Previous goals

World-class internal red-teaming

Status: Completed October 6, 2026 and removed from the Roadmap on October 19, 2026.

Version of this goal as set on: February 19, 2026

Target date: January 1, 2027

Today, we continually test our safeguards against AI misuse by red-teaming them in a variety of ways, including via a bug bounty program that offers rewards to anyone who can identify jailbreak techniques of concern. In the future, we may need to prevent misuse from actors more sophisticated than what we can simulate with these methods. We believe we can develop a method for red-teaming our systems (likely involving significant automation) that outperforms the collective contributions from the hundreds of participants in our bug bounty. This could put us in position to continue leveling up over time and stay ahead of even state-sponsored threat actors with large teams devoted to bypassing our safeguards.

We will establish an internal jailbreak-finding method for classifier guards (focused on chemical and biological weapons) that matches or exceeds the current collective abilities of all of our bug bounty participants to find jailbreaks. We will assess this via a report that evaluates whether our internal findings are more substantial in aggregate than our bug bounty findings.

We have moderate confidence that we can achieve this goal. We have a technical path in mind that we believe should succeed if we can execute on it well, but this is a research problem and progress may be hard to predict.

Update

October 19, 2026: World-class internal red-teaming. We completed this goal ahead of its January 1, 2027 target. We built an automated red-teaming system and compared it with the bug bounties we ran against our biological weapons classifiers between April 20 and September 11, 2026. On the same 8 bounty questions and 3 generations of production classifiers, it matched or beat the best human submission in all 24 question-classifier pairs, winning 23. It did this in 24 to 48 hours, compared with weeks to months of bounty time. We judge these findings to be more substantial in aggregate than our bug bounty findings, which is the test we set. We plan to publish a more in-depth blog post on this in the future. We removed this goal from the roadmap, as we have completed it.

Upholding Claude’s Constitution

Status: Retired and removed from the roadmap on October 19, 2026, see update below for more information.

Version of this goal as set on: July 10, 2026

Target date: October 1, 2026

We recently published Claude’s Constitution, which explains the kind of entity we want Claude to be and what principles we hope its behavior will follow. We already have a number of measures in place to ensure that the way we train Claude is in line with the Constitution, but we aim to make these measures more complete and systematic:

• We will keep our public Constitution up to date and run a systematic oversight process over our training data to evaluate alignment with it.
• We will perform systematic “alignment assessments” to examine Claude’s behavioral patterns and propensities, and evaluate whether they are in line with the spirit of the Constitution. These alignment assessments will incorporate findings from our interpretability research, and will validate the effectiveness of our methods using testing exercises with intentionally misaligned models. We will publish our findings in our system cards or Risk Reports.

Keeping the Constitution up to date and running a systematic oversight process. We will ensure that the public Claude’s Constitution stays in sync with what we use internally (specifically, updating it to match the most recent trained-on Constitution within 90 days of relevant internal or external deployments of models trained on updated Constitutions). We may also use additional guidelines and other training data (such as human preference labels) that are in line with Claude’s Constitution without publishing those.

We will run an oversight process over a representative sample of our production-relevant post-training data and rewards to evaluate alignment with the Constitution, aiming to ensure that we review for any egregious inconsistencies with the Constitution in ways that Claude itself can detect and will describe this oversight process in our Risk Reports.

In the future, we will work to extend the above to all models used in high-stakes usage, including, e.g., internal-only models used for evaluation purposes. But our immediate goal is to establish the above for our mainline models.

Our long-term goal, which may require further progress after we achieve the goal listed here, is that cases where production releases of Claude egregiously violate the Constitution on real-world traffic in ways that Claude itself could detect are rare or require explicit jailbreaks.

We have moderate confidence that we can achieve this goal. We already take measures along the lines of the above, but will work to make them more consistent and systematic.

