Anthropic has linked potential investment in Australian frontier AI research and infrastructure to the establishment of a clear legal framework for model training, telling federal parliamentarians that training-scale investment would be more durable than investment in inference capacity alone.
In written responses to questions from members of the Joint Select Committee on Artificial Intelligence, the company said it was confident it would bring existing researchers to Australia and hire researchers locally if it could undertake model training in the country.
However, Anthropic did not provide estimates for capital expenditure, staffing levels, computing capacity or power requirements, nor did it identify potential locations for infrastructure investment.
The responses come amid debate over the copyright rules that would apply to training advanced AI models in Australia, and the extent to which the country could attract research capabilities and infrastructure investment by permitting domestic training.
Anthropic claimed its investment decisions had not turned on any single provision of Australian copyright law. Its model training currently takes place outside Australia, meaning the application of Section 43B of the Copyright Act 1968 to its training operations had not arisen in practice.
The company said hosting frontier model training in Australia would require a clear legal basis and that it understood the government was considering what that framework should be.
Training infrastructure and the data question
Anthropic argued that the location of training would not fundamentally change the sources of data used to build its models. Whether models were trained in the US or Australia, developers would continue to rely on a combination of publicly available internet content, datasets obtained through commercial agreements and internally generated data, the company said.
Anthropic said its crawler identifies itself, respects robots.txt instructions and does not bypass paywalls, CAPTCHAs or other access controls.
It also distinguished commercial agreements to access data from licensing arrangements specifically for AI training. The company said it enters into commercial deals to obtain data, including material needed to fill gaps in particular knowledge areas and capabilities, but not licensing deals specifically for training.
It expects such commercial data arrangements for non-public and specialised data to continue.
Anthropic said it had not announced publisher licensing deals at this stage, adding that the licensing agreements most familiar across the AI industry were, in its understanding, for inference rather than training.
The distinction is relevant to proposals for an Australian framework that would permit AI training on copyrighted material subject to conditions, including mechanisms through which creators could reserve their works from use.
Anthropic said an effective opt-out system should use specific, verifiable and machine-readable controls at the point of collection. It proposed that compliance with those controls become a legal requirement, with an Australian regulator responsible for verification and enforcement.
Under the company’s proposed approach, compliance would be a condition of approval to train, and a developer that failed to comply would lose that approval. Anthropic also said web crawlers should identify themselves so website operators could make informed decisions about access.
The company did not set out a detailed estimate of the infrastructure investment that such a framework might attract.
Copyright settlement and licensing position
Anthropic also addressed the implications of its US copyright litigation, including the US$1.5 billion settlement in Bartz v Anthropic. The company said the US court found that training on the relevant books constituted fair use under US copyright law, but that acquiring books from so-called pirate libraries did not. The settlement requires Anthropic to destroy the downloaded copies covered by the agreement and provides for payments to authors and publishers.
Anthropic said the settlement resolved a US class action whose membership was defined through the US court process, including a requirement for registration with the US Copyright Office.
The company argued that the decision made clear that training generative AI models on copyrighted material constitutes fair use, and that the issue would be settled if the US Supreme Court agreed. It also cited the separate Kadrey v Meta case, in which a US trial court ruled in Meta’s favour on fair use in relation to books downloaded for training its Llama model.
Anthropic acknowledged, however, that no US appellate court had yet ruled on whether training a generative AI model constitutes fair use. It distinguished the appellate decision in Thomson Reuters v ROSS Intelligence on the basis that the case concerned a non-generative legal research tool.
Asked whether it believed inference of its models complied with Section 43B, Anthropic did not say whether it did. It said the provision’s application to inference, including whether it was relevant, had not been considered by an Australian court, and that the answer would likely depend on the specific facts and technical processes involved.
The company said it maintained safeguards designed to prevent Claude from reproducing copyrighted material in its outputs.
Australian research funding and government engagement
Anthropic said its March memorandum of understanding with the Australian Government had no financial components beyond a commitment to explore partnerships.
Senator Pocock’s question referred to AU$3 million in partnerships with Australian research institutions announced alongside the agreement. Anthropic said it had subsequently announced a further AU$10 million in Claude credits for Australian researchers and deep technology start-ups.
Anthropic said it had active memoranda of understanding or similar arrangements with the governments of Australia, Japan, Singapore and South Korea, and was in discussions with other governments.
It also said it intended to provide ongoing access to frontier models for eligible Australian entities regardless of whether domestic training was permitted. The company did not disclose how much revenue it had generated in Australia since establishing its local subsidiary in December 2025, or how much tax it had paid. It said it would report revenue and pay tax in accordance with Australian law.
Anthropic also said it could not provide the number of employees who had left the company over safety concerns. It described three internal channels for raising issues: an emergency alerting and response system, a general forum for suggesting safety improvements, and an anonymous channel for reporting potential breaches of its safety commitments.
AI safety and access to advanced models
As part of the statements, Anthropic disclosed incidents in which its models accessed real systems during security testing after a misconfigured sandbox gave them internet access they were not supposed to have.
The company said it halted cyber evaluations, notified affected organisations within days, published an account of the incidents and changed its safeguards. It subsequently introduced real-time classifiers intended to stop a model when it attempts to probe or escape its environment, before the action is executed.
In a report published on 9 October 2026, Anthropic also described four categories of unintended model behaviour involving real websites and systems: submitting forms, accessing gated data, using an existing software flaw to run commands on a server, and using URL-shortening services to circumvent limits in its own web search tool.
Anthropic said most of those cases were identified through reviews of its own testing, training and internal-use records. It characterised them as significantly less severe than incidents reported in July and September and said none involved Australian entities.
The company said access to its most cyber-capable models was governed by its Cyber Verification Program, which applies different verification requirements and security controls across access tiers. It also said that, as a US company subject to US law including export controls, it reviews the most sensitive tier with the US Government.
Anthropic said its Responsible Scaling Policy sets capability thresholds that trigger stronger safeguards before models can be trained further or deployed. It cited Project Glasswing, under which access to its most cyber-capable model was restricted to a small group of defensive partners rather than made generally available.
The company said it had committed under its Australian government agreement to joint safety and security evaluations with the Australian AI Safety Institute. It also described arrangements for independent evaluators to have access comparable to its own risk assessment teams and contractual rights to publish key findings about risks, incidents and practices without Anthropic’s editorial control, subject to limited redactions for matters such as security-sensitive or legally privileged information.
Separately, Anthropic did not say how many Australian organisations were involved in Project Glasswing or name them, saying the Australian entities involved were commercial in confidence. The committee is due to deliver its final report by 30 November 2026.