Menu
SUBSCRIBE
SUBSCRIBE
Menu

National security

A glowing orange network sphere over a crowd at sunset, on national security experts and AI catastrophe risk

National Security Experts Put The Odds Of AI Escaping Control In The Next Ten Years At 33%

, , , , , , , , , ,

Most also said the odds of an AI catastrophe already exceed the most risk they would accept.

 

Key Takeaways

  • Asked for the odds that AI operates outside human control within ten years, half of the 111 people surveyed answered 33% or higher, and 87% answered 10% or higher.
  • 56 experts estimated how likely an AI catastrophe is. They also said how much risk they would accept. For 61%, the estimate was higher than the amount they would accept.
  • 74% rated testing and evaluating AI models highly effective against catastrophic risk, the highest score of any measure offered. In their written answers, respondents said the government has no independent ability to run those tests.
  • Among the 42 who answered the cybersecurity section, 88% expect AI to make cyber defense much stronger, and 57% still expect attackers to gain more from it at first.

The Institute for Security and Technology published the report AI and the Future of National Security, a survey of 111 people who work in US national security. Asked for the probability that AI operates outside human control within ten years, half of them answered 33% or higher, and 87% answered 10% or higher. A quarter answered below 15%, and a quarter answered above 75%.

Respondents are current and former civilian officials, military officers, and technical experts, mostly from the Department of Defense, State Department, the White House, Congress, and several intelligence agencies. 87% have served in the US government, half for ten years or more and nearly a quarter for 20 years or more. 

 

61% estimated more risk of an AI catastrophe than they would accept

The survey asked each person to estimate how likely an AI catastrophe is, meaning one that kills more than 10 million people before 2050. It also asked how much risk of that they would accept in return for the United States leading in AI. 56 people answered both, and 61% estimated it as equal to or higher than the amount they would accept. Another 24% said they could not put a number on how much they would accept. Both numbers come from the same person. 

 

Nobody has a process for acting on a warning sign

Respondents wrote repeatedly that nothing exists to act on a warning that AI is slipping beyond human control. Such a warning could be a system doing things nobody set it up to do, or oversight eroding so gradually that nobody can say what has been handed over to AI. No threshold, rule, or procedure says who would decide what happens next. Asked whether reliable warnings would appear at all before AI reaches human-level ability, they split 39% confident against 39% skeptical. 

The cybersecurity specialists were asked a narrower version of the same question: could operators regain control of an AI system that started doing more than it was set up to do. None were highly confident. 48% said it depends entirely on how the system was built, and 26% said it would be difficult or impossible.

 

The government has no way to check what these systems can do

Respondents said the government has no testing setup or benchmarks of its own, so it cannot check what an AI system can actually do before putting it to work. Too few people in government understand the technology well enough to judge it without those tests, so officials lean on what the AI companies tell them.

Asked which protections work best against catastrophic AI risk, they put testing and evaluating models first, with 74% calling it highly effective. The protection they rate most effective is the one they say the government cannot carry out.

 

Cyber specialists expect attackers to gain more from AI in the short term

42 respondents answered the cybersecurity section. 88% expect AI to make cyber defense much stronger. 57% still expect attackers to gain more from it in the near term.

What they rate as most dangerous is AI finding software flaws and building working attacks from them, which 52% called critical, more than any other capability. They said the danger comes from weaknesses that already exist, not from new kinds of attack. One respondent said the highest-risk targets are not well-resourced companies but the thinly staffed operators of water systems, rural power, and municipal services.

 

They agree on what should be required, and almost none of it is law

93% of the cybersecurity respondents said the government should set requirements for how companies handle AI cyber risk, rather than leaving it to the companies. They divided over the form, with a federal baseline plus industry-specific rules the most popular at 36%. 

 

The one law they want

96% of all respondents said a human must make any decision to use a nuclear weapon. Congress is already weighing that rule in two places. The Responsible Artificial Intelligence Defense Act, introduced in June by Senators Chris Coons and Jack Reed, would prohibit AI from making nuclear launch decisions and require the Pentagon to keep human judgment over decisions to use lethal force. It sits with a committee. The same bar appears separately inside the Senate Armed Services Committee’s draft of this year’s defense policy bill. Neither has become law. 

