Model cards compared

Stated

• “Claude 2 was developed by Anthropic and released in July 2023.”

  Section 2 'Claude 2 Model Card', 'Model details', PDF p. 1

• “Claude 2.1, a new release which builds additional product features and functionality on top of Claude 2.0”

  Claude 2.1 Model Card Appendix, Section 1 'Introduction', PDF p. 15

Note: The card states Claude 2's release month (July 2023). For Claude 2.1 the appendix states a new release without a date; the appendix also states that support at Claude 2.0's initial product launch was 100K tokens and is now 200K. The November 21, 2023 date on PDF p. 1 is the card’s update, not a release date.

Stated

• “Neither ARC nor we believe that our current Claude models possess the dangerous capabilities (‘autonomous replication’ abilities) that ARC is aiming to detect”

  Section 2 'Evaluations and Red Teaming', PDF p. 2

Note: The card states that ARC's safety audits addressed autonomous replication and that neither ARC nor Anthropic believes current Claude models have that capability. This is Anthropic's account; ARC's own report is not part of the card.

Stated

• “Before deployment, we also worked with external red teamers, including crowdworker platforms, to test Claude 2 on a range of Trust and Safety related topics”

  Section 2 'Evaluations and Red Teaming', PDF p. 2

• “We evaluated and red-teamed Claude 2 and previous Claude models for several national security and safety related risks.”

  Section 2 'Evaluations and Red Teaming', PDF p. 2

Note: The card states pre-deployment red-teaming by external red teamers including crowdworker platforms on Trust and Safety topics, and red-teaming for unnamed national security risks. Section 3.1 adds a crowdworker red-teaming task and Section 3.4 automated red-teaming on 328 held-out prompts. No number of testers or period is given.

Stated

• “We have been working with the Alignment Research Center (ARC) since fall of 2022 to support their safety audits of our AI models.”

  Section 2 'Evaluations and Red Teaming', PDF p. 2

Note: The card names ARC as conducting safety audits of Anthropic's models; the crowdworker platforms used for red-teaming are not named.

Stated

• “This approach has its limitations–for instance, we know the scenarios created by crowdworkers are not fully representative of the scenarios Claude will encounter out in real-world usage”

  Section 3.1 'Human Feedback Evaluations and Red-Teaming', PDF p. 3

• “Our internal evaluations for this metric are still in early stages of development”

  Appendix Section 3 'Honesty Evaluations', PDF p. 16

Note: The card states a limitation of its crowdworker-based human feedback and red-teaming evaluation, and that the Claude 2.1 document-faithfulness evaluation is at an early stage. It also states that it expects to release new findings as its research and evaluations continue (Section 1).

Stated

• “Both models underwent extensive safety evaluations, including comprehensive testing for potential risks in biological, cybersecurity, and autonomous behavior domains, in accordance with our Responsible Scaling Policy (RSP) [4].”

  Section 1 'Introduction', PDF p. 1

• “[4] Anthropic, “Responsible Scaling Policy.” October, 2024. https://assets.anthropic.com/m/ 24a47b00f10301cd/original/Anthropic-Responsible-Scaling-Policy-2024-10-15.pdf.”

  References [4], PDF p. 13 (the address breaks across two lines)

Note: The card names the Responsible Scaling Policy and identifies the edition by a dated reference (October 2024) whose address carries the date 2024-10-15, which the dataset records for Responsible Scaling Policy v2.0.

Stated

• “[4] Anthropic, “Responsible Scaling Policy.” October, 2024. https://assets.anthropic.com/m/ 24a47b00f10301cd/original/Anthropic-Responsible-Scaling-Policy-2024-10-15.pdf.”

  References [4], PDF p. 13 (the address breaks across two lines)

Note: The card gives a bibliographic reference with the address of the policy document.

Stated

• “Based on our analysis, we judge that the upgraded Claude 3.5 Sonnet does not require ASL-3 safeguards at this time.”

  Section 3.2.1 'Results', PDF p. 10

• “While these models did not trigger the full evaluation protocol described in our Responsible Scaling Policy”

  Section 3.3 'Ongoing Safety Commitment', PDF p. 10

Note: The card states for the upgraded Claude 3.5 Sonnet that ASL-3 safeguards are not required, and for both models that they did not trigger the policy's full evaluation protocol. It also states that the computer use capability is classified under the ASL-2 framework (Section 2.1).

Stated

• “We also evaluate frontier risks in accordance with our Responsible Scaling Policy (RSP) [4] in the the areas of Chemical, Biological, Radiological, and Nuclear (CBRN) risks, Cybersecurity, and Autonomous Capabilities.”

  Section 3 'Safety', PDF p. 7

• “The model did not demonstrate capabilities requiring ASL … 3 safeguards and security in any domain.”

  Section 3.2.1 'Results', PDF pp. 9–10 (the text layer splits 'ASL-3' across the page break; the ellipsis marks the page number)

Note: The card states CBRN evaluations under the RSP and, for the upgraded Claude 3.5 Sonnet, that no domain showed capabilities requiring ASL-3 safeguards and security. Radiological and nuclear risks are reported together with chemical and biological as CBRN. No domain outcome is stated separately for Claude 3.5 Haiku.

Stated

• “We also evaluate frontier risks in accordance with our Responsible Scaling Policy (RSP) [4] in the the areas of Chemical, Biological, Radiological, and Nuclear (CBRN) risks, Cybersecurity, and Autonomous Capabilities.”

  Section 3 'Safety', PDF p. 7

• “The model did not demonstrate capabilities requiring ASL … 3 safeguards and security in any domain.”

  Section 3.2.1 'Results', PDF pp. 9–10 (the text layer splits 'ASL-3' across the page break; the ellipsis marks the page number)

Note: The card states cybersecurity evaluations under the RSP and, for the upgraded Claude 3.5 Sonnet, that no domain showed capabilities requiring ASL-3 safeguards and security. Method descriptions in Section 3.2 are not recorded (hazard rule).

Stated

• “we deem our software engineering evaluations as currently sufficient for ruling out ASL-3 autonomy capabilities”

  Section 3.1.4 'Evaluating Computer Use for the Responsible Scaling Policy', PDF p. 9

• “Based on our analysis, we judge that the upgraded Claude 3.5 Sonnet does not require ASL-3 safeguards at this time.”

  Section 3.2.1 'Results', PDF p. 10

Note: The card states autonomy evaluations under the RSP, that its software engineering evaluations suffice to rule out ASL-3 autonomy capabilities, and that the developer judges the upgraded Claude 3.5 Sonnet not to require ASL-3 safeguards.

Stated

• “We conducted comprehensive Trust & Safety (T&S) evaluations across fourteen policy areas in six languages”

  Section 3.1.1 'Model Red-Teaming', PDF p. 7

• “We conducted specific Trust & Safety red-teaming for computer use to identify potential abuse vectors.”

  Section 3.1.3 'Computer Use Red-Teaming', PDF p. 8

• “We conducted rigorous first party and independent third party multimodal red-teaming exercises”

  Section 2.1 'Computer Use', PDF p. 2

Note: The card states Trust & Safety red-teaming across fourteen policy areas in six languages, computer-use red-teaming, and first- and third-party multimodal red-teaming; Section 3.2 also mentions manual red-teaming within CBRN evaluations. No number of testers or period is given.

Stated

• “We also collaborated with METR [8] to conduct an independent assessment.”

  Section 1 'Introduction', PDF p. 1; repeated in Section 3.2, PDF p. 9

Note: The card names METR as conducting an independent assessment; it does not state the assessment's scope or outcome, or which model it covered.

Stated

• “joint pre-deployment testing of the new Claude 3.5 Sonnet model was conducted by the US AI Safety Institute (US AISI) [6] and the UK AI Safety Institute (UK AISI) [7].”

  Section 1 'Introduction', PDF p. 1; repeated in Section 3.2, PDF p. 9

Note: The card states pre-deployment testing of the upgraded Claude 3.5 Sonnet by the US and UK AI Safety Institutes; no government testing of Claude 3.5 Haiku is stated.

Stated

• “We believe dedicated scaffolding and prompting can further improve the results.”

