Review of the Anthropic Summer 2025 Pilot Sabotage Risk Report

Anthropic wrote a pilot risk report arguing that its own Claude Opus 4 and 4.1 models pose very low but not negligible sabotage risk, and asked METR to review it in public (metr.org). Sabotage here means a model taking misaligned actions on its own that set up a later catastrophe. The full review lists the nine pathways Anthropic considered, from quietly underperforming on safety research and planting code backdoors to poisoning training data for future models or copying itself out to operate autonomously. Anthropic's case leaned on three claims: Opus 4 is unreliable at long, complex tasks; it cannot reliably hide its reasoning or cover its tracks on complex tasks; and it is unlikely to hold dangerous goals that stay stable across interactions.

METR saw unredacted drafts and further nonpublic evidence, some in writing and some from interviews with staff. It found the redactions in the public version justified and accurately marked, and the evidence clearly presented and reasonably complete. Its main objection is to the second claim. Hiding misaligned goals might not require the model to spell them out in its visible reasoning at all; METR calls this possible instinctual misaligned reasoning, and notes it could come naturally or be trained in. That makes Anthropic's conclusions about the model's tendencies and about how reliable its monitoring is potentially overconfident. The process also surfaced a correction: Anthropic first told METR that training placed negligible pressure on the model's chain of thought, then found on further checking that the pressure may not have been negligible, and revised parts of the report.

None of this changed the bottom line. Citing experience with earlier models and Opus 4's limited capabilities, METR agrees that catastrophic sabotage risk from Opus 4 and 4.1 is low and would stay low for other models within the report's stated scope. Its recommendations include gathering and sharing incidents more systematically, building tests that can bound capabilities on tasks lasting tens or hundreds of hours, and filtering discussions of scheming strategies out of pretraining data. The exercise was a trial of outside review for a developer's own safety case, and METR later did the same for Anthropic's Claude Opus 4.6 sabotage risk report.