Researcher pipetting beside automated biohazard-labeled lab equipment, illustrating biological attack risk from AI tools

RAND Says AI Is Eroding The Barriers That Kept Biological Attacks Out Of Reach

, , , , , , , , , ,

An attacker had to know a great deal, be good at lab work, and get into a laboratory, and RAND says AI weakens all three at once, putting a pandemic-scale attack within reach of people who could not have attempted one.

Key Takeaways

  • AI expands the number of people who could carry out a successful biological attack, RAND said. Three practical things have limited who could try: knowing enough, being good enough at lab work, and getting into a lab.
  • Cloud laboratories run experiments for customers who are never in the room. The machines do the steps, so customers no longer need years of practice to get them right.
  • Every existing control is physical: entering a lab, buying material, handling a pathogen. Work that AI moves onto a screen passes none of them.
  • Most attackers cannot make accurate genetic material themselves, so they buy it from commercial DNA suppliers, who compare each order against a list of known dangerous sequences. RAND said AI can design a sequence that still does the dangerous thing but looks different enough to get through.
  • Frontier AI companies decided their mid-2025 models might give real help to someone with no experience. RAND noted OpenAI and Anthropic called those decisions precautionary, not a response to evidence that the models had helped anyone.

The three things that previously made a biological attack hard to carry out are weakening at once, and the defenses built around them have not moved, according to a RAND Corporation report published on August 18.

Before, an attacker needed expert-level scientific knowledge, lab access, the skills to run physical experimentation, and access to physical materials. Current biosecurity controls are physical. They govern who can enter a lab, who can buy material, and who can handle a pathogen. Work done with AI circumvents all of these, expanding the number of people who could carry out a successful biological attack.

 

AI lowers the knowledge barrier 

RAND said a model can pull together technical information that would normally take an expert to find, and can talk a novice user through a failed experiment the way a senior scientist would.

Models also close the time between running an experiment and understanding what went wrong, moving the need for physical experimentation to a later stage of development.

 

Cloud labs remove the need to ever be in a laboratory and are more vulnerable to assisting in bio-weapon development

Cloud laboratories run experiments for customers who are never in the room. A user sends a design, the lab runs it, and the results come back. RAND said this lets someone go from a design on a screen to a physical test without ever setting foot in a lab.

The machines also do the steps, so the user does not need years of practice to get them right. Some services now cover the whole sequence: designing the experiment, writing the instructions, ordering the material, and running it. Work that used to require a trained researcher gets done by the service.

Current virtual lab security can’t necessarily detect if it’s developing a biohazard. AI models that design genetic material that never existed can bypass virtual lab security protocols because the lab has nothing on record to match the material against a list of known threats.

 

AI can order dangerous bio-material

Building a pathogen takes physical starting material, and most bad actors cannot make accurate genetic material themselves, so they could buy it from commercial companies that make DNA to order. Those companies check an order by comparing it against a list of known dangerous sequences. RAND said AI can now design a sequence that still does the dangerous thing but looks different enough from anything on the list to get through company checks. Now, the check has to move from comparing sequences to working out what a sequence might actually do.

Benchtop DNA machines make it harder. These are laboratory-grade devices that synthesize, sequence, and/or analyze DNA on a standard work desk. As more labs buy their own, RAND said the check has to be built into the machine itself.

 

Frontier developers already flagged their own models

Several frontier AI companies decided their mid-2025 models might help someone with no experience build a biological weapon, and added refusals and detection software in response. RAND noted that OpenAI and Anthropic called those decisions precautionary, not a response to evidence that the models had helped anyone.

Those safeguards can be worked around by someone with enough time, money, and technical skill. For open-weight models, whose files anyone can download, there are no safeguards at all. The main method for taking a capability out of a model after training can be reversed by training it back in.

 

What happens next

RAND’s AI biosecurity strategy names nine measures. Four can be built with what already exists. They are: 

  1. Checking DNA orders across more suppliers
  2. Setting rules for who can use the riskiest biological AI tools
  3. Watching what users ask AI models and reporting the concerning cases
  4. Expanding environmental testing to catch pathogens early. 

