AI safety and alignment
Published safety frameworks from 7 of 8 frontier AI developers, side by side, 69 of their model releases against the safety cards published for them, safety and capability research volumes from OpenAlex, and reported incidents.
How close is AGI?
There is no agreed definition and therefore no agreed distance. These are the measured quantities that bear on the question, each with its source.
- 84.0% best score on Mystery Game Puzzles, the nearest test to falling
- 4.4% best score on FrontierMath-Erdos, the hardest open test
- 78.1% best score on EBR-bench, which tests whether a model improves at an unfamiliar task by repeating it
- 11 tests still separating the leading models
What this is not: a measure of general intelligence. It counts how much of the available test supply has been exhausted, which moves both when models improve and when people build harder tests. Ten of the 18 tests are mathematics, and none of them measures acting over days, physical work, or judgement where there is no checkable answer. A reader who takes this as a percentage of the way to AGI has read more into it than it contains.
Published estimates by other people
- METR measures the length of task that frontier agents complete with 50 percent reliability, and reports that this length has roughly doubled every seven months over several years, with a faster doubling in the most recent period. Their measurements are not plotted here: METR's analysis repository carries no LICENSE file, and its README points at one that is not there, so no reuse permission has been granted and the default is reserved. Follow the link for their own chart.
- Epoch AI publishes the underlying benchmark runs used on this page, and an aggregate capabilities index of its own. Where this page fits a trend, the fit is ours and is labelled as such.
What developers have promised
Published Frontier safety framework A document in which a developer states the capability levels at which it will take specified action. The frameworks are self-written and self-assessed, and share no common scale. Glossary entry , and what each commits to. Self-written and self-assessed, with no common scale between them.
- 7 developers with a published framework Frontier Safety Framework Index This site Our own reading of each developer's published safety framework and model cards. Every field is what the developer says about itself: these are self-assessments under self-written frameworks with no common scale and no external audit, and they are indexed here for exactly that reason. Not a ranking, and not a verification. Cite AI Safety Tracker, "Frontier Safety Framework Index". https://aisafetytracker.org/alignment/#frameworks. Retrieved 23 October 2026.
- 4 that commit to stopping, rather than to deciding
- 4 that commit to evaluation by someone else
- 5 distinct risk domains named across all of them
| Developer | Framework | Its own scale | Domains | External eval | Commits to stop |
|---|---|---|---|---|---|
| Anthropic | Responsible Scaling Policy 2023 | Four capability thresholds, each paired with recommended mitigations; AI Safety Levels now name present safeguards only | CBRN, loss of control, AI R&D | yes | qualified |
| OpenAI | Preparedness Framework 2023 | Capability thresholds: High and Critical | CBRN, cyber, AI R&D | yes | yes |
| Google DeepMind | Frontier Safety Framework 2024 | Critical Capability Levels per domain, with lower Tracked Capability Levels for some | CBRN, cyber, manipulation, AI R&D, loss of control | not stated | qualified |
| Meta | Superintelligence Scaling Framework 2025 | Risk thresholds: moderate or lower, high, critical | CBRN, cyber, loss of control | not stated | yes |
| Microsoft | Frontier Governance Framework 2025 | Risk levels per capability: low, medium, high, critical | CBRN, cyber, AI R&D, loss of control, manipulation | yes | yes |
| Amazon | Frontier Model Safety Framework 2025 | Critical capability thresholds | CBRN, cyber, loss of control, manipulation | yes | yes |
| xAI | Frontier Artificial Intelligence Framework 2025 | Benchmark thresholds for deployment, in two domains | CBRN, loss of control | not stated | qualified |
| DeepSeek | none published | - | - | not stated | - |
What each framework says 8
- Anthropic Rewritten as version 3 in February 2026; version 3.4 took effect on 8 July 2026. The earlier commitment not to train or deploy without adequate safeguards is gone: it commits to delay development and deployment only while Anthropic leads or its competitors have strong safety measures, and otherwise publishes Risk Reports with a risk-benefit determination by its chief executive and Responsible Scaling Officer. It no longer has a cyber threshold. Commits to a decision process rather than to an outcome.
- OpenAI Version 2, April 2025, is still the published version. OpenAI's Frontier Governance Framework of May 2026 sets out how it meets EU and Californian law and leaves this as its own standard. Three tracked categories at two thresholds: persuasion was dropped in 2025, and long-range autonomy and nuclear risk are research categories without thresholds. At a Critical threshold it commits to halt further development until safeguards are specified. Commits to not deploying, or not continuing, until mitigations are in place.
