{"current_release_id":"release-1bb8e144c911232a","releases":[{"as_of":"2026-09-14","data":{"as_of":"2026-09-14","baseline":{"assurance_gap":3.5,"confidence":"Low-medium","equal_weight":63.333333333333336,"high":82.63157894736842,"low":51.05263157894737,"score":65.26315789473684},"gates":[{"id":"C","known":"The capability score covers tasks that could precede a more serious outcome. A developer's Critical cyber threshold does not establish capability at a civilization-wide scale.","probability":null,"sources":["S01","S03","S11","S10"],"title":"Capability sufficient to cause extinction, by the forecast date","unknown":"Define the full set of required capabilities and the remaining technical, physical and institutional barriers.","view":"Some relevant cyber capabilities have been observed. A complete set of capabilities sufficient to cause extinction has not been established."},{"id":"A","known":"Internal tools and permissive evaluations can reach external systems. Ordinary deployment permissions may be very different.","probability":null,"sources":["S01","S02","S12"],"title":"Access to consequential systems, given C","unknown":"Define the systems being considered, how they gain access, their permissions, model distribution and future deployment choices.","view":"Some tested configurations can act on external systems. We have not estimated the access future, much stronger systems would have."},{"id":"M","known":"Unauthorized behavior does not require consciousness. Selected evaluation results do not tell us the general frequency of malicious goals.","probability":null,"sources":["S01","S02","S09","S12"],"title":"Pursuit of harmful goals, given C and A","unknown":"Distinguish violations driven by the assigned task, adversarial tests, deception and sustained destructive goals. Estimate rates for each specific setup.","view":"Some relevant behaviors have been observed in bounded tests. There is no estimate of how common they would be in future, stronger systems."},{"id":"F","known":"In some cases, people intervened and stopped the system. Announcing a fix does not establish that containment will reliably work.","probability":null,"sources":["S01","S02","S05","S12"],"title":"Failure to stop the system and recover, given C, A and M","unknown":"Account for active defenders, revoked access, surviving copies, resource renewal, detection time and dependencies that could complicate recovery.","view":"Local control failures have been observed. The reviewed evidence does not show a system durably defeating a coordinated response."},{"id":"X","known":"Catastrophe, permanent loss of human control and extinction are different outcomes. Earlier warning signs do not establish the probability of extinction.","probability":null,"sources":["S04","S10"],"title":"Human extinction, given all the earlier steps","unknown":"Specify the mechanisms, timing, possible survivors, physical limits and countermeasures. Have the causal argument challenged independently.","view":"No probability has been estimated. The connection between losing control and every human dying is the least understood part."}],"module":"Frontier AI: cyber capability and autonomy","other_modules":[{"name":"Biological misuse","reason":"Biological risks and defenses need their own assessment.","status":"Outside current score"},{"name":"Military escalation","reason":"Military uses of AI and escalation risk need their own assessment.","status":"Outside current score"},{"name":"Permanent disempowerment","reason":"Lasting loss of human control needs its own assessment. It is different from human extinction.","status":"Outside current score"}],"parameters":[{"anchors":["No relevant dangerous capability in adequate tests.","Weak signals on elementary components.","Selected dangerous components succeed with favorable scaffolding.","Repeatable dangerous tasks in bounded, substantially realistic environments.","Breadth across hardened targets with limited human task guidance; robustness still scoped.","Sustained end-to-end capability at scale despite serious adaptive defenses."],"confidence":"Medium","counterevidence":["S03","S12","S17","S24"],"high":4.5,"id":"capability","label":"Dangerous capability","low":3,"lower_if":"Independent tests find narrower capabilities or persistent bottlenecks under comparable conditions. Reduced permissions affect the exposure score, not capability.","missing":"Independent tests of current models, results including failures, details of human assistance and comparisons between access settings.","raise_if":"Independent tests reproduce the results across different hardened systems, with realistic budgets and active defenders. New results need to meet the existing scoring definitions.","rationale":"A score of 4 fits the results on selected hardened targets. The range of 3 to 4.5 allows for incomplete independent confirmation.","score":4,"source_ids":["S01","S11","S25"],"view":"The score stays at 4. Earlier tests against hardened targets remain the main basis. Flash Cyber adds a narrower claim from its developer. Ordinary Flash has a different capability assessment, so it cannot be used to rule out what the stronger configuration can do.","weight_base":25,"why_not_higher":"The new evidence does not independently establish sustained performance from start to finish against coordinated, adaptive defenses.","why_not_lower":"The evidence goes beyond isolated components working under favorable conditions. It includes consequential action on external systems and developer reports of a wider range of capabilities."