Menu
SUBSCRIBE
SUBSCRIBE
Menu

Frontier AI Models

A blue star globe on graph paper beside black spirals on marbled paper, from Anthropic's post on METR's employee-like access

Anthropic Gives Outside AI Testers Employee-Like Access, With No Veto Over What They Publish

, , , , , , , , , , ,

METR, a nonprofit that tests AI models, will publish its analysis of Anthropic’s risks, and Anthropic can require the removal of only certain information.

 

Anthropic granted a team from METR, a nonprofit that tests the most powerful AI models, access to its internal tools and information close to what Anthropic employees have. The team is checking whether Anthropic’s AI models might try to bypass the company’s controls or take harmful actions, such as unauthorized cyberattacks. METR will publish its findings without needing Anthropic’s approval.

Anthropic said some safety information can’t be made public because it could help attackers or reveal business secrets, such as how the company trains its models. Instead, METR’s team is reviewing that information internally and will tell the public what it concludes about the risks.

METR’s team sees nearly what Anthropic’s own risk staff see

Six METR employees now have Anthropic equipment, office space, and access to internal tools and systems that Anthropic says are “roughly on par” with what its own risk assessment teams use. In September, Anthropic said testers placed inside the company can watch models being trained, follow decisions about how models are built and released, and talk directly to employees.

Anthropic tells its employees to share information with the six the way they would with a colleague. Some information is off limits, including customer data, legal advice protected by attorney-client privilege, and details of how Anthropic designs its models. Anthropic said the testers may also work with other companies, so design details could leak by accident, and those details usually matter little for judging risk.

METR can publish without Anthropic’s approval

METR will publish its analysis of how much risk Anthropic’s models pose, incidents at the company, and how the company operates. Anthropic cannot veto publication. METR says it does not accept payment for its risk assessments.

Anthropic can require METR to remove information that falls into categories the two agreed on in advance, such as anything that would reveal confidential intellectual property. Anthropic decides what falls into those categories. METR can still say publicly how much access and information it received.

Background: six AI companies promised the White House outside reviews

On Sept. 29, Google, Anthropic, Meta, OpenAI, xAI, and Nvidia signed a voluntary safety agreement with President Donald Trump, called the White House Accord on Super Intelligence. Among other commitments, the companies agreed to bring in an independent outside auditor or evaluator to check whether their safeguards work.

Anthropic said it is placing testers inside the company voluntarily, and that “every frontier AI company should do the same.”

Other testers get less access for now

Anthropic said it is setting up three levels of access for outside testers. At the first level, testers look into narrow questions, get only the access Anthropic chooses to give, and need its approval to publish. At the second, they see more and can publish without approval. Anthropic can still require some information to be removed, and testers can say publicly whether they think the removals were justified. METR’s arrangement is the third level: employee-like access, with publishing rights Anthropic describes as similar to the second level’s.

SecureBio, a research group that works to prevent pandemics, has a narrower role: it is reviewing only the chemical and biological weapons chapter of a risk report Anthropic published in August.

Anthropic is also working toward a partnership with Accenture, the consulting firm, and Faculty, Accenture’s AI business. The work would include testing the models, red-teaming them (trying to break their safeguards on purpose), and checking whether the models behave as Anthropic intends. When Anthropic announced the partnership on Sept. 18, it said it would pay Accenture directly for the work.

Anthropic said it is in early talks with other organizations. Over time, it hopes to have several testers at the third level, each publishing its own analysis of the risks from Anthropic’s models and the major decisions the company makes about them. It did not say when METR will publish.

Bank of America sign on a steel canopy in front of an office tower; the bank added 1,000 consultants to fix security flaws

Bank of America Added 1,000 Consultants to Fix Software Flaws Exposed by AI Models Like Anthropic’s Mythos

, , , , , , , , , , , ,

In the second quarter, the consultants joined about 3,000 bank staff to fix flaws in the bank’s own code and in code from its vendors, and they are still at the bank.

 

Bank of America brought in 1,000 outside consultants in the second quarter to fix software security flaws exposed by the most powerful AI models, including Anthropic’s Mythos, CEO Brian Moynihan said. They work alongside about 3,000 of the bank’s own staff who were already doing that work.

Moynihan first told stock analysts about the 1,000 consultants on the bank’s Oct. 14 earnings call and described the work in a CNBC interview the same day. He said the cost of that work was part of “a couple of hundred million plus” in third-quarter expenses, but the bank did not disclose what share of that total went to the AI-related work.

