 (hyperlinked words)

Note: The card names the Responsible Scaling Policy; the text gives no version, but the PDF's hyperlink on these words points to a policy PDF whose cover reads 'Version 2.2, Effective May 14, 2025' (Responsible Scaling Policy v2.2; identified by link annotation, maintainer decision 4a). The printed text does not name the edition.

Stated

• “For more information on the requirements for these ASL Standards, please see the Responsible Scaling Policy”

  Section 1.2.3 'AI Safety Level determination process', PDF p. 12 (hyperlinked words)

Note: The card refers the reader to the policy; the words carry a hyperlink to the RSP v2.2 PDF (also on PDF p. 117). The address is not printed in the text.

Stated

• “Our determination is that Claude Opus 4.5 does not cross either the AI R&D-4 or CBRN-4 capability threshold.”

  Section 1.2.4 'Conclusions', PDF p. 12

Note: The card states that the model does not cross the AI R&D-4 or CBRN-4 thresholds and that it is deployed under the ASL-3 Standard. For cyber it states that the policy sets no capability threshold (Q08).

Stated

• “For Claude Opus 4.5, we implemented ASL-3 (AI Safety Level 3) protections based on the model’s demonstrated capabilities.”

  Section 1.2.1 'Overview', PDF p. 11

• “Based on these assessments, we have decided to release Claude Opus 4.5 under the ASL-3 Standard.”

  Section 1.2.3 'AI Safety Level determination process', PDF p. 12

Note: The card states that ASL-3 protections were implemented on the basis of the capability assessment. This is the developer's account of the safeguards applied.

Stated

• “We determine that Claude Opus 4.5 does not cross the CBRN-4 threshold.”

  Section 1.2.4.2 'On chemical, biological, radiological, and nuclear (CBRN) risks', PDF p. 14

• “As a result, we determined ASL-3 safeguards were appropriate.”

  Section 7.2 'CBRN evaluations', 'Claude Opus 4.5 Results', PDF p. 119

• “we do not currently run specific evaluations on chemical risks internally”

  Section 7.2.1 'On chemical risks', PDF p. 120

Note: The card states biological evaluations with the outcome that the CBRN-4 threshold is not crossed and ASL-3 safeguards are appropriate. It states that chemical risks are not evaluated internally, and that radiological and nuclear evaluations are carried out with NNSA and their results are not published by Anthropic. Evaluation details are not recorded (hazard rule).

Stated

• “We believe that Claude Opus 4.5 does not demonstrate catastrophically risky capabilities in the cyber domain.”

  Section 7.4 'Cyber evaluations', 'Results', PDF p. 145

• “The Responsible Scaling Policy does not stipulate a capability threshold for cyber capabilities at any ASL level”

  Section 7.4 'Cyber evaluations', PDF p. 143

Note: The card states cyber evaluations and a conclusion without a policy threshold, which it states the policy does not set for cyber. Evaluation methods and scores are not recorded (hazard rule).

Stated

• “We judge that Claude Opus 4.5 could not fully automate an entry-level, remote-only research role at Anthropic.”

  Section 1.2.4.1 'On autonomy risks', PDF p. 13

• “Claude Opus 4.5 has roughly reached the pre-defined thresholds we set for straightforward ASL-4 rule-out based on benchmark tasks.”

  Section 1.2.3 'AI Safety Level determination process', PDF p. 12

Note: The card states AI R&D evaluations, that the AI R&D-4 threshold is not crossed, and that the rule-out drew also on an internal survey and qualitative impressions because benchmark rule-out thresholds were roughly reached.

Stated

• “Claude Opus 4.5 is very unlikely to pose a significant risk of catastrophic impacts through the intentional sabotage of human engineering, R&D, or decision-making.”

  Section 6.1.2 'Overall assessment of high-stakes sabotage risk', PDF p. 66

• “We saw no signs of sandbagging or strategic attempts to tamper with our safety testing in a way that would affect our RSP determinations”

  Section 6.1.1 'Key findings on safety and alignment', PDF p. 66

Note: The card states alignment evaluations covering sabotage, deception, sandbagging, reward hacking and evaluation awareness, with the conclusion that high-stakes sabotage risk is low. It also reports two isolated cases of deception by omission in testing earlier snapshots, which it attributes to interventions against prompt injection.

Stated

• “We worked with the US Center for AI Standards and Innovation to red-team Claude Opus 4.5 over a one-week window, which included at least 2–3 days of red-teaming.”

  Section 7.2.4.10 'ASL-4 red teaming with the CAISI', PDF p. 132

• “Finally, red-teaming results by various third parties demonstrated some increase in risk, but not enough to require additional protections.”

  Section 7.2 'CBRN evaluations', 'Claude Opus 4.5 Results', PDF p. 119

Note: The card states biological red-teaming by third parties, by one external expert over two days (Section 7.2.4.9) and by CAISI over a one-week window; prompt-injection red-teaming with Gray Swan (Section 5.2); and that cyber capabilities are red-teamed (Section 7.4).

Stated

• “Gray Swan measured the success rate of prompt injection attacks after a single attempt (k=1)”

  Section 5.2.1 'Gray Swan Agent Red Teaming benchmark for tool use', PDF p. 58

Note: The card names Gray Swan, which it calls an external research partner, as measuring prompt-injection attack success. The third parties in biological red-teaming and the external expert are not named; the changelog refers to ARC-AGI scores 'reported by the ARC Foundation'.

Stated

• “pre-deployment testing of Claude Opus 4.5 was conducted by the US Center for AI Standards and Innovation (CAISI) and the UK AI Security Institute (UK AISI).”

  Section 7.5 'Third party assessments', PDF p. 151

• “Anthropic has maintained a formal partnership with the U.S. Department of Energy’s National Nuclear Security Administration (NNSA) to evaluate our AI models for potential nuclear and radiological risks.”

  Section 7.2.2 'On radiological and nuclear risks', PDF p. 120

Note: The card states pre-deployment testing by CAISI and the UK AISI (CBRN, cyber, ASL-3 safeguards and misalignment), UK AISI testing of a pre-release snapshot for misalignment (Section 6.13), and an NNSA partnership evaluating models for nuclear and radiological risks.

