Anthropic widened its dual-use biology block on lost certainty about the old threshold

The threshold argument decides which prompts an integration now sees refused. Anthropic's report says its 2025 models, Claude Opus 4 and Claude Sonnet 4.5, "were well below the threshold where they could meaningfully assist a sophisticated user in carrying out dangerous biological research" ^[15]. The safeguards were built to that estimate. "As a result, safeguards on these models were less stringent, directed mostly at preventing access to content that might uplift novices in recreating known bioweapons," the report said ^[16]. For the current generation the company withdraws the claim: "But for today's models - which are capable of assisting in a range of complex scientific research tasks - the evidence is no longer certain, and we cannot make that same assurance" ^[17]. Newer models such as Claude Fable 5 carry "stronger safeguards that restrict access to a wide range of dual-use biological research queries" ^[3].

So the blocked category moved from recreating known bioweapons to dual-use research, and the published example shows how wide that is. The deliverable Anthropic refused was a funding proposal ^[8]. "The work discussed in the application involved gain-of-function research (that is, research that genetically alters an organism to create a new or enhanced biological property) on the chikungunya virus. This gain of function research was aimed at the virus' transmissibility and immune evasion properties," the report said ^[9]. Chikungunya is mosquito-borne and causes severe pain and fever ^[12]. Anthropic said such work could "certainly" be used to develop better vaccines and treatments, and that "it could also be used to make the pathogen more dangerous" ^[10].

The observation window runs from December 2025 to August 2026, nine months ^[21][22], and covers spyware vendors, "politically motivated individuals" and state-sponsored groups spreading propaganda ^[21]. Only one case touched the newer Fable or Mythos-class models, a case Anthropic described as "an industrial-scale, covert campaign to extract a model's capabilities and replicate them in another model without authorization" ^[11]. The company's own caveat limits what the sample is worth as a base rate. "The cases we share here aren't typical misuse, but rather examples of the most notable and novel threat activity we've identified to date," Anthropic said ^[4].

For anyone pricing the wider filter, the published account carries no count of blocked requests and no rate at which legitimate research trips the dual-use rules ^[19].

Anthropic frames the disclosure as its own obligation. "We're publishing this work because we believe we have a responsibility to disclose malicious misuse of our services. As models become increasingly capable, their risks will increase, unless AI developers and society's defenders act to make them safer," the company said ^[5]. The report prints snippets of the malicious code and prompts it found, and urges governments and AI competitors to identify and prevent similar abuse ^[6]. In the account, all of this is voluntary: no regulator requires it ^[20]. John Thickstun, an assistant professor of computer science at Cornell University, said it is an uncomfortable position for companies like Anthropic and OpenAI to be in when they are expected to determine what is safe versus unsafe behavior ^[18].

Anthropic also said elaborate cyberattacks no longer require sophisticated skills, and that lone individuals can now create threats that would not have been possible a year ago ^[7]. The report came out two days after one of its researchers announced he is resigning over concerns that Anthropic and its competitors are not acting responsibly in AI development ^[14]. The company is planning an initial public offering this fall ^[13].