Alignment assessments. We will continue developing and maintaining our alignment assessment pipeline (see past alignment assessments in our system cards) and will ensure that it makes use of both interpretability and non-interpretability techniques. We will aim to use interpretability in particular in such a way that it produces meaningful signal beyond behavioral methods alone. We will thoroughly red-team our alignment arguments, which will likely include testing our assessment pipeline by assessing adversarially-designed misaligned model-organisms, though we may take other approaches if the analysis in our Risk Reports depends primarily on something other than auditing. We will continue to apply this auditing pipeline (a) prior to publicly deploying any model that is significantly more capable than any of the models described in our previous Risk Report; (b) within a reasonable period of time following the deployment of an internal or other non-public model that we determine could pose notable risks (in line with the threat models emphasized in our most recent Risk Report) distinct from those of public models. The latter will—at a minimum—include any internal models that we are deploying for large-scale, fully autonomous research and that are significantly more capable than our most capable such models as of the publication of our previous Risk Report.

We will be open about what we find, as feasible while protecting our IP around the development of model capabilities. For new internal deployments, the Responsible Scaling Officer can (and usually will) allow a temporary internal deployment before the audit is complete. This will be allowed as long as we complete our audit and seek another approval within a reasonable period of time. Our Risk Reports will examine these decisions.

We have high confidence we can achieve the non-interpretability parts of this goal and moderate confidence that we can achieve the interpretability parts of this goal. Our current practices are already fairly similar to the above, but it will require ongoing effort to maintain and improve their adequacy in the face of improving capabilities and to fully expand their coverage to internal deployments. We have done several limited red-teaming exercises to date, but think more would be needed in order to qualify as thoroughly red-teaming our alignment arguments, and using interpretability techniques on new frontier models are at risk of taking longer than initial release dates.

Update

October 19, 2026: Upholding Claude’s Constitution. We have kept our Constitution up to date and public. Our automated alignment assessment evaluates alignment with the Constitution as a core metric, and this is reported for all assessed models. Interpretability methods have become an important part of our overall alignment assessment methodology, and evidence produced using interpretability is featured in all recent system cards. We have red-teamed our alignment arguments using model organisms and published the findings in Risk Reports, though not as extensively as we had intended when drafting this goal. We initially ran an oversight process over a representative sample of our post-training data and rewards to check alignment with the Constitution, but found that it surfaced nothing beyond what our existing review processes were already catching, so we no longer run it routinely. A recent re-run on a sample of training data again flagged nothing. We are retiring this goal in its current form while we spend more time reflecting on which goals are most effective for alignment, and we will publish more about our thinking in the future. At a minimum, we plan to continue to update the public Constitution to match the most recent trained-on Constitution within 90 days of relevant internal or external deployments of models trained on updated Constitutions.

Version of this goal as set on: February 19, 2026

Target date: October 1, 2026

We recently published Claude’s Constitution, which explains the kind of entity we want Claude to be and what principles we hope its behavior will follow. We already have a number of measures in place to ensure that the way we train Claude is in line with the Constitution, but we aim to make these measures more complete and systematic:

• We will keep our public Constitution up to date and run a systematic oversight process over our training data to evaluate alignment with it.
• We will perform systematic “alignment assessments” to examine Claude’s behavioral patterns and propensities, and evaluate whether they are in line with the spirit of the Constitution. These alignment assessments will incorporate findings from our interpretability research, and will validate the effectiveness of our methods using testing exercises with intentionally misaligned models. We will publish our findings in our system cards or Risk Reports.

Keeping the Constitution up to date and running a systematic oversight process. We will ensure that the public Claude’s Constitution stays in sync with what we use internally (updating it within 90 days of relevant internal updates). We may also use additional guidelines and other training data (such as human preference labels) that are in line with Claude’s Constitution without publishing those.

We will run an oversight process over a representative sample of our production-relevant post-training data and rewards to evaluate alignment with the Constitution, aiming to ensure that we review for any egregious inconsistencies with the Constitution in ways that Claude itself can detect and will describe this oversight process in our Risk Reports.