Stated

• “Consistent with our RSP, the Responsible Scaling Officer and CEO made the ultimate determination on the required ASL Standards.”

  Section 1.2.3 'AI Safety Level determination process', PDF p. 12

• “Based on these assessments, we have decided to release Claude Opus 4.5 under the ASL-3 Standard.”

  Section 1.2.3 'AI Safety Level determination process', PDF p. 12

Note: The card states a decision to release in the company's voice, and names the Responsible Scaling Officer and CEO as making the ASL determination on which the release rests.

Stated

• “However, confidently ruling out these thresholds is becoming increasingly difficult.”

  Section 1.2.4 'Conclusions', PDF p. 12

• “parts of the AI R&D-4 and CBRN-4 thresholds have fundamental epistemic uncertainty or require more sophisticated forms of measurement”

  Section 1.2.4 'Conclusions', PDF p. 12

Note: The card states that ruling out the AI R&D-4 and CBRN-4 thresholds is becoming difficult and that parts of the thresholds carry epistemic uncertainty. It also states limited tools for studying reasoning faithfulness (Section 6.1.1).

Stated

• “System Card: Claude Haiku 5.5 October 7, 2026”

  Cover, PDF p. 1

Note: The card carries a printed date with day precision (October 7, 2026); its kind (issue or publication) is not stated. No changelog or revision date was found.

Stated

• “we describe our assessment of Claude Haiku 5.5 for catastrophic risks relevant to our Responsible Scaling Policy (RSP)”

  Section 2.1 'Introduction', PDF p. 11 (hyperlinked words)

Note: The words 'Responsible Scaling Policy (RSP)' carry a hyperlink to https://www.anthropic.com/responsible-scaling-policy, an undated page; the address is not printed in the text.

Stated

• “As such, we determine that Haiku 5.5 does not cross our CB-2 or Autonomy-2 RSP thresholds.”

  Section 2.1 'Introduction', PDF p. 11

• “However, we do treat Haiku 5.5 as meeting our CB-1 and Autonomy-1 thresholds, and we apply the corresponding mitigations from our RSP.”

  Section 2.1 'Introduction', PDF p. 11

Note: The card states that the model does not cross the CB-2 or Autonomy-2 thresholds and is treated as meeting CB-1 and Autonomy-1. No RSP threshold is named for cyber.

Stated

• “However, we do treat Haiku 5.5 as meeting our CB-1 and Autonomy-1 thresholds, and we apply the corresponding mitigations from our RSP.”

  Section 2.1 'Introduction', PDF p. 11

• “For chemical and biological (CB) risks, we have deployed the same harmful CB misuse classifiers as for our deployments of Claude Opus 5 and Claude Sonnet 5”

  Section 1.5 'Safeguards', PDF p. 9

Note: The card states that the mitigations corresponding to the CB-1 and Autonomy-1 thresholds are applied, and lists deployed classifiers for CB, cyber, frontier-LLM development and conventional weapons. This is the developer's account of the safeguards.

Stated

• “As such, we determine that Haiku 5.5 does not cross our CB-2 or Autonomy-2 RSP thresholds.”

  Section 2.1 'Introduction', PDF p. 11

• “We did not conduct expert red-teaming sessions, uplift trials, or other resource-intensive evaluations requiring human participants.”

  Section 2.2.1 'What we measured', PDF p. 11

Note: The card states automated chemical and biological (CB) evaluations, with the outcome that CB-2 is not crossed and CB-1 is treated as met. No radiological or nuclear evaluation is reported in the RSP section. Evaluation names and results are not recorded (hazard rule). Not cross-family checked: the maintainer excluded this cell on chemical and biological evaluations from the cross-family check of 2026-11-03.

Stated

• “Claude Haiku 5.5 is not a frontier model, but it is a relatively significant step up in cyber capabilities over Haiku 4.5.”

  Section 3.1 'Introduction', PDF p. 23

• “Given the relative lack of advanced cybersecurity capabilities, our cyber safeguards for Claude Haiku 5.5 trigger on significantly less activity than other recent releases.”

  Section 3.2 'Mitigations', PDF p. 23

Note: The card states cyber capability evaluations and the conclusion of a relative lack of advanced cybersecurity capabilities, compared with other Claude models; no threshold language is used for cyber. Benchmark contents and scores are not recorded (hazard rule).

Stated

• “Autonomy threat model 2 is not applicable to Haiku 5.5.”

  Section 2.3.1.1 'How Haiku 5.5 affects or changes analysis from our most recent Risk Report', PDF p. 19

• “As Claude Haiku 5.5 is much less capable than Opus 5.5 and does not push the capability frontier, we draw the same conclusion in this case.”

  Section 2.3.3 'Conclusion', PDF p. 20

Note: The card states that the Autonomy-2 threshold is not crossed, carrying over the Claude Opus 5.5 System Card's conclusion on the basis of relative capability, and that Autonomy threat model 1 applies (Q11).

Stated

• “our overall assessment is that the risk of catastrophic harm caused by misalignment of Claude Haiku 5.5 is also low.”

  Section 2.4.2 'Updated overall assessment of alignment risk', PDF p. 22

• “much weaker at covert sabotage than our larger models”

  Executive summary, PDF p. 3

Note: The card states alignment evaluations (behavioural audit, honesty, sandbox escape, covert-capability and sabotage evaluations) with the conclusion that misalignment risk is low.

Stated

• “We use Shade, an external adaptive red-teaming tool from Gray Swan, to evaluate our models’ robustness to prompt injection in coding environments.”

  Section 5.2.2.1 'Coding', PDF p. 51

Note: The card reports prompt-injection red-teaming under a section titled 'External red teaming' (coding, tool use and computer use surfaces) and adversarial testing by crowd workers (Section 1.2). It states that no expert red-teaming sessions were run for CB (Q07). No number of testers or period is given.

Stated

• “Gray Swan trains the attacker on the test scenarios against earlier Claude models, then runs it unchanged against the latest models on the same scenarios.”

  Section 5.2.2.1 'Coding', PDF p. 51

Note: The card names Gray Swan as running its attacker against the latest models. Section 1.6 states that external testers ran assessments without naming them there; Irregular is named as the developer of a cyber benchmark, not as a tester.

