Minimize Harm, Maximize Defense - How Anthropic Navigates the Offense Defense Divide

The talk opens with the dual-use problem that has long surrounded security tools such as mass scanners, Metasploit, Cobalt Strike and code analysis suites. The speaker, a technical policy manager for cyber safeguards at Anthropic, argues that AI sharpens this tension because capabilities arrive faster, at larger scale and to more people. Open-weight models cannot be gated, monitored or updated once released, so he frames hosted frontier models as a window in which defenders can get ahead.

The middle section walks through the written cyber constitution and its buckets: benign use that should never be blocked, low-risk dual use that is defensively biased but still blocked as a deliberate margin, high-risk dual use such as complex exploit building from binaries, and prohibited uses like self-replicating code, supply chain attacks and scaled data exfiltration. Since intent cannot be read from one exchange, Anthropic uses identity-based programs such as cyber verification and Project Glasswing as a proxy. The Fable 5 margin was set wider than for earlier models, accepting more false positives. Jailbreaks are judged with a new severity framework loosely modeled on CVSS, scoring capability gain, breadth, ease of weaponization and discoverability.

The closing part admits current shortcomings: legitimate agentic work gets blocked, independent researchers have the hardest path to access, four buckets flatten useful context, and refusal messages are vague. The speaker says the categories and thresholds will change, and invites practitioners to report blocked cases and help shape a shared industry standard.