In the future, we will work to extend the above to all models used in high-stakes usage, including, e.g., internal-only models used for evaluation purposes. But our immediate goal is to establish the above for our mainline models.

Our long-term goal, which may require further progress after we achieve the goal listed here, is that cases where production releases of Claude egregiously violate the Constitution on real-world traffic in ways that Claude itself could detect are rare or require explicit jailbreaks.

We have moderate confidence that we can achieve this goal. We already take measures along the lines of the above, but will work to make them more consistent and systematic.

Alignment assessments. We will continue developing and maintaining our alignment assessment pipeline (see past alignment assessments in our system cards) and will ensure that it makes use of both interpretability and non-interpretability techniques. We will aim to use interpretability in particular in such a way that it produces meaningful signal beyond behavioral methods alone. We will thoroughly red-team our alignment arguments, which will likely include testing our assessment pipeline by assessing adversarially-designed misaligned model-organisms, though we may take other approaches if the analysis in our Risk Reports depends primarily on something other than auditing. We will continue to apply this auditing pipeline (a) prior to publicly deploying any model that is significantly more capable than any of the models described in our previous Risk Report; (b) within a reasonable period of time following the deployment of an internal or other non-public model that we determine could pose notable risks (in line with the threat models emphasized in our most recent Risk Report) distinct from those of public models. The latter will—at a minimum—include any internal models that we are deploying for large-scale, fully autonomous research and that are significantly more capable than our most capable such models as of the publication of our previous Risk Report.

We will be open about what we find, as feasible while protecting our IP around the development of model capabilities. For new internal deployments, the Responsible Scaling Officer can (and usually will) allow a temporary internal deployment before the audit is complete. This will be allowed as long as we complete our audit and seek another approval within a reasonable period of time. Our Risk Reports will examine these decisions.

We have high confidence we can achieve the non-interpretability parts of this goal and moderate confidence that we can achieve the interpretability parts of this goal. Our current practices are already fairly similar to the above, but it will require ongoing effort to maintain and improve their adequacy in the face of improving capabilities and to fully expand their coverage to internal deployments. We have done several limited red-teaming exercises to date, but think more would be needed in order to qualify as thoroughly red-teaming our alignment arguments, and using interpretability techniques on new frontier models are at risk of taking longer than initial release dates.

Update

July 10, 2026: Upholding Claude's Constitution. We clarified the language on when the public Constitution must be updated. Where we previously stated we planned to update it within 90 days of relevant internal updates, we now specify that we will update it to match the most recent trained-on Constitution within 90 days of relevant internal or external deployments of models trained on updated Constitutions.

Principles for data retention

Status: Completed May 5, 2026 and removed from the Roadmap on the same date.

Version of this goal as set on: February 19, 2026

Target date: April 1, 2026

We offer many customers “zero data retention” policies so they can be confident that sensitive information is safe. Doing this for all customers, however, would greatly hamper our efforts to detect misuse attempts and continually learn from real-world usage of our systems. We would like better principles for which customers are offered which retention policies, and how we can ensure that “zero data retention” usage remains safe even as AI capabilities improve. We will complete an internal in-depth analysis of key factors and set new Frontier Safety Roadmap goals based on it.

Details: We will write a comprehensive internal report to identify how our Safeguards could be improved by updating our data retention policies. Within 6 weeks of report completion, we will publish a new goal related to this or announce that we aren’t doing so.

We are highly confident that we will complete this report, and will use it as a jumping-off point to set further goals.

Update

On March 29, 2026, we completed a comprehensive internal report to identify how our Safeguards could be improved by updating our data retention policies. By May 11, 2026, we will publish a new goal related to this or announce that we aren’t doing so.

Update

On May 5th 2026, we removed this content from the page after deciding not to set a new goal on this front. Based in part on the analysis we completed as a prior roadmap goal, we are undertaking a major project to improve our data retention practices for certain future models from a safety point of view, and we will be putting out public content explaining our thinking. We don’t feel that setting a separate date-bound goal in this context would be helpful as a forcing function for the goal, we feel that other internal processes will provide adequate forcing functions.

