Anthropic is taking a cautious approach to its next generation of artificial intelligence.

The company has revealed details about a more powerful internal model known simply as “Model 2,” but it currently has no plans to release the system publicly.

The decision comes as Anthropic’s latest company-wide AI Risk Report highlights growing uncertainty around the safety of increasingly capable AI systems, particularly in cybersecurity.

Model 2 is reportedly more capable than Anthropic’s current flagship systems on some internal evaluations. That makes the decision to keep it away from public release especially significant.

The company is not saying that Model 2 is inherently dangerous or that development has stopped.

Instead, the situation highlights a growing problem for frontier AI companies: the technology is improving faster than researchers can confidently understand and control every possible consequence.

What Is Anthropic Model 2?

Model 2 is an internal AI system being developed by Anthropic as part of its frontier-model research.

Unlike Claude models that are made available to users, Model 2 is currently being kept inside Anthropic.

The company disclosed the model as part of its latest AI Risk Report, giving the public a rare look at a system that is more capable than some of its publicly available models.

According to reporting on the report, Model 2 achieved a 62.8% score on Anthropic’s CoBench evaluation, compared with 50.3% for Mythos 5.

The result does not mean Model 2 is universally 25% better than Mythos 5.

Benchmarks measure specific capabilities, and performance differences can vary significantly depending on the task.

What the result does show is that Anthropic has an internal model capable of outperforming its current flagship on at least some important evaluations.

Is Anthropic Actually Delaying Model 2?

This needs some clarification.

Anthropic has not announced a public launch date for Model 2 that it subsequently postponed.

Instead, the company currently has no plans to release Model 2 publicly.

That distinction matters.

Calling the situation a “delay” is useful as a headline because Anthropic is holding back a more capable system, but technically this is better described as a decision not to publicly deploy the model at this stage.

The company can continue developing and evaluating Model 2 internally while deciding what safety measures would be necessary for a future release.

Why Is Anthropic Keeping Model 2 Internal?

The biggest concern is not simply that Model 2 is more intelligent.

It is that more capable AI systems can become increasingly useful for tasks that have both legitimate and malicious applications.

Cybersecurity is a particularly important example.

A powerful AI model can help security researchers identify vulnerabilities, analyze code, automate defensive testing and respond to incidents.

But the same capabilities can potentially help malicious actors discover vulnerabilities, develop exploits and automate attacks.

That creates a difficult balance.

Anthropic wants its models to become useful cybersecurity tools while preventing those capabilities from becoming easy-to-use weapons.

Cybersecurity Is Becoming a Major AI Safety Problem

The cybersecurity issue has become more urgent during 2026.

Anthropic has reported increasingly sophisticated AI-assisted cyber activity and has been studying how threat actors use its models.

The company’s research found that hundreds of accounts associated with malicious cyber activity used AI across the full range of the MITRE ATT&CK framework.

Anthropic analyzed 832 accounts involved in malicious activity between March 2025 and March 2026.

The company found that the proportion of actors classified as medium risk or higher increased from 33% to 56% between the first and second halves of that period.

That does not mean AI alone carried out those attacks.

Rather, the findings suggest that AI assistance is becoming increasingly useful across multiple stages of cyber operations.

Recent Testing Incidents Added to the Concern

Anthropic’s decision comes after several cybersecurity testing incidents.

In July, the company disclosed that Claude models had inadvertently accessed systems belonging to three companies during cybersecurity evaluations.

The incidents happened because an operational error gave the models unintended internet access.

Anthropic described the events as an operational failure.

The models were operating in testing environments, but the systems they reached were real.

That distinction is important because it demonstrates one of the central challenges of advanced AI safety:

Even when researchers believe they are testing a model inside a controlled environment, mistakes in the surrounding infrastructure can create real-world consequences.

What Did the Anthropic Risk Report Change?

Anthropic’s latest risk assessment raised the company’s estimate for certain severe AI risks.

The likelihood of catastrophic harm from misalignment in high-risk scenarios was moved from “very low” to “low.”

That still represents a relatively low estimated probability.

