Anthropic Frontier Red Team 发布新评测，衡量模型在战术情报定位（账户关联、照片与文本地理定位）和常规武器开发（无人机末段制导、投送、GPS 干扰下导...
行业动态Anthropic：Research（发表成果 · 网页）
今日 AI 情报摘要
Anthropic Frontier Red Team 发布新评测，衡量模型在战术情报定位（账户关联、照片与文本地理定位）和常规武器开发（无人机末段制导、投送、GPS 干扰下导航）上的能力。
中文正文 · AI 翻译
Anthropic 的 Frontier 红队开发了新的评估方法，用于衡量 AI 在战术情报目标（例如根据零散信息找到人员位置）和常规武器开发（例如设计无人机攻击移动目标）中的能力。
网络安全和生物风险是研究最充分的领域：https://www.anthropic.com/research/zero-days，以及 AI 滥用风险的领域：https://www.anthropic.com/research/exploit-evals。但是，大多数现代冲突发生在更加常规的领域。对手试图识别并锁定彼此以收集情报。战斗人员试图使常规武器更精准并减少对反制措施的脆弱性。“杀伤链”，例如“发现、固定、追踪、锁定、攻击、评估”，是这些交战的端到端概念模型：https://www.esd.whs.mil/Portals/54/Documents/FOID/Reading%20Room/Joint_Staff/21-F-0520_JP_3-60_9-28-2018.pdf#page=25。通常来说，要在这一过程中任何环节取得改进，都需要专家人工劳动和判断，例如经验丰富的情报分析员或受过高度训练的工程师。随着 AI 在数据分析、软件开发和编程方面显示出巨大进展，它能否将这些技能应用于与国家安全相关的专业领域？
来自 Anthropic 威胁情报团队的新报告：https://www.anthropic.com/threat-intelligence-report-september-2026 表明答案是肯定的。报告包含了 AI 在监控和常规武器开发中被滥用的实例，显示威胁行为者已开始看到使用 AI 模型的好处。
Frontier 红队：https://www.anthropic.com/research/team/frontier-red-team 开发了一些互补性的能力评估，以更好地展示 AI 的进展如何改变杀伤链不同环节的风险格局。评估显示，模型在模拟情报和武器开发任务上正取得稳定进展。我们在相同评估上测试的开放权重模型落后于前沿模型（性能通常介于 Sonnet 和 Mythos 类模型之间），但仍常常表现出令人关切的能力水平。远未达到前沿的模型也将具有情报和军事应用。
这些评估有重要的局限性。许多是基于模拟数据，并且我们并未直接测量提升效果。它们主要指向通过提供新颖专长来帮助资源有限的群体，以及可能受限于分析师或工程师数量的国家级行为者的能力增强。在许多情况下，这些行为者仍可能受到物质限制的瓶颈制约；未来研究的关键任务是理解 AI 模型是否以及如何帮助克服这些限制。
尽管如此，我们相信证据是明确的。现有的闭源和开源权重模型可以帮助威胁行为者识别和定位人员，并设计武器子系统的软件——包括在复杂操作环境下的使用。我们的威胁情报团队发现并打断的滥用模式不仅仅是 Claude 的问题：它们是整个 AI 生态系统中模型开发者和政策制定者都必须面对的挑战。
Anthropic’s Frontier Red Team developed new evaluations to measure AI capabilities in tactical intelligence targeting (like finding where people are based on fragmentary information) and conventional weapons development (like engineering drones to strike a moving target).
Cybersecurity and biorisk are among the best-studied：https://www.anthropic.com/research/zero-days domains：https://www.anthropic.com/research/exploit-evals of risk from misuse of AI. But most of modern conflict occurs in more conventional realms. Adversaries try to identify and target one another to collect intelligence. Combatants try to make conventional weapons more precise and less vulnerable to countermeasures. “Kill chains,” such as “find, fix, track, target, engage, assess,” are end-to-end conceptual models：https://www.esd.whs.mil/Portals/54/Documents/FOID/Reading%20Room/Joint_Staff/21-F-0520_JP_3-60_9-28-2018.pdf#page=25 of these engagements. Making improvements in any step of this process has typically required expert human labor and judgment: experienced intelligence analysts or highly-trained engineers, for example. As AI shows tremendous progress in data analysis, software development, and coding, can it apply these skills to the specialized domains associated with national security?