Launching moonshot R&D projects

Status: Completed September 30, 2026 and removed from the Roadmap on October 19, 2026.

Version of this goal as set on: May 5, 2026

Target date: September 30, 2026

Security is an ongoing and immediate priority for us, but it is also a long-term challenge where we’ll need to be creative and explore promising and incomplete ideas. This is because we may, at some point in the future, be targets of the world’s best-resourced attackers. Our moonshot R&D projects are exploring ambitious, possibly unconventional ways to achieve unprecedented levels of security.

Current ongoing projects:

• We are exploring a potential prototype of what our key workflows and infrastructure would look like (and what the productivity impact would be) if they were subject to extreme security practices. This would include simulating (at very small scale) isolated networks, “green lines” for limited remote connections, as well as commensurate physical security controls. We will complete Phase 1 - an inventory of needed components and preliminary analysis of costs and timelines - by September 30, 2026 and decide on next steps within 2 weeks of doing so. (It’s possible that we will de-prioritize this project in favor of other work, depending on what we determine in Phase 1.)
• We will develop a prototype by September 30, 2026 of provable inference, a technique for reliably, provably “signing” AI model outputs in a way that makes them attributable to a specific set of model weights. In the future, it’s possible that very sophisticated attackers will seek to infiltrate our systems and modify our models after we’ve trained them - whether to sabotage our work or co-opt our models into serving their own goals. If we could reliably and systematically verify that model outputs were coming from a specific set of model weights, we believe this threat would be significantly reduced.

Update

October 19, 2026: “Moonshot R&D” projects. We believe we broadly achieved the substantive components of the first goal. We created a prototype of what our key workflows and infrastructure would look like if they were subject to extreme security practices. We’ve explored the longest lead-time systems that needed to change to achieve air-gapped operations. Most of our effort has been spent building prototype environments in which we run workloads to test what productivity cost they’ll incur and did not focus on commensurate physical security controls, in favor of other work. We plan to deploy inference systems in isolated environments in the near future. We also created an inventory of the needed controls and as the next step, have begun putting them into production in our environments. We believe we broadly achieved the second goal in full. For the provable inference project, we built a prototype that runs on production inference and checks that outputs come from a specific set of model weights. In developing this prototype, we rolled out signing on all of our internal token traffic, which has already caught one extremely rare, benign integrity glitch. We now use the term “inference verification,” rather than “provable inference”, our original aim with this moonshot is to achieve high assurance in the integrity of our token stream, which can be achieved in several ways, and “provable inference” suggests a narrower approach than we believe is necessary.

Version of this goal as set on: April 2, 2026

Target date: May 15, 2026 and September 30, 2026

Security is an ongoing and immediate priority for us, but it is also a long-term challenge where we’ll need to be creative and explore promising and incomplete ideas. This is because we may, at some point in the future, be targets of the world’s best-resourced attackers. Our moonshot R&D projects are exploring ambitious, possibly unconventional ways to achieve unprecedented levels of security.

Current ongoing projects:

• We are exploring a potential prototype of what our key workflows and infrastructure would look like (and what the productivity impact would be) if they were subject to extreme security practices. This would include simulating (at very small scale) isolated networks, “green lines” for limited remote connections, as well as commensurate physical security controls. We will complete Phase 1 - an inventory of needed components and preliminary analysis of costs and timelines - by May 15, 2026 and decide on next steps within 2 weeks of doing so. (It’s possible that we will de-prioritize this project in favor of other work, depending on what we determine in Phase 1.)
• We will develop a prototype by September 30, 2026 of provable inference, a technique for reliably, provably “signing” AI model outputs in a way that makes them attributable to a specific set of model weights. In the future, it’s possible that very sophisticated attackers will seek to infiltrate our systems and modify our models after we’ve trained them - whether to sabotage our work or co-opt our models into serving their own goals. If we could reliably and systematically verify that model outputs were coming from a specific set of model weights, we believe this threat would be significantly reduced.