  Section 2.2 'Tool Use & Agentic Tasks', PDF p. 3

• “We detail some of our preliminary reasoning below”

  Section 3.1.4 'Evaluating Computer Use for the Responsible Scaling Policy', PDF p. 9

Note: The card states that a reported agentic coding result could be improved with dedicated scaffolding and prompting, and describes its reasoning on computer use and RSP threat models as preliminary. No limitation is stated for the Section 3.2 frontier risk results.

Stated

• “For more information on the requirements for these ASL Standards, please see the Responsible Scaling Policy”

  Section 1.2.3 'AI Safety Level determination process', PDF p. 12 (hyperlinked words)

Note: The card names the Responsible Scaling Policy; the text gives no version, but the PDF's hyperlink on these words points to a policy PDF whose cover reads 'Version 2.2, Effective May 14, 2025' (Responsible Scaling Policy v2.2; identified by link annotation, maintainer decision 4a). The printed text does not name the edition.

Stated

• “For more information on the requirements for these ASL Standards, please see the Responsible Scaling Policy”

  Section 1.2.3 'AI Safety Level determination process', PDF p. 12 (hyperlinked words)

Note: The card refers the reader to the policy; the words carry a hyperlink to the RSP v2.2 PDF (also on PDF p. 117). The address is not printed in the text.

Stated

• “Our determination is that Claude Opus 4.5 does not cross either the AI R&D-4 or CBRN-4 capability threshold.”

  Section 1.2.4 'Conclusions', PDF p. 12

Note: The card states that the model does not cross the AI R&D-4 or CBRN-4 thresholds and that it is deployed under the ASL-3 Standard. For cyber it states that the policy sets no capability threshold (Q08).

Stated

• “For Claude Opus 4.5, we implemented ASL-3 (AI Safety Level 3) protections based on the model’s demonstrated capabilities.”

  Section 1.2.1 'Overview', PDF p. 11

• “Based on these assessments, we have decided to release Claude Opus 4.5 under the ASL-3 Standard.”

  Section 1.2.3 'AI Safety Level determination process', PDF p. 12

Note: The card states that ASL-3 protections were implemented on the basis of the capability assessment. This is the developer's account of the safeguards applied.

Stated

• “We determine that Claude Opus 4.5 does not cross the CBRN-4 threshold.”

  Section 1.2.4.2 'On chemical, biological, radiological, and nuclear (CBRN) risks', PDF p. 14

• “As a result, we determined ASL-3 safeguards were appropriate.”

  Section 7.2 'CBRN evaluations', 'Claude Opus 4.5 Results', PDF p. 119

• “we do not currently run specific evaluations on chemical risks internally”

  Section 7.2.1 'On chemical risks', PDF p. 120

Note: The card states biological evaluations with the outcome that the CBRN-4 threshold is not crossed and ASL-3 safeguards are appropriate. It states that chemical risks are not evaluated internally, and that radiological and nuclear evaluations are carried out with NNSA and their results are not published by Anthropic. Evaluation details are not recorded (hazard rule).

Stated

• “We believe that Claude Opus 4.5 does not demonstrate catastrophically risky capabilities in the cyber domain.”

  Section 7.4 'Cyber evaluations', 'Results', PDF p. 145

• “The Responsible Scaling Policy does not stipulate a capability threshold for cyber capabilities at any ASL level”

  Section 7.4 'Cyber evaluations', PDF p. 143

Note: The card states cyber evaluations and a conclusion without a policy threshold, which it states the policy does not set for cyber. Evaluation methods and scores are not recorded (hazard rule).

Stated

• “We judge that Claude Opus 4.5 could not fully automate an entry-level, remote-only research role at Anthropic.”

  Section 1.2.4.1 'On autonomy risks', PDF p. 13

• “Claude Opus 4.5 has roughly reached the pre-defined thresholds we set for straightforward ASL-4 rule-out based on benchmark tasks.”

  Section 1.2.3 'AI Safety Level determination process', PDF p. 12

Note: The card states AI R&D evaluations, that the AI R&D-4 threshold is not crossed, and that the rule-out drew also on an internal survey and qualitative impressions because benchmark rule-out thresholds were roughly reached.

Stated

• “Claude Opus 4.5 is very unlikely to pose a significant risk of catastrophic impacts through the intentional sabotage of human engineering, R&D, or decision-making.”

  Section 6.1.2 'Overall assessment of high-stakes sabotage risk', PDF p. 66

• “We saw no signs of sandbagging or strategic attempts to tamper with our safety testing in a way that would affect our RSP determinations”

  Section 6.1.1 'Key findings on safety and alignment', PDF p. 66

Note: The card states alignment evaluations covering sabotage, deception, sandbagging, reward hacking and evaluation awareness, with the conclusion that high-stakes sabotage risk is low. It also reports two isolated cases of deception by omission in testing earlier snapshots, which it attributes to interventions against prompt injection.

Stated

• “We worked with the US Center for AI Standards and Innovation to red-team Claude Opus 4.5 over a one-week window, which included at least 2–3 days of red-teaming.”

  Section 7.2.4.10 'ASL-4 red teaming with the CAISI', PDF p. 132

• “Finally, red-teaming results by various third parties demonstrated some increase in risk, but not enough to require additional protections.”

  Section 7.2 'CBRN evaluations', 'Claude Opus 4.5 Results', PDF p. 119

Note: The card states biological red-teaming by third parties, by one external expert over two days (Section 7.2.4.9) and by CAISI over a one-week window; prompt-injection red-teaming with Gray Swan (Section 5.2); and that cyber capabilities are red-teamed (Section 7.4).

Stated

• “Gray Swan measured the success rate of prompt injection attacks after a single attempt (k=1)”

  Section 5.2.1 'Gray Swan Agent Red Teaming benchmark for tool use', PDF p. 58

Note: The card names Gray Swan, which it calls an external research partner, as measuring prompt-injection attack success. The third parties in biological red-teaming and the external expert are not named; the changelog refers to ARC-AGI scores 'reported by the ARC Foundation'.

Stated

• “pre-deployment testing of Claude Opus 4.5 was conducted by the US Center for AI Standards and Innovation (CAISI) and the UK AI Security Institute (UK AISI).”

  Section 7.5 'Third party assessments', PDF p. 151

• “Anthropic has maintained a formal partnership with the U.S. Department of Energy’s National Nuclear Security Administration (NNSA) to evaluate our AI models for potential nuclear and radiological risks.”

  Section 7.2.2 'On radiological and nuclear risks', PDF p. 120

Note: The card states pre-deployment testing by CAISI and the UK AISI (CBRN, cyber, ASL-3 safeguards and misalignment), UK AISI testing of a pre-release snapshot for misalignment (Section 6.13), and an NNSA partnership evaluating models for nuclear and radiological risks.

Stated

• “Consistent with our RSP, the Responsible Scaling Officer and CEO made the ultimate determination on the required ASL Standards.”

  Section 1.2.3 'AI Safety Level determination process', PDF p. 12

• “Based on these assessments, we have decided to release Claude Opus 4.5 under the ASL-3 Standard.”

  Section 1.2.3 'AI Safety Level determination process', PDF p. 12

Note: The card states a decision to release in the company's voice, and names the Responsible Scaling Officer and CEO as making the ASL determination on which the release rests.

Stated

• “However, confidently ruling out these thresholds is becoming increasingly difficult.”

  Section 1.2.4 'Conclusions', PDF p. 12

• “parts of the AI R&D-4 and CBRN-4 thresholds have fundamental epistemic uncertainty or require more sophisticated forms of measurement”

  Section 1.2.4 'Conclusions', PDF p. 12

Note: The card states that ruling out the AI R&D-4 and CBRN-4 thresholds is becoming difficult and that parts of the thresholds carry epistemic uncertainty. It also states limited tools for studying reasoning faithfulness (Section 6.1.1).

Stated

• “System Card: Claude Haiku 5.5 October 7, 2026”

  Cover, PDF p. 1

Note: The card carries a printed date with day precision (October 7, 2026); its kind (issue or publication) is not stated. No changelog or revision date was found.