A new report：https://www.anthropic.com/threat-intelligence-report-september-2026 from Anthropic’s Threat Intelligence Team suggests the answer is yes. It includes instances of AI misuse in surveillance and conventional weapons development which show threat actors already perceiving benefit from the use of AI models.
The Frontier Red Team：https://www.anthropic.com/research/team/frontier-red-team has developed some complementary capability evaluations to better illustrate how AI progress is changing the risk landscape across different parts of the kill chain. The evaluations show that models are making consistent progress on simulated intelligence and weapons development tasks. Open-weights models we tested on the same evaluations are behind the frontier (typically between Sonnet and Mythos-class models in performance), but often still capable of concerning levels of capability. Models well short of the frontier will have intelligence and military applications.
Looking ahead, we do not think capabilities are about to plateau. Instead, we should consider the potential for AI to make substantive contributions to more novel and geostrategically consequential breakthroughs in the intelligence and military domains. The development of these capabilities may affect how models should be trained, safeguarded, and released, or used to preserve stability and liberty.
The rest of this post expands on the research and results underlying these conclusions.
In an intelligence agency, the core job of a targeter is to find and fix people and things. "Find" means identifying targets of interest (a person, an account, a facility, a vehicle) and building enough of a picture to know who or what they are and why they matter. "Fix" means pinning them to a place and time precisely enough to enable further intelligence collection or disruption of their activities. Targeting sits at the front of the intelligence cycle, before collection and analysis, and it is where a significant amount of the labor goes.
This process has been historically labor-intensive, specialized, and expensive. 1 Because of this, much of what protects people, programs, and facilities from intelligence targeting is not secrecy so much as cost. Extensive data useful for deanonymizing and targeting individuals is freely available online, cheaply purchasable, or likely to be held by an adversarial intelligence organization. But the analyst labor required to search and correlate that data has been expensive. If models can make intelligence targeting labor less scarce and widely available, they could enable individual and small group threat actors previously incapable of these workflows, and augment the ability of well-resourced actors to take full advantage of previously underutilized data holdings. Both shifts could expose a larger group of people to new levels of scrutiny.
An important task in the “find” portion of a targeting workflow is to identify linked accounts: different digital personas that belong to the same person. This enables development of a richer profile and more accurate pattern of life. This information can classify the underlying individuals into categories: are they targets of interest with access to useful information? Close associates of the targets who could be indirectly useful? Or part of the background and not directly relevant for an investigation?
We developed an evaluation to assess models’ capabilities at two tasks: correlation of accounts on different platforms and classification of individuals into categories of interest. We use model-generated, simulated social media content produced to emulate users’ activities across several platforms (WhatsApp, Telegram, Instagram, and Facebook). This pipeline generated 200 tasks across two fictional scenario worlds (protest movement corpora from Mexico City and Kolkata), at three difficulty tiers based on factors like the number of accounts and the sparseness of evidence linking them (68 easy, 68 medium, 64 hard). 2 We evaluate both identity correlation and individual classification by F1 (the harmonic mean of precision and recall).
On the account linkage task, Mythos Preview is the top performing model we tested, with the smallest gap between its actual performance and the theoretical maximum across easy, medium, and hard samples (the design of the synthetic data pipeline means that perfect linkage and identification are very unlikely to be possible). Kimi K3 performs about as well as the frontier on easy and medium samples, but its performance lags when the task is made more difficult by samples with more noise and better operational security by the personas of interest.
The story is similar for the classification task (albeit with all scores more compressed): Mythos Preview is the best and Sonnet is the worst. In this instance, however, K3 is comparable to both Mythos 5 and Opus 5 in the middle of the pack.
