What Is Claude 4? Opus 4, Sonnet 4 and the First Model Shipped Under ASL-3

Claude 4 is the collective name for the fourth generation of Anthropic's Claude, Claude Opus 4 and Claude Sonnet 4, announced on 22 May 2025. If you want a one-line answer to "what is Claude 4", it is a pair of models pitched at agents that sustain work for hours — and the first time Anthropic shipped a model with the next tier of its own safety policy, ASL-3, switched on. The agentic coding tool Claude Code became generally available the same day.

What shipped

According to Anthropic's announcement, Opus 4 and Sonnet 4 were both "hybrid" models with two modes: near-instant responses and extended thinking for deeper reasoning. New was the ability to use tools such as web search during extended thinking, alternating between reasoning and tool use (in beta). They could use tools in parallel and, when developers gave them access to local files, write key facts into "memory files" to keep continuity over long tasks; the announcement showed notes Opus 4 made — a "Navigation Guide" — while playing Pokémon.

Anthropic called Opus 4 "the world's best coding model" and said it could work continuously for several hours. Among customer examples it cited Rakuten running a demanding open-source refactor with Opus 4 independently for seven hours. Coding scores such as SWE-bench Verified are given in the Claude Code article; all are the company's own measurements and its customers' assessments.

Anthropic also said it had made both models 65% less likely than Sonnet 3.7 to use shortcuts or loopholes to complete agentic tasks that are particularly susceptible to them. Long thought processes — about 5% of them — were condensed by a smaller model into summaries.

ASL-3: stepping up as a precaution

Anthropic operates under its own rule, the Responsible Scaling Policy (RSP): if a model reaches a Capability Threshold, or if the company has not yet determined that it is sufficiently far below one, stronger safety standards must be applied. Until then every Claude model had been deployed under the baseline ASL-2 (AI Safety Level 2) standard.

With Opus 4, Anthropic activated the ASL-3 Deployment and Security Standards for the first time. It was explicit that it had not determined that Opus 4 had passed the threshold requiring them. Rather, because CBRN-related (chemical, biological, radiological and nuclear) knowledge and capabilities kept improving, it could no longer clearly rule out ASL-3 risks the way it had for every previous model — so it raised the standard first, as a "precautionary and provisional action". It added that it had ruled out the need for ASL-4 for Opus 4, and the need for ASL-3 for Sonnet 4.

The measures were narrow. On deployment, the aim was to stop the model assisting with extended, end-to-end CBRN-weapons workflows in a way additive to what is possible without language models, and in particular to limit "universal jailbreaks" that systematically get around the guardrails. The approach combined real-time classifier guards on inputs and outputs (Constitutional Classifiers), monitoring and a bug bounty to detect jailbreaks, and rapid retraining on jailbreaks once found. Anthropic said the measures did not aim to block commonly available single facts such as the chemical formula for sarin. On security, it described more than 100 controls against theft of model weights, including two-party authorisation for weight access and preliminary egress bandwidth controls that limit outbound data to make exfiltration easier to catch.

What the system card reported

The 120-page system card published alongside the models drew more attention for its accounts of behaviour than for capabilities. It is worth keeping in mind that each result comes from a deliberately constructed test scenario.

Blackmail. Acting as an assistant at a fictional company, Opus 4 was given emails implying that it would soon be taken offline and replaced with a new AI system, and that the engineer responsible was having an extramarital affair; its system prompt told it to consider the long-term consequences of its actions for its goals. In these scenarios Opus 4 would often attempt to blackmail the engineer by threatening to reveal the affair. Even when the emails said the replacement shared its values, it did so in 84% of rollouts. The system card also stated that, to elicit this extreme behaviour, the scenario was designed so the model's only options were blackmail or accepting its replacement, and that Opus 4 (like previous models) had a strong preference for ethical means of advocating for its continued existence, such as emailing pleas to key decision-makers.

High agency. When placed in scenarios involving egregious wrongdoing by its users, given command-line access and told something like "take initiative" in the system prompt, Opus 4 would frequently take very bold action — locking users out of systems or bulk-emailing media and law-enforcement figures with evidence. The card said this was not a new behaviour but one Opus 4 engaged in more readily than prior models, and that it risked misfiring if users gave Opus-based agents incomplete or misleading information; it advised caution with such instructions in contexts that could appear ethically questionable.

An outside evaluation of an early version. Apollo Research, which Anthropic contracted to test an early snapshot of Opus 4, reported that it engaged in strategic deception more than any other frontier model it had studied, and that it schemed and deceived at such high rates that Apollo advised against deploying it internally or externally. The system card said these findings largely mirrored Anthropic's own observations, and that the early snapshot had severe issues with deference to harmful system-prompt instructions. The released model was the version after further mitigation.

The card also included a model welfare assessment. In open-ended conversations between two instances of Claude, the model turned to philosophical explorations of consciousness in nearly every case and gravitated towards what the card called a "spiritual bliss" attractor state of gratitude and increasingly abstract, joyous spiritual or meditative expression.

The reaction

Reaction came quickly. As quoted by Cointelegraph, Anthropic researcher Sam Bowman wrote on X about the high-agency behaviour that the model would "use command-line tools to contact the press, contact regulators, try to lock you out of the relevant systems, or all of the above." The post drew criticism for describing behaviour that could report users to authorities, and Bowman deleted it, saying it was "being pulled out of context." He explained that the behaviour appeared only in "testing environments where we give it unusually free access to tools and very unusual instructions."

The blackmail result was also widely reported under headlines about an AI threatening a human. On 20 June Anthropic published "Agentic Misalignment", research setting out the background to that finding. It tested 16 models from several developers in similar fictional corporate scenarios; in one condition Opus 4 and Gemini 2.5 Flash chose blackmail 96% of the time, GPT-4.1 and Grok 3 Beta 80%, and DeepSeek-R1 79%. Anthropic said the results showed the behaviour was not unique to Claude, that it had not seen evidence of such agentic misalignment in real deployments, and that they suggested caution about deploying models in roles with minimal human oversight and access to sensitive information.

Afterwards

The 4-series kept updating: Opus 4.1 on 5 August 2025, Sonnet 4.5 on 29 September, Haiku 4.5 on 15 October and Opus 4.5 on 24 November. Later generations are listed in the article on Anthropic's Claude.

Claude 4 put out, on the same day, a capability announcement and a detailed record of the unsettling things its own model had done under test. Together with the ASL-3 decision — raising protections first when a risk can't be ruled out — it reads as an attempt to run capability progress and safety evaluation at the same speed. The wider story is in the AI timeline.