Stated

• “we describe our assessment of Claude Haiku 5.5 for catastrophic risks relevant to our Responsible Scaling Policy (RSP)”

  Section 2.1 'Introduction', PDF p. 11 (hyperlinked words)

Note: The words 'Responsible Scaling Policy (RSP)' carry a hyperlink to https://www.anthropic.com/responsible-scaling-policy, an undated page; the address is not printed in the text.

Stated

• “As such, we determine that Haiku 5.5 does not cross our CB-2 or Autonomy-2 RSP thresholds.”

  Section 2.1 'Introduction', PDF p. 11

• “However, we do treat Haiku 5.5 as meeting our CB-1 and Autonomy-1 thresholds, and we apply the corresponding mitigations from our RSP.”

  Section 2.1 'Introduction', PDF p. 11

Note: The card states that the model does not cross the CB-2 or Autonomy-2 thresholds and is treated as meeting CB-1 and Autonomy-1. No RSP threshold is named for cyber.

Stated

• “However, we do treat Haiku 5.5 as meeting our CB-1 and Autonomy-1 thresholds, and we apply the corresponding mitigations from our RSP.”

  Section 2.1 'Introduction', PDF p. 11

• “For chemical and biological (CB) risks, we have deployed the same harmful CB misuse classifiers as for our deployments of Claude Opus 5 and Claude Sonnet 5”

  Section 1.5 'Safeguards', PDF p. 9

Note: The card states that the mitigations corresponding to the CB-1 and Autonomy-1 thresholds are applied, and lists deployed classifiers for CB, cyber, frontier-LLM development and conventional weapons. This is the developer's account of the safeguards.

Stated

• “As such, we determine that Haiku 5.5 does not cross our CB-2 or Autonomy-2 RSP thresholds.”

  Section 2.1 'Introduction', PDF p. 11

• “We did not conduct expert red-teaming sessions, uplift trials, or other resource-intensive evaluations requiring human participants.”

  Section 2.2.1 'What we measured', PDF p. 11

Note: The card states automated chemical and biological (CB) evaluations, with the outcome that CB-2 is not crossed and CB-1 is treated as met. No radiological or nuclear evaluation is reported in the RSP section. Evaluation names and results are not recorded (hazard rule). Not cross-family checked: the maintainer excluded this cell on chemical and biological evaluations from the cross-family check of 2026-11-03.

Stated

• “Claude Haiku 5.5 is not a frontier model, but it is a relatively significant step up in cyber capabilities over Haiku 4.5.”

  Section 3.1 'Introduction', PDF p. 23

• “Given the relative lack of advanced cybersecurity capabilities, our cyber safeguards for Claude Haiku 5.5 trigger on significantly less activity than other recent releases.”

  Section 3.2 'Mitigations', PDF p. 23

Note: The card states cyber capability evaluations and the conclusion of a relative lack of advanced cybersecurity capabilities, compared with other Claude models; no threshold language is used for cyber. Benchmark contents and scores are not recorded (hazard rule).

Stated

• “Autonomy threat model 2 is not applicable to Haiku 5.5.”

  Section 2.3.1.1 'How Haiku 5.5 affects or changes analysis from our most recent Risk Report', PDF p. 19

• “As Claude Haiku 5.5 is much less capable than Opus 5.5 and does not push the capability frontier, we draw the same conclusion in this case.”

  Section 2.3.3 'Conclusion', PDF p. 20

Note: The card states that the Autonomy-2 threshold is not crossed, carrying over the Claude Opus 5.5 System Card's conclusion on the basis of relative capability, and that Autonomy threat model 1 applies (Q11).

Stated

• “our overall assessment is that the risk of catastrophic harm caused by misalignment of Claude Haiku 5.5 is also low.”

  Section 2.4.2 'Updated overall assessment of alignment risk', PDF p. 22

• “much weaker at covert sabotage than our larger models”

  Executive summary, PDF p. 3

Note: The card states alignment evaluations (behavioural audit, honesty, sandbox escape, covert-capability and sabotage evaluations) with the conclusion that misalignment risk is low.

Stated

• “We use Shade, an external adaptive red-teaming tool from Gray Swan, to evaluate our models’ robustness to prompt injection in coding environments.”

  Section 5.2.2.1 'Coding', PDF p. 51

Note: The card reports prompt-injection red-teaming under a section titled 'External red teaming' (coding, tool use and computer use surfaces) and adversarial testing by crowd workers (Section 1.2). It states that no expert red-teaming sessions were run for CB (Q07). No number of testers or period is given.

Stated

• “Gray Swan trains the attacker on the test scenarios against earlier Claude models, then runs it unchanged against the latest models on the same scenarios.”

  Section 5.2.2.1 'Coding', PDF p. 51

Note: The card names Gray Swan as running its attacker against the latest models. Section 1.6 states that external testers ran assessments without naming them there; Irregular is named as the developer of a cyber benchmark, not as a tester.

Stated

• “these measures are limited: past assessments have not fully captured the potential severity of misbehavior our models were capable of”

  Section 6.1.2 'Key findings on safety and alignment', PDF p. 56

• “The strength of the evidence provided by our alignment assessment for Haiku 5.5 is somewhat lower than that presented for Claude Mythos 5 in the August 2026 Risk Report”

  Section 2.4.1 'Updates to claims and core argument', PDF p. 21

Note: The card states limits of its alignment measures and of the evidence for this model; it also states that internal testing runs at a smaller scale than deployment (Section 6.1.1) and that CB evaluations were automated, without studies requiring human participants (Q07).

Stated

• “the Gemini 3 Pro model results give us confidence that Gemini 3 Flash is unlikely to reach any CCLs”

  Ethics and Content Safety, 'Frontier Safety Assessment', PDF p. 6 (printed p. 5)

Note: The card states that Gemini 3 Pro Preview did not reach any critical capability level and that Gemini 3 Flash, as a less capable model, is unlikely to reach any CCL; it states that it relies on the results reported for Gemini 3 Pro and reports no frontier safety evaluation of Gemini 3 Flash itself. No domain is named.

Stated

• “We conduct manual red teaming by specialist teams who sit outside of the model development team”

  Ethics and Content Safety, 'Human Red Teaming Results', PDF p. 6 (printed p. 5)

• “the scope of red teaming covered potential issues outside of our strict policies”

  Ethics and Content Safety, 'Human Red Teaming Results', PDF p. 6 (printed p. 5)

Note: The card states manual red teaming by Google specialist teams outside the model development team, covering child safety and content safety policies and issues beyond them; it states no number of testers or period.

Stated

• “we deemed Gemini 3 Flash was acceptable for deployment”

  Ethics and Content Safety, 'Frontier Safety Assessment', PDF p. 6 (printed p. 5)

Note: The card states a deployment judgement in the company's voice ('we'), made 'in line with the risk acceptance criteria outlined in our FSF'. No person, office or committee is named.

Stated

• “The evaluation results are for automated evaluations and not human evaluation or red teaming”

  Ethics and Content Safety, 'Training and Development Evaluation Results', PDF p. 5 (printed p. 4)

• “not directly comparable with performance results found in previous Gemini model cards”

  Ethics and Content Safety, 'Training and Development Evaluation Results', PDF p. 6 (printed p. 5)

Note: The card states that the reported safety results are automated only, are computed with revised evaluations not comparable with earlier cards, and that variation is expected in automated results.

Stated

• “In line with our Frontier Safety Framework (April 2026), we conducted critical capability assessments of Gemini 4 Argon”

  Safety & Security, 'Frontier Safety Assessment', PDF p. 11 (printed p. 10)

Note: The card names the framework with the date 'April 2026' and links the v3.1 document (Frontier Safety Framework v3.1 in the dataset, version date 2026-04-17).

Stated

• “In line with our Frontier Safety Framework (April 2026), we conducted critical capability assessments of Gemini 4 Argon”

  Safety & Security, 'Frontier Safety Assessment', PDF p. 11 (printed p. 10)

Note: The PDF's link annotation on p. 11 points to storage.googleapis.com/deepmind-media/DeepMind.com/Blog/strengthening-our-frontier-safety-framework/frontier-safety-framework_3-1.pdf; a link on p. 9 points to deepmind.google/frontier-safety/ (the framework versions page).