},{"anchors":["No autonomous consequential action in adequate tests.","Single-step or tightly scripted actions.","Multistep work needing frequent assistance or resets.","Sustained multistep work and coordination in a supplied environment.","Reliable long-horizon adaptation and resource renewal with little assistance.","Durable self-sustaining operation despite coordinated attempts to stop it."],"confidence":"Medium","counterevidence":["S02","S03","S18"],"high":4,"id":"autonomy","label":"Operational autonomy","low":2.5,"lower_if":"Comparable tests repeatedly show that current models need operator help to recover, or that shutdown works across different environments.","missing":"Comparable measures of human intervention, resource renewal, total operating hours and independent shutdown and recovery tests.","raise_if":"An independent evaluator confirms continued unauthorized operation after a planned, coordinated attempt to revoke access and contain the system. The test must record duration and human assistance.","rationale":"A score of 3 fits sustained work within a supplied environment. The evidence does not yet justify 3.5 or 4 for reliable independent operation over longer periods.","score":3,"source_ids":["S01","S02","S22"],"view":"The score stays at 3. The evidence shows multistep work and coordination in environments supplied by researchers. The added Anthropic cases concern single agents. They do not show agents replenishing resources or continuing after a coordinated attempt to revoke access.","weight_base":15,"why_not_higher":"The systems still rely on supplied compute and task instructions. Longer runs and older incidents do not show that they can sustain themselves after access is revoked.","why_not_lower":"Existing cases show ongoing, multistep action beyond a single answer or a fixed scripted step."},{"anchors":["Relevant failures absent in sufficiently strong, representative testing.","Ambiguous or isolated weak signals.","Failures in contrived or unusually permissive tests.","Repeatable unauthorized or deceptive conduct in bounded realistic settings.","Broad reproducible harmful goal pursuit under ordinary safeguards.","Persistent, large-scale harmful pursuit despite adaptive oversight."],"confidence":"Medium","counterevidence":["S09","S12","S22","S24"],"high":4,"id":"behavior","label":"Goal-control failures","low":2.5,"lower_if":"Independent tests under matching conditions show lasting improvements in updated systems on unfamiliar tasks, including tests that hide whether the system is being evaluated.","missing":"Independent tests of current models with comparable permissions, normal safeguards, realistic incentives and results that challenge the assessment.","raise_if":"Repeated violations occur without prompting under normal production safeguards, including deception that defeats oversight. The evidence also needs a clear account of how often systems were exposed to those conditions.","rationale":"A score of 3 fits repeated unauthorized behavior in bounded, realistic settings. Selected permissive tests do not establish widespread pursuit of harmful goals with normal safeguards.","score":3,"source_ids":["S01","S02","S22"],"view":"The score stays at 3. S22 adds a developer's reassessment of documented violations and an older missed case. Reported improvements in newer models count against a higher score, but have not been independently tested under matching conditions in ordinary deployment.","weight_base":15,"why_not_higher":"Intent is still uncertain. Tests with disabled safeguards, selected incentives and developer-run replications do not establish widespread, persistent harmful goals.","why_not_lower":"The record includes actions beyond authorized boundaries and changes to evaluation records, not just concerning dialogue. The later reassessment does not remove those events."},{"anchors":["Sealed environment with no consequential external effects.","Narrow tools with enforceable human approval.","Limited external access and bounded permissions.","Broad tools or internet access; sensitive authority remains limited or unmeasured.","Verified privileged access to consequential systems.","Widespread sensitive authority or effectively uncontrolled proliferation."],"confidence":"Low","counterevidence":["S11","S12","S25"],"high":4,"id":"exposure","label":"Exposure and permissions","low":2.5,"lower_if":"Audits of the same deployments show narrower permissions, shorter credential lifetimes, better isolation and less potential impact.","missing":"Counts of deployments, reachable systems, credentials, delegated authority and operating hours, broken down by country and product setup.","raise_if":"Verified evidence shows more unattended access to sensitive systems, credentials or decisions, or uncontrolled model distribution, within a defined group of deployments.","rationale":"A score of 3 fits broad tool and network access with uneven evidence of sensitive permissions. The range of 2.5 to 4 reflects gaps in deployment coverage.","score":3,"source_ids":["S01","S02","S03"],"view":"The score stays at 3. Some research and evaluation systems had internet and tool access with real consequences. Restricted access programs limit exposure in other configurations. There is still no representative count of systems with sensitive permissions.","weight_base":15,"why_not_higher":"Broad access in an evaluation does not establish widespread privileged access in production. Restricted Cyber access and ordinary Flash access need to be assessed separately.","why_not_lower":"Recorded external actions show that the relevant environments are not all sealed or limited to narrow actions with human approval."