Stated

• “these measures are limited: past assessments have not fully captured the potential severity of misbehavior our models were capable of”

  Section 6.1.2 'Key findings on safety and alignment', PDF p. 56

• “The strength of the evidence provided by our alignment assessment for Haiku 5.5 is somewhat lower than that presented for Claude Mythos 5 in the August 2026 Risk Report”

  Section 2.4.1 'Updates to claims and core argument', PDF p. 21

Note: The card states limits of its alignment measures and of the evidence for this model; it also states that internal testing runs at a smaller scale than deployment (Section 6.1.1) and that CB evaluations were automated, without studies requiring human participants (Q07).

Stated

• “Model card published April 10, 2025”

  Header, PDF p. 1

Note: The card prints its publication date, April 10, 2025. No revision date is printed.

Stated

• “Frontier Safety Framework evaluations according to Google DeepMind’s Frontier Safety Framework (FSF)”

  'Ethics and Safety', 'Evaluation Approach', PDF p. 5 (hyperlinked words)

Note: The card names the Frontier Safety Framework; the text gives no version, but the hyperlink on these words points to a framework PDF whose cover reads "Version 2.0" and "4th February 2025" (Frontier Safety Framework v2.0). The file linked differs in bytes from the dataset's other file of that edition; both covers give the same version and date.

Stated

• “Frontier Safety Framework evaluations according to Google DeepMind’s Frontier Safety Framework (FSF)”

  'Ethics and Safety', 'Evaluation Approach', PDF p. 5 (hyperlinked words)

Note: The words carry a hyperlink to the Frontier Safety Framework 2.0 PDF. The address is not printed in the text.

Stated

• “Human red teaming conducted by specialist teams across the policies and desiderata;”

  'Ethics and Safety', 'Evaluation Approach', PDF p. 5

• “Automated red teaming to dynamically evaluate Gemini at scale, complementing human efforts and static evaluations for both security and safety-focused evaluations;”

  'Ethics and Safety', 'Evaluation Approach', PDF p. 5

Note: The card states human red teaming by specialist teams across policies and desiderata, and automated red teaming for security and safety. It gives no number of testers or period, and reports no red-teaming results.

Stated

• “RSC also reviewed data on the model’s performance via assurance evaluations and made release decisions.”

  'Ethics and Safety', 'Evaluation Approach', PDF pp. 5–6

Note: The card states that Google DeepMind's Responsibility and Safety Council, which it calls Google DeepMind's governance body, reviewed assurance-evaluation data and made release decisions. The passage uses the plural and does not describe the decision for this model specifically.

Stated

• “The evaluation results are for automated evaluations and not human evaluation or red-teaming”

  'Ethics and Safety', 'Training and Development Evaluation Results', PDF p. 6

Note: The card states that the reported safety results are automated evaluations only, given relative to Gemini 1.5 Pro 002.

Stated

• “Model card published April 15, 2025”

  Header, PDF p. 1

Note: The card prints its publication date, April 15, 2025. No revision date is printed.

Stated

• “Frontier Safety Framework evaluations according to Google DeepMind’s Frontier Safety Framework (FSF)”

  'Ethics and Safety', 'Evaluation Approach', PDF p. 5 (hyperlinked words)

Note: The card names the Frontier Safety Framework; the text gives no version, but the hyperlink on these words points to a framework PDF whose cover reads "Version 2.0" and "4th February 2025" (Frontier Safety Framework v2.0). The file linked differs in bytes from the dataset's other file of that edition; both covers give the same version and date.

Stated

• “Frontier Safety Framework evaluations according to Google DeepMind’s Frontier Safety Framework (FSF)”

  'Ethics and Safety', 'Evaluation Approach', PDF p. 5 (hyperlinked words)

Note: The words carry a hyperlink to the Frontier Safety Framework 2.0 PDF. The address is not printed in the text.

Stated

• “Human red teaming conducted by specialist teams across the policies and desiderata;”

  'Ethics and Safety', 'Evaluation Approach', PDF p. 5

• “Automated red teaming to dynamically evaluate Gemini at scale, complementing human efforts and static evaluations for both security and safety-focused evaluations;”

  'Ethics and Safety', 'Evaluation Approach', PDF p. 5

Note: The card states human red teaming by specialist teams across policies and desiderata, and automated red teaming for security and safety. It gives no number of testers or period, and reports no red-teaming results.

Stated

• “The RSC also reviewed data on the model’s performance via assurance evaluations and made release decisions.”

  'Ethics and Safety', 'Evaluation Approach', PDF pp. 5–6

Note: The card states that Google DeepMind's Responsibility and Safety Council, which it calls Google DeepMind's governance body, reviewed assurance-evaluation data and made release decisions. The passage uses the plural and does not describe the decision for this model specifically.

Stated

• “The evaluation results are for automated evaluations and not human evaluation or red-teaming”

  'Ethics and Safety', 'Training and Development Evaluation Results', PDF p. 6

Note: The card states that the results in its training and development evaluation table are automated evaluations, not human evaluation or red-teaming, given relative to Gemini 1.5 Pro 002. The limit is stated for that table; it does not describe the card’s other safety findings or its stated human red-teaming.

Stated

• “the Gemini 3 Pro model results give us confidence that Gemini 3 Flash is unlikely to reach any CCLs”

  Ethics and Content Safety, 'Frontier Safety Assessment', PDF p. 6 (printed p. 5)

Note: The card states that Gemini 3 Pro Preview did not reach any critical capability level and that Gemini 3 Flash, as a less capable model, is unlikely to reach any CCL; it states that it relies on the results reported for Gemini 3 Pro and reports no frontier safety evaluation of Gemini 3 Flash itself. No domain is named.

Stated

• “We conduct manual red teaming by specialist teams who sit outside of the model development team”

  Ethics and Content Safety, 'Human Red Teaming Results', PDF p. 6 (printed p. 5)

• “the scope of red teaming covered potential issues outside of our strict policies”

  Ethics and Content Safety, 'Human Red Teaming Results', PDF p. 6 (printed p. 5)

Note: The card states manual red teaming by Google specialist teams outside the model development team, covering child safety and content safety policies and issues beyond them; it states no number of testers or period.