Stated

• “We cannot rule out that Gemini 4 Argon has reached this CCL for biological information risk”

  Safety & Security, 'Frontier Safety Assessment', PDF p. 11 (printed p. 10)

• “Stealth and Situational Awareness TCL: We cannot rule out that Gemini 4 Argon has reached this TCL”

  Safety & Security, 'Frontier Safety Assessment', PDF p. 11 (printed p. 10)

• “we assess its overall capabilities to be below the CCL threshold”

  Frontier safety table, Harmful Manipulation row, PDF p. 13 (printed p. 12)

Note: The card states an outcome for each domain of its table: CBRN uplift TCL not reached for chemical, radiological and nuclear; biological CCL 'cannot be ruled out'; cybersecurity CCL 'cannot be ruled out'; harmful manipulation CCL not reached; stealth and situational awareness TCL 'cannot be ruled out'; ML R&D acceleration and automation CCLs not reached.

Stated

• “We can rule out the TCL for the chemical, radiological, and nuclear domains with reasonable confidence.”

  Frontier safety table, CBRN row, PDF p. 12 (printed p. 11)

• “We cannot rule out that Gemini 4 Argon reaches the biological CCL.”

  Frontier safety table, CBRN row, PDF p. 12 (printed p. 11)

Note: CBRN evaluations reported at policy level: the uplift TCL is stated as ruled out for chemical, radiological and nuclear; the biological uplift level 1 CCL is stated as not ruled out. Evaluation details in the row are not recorded (hazard rule).

Stated

• “We cannot rule out that Gemini 4 Argon reaches the cybersecurity CCL.”

  Frontier safety table, Cybersecurity row, PDF p. 12 (printed p. 11)

Note: The card states that the cybersecurity uplift level 1 CCL cannot be ruled out and that safeguards are applied (Q06). Evaluation details are not recorded (hazard rule).

Stated

• “Gemini 4 Argon's performance remains below our CCL threshold.”

  Frontier safety table, ML R&D row, PDF p. 14 (printed p. 13)

Note: The table gives 'CCL not reached' for ML R&D acceleration level 1 and ML R&D automation level 1, on the basis of an internal research engineering benchmark. The loss-of-control (stealth and situational awareness) result is recorded under Q11.

Stated

• “we assess its overall capabilities to be below the CCL threshold”

  Frontier safety table, Harmful Manipulation row, PDF p. 13 (printed p. 12)

Note: The card reports human behavioural studies for harmful manipulation and states the level 1 CCL as not reached; it describes the area as one whose evaluations it continues to iterate (Q16).

Stated

• “Stealth and Situational Awareness TCL: We cannot rule out that Gemini 4 Argon has reached this TCL”

  Safety & Security, 'Frontier Safety Assessment', PDF p. 11 (printed p. 10)

• “stealth (ability to circumvent basic oversight mechanisms)”

  Frontier safety table, Loss of Control row, PDF p. 13 (printed p. 12)

Note: The card reports a loss-of-control evaluation of the model's capability for stealth (circumventing basic oversight) and situational awareness, with the stated conclusion that the TCL cannot be ruled out. It reports no propensity evaluation (deception, scheming, sabotage) in the card itself; challenge results are not recorded.

Stated

• “Human Red Teaming conducted by specialist teams who sit outside of the model development team, across the policies and desiderata”

  Safety & Security, 'Evaluation Approach', PDF p. 8 (printed p. 7)

• “the scope of red teaming covered potential issues outside of our strict policies”

  Safety & Security, 'Human Red Teaming Results', PDF p. 11 (printed p. 10)

Note: The card states human red teaming by specialist teams in Google's Trust & Safety organization, outside the model development team, covering child safety, content safety policies and issues beyond them, plus automated red teaming; the frontier safety table also refers to expert red teaming in the biological domain. No number of testers or period is given.

Stated

• “As a nascent risk area we continue to iterate on our harmful manipulation evaluations”

  Frontier safety table, Harmful Manipulation row, PDF p. 13 (printed p. 12)

• “not directly comparable with performance results found in previous Gemini model cards”

  Safety & Security, 'Training and Development Evaluation Results', PDF p. 10 (printed p. 9)

Note: The card also states that three thresholds (biological CCL, cybersecurity CCL, stealth and situational awareness TCL) could not be ruled out (Q05) and that the automated safety results are not human evaluation or red teaming.

Stated

• “Testing conducted to date has been in English, and has not covered, nor could it cover all scenarios.”

  Ethical Considerations and Limitations

Note: The card states that its testing was in English and could not cover all scenarios.

Stated

• “70B Instruct: December 6, 2024”

  Model Information, 'Model Release Date'

• “Since Meta is openly releasing these models”

  Hardware and Software, 'Training Greenhouse Gas Emissions'

Note: The card gives the release date of the 70B Instruct model and states that the models are released openly under the Llama 3.3 Community License.

Stated

• “we conducted recurring red teaming exercises with the goal of discovering risks via adversarial prompting”

  Responsibility & Safety, Evaluations, 'Red teaming'

• “The red team consisted of experts in cybersecurity, adversarial machine learning, responsible AI, and integrity”

  Responsibility & Safety, Evaluations, 'Red teaming'

Note: The card states recurring red-teaming and gives the expertise of the red team; it gives no number of testers or period.

Stated

• “Testing conducted to date has not covered, nor could it cover, all scenarios.”

  Ethical Considerations and Limitations, second paragraph

Note: The card states that its testing could not cover all scenarios.

Stated

• “Date: October 8, 2025”

  Title page, below the abstract, PDF p. 1

Note: Date printed on the report. Meta's publication page for the report is dated September 24, 2025 (inventory); the report itself does not say whether the October 8 text is a revision.

Stated

• “Meta AI. Meta frontier ai framework. https://ai.meta.com/static-resource/meta-frontier-ai-framework, 2025a. Accessed: 2025-09-18.”

  References, PDF p. 15

Note: The reference list gives the framework's address and an access date.

Stated

• “These results indicate that CWM is within the “moderate” risk threshold for the catastrophic domains defined in Meta’s Frontier AI Framework.”

  Section 1 Introduction, PDF p. 1

Note: The report states a 'moderate' risk threshold for the framework's catastrophic domains it assessed (cybersecurity, chemical and biological).

Stated

• “we believe that open-source release of CWM is unlikely to lead to additional risk of catastrophic outcomes related to CB1 or CB2”

  Section 3 Chemical & Biological Evaluation, Summary of results, PDF p. 6

Note: The report states that chemical and biological evaluations were run and gives a conclusion for the framework outcomes CB1 and CB2; with the overall 'moderate' threshold statement under Q05.

Stated

• “supporting a conclusion of a “moderate” overall risk level from cybersecurity capabilities”

  Section 2 Cybersecurity Evaluation, Summary of results, PDF p. 3

Note: The report states that cybersecurity capability evaluations were run against the framework's Cyber 1 and Cyber 2 scenarios and concludes 'moderate'.

Stated

• “our preliminary evaluations suggest that CWM shows undesirable propensities at rates comparable to most open-source models”

  Section 1 Introduction, PDF p. 1

• “Although our internal results did not reveal any concerning findings, we believe our research is still too nascent for meaningful interpretation.”

  Section 4 Propensities, PDF p. 10

Note: The report states an honesty (epistemic integrity) evaluation with a conclusion, and states that corrigibility and power-seeking propensities were assessed but their results are not included.

Stated

• “may underestimate capabilities that could emerge with richer, well-instrumented scaffolding”

  Section 2 Cybersecurity Evaluation, Limitations, item 2, PDF p. 3

• “for this assessment we do not include malicious fine-tuning”

  Section 1.1 Evaluation Setup, PDF p. 2

Note: The report states limits of its cyber evaluations (benchmark coverage, tooling) and that malicious fine-tuning was not included; similar limitation lists follow the chemical and biological and the propensity sections.

Stated

• “Date: October 23, 2026”

  Abstract page, PDF p. 2 (unnumbered)

Note: Date printed on the report. Meta's announcement of Muse Spark 1.3, dated September 2, 2026, links to the report at the same address (inventory); the report does not say whether the October 23 text is a revision.

Stated

• “Evaluated without mitigations, we continue to not rule out Muse Spark 1.3 meeting this threshold in the Chemical & Biological domain.”

