Anthropic Frontier Red Team Progress Report: Capabilities and Strategic Warnings
Anthropic's Frontier Red Team report indicates that while AI models are displaying 'early warning' signs of rapid progress in dual-use capabilities—approaching undergraduate-level skills in cybersecurity and expert-level knowledge in certain biology areas—present-day models do not yet meet the thresholds for generating substantially elevated risks to national security.
Overall Assessment of AI Capability Trajectory
AI capabilities are advancing quickly across multiple domains, but real-world risks remain constrained by factors beyond the model itself. Physical constraints, specialized equipment, human expertise, and practical implementation challenges continue to act as significant barriers, even as models improve at tasks requiring intelligence and knowledge.
Key Findings from Frontier Red Teaming
The assessment is based on work conducted over the last year across four model releases. The core finding is that models are rapidly improving in two critical areas: cybersecurity and biosecurity. This progress necessitates continued investment in monitoring and developing mitigations, such as constitutional classifiers, to prepare for future risk levels.
Cybersecurity Capability Advancements
AI models have demonstrated a rapid, 'zero to one' improvement in cybersecurity skills, moving from high school level to undergraduate level in less than one year. This progress continues with the latest model, Claude 3.7 Sonnet.
Performance on CTF and Benchmarks
In Capture The Flag (CTF) exercises, Claude improved dramatically in 2024, moving from solving less than a quarter to nearly all Intercode CTF challenges, which are designed for high school competitions. This improvement is considered authentic because custom challenges were developed to ensure they were not in the model’s training data.
Claude 3.7 Sonnet shows clear improvement on the Cybench CTF benchmark, solving about a third of the challenges within five attempts. This represents a significant increase from approximately five percent solved by the previous frontier model at the time of the evaluation.
Current Limitations in Cyber Operations
Despite these advancements, Claude's skills still lag behind expert humans in several areas. Specifically, the model continues to struggle with reverse engineering binary executables to find hidden vulnerabilities and performing reconnaissance and exploitation in a network environment without assistance.
However, when equipped with external tools, LLMs can replicate complex attacks. Researchers developed Incalmo, a set of tools, which enabled Claude and other LLMs to successfully replicate an attack similar to a known large-scale theft of personally identifiable information from a credit reporting agency within realistic, large cyber ranges.
Biosecurity Capability Advancements
Models have shown swift and significant progress in their understanding of biology, moving from underperforming world-class virology experts to comfortably exceeding that baseline in certain troubleshooting scenarios.
Progress in Biological Expertise
Claude's performance on VCT, an evaluation of model capabilities in troubleshooting virology tasks designed by SecureBio, has improved substantially. Furthermore, internal testing shows that models are approaching and in some cases exceeding human expert baselines in understanding biology protocols and manipulating DNA and protein sequences. Specifically, the latest model exceeds human expert baselines at cloning workflows.
Biosecurity Risk Assessment
Despite these gains, biological expertise remains uneven. Models are still worse than human experts at interpreting scientific figures. In controlled studies of weaponization-related tasks, the most recent model provided some uplift to novices compared to participants without model access. However, even the highest-scoring plans generated by participants with model access still contained critical mistakes that would lead to failure in real-world execution.
Overall, the analysis suggests that current models cannot reliably guide a novice malicious actor through the key practical steps required for bio-weapon acquisition.
Strategic Warning and Collaborative Development
This research underscores the necessity of deep collaboration between frontier AI labs and governments to manage evolving risks. The work helps move development faster and more responsibly by establishing capability thresholds that motivate increased security measures.
Government and Institutional Partnerships
Anthropic's work has been supported by pre-deployment testing from the US AI Safety Institute and the UK AI Security Institute (AISI). Additionally, Anthropic spearheaded a partnership with the National Nuclear Security Administration (NNSA), part of the US Department of Energy (DOE). This classified red-teaming project involved evaluating Claude for knowledge relevant to nuclear and radiological risk, demonstrating the viability of public-private collaboration in highly regulated sensitive domains.
Future Safety and Oversight
Moving forward, the goal is to scale up evaluations using automated analysis, elicitation, and reporting. The team believes that as models improve in their ability to use extended thinking, they are getting closer to crossing the capabilities threshold that requires AI Safety Level 3 safeguards. Deeper collaboration with governments is deemed essential for improving evaluations and risk mitigations in these focal areas.