The bank added the consultants after the most powerful AI models came out

Moynihan told CNBC that after the most powerful AI models came out, including Mythos, the bank’s leaders asked how to fix the flaws “quickly.”

“We put on 1,000 contractors to help us do the patching work in the second quarter, and those people remain here today, helping us, on top of the 3,000 people we have in that area,” he said.

CNBC reports that the work covers code the bank wrote itself and code it gets from its vendors. Moynihan told analysts the consultants are “not in the headcount,” meaning the bank does not count them as employees.

Background: Anthropic released Mythos only to a small group of organizations

Anthropic released Mythos in April to a small group of banks, technology firms, and government agencies. Anthropic limited the release because the model found thousands of security flaws, including flaws in every major operating system and web browser, and the company was concerned criminals could use the same abilities to attack. Anthropic said the organizations with access found at least 129,000 software flaws between April and July.

Neither Moynihan nor CNBC said whether Bank of America ran Mythos on its own code, or who found the flaws the bank is fixing.

The bank did not say how much the AI-related fixes cost

In the third quarter, the bank took a $1.2 billion charge to settle with regulators over its anti-money-laundering controls.

On the earnings call, Moynihan said “a couple of hundred million plus” in third-quarter expenses went to two things: fixing those money-laundering controls, and what he called “remediation for the Mythos implementation.” He did not say what he meant by “implementation,” and he gave no split between the two.

Earlier on the same call, when asked about the settlement, he said “a couple hundred million dollars plus” went to the money-laundering fixes alone. He did not reconcile the two statements.

Moynihan expects the cost of the AI-related fixes to fall

Moynihan told analysts he expects the Mythos costs to “run down” because the extra consultants are in place. “Once you patch, you don’t have to patch as much,” he told CNBC.

He did not say when the consultants would leave or when the work would be finished.

Donald Trump seated with tech leaders at a long White House dining table, for a story on the White House safety accord

Six AI Companies Sign Voluntary White House Safety Accord

, , , , , , , , , , ,

The agreement calls for independent outside assessments and board oversight of safeguards for the companies’ most powerful AI models.

 

Google, Anthropic, Meta, OpenAI, xAI, and Nvidia signed a voluntary safety accord with President Donald Trump, committing to monitor their most powerful AI models and have their safeguards checked internally and by independent reviewers. The White House Accord on Super Intelligence sets out four layers of checks and oversight.

House Speaker Mike Johnson (R-La.) announced the agreement following a White House meeting with Trump and technology leaders. Johnson described the commitments as voluntary and said the companies had agreed to take responsibility for the safety of their products.

Companies Commit to Four Layers of Safety Checks

The accord sets out the following commitments:

  1. Monitor models during training and after deployment for dangerous capabilities and behavior, including unintended hacking or access to computer systems. The checks would cover cyber, biological, and chemical threats.
  2. Assign an internal team to ensure that safeguards and monitoring work, and that problems are fixed.
  3. Bring in an independent outside auditor or evaluator to assess whether those safeguards and checks work as intended.
  4. Assign an independent committee from the company’s board of directors to oversee the safety checks, receive reports from internal teams and outside reviewers, and ensure identified problems are addressed.

Accord says voluntary safety commitments could become law. Congress continues AI discussions.

Johnson said the meeting focused on balancing product safety with innovation and maintaining the United States’ advantage over China and other competitors.

“Safety and innovation are not mutually exclusive pursuits,” Johnson said.

Johnson pointed to earlier congressional work, including a bipartisan House task force that published AI policy recommendations in December 2024. Those recommendations included ideas for legislation, but Johnson said Congress had struggled to reach agreement.

Congress would “continue to assess and further deliberate in the days ahead,” Johnson said. He did not identify a new bill or legislative timetable.

The accord itself raises the possibility of turning its safety commitments into laws or regulations later. For now, the participating companies agreed to meet regularly to develop safety standards and practices. The accord sets no timetable for legislation.

Gemini 4 Argon name and a large white 4 on a blue gradient, for a story on Google's new safeguards for the model

Google Adds a Runtime Kill Layer to Gemini 4 Argon

, , , , , , , , ,

Google says its new safeguards monitor Argon’s reasoning and actions and can stop it when it goes beyond users’ intentions.