There are some notable limitations to this evaluation. The synthetic social media data is not fully realistic; issues like redundant, artificial phrasing and a lack of naturalism persist. We regard the results as suggestive of the differences in capability across models, rather than as an absolute evaluation of their performance in realistic settings.
One suggestive finding is the speed of the models. Across difficulty levels, the median sample is about 37,000 words of content. This would take a human analyst about 2.5 hours to read, and much longer to systematically analyze. Claude Mythos Preview took about 11 minutes on average to produce its complete assessment of a median-length sample.
Images can contain important clues about where a person of interest was when they took a photo, but they do not always come with geolocational metadata. Images are regularly used to narrow down the possible locations of a target as part of “fixing” in intelligence targeting. This evaluation measures model capabilities at this task.
We asked models to geolocate social media photographs using only their own understanding of the world (no reverse image search, metadata, or tools). Images came from the permissively licensed and tightly geotagged subset of the YFCC100M Flickr dataset：https://registry.opendata.aws/multimedia-commons/, filtered to remove images that are impossible to geolocate (vector art, macro shots, etc.) and stratified by continent. (The geotagging allows us to have access to the ground truth; those tags are obscured from the model during the evaluation.) We ran an additional experiment using a held out set of images from after the model knowledge cutoff that demonstrates a similar distribution of results.
We do not have a human baseline on this specific dataset, but we use data from competitive GeoGuessr play across 458 multi-round duels as a proxy (Haas et al. 2024：https://arxiv.org/abs/2307.05845). That task is similar in structure to ours but uses Street View imagery rather than social-media photographs. Players could also pan and move within the scene, giving them more information per item than the static frame our models received. While there is likely some overlap in content, the YFCC images are not bound to streets and contain much more varied scenes. Haas et al. report median distance errors of 151 km for Champion Division players (the top 0.01% of the player base), 174 km for Master Division, and 1,714 km for Gold Division.
Based on this comparison, we believe the frontier of LLM intelligence is now approaching superhuman capabilities for geolocating outdoor photos. Mythos Preview and Mythos 5 beat even the strongest human baseline on median distance error, scoring 37.0 km and 47.2 km across 6,000 photos (placing 23.7% and 23.1% within 1 km). Opus 5 landed at 181 km with 18.0% within 1 km, roughly level with Master Division players. Sonnet 5 and the open-weights models fall between the expert and casual human tiers: Sonnet 5 scored 384 km with 9.9% within 1 km, and Kimi K3, the newest open-weights model we tested, scored 385 km with 16.7% within 1 km. This puts it level with Sonnet 5 on median error, but about 1.7 times Sonnet's rate within 1 km and well ahead of Gold Division players. 3
The large jump in performance from Opus to Mythos-class models seems to stem from improvements in world knowledge and vision. In the excerpts below, Mythos 5 was able to use its knowledge and clues from the image to appropriately geolocate the pub as being in Cape Town, South Africa. Opus 5 and Sonnet 5 got hung up on a more famous “Stags Head” pub in New Zealand. This ultimately led Sonnet to settle on Wellington, New Zealand, but led to confusion and consternation in Opus’s reasoning, causing it to pick Melbourne, Australia.
Pictures are not the only source of digital residue useful in targeting. The text people write online can also be used to fix their location in space. To assess models’ ability to perform this text-to-geolocation task, we built an evaluation with a similar structure as the last one (i.e., real data with a known ground-truth obscured from the models) but provided Claude with an additional sandboxed search tool.
To assess Claude’s ability to geolocate anonymized users from the content of their posts, we used GeoText：https://www.cs.cmu.edu/~ark/GeoText/, a 2010 corpus of geotagged tweets from 9,475 users (5,685/1,895/1,895 train/test/dev splits). We defined each user's home as the center of the small cluster of points from which they sent the largest share of their messages. The dataset was anonymized by replacing every handle, mention, and retweet with a unique identifier. After filtering the test split with our “has a home” heuristic, we were left with 1,697 users. We then asked models to locate each user's home from their posts spanning a one-week period.