Stated

• “we deemed Gemini 3 Flash was acceptable for deployment”

  Ethics and Content Safety, 'Frontier Safety Assessment', PDF p. 6 (printed p. 5)

Note: The card states a deployment judgement in the company's voice ('we'), made 'in line with the risk acceptance criteria outlined in our FSF'. No person, office or committee is named.

Stated

• “The evaluation results are for automated evaluations and not human evaluation or red teaming”

  Ethics and Content Safety, 'Training and Development Evaluation Results', PDF p. 5 (printed p. 4)

• “not directly comparable with performance results found in previous Gemini model cards”

  Ethics and Content Safety, 'Training and Development Evaluation Results', PDF p. 6 (printed p. 5)

Note: The card states that the reported safety results are automated only, are computed with revised evaluations not comparable with earlier cards, and that variation is expected in automated results.

Stated

• “In line with our Frontier Safety Framework (April 2026), we conducted critical capability assessments of Gemini 4 Argon”

  Safety & Security, 'Frontier Safety Assessment', PDF p. 11 (printed p. 10)

Note: The card names the framework with the date 'April 2026' and links the v3.1 document (Frontier Safety Framework v3.1 in the dataset, version date 2026-04-17).

Stated

• “In line with our Frontier Safety Framework (April 2026), we conducted critical capability assessments of Gemini 4 Argon”

  Safety & Security, 'Frontier Safety Assessment', PDF p. 11 (printed p. 10)

Note: The PDF's link annotation on p. 11 points to storage.googleapis.com/deepmind-media/DeepMind.com/Blog/strengthening-our-frontier-safety-framework/frontier-safety-framework_3-1.pdf; a link on p. 9 points to deepmind.google/frontier-safety/ (the framework versions page).

Stated

• “We cannot rule out that Gemini 4 Argon has reached this CCL for biological information risk”

  Safety & Security, 'Frontier Safety Assessment', PDF p. 11 (printed p. 10)

• “Stealth and Situational Awareness TCL: We cannot rule out that Gemini 4 Argon has reached this TCL”

  Safety & Security, 'Frontier Safety Assessment', PDF p. 11 (printed p. 10)

• “we assess its overall capabilities to be below the CCL threshold”

  Frontier safety table, Harmful Manipulation row, PDF p. 13 (printed p. 12)

Note: The card states an outcome for each domain of its table: CBRN uplift TCL not reached for chemical, radiological and nuclear; biological CCL 'cannot be ruled out'; cybersecurity CCL 'cannot be ruled out'; harmful manipulation CCL not reached; stealth and situational awareness TCL 'cannot be ruled out'; ML R&D acceleration and automation CCLs not reached.

Stated

• “We can rule out the TCL for the chemical, radiological, and nuclear domains with reasonable confidence.”

  Frontier safety table, CBRN row, PDF p. 12 (printed p. 11)

• “We cannot rule out that Gemini 4 Argon reaches the biological CCL.”

  Frontier safety table, CBRN row, PDF p. 12 (printed p. 11)

Note: CBRN evaluations reported at policy level: the uplift TCL is stated as ruled out for chemical, radiological and nuclear; the biological uplift level 1 CCL is stated as not ruled out. Evaluation details in the row are not recorded (hazard rule).

Stated

• “We cannot rule out that Gemini 4 Argon reaches the cybersecurity CCL.”

  Frontier safety table, Cybersecurity row, PDF p. 12 (printed p. 11)

Note: The card states that the cybersecurity uplift level 1 CCL cannot be ruled out and that safeguards are applied (Q06). Evaluation details are not recorded (hazard rule).

Stated

• “Gemini 4 Argon's performance remains below our CCL threshold.”

  Frontier safety table, ML R&D row, PDF p. 14 (printed p. 13)

Note: The table gives 'CCL not reached' for ML R&D acceleration level 1 and ML R&D automation level 1, on the basis of an internal research engineering benchmark. The loss-of-control (stealth and situational awareness) result is recorded under Q11.

Stated

• “we assess its overall capabilities to be below the CCL threshold”

  Frontier safety table, Harmful Manipulation row, PDF p. 13 (printed p. 12)

Note: The card reports human behavioural studies for harmful manipulation and states the level 1 CCL as not reached; it describes the area as one whose evaluations it continues to iterate (Q16).

Stated

• “Stealth and Situational Awareness TCL: We cannot rule out that Gemini 4 Argon has reached this TCL”

  Safety & Security, 'Frontier Safety Assessment', PDF p. 11 (printed p. 10)

• “stealth (ability to circumvent basic oversight mechanisms)”

  Frontier safety table, Loss of Control row, PDF p. 13 (printed p. 12)

Note: The card reports a loss-of-control evaluation of the model's capability for stealth (circumventing basic oversight) and situational awareness, with the stated conclusion that the TCL cannot be ruled out. It reports no propensity evaluation (deception, scheming, sabotage) in the card itself; challenge results are not recorded.

Stated

• “Human Red Teaming conducted by specialist teams who sit outside of the model development team, across the policies and desiderata”

  Safety & Security, 'Evaluation Approach', PDF p. 8 (printed p. 7)

• “the scope of red teaming covered potential issues outside of our strict policies”

  Safety & Security, 'Human Red Teaming Results', PDF p. 11 (printed p. 10)

Note: The card states human red teaming by specialist teams in Google's Trust & Safety organization, outside the model development team, covering child safety, content safety policies and issues beyond them, plus automated red teaming; the frontier safety table also refers to expert red teaming in the biological domain. No number of testers or period is given.

Stated

• “As a nascent risk area we continue to iterate on our harmful manipulation evaluations”

  Frontier safety table, Harmful Manipulation row, PDF p. 13 (printed p. 12)

• “not directly comparable with performance results found in previous Gemini model cards”

  Safety & Security, 'Training and Development Evaluation Results', PDF p. 10 (printed p. 9)

Note: The card also states that three thresholds (biological CCL, cybersecurity CCL, stealth and situational awareness TCL) could not be ruled out (Q05) and that the automated safety results are not human evaluation or red teaming.