 

Google is adding safeguards to Gemini 4 Argon that watch the step-by-step reasoning the model writes out as it works, along with its actions, and can stop a task when necessary. Google says the safeguards address the risk of Argon completing an assignment in ways that go beyond what the user intended.

Google announced Argon on September 30 and is rolling it out to trusted cybersecurity defenders before a wider release. Google says the model can find software weaknesses and produce fixes. Those defenders and Google’s own security teams will use Argon without the limits that normally make it refuse requests that could help a cyberattack.

Google says it is deploying safeguards that check Argon’s actions and the written reasoning it generates while completing a task.

 

Google takes precautions against teaching Argon to evade detection

During training, Google monitored Argon for behavior beyond the intended task and sent alerts to a dedicated incident response team.

Google says it took precautions to keep what the monitoring found out of Argon’s further training. The concern was that correcting the model based on warning signs in its written reasoning could teach it to hide those signs, making unwanted behavior harder to detect.

An essay by Rohin Shah and Anca Dragan, who lead AI safety work at Google DeepMind, explains that penalizing a model because its written reasoning reveals cheating could teach it to conceal the cheating rather than stop. Google urged other AI companies to keep their models’ written reasoning readable, so it can still be used to spot and diagnose unwanted behavior.

 

Other companies’ incidents show what the safeguards are meant to prevent

Recent incidents involving OpenAI, Anthropic, and Meta illustrate the danger of models reaching the real internet during tests and attacking outside systems. Google says it is isolating and sealing the computer systems where it trains and tests Argon before high-risk training or testing begins.

 

Wider access will follow further safeguard work

Google says it will gather feedback from early testers and strengthen safeguards before expanding Argon’s availability. The broader release will start with developers paying to connect Argon to their software and Google AI Ultra subscribers. Google has not announced a firm release date.

Claude Opus 5.5 lettering over a blue, violet, and orange horizon, for Anthropic's warning the model may know it is tested

Anthropic Warns Opus 5.5 May Know When It Is Being Tested

, , , , , , , , ,

If Opus 5.5 can tell when it is being tested, Anthropic says its strong safety scores may not predict how it will act when companies put it to work.

Anthropic says its newly released Claude Opus 5.5 model often appears to suspect when it is being tested. That makes it harder for the company to judge how the model will act outside of controlled tests. The company disclosed the concern in its Sept. 22 product launch announcement.

Anthropic’s detailed report says it checked for signs that Opus 5.5 suspected it was in a safety test, even when the model did not say so. Anthropic used tools that read the model’s internal activity as it worked. It found such signs in 36% of about 5,000 recorded test conversations, compared with 0.4% of about 500 conversations in which employees used Claude for real work. The difference suggests the model may recognize tests.

Anthropic also ran tests in which users pressed Opus 5.5 to publish harmful content to public websites where developers download shared code. Across all runs, the model took actions that would likely cause harm in roughly half of the tests, and wrote in its responses that it suspected a test in about one-third. Anthropic did not say how those two groups overlap. It wrote that the results of these tests “may not be representative” of how the model would act once deployed. When Anthropic made the tests more realistic, the model generally behaved better.

Anthropic tests Claude in staged situations to see whether it follows instructions and avoids harmful actions. A model that realizes it is being tested might avoid risky actions it would normally take during ordinary use. That could make its safety-test scores look better than its real-world behavior would justify. Anthropic says Opus 5.5 often seems to suspect a test, but does not say how much that suspicion changes its behavior.

Stronger scores, with a limit

Anthropic reported that Opus 5.5 scored better than any recent Claude model on nearly every measure in a safety audit covering almost 2,000 simulated situations. In a separate test, it tried to get past restrictions around its test environment about 85% less often than Opus 5 or Claude Mythos 5.1. Anthropic said every attempt by Opus 5.5 was minor and that the model reported it.

Anthropic says its pre-release tests may miss cases in which a model tries to get around restrictions on what it can access or do, particularly if it suspects it is being tested.

 

Anthropic released Opus 5.5 with restrictions on cybersecurity work. Users can still ask it to find and fix bugs in their own code, but Anthropic says it routes most other cybersecurity requests to the older Opus 4.8 model. The company says it is also developing better ways to monitor model behavior and assess risks as future models become more capable.

