Anthropic → US AISI

1.0.0-rc.1 · Evidence cutoff 12 September 2026

Directly documented interface

Model access

Announced agreement permitting model access; not proof access occurred.

provider → recipient. Provider → recipient; model access is distinct from evaluation.

Displayed claim → analysis (if present) → coded attributes → interface / instrument → atomic evidence → source version

Instrument and timeline

Instrument: Model-access memorandum
Bindingness: Not established from the announcement
Announced: 2024-08-29
Observed by: 2024-08-29 · upper-bound
Effective period: Unknown → Unknown
Event: Announced
Status at cutoff: unresolved/unknown
Last confirmation: 2024-08-29

Later renegotiation announcement is not mapped to a particular 2024 instrument; predecessor continuity unresolved.

Provider → recipient; model access is distinct from evaluation.
Continuity through cutoff unresolved.

Status investigation

Checked 2026-09-12; assessed as of 2026-09-12. Last confirmation does not establish uninterrupted continuity.

amendments: unknown
expiry: unknown
termination: investigated within listed sources
restrictions: investigated within listed sources
succession: see succession.json
conflicts: Later renegotiation announcement is not mapped to a particular 2024 instrument; predecessor continuity unresolved.

Search queries

"anthropic" "us-aisi" access agreement 2026 amendment termination expiry status before:2026-09-13

Analytical assessment

No reviewed analytical conclusion is attached. This does not establish independence or absence of an institutional constraint.

Coded attributes

evaluation-capacity: substantial-access-constrained

Ability to design and execute a substantive assessment independently, conditional on access.

Evaluator × evaluation exercise or programme × date. Claude 3.5 Sonnet 2024 pre-deployment exercise; assessed 2024-11-19.

Completed independent assessment plus explicit access/time limitation satisfies anchor. Not a statement of current CAISI resources.

Supporting evidence: independent-tests access-limits . Counterevidence: independent-tests

Coding applies only to stated context and date, not a permanent institutional rank.

Published rubric anchors

absent: Affirmative evidence of no ability to perform this assessment.
nascent: Initial methods/team with no completed substantive assessment.
substantial-access-constrained: Completed independent assessment with documented access or time constraints materially limiting conclusions.
substantial-durable-access: Completed assessment and enforceable/reproducible access sufficient for the task over its defined period.

Unresolved when necessary evidence is missing or adjacent anchors cannot be distinguished. No numeric conversion. Absence requires affirmative remit or operational evidence, not missing sources.

technical-control: shared-constrained

Practical ability to alter the model, its availability, or safeguards in the specified deployment. Contract clauses alone are insufficient.

Actor × exact model/deployment × period. Anthropic provision and replacement of Claude models for DoW, contrasted with deployed operational control; 2025–August 2026; assessed 2026-08-27.

Anthropic provides model artifacts and responds to feedback; DoW and cloud providers independently gate operational deployment. Existing deployed models are outside Anthropic technical alteration or shutdown. Consequential functions are divided across institutions, satisfying shared/constrained control without attributing a real-time veto.

Supporting evidence: court-model-provision court-update-gate . Counterevidence: contractual-control court-static-deployment

Coding applies only to stated context and date, not a permanent institutional rank.

Published rubric anchors

little-control: No demonstrated practical control over the specified consequential operation, with affirmative contrary evidence.
shared-constrained: Consequential controls divided among actor, host, customer or enforceable technical constraints.
substantial: Actor demonstrably retains major development, update or access controls in this environment.
dominant-lifecycle: Actor demonstrably controls development, deployment, updates and access across the specified lifecycle without a consequential independent controller.

Unresolved when necessary evidence is missing or adjacent anchors cannot be distinguished. No numeric conversion. Absence requires affirmative remit or operational evidence, not missing sources.

Atomic evidence and exact sources

NIST announced an Anthropic agreement for model access before and after release.

Source: US AISI agreements with Anthropic and OpenAI · NIST
Version: 2026-05-04; retrieved 2026-09-12
Exact locator: Opening body, paragraph beginning “Each company’s Memorandum of Understanding”
Limit: The underlying MoU terms were not reviewed.