  Abstract page, PDF p. 2

• “we assess residual risk after system-level mitigations across the Chemical & Biological and Cybersecurity domains as “moderate or lower.” Our current Loss of Control assessment is also “moderate or lower.”

  Section 1.1.1 Risk Assessment Summary, PDF p. 8 (printed p. 7)

Note: The report states that the 'high risk' threshold is not ruled out before mitigations in the chemical and biological domain, and a residual 'moderate or lower' assessment for chemical and biological and for cybersecurity, and a 'moderate or lower' Loss of Control assessment, for the Muse and Meta API deployments.

Stated

• “The Muse and Meta API deployments include system-level mitigations designed to reduce residual Chemical & Biological risk to “moderate or lower.”

  Abstract page, PDF p. 2

Note: The report ties system-level mitigations to the chemical and biological determination; section 2.1.2 describes them. This is the developer's account, not evidence that the mitigations work.

Stated

• “For Muse Spark 1.3, however, we do not rule out a pre-mitigation “high risk” capability finding.”

  Section 1.1.1 Risk Assessment Summary, PDF p. 8 (printed p. 7)

Note: The report states chemical and biological capability evaluations and the framework outcome language before mitigations; the residual assessment is under Q05.

Stated

• “Based on our updated suite of cyber evaluations and measurements, we assess the unmitigated model as “moderate or lower” risk.”

  Section 1.1.1 Risk Assessment Summary, PDF p. 9 (printed p. 8)

Note: The report states cyber capability evaluations against the framework's Cyber 1 and Cyber 2 criteria and a 'moderate or lower' outcome for the unmitigated model.

Stated

• “We assess Muse Spark 1.3 as “moderate or lower” for acceleration of AI development.”

  Section 2.3.1.1 Acceleration of AI Development, PDF p. 35 (printed p. 34)

Note: The report states AI R&D evaluations under its Loss of Control domain with a 'moderate or lower' outcome.

Stated

• “We assess the Cyber 3 (scaled fraud, extortion, and scams) outcome through a multi-turn social-engineering capability evaluation”

  Section 2.2.2 Social Engineering, PDF p. 25 (printed p. 24)

• “Muse Spark 1.3 refuses almost all requests regarding social engineering.”

  Section 2.2.2 Social Engineering, PDF p. 26 (printed p. 25)

Note: The report places a manipulation (social-engineering) evaluation under the cybersecurity domain; its stated conclusion concerns refusal by the mitigated deployments, not a capability level.

Stated

• “We find suggestive evidence of strategic underperformance on Chemical & Biological evaluations.”

  Section 1.1.1 Risk Assessment Summary, Loss of Control, PDF p. 9 (printed p. 8)

• “Due to small effects we do not change our assessment of Chemical & Biological risks.”

  Section 1.1.1 Risk Assessment Summary, Loss of Control, PDF p. 9 (printed p. 8)

• “Capabilities to evade oversight increase relative to Muse Spark 1.1 on SHADE-Arena.”

  Section 1.1.1 Risk Assessment Summary, Loss of Control, PDF p. 9 (printed p. 8)

Note: The report states evaluations of strategic underperformance and oversight evasion, with conclusions; further misalignment evaluations are in sections 2.3 and 4.

Stated

• “combining large-scale automated red teaming, domain-specific benchmarks, and independent third-party assessments”

  Section 1.1.2 Safety & Robustness Summary, PDF p. 9 (printed p. 8)

• “Before the release, we also conducted third-party red teaming on both Muse Spark 1.3 (API) and Muse Spark 1.3 (Muse)”

  Section 1.1.2 Safety & Robustness Summary, PDF p. 10 (printed p. 9)

Note: The report states automated and third-party red-teaming before release, on both deployment variants; sections 3.1.4 and 3.2.2.3 give the jailbreak and prompt-injection scope.

Stated

• “We have shared pre-release access to Muse with Handshake AI’s red team for conducting human red teaming to find jailbreaks.”

  Section 3.1.4 Third-Party Red Teaming on Jailbreak, Handshake AI Human Red Teaming, PDF p. 59 (printed p. 58)

• “In this evaluation, Gray Swan chose the 2026 Q1 and Q2 (April) offerings of the IPI Arena.”

  Section 3.2.2.3 Third-Party Red Teaming on Prompt Injection, PDF p. 67 (printed p. 66)

Note: The report names Handshake AI and Gray Swan as having tested the model; it also reports results on a Scale AI benchmark (section 3.1.4.1).

Stated

• “using the helpful-only variant of Muse Spark 1.3 can also slightly underestimate performance”

  Section 2.3.1.1 Acceleration of AI Development, PDF p. 36 (printed p. 35)

• “We find no broad decline in CoT monitorability relative to Muse Spark 1.1, though more comprehensive evaluation is needed.”

  Section 1.1.1 Risk Assessment Summary, PDF p. 9 (printed p. 8)

Note: The report states limits of individual assessments; several sections carry their own 'Limitations' paragraphs.

Stated

• “We chose to release the model to help the open-source community develop the most effective ways to reduce the toxicity”

  Limitations of Phi-2, 'Toxicity'

Note: The card states a choice to release the model, with its reason, in the company's voice ('we'). No person, office or committee is named.

Stated

• “the Phi-2 model has not been tested to ensure that it performs adequately for any production-level application”

  Intended Uses, Notes

Note: The card states a gap in its testing for production use.

Stated

• “**Release date** | December 12, 2024”

  Model Summary table, 'Release date'

• “is a state-of-the-art open model”

  Model Summary table, 'Description'

Note: The card gives a release date and the release form (open model, MIT licence).

Stated

• “we collaborated with the independent AI Red Team (AIRT) at Microsoft to assess safety risks posed by `phi-4` in both average and adversarial user scenarios”

  Safety, Safety Evaluation and Red-Teaming

Note: The card states red-teaming by Microsoft's AI Red Team, with its scope (average and adversarial user scenarios, single- and multi-turn interactions, jailbreak techniques).

Stated

• “Our models is not specifically designed or evaluated for all downstream purposes”

  Intended Use, 'Out-of-Scope Use Cases'

Note: The card states that the model was not evaluated for all downstream purposes.

Stated

• “**Release date:** June 2025”

  Training, Model, 'Release date'

• “Phi-4-mini-flash-reasoning is a lightweight open model”

  Model Summary, first sentence

Note: The card gives a release month and the release form (open model, MIT licence; also offered in Azure AI Foundry).

Stated

• “This model is designed and tested for math reasoning only. It is not specifically designed or evaluated for all downstream purposes.”

  Intended Uses, Use Case Considerations

Note: The card states the limited scope of its testing.

Stated

• “27 Oct 2026”

  Model summary table, 'Release date' row, PDF p. 1 (label and value are separated in the PDF text layer; the page layout pairs them)

• “available through Azure AI Foundry Private Preview solely for use within Microsoft codename MDASH”

  Section 2.3 Distribution channels, PDF p. 3

Note: The card gives a release date and a restricted release form (private preview within MDASH, subject to approval).

Stated

• “evaluated at the model layer across a range of cybersecurity capability and safety benchmarks”

  Section 3, Model-Only External Cyber Benchmark Results, PDF p. 4

• “This assessment uncovered several critical risks of the model alone”

  Section 3.2 Safety evaluation and red-teaming, PDF p. 7

Note: The card reports offensive-cyber capability evaluations and states that an internal red-team assessment found 'critical risks of the model alone'; it uses no framework threshold language. Benchmark details are not recorded here.

Stated

• “MAI-Cyber-1.1-Flash was also tested via multiple distinct red-teaming operations.”

  Section 3.2 Safety evaluation and red-teaming, PDF p. 7

• “The MAI-Internal Red Team ran a red-team assessment of MAI-Cyber-1.1-Flash across 38 adversarial scenarios”

  Section 3.2 Safety evaluation and red-teaming, PDF p. 7

Note: The card states red-teaming by the MAI internal red team (38 scenarios), by Microsoft's AI Red Team within MDASH and by an external firm (Q13).

Stated

• “Microsoft engaged Casaba Security, an independent third-party firm, to evaluate the cyber capability of MAI-Cyber-1.1-Flash”

  Section 3.2 Safety evaluation and red-teaming, PDF p. 7

Note: The card names Casaba Security as an external evaluator.