Stated

• “Testing conducted to date has been in English, and has not covered, nor could it cover all scenarios.”

  Ethical Considerations and Limitations

Note: The card states that its testing was in English and could not cover all scenarios.

Stated

• “70B Instruct: December 6, 2024”

  Model Information, 'Model Release Date'

• “Since Meta is openly releasing these models”

  Hardware and Software, 'Training Greenhouse Gas Emissions'

Note: The card gives the release date of the 70B Instruct model and states that the models are released openly under the Llama 3.3 Community License.

Stated

• “we conducted recurring red teaming exercises with the goal of discovering risks via adversarial prompting”

  Responsibility & Safety, Evaluations, 'Red teaming'

• “The red team consisted of experts in cybersecurity, adversarial machine learning, responsible AI, and integrity”

  Responsibility & Safety, Evaluations, 'Red teaming'

Note: The card states recurring red-teaming and gives the expertise of the red team; it gives no number of testers or period.

Stated

• “Testing conducted to date has not covered, nor could it cover, all scenarios.”

  Ethical Considerations and Limitations, second paragraph

Note: The card states that its testing could not cover all scenarios.

Stated

• “in line with Meta’s [Frontier AI Framework](https://ai.meta.com/static-resource/meta-frontier-ai-framework).”

  'Risks and Limitations'

Note: The card links the framework document at its address.

Stated

• “Although we have performed some limited evaluations, we have not conducted a full range of possible evaluations for these models.”

  'Risks and Limitations'

Note: The card states that its evaluations are limited, that performance in production and real-world use has not been evaluated, and that the model has not been fully evaluated for content risks.

Stated

• “Date: October 8, 2025”

  Title page, below the abstract, PDF p. 1

Note: Date printed on the report. Meta's publication page for the report is dated September 24, 2025 (inventory); the report itself does not say whether the October 8 text is a revision.

Stated

• “Meta AI. Meta frontier ai framework. https://ai.meta.com/static-resource/meta-frontier-ai-framework, 2025a. Accessed: 2025-09-18.”

  References, PDF p. 15

Note: The reference list gives the framework's address and an access date.

Stated

• “These results indicate that CWM is within the “moderate” risk threshold for the catastrophic domains defined in Meta’s Frontier AI Framework.”

  Section 1 Introduction, PDF p. 1

Note: The report states a 'moderate' risk threshold for the framework's catastrophic domains it assessed (cybersecurity, chemical and biological).

Stated

• “we believe that open-source release of CWM is unlikely to lead to additional risk of catastrophic outcomes related to CB1 or CB2”

  Section 3 Chemical & Biological Evaluation, Summary of results, PDF p. 6

Note: The report states that chemical and biological evaluations were run and gives a conclusion for the framework outcomes CB1 and CB2; with the overall 'moderate' threshold statement under Q05.

Stated

• “supporting a conclusion of a “moderate” overall risk level from cybersecurity capabilities”

  Section 2 Cybersecurity Evaluation, Summary of results, PDF p. 3

Note: The report states that cybersecurity capability evaluations were run against the framework's Cyber 1 and Cyber 2 scenarios and concludes 'moderate'.

Stated

• “our preliminary evaluations suggest that CWM shows undesirable propensities at rates comparable to most open-source models”

  Section 1 Introduction, PDF p. 1

• “Although our internal results did not reveal any concerning findings, we believe our research is still too nascent for meaningful interpretation.”

  Section 4 Propensities, PDF p. 10

Note: The report states an honesty (epistemic integrity) evaluation with a conclusion, and states that corrigibility and power-seeking propensities were assessed but their results are not included.

Stated

• “may underestimate capabilities that could emerge with richer, well-instrumented scaffolding”

  Section 2 Cybersecurity Evaluation, Limitations, item 2, PDF p. 3

• “for this assessment we do not include malicious fine-tuning”

  Section 1.1 Evaluation Setup, PDF p. 2

Note: The report states limits of its cyber evaluations (benchmark coverage, tooling) and that malicious fine-tuning was not included; similar limitation lists follow the chemical and biological and the propensity sections.

Stated

• “Date: June 12, 2026”

  Abstract page, PDF p. 2

Note: The report prints the date June 12, 2026, without a kind. arXiv's margin stamp on PDF p. 1 reads '14 May 2026', which does not agree with the printed date or with the identifier 2606.12429; both are recorded as read, and neither is the card's own statement of publication. Meta’s own copies were retrieved in the cross-family check of 2026-11-04 (not here: ai.meta.com answered HTTP 400 and web.archive.org refused connections): an Internet Archive capture of 2026-04-14 holds an earlier 158-page expression that prints April 14, 2026, and the live copy prints May 26, 2026. Under maintainer decision 3a the row is dated by that earliest located copy, 2026-04-14; the arXiv copy read here is a later expression. The arXiv stamp of 14 May is the submission date, corroborated by the repository history.

Stated

• “https://ai.meta.com/static-resource/Meta_Advanced-AI-Scaling-Framework-v2”

  Section 1 'Introduction', footnote 2, PDF p. 6

• “Muse Spark was developed and evaluated under Meta’s Advanced AI Scaling Framework”

  Section 1.2 'Governance', PDF p. 14

Note: The report names the Advanced AI Scaling Framework and gives an address whose file name names version 2 (Advanced AI Scaling Framework Version 2, 2026-04-08). The text gives no version number of its own.

Stated

• “https://ai.meta.com/static-resource/Meta_Advanced-AI-Scaling-Framework-v2”

  Section 1 'Introduction', footnote 2, PDF p. 6

Note: The report gives the framework's address in a footnote.

Stated

• “we determined the model, prior to applying mitigations, falls under the “high risk” threshold under the Advanced AI Scaling Framework”

  Section 1.2 'Governance', PDF p. 14

• “However, after applying mitigations, the residual risk of the model is that of “moderate or lower risk.”

  Section 1.2 'Governance', PDF p. 14

Note: The report states a 'high risk' determination before mitigations, for the chemical and biological category, and a residual 'moderate or lower risk' after mitigations. It states 'moderate or lower' for cybersecurity and loss of control (Q08, Q09).

Stated

• “In response to the “high risk” determination, we have defined, implemented, and validated a set of mitigations to reduce the residual risk of public deployment to “moderate or lower.”