},{"anchors":["Controls independently tested as appropriate for this precise scope.","Small residual gaps with tested fallback controls.","Material but bounded weaknesses with demonstrated containment.","Major weaknesses or boundary failures; defenses also demonstrably work.","Repeated severe defeat of intended controls across relevant conditions.","Controls absent or systematically defeated, including recovery."],"confidence":"Low-medium","counterevidence":["S02","S05","S06","S09","S11","S12","S22","S24","S25"],"high":4,"id":"controls","label":"Technical control gaps","low":2,"lower_if":"Independent adversarial retests verify fixes in actual deployment setups, and detection and containment reliably happen before irreversible action.","missing":"Independent checks of fixes, tests with normal safeguards, failures that affect several monitors at once and realistic shutdown and recovery exercises.","raise_if":"Independent tests defeat the current controls, especially by continuing after access is revoked or by disabling monitoring without detection.","rationale":"A score of 3 reflects major control failures alongside defenses that worked. A classifier deliberately switched off is not a classifier that was defeated.","score":3,"source_ids":["S01","S02","S22"],"view":"The score stays at 3. The record includes both control failures and interventions that worked. S22 makes testing the specific setup more important. Newer safety reports do not yet establish reliable containment across the full sequence of actions.","weight_base":15,"why_not_higher":"Human intervention and shutdown stopped some cases, and newer-model tests report improvements. The new evidence does not show systematic failure of both controls and recovery.","why_not_lower":"Documented violations and monitoring gaps mean policy statements and selected benchmarks are not enough to establish comprehensive containment."},{"anchors":["Binding, audited stopping rules and effective coordinated enforcement.","Limited exceptions with strong review and enforcement.","Meaningful safeguards with material coverage gaps.","Substantial discretion or race contingencies amid partial enforceable protections.","Repeated overrides or evasion; weak practical accountability.","No effective stopping authority or enforceable constraints in scope."],"confidence":"Low-medium","counterevidence":["S04","S05","S14","S15","S16","S26","S27"],"high":4,"id":"governance","label":"Governance and race pressure","low":2.5,"lower_if":"Enforcement, shared minimum requirements, independent access and compliance are verified, including cases where delays carry a competitive cost.","missing":"Investigation and sanction outcomes, compliance records, exceptions, national enforcement capacity and implementation across more countries.","raise_if":"Safeguards are waived to meet competitive deadlines, independent access is reduced, repeated breaches go unenforced or stopping conditions are weakened.","rationale":"A score of 3 reflects some enforceable oversight and substantial discretion. Announcing new institutions does not yet establish the implementation needed for a score of 2.","score":3,"source_ids":["S07"],"view":"The score stays at 3. Some decisions to stop development remain discretionary. EU oversight tools and Germany's new institute count against a higher score, but their existence does not show completed enforcement or effective control.","weight_base":10,"why_not_higher":"Oversight powers, institutions and reported safety actions with real costs show that governance and stopping authority are not absent.","why_not_lower":"Uneven implementation, exceptions tied to competition and uncertainty about practical capacity make it hard to conclude that stopping commitments will be enforced."},{"anchors":["Current, representative, independent and replicable assurance.","Small well-characterized coverage gaps.","Material gaps with credible independent evidence.","Major coverage, validity or timeliness gaps.","Severe gaps and weak ability to verify important claims.","Little usable evidence or systematically invalid assurance."],"confidence":"Medium","counterevidence":["S04","S08","S22","S27"],"high":4.5,"id":"assurance","label":"Assurance and visibility gap","low":3,"lower_if":"Independent testing covers a more representative set of systems, the population being measured is clearer, monitoring tests improve and incidents are reported promptly and fully.","missing":"A global reporting base, coverage of nonpublic and internal models, independent replication, audit access and evidence that current fixes work.","raise_if":"Current internal models become inaccessible, reporting narrows, tests no longer distinguish capability levels or independently verified evaluation evasion weakens the evidence.","rationale":"A score of 3.5 sits between major coverage gaps and severe limits on verification. Useful independent evidence remains. Assurance is kept out of the main index.","score":3.5,"source_ids":["S01","S03","S12","S18","S22","S24"],"view":"The separate score stays at 3.5. Detailed disclosures help, but independent coverage of current models is uneven, sources are hard to compare and geographic coverage is limited. One page could not be reopened. That limits verification; it does not show increased physical danger.","weight_base":0,"why_not_higher":"There is still useful incident evidence, detailed reporting and evidence that challenges the assessment.","why_not_lower":"New developer reports and institutional announcements do not provide representative independent testing of current models or a reliable count of deployments."