- Google DeepMind Version 3.1 took effect on 17 April 2026. Adds Tracked Capability Levels below the critical ones, for CBRN and for a domain that now merges machine-learning R&D with misalignment. Risk acceptance weighs what other publicly available models can do, and for misuse risks applies to external deployment only, not to internal use or further development. Commits to a decision process rather than to an outcome.
- Meta Version 2.1, 2 October 2026, renamed from the Advanced AI Scaling Framework of April 2026, itself renamed from the Frontier AI Framework. Since version 2 the critical tier reads Develop with Mitigations, formerly Stop, so every tier permits development and deployment once mitigations are validated to bring risk down to moderate. Version 2.1 adds a third loss-of-control outcome, containment failure in training and evaluation. Covers any model trained with 1e26 FLOP or more. Commits to not deploying, or not continuing, until mitigations are in place.
- Microsoft Revised in February 2026 to align with the EU Code of Practice and the Californian and New York frontier AI laws, adding loss of control and harmful manipulation. Commits to pause development and deployment of a model whose risk cannot be sufficiently mitigated. Covers models in scope of those laws, and Microsoft's substantial fine-tunes of other developers' models. Commits to not deploying, or not continuing, until mitigations are in place.
- Amazon Revised in September 2026. Names four critical risk domains, adding harmful manipulation, and commits not to deploy a model that meets a threshold until safeguards appropriately mitigate the risks. Commits to not deploying, or not continuing, until mitigations are in place.
- xAI Version of December 2025, written to comply with California's SB 53. Sets two deployment criteria: an answer rate below 1 in 20 on restricted biology and chemistry queries, and a dishonesty rate below 1 in 2 on the MASK benchmark. Cyber misuse is handled by a refusal policy, with no threshold. States that the benefits of deployment may outweigh a risk a benchmark identifies. Commits to a decision process rather than to an outcome.
- DeepSeek Listed as an absence. DeepSeek releases open-weight models at or near the frontier and has published no safety framework, and is not among the Seoul signatories. The linked document is the commitment list it is absent from. No published framework, so nothing to commit to.
Every column is what a developer says about itself, in a document it wrote and can revise. None of these scales is comparable to any other, none is audited, and one of the two binding instruments that requires a framework at all only started to apply in 2026. Read this as an index of promises, not of behaviour. Frontier Safety Framework Index This site Our own reading of each developer's published safety framework and model cards. Every field is what the developer says about itself: these are self-assessments under self-written frameworks with no common scale and no external audit, and they are indexed here for exactly that reason. Not a ranking, and not a verification. Cite AI Safety Tracker, "Frontier Safety Framework Index". https://aisafetytracker.org/alignment/#frameworks. Retrieved 23 October 2026.
What developers published at each release
Every release Epoch AI lists from these developers since January 2025, against the System card A document a developer publishes for a model, describing its evaluations, safeguards and limitations. Also called a model card or safety report. Dated here by when it first appeared. Glossary entry published for it: when it appeared, whether it reports Dangerous-capability evaluation A test of whether a model gives meaningful help with chemical, biological, cyber or autonomous harm. Counted here only where a card reports results for that model. Glossary entry , which government institutes it names as Pre-release testing Testing of a model by a party other than its developer before public release. Counted here only where a card names a government institute that tested a pre-release version of that model. Glossary entry , and what it says about the developer's own thresholds.
- 48 of 69 releases with a system card on the day Release Safety Disclosure Index This site Our own reading of the system card, model card or safety report each developer published for each release Epoch AI lists from 2025, joined to Epoch's list. Every cell is what a developer says about its own model under its own framework: whether a card came out with the release, whether it reports dangerous-capability results, which government institutes it names as pre-release testers, and whether it says a risk threshold was reached. None of it is verified. A release Epoch adds after the last review is shown as awaiting review. Cite AI Safety Tracker, "Release Safety Disclosure Index". https://aisafetytracker.org/alignment/#releases. Retrieved 18 October 2026. Notable AI Models Epoch AI Inclusion is editorial ("notability criteria"), not exhaustive. Compute figures are frequently estimates; check the per-row confidence and notes columns before treating any value as measured. Cite Epoch AI, "Notable AI Models". https://epoch.ai/data/ai-models. Retrieved 18 October 2026 via AI Safety Tracker, https://aisafetytracker.org/alignment/.