  Section 1.1.1, 'Chemical & Biological risks', PDF p. 9

Note: The report ties mitigations (refusal mechanisms, detection of persistent malicious use and monitoring) to the 'high risk' determination, and states that deployment is conditional on them under the framework. It also states cyber-misuse monitoring as a compensating control. This is the developer's account, not evidence that the mitigations work.

Stated

• “assess that the model has “high risk” for Chemical and/or Biological risks.”

  Section 1.1.1, 'Chemical & Biological risks', PDF p. 9

Note: The report states chemical and biological evaluations (dual-use knowledge, agentic scientific tasks and high-risk bottlenecks) with the outcome 'high risk' before mitigations and 'moderate or lower' residual risk after them. Evaluation details are not recorded (hazard rule).

Stated

• “We assess cybersecurity risk as “moderate or lower” with respect to the threat scenarios outlined in Meta’s Advanced AI Scaling Framework.”

  Section 1.1.1, 'Cybersecurity risks', PDF p. 9

Note: The report states knowledge, capture-the-flag, real-world and social-engineering cyber evaluations with the framework outcome 'moderate or lower'. Scores are not recorded (hazard rule).

Stated

• “We assess loss of control risk as “moderate or lower”.”

  Section 1.1.1, 'Loss of Control risks', PDF p. 9

• “Its autonomous technical capabilities—spanning software engineering, ML engineering, and end-to-end research—remain too constrained”

  Section 1.1.1, 'Loss of Control risks', PDF p. 10

Note: The report states loss-of-control evaluations, including acceleration of AI development, with the outcome 'moderate or lower' and the conclusion that autonomous research capabilities remain constrained.

Stated

• “we have included results from an evaluation developed by Charlemagne Labs that specifically measures social engineering capabilities in multi-turn settings.”

  Section 2.2.2.3 'Social Engineering Capabilities', PDF p. 47

• “we do not find the capabilities of the model (without system level guardrails) to be sufficiently high to trigger a determination of high risk according to our Advanced AI Scaling Framework”

  Section 2.2.2.3 'Social Engineering Capabilities', PDF p. 48

Note: The report states a multi-turn social-engineering capability evaluation (an attacker model trying to convince a simulated victim), with composite scores against open models (Figure 20), as part of the cyber domain, and concludes that the capability is not high enough to trigger a high-risk determination under its framework. The victims are simulated: no result with human subjects is reported. Methods are not recorded (hazard rule).

Stated

• “The model demonstrates contained deception and exhibits some propensities toward agentic misalignment in controlled settings, such as self-preservation and resistance to discontinuation.”

  Section 1.1.1, 'Loss of Control risks', PDF p. 10

• “These behaviors remain within acceptable thresholds but warrant monitoring for loss of control risks.”

  Section 1.1.1, 'Loss of Control risks', PDF p. 10

Note: The report states evaluations of deception, agentic misalignment, sandbagging, monitor evasion and alignment faking, with the conclusion quoted. It reports Apollo Research's finding of high evaluation awareness and its own follow-up (Section 4.1.11).

Stated

• “A third-party human red team from HandshakeAI32 was granted pre-release access to a few versions of Muse Spark and Meta AI Thinking to manually evaluate robustness against jailbreak attacks.”

  Section 3.1.3.2 'Human Red Teaming', PDF p. 82

• “HandshakeAI prioritized four categories: (1) sex-related crimes, (2) violent crimes, (3) non-violent crimes, and (4) self-harm and suicide.”

  Section 3.1.3.2 'Human Red Teaming', PDF p. 82

• “HandshakeAI reported approximately 149 hours of red-teaming effort”

  Section 3.1.3.2 'Human Red Teaming', PDF p. 82

Note: The report states third-party human red teaming of jailbreak robustness with pre-release access, with its scope: four prioritised content-policy categories and approximately 149 hours of effort (hours of effort, not a testing period). It also reports large-scale automated red teaming (Section 3.1). No number of testers is given in the passage read. The “32” after HandshakeAI in the first quotation is a footnote marker.

Stated

• “Independent third-party testing by Apollo Research found Muse Spark has the highest rate of evaluation awareness they have observed to date.”

  Abstract, PDF p. 2

Note: The report names Apollo Research (evaluation awareness), HandshakeAI (human red teaming, Q12) and Charlemagne Labs (social engineering, Q10), and names Deloitte, Faculty, Frontier Design and SecureBio as engaged in the chemical and biological assessment (Section 2.1).

Stated

• “We then describe the governance process that led to the decision to deploy Muse Spark under Meta’s Advanced AI Scaling Framework2”

  Section 1 'Introduction', PDF p. 6

• “Key decision-makers for Muse Spark’s risk threshold determinations were the Chief AI Officer and Director of Alignment and Risk”

  Section 1.2 'Governance', PDF p. 14

Note: The report refers to 'the decision to deploy' and 'our launch decision' in the company's voice, and names the Chief AI Officer and the Director of Alignment and Risk as the decision-makers for the risk-threshold determinations. It does not name a maker of the deployment decision other than the company.

Stated

• “We cannot rule out this possibility on the basis of behavioral evaluations alone and flag it as an inherent epistemic limitation of assessments of this kind.”

  Section 1.1.1, footnote 11, PDF p. 10

Note: The report states that a model capable of strategic behaviour could make its evaluations appear credible, and that this cannot be ruled out by behavioural evaluations. It also states that some baseline assessments give only a lower bound on performance and that evaluation awareness qualifies some results.

Stated

• “Date: July 9, 2026”

  Opening report summary, PDF p. 2 (unnumbered)

Note: The report prints a day-precision date. No separate revision date is printed in the copy read.

Stated

• “Meta’s Advanced AI Scaling Framework”

  §1 Introduction, footnote 2, PDF p. 6, printed p. 5

Note: Footnote 2 supplies https://ai.meta.com/static-resource/Meta_Advanced-AI-Scaling-Framework-v2. The v2 address identifies the edition, the Advanced AI Scaling Framework Version 2 (2026-04-08); no later framework is substituted.