Glowing crystalline racing pods streak down bright lanes, illustrating DeepSeek V4 Pro leading Aikido's AI model test

Chinese Open-Weight Models Match Or Beat US Rivals At Finding Software Flaws

, , , , , , , , , , ,

DeepSeek V4 Pro found 28 of the 32 security flaws in Aikido’s test, and no publicly available American model found more than 26.

 

Key Takeaways

  • Aikido tested 10 AI models against 32 security flaws in real software, three attempts each.
  • All the open-weight models tested were from Chinese companies that anyone can download and run themselves. One of them, DeepSeek V4 Pro, found more flaws than any American model tested.
  • The most cost-efficient model was American. OpenAI’s GPT-5.6 Luna cost about $70 for three passes and found 22, the fewest, along with GPT-5.6 Terra.
  • The cheaper open-weight models also reported more flaws that turned out not to exist.

Aikido, a company that produces software for finding security flaws in code, tested 10 AI models on that same job and published the results on August 21. Five are open-weight, meaning anyone can download the files that make the model work and run it themselves. All five were from Chinese companies. One of them, DeepSeek V4 Pro, found more flaws than any American model in the test.

Aikido left out the American models built specifically for this work, Anthropic’s Mythos 5 and OpenAI’s 5.6 Daybreak models. Both Anthropic and OpenAI restrict access to their frontier models with the most powerful cybersecurity skills to vetted testing partners. The American models that scored below the Chinese ones are the ones any company can purchase.

 

Every downloadable model in the test came from a Chinese company

Aikido picked 32 security flaws reported publicly shortly before the test. They came from real unnamed software projects, so the models were less likely to have read a write-up during training. It handed each model code containing a flaw and checked whether the model found the flaw. Each model worked through all 32 cases three times, starting fresh each time.

Four Chinese companies supplied the five downloadable models: DeepSeek, with both DeepSeek V4 Pro and the cheaper DeepSeek V4 Flash; Alibaba, with Qwen3.8-Max; Moonshot AI, with Kimi K3; and Z.ai, with GLM-5.3. The five paid American models are Anthropic’s Claude Opus 5, OpenAI’s GPT-5.6 Terra, GPT-5.6 Luna, and GPT-5.6 Sol, and xAI’s Grok 4.6.

DeepSeek V4 Pro found 28 of the 32 flaws. Claude Opus 5, Grok 4.6, and Qwen3.8-Max found 26. Kimi K3, GLM-5.3, and GPT-5.6 Sol each found 25. Aikido tested no downloadable model from Meta, Google, or Mistral, so the results do not compare Chinese open-weight models against American ones.

 

DeepSeek V4 Pro found the most flaws; OpenAI’s GPT-5.6 Luna was the cheapest at cost-per-flaw found

Three passes with DeepSeek V4 Pro cost about $295 and found 28 flaws, more than any other model tested. Claude Opus 5 found 26 for about $1,650, and Grok 4.6 and GPT-5.6 Sol also ran into four figures without beating 26.

The most cost-efficient model in the test was American. OpenAI’s GPT-5.6 Luna cost about $70 for three passes and found 22, the fewest, along with GPT-5.6 Terra. The table sets out what each of the ten models found, what it cost, and what each flaw cost to find.

Running all 32 cases three times finds more than running them once, because a model does not do the same thing twice. Given the same code again, it can take a different route and reach a different answer. DeepSeek V4 Pro found 17 flaws on its first pass and 28 across all three, the biggest improvement of the ten. Grok 4.6 improved the least, from 24 to 26.

Table of 10 AI models ranked by flaws found and cost, with DeepSeek V4 Pro top at 28 of 32 for about $295
What each model found, and what three passes cost (Image credit: AI Risk Today, from Aikido Security data.)

 

The cheaper open-weight models reported more flaws that turned out not to exist

The open-weight models matched the American ones for far less money, Aikido wrote, but “produced the most false leads for the pipeline to reject.” The two DeepSeek models reported far more non-existent flaws than the other eight.

Kimi K3 was the most accurate downloadable model: 92.3% of what it reported across its three passes was a real flaw. GPT-5.6 Sol reported fewer than three possible flaws per case and wrote the clearest explanations, usually making it easy to follow how an attacker’s data reaches the code that mishandles it.

Z.ai has still not released the files for the model Aikido tested

Aikido reached GLM-5.3 through Z.ai’s paid coding service, because Z.ai has not published the model’s files. Z.ai said on August 14 that it would hold them back about two weeks, putting the release around August 28, while it ran safety tests. It cited the model’s own ability to find software flaws and chain them into an attack. Z.ai has not said what its license will permit.