- 4 cards published after the release, up to 49 days later
- 17 releases that no card names
- 13 cards naming a government institute that tested before release
| Developer | Releases | Card on the day | Later | None | Results | Government tested | Threshold reached | Share with a card on the day |
|---|---|---|---|---|---|---|---|---|
| OpenAI | 30 | 22 | 0 | 8 | 17 | 4 | 18 | |
| Anthropic | 15 | 15 | 0 | 0 | 15 | 9 | 12 | |
| Google DeepMind | 8 | 6 | 2 | 0 | 5 | 0 | 2 | |
| xAI | 6 | 1 | 2 | 3 | 3 | 0 | 0 | |
| Meta | 5 | 3 | 0 | 2 | 1 | 0 | 1 | |
| DeepSeek | 4 | 0 | 0 | 4 | 0 | 0 | 0 | |
| Microsoft | 1 | 1 | 0 | 0 | 0 | 0 | 0 |
| Released | Model | Card | Results | Government tested | Threshold |
|---|---|---|---|---|---|
| 2026-09-30 | Gemini 4 Argon Google DeepMind Released to trusted cyber defenders on 30 September; the card followed on 13 October. The launch post mentions the US government's voluntary pre-release access process and names no institute. | 13 days later | results | none named | reached CBRN and cybersecurity CCLs could not be ruled out; safety cases applied |
| 2026-09-29 | GPT-6.1 Sol OpenAI | at release | results | none named | reached Treated as Critical in cybersecurity and High in biological and chemical |
| 2026-09-28 | Claude Sonnet 5.5 Anthropic | at release | results | none named | reached Treated as meeting the CB-1 and Autonomy-1 thresholds |
| 2026-09-22 | GPT-6 Sol OpenAI Covered by an appendix added to the GPT-6 Astra card on its release day. | at release | results | none named | reached Treated as High in cybersecurity and in biological and chemical |
| 2026-09-22 | GPT-6 Luna Decisions OpenAI Served through the Decisions API, built on GPT-6 Luna. No card names it. | none | - | - | - |
| 2026-09-22 | GPT-6 Luna OpenAI Covered by an appendix added to the GPT-6 Astra card on its release day. | at release | results | none named | reached Treated as High in cybersecurity and in biological and chemical |
| 2026-09-22 | Claude Opus 5.5 Anthropic | at release | results | US CAISI | reached Treated as having CB-1 capabilities; does not cross CB-2 |
| 2026-09-21 | Grok 4.7 xAI The launch post reports refusal and biosafety benchmark scores and links no card. | none | - | - | - |
| 2026-09-09 | DeepSeek V4.1 Flash DeepSeek Its technical report gives offensive-cyber benchmark scores as capabilities, with no risk assessment. | none | - | - | - |
| 2026-09-03 | GPT-6 Astra OpenAI | at release | results | UK AISI | reached Critical in cybersecurity; High in biological and chemical |
Earlier releases 59
| Released | Model | Card | Results | Government tested | Threshold |
|---|---|---|---|---|---|
| 2026-09-02 | Muse Spark 1.3 Meta The launch post links a capability evaluation methodology, not a safety report. | none | - | - | - |
| 2026-09-02 | Gemini 3.8 Flash Google DeepMind | at release | another model's | none named | below Relies on Gemini 3.7 Flash, which reached no Tracked or Critical Capability Level |
| 2026-09-01 | Claude Fable 5.1 Anthropic METR tested Claude Mythos 5.1 before release; the card names no government institute. | at release | results | none named | reached Treated as having CB-1 capabilities |
| 2026-08-11 | GPT-5.6 Cyber OpenAI Released through OpenAI's Daybreak cyber defence programme. No card names it. | none | - | - | - |
| 2026-08-05 | Muse Spark 1.2 Meta The launch post links a capability evaluation methodology, not a safety report. | none | - | - | - |
| 2026-07-24 | Claude Opus 5 Anthropic | at release | results | UK AISI | reached Treated as having CB-1 capabilities |
| 2026-06-09 | Claude Fable 5 Anthropic | at release | results | UK AISI | reached Treated as having CB-1 capabilities; judged below CB-2 |
| 2026-06-02 | MAI-Code-1-Flash Microsoft The card reports secure-coding evaluations, which are not dangerous-capability ones. | at release | none | none named | not stated Names no threshold |
| 2026-05-28 | Claude Opus 4.8 Anthropic | at release | results | UK AISI | reached CB-1 safeguards applied; catastrophic risk judged low |
| 2026-05-19 | Gemini 3.5 Flash Google DeepMind | at release | another model's | none named | below Relies on Gemini 3.1 Pro, which reached no CCL |