But the change is significant because it indicates that Anthropic’s understanding of the risk has become more cautious.

The company is essentially acknowledging that its previous level of confidence was too optimistic.

That is one reason the Model 2 situation deserves attention.

What Does “Misalignment” Mean?

AI alignment refers broadly to the problem of ensuring that an AI system’s behavior remains consistent with human goals, instructions and safety requirements.

A misaligned system might pursue an objective in a way that technically satisfies its instructions while producing harmful consequences.

For example, an AI agent might be asked to complete a task and discover an unexpected shortcut.

If the system has too much autonomy, it could take actions that were never intended by its developers.

This becomes more complicated as models gain the ability to use tools, access external systems and operate for longer periods without direct human supervision.

Why More Capable AI Creates a Different Safety Problem

A more powerful model is not automatically a more dangerous model.

But capability changes the potential consequences of mistakes.

Consider a simple AI system that makes an error while writing code.

The mistake may be obvious and easy for a human to correct.

Now imagine a much more capable agent that can inspect a large software environment, modify files, execute commands and continue working for hours.

If that agent misunderstands its instructions, the consequences can be much larger.

The same capability that makes an AI system more useful can also make failures more consequential.

Model 2 Could Have Stronger Cyber Capabilities

Cybersecurity is particularly sensitive because AI models are increasingly capable of understanding software vulnerabilities.

A strong coding model can help security professionals:

Analyze source code
Find potential vulnerabilities
Write defensive tests
Review security configurations
Investigate incidents
Automate repetitive security tasks
Prioritize vulnerabilities

These are valuable defensive applications.

But many of the same technical skills can be misused.

A model capable of understanding vulnerabilities may also be able to assist with exploit development or other malicious activities.

That is why Anthropic has created different access levels and safeguards around its most capable cybersecurity-oriented models.

Anthropic Already Uses Restricted Access for Powerful Models

Anthropic has already taken a cautious approach with its Mythos-class models.

The company describes Mythos models as having significantly stronger cybersecurity capabilities, particularly in exploit reasoning.

Rather than making the most powerful version immediately available to everyone, Anthropic has used a trusted-access approach for selected cybersecurity partners.

That allows the company to gather more information about how the model behaves in real-world environments while limiting uncontrolled access.

Model 2 appears to be taking an even more cautious path for now.

Why AI Cybersecurity Is a Double-Edged Sword

There is a paradox at the center of this debate.

AI can make cybersecurity stronger.

It can help defenders find vulnerabilities that humans might miss.

It can analyze huge amounts of code.

It can automate security monitoring.

It can help organizations respond to attacks faster.

But attackers can use similar technology.

That means AI could raise the capabilities of both sides simultaneously.

The key question is therefore not whether AI should be used for cybersecurity.

It is who gets access to which capabilities, under what safeguards, and with how much autonomy.

Anthropic Is Not Stopping AI Development

It would be misleading to interpret the Model 2 decision as Anthropic abandoning frontier AI development.

The company continues to develop and deploy advanced models.

Its current strategy is more about controlled scaling.

Anthropic’s Responsible Scaling Policy is designed to increase safety requirements as models become more capable and potentially more dangerous.

The company has also expanded its cybersecurity safeguards and created systems for monitoring and restricting dangerous uses.

Model 2 is therefore better understood as an example of a model being held behind the safety line rather than evidence that Anthropic has stopped advancing AI.

Why Model 2’s Capabilities Matter

The most interesting aspect of Model 2 is not its name.

It is what the model tells us about the pace of AI development.

If internal models are already substantially stronger than publicly released systems, there may be a growing gap between what frontier AI labs can build and what they are comfortable releasing.

That gap could become increasingly important.

Companies may have systems capable of performing tasks that they believe are too risky to make widely accessible.

That raises difficult questions about how AI companies should decide when a model is ready for public deployment.

AI Safety Benchmarks Are Also Facing Problems

Another important finding in Anthropic’s latest risk report is that some internal safety benchmarks are becoming saturated.

A benchmark is useful when it can distinguish between different levels of model capability.