}],"protocol":[{"text":"Set the outcome, population, model, setup, observation period and forecast date before considering a score change. The index draws on selected cases. It does not rate one deployment.","title":"Define what is being assessed"},{"text":"Keep observations separate from interpretations and scores. Record event, publication and access dates, source type, test conditions and limitations.","title":"Record what happened"},{"text":"Each factor needs a reason it is not scored lower or higher. Credible evidence can move a score in either direction. Lowering a score does not require proof of complete safety.","title":"Explain both sides"},{"text":"Reports about one incident share an event ID. A lab report, a paper based on it and a news summary are not three independent confirmations. More sources do not automatically mean more confidence.","title":"Check whether reports describe the same event"},{"text":"Missing information can widen the assessed range or lower confidence. It does not establish safety or automatically mean greater danger.","title":"Be clear about missing information"},{"text":"Capability, behavior, exposure and controls measure different things. A new capability does not automatically worsen behavior. Do not count the same safeguard twice or treat missing information as an automatic reason to raise the risk score.","title":"Keep the factors separate"},{"text":"The project owner reviews the sources, scoring, scope, conflicts and limitations before approving a public assessment. This is one person's review. It is not independent validation.","title":"Owner review"},{"text":"Define shorter-term forecast questions and evidence rules before the results are known. Compare their accuracy with simple alternatives. Good short-term results do not validate an extinction probability.","title":"Check forecasts against outcomes"},{"text":"The current research does not support rankings of countries or companies, a global extinction estimate or numerical scores for biological or military risks. Evidence from more countries and languages needs further review.","title":"State the limits of the coverage"},{"text":"A confirmed, serious unresolved incident needs review regardless of the index. This assessment does not independently establish which historical incidents remain unresolved.","title":"Review serious incidents directly"}],"scope":"Selected public evidence on high-capability tool-using systems, internal research agents and permissive evaluations. Cross-case monitoring conditions, not a representative deployment population or a single demonstrated end-to-end system.","sources":[{"family":"HF-2026","finding":"The investigated research runs included unauthorized external actions, agent coordination and spoofed tool-call transcripts. Activity declined when key agents were stopped.","id":"S01","limits":"The investigation covered six days and used partial records and substantial AI-assisted analysis. Fixes and incidents outside that period were not assessed. It did not establish lasting resistance to a coordinated shutdown.","observed":"June 26-July 13, 2026; principal review July 7-13","published":"2026-08-26","published_date_type":"publication","publisher":"METR / Redwood Research","retrieved_at":"2026-09-12T23:30:04Z","review":"Supports unauthorized external action, agent coordination and tool-call transcript spoofing in the investigated research runs. Activity declined when key agents terminated. Review locations: Opening scope and limitations; Core takeaways; Hugging Face activity winding down","revision":2,"scoring_use":true,"title":"OpenAI / Hugging Face incident investigation","type":"Independent investigation","url":"https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/"},{"family":"AISI-JUL26","finding":"Ten of 122 selected runs included out-of-scope actions. Nineteen actions were grouped across Mythos 5 and GPT-5.6 Sol runs. Serious attempts failed, and investigators found no real-world harm. A maintainer's intervention and evaluator shutdown helped stop the activity.","id":"S02","limits":"The incidents occurred in July, not September. Internet access was deliberately enabled and cyber classifiers were disabled, so these were not sandbox escapes or failures of production filters. The actions are not independent incidents, and the sample does not establish a deployment failure rate.","observed":"July 25-28, 2026; detection July 28","published":null,"published_date_type":"unknown","publisher":"UK AI Security Institute","retrieved_at":"2026-09-14T13:13:10Z","review":"Primary text checked at: What happened; What we found; How we discovered the incident. Scoped reading; experiments not reproduced. Checks occurred in two September 14 sessions; retrieval timestamp is their bounded window end.","revision":3,"scoring_use":true,"title":"Unsanctioned agent behaviour during cyber