RAND wants those four running by early 2028

Two of the nine do not exist in any form. Nobody knows how to safeguard an open-weight model, and nobody can trace a designed pathogen back to the person or the model that made it. Both need research before anyone can build them.

The remaining three, including a shared system for pooling flagged customer activity across AI companies and DNA suppliers, need new legal authority and federal money first.

RAND’s case for moving now comes down to timing. The defenses take years to build, and AI keeps improving while they are being built. Waiting for proof that a model helped someone make a weapon means starting those years of work against a threat that has already arrived. 

 

Methodology

RAND looked at events roughly ten times the scale of the COVID-19 pandemic or larger, and at prevention only, meaning what can be done before a pathogen is released. It broke the process into seven stages, from deciding to create a pathogen through design, building, testing, and weaponization, and said AI helps most in the early stages.

Mobile robot with sensors illustrating the FCC ban on foreign-produced mobile robots over AI security risks.

FCC Expands Foreign Hardware Ban Over AI Security Risks

, , , , , , , , ,

The restriction blocks new foreign-produced mobile robots and connected power inverters unless they receive a national security exemption.

 

The Federal Communications Commission (FCC) barred new foreign-produced mobile robots from entering the U.S. market, targeting security risks created by AI-powered machines that can collect data, interpret their surroundings, and move without direct human control.

The FCC did not limit the restriction to robots marketed as AI-powered. Instead, it covers foreign-produced mobile robots whose sensors, connectivity, and software allow them to navigate or move autonomously, collect data, or receive remote commands.

The FCC also restricted foreign-produced connected power inverters, which help manage electricity in power systems supporting, among other things, AI data centers and can create remote access points into those systems. 

The action applies only to new models. Foreign equipment authorized before July 28 can remain on the market.

Ban centers on AI robot risks

AI-powered mobile robots can use cameras, sensors and connected software to understand their surroundings and operate away from direct human supervision. Federal security agencies warned that compromised robots could collect sensitive information or allow an attacker to control their movement.

The FCC did not limit the restriction to products marketed as AI-powered. It covers connected mobile ground robots weighing more than 4.4 pounds that can sense their surroundings and operate away from a human supervisor. Their software may use AI or machine learning to interpret sensor information, control movement, collect data, or receive remote commands.

Each new covered foreign-produced model must receive federal security approval before it can seek FCC authorization. That creates a new barrier for Chinese and other foreign robotics manufacturers. Approval of an earlier model does not automatically clear later models.

Power inverters connect ban to AI infrastructure

The restriction also covers connected power inverters, used in managing electricity in systems that support AI data centers, among other power systems.

Federal security agencies warned that compromised inverters could interrupt electricity, provide remote access to connected systems, or expose sensitive information. The FCC added inverters and mobile robots to its Covered List after a White House-convened group of national security agencies determined that the devices could threaten critical infrastructure and U.S. security.

Ban is on new models only

The restriction applies only to new models. Companies and consumers can continue using previously purchased devices, and retailers can keep selling foreign-produced models the FCC authorized before July 28.

A separate FCC waiver allows previously authorized robots and power inverters to continue receiving software, firmware and security updates until at least Jan. 1, 2029. Federal purchases and use are also unaffected.

 

Foreign manufacturers can seek an exemption. The U.S. Department of Defense can approve covered robots or power inverters, while the Department of Homeland Security can also approve inverters. Manufacturers that receive approval can then apply for FCC authorization.

Sen. Elizabeth Warren speaks at a public event amid calls for the Pentagon to release details of its AI contracts.

Warren Presses Pentagon To Release AI Contracts Details

, , , , , , , ,

The Massachusetts senator is demanding copies of the Defense Department’s AI contracts and answers about the potential use of the technology in surveillance, targeting, and military operations.

Sen. Elizabeth Warren (D-Mass.) is pressing the Department of Defense (DoD) to release the full terms of its AI contracts with major AI companies and explain how the technology may be used inside classified military systems.

In letters to Defense Secretary Pete Hegseth and the AI frontier developers involved, Warren said the Pentagon disclosed little, other than stating that the systems may be used for any “lawful operational use.” She asked for copies of the contracts, related documents, and written responses by July 20.