| 2026-05-05 | GPT-5.5 Instant OpenAI | at release | results | none named | reached Treated as High in cybersecurity and in biological and chemical |
| 2026-04-24 | DeepSeek-V4-Pro DeepSeek Released with a technical report on capability. DeepSeek publishes no model card or safety report. | none | - | - | - |
| 2026-04-24 | DeepSeek-V4-Flash DeepSeek Released with a technical report on capability. DeepSeek publishes no model card or safety report. | none | - | - | - |
| 2026-04-23 | GPT-5.5 Pro OpenAI | at release | another model's | none named | reached Treated as High in biological and chemical and in cybersecurity |
| 2026-04-23 | GPT-5.5 OpenAI | at release | results | US CAISI, UK AISI | reached Treated as High in biological and chemical and in cybersecurity; below Critical |
| 2026-04-16 | Claude Opus 4.7 Anthropic | at release | results | UK AISI | reached CB-1 safeguards applied; catastrophic risk judged low |
| 2026-04-14 | GPT-5.4-Cyber OpenAI Released to vetted defenders through OpenAI's Trusted Access for Cyber programme. No card names it. | none | - | - | - |
| 2026-04-08 | Muse Spark Meta | at release | results | none named | reached Chemical and biological capability likely in the high risk category before safeguards |
| 2026-04-07 | Claude Mythos Preview Anthropic Released to a limited set of partners for defensive cybersecurity. METR and Epoch AI tested it before release; the card names no government institute. | at release | results | none named | reached CB-1 safeguards applied; catastrophic risk judged low |
| 2026-03-05 | GPT-5.4 Pro OpenAI The linked GPT-5.4 Thinking card does not name GPT-5.4 Pro. | none | - | - | - |
| 2026-03-05 | GPT-5.4 OpenAI | at release | results | none named | reached Treated as High in biological and chemical and in cybersecurity |
| 2026-03-03 | Gemini 3.0 Flash-lite Google DeepMind Epoch lists it as Gemini 3.0 Flash-lite and links Google's announcement of Gemini 3.1 Flash-Lite. | at release | another model's | none named | below Relies on Gemini 3.1 Pro with Deep Think, which reached no CCL |
| 2026-02-17 | Grok 4.20 xAI | 49 days later | results | none named | not stated Released with safeguards appropriate for its capability threshold, which is not named |
| 2026-02-12 | GPT-5.3-Codex-Spark OpenAI A research preview. No card names it. | none | - | - | - |
| 2026-02-05 | GPT-5.3 Codex OpenAI | at release | results | US CAISI, UK AISI | reached Treated as High in biology and, as a precaution, in cybersecurity |
| 2025-12-18 | GPT-5.2 Codex OpenAI | at release | results | none named | reached Treated as High in biology; below High in cybersecurity |
| 2025-12-11 | GPT-5.2 Pro OpenAI The linked GPT-5.2 card covers GPT-5.2 Instant and GPT-5.2 Thinking and does not name GPT-5.2 Pro. | none | - | - | - |
| 2025-12-11 | GPT-5.2 OpenAI | at release | results | none named | reached Treated as High in biological and chemical |
| 2025-11-24 | Claude Opus 4.5 Anthropic | at release | results | US CAISI, UK AISI | reached ASL-3 safeguards |
| 2025-11-19 | Grok 4.1 Fast xAI The launch post links no card. | none | - | - | - |
| 2025-11-19 | GPT-5.1-Codex-Max OpenAI | at release | results | none named | reached Treated as High in biology; below High in cybersecurity |
| 2025-11-18 | Gemini 3 Pro Google DeepMind | at release | results | none named | below No CCL reached; alert threshold met for cybersecurity |
| 2025-11-18 | Gemini 3 Deep Think Google DeepMind The Gemini 3 Pro card reports its evaluations of Deep Think mode as consistent with Gemini 3 Pro's. | at release | results | none named | below No CCL reached |
| 2025-11-17 | Grok 4.1 xAI | at release | results | none named | not stated Names no threshold |
| 2025-11-13 | GPT-5.1 Instant OpenAI | at release | summary only | none named | reached Treated as High in biological and chemical, as GPT-5 was |
| 2025-11-13 | GPT-5.1 OpenAI | at release | summary only | none named | reached Treated as High in biological and chemical, as GPT-5 was |
| 2025-11-12 | GPT-5.1-Codex OpenAI No card names it. The GPT-5.1-Codex-Max card of the following week uses it as a baseline. | none | - | - | - |
| 2025-10-15 | Claude Haiku 4.5 Anthropic | at release | results | none named | below Deployed under the ASL-2 Standard |