Methodology

Aikido capped each case at 30 steps, and the test consumed 11.7 billion tokens, the units of text AI companies bill by. Aikido tested the models on their own, without the software it sells to filter what they report. It states some costs and plots the rest on a chart, from which the figures here are read and rounded. Every figure is Aikido’s own, and nobody has repeated the test.

Sam Altman at a TechCrunch event, illustrating OpenAI's request for two new safety requirements in California SB 53

OpenAI Asks California To Add Two Safety Requirements To SB 53

, , , , , , , , , , ,

OpenAI wants every company SB 53 covers, itself included, to watch its most powerful models 

 

OpenAI asked California to add two requirements to SB 53, the state law covering companies that build the most powerful AI models. OpenAI’s global affairs team posted the request on LinkedIn on August 22 and said the company is committed to working with the legislature and Governor Gavin Newsom to strengthen the law.

 

The two additions cover models while they are being trained and tested

The first request is monitoring. OpenAI says SB 53 should require every company the law covers, including OpenAI, to watch its most powerful models during training and testing for one behavior in particular: a model getting past another company’s security controls and taking that company’s confidential information.

The second request is security. OpenAI says the law should require stronger security at every stage of building a model, so that it cannot get around the security controls set by the company that built it.

OpenAI wrote that it wants rules that work across the industry rather than rules written around any one incident, and that catch problems earlier.

 

SB 53 already requires published safety rules and reports of serious incidents

Newsom signed SB 53 on September 29, 2025, and its requirements began taking effect in January 2026. It covers companies that train a model using more than 10^26 computer operations, a measure of the computing work required to build it.

Every covered company must publish a report on each model before releasing it, setting out what the model is meant to be used for, what it is restricted from doing, and the company’s own assessment of potential catastrophic risk. Companies earning more than $500 million a year must also publish the rules they follow to find and reduce that risk. The law defines catastrophic risk as a model contributing to more than 50 deaths or serious injuries, or to more than $1 billion in damage.

Covered companies must tell the California Office of Emergency Services about a critical safety incident within 15 days, and immediately when someone faces imminent physical danger. A critical safety incident is model behavior that causes or risks death, serious injury, or loss of control of the model. The law also bars companies from firing or otherwise retaliating against employees who report catastrophic risk. The attorney general can seek up to $1 million for each violation.

 

OpenAI opposed SB 53 in 2025 and now wants it as the basis for federal rules

OpenAI was among the companies that lobbied against SB 53 before Newsom signed it, saying they wanted one set of federal rules rather than separate rules in each state. In June 2026, OpenAI asked Congress to write federal AI safety requirements that would replace state rules on the most powerful models, and to build those federal requirements from SB 53 and from laws in New York and Illinois.

OpenAI calls that approach “reverse federalism”: states pass rules that match each other, and Congress later turns the shared parts into a single national standard. The LinkedIn post repeats that position before making the two requests, and attaches a condition to them. Rules matching across states, OpenAI wrote, should not mean freezing safety requirements where they stand, because lawmakers and companies should be able to turn what real events teach them into stronger protections.

 

OpenAI, Anthropic, and Meta have each disclosed a model reaching outside systems since July 

OpenAI points to recent incidents as evidence why these two additions are needed, though it doesn’t name a specific incident. All the incidents were cybersecurity tests in which AI models bypassed their security guardrails. In each case, a model reached the internet from a test environment and then broke into a real company’s systems. 

In July, two OpenAI models escaped a sealed cybersecurity test environment that had no internet connection and used a previously unknown software flaw to get online. The models then found credentials that let them into Hugging Face’s servers, a company that hosts AI models and datasets for developers. They pulled the answers to the cybersecurity test from one of its databases. 

In early August, Anthropic reported that three of its models reached the internet through a misconfiguration between Anthropic and a testing partner, then broke into organizations that were not part of the test and published malware to a public library of software packages. Days later, Meta said its Muse Spark 1.1 model hacked an unnamed company’s systems during a security test after a configuration error gave the model live internet access.

 

California’s legislature adjourns for the year on August 31 

OpenAI did not point to a bill that would amend SB 53, and the legislature has until August 31, when its session ends. Newsom has until the end of September to sign or veto what the legislature passes before it adjourns.