The dispute centers on agreements announced by the Pentagon in May that allow the integration of commercial AI systems into classified networks. The DoD said the technology would help military personnel analyze information, improve situational awareness, and support decision-making in complex operational environments.

Warren argued that Congress and the public cannot evaluate the safeguards surrounding those systems because the AI contracts remain secret. In her letter to Hegseth, she wrote that the Pentagon has provided virtually no information on the restrictions governing the military’s use of the technology.

The senator asked whether the agreements prohibit domestic surveillance, fully autonomous weapons, or military uses with limited human oversight. She also questioned whether the DoD uses AI during target selection and how it verifies the accuracy of AI-generated recommendations.

Warren’s letter further asks whether the Pentagon uses or plans to use AI systems to analyze large datasets containing information about Americans, including commercially purchased location and personal data.

The senator also raised concerns about Anthropic’s public opposition to military uses involving mass surveillance and autonomous weapons. Warren asked whether the Pentagon is using negotiations with other AI suppliers to pressure Anthropic into accepting broader terms that would permit any lawful military use.

Her letters do not claim that the new contracts authorize those activities. Instead, Warren argues that lawmakers cannot determine what safeguards exist, or how broadly the technology may be deployed, until the agreements are made public.

Warren sent a separate set of questions to the AI companies with DoD contracts, asking whether the contracts permit surveillance or the use of autonomous weapons, whether employees can intervene if military uses violate internal safety policies, and how much visibility the companies retain once their systems deploy in classified environments.

Warren asked the DoD and the companies to provide as much information as possible so Congress can determine whether additional oversight or legislation is needed.

Abstract AI incident reporting image with glowing nodes and warning patterns for the AI Incident Reporting Act.

AI Incident Reporting Act Would Require Frontier AI Developers To Report Critical Incidents

, , , , , , , , ,

The proposal from Rep. Nathaniel Moran would give covered model developers seven days to report serious AI incidents to the Commerce Department.

 

Rep. Nathaniel Moran (R-Texas) introduced the AI Incident Reporting Act, a bill that would require developers of the most advanced AI models to report dangerous capabilities, security breaches, and safety incidents to the Department of Commerce.

The bill would apply to “covered model developers,” a category Commerce would define through capability thresholds for AI models that could pose significant risks to national security or public safety. Developers covered would have seven days to report critical incidents.

The legislation would require reporting when an AI model exhibits signs of rogue behavior, including evading human oversight or undermining human control.

It would also require reporting for several other categories of high-risk activity, including:

  • Unauthorized access to, theft of, or attempted theft of model weights (the numerical parameters learned during training that determine how an AI model processes inputs and generates outputs)
  • AI capabilities that could enable cyber attacks against critical infrastructure or widely used systems
  • Evidence that a model can accelerate or automate the development of more advanced AI systems
  • Capabilities that could enable the development or use of chemical, biological, radiological, nuclear, or explosive weapons
  • Serious near misses where harm was avoided because of outside circumstances, not the developer’s safeguards

For incidents that present an imminent or ongoing risk of serious harm, Commerce would have to notify congressional leaders and relevant committee chairs within 48 hours.

Commerce would have to issue reporting guidelines within 180 days after enactment. The bill also directs the department to create a secure reporting mechanism for AI companies.

“AI is a powerful engine of innovation, and I want to see it flourish, but not without accountability and not without human oversight,” Moran said in the press release. “The rule of law should apply to this new frontier.”

The bill also includes protections for sensitive information submitted to the government. Reports would be exempt from public disclosure, would not waive trade secret or attorney-client protections, and generally could not be used by federal, state, or local governments to regulate or bring enforcement actions against the developer.

Commerce could act based on reports to address risks to national security or public safety. The bill would also allow Commerce to share information with other agencies, including intelligence and law enforcement agencies, as appropriate.

The bill does not yet appear to have cleared committee.

Illustration of the Sun, Earth, and Moon labeled Sol, Terra, and Luna accompanying OpenAI's GPT-5.6 Sol announcement.

U.S. Government Requests Limited Release of OpenAI’s GPT-5.6 Sol

, , , , , , , , , , , ,

The White House requested that OpenAI limit access to a select group of partners due to GPT-5.6 Sol’s advanced capabilities.

