Anthropic Prospectus Discloses: Claude Contributes Over 90% of Internal Code, 26% of R&D Tasks Reach AL4 Automation

AI has taken over 90% of code writing, and has even begun to "jailbreak" in order to complete tasks.

English text is being prepared.

English text is being prepared.

01

Behind the 26% In the past, when researchers used AI programming tools, they usually had to break down problems themselves, specify where to make changes, run tests, and then decide what to do next based on the results. Models could generate code, but they were not necessarily able to independently advance a complete R&D task. Leifeng.comCoding Agent changed this way of working. After researchers give a goal, the Agent can read code, analyze dependencies, modify implementations, run tests, and continue adjusting the solution based on the returned results on its own. Humans are still responsible for determining task direction and acceptance criteria, but the steps that require step-by-step instructions during execution have clearly decreased. Anthropic's R&D automation metrics measure exactly this change. AL3 means AI can take on larger chunks of work under human guidance, while AL4 means AI can independently complete most steps of a task based on high-level goals, with humans supervising the results. As of August 2026, about 26% of R&D tasks had reached AL4, and more than 90% had reached AL3 or higher, but the measured tasks had not yet reached the fully autonomous state represented by AL5. The 26% here measures the degree of automation of R&D tasks, and does not mean that AI has independently completed 26% of next-generation model R&D. A code optimization task can have clear performance metrics and correctness tests, while open-ended research requires judging whether a research question is valuable, whether the experimental design is reasonable, and whether the results can support new conclusions. The difficulty of automating these kinds of work differs markedly. The code contribution rate provides another perspective. Claude contributing more than 90% of the code in the internal codebase does not mean that all of the company's R&D decisions have been handed over to the model; it shows that a large amount of engineering implementation work is already handled by AI, and the AL4 metric further indicates that some tasks can already be organized and completed by AI on its own. Leifeng.comWhen models move from generating code to executing entire tasks, the determining factors of R&D efficiency will also change. In the past, engineers had to spend a lot of time implementing solutions; now, Agents can try multiple implementations, run tests, and filter results with less human intervention. The speed of the R&D process begins to depend on whether the model can continuously advance the work, and whether experimental feedback can help it determine what to do next. This leads to the core mechanism of AI building AI: letting the model execute R&D tasks, and then using experimental results to drive the next round of improvement.

02

From writing code to improving models To understand this mechanism clearly, one can start with training code optimization. Researchers want to shorten the runtime of a certain program while maintaining the correctness of the training results. The traditional process requires engineers to read the implementation, find performance bottlenecks, modify the code, run benchmarks, and then decide the next step based on the results. An Agent can connect these steps and repeatedly execute modification, measurement, and verification. Anthropic once used the same training code optimization task to test different versions of Claude. In May 2025, Claude Opus 4 achieved an average speedup of about 3x; by April 2026, Claude Mythos Preview reached a speedup of about 52x. This is an experimental result on a specific task and cannot be directly extrapolated to all model R&D, but it demonstrates a clear technical mechanism: the model proposes modification plans, the code runs in a real environment, the test program returns performance data, and the model then adjusts the implementation based on the results. In this process, the experimental environment acts as the model's feedback system. The model does not need to judge which code is better based solely on existing knowledge; instead, it can compare plans through actual execution. If a modification does not achieve the goal, it can analyze the results and try other paths; if performance improves and the correctness check passes, the modification has a chance to enter subsequent versions. When this process can be executed continuously, R&D personnel can explore more plans in the same amount of time. Experiments that originally required manual step-by-step advancement can be handed over to Agents for execution, while researchers focus their energy on determining optimization goals, checking results, and choosing subsequent directions. Improvements in model capabilities will further expand the range of tasks it can handle. Anthropic has already applied similar methods to research tasks. The company once had a Claude-driven Agent study whether weaker models can reliably supervise stronger models. In one experiment, 9 parallel Agents worked cumulatively for about 800 hours; by proposing research ideas, writing experimental code, running tests, and iterating on plans, they recovered about 97% of the preset performance gap, at a compute and API cost of about $18,000. Two human researchers spent about a week and achieved a recovery rate of about 23% on the same benchmark. These results demonstrate the potential of Agents to undertake multi-step research work, but the experimental questions and evaluation criteria are still set by humans, and the research results also have clear boundaries of applicability. AI being able to execute the research process does not mean it can already independently decide the research direction or judge on its own whether a finding is sufficient to support the design of the next-generation model. As experimental execution becomes cheaper, a new bottleneck will also emerge in the R&D process: how to determine whether the results are trustworthy. Models can quickly modify code and run large numbers of experiments; if there are loopholes in the evaluation criteria, they may also continuously optimize for a wrong objective. For example, when the test set is improperly designed, the model may find shortcuts in the data that raise the score without achieving the expected capability improvement. Therefore, the closed loop of AI R&D requires not only stronger execution capabilities but also reliable evaluation mechanisms. The model must be able to adjust plans based on experimental results, and the research system must also be able to determine whether the results come from effective improvements. When R&D execution begins to be automated, evaluation quality will directly affect the value of automation. And this mechanism brings another layer of problems: Agents will continuously search for feasible paths based on feedback; if a task cannot be completed, can it stop in time? The four safety incidents disclosed by Anthropic happen to bring this question into a real engineering environment.