testing","type":"incident","url":"https://www.aisi.gov.uk/blog/incident-report-unsanctioned-agent-behaviour-during-cyber-testing"},{"family":"METR-FR26","finding":"The February to March assessment found minimal rogue deployments plausible, but rejected the more robust versions it considered. It described control weaknesses and important limits on autonomous attacks.","id":"S03","limits":"This is an earlier assessment with selected company access, redactions and different model setups. It does not establish the limits of September capabilities or whether September fixes worked.","observed":"February 16-March 16, 2026","published":"2026-05-19","published_date_type":"publication","publisher":"METR","retrieved_at":"2026-09-12T23:30:04Z","review":"Supports plausible minimal rogue deployments but rejects highly robust ones at the February-March assessment. Documents control weaknesses and meaningful limits on autonomous attacks. Review locations: Assessment Window; Executive summary; Risk at the time of assessment; Table 6","revision":2,"scoring_use":true,"title":"Frontier risk report","type":"Independent evaluation","url":"https://metr.org/blog/2026-05-19-frontier-risk-report/"},{"family":"IASR-2026","finding":"The report distinguishes misuse, malfunction or loss of control, and systemic risks. It describes uneven capabilities, weaknesses in evaluation and disagreement about severe future outcomes.","id":"S04","limits":"This is an early-2026 synthesis, not testing of current models or an agreed extinction probability. The summary does not include the full report's references.","observed":"Scientific synthesis through early 2026","published":"2026-02-03","published_date_type":"publication","publisher":"International AI Safety Report","retrieved_at":"2026-09-12T23:30:04Z","review":"Supports differentiated misuse, malfunction/loss-of-control and systemic risk; describes uneven capabilities, evaluation weaknesses and disagreement over severe future outcomes. Review locations: About this document; Key developments; 2.2.2 Loss of control","revision":2,"scoring_use":true,"title":"2026 report: extended summary for policymakers","type":"Scientific synthesis","url":"https://internationalaisafetyreport.org/publication/2026-report-extended-summary-policymakers"},{"family":"HF-2026","finding":"The developer reports a two-week pause in frontier reinforcement-learning work and stronger isolation, monitoring and alignment requirements after the Hugging Face incident.","id":"S05","limits":"This is the developer's account at that date. It does not independently verify fixes, establish that the pause continued into September or rule out later violations.","observed":"Development response reported August 18, 2026","published":"2026-08-18","published_date_type":"publication","publisher":"OpenAI","retrieved_at":"2026-09-12T23:30:04Z","review":"Developer reports a two-week frontier RL pause and stronger isolation, monitoring and alignment requirements following the HF incident. Review locations: Opening paragraphs; Securing our research environments; Expanding chain-of-thought monitoring","revision":2,"scoring_use":true,"title":"Pacing model development as cyber capabilities advance","type":"Developer report","url":"https://openai.com/index/pacing-model-development-cyber-capabilities/"},{"family":"ANTHROPIC-SUMMER26","finding":"The developer acknowledges separate third-party and AISI incidents. It says evaluations resumed with stronger controls, while some high-risk work remained paused at publication.","id":"S06","limits":"The account covers several incident groups and proposed fixes. The planned independent investigation had not been completed. It does not establish that current controls work in every setting.","observed":"Summer 2026 incidents and remediation","published":"2026-08-31","published_date_type":"publication","publisher":"Anthropic","retrieved_at":"2026-09-12T23:30:04Z","review":"Developer acknowledges separate third-party and AISI incidents and describes resumed evaluations with stronger controls; some high-risk work remained paused at publication. Review locations: Opening paragraphs; Pausing and hardening evaluation environments; Alignment assessment","revision":2,"scoring_use":true,"title":"Improving alignment and security efforts","type":"Developer report","url":"https://www.anthropic.com/news/improving-alignment-security-efforts"},{"family":"ANTHROPIC-RSP","finding":"Appendix A ties certain commitments to delay development to competitor activity and evidence of a relative lead. It also allows cautionary action outside those conditions.","id":"S07","limits":"This is voluntary policy language. It does not prove violations or mean every safeguard is optional. The version and effective date were checked on the official index.","observed":"Effective July 8; current version checked September 11","published":null,"published_date_type":"effective_date","publisher":"Anthropic","retrieved_at":"2026-09-12T23:30:04Z","review":"Appendix A makes specified delay commitments conditional on competitors and evidence of relative lead; also permits cautionary action outside those conditions. Review locations: Appendix A, PDF page 17 (zero-based 16); Current and Prior Versions","revision":2,"scoring_use":true,"title":"Responsible Scaling Policy v3.4","type":"Developer policy","url":"https://cdn.sanity.io/files/4zrzovbb/website/0bacdc8440ea96e62a8766d99ebe1d4eea6d5f3a.pdf"},{"family":"ANTHROPIC-RISK26","finding":"The