Update

On May 5th 2026, we changed our target date for Phase 1 from May 15, 2026 to September 30, 2026 because we decided to focus the relevant resources on accelerating our “Leveling up across the board” goal for the time being. While we still don’t expect to fully complete the latter goal in the next few months, we believe we will make significant progress on it, and that the safety benefits of doing so are greater than what we’d realize with our original prioritization. As for the latter goal, our initial discussions have left us skeptical that isolated networks are a feasible path forward inside the next 1-2 years, when powerful AI may be developed. We still plan to complete Phase 1, which will hopefully leave us with a more confident and grounded view.

Version of this goal as set on: February 19, 2026

Target date: April 1, 2026

Security is an ongoing and immediate priority for us, but it is also a long-term challenge where we’ll need to be creative and explore promising and incomplete ideas. This is because we may, at some point in the future, be targets of the world’s best-resourced attackers. Our moonshot R&D projects will explore ambitious, possibly unconventional ways to achieve unprecedented levels of security.

Possible moonshot projects range from a small-scale “mock secure research environment” (simulating what our key workflows and infrastructure could look like under extreme security) to exploring applications of advanced AI to security.

Details of this goal

Candidate projects include:

• An operational Mock Secure Research Environment, aiming to simulate at a very small scale what our key workflows and infrastructure would look like (and what the productivity impact would be) if they were subject to extreme security practices. This would include simulating isolated networks,“green lines” for limited remote connections, as well as commensurate physical security controls.
• An analysis of the feasibility of full adoption of confidential compute during the entire lifecycle of model R&D.
• An initial assessment of what AI-assisted security tooling (vulnerability discovery, automated patching, anomaly detection) is feasible today.
• A pilot of a continuous personnel security vetting program for high-risk roles with defined screening criteria, monitoring, and reporting requirements.
• A pilot of a system in which all interaction with our models (including internal research and training) uses APIs rather than interaction with raw model weights.
• An attempt to create adaptive behavioral models for flagging anomalous activity by users and services on our systems (flagged anomalies should adapt as our workflows and usage patterns change).
• An attempt to identify our most valuable algorithmic IP and a path to giving it additional protections.

By April 1, 2026, we will have selected and begun 1-3 project(s), including but not limited to those above, and established concrete further goals and timelines for each. Each should lead to a working answer to the key open questions within 6 months.

We are highly confident that we can complete this initial step, and will use it as a jumping-off point to set further goals.

Update

By April 2nd 2026, we had completed this goal by selecting and beginning work on two projects, detailed above.

A roadmap for policymakers

Status: As of July 8, 2026, we consider our Advanced AI Framework to fulfill this goal. We did not make any significant changes before completing this goal. On October 19, 2026, we published two new policy goals to replace it.

Version of this goal as set on: February 19, 2026

Target date: July 1, 2026

We will develop and share a set of ambitious policy proposals to effectively manage industry AI risks globally without unnecessarily limiting the benefits from AI development or slowing the AI development of democracies relative to that of autocracies.

We believe the right framework is a regulatory ladder: requirements that scale with risk. Today's frontier models require transparency and basic oversight. Yet as capabilities increase, we are moving towards a need for more rigorous external testing, stronger incident reporting, and deeper government oversight. At the most advanced capability levels and risks, the appropriate governance analogy may be closer to nuclear energy or financial regulation than to today's approach to software.

As with our advocacy for transparency frameworks as a starting point, we will develop and advocate for more advanced and risk-appropriate proposals in collaboration with a wide array of stakeholders.

Update

By July 8th 2026, we had completed this goal and are planning to set another policy goal to replace it.

Update

October 19, 2026: New policy goals. We added two new policy goals. These are a policy proposal on embedded third-party evaluators (due December 15, 2026) and a policy framework for targeting the pace of AI development (due January 15, 2027).