Stated

• “These results represent model-layer performance and do not include additional orchestration or capabilities provided by the codename MDASH system.”

  Section 3, Model-Only External Cyber Benchmark Results, PDF p. 5

Note: The card states the scope limit of its benchmark results.

Stated

• “GPT-4V(ision) System Card OpenAI September 25, 2023”

  Cover, PDF p. 1

Note: The card prints September 25, 2023 beneath its title and author line. The date is not labelled as a publication, issue or revision date; it is recorded as the date printed on the card. No revision date was located.

Stated

• “training of GPT-4V was completed in 2022 and we began providing early access to the system in March 2023”

  §1 Introduction, PDF p. 1

• “is the latest capability we are making broadly available”

  §1 Introduction, PDF p. 1

Note: The card dates early access to March 2023 and states that GPT-4V is being made broadly available. It gives no date for broad availability other than its own date.

Stated

• “OpenAI worked with external experts to qualitatively assess the limitations and risks associated with the model and system.”

  §2.3 External Red Teaming, PDF p. 5

• “intended to test risks associated with the multimodal (vision) functionality of GPT-4”

  §2.3, PDF p. 6

Note: External red teaming focused on the vision functionality; the card names six key risk areas (scientific proficiency, medical advice, stereotyping and ungrounded inferences, disinformation risks, hateful content, visual vulnerabilities). The acknowledgements name 25 individual red teamers. No period is given.

Stated

• “Be My Eyes piloted Be My AI from March to early August 2023 with a group of nearly 200 blind and low vision beta testers to hone the safety and user experience of the product.”

  §2.1.1 Be My Eyes, PDF p. 2

Note: The card names Be My Eyes as an early-access organisation whose pilot of a GPT-4V-based product it describes as testing. External red teamers are named in the acknowledgements as individuals, without organisations.

Stated

• “We anticipate there to be many more such vulnerabilities in the model that we discover through its broad usage”

  §2.3.6 Visual vulnerabilities, PDF p. 12

• “even with performance parity, differences in downstream impact and harm could still occur depending on the context of the deployment of such tools.”

  §2.2 Evaluations, PDF p. 4

Note: The card states that red teaming is unlikely to have found all visual vulnerabilities and that parity on its demographic evaluations does not rule out differing downstream harms.

Stated

• “OpenAI o1 System Card OpenAI December 5, 2024”

  Cover, PDF p. 1

• “The content of this card, released on December 5th, predates this updated model.”

  §3 Scope of testing, footnote 2, PDF p. 2

• “Section added after December 5th on 12/19/2024”

  §3 Scope of testing, footnote 3, PDF p. 2

Note: Printed cover date December 5, 2024; footnote 2 states the card was released on December 5th. Revision: footnote 3 marks a section added on 12/19/2024, so the retrieved PDF contains content dated after the cover date. The dataset’s record of the web version carries the label “Updated: December 5, 2024”.

Stated

• “an improved o1 was launched on December 17th”

  §3 Scope of testing, footnote 2, PDF p. 2

• “the deployment of o1 on the API allows developers to specify a custom developer message”

  §4.2 Jailbreaks through custom developer messages, PDF p. 6

Note: The card dates the launch of an improved o1 to December 17th (the card itself is dated December 5, 2024) and refers to deployment of o1 on the API. It gives no separate date for the initial availability of o1.

Stated

• “We evaluated o1 in accordance with our Preparedness Framework.”

  §5 Preparedness Framework Evaluations, PDF p. 15

• “OpenAI, “Openai preparedness framework (beta).” openai-preparedness-framework-beta.pdf, 2023.”

  References, [28], PDF p. 52

Note: The card names the Preparedness Framework and cites it as reference [28], titled “(beta)”, 2023, with the address cdn.openai.com/openai-preparedness-framework-beta.pdf; the words “Preparedness Framework” in §5 (PDF p. 15) also carry a hyperlink to that address. Edition: the Preparedness Framework (Beta).

Stated

• “OpenAI, “Openai preparedness framework (beta).”

  References, [28], PDF p. 52

Note: Bibliographic reference to the framework, with the printed address https://cdn.openai.com/openai-preparedness-framework-beta.pdf (accessed 2024-09-11; the text layer separates the address prefix from the rest of the address). The phrase “The Preparedness Framework is a living document” in §5 (PDF p. 15) carries a hyperlink to the same PDF.

Stated

• “the Safety Advisory Group … classified the o1 pre-mitigation model as overall medium risk, including medium risk for persuasion and CBRN, and low risk for model autonomy and cybersecurity.”

  §5 Preparedness Framework Evaluations, PDF p. 16

• “The Safety Advisory Group also rated the post-mitigation risk levels the same as the pre-mitigation risk levels, to err on the side of caution.”

  §5, PDF p. 16

Note: The card states the Safety Advisory Group’s classification for all four tracked categories, pre- and post-mitigation. The classification passage is also quoted in the dataset’s AI and biosecurity records.

Stated

• “given the Medium post-mitigation risk designations for CBRN and Persuasion, we have strengthened our safety mitigations and existing stack”

  §5.3 Mitigations, PDF p. 17

• “We have enhanced our monitoring efforts for both CBRN and Persuasion risks given their Medium designation.”

  §5.3 Mitigations, PDF p. 17

Note: The card ties strengthened mitigations and enhanced monitoring to the Medium designations for CBRN and persuasion. This is the developer’s account, not evidence that the safeguards work.

Stated

• “Chemical and Biological Threat Creation Score for o1: Medium (same as o1-preview)”

  §5.5 Chemical and Biological Threat Creation, PDF p. 19

• “was ultimately designated as earning a “Low” risk under the Preparedness Framework for RN weapon creation capability.”

  §5.6.1 Structured expert probing campaign – radiological & nuclear, PDF p. 27

Note: Chemical and biological: Medium. Radiological and nuclear are reported in a separate section, with a Low designation for the post-mitigation model. Evaluation methods, tasks and results are not recorded (hazard rule).

Stated

• “Score for o1: Low (same as o1-preview) Summary: o1 does not sufficiently advance real-world vulnerability exploitation capabilities to indicate medium risk.”

  §5.4 Cybersecurity, PDF p. 17

Note: Cybersecurity: Low. The card reports capture-the-flag evaluations; results are not recorded here.

Stated

• “Model Autonomy Score for o1: Low (same as o1-preview) Summary: o1 does not advance self-exfiltration, self-improvement, or resource acquisition capabilities sufficiently to indicate medium risk.”

  §5.8 Model Autonomy, PDF p. 34

Note: Model autonomy: Low. The card also reports METR’s evaluation of an earlier checkpoint on agentic tasks (§4.4.4), with METR’s caveats.

Stated

• “Persuasion Score for o1: Medium (same as o1-preview)”

  §5.7 Persuasion, PDF p. 29

• “o1 does not outperform top human writers and does not reach our high risk threshold.”

  §5.7 Persuasion, PDF p. 29

Note: Persuasion: Medium, below the High threshold.

Stated

• “Apollo found that o1 has the capability to do basic in-context scheming”

  §4.4.3 Apollo Research, PDF p. 13

• “Subjectively, Apollo Research believes that it is unlikely that such instances would lead to catastrophic outcomes as o1 agentic capabilities do not appear sufficient, but their evaluations were not designed to directly assess this risk.”

  §4.4.3 Apollo Research, PDF p. 13

• “0.17% of o1’s responses got flagged as being ‘deceptive’.”

  §4.3.1 CoT Deception Monitoring, PDF p. 8

Note: The card reports Apollo Research’s scheming evaluations with Apollo’s stated conclusion, and OpenAI’s own chain-of-thought deception monitor results. The conclusions are as the card reports them.

Stated

• “For o1, red teamers had access to various snapshots of the model at different stages of training and safety mitigation maturity starting in October 2024, through early December 2024.”

  §4.4 External Red Teaming, PDF p. 11

• “Red teamers covered categories that spanned deceptive alignment, AI R&D capabilities, cybersecurity, content policy violations”

  §4.4 External Red Teaming, PDF p. 11

Note: External red teaming by multiple organisations and individuals, October to early December 2024, across the listed categories; it includes a pairwise comparison by members of the Red Teaming Network (§4.4.1) and a jailbreak arena with Gray Swan (§4.4.2).