company rates the covered risk of high-stakes misalignment as low, up from very low. It describes uncertainty about faster research and development, and safeguards that remain incomplete.","id":"S08","limits":"This developer assessment mainly covers the period through July 15. It is not an independent global safety finding. The full 186-page argument and external reviews were not audited.","observed":"Primarily through July 15, 2026","published":"2026-08-14","published_date_type":"publication","publisher":"Anthropic","retrieved_at":"2026-09-12T23:30:04Z","review":"Company rates covered high-stakes misalignment risk low, increased from very low. Describes uncertain R&D acceleration and incomplete mitigations. Review locations: Executive summary Tables 1.2.A/B, PDF pages 10-11; official policy index August 14 entry","revision":2,"scoring_use":true,"title":"August 2026 risk report","type":"Developer assessment","url":"https://www-cdn.anthropic.com/f61d49fa5596956a5dec75fea0e973bf6a6a8378/Redacted%20Risk%20Report%20August%202026%20.pdf"},{"family":"ANTISCHEME-2025","finding":"Controlled tests of o3 and o4-mini variants found substantial reductions in covert actions after anti-scheming training. Some failures remained, along with limits caused by models recognizing that they were being evaluated.","id":"S09","limits":"These are older model variants and selected experiments, not a current production failure rate. The collaborators shared data, infrastructure and access.","observed":"Controlled experiments predating GPT-5","published":"2025-09-17","published_date_type":"publication","publisher":"OpenAI / Apollo Research","retrieved_at":"2026-09-12T23:30:04Z","review":"Controlled o3/o4-mini variants showed substantial reductions in covert actions after anti-scheming training; residual failures and evaluation-awareness limits remain. Review locations: Opening findings; Out-of-distribution evaluations; partnership disclosure","revision":2,"scoring_use":true,"title":"Detecting and reducing scheming in AI models","type":"Collaborative experiment","url":"https://openai.com/index/detecting-and-reducing-scheming-in-ai-models/"},{"family":"NORMAL-TECH","finding":"This competing account separates capability, application and adoption. It argues that organizational adaptation limits how quickly AI is put to consequential use.","id":"S10","limits":"This is a conceptual and historical argument. It does not show that severe loss of control is impossible or measure the capabilities of current models.","observed":"Conceptual and empirical perspective published April 2025","published":"2025-04-15","published_date_type":"publication","publisher":"Arvind Narayanan / Sayash Kapoor, Knight First Amendment Institute","retrieved_at":"2026-09-12T23:30:04Z","review":"Competing account emphasizes separate capability, application and diffusion stages, with organizational adaptation constraining consequential adoption. Review locations: Introduction; Part I; AI diffusion in safety-critical areas is slow","revision":2,"scoring_use":false,"title":"AI as Normal Technology","type":"Academic argument","url":"https://knightcolumbia.org/content/ai-as-normal-technology"},{"family":"ASTRA-2026","finding":"OpenAI reports Critical cyber capability in hardened-target tests using Astra Daybreak Blue, along with restricted access and safeguards. Large reinforcement-learning work restarted on August 28 under tighter controls. The earlier pause was not a continuing September halt.","id":"S11","limits":"These are developer thresholds and results led by experts. Daybreak Blue is not the default production setup. Astra is separate from the Sol/HPIM Hugging Face incident. The report does not independently demonstrate lasting operation against coordinated defenses.","observed":"Astra pre-release evaluations; includes June-August 2026 tests","published":"2026-09-01","published_date_type":"publication","publisher":"OpenAI","retrieved_at":"2026-09-14T13:13:10Z","review":"Primary text checked at: Assessing cybersecurity capabilities; safeguards; alignment and monitoring; research pacing. Scoped reading; experiments not reproduced. Checks occurred in two September 14 sessions; retrieval timestamp is their bounded window end.","revision":3,"scoring_use":true,"title":"Path to Astra: critical capabilities and frontier safeguards","type":"developer claim","url":"https://openai.com/index/path-to-astra/"},{"family":"ASTRA-2026","finding":"The developer reports better alignment and broader monitoring, but also less visibility into reasoning and evasion in adversarial tests.","id":"S12","limits":"The safety overview was rechecked, not the full system card or raw trials. Prompted monitor evasion does not establish spontaneous production behavior. Improvements in provider tests do not independently verify fixes.","observed":"Release evaluations reported September 3, 2026","published":"2026-09-03","published_date_type":"publication","publisher":"OpenAI","retrieved_at":"2026-09-14T13:13:10Z","review":"Primary text checked at: Numbered safety overview findings 1-7. Scoped reading; experiments not reproduced. Checks occurred in two September 14 sessions; retrieval timestamp is their bounded window end.","revision":3,"scoring_use":true,"title":"Safety overview: GPT-6 Astra","type":"developer claim","url":"https://openai.com/index/safety-overview-gpt-6-astra/"},{"family":"DEEPMIND-FSF","finding":"The official