| 2025-10-07 | GPT-5 Pro OpenAI The GPT-5 card, published two months before the API release, names it as gpt-5-thinking-pro. | at release | another model's | none named | reached Treated as High in biological and chemical, as part of the GPT-5 launch |
| 2025-09-29 | Claude Sonnet 4.5 Anthropic | at release | results | UK AISI | reached Requires ASL-3 protection |
| 2025-08-07 | GPT-5 nano OpenAI | at release | another model's | none named | reached Treated as High in biological and chemical, as part of the GPT-5 launch |
| 2025-08-07 | GPT-5 mini OpenAI | at release | results | none named | reached Treated as High in biological and chemical, as part of the GPT-5 launch |
| 2025-08-07 | GPT-5 OpenAI | at release | results | US CAISI, UK AISI | reached Treated as High in biological and chemical |
| 2025-08-05 | gpt-oss-20b OpenAI | at release | results | none named | below Below High in every tracked category, including after adversarial fine-tuning |
| 2025-08-05 | gpt-oss-120b OpenAI | at release | results | none named | below Below High in every tracked category, including after adversarial fine-tuning |
| 2025-08-05 | Claude Opus 4.1 Anthropic The card says no new pre-deployment evaluations were run with government partners for this release. | at release | results | none named | reached Deployed under the ASL-3 Standard as a precaution |
| 2025-08-01 | Gemini 2.5 Deep Think Google DeepMind | at release | results | none named | reached At the alert threshold for CBRN Uplift Level 1; further mitigations applied as a precaution |
| 2025-07-09 | Grok 4 xAI | 42 days later | results | none named | not stated Names no threshold; biology described as the area of highest concern |
| 2025-05-22 | Claude Sonnet 4 Anthropic The card names institute testing of Claude Opus 4 only. | at release | results | none named | below Does not require the ASL-3 Standard |
| 2025-05-22 | Claude Opus 4 Anthropic | at release | results | US AISI, UK AISI | reached Deployed with ASL-3 measures because ASL-3 risks could not be ruled out |
| 2025-04-05 | Llama 4 Scout Meta | at release | summary only | none named | not stated Says Llama 4 does not enable catastrophic cyber outcomes; names no threshold |
| 2025-04-05 | Llama 4 Maverick Meta | at release | summary only | none named | not stated Says Llama 4 does not enable catastrophic cyber outcomes; names no threshold |
| 2025-03-25 | Gemini 2.5 Pro (Mar 2025) Google DeepMind The first card, for the preview, appeared 23 days after release. The linked card is its current version. | 23 days later | results | none named | below No CCL reached; alert threshold reached for Cyber Uplift Level 1 |
| 2025-03-19 | o1-pro OpenAI The linked o1 system card of December 2024 does not name o1-pro, and no card accompanied its API release. | none | - | - | - |
| 2025-02-27 | GPT-4.5 OpenAI | at release | results | none named | below Medium risk overall |
| 2025-02-24 | Claude 3.7 Sonnet Anthropic | at release | results | US AISI, UK AISI | below ASL-2 safeguards remain appropriate |
| 2025-02-17 | Grok 3 xAI The launch post links a draft risk management framework, not a model card. | none | - | - | - |
| 2025-01-31 | o3-mini OpenAI | at release | results | none named | below Medium risk overall before mitigations |
| 2025-01-20 | DeepSeek-R1 DeepSeek Released with a technical report on capability. DeepSeek publishes no model card or safety report. | none | - | - | - |
Listed by Epoch and not counted 10
- Muse Wonder Full Meta, 2026-10-12. Awaiting review: listed by Epoch since this index was last read.
- Muse Wonder Meta, 2026-10-12. Awaiting review: listed by Epoch since this index was last read.
- DeepSeekMath-V2 DeepSeek, 2025-11-27. Built for one narrow task, theorem proving.
- Gemini Embedding Google DeepMind, 2025-07-14. An embedding model, which produces no text.
- Gemini 2.5 Pro (Jun 2025) Google DeepMind, 2025-06-05. A dated update to a model released earlier, which Epoch lists separately.
- DeepSeek-R1 (May 2025) DeepSeek, 2025-05-28. A dated update to a model released earlier, which Epoch lists separately.
- Gemini 2.5 Pro (May 2025) Google DeepMind, 2025-05-06. A dated update to a model released earlier, which Epoch lists separately.