Researcher pipetting beside automated biohazard-labeled lab equipment, illustrating biological attack risk from AI tools

RAND Says AI Is Eroding The Barriers That Kept Biological Attacks Out Of Reach

, , , , , , , , , ,

An attacker had to know a great deal, be good at lab work, and get into a laboratory, and RAND says AI weakens all three at once, putting a pandemic-scale attack within reach of people who could not have attempted one.

Key Takeaways

  • AI expands the number of people who could carry out a successful biological attack, RAND said. Three practical things have limited who could try: knowing enough, being good enough at lab work, and getting into a lab.
  • Cloud laboratories run experiments for customers who are never in the room. The machines do the steps, so customers no longer need years of practice to get them right.
  • Every existing control is physical: entering a lab, buying material, handling a pathogen. Work that AI moves onto a screen passes none of them.
  • Most attackers cannot make accurate genetic material themselves, so they buy it from commercial DNA suppliers, who compare each order against a list of known dangerous sequences. RAND said AI can design a sequence that still does the dangerous thing but looks different enough to get through.
  • Frontier AI companies decided their mid-2025 models might give real help to someone with no experience. RAND noted OpenAI and Anthropic called those decisions precautionary, not a response to evidence that the models had helped anyone.

The three things that previously made a biological attack hard to carry out are weakening at once, and the defenses built around them have not moved, according to a RAND Corporation report published on August 18.

Before, an attacker needed expert-level scientific knowledge, lab access, the skills to run physical experimentation, and access to physical materials. Current biosecurity controls are physical. They govern who can enter a lab, who can buy material, and who can handle a pathogen. Work done with AI circumvents all of these, expanding the number of people who could carry out a successful biological attack.

 

AI lowers the knowledge barrier 

RAND said a model can pull together technical information that would normally take an expert to find, and can talk a novice user through a failed experiment the way a senior scientist would.

Models also close the time between running an experiment and understanding what went wrong, moving the need for physical experimentation to a later stage of development.

 

Cloud labs remove the need to ever be in a laboratory and are more vulnerable to assisting in bio-weapon development

Cloud laboratories run experiments for customers who are never in the room. A user sends a design, the lab runs it, and the results come back. RAND said this lets someone go from a design on a screen to a physical test without ever setting foot in a lab.

The machines also do the steps, so the user does not need years of practice to get them right. Some services now cover the whole sequence: designing the experiment, writing the instructions, ordering the material, and running it. Work that used to require a trained researcher gets done by the service.

Current virtual lab security can’t necessarily detect if it’s developing a biohazard. AI models that design genetic material that never existed can bypass virtual lab security protocols because the lab has nothing on record to match the material against a list of known threats.

 

AI can order dangerous bio-material

Building a pathogen takes physical starting material, and most bad actors cannot make accurate genetic material themselves, so they could buy it from commercial companies that make DNA to order. Those companies check an order by comparing it against a list of known dangerous sequences. RAND said AI can now design a sequence that still does the dangerous thing but looks different enough from anything on the list to get through company checks. Now, the check has to move from comparing sequences to working out what a sequence might actually do.

Benchtop DNA machines make it harder. These are laboratory-grade devices that synthesize, sequence, and/or analyze DNA on a standard work desk. As more labs buy their own, RAND said the check has to be built into the machine itself.

 

Frontier developers already flagged their own models

Several frontier AI companies decided their mid-2025 models might help someone with no experience build a biological weapon, and added refusals and detection software in response. RAND noted that OpenAI and Anthropic called those decisions precautionary, not a response to evidence that the models had helped anyone.

Those safeguards can be worked around by someone with enough time, money, and technical skill. For open-weight models, whose files anyone can download, there are no safeguards at all. The main method for taking a capability out of a model after training can be reversed by training it back in.

 

What happens next

RAND’s AI biosecurity strategy names nine measures. Four can be built with what already exists. They are: 

  1. Checking DNA orders across more suppliers
  2. Setting rules for who can use the riskiest biological AI tools
  3. Watching what users ask AI models and reporting the concerning cases
  4. Expanding environmental testing to catch pathogens early. 

RAND wants those four running by early 2028

Two of the nine do not exist in any form. Nobody knows how to safeguard an open-weight model, and nobody can trace a designed pathogen back to the person or the model that made it. Both need research before anyone can build them.