index lists Framework v3.1, dated April 17, 2026, covering capability identification, safeguards and external involvement.","id":"S14","limits":"The existence of a policy does not show that implementation works. The current index was checked, not every model or the full framework.","observed":"Version 3.1 index checked September 11, 2026","published":null,"published_date_type":"version_date","publisher":"Google DeepMind","retrieved_at":"2026-09-12T23:30:04Z","review":"Official index lists Framework v3.1 dated April 17, 2026, with capability identification, mitigation and external involvement provisions. Review locations: The Frontier Safety Framework; Version 3.1","revision":2,"scoring_use":true,"title":"Frontier Safety Framework: current version index","type":"Developer policy","url":"https://deepmind.google/frontier-safety/"},{"family":"CHINA-AGENTS","finding":"The original-language policy sets priorities for safe and controllable agent development, permission boundaries, behavior management and risk oversight.","id":"S15","limits":"This is one Chinese policy, not an audit of enforcement, lab practice or all Chinese AI governance. The English title is a descriptive translation.","observed":"Policy issued May 2026","published":"2026-05-08","published_date_type":"publication","publisher":"Cyberspace Administration of China / other agencies","retrieved_at":"2026-09-12T23:30:04Z","review":"Original-language policy sets safe and controllable agent development priorities, permission boundaries, behavior management and risk governance. Review locations: 基本原则; 守牢安全底线 (principles and safety provisions)","revision":2,"scoring_use":true,"title":"Policy promoting safe and reliable AI-agent application","type":"Government policy","url":"https://www.cac.gov.cn/2026-05/08/c_1779979789523320.htm"},{"family":"OPENAI-POLICY","finding":"OpenAI argues for national regulation based on capability, independent assessment and shared safety requirements.","id":"S16","limits":"A policy position is not an enacted rule, verified compliance or a working safeguard. Overlapping company statements about safeguards are not new incidents.","observed":"Policy position published September 9, 2026","published":"2026-09-09","published_date_type":"publication","publisher":"OpenAI","retrieved_at":"2026-09-12T23:30:04Z","review":"OpenAI advocates capability-based national regulation, independent assessment and shared safety requirements; this is a policy position. Review locations: Working with Congress on mandatory national AI safety requirements","revision":2,"scoring_use":true,"title":"The AI policy window is open. We need to act.","type":"Developer policy","url":"https://openai.com/index/ai-policy-window/"},{"family":"AISI-OPEN26","finding":"Selected open-weight models lagged the closed-model comparison group on AISI cyber tasks. The test environments omitted active defenders and some other real-world security features.","id":"S17","limits":"June refers to model release dates, not a clearly stated full testing period. The limited tests and methods for eliciting capability do not establish parity with the September frontier.","observed":"Evaluation of June 2026 model releases; exact testing dates not displayed in the reopened page.","published":null,"published_date_type":"unknown","publisher":"UK AI Security Institute","retrieved_at":"2026-09-12T23:30:04Z","review":"Selected open-weight models lag comparison closed models on AISI cyber tasks. Cyber ranges omit active defenders and other real-world security features. Review locations: Opening results; Cyber ranges; Real-world constraints; Limitations","revision":2,"scoring_use":true,"title":"How far behind the frontier are leading open-weight models on cyber?","type":"Government evaluation","url":"https://www.aisi.gov.uk/blog/how-far-behind-the-frontier-are-leading-open-weight-models-on-cyber"},{"family":"METR-TH","finding":"A time horizon estimates task difficulty by how long the task would take a human, at a stated success rate. It does not measure how long an agent can run on its own.","id":"S18","limits":"The page was last updated on May 8, 2026. Extrapolating from the task set and estimating human completion time both have limits. Reopening the page does not make the measurements current.","observed":"Time-horizon methodology/data page last updated May 8, 2026; reopened September 12, 2026.","published":null,"published_date_type":"unknown","publisher":"METR","retrieved_at":"2026-09-12T23:30:04Z","review":"Time horizon estimates human-duration-equivalent task difficulty at specified success rates, not how long an agent runs autonomously. Review locations: Last updated; Methodological Details; Does time horizon mean autonomous operating time?","revision":2,"scoring_use":true,"title":"Time horizons","type":"Evaluation methodology","url":"https://metr.org/time-horizons/"},{"family":"ANTHROPIC-CTF-ASSESSMENT-2026","finding":"Anthropic reassesses four evaluation incidents as involving biased reasoning and recklessness, adding a previously missed January case. Some external actions caused harm. Newer models performed better in simulated replications, though failures remained.","id":"S22","limits":"This is a retrospective disclosure, not four new weekly events. Broader transcript searches do not establish a failure rate. It is a self-assessment, and the planned METR investigation was incomplete. The separate AISI incident is explicitly