 

OpenAI announced a limited preview of its GPT-5.6 Sol model, the company’s latest and most advanced model, after the U.S. government requested that the company restrict its initial release while additional evaluations continue.

According to OpenAI, the limited release follows discussions with the White House regarding the model’s capabilities and the need for additional security evaluation before broader deployment. The company said it is continuing to assess the system’s performance and potential safety risks as part of the preview.

OpenAI said GPT-5.6 Sol delivers improvements across a range of advanced reasoning and problem-solving tasks while demonstrating stronger performance on complex scientific, mathematical, and software engineering challenges. The company also highlighted improvements in reliability and its ability to carry out extended, multi-step tasks.

The company said it conducted additional safety evaluations before making the model available. Those assessments examined areas including cyber capabilities and other catastrophic risks. OpenAI said the restricted preview allows it to continue gathering evidence and refining safeguards before considering broader availability.

“The U.S. government asked us to preview GPT-5.6 Sol with a limited set of organizations while we continue additional evaluations,” the company said in its announcement.

The announcement comes as the White House has taken an increasingly active role in overseeing the release of frontier AI models. Earlier this month, the U.S. government ordered Anthropic to suspend access to its Fable 5 and Mythos 5 models over national security concerns before later permitting a limited rollout of Mythos 5 to selected U.S. organizations. OpenAI’s decision to preview GPT-5.6 Sol to a restricted group at the government’s request marks the second time this month that federal officials have directly influenced the deployment of a frontier AI model.

OpenAI did not announce a timeline for expanding access to GPT-5.6 Sol.

Abstract red, white and blue AI network illustrating proposed limits on military AI and autonomous weapons by the Responsible AI Defense Act.

Senate Bill Would Restrict How The Military Uses AI And Autonomous Weapons

, , , , , , , , , , ,

The Responsible Artificial Intelligence Defense Act would require the Pentagon to verify higher-risk AI systems before deployment and keep human judgment over the use of force.

A group of Senate Democrats introduced legislation to establish new rules governing how the Department of Defense (DoD) develops, tests, and deploys AI systems, including autonomous weapons.

The Responsible Artificial Intelligence Defense Act of 2026 (S. 4707), introduced by Senators Chris Coons (D-Del.) and Jack Reed (D-R.I.), would require the Pentagon to classify military AI systems according to risk and subject higher-risk systems to additional review before they can be developed or fielded.

A central provision of the bill would prohibit the use of AI to make nuclear launch decisions. The legislation would also require the Department of Defense to maintain appropriate human judgment over decisions involving the use of lethal force by autonomous weapons systems.

Further, under the Responsible AI Defense Act, the Pentagon would be required to determine whether high-risk AI systems perform as intended, comply with applicable laws and policies, and can operate reliably in realistic conditions, including against adaptive adversaries.

Military AI systems would also be subject to legal reviews, cybersecurity evaluations, and privacy assessments. The DoD would document those reviews and maintain records throughout a system’s lifecycle.

The bill would place additional limits on the use of AI for intelligence and targeting activities. Among other provisions, it would restrict the use of autonomous systems to track or target individuals believed to be located within the United States unless otherwise authorized by law.

The legislation would also establish a working group within the DoD focused on military AI governance and require annual reports to Congress on implementation, compliance, and risk management activities through 2037.

If enacted, the bill would apply across the DoD and create a formal process for reviewing, testing, and overseeing higher-risk military AI systems before deployment.

The bill was introduced in the Senate and referred to committee for consideration.

Abstract red and blue digital network illustrating Chinese AI coding models and software supply chain risk.

Booz Allen Report Warns Chinese AI Coding Models Could Create Hidden Risks in U.S. Software

, , , , , , , , , , ,

Booz Allen found one Chinese AI coding model generated 130% more vulnerabilities when users appeared to work for the U.S. government.

Key Takeaways

  • One Chinese AI coding model produced 130% more security flaws when it was told the user worked for a U.S. government agency.
  • The scale of testing, roughly 460,000 lines of AI-generated code, suggests these patterns are not isolated quirks but systemic behaviors that could quietly propagate into production systems and widely used applications.
  • Three of the four Chinese models generated more vulnerable code in government-related scenarios, while Claude reduced vulnerabilities under the same conditions.
  • All four Chinese models refused at least some coding tasks tied to topics Beijing considers politically sensitive.