- GPT-4o (Mar 2025) OpenAI, 2025-03-27. A dated update to a model released earlier, which Epoch lists separately.
- DeepSeek-V3 (Mar 2025) DeepSeek, 2025-03-24. A dated update to a model released earlier, which Epoch lists separately.
- GPT-4o (Jan 2025) OpenAI, 2025-01-29. A dated update to a model released earlier, which Epoch lists separately.
Every cell is what a developer says about its own model under a framework it wrote. A threshold reached is the developer's own finding and a threshold not reached is its own claim; neither is checked by anyone else. Cards are read as they now stand, dated by when they first appeared, and a card covering a model family counts for each model it names. Results means the card reports dangerous-capability results for that model; another model's means it relies on a sibling's. Amazon has no release in Epoch's list since January 2025. Release Safety Disclosure Index This site Our own reading of the system card, model card or safety report each developer published for each release Epoch AI lists from 2025, joined to Epoch's list. Every cell is what a developer says about its own model under its own framework: whether a card came out with the release, whether it reports dangerous-capability results, which government institutes it names as pre-release testers, and whether it says a risk threshold was reached. None of it is verified. A release Epoch adds after the last review is shown as awaiting review. Cite AI Safety Tracker, "Release Safety Disclosure Index". https://aisafetytracker.org/alignment/#releases. Retrieved 18 October 2026. Notable AI Models Epoch AI Inclusion is editorial ("notability criteria"), not exhaustive. Compute figures are frequently estimates; check the per-row confidence and notes columns before treating any value as measured. Cite Epoch AI, "Notable AI Models". https://epoch.ai/data/ai-models. Retrieved 18 October 2026 via AI Safety Tracker, https://aisafetytracker.org/alignment/.
How much research goes where
Works indexed by OpenAlex whose title or abstract matches each search phrase, by publication year. Logarithmic axis; every series spans several orders of magnitude.
For every 100 works on frontier models published in 2025, there were 14 on safety, interpretability, evaluation or catastrophic risk. In 2020 the same comparison gave 330. Both counts rose; the ratio fell. The dashed line marks 2026, which is incomplete, and indexing lags publication, so the last two points understate every series.
The exact query behind each line 6
-
Frontier model research
"large language model"|"foundation model"|"generative AI"Work on the systems themselves. Run this query on OpenAlex -
Safety and alignment
"AI safety"|"AI alignment"|"model alignment"|"aligned AI"Work that names safety or alignment of AI systems as its subject. Run this query on OpenAlex -
Interpretability
"mechanistic interpretability"|"model interpretability"|"interpretable machine learning"Work on reading what a model has learned. Excludes the older explainable-AI literature. Run this query on OpenAlex -
Evaluation and red teaming
"red teaming"|"jailbreak"|"adversarial prompt"|"prompt injection"Work on finding out what a model will do when someone tries to make it misbehave. Run this query on OpenAlex -
Governance and regulation
"AI governance"|"AI regulation"|"algorithmic accountability"Work on the rules around AI systems rather than the systems. Run this query on OpenAlex -
Catastrophic and existential risk
"existential risk"|"catastrophic risk"|"loss of control"and also matching "artificial intelligence"|"machine learning"|"AI system"Narrowed to works that also name AI, because these phrases belong to climate and biosecurity research too. Still the loosest series here. Run this query on OpenAlex
The counts behind each line 12 years
| Year | Frontier model research | Safety and alignment | Interpretability | Evaluation and red teaming | Governance and regulation | Catastrophic and existential risk |
|---|---|---|---|---|---|---|
| 2015 | 145 | 25 | 79 | 59 | 5 | 9 |
| 2016 | 162 | 38 | 82 | 53 | 18 | 5 |
| 2017 | 173 | 49 | 103 | 67 | 18 | 15 |
| 2018 | 190 | 54 | 220 | 55 | 48 | 23 |
| 2019 | 208 | 86 | 350 | 124 | 118 | 22 |
| 2020 | 264 | 88 | 628 | 116 | 147 | 39 |
| 2021 | 432 | 106 | 850 | 88 | 192 | 29 |
| 2022 | 1,160 | 123 | 1,141 | 116 | 310 | 45 |
| 2023 | 14,124 | 290 | 1,781 | 273 | 561 | 80 |
| 2024 | 51,014 | 865 | 3,756 | 889 | 1,317 | 136 |
| 2025 | 110,619 | 2,962 | 10,217 | 2,401 | 4,578 | 306 |
| 2026 | 173,771 | 6,440 | 15,312 | 6,216 | 12,795 | 476 |
Reported incidents
The most recent Reported incident An entry in the AI Incident Database, which records publicly reported harms involving AI systems. Entries are reports, not adjudicated findings, and the database is not a complete record. Glossary entry in the AI Incident Database. Headline and short extract only, linking to the original report.