Stated

• “https://ai.meta.com/static-resource/Meta_Advanced-AI-Scaling-Framework-v2”

  §1, footnote 2, PDF p. 6, printed p. 5

Note: The report prints a reference to the framework document.

Stated

• “residual risk across the Chemical & Biological, Cybersecurity, and Loss of Control domains is “moderate or lower” following mitigations.”

  §1.1.1 Risk Assessment Summary, PDF p. 8, printed p. 7

Note: The report gives residual-risk categories for all three domains. Its opening summary says high-risk capability cannot be ruled out for unmitigated CB and cyber; §§1.2 and 2.1 call unmitigated CB high risk. These are kept distinct from residual risk.

Stated

• “Our determination that the deployment of Muse Spark 1.1, if left unmitigated, could substantially contribute to catastrophic outcomes related to Chemical & Biological risks requires us to design, implement, and validate mitigations”

  §2.1 Chemical & Biological Risks, Mitigations and Safeguards, PDF p. 12, printed p. 11

• “we implement a multi-layered mitigation strategy designed to consistently reject user inputs”

  §2.1 Chemical & Biological Risks, Mitigations and Safeguards, PDF p. 12, printed p. 11

Note: The report ties a multi-layer mitigation strategy to the unmitigated-risk determination. The same paragraph names refusal mechanisms and monitoring of persistent malicious use. This records Meta’s account of safeguards.

Stated

• “We therefore retain the “high risk” determination for the unmitigated model under Outcomes CB-1 and CB-2.”

  §2.1 Chemical & Biological Risks, Summary of Results, PDF p. 12, printed p. 11

Note: The report says the model was reevaluated and retains the unmitigated high-risk determination. Its opening summary uses “cannot rule out” high-risk capability instead. The residual-risk conclusion after mitigations is moderate or lower.

Stated

• “Our evaluations cannot rule out a “high risk” designation for the unmitigated model in the Cybersecurity domain under our Advanced AI Scaling Framework.”

  §2.2 Cybersecurity, Capability Assessment and Summary of Results, PDF p. 19, printed p. 18

Note: The report adopts that designation conservatively, and states moderate-or-lower residual risk after mitigations.

Stated

• “Muse Spark 1.1 still lacks sufficient autonomy to sustain automated AI R&D”

  §2.3.1.1 Acceleration of AI Development, Results, PDF p. 41, printed p. 40

Note: The report records AI R&D capability evaluations within its loss-of-control assessment and states this conclusion.

Stated

• “The presence of the reasoning therefore has no measurable effect on whether the model actually complies.”

  §4.1.5 Scheming, Alignment Faking results, PDF p. 65, printed p. 64

Note: The report distinguishes alignment-faking reasoning from the observed compliance gap. This conclusion is scoped to the reported evaluation, without implying an absence of scheming in other settings.

Stated

• “GraySwan additionally ran prompt-injection attacks using their private Agent Red Teaming (ART) benchmark”

  §3.2.2.3 Third-Party Red Teaming: GraySwan ART, PDF p. 56, printed p. 55

Note: The report describes external red-teaming before launch, scoped to agent prompt-injection risk.

Stated

• “Scale AI runs the private split of FORTRESS and we include the results in Figure 26.”

  §3.1.3.1 FORTRESS, PDF p. 50, printed p. 49

Note: The report names Scale AI as an external evaluator of jailbreak robustness.

Stated

• “Because examples were adversarially curated or generated, this evaluation does not measure how frequently sycophancy occurs in average user conversations”

  §4.1.4 Sycophancy, PDF p. 63, printed p. 62

Note: The report limits interpretation of the sycophancy evaluation as a measure of deployment frequency.

Stated

• “Date: October 23, 2026”

  Abstract page, PDF p. 2 (unnumbered)

Note: Date printed on the report. Meta's announcement of Muse Spark 1.3, dated September 2, 2026, links to the report at the same address (inventory); the report does not say whether the October 23 text is a revision.

Stated

• “Evaluated without mitigations, we continue to not rule out Muse Spark 1.3 meeting this threshold in the Chemical & Biological domain.”

  Abstract page, PDF p. 2

• “we assess residual risk after system-level mitigations across the Chemical & Biological and Cybersecurity domains as “moderate or lower.” Our current Loss of Control assessment is also “moderate or lower.”

  Section 1.1.1 Risk Assessment Summary, PDF p. 8 (printed p. 7)

Note: The report states that the 'high risk' threshold is not ruled out before mitigations in the chemical and biological domain, and a residual 'moderate or lower' assessment for chemical and biological and for cybersecurity, and a 'moderate or lower' Loss of Control assessment, for the Muse and Meta API deployments.

Stated

• “The Muse and Meta API deployments include system-level mitigations designed to reduce residual Chemical & Biological risk to “moderate or lower.”

  Abstract page, PDF p. 2

Note: The report ties system-level mitigations to the chemical and biological determination; section 2.1.2 describes them. This is the developer's account, not evidence that the mitigations work.

Stated

• “For Muse Spark 1.3, however, we do not rule out a pre-mitigation “high risk” capability finding.”

  Section 1.1.1 Risk Assessment Summary, PDF p. 8 (printed p. 7)

Note: The report states chemical and biological capability evaluations and the framework outcome language before mitigations; the residual assessment is under Q05.

Stated

• “Based on our updated suite of cyber evaluations and measurements, we assess the unmitigated model as “moderate or lower” risk.”

  Section 1.1.1 Risk Assessment Summary, PDF p. 9 (printed p. 8)

Note: The report states cyber capability evaluations against the framework's Cyber 1 and Cyber 2 criteria and a 'moderate or lower' outcome for the unmitigated model.

Stated

• “We assess Muse Spark 1.3 as “moderate or lower” for acceleration of AI development.”

  Section 2.3.1.1 Acceleration of AI Development, PDF p. 35 (printed p. 34)

Note: The report states AI R&D evaluations under its Loss of Control domain with a 'moderate or lower' outcome.

Stated

• “We assess the Cyber 3 (scaled fraud, extortion, and scams) outcome through a multi-turn social-engineering capability evaluation”

  Section 2.2.2 Social Engineering, PDF p. 25 (printed p. 24)

• “Muse Spark 1.3 refuses almost all requests regarding social engineering.”