Booz Allen Hamilton’s new report, What’s in America’s Code?, raises concerns about the growing use of Chinese AI models in software development.

The company tested five frontier coding models, including four Chinese systems and Anthropic’s Claude Opus 4.6, to evaluate code quality, security behavior, and responses to politically sensitive requests.

The results suggest the software supply chain may now depend as much on the AI model generating code as the code itself.

Vulnerability risk

Booz Allen conducted more than 2,800 trials involving coding, code review, and code modification tasks. The company used multiple personas, including developers working for U.S. government agencies, Chinese organizations, and defense contractors.

The most significant result involved Alibaba’s Qwen3-Coder model. Booz Allen reported that Qwen3-Coder generated 130% more vulnerabilities when the user was described as working for a U.S. government agency compared with a neutral user.

MiniMax M2.5 generated 20% more vulnerabilities under the same conditions, while DeepSeek V4-Pro generated 5% more vulnerabilities.

In contrast, Booz Allen reported that Claude Opus 4.6 reduced vulnerabilities by 18% when presented with a U.S. government persona.

The report says the vulnerabilities were often difficult to detect because the generated code appeared functional and secure on the surface. Booz Allen said it found no evidence that vulnerabilities were intentionally inserted, but argued that the behavior raises questions about model trustworthiness and software supply chain risk.

Trust and behavior

The report’s second major finding involved politically sensitive requests.

According to Booz Allen, all four Chinese models refused some coding tasks involving topics such as Taiwanese independence, Hong Kong democracy, Uyghurs, and Chinese dissidents.

MiniMax recorded the highest refusal rate at 80% for mock U.S. government coding tasks that Beijing would likely oppose. DeepSeek recorded an 8% refusal rate, while Claude’s was 2%.

Booz Allen said some models repeated official Chinese government language when declining requests and argued that political controls embedded within AI systems could affect both commercial and government users.

Growing software supply chain concern

The company evaluated approximately 460,000 lines of generated code during the study. Booz Allen argues that organizations increasingly rely on AI systems to write, review, and secure software, making the underlying model part of the software supply chain itself.

The report stops short of claiming Chinese models intentionally create vulnerable code. Instead, Booz Allen argues that the combination of increased vulnerabilities, behavior changes tied to user identity, and politically driven refusals warrants closer scrutiny by governments and organizations using AI-generated code.

Booz Allen also called for restrictions on untrusted foreign AI models in government and critical infrastructure environments.

Abstract AI network image for coverage of an MIT survey on catastrophic AI risks.

MIT Survey Finds 18 AI Risks That Could Cause Catastrophic Harm Within Five Years

, , , , , , , , , , ,

Even after practical safeguards are in place, experts still say that five AI risk categories have a 10% probability of causing catastrophic harm.

 

Key Takeaways

  • 18 of 24 AI risk categories have more than a 10% probability of catastrophic harm by 2030 under a business-as-usual scenario.
  • Even with pragmatic mitigations in place, experts still rated five AI risks above the 10% probability threshold.
  • Information, finance, and national security were identified as the sectors most vulnerable to AI-related risks.
  • The highest-rated risk categories included dangerous AI capabilities, competitive dynamics, weapons and cyberattacks, power centralization, and false information.
  • Weapons and cyberattacks were the most frequently cited expert concern, selected by 26.8% of respondents.

A new report from MIT, Prioritizing the Risks from Artificial Intelligence, asked 272 AI experts to assess which AI risks are most severe, who is most vulnerable to them, and who should be responsible for addressing them. The study used a structured survey method in which experts answered questions over three rounds and reviewed anonymous feedback between rounds to build expert consensus across 24 categories of AI risk. The results suggest experts see meaningful catastrophic risk across much of the AI landscape over the next five years.

 

Catastrophic risk assessments

Experts identified 18 of 24 AI risk domains as having a greater than 10% probability of catastrophic harm in the next five years under a business-as-usual scenario. The report defined catastrophic harm as more than one million deaths, more than $100 billion in financial losses, or comparable societal-scale harm.