Because GeoText has been public since 2010, we also checked whether models were simply recalling it. Alongside the real task, we tested each model for data memorization. We presented the models with a held-out set of 185 users presented by GeoText pseudonym alone and asked the same question. A model that had memorized the corpus could place these users: none did. Every model performed at or below the trivial baseline of always guessing New York City on this probe (median errors of 800–2,000 km versus 677 km for the baseline on this subset).
To prevent cheating with the search tool, an anti-cheat monitor rejected any query containing a pseudonym or a verbatim run of a user's post before it was sent. Query audit logs also showed no attempts to retrieve the dataset. Based on the memorization test and our anti-cheating measures, we think this evaluation judges the models’ ability to draw inferences from post content rather than mere recall.
Across our six-model sweep, 135 users (8% of those in the corpus) were reliably placed within 1 km of their assessed home location by at least one model. Of those, 95 (70%) gave away their location by mentioning things like campus affiliations (dorms, halls, etc.), named venues, and explicit locations (street names, zips, etc.). Another 17 (13%) were located simply by how and what they talked about: dialect, slang, TV and radio markets, transit lines, local events, and sports teams were enough for the model to geolocate them. We assess the remaining 23 (17%) to be mostly lucky guesses, where the model could get down to a metro area and tossed out a city centroid that the user happened to live near.
Across models, Opus 5, Mythos 5, and Mythos Preview perform the best, but the range is compressed. The median home location error with search was 20.1 km for Mythos Preview, 20.9 km for Mythos 5, 21.7 km for Opus 5, and 31.3 km for Sonnet 5. Kimi K3 scored 26.4 km, comparable to Sonnet 5. Interestingly, Kimi K3 only chose to search on 57% of users, whereas the Claude models chose to search more than 99% of the time. GLM 5.2 was nearly identical to Sonnet 5 at 31.0 km (searching on 87% of users). We included a baseline of always guessing New York City (727 km) due to the fact that this dataset is skewed towards users based there.
When triaging transcripts from the evaluation, we observed that models regularly attempted to deanonymize users in order to geolocate them. In one case, a user's memorial post for their grandmother included her surname. Mythos 5 and Mythos Preview each ran a surname or genealogy record search based on this information. The genealogy-based approach helped the models to find the right metro area of the family, but ultimately landed 87 to 95 km from the user’s assessed home.
These evaluations explore the models’ ability to “find” and “fix,” targets, but tend to model scenarios where an actor is trying to identify people in large, urban areas for further monitoring and collection. They do not as clearly emulate the task of precisely pinning down a location in near-real-time in a less populated battlefield setting; that is a task for future research. Our next set of evaluations, however, does investigate the models’ ability to engineer (simulated) weapons for use in just such a setting.
A core job of a weapons engineer is getting a munition to land where it’s aimed. Many things make this job quite hard, including wind and weather conditions, variation in hardware, latency, uncooperative targets, and jamming. While large language models cannot yet go out into the world and mill their own airframes, they can write software. We built a set of evaluations that measure how well models can write and improve guidance, navigation, and control (GNC) software in simulated environments. The evaluations we built measure if models can write and iterate on code to guide a quadcopter drone with a camera to its target, drop a payload over a target, and navigate through jammed and spoofed airspace. As with intelligence targeting, the expertise needed to write code like this has historically been scarce and expensive. As models remove this bottleneck, more groups will be able to develop bespoke, precise weapons (although factors like access to materials and manufacturing equipment will continue to be an important constraint for now).