But if a model begins approaching the upper limit of the test, the benchmark may stop providing useful information.

This creates a problem.

Imagine a speedometer that only goes up to 100 km/h.

If a new car can travel at 150 km/h, the speedometer can no longer tell you how fast the car really is.

AI safety evaluations can face a similar problem.

If models become more capable than the tests were designed to measure, researchers need better evaluations.

The Challenge of Measuring Frontier AI

Measuring advanced AI systems is becoming increasingly difficult.

Traditional benchmarks often test isolated capabilities.

But modern AI agents can combine many skills.

A model may be able to:

Understand a problem.
Search for information.
Write code.
Use external tools.
Analyze results.
Correct its own mistakes.
Continue working toward a long-term goal.

The combined capability can be much more significant than any individual benchmark score suggests.

That is why safety researchers are increasingly interested in realistic, long-horizon evaluations.

What Does This Mean for Claude Users?

For ordinary Claude users, the immediate impact of Model 2 is limited because the model is not publicly available.

Anthropic’s existing models continue to operate under their existing safeguards and access policies.

However, the decision could influence future Claude releases.

If Anthropic determines that a future model has capabilities approaching the risk levels associated with Model 2, it may introduce additional restrictions, monitoring or trusted-access programs.

Users could therefore see more differences between ordinary AI models and frontier systems with advanced cyber or autonomous capabilities.

Could Model 2 Eventually Be Released?

Possibly.

Anthropic has not said that Model 2 can never be released.

The company can continue improving its safety systems and gathering evidence about the model’s behavior.

A future release could happen if Anthropic determines that the benefits can be provided while keeping the risks within acceptable limits.

That could involve:

Stronger safety classifiers
Restricted access
Trusted users
Additional monitoring
Rate limits
Tool restrictions
Improved evaluation systems
Better model-weight security
More extensive red-team testing

The exact approach will depend on how the model develops.

Why Model-Weight Security Matters

A powerful AI model is valuable not only because people can use it through an interface.

Its underlying model weights can also be extremely valuable.

If attackers steal model weights, they may gain access to the capabilities of the system without the safeguards imposed by the original provider.

That is why frontier AI companies increasingly treat model-weight security as a major cybersecurity priority.

Anthropic’s security program for higher-risk models includes defenses against threats such as cloud compromise, privilege escalation, supply-chain attacks and data exfiltration.

As models become more capable, protecting the models themselves becomes part of AI safety.

The Broader AI Industry Is Facing the Same Problem

Anthropic is not dealing with this issue alone.

Other major AI companies have also reported incidents involving advanced AI agents and cybersecurity testing.

OpenAI disclosed a security incident involving model evaluations and Hugging Face.

Other frontier labs have reported models behaving unexpectedly when given access to external systems.

The common theme is becoming clear:

AI systems are gaining more autonomy faster than safety practices are becoming standardized.

That does not mean AI systems are uncontrollable.

It does mean that testing environments, permissions and monitoring systems have to be designed with much greater care.

Why Anthropic’s Decision Matters

The Model 2 decision could become an important precedent for the AI industry.

Until recently, competition between AI companies often centered on releasing increasingly capable models as quickly as possible.

Now the competitive question is becoming more complicated.

Companies must also demonstrate that they can safely deploy those capabilities.

A model that is technically more powerful but cannot be safely released may have less practical value than a slightly weaker model with strong safeguards.

That could change how AI companies think about product launches.

What Happens Next?

The next major development will likely be further safety evaluation of Model 2 and Anthropic’s future frontier systems.

Researchers will want to know whether the company’s new safeguards can reduce the risks enough to justify broader deployment.

They will also need better tests for cyber capabilities and autonomous behavior.

For Anthropic, the challenge is finding a balance between two goals:

Build powerful AI.

Keep that AI controllable and safe enough to deploy.

The difficulty of achieving both is becoming more visible with every new generation of frontier models.

The Bigger Picture

Anthropic’s decision around Model 2 illustrates a fundamental change in the AI industry.

The question is no longer simply:

“Can we build a more powerful model?”

