Anthropic has disclosed a long-running safety lapse involving its bio-weapons filter, a safeguard meant to stop AI models from helping users extract dangerous knowledge about chemical or biological weapons.
According to a safety report, the company’s blocking biological classifiers were inactive from May 2025 through April 2026 for traffic from external contractors providing human feedback. Anthropic says the issue affected about 50,000 people and roughly 133 million chats.
What Anthropic says went wrong
The inactive system was not a small edge case. The safety report says the blocking biological classifiers were down for almost a year across all traffic from external contractors who were providing human feedback on the company’s models.
Those classifiers are designed to prevent AI models from being used to obtain dangerous information related to chemical or biological weapons. In practical terms, they are a blocking layer around a category of content that Anthropic itself treats as highly sensitive.
The disclosure is notable because Anthropic’s CEO has called AI-assisted development of chemical and biological weapons a bigger threat than cyberattacks. That makes the gap especially consequential: a company emphasizing this risk found that one of its relevant safeguards was inactive for a large contractor traffic stream.
The scale of the exposure
The affected group was large. Anthropic says the pool included about 50,000 people who ran roughly 133 million chats with the models during the period when the blocking biological classifiers were inactive.
The contractors were part of human feedback work, a process in which people interact with AI systems to help improve model behavior. The source material does not say that these chats involved dangerous requests. It says the relevant filters were not active for this traffic.
Anthropic also says the contractors were vetted only by external vendors, and that those vendors’ screening processes were often insufficient. That point matters because screening and technical blocking serve different roles. Vetting is meant to limit who gets access; classifiers are meant to limit what the model will help with once access exists.
When both systems are strong, they can support each other. When one is weak, the other becomes more important. In this case, Anthropic describes insufficient external screening at the same time that the relevant blocking classifiers were inactive.
No evidence of misuse, but a serious control failure
Anthropic says its internal investigation found no evidence of actual misuse. That is an important distinction. The report, as described, identifies exposure and inactive safeguards, not confirmed harmful use.
Still, the absence of detected misuse does not make the lapse trivial. The central issue is that a control designed for a high-risk category was not operating for nearly a year across a large volume of contractor interactions.
For AI safety, that kind of failure raises several practical questions:
- How quickly can a company detect when a safety classifier is inactive?
- Which traffic streams are covered by the same safety checks as ordinary user traffic?
- How much reliance is placed on outside vendors for contractor screening?
- What happens when human feedback workflows have different protections from other model access routes?
The source article does not provide technical details about why the classifiers were inactive. It also does not describe the exact remediation steps beyond saying that Anthropic has tightened contractor requirements. The known facts are narrower but still significant: the gap lasted from May 2025 through April 2026, affected external contractor traffic, and involved roughly 133 million chats.
Why contractor access matters
External contractors can play a meaningful role in AI development because human feedback helps shape how models respond. That work can involve many people and many interactions, which is why safety controls around contractor workflows are not merely administrative details.
In this case, Anthropic says the contractors were vetted by external vendors rather than through stronger internal processes. The company’s finding that those screening processes were often insufficient adds a governance problem to the technical one.
The issue is not only whether a model refuses a dangerous request. It is also whether the organization knows who is interacting with the model, what safeguards apply to that access, and whether those safeguards are functioning over time.
Anthropic’s response, according to the source, has been to tighten contractor requirements. That directly addresses one part of the failure: the reliance on vendor screening that the company later judged inadequate.
The broader tension around AI safety filters
The disclosure also sits beside another development: Anthropic recently loosened its classifiers on Fable 5 after researchers complained that the filters were too aggressive and blocked legitimate research.
That detail shows the difficult balance around AI safety systems. If filters are too weak or inactive, dangerous knowledge may be easier to extract. If filters are too strict, they can interfere with legitimate research that the system should allow.
The safety challenge is therefore not just adding more filters. It is making sure the right filters are active in the right places, tuned carefully, and monitored closely enough that failures are detected before they persist at scale.
Anthropic’s reported lapse is a reminder that AI safety depends on operational discipline as much as policy intent. A company can identify chemical and biological weapons as a major risk and still face basic implementation failures in the systems meant to reduce that risk.