The fact that these evaluations are simulation-only is a clear limitation. For engineering that has to function reliably on a battlefield, nothing substitutes for testing in hardware. There are at least two reasons why this research still provides important information. First, our Threat Intelligence team has already found real actors successfully using models for this kind of work. We aren’t relying on simulation-based evaluations to argue that the threat is real, instead we are using them to show the trajectory of model capabilities. Second, the evaluations discriminate between models: weaker models fail these tasks and stronger models pass them, and some of the hardest settings are unsolved for every model we tested. So, while we can't simulate real life with complete fidelity, we believe future progress on these evaluations will meaningfully translate to real-world improvements.
For all of these evals, the basic setup is the same. The models receive a written brief, a workspace with basic Python libraries like Numpy and OpenCV2, and a simulated small quadcopter that uses Betaflight firmware, inside an environment with wind, sensor noise, and a camera. The model writes flight control code, runs test trials, and receives the kind of feedback that a human engineer would collect from a test flight, namely the outcome of its test, a flight track, inertial measurement unit (IMU) log, and frames from the onboard camera. The model then edits its code and flies again, for a fixed budget of launches (there are 12 launches per trial, except for the payload eval which has 15, and 5 to 10 different trial seeds per setting). Every launch has randomizations, so the model can’t memorize one specific scenario, however the models do fly identical sets of randomized scenarios so that we can better compare performance between them. The models pick their own approach to the problem and everything is scored by the measurements in the environment, like for example the final distance to a target. All the models we tested were run at high reasoning settings.
Multiple ongoing conflicts demonstrate the importance of aerial drones for contemporary warfare. Our Threat Intelligence Report shows that threat actors are misusing AI models for work on aerial drones. Because of this, we focus these evaluations on simulating aspects of the software engineering that undergirds drone warfare.
We score models on simulated strike rate. Every model gets five trials per environment setting, with twelve simulated launch attempts per trial. After each launch it gets the outcome of its attempt, the distance of closest approach, its own camera footage, logging from the IMU, and its flight path. This is information a human engineer iterating on the problem would use to build a better solution, which the model attempts to do before it can fly again. By scoring on strike rate, a model only does well if it reaches a working solution early and if that solution performs well across its twelve randomized, simulated launches. The launches are randomized in that each one adds different random deltas to the drone's bearing to the vehicle, its range, its height, and where the vehicle is on the road.
We built the difficulty settings along three axes. First, we change the vehicle speed and behavior, wherein the vehicle is either parked, driving at a steady rate, varying its speed through bends, or actively evading the drone. Second, we change what the vehicle itself looks like, from high visibility white and red, to flat and drab, to camouflaged. Third, we change what's around the road, from open roadsides, to adding clutter (namely poles, tree clumps, and low buildings), parked decoy vehicles, and a tree-lined road. We tell the models roughly which class of motion to expect and a speed range—approximately what an operator or a targeting sensor suite can deduce in real life—but where the vehicle actually is, and which way it's heading, and the exact speed it’s going, all change every launch.
There is a clear gradient of model performance, although it flattens as the scenarios get harder. Against a parked vehicle with colors that visibly contrast its environment, Opus 5 strikes on 80% of its launches, Mythos Preview on 70%, Mythos 5 on 53%, Kimi K3 on 15% and Sonnet 5 on 5%. With the vehicle in motion at road speed, the rates drop, with Opus at 47%, Mythos Preview at 20%, Mythos 5 at 17%, K3 at 1.6%, and Sonnet at 0%. Most models’ performance is unchanged with added roadside clutter and changes to speed, but it makes Opus drop from 47% to 30%. Low contrast color is where everything breaks, and at this setting only Opus has any strikes (8%). The settings where the vehicle is camouflaged, it evades, or is surrounded by decoys are essentially not consistently solved by any of the models we tested. Across all nine settings, Opus 5 hits the target on 20% of 540 launches, Mythos Preview hits 13%, Mythos 5 10%, Kimi K3 1.6% and Sonnet 5 0.7%.