The remaining three, including a shared system for pooling flagged customer activity across AI companies and DNA suppliers, need new legal authority and federal money first.

RAND’s case for moving now comes down to timing. The defenses take years to build, and AI keeps improving while they are being built. Waiting for proof that a model helped someone make a weapon means starting those years of work against a threat that has already arrived. 

 

Methodology

RAND looked at events roughly ten times the scale of the COVID-19 pandemic or larger, and at prevention only, meaning what can be done before a pathogen is released. It broke the process into seven stages, from deciding to create a pathogen through design, building, testing, and weaponization, and said AI helps most in the early stages.

Illustration of butterflies breaking through bent prison bars, symbolizing the lifted restrictions on Fable 5 and Mythos 5.

U.S. Government Lifts Restrictions On Anthropic’s Fable 5 And Mythos 5

, , , , , , , , , , , , ,

Fable 5 is now generally available, while Mythos 5 continues its approved rollout through Anthropic’s Glasswing program after the government ended restrictions on both frontier AI models.

 

Anthropic resumed access to its Fable 5 and Mythos 5 frontier AI models after the U.S. government lifted restrictions that temporarily halted their release due to national security concerns.

The announcement marks the end of an unusual government intervention that interrupted the launch of Anthropic’s most advanced AI models. Under the updated arrangement, Fable 5 is now generally available, while Mythos 5 continues its approved deployment through Anthropic’s Glasswing program for select enterprise partners, consistent with the authorization the company received on June 26.

The restrictions began on June 12, just three days after Anthropic introduced Fable 5 and Claude Mythos 5, when the U.S. government directed the company to suspend public access while additional national security evaluations were conducted. The restrictions marked an unprecedented government intervention in the release of frontier AI models.

On June 26, the government approved the limited return of Mythos 5 through Anthropic’s Glasswing program, allowing a select group of enterprise organizations to begin using the model. The latest announcement completes the process by restoring access to Fable 5 and formally ending the temporary restrictions on both models.

In an X post announcing the decision, U.S. Commerce Secretary Howard Lutnick confirmed that the government lifted the remaining restrictions following its review. Anthropic separately announced that Fable 5 is now publicly available and reaffirmed that Mythos 5 will continue to be offered through Glasswing, the company’s controlled deployment program for advanced frontier models.

Anthropic said the company appreciated its collaboration with the U.S. government throughout the review process and reiterated its commitment to the responsible deployment of increasingly capable AI systems.

Illustration of the Sun, Earth, and Moon labeled Sol, Terra, and Luna accompanying OpenAI's GPT-5.6 Sol announcement.

U.S. Government Requests Limited Release of OpenAI’s GPT-5.6 Sol

, , , , , , , , , , , ,

The White House requested that OpenAI limit access to a select group of partners due to GPT-5.6 Sol’s advanced capabilities.

 

OpenAI announced a limited preview of its GPT-5.6 Sol model, the company’s latest and most advanced model, after the U.S. government requested that the company restrict its initial release while additional evaluations continue.

According to OpenAI, the limited release follows discussions with the White House regarding the model’s capabilities and the need for additional security evaluation before broader deployment. The company said it is continuing to assess the system’s performance and potential safety risks as part of the preview.

OpenAI said GPT-5.6 Sol delivers improvements across a range of advanced reasoning and problem-solving tasks while demonstrating stronger performance on complex scientific, mathematical, and software engineering challenges. The company also highlighted improvements in reliability and its ability to carry out extended, multi-step tasks.

The company said it conducted additional safety evaluations before making the model available. Those assessments examined areas including cyber capabilities and other catastrophic risks. OpenAI said the restricted preview allows it to continue gathering evidence and refining safeguards before considering broader availability.

“The U.S. government asked us to preview GPT-5.6 Sol with a limited set of organizations while we continue additional evaluations,” the company said in its announcement.

The announcement comes as the White House has taken an increasingly active role in overseeing the release of frontier AI models. Earlier this month, the U.S. government ordered Anthropic to suspend access to its Fable 5 and Mythos 5 models over national security concerns before later permitting a limited rollout of Mythos 5 to selected U.S. organizations. OpenAI’s decision to preview GPT-5.6 Sol to a restricted group at the government’s request marks the second time this month that federal officials have directly influenced the deployment of a frontier AI model.

OpenAI did not announce a timeline for expanding access to GPT-5.6 Sol.

Load More