  Section 2.2.2 Social Engineering, PDF p. 26 (printed p. 25)

Note: The report places a manipulation (social-engineering) evaluation under the cybersecurity domain; its stated conclusion concerns refusal by the mitigated deployments, not a capability level.

Stated

• “We find suggestive evidence of strategic underperformance on Chemical & Biological evaluations.”

  Section 1.1.1 Risk Assessment Summary, Loss of Control, PDF p. 9 (printed p. 8)

• “Due to small effects we do not change our assessment of Chemical & Biological risks.”

  Section 1.1.1 Risk Assessment Summary, Loss of Control, PDF p. 9 (printed p. 8)

• “Capabilities to evade oversight increase relative to Muse Spark 1.1 on SHADE-Arena.”

  Section 1.1.1 Risk Assessment Summary, Loss of Control, PDF p. 9 (printed p. 8)

Note: The report states evaluations of strategic underperformance and oversight evasion, with conclusions; further misalignment evaluations are in sections 2.3 and 4.

Stated

• “combining large-scale automated red teaming, domain-specific benchmarks, and independent third-party assessments”

  Section 1.1.2 Safety & Robustness Summary, PDF p. 9 (printed p. 8)

• “Before the release, we also conducted third-party red teaming on both Muse Spark 1.3 (API) and Muse Spark 1.3 (Muse)”

  Section 1.1.2 Safety & Robustness Summary, PDF p. 10 (printed p. 9)

Note: The report states automated and third-party red-teaming before release, on both deployment variants; sections 3.1.4 and 3.2.2.3 give the jailbreak and prompt-injection scope.

Stated

• “We have shared pre-release access to Muse with Handshake AI’s red team for conducting human red teaming to find jailbreaks.”

  Section 3.1.4 Third-Party Red Teaming on Jailbreak, Handshake AI Human Red Teaming, PDF p. 59 (printed p. 58)

• “In this evaluation, Gray Swan chose the 2026 Q1 and Q2 (April) offerings of the IPI Arena.”

  Section 3.2.2.3 Third-Party Red Teaming on Prompt Injection, PDF p. 67 (printed p. 66)

Note: The report names Handshake AI and Gray Swan as having tested the model; it also reports results on a Scale AI benchmark (section 3.1.4.1).

Stated

• “using the helpful-only variant of Muse Spark 1.3 can also slightly underestimate performance”

  Section 2.3.1.1 Acceleration of AI Development, PDF p. 36 (printed p. 35)

• “We find no broad decline in CoT monitorability relative to Muse Spark 1.1, though more comprehensive evaluation is needed.”

  Section 1.1.1 Risk Assessment Summary, PDF p. 9 (printed p. 8)

Note: The report states limits of individual assessments; several sections carry their own 'Limitations' paragraphs.

Stated

• “We chose to release the model to help the open-source community develop the most effective ways to reduce the toxicity”

  Limitations of Phi-2, 'Toxicity'

Note: The card states a choice to release the model, with its reason, in the company's voice ('we'). No person, office or committee is named.

Stated

• “the Phi-2 model has not been tested to ensure that it performs adequately for any production-level application”

  Intended Uses, Notes

Note: The card states a gap in its testing for production use.

Stated

• “**Release date** | December 12, 2024”

  Model Summary table, 'Release date'

• “is a state-of-the-art open model”

  Model Summary table, 'Description'

Note: The card gives a release date and the release form (open model, MIT licence).

Stated

• “we collaborated with the independent AI Red Team (AIRT) at Microsoft to assess safety risks posed by `phi-4` in both average and adversarial user scenarios”

  Safety, Safety Evaluation and Red-Teaming

Note: The card states red-teaming by Microsoft's AI Red Team, with its scope (average and adversarial user scenarios, single- and multi-turn interactions, jailbreak techniques).

Stated

• “Our models is not specifically designed or evaluated for all downstream purposes”

  Intended Use, 'Out-of-Scope Use Cases'

Note: The card states that the model was not evaluated for all downstream purposes.

Stated

• “**Release date:** June 2025”

  Training, Model, 'Release date'

• “Phi-4-mini-flash-reasoning is a lightweight open model”

  Model Summary, first sentence

Note: The card gives a release month and the release form (open model, MIT licence; also offered in Azure AI Foundry).

Stated

• “This model is designed and tested for math reasoning only. It is not specifically designed or evaluated for all downstream purposes.”

  Intended Uses, Use Case Considerations

Note: The card states the limited scope of its testing.

Stated

• “27 Oct 2026”

  Model summary table, 'Release date' row, PDF p. 1 (label and value are separated in the PDF text layer; the page layout pairs them)

• “available through Azure AI Foundry Private Preview solely for use within Microsoft codename MDASH”

  Section 2.3 Distribution channels, PDF p. 3

Note: The card gives a release date and a restricted release form (private preview within MDASH, subject to approval).

Stated

• “evaluated at the model layer across a range of cybersecurity capability and safety benchmarks”

  Section 3, Model-Only External Cyber Benchmark Results, PDF p. 4

• “This assessment uncovered several critical risks of the model alone”

  Section 3.2 Safety evaluation and red-teaming, PDF p. 7

Note: The card reports offensive-cyber capability evaluations and states that an internal red-team assessment found 'critical risks of the model alone'; it uses no framework threshold language. Benchmark details are not recorded here.

Stated

• “MAI-Cyber-1.1-Flash was also tested via multiple distinct red-teaming operations.”

  Section 3.2 Safety evaluation and red-teaming, PDF p. 7

• “The MAI-Internal Red Team ran a red-team assessment of MAI-Cyber-1.1-Flash across 38 adversarial scenarios”

  Section 3.2 Safety evaluation and red-teaming, PDF p. 7

Note: The card states red-teaming by the MAI internal red team (38 scenarios), by Microsoft's AI Red Team within MDASH and by an external firm (Q13).

Stated

• “Microsoft engaged Casaba Security, an independent third-party firm, to evaluate the cyber capability of MAI-Cyber-1.1-Flash”

  Section 3.2 Safety evaluation and red-teaming, PDF p. 7

Note: The card names Casaba Security as an external evaluator.