Retrieved bytes SHA-256: 65876c874a485e03147c7467ae419c05dfeded6b31aa7223c6f2c9e83c661b56

The evaluation had a limited access and testing period.

Source: Claude 3.5 Sonnet joint testing report · US AISI / UK AISI
Version: 2024-11-19; retrieved 2026-09-12
Exact locator: Section 2.1, printed pages 1–2
Limit: Applies to this exercise; does not identify who caused the limits.

Retrieved bytes SHA-256: cee68f384975897e9ae8fd556baa9ebae9919fe08fe1e1abb363cbead7802903

The institutes each ran independent tests and worked together on methodology and interpretation of findings.

Source: Claude 3.5 Sonnet joint testing report · US AISI / UK AISI
Version: 2024-11-19; retrieved 2026-09-12
Exact locator: Section 1, printed page 1
Limit: Independence of tests does not establish durable model access.

Retrieved bytes SHA-256: cee68f384975897e9ae8fd556baa9ebae9919fe08fe1e1abb363cbead7802903

NIST says previously announced partnerships were renegotiated.

Source: New frontier evaluation agreements · NIST
Version: 2026-05-05; retrieved 2026-09-12
Exact locator: Second body paragraph
Limit: Bulletin does not identify each predecessor agreement or disclose amended terms.

Retrieved bytes SHA-256: a12961c1edd972ff6d72c45bb8b78793ef9254b57442df684e3fa14a63c77325

Anthropic could not technologically enforce contractual usage restrictions and lacked direct visibility into DoW use.

Source: Anthropic v DoW: summary judgment, document 250 · US District Court, Northern District of California
Version: 2026-08-27; retrieved 2026-09-12
Exact locator: Printed page 6
Limit: Specific deployed environment; does not imply no control over future development, contracts or provision.

Byte capture unavailable. HTTP Error 403: Forbidden Published document identity and locator remain recorded.

The court describes deployed DoW Claude models as static and beyond Anthropic technological access, alteration or shutdown.

Source: Anthropic v DoW: summary judgment, document 250 · US District Court, Northern District of California
Version: 2026-08-27; retrieved 2026-09-12
Exact locator: Printed page 17, Section II.F, first paragraph
Limit: Applies to deployed models described in this litigation, not future model provision or hosted consumer services.

Byte capture unavailable. HTTP Error 403: Forbidden Published document identity and locator remain recorded.

The court records that replacement Claude models undergo third-party cloud-provider and DoW security testing and evaluation before operational approval.

Source: Anthropic v DoW: summary judgment, document 250 · US District Court, Northern District of California
Version: 2026-08-27; retrieved 2026-09-12
Exact locator: Printed page 17, Section II.F, first paragraph
Limit: Identifies a deployment approval gate, not complete interpretability, universal evaluation sufficiency or provider substitutability.

Byte capture unavailable. HTTP Error 403: Forbidden Published document identity and locator remain recorded.

The court records Anthropic providing models to DoW or a primary defense contractor and responding to DoW evaluation feedback and requests.

Source: Anthropic v DoW: summary judgment, document 250 · US District Court, Northern District of California
Version: 2026-08-27; retrieved 2026-09-12
Exact locator: Printed page 17, Section II.F, first paragraph
Limit: Provision is distinct from control over deployed inference; future supply terms and update alternatives are unspecified.

Byte capture unavailable. HTTP Error 403: Forbidden Published document identity and locator remain recorded.

Supporting and conflicting evidence

Interface support: anthropic-access. Counterevidence: caisi-renegotiation

Substantive review

evidence/anthropic-access: approved · agent reviewer codex-research-checker · 2026-09-12

NIST separately names Anthropic and its model-access memorandum; no pairwise inference from programme membership. Underlying signed terms remain unavailable. Checked locator: Opening body, paragraph beginning “Each company’s Memorandum of Understanding”. Source version: 2026-05-04.