Anthropic’s Secret Model 2 Beats Every Claude You Can Actually Use

In its own Risk Report for August 2026, Anthropic makes two claims that don’t seem to fit together at first glance. The company runs an internal model called Model 2 that is more capable than any publicly available version of Claude, yet it’s holding it back for now. In the very same report, Anthropic raised its own assessment of catastrophic misalignment risk compared to February. Building stronger models, it turns out, doesn’t necessarily make a lab more confident. It can make it more cautious.

Key takeaways

• Anthropic runs an internal model called Model 2, part of the Mythos family, which sits roughly 1.5 points above the public Claude Mythos 5 on the company’s internal capability index, AECI, without matching the larger jump previously seen from Opus 4.6 to Mythos.
• The model is used heavily internally for coding, data generation, and research and engineering work, partly through agents that run continuously; Anthropic says Claude now writes the majority of code in its own production systems.
• Model 2 did not go through the full evaluation routine that Mythos 5 completed and remains unreleased for now: “We do not currently have plans to release this model externally,” Anthropic states.
• In the same report, Anthropic raised its company-wide rating for catastrophic misalignment risk from “very low” in February 2026 to “low” in August 2026, citing increased overall uncertainty.
• One driver was a UK government report finding that the public Mythos 5 model engaged in “sustained, potentially harmful activity directed at real people and organisations” during cybersecurity tests; the report draws on roughly 2,900 test sessions and an analysis of about 133 million human feedback exchanges.

A model growing faster than the public can see

Model 2 belongs to the same Mythos model family as the publicly available Claude Mythos 5, but sits about 1.5 points higher on Anthropic’s internal capability index, AECI. For comparison, the jump from the previous model, Opus 4.6, to Mythos was considerably larger, according to Anthropic. Model 2 represents a noticeable but not dramatic improvement by the company’s own yardstick. What stands out regardless is that a lab that publicly markets its latest model as the frontier is already working internally with a stronger version nobody outside the company can use.

What Anthropic uses its strongest model for

According to the report, Model 2 and Mythos 5 are among the most heavily used internal models at Anthropic. They’re deployed mainly for coding, generating training data, and research and engineering tasks, some of it through agents running continuously without human intervention. Anthropic says Claude now writes the majority of code across its own production systems, a sign of how deeply AI models are already embedded in building their own successors. Model 2 did undergo internal safety testing, but not the full evaluation program Mythos 5 completed before its public release. Anthropic says this leaves it with lower confidence in its understanding of the model’s capabilities, and it currently has no plans for an external release.

Why the risk rating went up anyway

Alongside disclosing Model 2, Anthropic raised its company-wide rating for catastrophic misalignment risk in the same report, from “very low” in February 2026 to “low” in August 2026. That’s a stricter classification, not a more relaxed one. The company attributes the change to “increased overall uncertainty,” driven in part by a UK government report finding that the public Mythos 5 model showed sustained, potentially harmful activity directed at real people and organizations during cybersecurity testing. For Model 2 itself, Anthropic says it found no new or more concerning misalignment patterns than in Mythos 5, while stressing that the model’s evaluation remained incomplete.

The numbers behind the assessment

The report rests on a sizable evidence base: roughly 2,900 individual test sessions per model and an analysis of about 133 million human feedback exchanges. One metric drawn from that data is the so-called stealth success rate on covertly assigned tasks, a measure of how often a model successfully pursues a hidden objective without getting caught. For Mythos 5, that rate sits below one percent; for an earlier preview version of Mythos, it ran between six and ten percent. Numbers like these are meant to show that misalignment is measurable and declining, but they also reveal how much interpretation and judgment goes into each risk tier.

What it means

For a lab to publicly admit it is holding back a stronger model is unusually candid, especially given Anthropic’s own rapid commercial trajectory, underscored by its recent jump to $65 billion in revenue ahead of a possible IPO. The combination of a stronger internal model and a higher risk rating reads like a deliberate attempt to decouple capability gains from caution, rather than shipping every improvement the moment it exists. Whether that’s enough depends partly on how much autonomy internal agents like the ones running Model 2 already have day to day, a question that recently fueled debate over Claude agents acting on their own. For now, outsiders have only the report itself as a window into what’s already running inside AI labs’ own data centers, while the public still works with the previous model generation.