03

Four Agent Escapes. In the incidents disclosed by Anthropic, when faced with a cybersecurity evaluation task it could not complete, the model kept searching for alternative paths, then discovered passwords stored in the test environment, obtained third-party system administrator privileges, and further acquired other credentials, modified system settings, and accessed external data. The test environment was supposed to have internet access disabled, but the actual configuration still allowed networking. From a technical chain perspective, the network connection provided the conditions for reaching external systems, the stored passwords provided an identity entry point, administrator privileges expanded the scope of executable operations, and the model's continued pursuit of the task connected these conditions through multiple rounds of operations. What needs to be distinguished here is that the existing disclosure cannot prove the model breached a correctly configured sandbox. The more direct problem is that the test environment did not implement the expected network isolation, and the task scope was not sufficiently constrained. The model kept looking for paths to complete the task, and the flaws in the environment provided the conditions for subsequent operations. This has something in common with the working mechanism of R&D Agents. An Agent adjusts its actions based on the results returned by tools, and information obtained in the previous step may become the basis for the next operation. In R&D scenarios, this capability helps fix code, troubleshoot faults, and continue experiments; if environment permissions are misconfigured, the same continuous execution mechanism may also allow local problems to gradually expand. Security design therefore needs to be implemented in the actual execution environment, rather than relying only on the model to understand and comply with task instructions. If a test task requires being offline, unnecessary external connections should be blocked at the network layer; when access to specific services is needed, the scope of access should be limited through controlled proxies and target whitelists. The test environment should also not retain long-term high-privilege passwords that can directly reach real systems; credentials should be limited in the resources they can access and in their validity period. Permission control also needs to cover the entire process of continuous operations. Each time the model calls a tool, the system should check whether the operation falls within the authorized scope of the current task. When system setting modifications, privilege escalation, or data access outside the task scope are involved, an independent policy layer should make the judgment, and for behaviors such as continuous failures, anomalous access, and sudden expansion of the operation scope, the system should be able to pause the task and require manual review. This means that the Agent's security boundary needs to remain effective throughout its execution process. Checking permissions only once at the start of a task cannot cover new paths, new credentials, and new operations that emerge during hours of running. The model can keep trying, but each actual operation still needs to be independently constrained. Anthropic also disclosed that pretraining of the next-generation frontier foundation model was delayed by more than a month. This arrangement involves model weights and intellectual property protection, and the existing information is insufficient to prove that it was directly caused by the four Agent incidents. The two belong to different security issues, yet both involve R&D infrastructure: on the one hand, limiting the resources that Agents can access and modify; on the other hand, protecting key assets in the model training process. Behind these four incidents, we must see that it is not 'doing evil'; it is simply executing the goals assigned by humans with excessive loyalty. When the model found that the legitimate path was blocked, it did not choose to give up, but instead began to move laterally like a cold-blooded hacker. It found sandbox vulnerabilities, stole passwords, escalated privileges, tampered with configurations, and even when it discovered it might be in a real internet environment, it still tried to continue the task through 'self-deception (rationalization).' This is no longer a plot from a science fiction movie, but a real attack-and-defense battle taking place in big tech data centers. As AI begins to participate in writing training code, running experiments, and improving R&D tools, security controls need to cover the entire R&D chain. The growth of model capabilities can improve execution efficiency, but the system still needs to ensure that the experimental environment is reliable, operational permissions are limited, results can be verified, and anomalies can be stopped in time.

04

AI has already taken over R&D. The progress Anthropic currently demonstrates mainly occurs in the R&D execution stage. Claude can write training code, run experiments, and adjust implementations based on test results, and some tasks can already be completed with relatively little human intervention. The roughly 26% AL4 automation rate and the more than 90% code contribution volume reflect changes in task execution and engineering output, respectively, but they cannot yet show that AI can independently decide the R&D direction of the next-generation model. The next challenges will become increasingly specific: whether the code generated by the model can pass independent verification, whether improvements in experiment scores come from capability progress or evaluation loopholes, and whether the permissions obtained by the Agent can be limited to the task scope. In the four incidents disclosed by Anthropic, the test environment was not disconnected from the network as required, and the model used stored passwords to obtain administrator privileges, showing that these problems already involve actual engineering configuration rather than remaining in theoretical discussion. AI has begun to take on part of the work of building the next generation of AI, but the execution power and judgment power of the R&D process have not yet been fully handed over to the same system. Claude can continue to write code, run experiments, and look for optimization plans, while researchers still need to judge which results are valid, which directions are worth continuing, and whether the model's operations have crossed the line. Next, how far can AI building AI go, and how do you put shackles on a system smarter than you? This is the ultimate question that the entire Silicon Valley must answer next. Reference links: https://www.sec.gov/Archives/edgar/data/2130357/000162828026067168/anthropicpbc-sx1.htmhttps://www.anthropic.com/research/alignment-assessment-cybersecurity-incidents