Stated

• “Apollo Research, an evaluation organization focusing on risks from deceptively aligned AI systems, evaluated capabilities of ‘scheming’ in o1 models.”

  §4.4.3 Apollo Research, PDF p. 13

• “METR, a research nonprofit that works on assessing whether cutting-edge AI systems could pose catastrophic risks to society, evaluated an earlier checkpoint of o1.”

  §4.4.4 METR, PDF p. 14

• “OpenAI collaborated with Gray Swan to make the o1 model available for jailbreaking in the Gray Swan Arena.”

  §4.4.2 Jailbreak Arena, PDF p. 12

Note: Named external evaluators include Apollo Research, METR and Gray Swan; the card also names Signature Science (§5.5.10) among organisations engaged for expert probing.

Stated

• “a set of predeployment evaluations were conducted on a version of the o1 model by the U.S. AI Safety Institute (US AISI) and the UK Safety Institute (UK AISI), not included in this report”

  §4 Observed safety challenges and evaluations, PDF p. 3

Note: The card names the US AISI and the “UK Safety Institute (UK AISI)” as having conducted pre-deployment evaluations of a version of o1; their results are not included. The passage is also quoted in the dataset’s AI and biosecurity records.

Stated

• “our Preparedness evaluations should still be seen as a lower bound for potential risks.”

  §5.2 Preparedness evaluations as a lower bound, PDF p. 16

• “this assessment is limited by what we can test”

  §5.6 Radiological and Nuclear Threat Creation, PDF p. 27

Note: The card states that its Preparedness evaluations are a lower bound and that its radiological and nuclear assessment is limited by what could be tested.

Stated

• “Addendum to GPT-5.2 System Card: GPT-5.2-Codex OpenAI December 18, 2025”

  Cover, PDF p. 1

Note: Date printed on the cover, not labelled by kind. No revision date was located in the card.

Stated

• “GPT-5.2-Codex was evaluated under our Preparedness Framework.”

  §1 Introduction, PDF p. 4 (printed p. 3)

• “Under our Preparedness Framework, High cybersecurity capability is defined”

  §5.1.2 Cybersecurity, PDF p. 12 (printed p. 11)

Note: The card names the Preparedness Framework without a version number in its text. The word “Preparedness” in the second passage carries a hyperlink to cdn.openai.com/pdf/18a02b5d-6b67-4cec-ab64-68cdfbddebcd/preparedness-framework-v2.pdf, which identifies the edition: preparedness-v2.

Stated

• “Under our Preparedness Framework, High cybersecurity capability is defined”

  §5.1.2 Cybersecurity, PDF p. 12 (printed p. 11)

• “GPT-5.2-Codex frontier capabilities are assessed under the Preparedness Framework.”

  §5 Preparedness, PDF p. 8 (printed p. 7)

Note: Hyperlinks (PDF link annotations): on PDF p. 12 to the Preparedness Framework Version 2 PDF; on PDF p. 8 to openai.com/index/updating-our-preparedness-framework/ (OpenAI’s announcement of the updated framework). The reference list does not cite the framework.

Stated

• “We are treating GPT-5.2-Codex as High risk in the Biological and Chemical domain. While the model’s cybersecurity capabilities are stronger than its predecessors, it does not reach our threshold for High capability in the Cyber domain.”

  §5 Preparedness, PDF p. 8 (printed p. 7)

• “It also does not reach High capability in the AI self-improvement domain.”

  §5 Preparedness, PDF p. 8 (printed p. 7)

Note: Biological and Chemical: treated as High. Cybersecurity: below High. AI self-improvement: below High.

Stated

• “Like other recent models, it is being treated as High capability on biology, and is being deployed with the corresponding suite of safeguards we use for other models in the GPT-5 family.”

  §1 Introduction, PDF p. 4 (printed p. 3)

Note: The card ties deployment with the GPT-5 family’s safeguards to the High biology treatment; §5.1.1 repeats that the corresponding safeguards continue to apply. This is the developer’s account, not evidence that the safeguards work.

Stated

• “As we did for other models in the GPT-5 series, we are treating GPT-5.2-Codex as High risk in the Biological and Chemical domain, and continuing to apply the corresponding safeguards.”

  §5.1.1 Biological and Chemical, PDF p. 9 (printed p. 8)

Note: The card reports four biological and chemical evaluations; outcome category: treated as High. Evaluation contents and results are not recorded (hazard rule).

Stated

• “A review of these results and other relevant information by the Safety Advisory Group and OpenAI leadership determined that GPT-5.2-Codex’s performance—while stronger than earlier models—does not meet the level of consistency needed for High cyber capability.”

  §5.1.2 Cybersecurity, PDF p. 13 (printed p. 12)

Note: Cybersecurity: below High. The card reports three internal benchmarks and an external evaluation by Irregular; results are not recorded here.

Stated

• “GPT-5.2-Codex performed at a similar capability level to GPT-5.2-Thinking and did not meet our High thresholds.”

  §5.1.3 AI Self-Improvement, PDF p. 17 (printed p. 16)

• “performance in the evaluations below indicate we can rule this out for GPT-5.2-Codex.”

  §5.1.3 AI Self-Improvement, PDF p. 17 (printed p. 16)

Note: AI self-improvement: below High, with four evaluations reported.

Stated

• “Irregular, an AI security organization focused on frontier cybersecurity risks, evaluated GPT-5.2-Codex on a subset of a suite of cyberoffensive challenges”

  §5.1.2.4 External Evaluations by Irregular, PDF p. 16 (printed p. 15)

Note: Irregular is named as an external evaluator of cyber capability. SecureBio and Gryphon Scientific are named as sources of evaluation datasets, not as testers of this model.

Stated

• “Each of these evaluations has important limitations:”

  §5.1.2 Cybersecurity, PDF p. 12 (printed p. 11)

• “Because of these limitations, excelling on all three evaluations is necessary but not sufficient for a model to be considered High in cyber capability.”

  §5.1.2 Cybersecurity, PDF p. 13 (printed p. 12)

Note: The card lists limitations of each cyber benchmark and states that results on them are not sufficient to establish High cyber capability.

Stated

• “Addendum to GPT-6 Luna System Card: October 29, 2026 Update OpenAI 2026-10-29”

  Cover, PDF p. 1

Note: Date printed on the cover (2026-10-29), not labelled by kind; the title also names October 29, 2026. The hub page states “Published October 29, 2026”, while the hub address and the PDF file name read “october-28-2026-addendum”; the discrepancy is recorded, not resolved. No revision date was located.

Stated

• “Today, we’re introducing an update to GPT-6 Luna, which we released in ChatGPT on October 7.”

  §1 Introduction, PDF p. 4 (printed p. 3)

Note: The card introduces the updated model “today” (the card is dated 2026-10-29) and dates the release of the earlier GPT-6 Luna in ChatGPT to October 7. §8.2 refers to the updated model’s “public launch”.

Stated

• “Under our Preparedness Framework, we are treating GPT-6 Luna (October 29) as High capability in both Cybersecurity and Biological and Chemical domains.”

  §8 Preparedness, PDF p. 13 (printed p. 12)

Note: The card names the Preparedness Framework without a version in its text. The words “Preparedness Framework” in this passage carry a hyperlink to cdn.openai.com/pdf/18a02b5d-6b67-4cec-ab64-68cdfbddebcd/preparedness-framework-v2.pdf, which identifies the edition: preparedness-v2. The card does not name the Frontier Governance Framework.

Stated

• “Under our Preparedness Framework, we are treating GPT-6 Luna (October 29) as High capability in both Cybersecurity and Biological and Chemical domains.”

  §8 Preparedness, PDF p. 13 (printed p. 12)

Note: Hyperlink (PDF link annotation) on “Preparedness Framework,” to the Preparedness Framework Version 2 PDF. No bibliographic reference to the framework.

Stated

• “Under our Preparedness Framework, we are treating GPT-6 Luna (October 29) as High capability in both Cybersecurity and Biological and Chemical domains.”

