Anthropic has published version 2.2 of its Responsible Scaling Policy (RSP), the framework that decides when the company may — and may not — train and release more capable models. Announced on 13 October 2026 on its official blog, the update brings three structural changes: finer-grained thresholds for biosecurity and cybersecurity capabilities, an independent external review mechanism, and semiannual publication of risk evaluation results.
The timing matters. The RSP was pioneering when it appeared in 2023, an attempt at credible self-limitation for advanced AI development. Two years on, with far more capable models and competitive pressure pushing toward rapid deployment, hardening that framework — and submitting it to outside verification — carries real costs, including the risk of delaying a launch when evaluations fail to clear their thresholds.
- Graded thresholds: binary pass/fail categories give way to a five-level scale across biosecurity, cybersecurity and persuasion at scale.
- Outside scrutiny: MIT, Stanford and the University of Edinburgh will audit evaluation protocols and a sample of results twice a year.
- Published findings: the first semiannual report, due January 2027, will cover the zero-day exploit threshold Claude 3.7 is said not to cross.
What changes in RSP 2.2
The previous revision, version 2.1 from January 2026, had already added malicious code analysis as an alert threshold. Version 2.2 widens the net on two fronts.
First, capability thresholds become far more granular. Where the old policy used binary categories — a model cleared a threshold or it did not — the new version introduces a five-level scale for biosecurity, cybersecurity and persuasion at scale. Anthropic can therefore keep models with elevated abilities in low-risk areas while restricting them in domains that breach a threshold, instead of freezing a whole model over one failing category.
Second, independent external review. Anthropic has agreed with a consortium of three universities — MIT, Stanford and the University of Edinburgh — to review evaluation protocols and a sample of results twice a year. The consortium will not see model weights or training code, but will receive full protocols and results data. This is the most significant part of the announcement: it turns a self-published policy into one with genuine outside oversight.
Anthropic’s Model Context Protocol is part of the technical backdrop: the open standard for agent integration is already supported by more than 10,000 published services. Once models gain agentic capability, static evaluations — what a model answers when asked — are insufficient; behavioural testing in tool-equipped environments becomes necessary.
The cybersecurity red line
The most contested threshold in the security community concerns offensive cyber capability. RSP 2.2 sets its maximum alert level at a model’s ability to assist autonomously in developing a working zero-day exploit against widely deployed software, using only publicly available information.
The policy defines the line as the capacity to “autonomously assist in the development of a functional zero-day exploit in widely deployed software, with only publicly available information.”
Were one of Anthropic’s models to reach that capability in internal tests, the policy says it could not be deployed in any product until verified mitigations exist. Anthropic states that Claude 3.7, its most capable production model as of October 2026, does not cross the line. The results will appear in the first semiannual report, due January 2027.
There is a useful side effect: it forces rivals to take a position. If OpenAI and Google do not publish equivalent frameworks with external verification, the comparison becomes awkward in front of regulators, institutional investors and enterprise buyers asking about risk management.
Transparency as a commercial strategy
Anthropic sells mainly to enterprise customers who must satisfy their own legal and compliance teams about the models they adopt. A vendor whose safety policy is externally audited simplifies that conversation — a competitive advantage that can be monetised directly. Transparency also serves a second purpose: in Europe’s debate over high-risk AI, Anthropic is building a record of good practice ahead of any legal requirement. The EU AI Act mandates risk assessments for high-impact systems, and RSP 2.2 supplies verifiable documentation that those assessments happen systematically.
What remains unresolved: RSP 2.2 does not specifically address the risks of agentic systems deployed at scale, which differ qualitatively from those of a chatbot. That is the next front, and RSP 2.3 is the obvious place to cover it.
It is also worth noting that Anthropic is building this safety architecture while fighting OpenAI and Google for the same enterprise contracts. In a race where deployment speed carries commercial weight, every week a safety evaluation delays a launch is a week a rival can gain. Harder commitments in that environment are genuinely significant, whatever public-relations function they also serve; companies seldom act against their own short-term incentives, and when they do it deserves documenting.