On September 17th, Anthropic launched the Life Sciences Verification Program LSVP, which allows qualified professional teams to use the Claude model with fewer restrictions for tasks such as drug discovery, biological research, clinical development, and manufacturing. This program has already been integrated with dozens of institutions at an early stage and is now open for applications to a wider range of life science organizations in its beta version. It is not a one-time unlocking for all users, but rather a tiered access system based on identity, project, and continuous monitoring.
Generally, public versions will block some professional biological requests because the same type of knowledge can be used for both vaccines and drugs, as well as for dangerous purposes. The problem LSVP attempts to solve is: if a one-size-fits-all approach is taken to all requests, legitimate research will be frequently interrupted; if it is completely unrestricted, there is a risk of account theft, abuse by internal personnel, or loss of control over long-running proxies, which could increase risks even further. Anthropic has chosen to shift the judgment from relying solely on a single keyword to considering factors such as "who is using it, for what project, and what happened afterwards."
The official classification divides permissions into Standard Use, High-risk, and Use. Standard permissions cover most life science research and development activities as well as daily work, and are granted to teams with annual renewals; high-risk permissions are additional licenses designed for individual research projects, with renewals every six months and require more stringent review. Currently, high-risk permissions can be used for Opus 5 and Sonnet 5; the broader high-risk access for Mythos is still being coordinated with the U.S. government, and when it is released, it will be limited to a small number of entities that have undergone additional scrutiny.
Lifting real-time interception does not mean removing all security measures.
Applying institutions are required to undergo reviews for research qualifications, safety standards, and ethical oversight, and to specify the intended uses. Standard permissions allow for the use of classifiers more suitable for scientific research, while high-risk permissions can remove blockages for requests related to life sciences; however, other protections such as network security are still in place. In other words, what LSVP adjusts are the access boundaries related to biology, not granting research teams an unrestricted pass to all capabilities.
The core change in the system is offline monitoring. Officials state that severe abuse may be disguised as many seemingly unrelated requests, making it difficult to identify the complete pattern with a single real-time interception. Therefore, more legitimate activities are allowed to proceed first before analyzing cross-session behavior. To achieve this, the relevant traffic needs to be retained for 30 days. The marked data will be stored separately and cannot be used for model training, nor can it be accessed by the life science research team at Anthropic.
This arrangement reduces the likelihood of accidental interceptions during the research process, but it shifts more responsibility to the organizations. These organizations are required to define acceptable uses, manage member permissions, handle account takeovers and internal threats, and investigate and remediate issues within agreed time frames after exceptions are detected. Offline monitoring means that problems may only be discovered after the behavior has occurred, so authentication, least privilege principles, operation logs, and manual approval processes remain important. Platform monitoring cannot be considered a substitute for the laboratory's own security system.
The plan specifically mentions the risk of proxy abuse. Life science proxies may run for extended periods and may even perform retrieval, design, and analysis tasks in a multi-proxy collaborative manner. The longer the tasks, the more likely individual errors or contaminated inputs are to accumulate. Organizations need to set revocable credentials for proxies, tool whitelists, time and cost limits, and leave actions involving real experiments, procurement, or external systems to manual confirmation. Just because a model has the authority to generate recommendations does not mean that it should automatically execute each step.
There are also clear restrictions regarding privacy and compliance. The LSVP trial version cannot currently be used by organizations that wish to enable BAA; therefore, customers containing protected health information should not consider it as a HIPAA ready environment. Officials recommend that such users utilize separate, non-BAA organizations, but this does not eliminate the obligation for data classification. Project descriptions should remain at a high level of abstraction, and sensitive intellectual property should not be included in application materials; it is still up to the institutions to determine whether data can be entered into the corresponding services before actual use.
Applications are now open for the plan, but its scale, effectiveness, and risks have not yet been verified over the long term.
LSVP can currently be used through the first-party API console as well as Claude Enterprise and Team. Personal Pro and Max packages are not yet supported, and third-party platforms have not been integrated either. Claude.ai and Claude Code initially only use the preset default licenses; API and Claude Science allow for switching between different licenses. Anthropic indicates that it is expected to accommodate hundreds of organizations in the first week, with expansion planned for the following weeks, but this is a goal, not the actual coverage scale that has already been achieved.
For pharmaceutical companies, startups, and academic laboratories, the value lies in using strong models to address specialized issues that were previously difficult to tackle with classifiers. It can help organize literature, review experimental designs, generate analysis code, or coordinate open-source models. However, any biological findings still need to be verified by experts in the field. The fact that a model can interpret a paper or propose candidate solutions does not mean that these solutions have experimental validity, clinical safety, or regulatory acceptance.
This system also provides a broader governance example of AI. Many high-risk capabilities are not simply "enabled or disabled," but can be authorized based on users, organizations, projects, and time. Banking systems, network security tools, and sensitive databases have already adopted similar approaches, and generative AI is now filling this gap. The challenges lie in whether the review costs will be too high, whether monitoring can truly detect cross-session abuse, and whether small laboratories can meet the same control requirements as large pharmaceutical companies.
What Anthropic publishes is its own institutional design and early participation information, not independent audit conclusions. There is currently a lack of long-term public data regarding whether a 30-day retention period is sufficient, the false positive rate of abnormal rules, and the actual response times of institutions after receiving alerts. After the removal of high-risk permissions and biological blocking, external verification and transparent reporting will become even more important.
LSVP Therefore, it is not about "Claude lifting biosafety restrictions," but rather changing the approach from a unified real-time rejection system to one that involves verified access, tiered permissions, and continuous supervision. This leaves more room for legitimate research, but also complicates the chain of responsibility. If this method is effective, the key indicators will not just be how many institutions join, but whether research efficiency improves, whether false blockades are reduced, and whether account takeovers, internal abuses, and uncontrolled proxies are detected and managed in a timely manner. The beta version has already begun, and conclusions still await real-world usage data.