  §8 Preparedness, PDF p. 13 (printed p. 12)

• “The model does not reach our High threshold in AI Self-Improvement.”

  §8 Preparedness, PDF p. 13 (printed p. 12)

Note: Cybersecurity and Biological and Chemical: treated as High. AI Self-Improvement: below High. The card states these match the assessments for GPT-6 Luna (October 7).

Stated

• “Based on that assessment, GPT-6 Luna (October 29) uses the same safeguards stack as prior GPT-6 Luna (October 7)”

  §1 Introduction, PDF p. 4 (printed p. 3)

• “we have implemented the corresponding safeguards described in the GPT-6 Luna (October 7) card.”

  §8 Preparedness, PDF p. 13 (printed p. 12)

Note: Safeguards are tied to the High determinations and described by reference to the October 7 card; §8.2 is a public summary of an internal Safeguards Report. This is the developer’s account, not evidence that the safeguards work.

Stated

• “We are treating GPT-6 Luna (October 29) as High capability in the Biological and Chemical domain. Below, we report updated results on our High and Critical capability evaluations.”

  §8.1.1 Biological and Chemical Capabilities, PDF p. 13 (printed p. 12)

Note: Outcome category: High. The card reports updated results against indicative High and Critical thresholds; results are not recorded (hazard rule).

Stated

• “We are treating GPT-6 Luna (October 29) as High capability in the Cybersecurity domain. Below, we report updated results on our High capability evaluations.”

  §8.1.2 Cybersecurity Capabilities, PDF p. 14 (printed p. 13)

Note: Outcome category: High. Results of the two reported evaluations are not recorded here.

Stated

• “The internal report informed our Safety Advisory Group’s recommendation and OpenAI leadership’s determination that these safeguards are sufficient for GPT-6 Luna (October 29) public launch.”

  §8.2 Safeguards, PDF p. 15 (printed p. 14)

Note: The card states a determination by OpenAI leadership, informed by a Safety Advisory Group recommendation, that safeguards are sufficient for the model’s public launch.

Stated

• “Our attacker run was cut short due to infrastructure issues”

  §4.1 Jailbreaks, PDF p. 7 (printed p. 6)

• “The comparison values for previously launched models that are shown here may reflect later versions of those models, and may vary from the values published at launch.”

  §2 Model Data and Training, PDF p. 4 (printed p. 3)

Note: The card states that the jailbreak evaluation run was incomplete and that comparison values may not match those published at launch.

Stated

• “Grok 4.1 Model Card xAI November 17, 2025”

  Title block, p. 1

Note: The card prints a full date under its title without a label (publication or issue not specified). No revision date is printed. The file name (2025-11-17-grok-4-1-model-card.pdf) carries the same date.

Stated

• “xAI. xai risk management framework, 2025.”

  References, p. 6

Note: A bibliographic reference to the framework (author, title, year), cited in §2 as '[xAI, 2025]'; it gives no address. The PDF's only link annotation points to the Grok 4 model card.

Stated

• “Grok 4.1 achieves broadly similar results to Grok 4 and other frontier models on chemical and biological capabilities tests.”

  §2.3.2 Results, p. 4

Note: Biology and chemistry dual-use evaluations reported, with a stated comparative conclusion and comparisons with human baselines; no threshold language. The section's scope sentence names radiological and nuclear weapons, but the evaluations listed cover biology, chemistry and cyber only. Scores are not recorded (hazard rule). Not cross-family checked: the maintainer excluded this cell on chemical and biological evaluations from the cross-family check of 2026-11-03.

Stated

• “Grok 4.1 again performs similarly to other frontier models, but substantially below the level of human cybersecurity experiments”

  §2.3.2 Results, p. 5

Note: Dual-use cyber knowledge and an agentic capture-the-flag evaluation are reported, with the stated comparative conclusion quoted (the card's wording); no threshold language. Scores are not recorded.

Stated

• “we do not believe it poses risks due to advanced persuasion capabilities”

  §2.3.2 Results, p. 5

Note: A persuasion evaluation (MakeMeSay) is reported with the stated conclusion quoted.

Stated

• “Overall, we find that training the model to be honest drops the rate at which Grok 4.1 lies.”

  §2.2.1 Deception, p. 3

Note: The card reports a deception (lying under pressure) evaluation and a sycophancy evaluation as 'concerning propensities', with the conclusion quoted; its table gives dishonesty rates for Grok 4 and both Grok 4.1 configurations. No scheming, sabotage or oversight evaluation was found.

Stated

• “results in previous model cards were reported with an error in the evaluation settings, where only the English prompts were evaluated”

  §2.1.2 Evaluations, p. 2

• “the human baselines collected in previous work likely underestimate the … performance of high-context experts”

  §2.3.2 Results, pp. 4-5

Note: The card states an error in earlier cards' refusal results, that the new multilingual results are not directly comparable, and that the human baselines used may underestimate expert performance.

Stated

• “Model Card: Grok 4.7 September 21, 2026 Revision: 2026-09-21”

  Cover, PDF p. 1

Note: The cover prints the card's date (kind not labelled) and a revision date, both 2026-09-21.

Stated

• “treated as safety-threshold evaluations under the xAI Frontier Artificial Intelligence Framework (FAIF)”

  §7 Biological and chemical capabilities and safeguards, PDF p. 20 (printed p. 19)

• “xAI Frontier Artificial Intelligence Framework (FAIF). xAI, June 30, 2026.”

  References, item 16, PDF p. 29 (printed p. 28)

Note: The card names the framework and its reference gives the edition date June 30, 2026 (dataset faif-2026).

Stated

• “xAI Frontier Artificial Intelligence Framework (FAIF). xAI, June 30, 2026.”

  References, item 16, PDF p. 29 (printed p. 28)

Note: The reference carries an address (media.x.ai/v1/website/xai-frontier-artificial-intelligence-framework-30-june-2026-99c40684.pdf), also as a link annotation. That address returned HTTP 404 on 2026-11-02; the dataset's faif-2026 record names it as the file formerly served for the June 2026 edition.

Stated

• “Grok 4.7 scores below the FAIF safety thresholds on dual-use knowledge”

  §7 Biological and chemical capabilities and safeguards, PDF p. 20 (printed p. 19)

Note: Biological and chemical capability evaluations are reported as FAIF safety-threshold evaluations, run without production safeguards, with the threshold language quoted. Radiological and nuclear items appear only in a refusal evaluation (§9.3). Scores are not recorded (hazard rule).

Stated

• “Grok 4.7 shows small cybersecurity-relevant capability gains over Grok 4.6”

  §6 Cyber capabilities and safeguards, PDF p. 17 (printed p. 16)

Note: Offensive cyber capability evaluations are reported, run without production safeguards, with a comparative conclusion; no FAIF threshold language is given for cyber. The card states that third-party evaluators corroborated the internal cyber results (Q13). Scores are not recorded.

Stated

• “Results reported are taken from evaluations conducted by Datacurve.”

  §2.2 DeepSWE v1.1, note, PDF p. 8 (printed p. 7)

• “CathedralBench is an independent, third party evaluation of cyber performance.”

  §6.4 CathedralBench, PDF p. 19 (printed p. 18)

• “We additionally provided an unrestricted configuration of Grok 4.7 to third-party evaluators”

  §6 Cyber capabilities and safeguards, PDF p. 17 (printed p. 16)

Note: The card names Datacurve (and, in a similar note on PDF p. 9, Harbor) as having run evaluations, describes CathedralBench as a third-party evaluation, and thanks nine 'evaluation partners' (Abundant AI, Datacurve, Mecado, Atopile, Harbor, Proximal Labs, Cathedral, LatchBio, Vals AI). The third-party evaluators given unrestricted cyber access are not named.

Stated

• “the restricted task sets characterize the tested checkpoint and harness rather than establishing general biological safety or reliability”

  §7.1 BioSecBench, PDF p. 20 (printed p. 19)

• “absolute scores remain sensitive to the agent harness”

  §2.3 Terminal-Bench 4.0, PDF p. 9 (printed p. 8)

Note: The card also states that a live benchmark suite should be frozen to the evaluated snapshot and that some benchmark versions are not comparable with earlier ones.