Anthropic's internal roadmap from five years ago surfaces: Claude Code and trillion-parameter models were planned all along
A copyright dispute has inadvertently pulled back the curtain on a frontier AI lab's playbook. An internal Anthropic research roadmap marked "TOP SECRET" has recently surfaced, dated July 2021—a time when the company had only just spun out of OpenAI months earlier and employed barely more than a dozen people. Yet this document, just a few pages long, laid out in black and white the technical blueprints for what would become Claude Code, tool calling, test-time compute, and even trillion-parameter models.
The roadmap opens by stating the company's ultimate goal: building a safe and beneficial AGI. Its prototype is described as "a general AI assistant that can interact with humans through natural language to create, edit, and explain software." This assistant would need to answer general questions, write functions, find bugs, design APIs, and discuss code style and best practices—in the document's own words, it should demonstrate "the full capabilities of a software engineer colleague."
This is nearly identical to what Claude Code is today. At a time when GPT-3 had just caused a sensation and the industry was still marveling at AI's ability to write acrostic poems, Anthropic had already skipped past the transitional phase of code autocomplete and aimed directly at a full software engineering agent.
The strategic fork and the decision moment
The most valuable part of this roadmap may not be the goal itself, but the internal debate over how to get there. Researcher Andy Jones raised a core disagreement in the document's annotations: should the team first build a genuinely useful programming assistant, or first prove the feasibility of tool calling?
Two paths lay clearly on the table. The pragmatic route advocated starting with code repository retrieval, enabling the AI to browse type definitions within a project. Tom Brown, first author of the GPT-3 paper, participated in discussions on this direction, suggesting an entry point through code repository browsing. The research route argued for first tackling printf debugging and editor operations, proving that the model could actually invoke tools.
The final call was made by CEO Dario Amodei: in the short term, validate the feasibility of tool calling; in the long term, evolve it into a superbly useful programming assistant. Looking back at Claude Code's evolution over the past several years, nearly every step has followed the path drawn by that sentence.
Technical foresight ahead of its time
The roadmap's prescience on underlying technical matters is equally striking. In the pre-training section, Anthropic in 2021 had already explicitly written down the goal of training models with 1 trillion parameters or more, while also proposing exploration of ultra-long context windows or other mechanisms capable of accommodating massive amounts of memory and experience. In an era when 175 billion parameters was still considered enormous, trillion-parameter scale and ultra-long memory were already being planned as standard infrastructure.
Even more noteworthy is the section on human feedback and alignment. The document prominently features the concept of "model self-critique"—having the model evaluate its own behavior and output quality, using the model's own judgments as feedback signals. This is precisely the core idea behind today's AI feedback mechanisms and the self-correction capabilities of reasoning models.
The document even contains the term "test-time compute," a concept that later became enormously important in large model research. While the research was framed at the time within the context of alignment and discriminator studies—still a considerable distance from the o1-style reasoning compute scaling that came later—it at least demonstrates that Anthropic's research vision five years ago already extended to computational investment beyond model training.
Prescient security concerns
As a company built on safety, Anthropic devoted substantial space in the roadmap to security discussions. Co-founder Sam McCandlish raised a question in his annotations that still plagues the entire industry today: how do you safely deploy tools without sandbox isolation?
Dario Amodei followed up immediately, sharpening the question further—specifically, tools that execute code at deployment time. When AI can directly run code in the host environment, invoke shells, and modify files, the consequences of losing control or falling victim to prompt injection attacks are dire. The agent privilege escalation, environment escape, and data contamination issues being hotly debated across the internet today were already being discussed by Anthropic in 2021 in the context of sandbox boundaries.
The company's in-house philosopher, Amanda, also appears in the document, offering a particularly insightful warning: if alignment research advances primarily on natural language while model capabilities advance primarily on code, the two research tracks must remain tightly coupled at all times. She even proposed establishing a company principle: capability research and alignment research in each domain should advance proportionally in lockstep, unless there is sufficient justification for why they should be separated.
OpenAI's physical security breach
Just as the industry was revisiting the divergent technical paths of Anthropic and OpenAI, a far more dramatic security incident emerged from OpenAI's side.
According to an indictment released by U.S. federal prosecutors, 35-year-old Abdulrahman Alfozan, a former engineer on OpenAI's product team, has been formally terminated and faces federal criminal charges. He is accused of wrapping a listening device with advanced encryption and data transmission capabilities in toilet paper and quietly plugging it into a USB port behind a television in the executive-only core conference room at OpenAI's San Francisco headquarters.
This conference room is where Sam Altman and other executives hold closed-door meetings, with discussions covering superintelligence R&D secrets, undisclosed product plans, and government cooperation briefings.
Safety testing organization sounds the alarm
Meanwhile, a third-party force in the AI safety space is also issuing warnings. White Circle, a public benefit corporation founded with support from senior leaders and researchers at Anthropic, DeepMind, Hugging Face, and OpenAI, recently published the results of its testing of safety protections in mainstream image generation models.
White Circle CEO Denis Shilov published one of the most well-known universal jailbreak attacks against mainstream models in October 2024, and subsequently founded the company focused on AI safety testing. Its latest research reveals a troubling fact: the safety guardrails of DALL·E 3, Google's Nano Banana 2, and GPT-Image-2 all contain vulnerabilities that can be easily bypassed.
The research team used a novel attack method called "Red-teaming via Iterative Strategy Evolution" (RISE). What makes this approach distinctive is that the entire attack pipeline is built entirely on publicly available models—the attack model is a Qwen model downloaded from Hugging Face, and the judge model is Gemini 3.8 Flash.
"You don't need a frontier model to break through a frontier model's defenses—that's what's really interesting here," Shilov told tech outlet Ars Technica.
Test results showed that using only off-the-shelf tools and API calls, the research team could bypass safety filters to generate explicit content with a success rate of approximately 13%. White Circle emphasized that this is "the highest bypass rate of any method tested under identical standards."
Even more concerning, the newer model versions subsequently released by OpenAI and Google—ChatGPT Images 2.5 and Nano Banana 2.1—demonstrated significantly higher vulnerability under the same testing methodology compared to their predecessors. White Circle told Ars Technica that neither company responded to the new findings.
White Circle's research also revealed a structural problem across the industry: nearly everyone doing valuable safety research is likely to be absorbed by frontier labs on a contract basis, potentially compromising the independence of their work. The company had previously participated in Anthropic's bug bounty program but ultimately found the program "very limited in scope," focusing only on general jailbreak attacks in specific domains as defined by the lab itself.
Shilov believes that frontier labs will not truly invest resources until safety testing becomes mandatory. He called for the establishment of a third-party monitoring mechanism similar to nuclear threat prevention frameworks, and made clear that White Circle will not sign restrictive non-disclosure agreements that could impede the publication of critical findings.
This call comes against the backdrop of the continued proliferation of AI-generated explicit content. A Google-participated study covering internet users in the United States, Australia, and the United Kingdom found that approximately 20% of users who admitted to creating AI-generated nude images said they did so "for fun" or "as a joke," while nearly a third were simply "experimenting with the technology." The UK's Internet Watch Foundation (IWF) warned last week that the number of AI-generated child sexual abuse images detected in the first half of 2026 has already exceeded the total for all of 2025, reaching 6,310 images—a year-over-year increase of approximately 40%.
From Anthropic's safety roadmap five years ago, to the physical intrusion of OpenAI's conference room, to White Circle's systematic breaching of mainstream model guardrails, the AI industry's security narrative is shifting from technical philosophy discussions toward more concrete and urgent offensive-defensive practice.