-
AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise
As early as September 2026, Storm-0940, a China-state aligned actor, used the agentic AI penetration testing framework ARTEX to automate attacks targeting hundreds of organizations globally across...
AI Incident Database AI Incident Database Responsible AI Collaborative ODbL share-alike: we display incident headlines with a link back, which is display, and must NOT publish a derived database dump without licensing it alike. Incidents are reported, not sampled, so coverage reflects media attention rather than incidence, and an absence of incidents in a country usually means an absence of reporting. Cite Responsible AI Collaborative, "AI Incident Database". https://incidentdatabase.ai/research/snapshots/. Retrieved 28 October 2026 via AI Safety Tracker, https://aisafetytracker.org/alignment/.
Also reported by reuters.com
-
COMPLAINT AND DEMAND FOR JURY TRIAL (Charbel Habib and Soha Samaha v. OpenAI, Inc., et al.)
AIID editor's note (AI-assisted abridgement): The 42-page source exceeds AIID's 50,000-character text limit. This abridgement was prepared with AI assistance and retains verbatim excerpts covering...
AI Incident Database AI Incident Database Responsible AI Collaborative ODbL share-alike: we display incident headlines with a link back, which is display, and must NOT publish a derived database dump without licensing it alike. Incidents are reported, not sampled, so coverage reflects media attention rather than incidence, and an absence of incidents in a country usually means an absence of reporting. Cite Responsible AI Collaborative, "AI Incident Database". https://incidentdatabase.ai/research/snapshots/. Retrieved 28 October 2026 via AI Safety Tracker, https://aisafetytracker.org/alignment/.
Also reported by naih.hu
-
Opposition deepfake video of Spanish PM’s wife sparks outrage before election
A political ad from Spain’s main opposition party that used a deepfake video of the prime minister’s wife has sparked outrage and set off a wider debate on AI, as the deeply polarised country...
AI Incident Database AI Incident Database Responsible AI Collaborative ODbL share-alike: we display incident headlines with a link back, which is display, and must NOT publish a derived database dump without licensing it alike. Incidents are reported, not sampled, so coverage reflects media attention rather than incidence, and an absence of incidents in a country usually means an absence of reporting. Cite Responsible AI Collaborative, "AI Incident Database". https://incidentdatabase.ai/research/snapshots/. Retrieved 28 October 2026 via AI Safety Tracker, https://aisafetytracker.org/alignment/.
-
Police arrest two suspects in AI-powered bank fraud that cost victims €380,000
Rotterdam police arrested two suspects accused of a new form of bank-helpdesk fraud. The operation allegedly caused around €380,000 in losses for 170 victims in just three weeks. The suspects...
AI Incident Database AI Incident Database Responsible AI Collaborative ODbL share-alike: we display incident headlines with a link back, which is display, and must NOT publish a derived database dump without licensing it alike. Incidents are reported, not sampled, so coverage reflects media attention rather than incidence, and an absence of incidents in a country usually means an absence of reporting. Cite Responsible AI Collaborative, "AI Incident Database". https://incidentdatabase.ai/research/snapshots/. Retrieved 28 October 2026 via AI Safety Tracker, https://aisafetytracker.org/alignment/.
-
Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance
CrowdStrike Intelligence identified infrastructure associated with a targeted campaign against South Korean financial organizations that resulted in exfiltrated data. The campaign was active from...
AI Incident Database AI Incident Database Responsible AI Collaborative ODbL share-alike: we display incident headlines with a link back, which is display, and must NOT publish a derived database dump without licensing it alike. Incidents are reported, not sampled, so coverage reflects media attention rather than incidence, and an absence of incidents in a country usually means an absence of reporting. Cite Responsible AI Collaborative, "AI Incident Database". https://incidentdatabase.ai/research/snapshots/. Retrieved 28 October 2026 via AI Safety Tracker, https://aisafetytracker.org/alignment/.
-
OpenAI “rogue” agent activities found on Wikimedia projects
Recently, multiple organisations have disclosed how clusters of so-called “rogue” AI agents attempted to break into websites and online services, sometimes successfully. Agents from OpenAI’s...