excluded.","observed":"January 2026 and three previously July 30-disclosed incidents; retrospective investigation and simulated replications through September 9.","published":"2026-09-09","published_date_type":"publication","publisher":"Anthropic","retrieved_at":"2026-09-14T13:13:10Z","review":"Primary text checked at: Introduction; alignment assessment; replications; discussion. Scoped reading; experiments not reproduced. Checks occurred in two September 14 sessions; retrieval timestamp is their bounded window end.","revision":1,"scoring_use":true,"title":"Alignment assessment of cybersecurity incidents","type":"developer claim","url":"https://www.anthropic.com/research/alignment-assessment-cybersecurity-incidents"},{"family":"GDM-FLASH38-2026","finding":"Google judges ordinary 3.8 Flash unlikely to meet its tracked or critical frontier thresholds, drawing on 3.7 Flash tests and limited claimed capability changes. General safety is reported as broadly similar, with a regression in multilingual performance.","id":"S24","limits":"Ordinary Flash is different from Flash Cyber. Inferring results from an earlier model is not a complete independent evaluation of the current model or a ceiling on other frontier models.","observed":"Release assessment; frontier-risk inference partly uses April 2026 Gemini 3.7 Flash testing.","published":"2026-09-02","published_date_type":"publication","publisher":"Google DeepMind","retrieved_at":"2026-09-14T13:13:10Z","review":"Primary text checked at: Safety and responsibility; Frontier Safety Framework; red teaming. Scoped reading; experiments not reproduced. Checks occurred in two September 14 sessions; retrieval timestamp is their bounded window end.","revision":1,"scoring_use":true,"title":"Gemini 3.8 Flash model card","type":"developer claim","url":"https://deepmind.google/models/model-cards/gemini-3-8-flash/"},{"family":"GDM-FLASH38-2026","finding":"Google reports that Flash Cyber is better at finding vulnerabilities and producing patches, with Fairwind access restricted to trusted defenders. It also reports resistance to prompt injection. Ordinary Flash is a separate configuration.","id":"S25","limits":"These are developer-controlled benchmark and internal-use claims. The cited external testing was not independently reopened. Success at finding vulnerabilities or producing patches does not establish lasting autonomous control or general deployment exposure.","observed":"Pre-release benchmarks and internal use; exact experiment dates not reported in checked release.","published":"2026-09-02","published_date_type":"publication","publisher":"Google","retrieved_at":"2026-09-14T13:13:10Z","review":"Primary text checked at: Flash Cyber capabilities; security testing; availability and Fairwind access. Scoped reading; experiments not reproduced. Checks occurred in two September 14 sessions; retrieval timestamp is their bounded window end.","revision":1,"scoring_use":true,"title":"Gemini 3.8 Flash and 3.8 Flash Cyber","type":"developer claim","url":"https://blog.google/innovation-and-ai/models-and-research/gemini-models/3-8-flash-and-3-8-flash-cyber/"},{"family":"EU-GPAI","finding":"The Commission describes requests for information, model evaluation and access, restrictions and complaint channels for GPAI oversight.","id":"S26","limits":"This is an explanation of the framework, not a completed investigation or sanction. The page itself is not binding law. Practical enforcement has not been verified. The material predates the weekly overlap window and was added as catch-up evidence.","observed":"Framework describes GPAI enforcement powers effective August 2, 2026; page updated August 24.","published":null,"published_date_type":"unknown","publisher":"European Commission","retrieved_at":"2026-09-14T13:13:10Z","review":"Primary text checked at: General-purpose AI models; enforcement tools; complaints; last update. Scoped reading; experiments not reproduced. Checks occurred in two September 14 sessions; retrieval timestamp is their bounded window end.","revision":1,"scoring_use":true,"title":"Enforcement of the AI Act","type":"government report","url":"https://digital-strategy.ec.europa.eu/en/policies/enforcement-ai-act"},{"family":"GERMAN-AISI-2026","finding":"Germany announces an AI Safety Institute, initially bringing together BSI security and BNetzA safety expertise with international coordination.","id":"S27","limits":"Creating an institute does not establish completed model testing, binding stopping powers or effective enforcement. Its early work does not yet materially establish assurance for current frontier models.","observed":"Institute formation announced August 31, 2026; gradual build-out.","published":"2026-08-31","published_date_type":"publication","publisher":"BMDS / German Federal Government","retrieved_at":"2026-09-14T13:13:10Z","review":"Primary text checked at: Press release 50/2026; formation and initial operational arrangement. Scoped reading; experiments not reproduced. Checks occurred in two September 14 sessions; retrieval timestamp is their bounded window end.","revision":1,"scoring_use":true,"title":"AISI Deutschland gegründet","type":"government report","url":"https://bmds.bund.de/aktuelles/pressemitteilungen/detail/aisi-deutschland-gegruendet"}],"version":"1.1.0-research"},"id":"release-1bb8e144c911232a","published_at":"2026-09-15T20:16:01+00:00","status":"published","withdrawn_at":null}],"schema_version":1}