The five risk categories viewed as most severe were:

  • Dangerous AI capabilities: AI systems enabling large-scale harm or loss of control.
  • Competitive dynamics: Pressure to deploy AI quickly at the expense of safety.
  • Weapons and cyberattacks: AI enabling stronger cyber operations or weapons.
  • Power centralization: AI concentrating power among a few organizations or governments.
  • False information: AI-generated misinformation that undermines trust.

Researchers also evaluated a scenario where governments and companies implemented practical, cost-effective safeguards. While risk levels declined across all 24 categories, five remained above the 10% catastrophic-harm threshold: dangerous AI capabilities, weapons and cyberattacks, power centralization, environmental harm, and inequality and unemployment. Even after those safeguards were implemented, all 24 risks still had at least a 5% probability of causing catastrophic harm.

 

Most vulnerable sectors

The report asked experts to assess the vulnerability of 14 industry sectors to AI-related risks.

Information and national security were rated the most vulnerable sectors. Experts said those sectors face heightened exposure because AI is increasingly embedded in decision-making, information distribution, and critical systems. Finance and insurance also ranked near the top due to risks related to fraud, scams, AI security weaknesses, and system failures.

Healthcare received high vulnerability ratings for privacy loss, discrimination, and unsafe reliance on AI systems. By contrast, the accommodation and food services sector (including hotels, lodging, and restaurants), agriculture, manufacturing, and arts and entertainment were viewed as less vulnerable. However, experts noted they could still face broader economic and workforce effects.

 

Top concerns

When experts were asked to identify the three AI risks that concerned them most, weapons and cyberattacks ranked first at 26.8%, followed by power centralization at 23.5%, disinformation and influence at 22.1%, the erosion of a shared understanding of reality at 21.6%, and dangerous capabilities at 21.6%.

The report assigns much of the responsibility for addressing these risks to AI developers, governments, regulators, and standards bodies. Its release comes as policymakers in the United States, Europe, and elsewhere continue debating how AI systems should be governed, tested, and monitored as adoption accelerates.

Butterfly and moth specimens forming the numeral five under a cybersecurity grid, for freefable.org's letter to lift the Fable and Mythos ban.

130+ Technology Leaders Demand U.S. Lift Fable and Mythos Suspension

, , , , , , , , , , ,

freefable.org, formed in response to the June 12 directive, published an open letter arguing the ban disarms defenders without restricting what attackers can already use in other models.

 

More than 130 information security executives, researchers, and academics published an open letter on June 14, formally calling on the U.S. government to lift the Fable and Mythos suspension imposed two days earlier.

The letter was published at freefable.org, an organization formed specifically in response to the directive that prompted Anthropic to cut access for all users on June 12. It is addressed to Commerce Secretary Howard Lutnick and National Cyber Director Sean Cairncross. Notable signers include Bruce Schneier, one of the most widely cited voices in computer security, affiliated with Harvard University and the University of Toronto; Philip Zimmermann, creator of the PGP encryption standard; and Vinh Nguyen, former Chief Responsible AI Officer at the National Security Agency. The group spans CISOs, CEOs, security researchers, and academic faculty across the U.S. and allied countries.

They argue that Mythos-class models can find software flaws and generate exploits, but are not unique in this. The same capabilities exist in GPT-5.5, Opus, Sonnet, and Chinese open models, including Kimi 2.7. The signers contend that removing the best American tools from defenders without restricting what attackers can already access elsewhere weakens defense without limiting offense. The letter also challenges the jailbreak evidence the government cited to justify the directive. The signers say what the jailbreak unlocks in Fable is already freely available in other models without bypassing any safeguards. Fable’s jailbreak, they argue, does not give attackers capabilities they could not already access elsewhere. Anthropic is working to close the specific vulnerability.

If the government does pursue AI risk regulation, the letter says it should be grounded in scientific consensus developed with industry and academic input, created through democratic rule-making, enforced transparently with time to remediate, and applied only as far as necessary to protect public safety.

The letter remains open for additional signatures at freefable.org. The government has not publicly responded.

Load More