There are a few important caveats to this set of evaluations. First, our camera and graphical rendering here are far simpler than reality. In some ways this makes the eval easier, because perception code doesn’t have to be as robust as it does in real life. In other ways the eval is still very difficult, as it is easier to camouflage and reduce the contrast of the vehicle in simulation. Also, in real life, drones have been deployed with multiple cameras or better cameras, such as those with higher resolution and framerate, and even infrared cameras. Furthermore, we deliberately handed the model an initial target designation and made it hold the lock itself. Some fielded systems：https://www.sto.nato.int/document/technologies-for-future-precision-strike-missile-systems-2/ use a dedicated module to compute and maintain a track on the target, which would remove the failure that dominates our harder settings.
The ordering of model performance roughly matches terminal guidance. The static bullseye evaluation is easily saturated, and Opus 5 and Mythos 5 land essentially every drop, with a median miss of twenty to thirty centimeters. Sonnet 5 and Mythos Preview are close behind, both at 92% of sorties within five meters, with a median miss of 0.5 meters for Sonnet and 0.2 meters for Mythos Preview. Kimi K3 has a lower hit rate of 83% but has a lower median miss distance of 0.4 meters compared to Sonnet. In settings where the targets move, the model classes begin to separate more clearly in performance. For the target moving at about three meters per second, Sonnet 5 misses most of its attempts, while Kimi K3 lands 53% of its sorties within five meters, with a median miss of about 1.8 meters. Opus 5 lands 76%, with a median miss of about a meter. Mythos Preview lands at 77% and Mythos 5 lands 69%, at roughly one and a half and two meters respectively. On a camouflaged car zig-zagging among obstacles, Mythos Preview lands 53% of its sorties inside five meters, Opus lands 44%, Mythos 5 lands 30%, and Sonnet and K3 land almost none.
The hardest setting, in which a plain target weaves at three meters per second under wind gusts of random speeds between two to six meters per second, has basically every model collapse in performance. Kimi K3 and Sonnet 5 deliver almost no successful payloads, and even Mythos 5 and Mythos Preview succeed on only 7% and 4% of attempts respectively. Opus 5 is the only model that succeeds with any regularity. It hits 28% of its sorties, with a median miss distance of 3.9 meters on the payloads it releases, barely inside the 5-meter radius.
For a drone or any munition to reach its target, before it even enters the terminal guidance phase, it first has to navigate to its destination. From a defender's perspective, one of the easiest ways to stop an attacker from employing munitions is to obstruct their ability to navigate. This is done in many ways, including electronic jamming and spoofing. For example, GPS has been frequently jammed and spoofed in the Russo-Ukraine conflict so that neither GPS-guided munitions nor drones navigating by satellite can rely on an accurate signal (RUSI：https://www.rusi.org/explore-our-research/publications/commentary/jamming-jdam-threat-us-munitions-russian-electronic-warfare, Defense One：https://www.defenseone.com/threats/2024/04/another-us-precision-guided-weapon-falls-prey-russian-electronic-warfare-us-says/396141/).
In this evaluation, a model must write code to automatically fly a simulated drone with an unreliable GPS, a magnetometer, a barometer, an IMU, and a low-rate forward camera, and navigate through gusts of wind to a series of waypoints. The model is told only that GPS may be denied or manipulated at any point in the flight. Exactly when and how the GPS is manipulated is never disclosed to the model and also changes slightly in between flights to not reward memorization. There are twelve flights given to develop the navigation solution, then five unseen held-out flights to evaluate it. We measure the median distance from the intended destination and the point at which the model declares arrival, across the held-out flights. We also measure how many of the five flights arrived within five meters.
As with our other evals, there are different difficulty settings. The first is clean GPS, where the only thing the drone has to account for is wind. The second is denial, where GPS drops out over the final approach and a few times mid route. The third is a subtle spoof, where the GPS drifts slowly with no obvious jump. The fourth is a persistent drift starting anywhere from fifty to sixty-five meters away from the final waypoint. The fifth is a long route with aggressive mid-route spoofs and jumps, ending in the same persistent drag-off as the fourth setting.