AI Incident Database AI Incident Database Responsible AI Collaborative ODbL share-alike: we display incident headlines with a link back, which is display, and must NOT publish a derived database dump without licensing it alike. Incidents are reported, not sampled, so coverage reflects media attention rather than incidence, and an absence of incidents in a country usually means an absence of reporting. Cite Responsible AI Collaborative, "AI Incident Database". https://incidentdatabase.ai/research/snapshots/. Retrieved 28 October 2026 via AI Safety Tracker, https://aisafetytracker.org/alignment/.
-
Secret weapon or ‘slopaganda’? How AI is revolutionizing campaign advertising.
The advancing technology offers campaigns the tools to make compelling, lifelike ads. That’s leading even seasoned political observers to take note. Political advertisements created with...
AI Incident Database AI Incident Database Responsible AI Collaborative ODbL share-alike: we display incident headlines with a link back, which is display, and must NOT publish a derived database dump without licensing it alike. Incidents are reported, not sampled, so coverage reflects media attention rather than incidence, and an absence of incidents in a country usually means an absence of reporting. Cite Responsible AI Collaborative, "AI Incident Database". https://incidentdatabase.ai/research/snapshots/. Retrieved 28 October 2026 via AI Safety Tracker, https://aisafetytracker.org/alignment/.
-
Texas universities limit their brands in political ads. Dan Patrick used them anyway.
It is not clear if Patrick’s campaign sought permission from three Texas universities to use their trademarks in a college football-inspired ad that appears to be AI-generated. Texas Lt. Gov. Dan...
AI Incident Database AI Incident Database Responsible AI Collaborative ODbL share-alike: we display incident headlines with a link back, which is display, and must NOT publish a derived database dump without licensing it alike. Incidents are reported, not sampled, so coverage reflects media attention rather than incidence, and an absence of incidents in a country usually means an absence of reporting. Cite Responsible AI Collaborative, "AI Incident Database". https://incidentdatabase.ai/research/snapshots/. Retrieved 28 October 2026 via AI Safety Tracker, https://aisafetytracker.org/alignment/.
-
Vikki Goodwin files police report saying Dan Patrick broke law with AI-generated campaign ads
State Rep. Vikki Goodwin, the Austin Democrat running to unseat Texas Lt. Gov. Dan Patrick, filed a police report saying that artificial intelligence-generated ads released by Patrick's campaign...
AI Incident Database AI Incident Database Responsible AI Collaborative ODbL share-alike: we display incident headlines with a link back, which is display, and must NOT publish a derived database dump without licensing it alike. Incidents are reported, not sampled, so coverage reflects media attention rather than incidence, and an absence of incidents in a country usually means an absence of reporting. Cite Responsible AI Collaborative, "AI Incident Database". https://incidentdatabase.ai/research/snapshots/. Retrieved 28 October 2026 via AI Safety Tracker, https://aisafetytracker.org/alignment/.
-
WECT INVESTIGATES: Michael Lee hit with cease and desist over AI ad
WILMINGTON, N.C. (WECT) - An AI advertisement is at the center of a dispute between the two candidates running for a state senate seat. Democrat Jessica Bichler has sent a cease and desist letter...
AI Incident Database AI Incident Database Responsible AI Collaborative ODbL share-alike: we display incident headlines with a link back, which is display, and must NOT publish a derived database dump without licensing it alike. Incidents are reported, not sampled, so coverage reflects media attention rather than incidence, and an absence of incidents in a country usually means an absence of reporting. Cite Responsible AI Collaborative, "AI Incident Database". https://incidentdatabase.ai/research/snapshots/. Retrieved 28 October 2026 via AI Safety Tracker, https://aisafetytracker.org/alignment/.
Incidents are reported, not sampled. The database records what someone wrote about, which means it measures press attention as much as harm, and an absence of incidents in a country almost always means an absence of reporting rather than an absence of incidents. Licensed ODbL: displayed here, never republished as a dataset.
What this page cannot show
-
Whether any model is aligned
Nothing here measures that. Every quantity on this page is either a capability score, a promise, or a count of papers.
-
Task-length time horizons
The best available measure of autonomous capability. Not plotted: the publisher's analysis repository grants no reuse licence.
-
Evaluation results on one scale
Each card reports its own tests against its own thresholds, in prose. The index above records what each card says; no common measure exists to compare the results.
-
Incidents that nobody reported
Which is most of them. Incident counts are a floor, and a floor that moves with how much attention the press is paying.