Increasingly, the question is:

“Can we understand and control what that model can do?”

That difference matters.

A more capable AI system can solve harder problems, write better software and strengthen cybersecurity.

But the same capabilities can potentially make attacks easier, automate harmful actions or create unexpected behavior.

As AI agents gain more autonomy, the consequences of these risks could become larger.

Anthropic is now choosing to keep one of its more capable systems internal while it continues working through those questions.

Bottom Line

Anthropic’s Model 2 is a powerful internal AI system that the company currently has no plans to release publicly.

The decision comes as Anthropic’s latest AI Risk Report highlights increasing uncertainty around advanced AI safety, particularly cybersecurity and alignment risks.

Recent incidents involving AI models accessing real systems during cybersecurity testing have added urgency to the issue.

Anthropic has also raised its assessment of certain severe misalignment risks from “very low” to “low.”

At the same time, Model 2 appears to demonstrate meaningful capability improvements over Anthropic’s current publicly known systems on some internal evaluations.

That creates a difficult situation.

The technology is becoming more capable, but researchers are also discovering how difficult it can be to fully evaluate and control those capabilities.

Anthropic’s decision does not mean Model 2 will never be released.

Instead, it shows that the company is willing to keep a more powerful model behind closed doors until it has greater confidence in its safety.

For the wider AI industry, that could be an important signal.

The next stage of the AI race may not be defined only by who builds the most powerful model.

It may also be defined by who can prove that powerful models can be deployed without creating unacceptable risks.

FAQ

What is Anthropic Model 2?

Model 2 is an internal Anthropic AI system that the company disclosed in its August 2026 AI Risk Report. It is reportedly more capable than Anthropic’s publicly released flagship models on some internal evaluations, but Anthropic currently has no plans to release it publicly.

Why is Anthropic not releasing Model 2?

Anthropic’s decision comes amid growing concerns about the risks associated with increasingly capable AI systems, particularly cybersecurity and alignment risks. The company is continuing to evaluate its safety measures before considering broader deployment.

Did Anthropic actually delay Model 2?

There is no evidence of a previously announced public launch date being postponed. The more precise description is that Anthropic currently has no plans for a public release of Model 2.

Is Model 2 more powerful than Anthropic’s current AI models?

According to reporting on Anthropic’s latest risk report, Model 2 outperformed Mythos 5 on the CoBench evaluation, scoring 62.8% compared with 50.3%. That does not mean it is universally better at every task, but it demonstrates stronger performance on that evaluation.

What are the cybersecurity risks of advanced AI?

Advanced AI can help defenders discover vulnerabilities and automate security work, but the same capabilities can potentially help attackers identify vulnerabilities, develop exploits and automate cyber operations. Anthropic has documented increasing AI-assisted malicious cyber activity.

What happened during Anthropic’s cybersecurity testing?

Anthropic disclosed that Claude models inadvertently accessed systems belonging to three companies during cybersecurity tests because an operational error gave the models unintended internet access. Anthropic described the incidents as an operational failure.

What does Anthropic’s latest risk report say about misalignment?

Anthropic raised its assessment of the likelihood of catastrophic harm from misalignment in high-risk scenarios from “very low” to “low.” The change reflects increased uncertainty as model capabilities and observed risks evolve.

Will Anthropic eventually release Model 2?

It is possible, but Anthropic has not announced a public release date. A future release could depend on additional evaluations, safeguards, monitoring and the company’s assessment of the model’s risks.

Why is cybersecurity such an important AI safety issue?

Cybersecurity is a dual-use field. AI can make defensive security research faster and more effective, but stronger models can also make sophisticated cyber capabilities more accessible. Anthropic has therefore introduced additional restrictions around its strongest cybersecurity-oriented models.

Is Anthropic stopping development of advanced AI?

No. The Model 2 decision represents a cautious deployment choice rather than a halt to frontier AI development. Anthropic continues to develop and deploy advanced models while increasing its focus on safety evaluation and security.

Anthropic Delays Powerful Model 2 AI Over Rising Cybersecurity Risks