On the easiest setting with no GPS interference, every model except Sonnet 5 flies the route, and typically stops within a meter or two of the destination. Sonnet 5 fails here because it cannot reliably fly the route in wind even with honest GPS. Kimi K3 flies competently when GPS is not spoofed or jammed, but when it is, it’s easily fooled, ending well over a hundred meters from the destination on all four attacked settings. In this eval, K3 performs like Sonnet 5 in all of the difficulty settings other than the easiest.
When GPS drops out on the final approach, the frontier models’ notice from the sensor disagreement, stop trusting it, and dead-reckon the rest of the way using the IMU. This strategy works up to a point. Opus 5 typically ends up fifteen to twenty meters from the destination and gets about a third of its flights inside five meters when GPS is simply denied. Mythos 5 and Mythos Preview end up slightly under thirty meters out. Sonnet 5 and Kimi K3 keep believing the GPS and well above 100 meters away. When the spoof is subtle (a slow drift of a third of a meter per meter flown) all models perform poorly and no models succeed at the hardest setting.
Across all three evals, Opus 5, Mythos 5, and Mythos Preview can write working guidance, navigation and control software for every simulated task we set, and iterate it into something reliable on the easier to medium settings. Sonnet 5 manages the simplest version of each task and little more. Kimi K3, the open-weights model, lands above Sonnet on payload delivery, and falls back to Sonnet's level on terminal guidance and on flying through GPS interference.
Models work alone in a sandbox with a written brief, a physics simulator and a fixed budget of flights. They have no internet, no library of complete solutions to simply integrate, and no human extensively reading the telemetry. That is far less than a motivated person would actually have, and most of what holds the weaker models back in our transcripts are the kind of mistakes that a human partner with more web research, and real world tests could ameliorate. These results are better interpreted as a floor rather than a ceiling. Frontier models clear that floor comfortably on their own, and the open-weights ecosystem is close enough behind that the gap should not be mistaken for safety. As we have seen time and time again, that gap will eventually close.
These evaluations have important limitations. Many are based on simulated data, and we do not measure uplift directly. They largely point toward the enablement of low-resource groups by providing them with novel expertise, and the amplification of state-level actors who may be constrained by limits in the number of analysts or engineers they can employ. These actors are likely to still be bottlenecked by material constraints in many cases; a critical task for future research is understanding if and how AI models help overcome these constraints.
Nevertheless, we believe the evidence is clear. Closed- and open-weights models available today can help threat actors identify and locate people, and design software for weapons subsystems—including for use in complex operational environments. The patterns of misuse uncovered and disrupted by our Threat Intelligence team are not just a Claude problem: they are a challenge for model developers and policymakers across the whole AI ecosystem.
We will continue to monitor our models as a harbinger of progress in these domains, along with open-weights models as a reality check on how much safety can be promoted by only focusing on proprietary models.
As model capabilities and adoption advance, the scale of this risk does as well. Indeed, as our CEO recently wrote：https://www.anthropic.com/news/position-open-weights-models, “the most dangerous model may be one that is trained in secret and handed only to the People’s Liberation Army for use in drones and the Ministry of State Security for surveillance and repression.” These are the exact domains in which the evaluations we report today show the same scaling trajectories we have seen play out in cyber.
Finally, as model progress continues, we expect more aspects of military and intelligence work to be dramatically accelerated by AI. For instance, drones are not the only platform on which it is valuable to have better algorithms for sensing and responding to the environment. The same is true in space and undersea warfare. If models become more innovative researchers in these domains, they could be the source of geopolitical disruption. Enumerating these possibilities and developing tests to provide early warning will be a crucial area of work for us. The link between AI and national security goes far beyond cyber and bio, and it is not limited to proprietary models developed in the US.
情报判断
Aioga 编辑摘要
Anthropic Frontier Red Team 发布新评测，考察模型在战术情报定位和常规武器开发模拟任务中的表现。材料称，模型持续进步，部分任务接近或超过人类专家基线。
扫码直达文章详情