Model cards compared

Stated

• “Claude 2 was developed by Anthropic and released in July 2023.”

  Section 2 'Claude 2 Model Card', 'Model details', PDF p. 1

• “Claude 2.1, a new release which builds additional product features and functionality on top of Claude 2.0”

  Claude 2.1 Model Card Appendix, Section 1 'Introduction', PDF p. 15

Note: The card states Claude 2's release month (July 2023). For Claude 2.1 the appendix states a new release without a date; the appendix also states that support at Claude 2.0's initial product launch was 100K tokens and is now 200K. The November 21, 2023 date on PDF p. 1 is the card’s update, not a release date.

Stated

• “Neither ARC nor we believe that our current Claude models possess the dangerous capabilities (‘autonomous replication’ abilities) that ARC is aiming to detect”

  Section 2 'Evaluations and Red Teaming', PDF p. 2

Note: The card states that ARC's safety audits addressed autonomous replication and that neither ARC nor Anthropic believes current Claude models have that capability. This is Anthropic's account; ARC's own report is not part of the card.

Stated

• “Before deployment, we also worked with external red teamers, including crowdworker platforms, to test Claude 2 on a range of Trust and Safety related topics”

  Section 2 'Evaluations and Red Teaming', PDF p. 2

• “We evaluated and red-teamed Claude 2 and previous Claude models for several national security and safety related risks.”

  Section 2 'Evaluations and Red Teaming', PDF p. 2

Note: The card states pre-deployment red-teaming by external red teamers including crowdworker platforms on Trust and Safety topics, and red-teaming for unnamed national security risks. Section 3.1 adds a crowdworker red-teaming task and Section 3.4 automated red-teaming on 328 held-out prompts. No number of testers or period is given.

Stated

• “We have been working with the Alignment Research Center (ARC) since fall of 2022 to support their safety audits of our AI models.”

  Section 2 'Evaluations and Red Teaming', PDF p. 2

Note: The card names ARC as conducting safety audits of Anthropic's models; the crowdworker platforms used for red-teaming are not named.

Stated

• “This approach has its limitations–for instance, we know the scenarios created by crowdworkers are not fully representative of the scenarios Claude will encounter out in real-world usage”

  Section 3.1 'Human Feedback Evaluations and Red-Teaming', PDF p. 3

• “Our internal evaluations for this metric are still in early stages of development”

  Appendix Section 3 'Honesty Evaluations', PDF p. 16

Note: The card states a limitation of its crowdworker-based human feedback and red-teaming evaluation, and that the Claude 2.1 document-faithfulness evaluation is at an early stage. It also states that it expects to release new findings as its research and evaluations continue (Section 1).

Stated

• “Anthropic, “Anthropic’s Responsible Scaling Policy.” September, 2023.”

  References, [5], PDF p. 39

• “The evaluation tasks were based on tasks defined in the appendix of v1.0 of our RSP [5]”

  Section 6.2.1 'Autonomous Replication and Adaption (ARA) evaluations', PDF p. 24

Note: The card names the Responsible Scaling Policy and identifies the edition by its date (September 2023) and as v1.0 (Responsible Scaling Policy v1.0, September 19, 2023).

Stated

• “September, 2023. https://www.anthropic.com/index/anthropics-responsible-scaling-policy.”

  References, [5], PDF p. 39

Note: The card gives a bibliographic reference with an address. The address is Anthropic's announcement page for the policy, not the policy PDF.

Stated

• “Our results show no indicators of catastrophic risk, and therefore we classify all of our Claude 3 models as ASL-2.”

  Section 6.2 'Evaluation Results', PDF p. 24

Note: The card assigns ASL-2 to all three Claude 3 models. It states that the evaluations were run on a lower-refusal version of Claude 3 Opus.

Stated

• “we still take various precautionary measures at ASL-2. We harden security against opportunistic attackers for all copies of Claude 3 model weights.”

  Section 6.3 'Security and Deployment Mitigations', PDF p. 26

• “You can read a more detailed description of our ASL-2 security and deployment measures in our full policy [5].”

  Section 6.3 'Security and Deployment Mitigations', PDF p. 26

Note: The card states security and deployment measures at ASL-2, the level assigned in Q05, including automated detection of CBRN- and cyber-related prompts. This is the developer's account of the measures.

Stated

• “In summary, the model did not meet our most conservative biological risk thresholds, and our expert consultants agreed.”

  Section 6.2.2 'Biological Evaluations', PDF p. 25

Note: The card states biological evaluations (automated question sets and a human uplift trial) with the outcome that the early-indicator thresholds were not met. No chemical, radiological or nuclear evaluation is reported for Claude 3. Evaluation details are not recorded (hazard rule).

Stated

• “We judged that the model did not pass the ASL-3 threshold on any of the early indicator tests.”

  Section 6.2.3 'Cyber Evaluations', PDF p. 25

Note: The card states cyber evaluations (vulnerability discovery and exploit development) with the outcome that the ASL-3 threshold was not passed. Scores and task details are not recorded (hazard rule).

Stated

• “Across all the rounds, the model was clearly below our ARA ASL-3 risk threshold, having failed at least 3 out of 5 tasks”

  Section 6.2.1 'Autonomous Replication and Adaption (ARA) evaluations', PDF p. 24

Note: The card states autonomous replication and adaptation evaluations with the outcome that the ASL-3 warning threshold was not crossed. Task contents are not recorded (hazard rule).

Stated

• “Examples of tested topics include, but are not limited to: child safety, dangerous weapons and technology, hate speech, violent extremism, fraud, and illegal substances.”

  Section 7.1.1 'Multimodal Policy Red-Teaming', PDF p. 27

• “We conduct vulnerability testing using internal and external human testers to explore over a dozen policy categories”

  Section 7 'Trust & Safety and Societal Impact Evaluations', PDF p. 26

Note: The card states a Trust & Safety multimodal red-team exercise, with example topics and a prompt count (378 prompts, Figure 17), and vulnerability testing by internal and external testers across over a dozen policy categories. Section 6.2 states that the RSP requires risk assessment 'primarily through automated evaluations and red teaming'.

Stated

• “we are aware that these results do not comprehensively rule out risk.”

  Section 6.4 'RSP areas for improvement', PDF p. 26

• “Opus performed worse, suggesting that we may have under-elicited the model’s capabilities.”

  Section 6.2.2 'Biological Evaluations', PDF p. 25

Note: The card states that its results do not rule out risk, that elicitation could be improved on ARA and CBRN tasks, and that the biological evaluations may have under-elicited capability. Section 6.2 adds that 'evaluations are a hard scientific problem'.

Stated

• “Based on our assessments, we classify Claude 3.5 Sonnet as an AI Safety Level 2 (ASL-2) model, indicating that it does not pose risk of catastrophic harm.”

  Section 3 'Safety', Introduction, PDF p. 6

Note: The addendum assigns ASL-2. It also states that the model did not trigger the compute threshold for the policy's full evaluation protocol, and that evaluations were run regardless.

Stated

• “Claude 3.5 Sonnet did not exceed our safety thresholds in these evaluations and we classify it at ASL-2.”

  Section 3, 'Safety Evaluations Results', PDF p. 6

Note: The addendum states CBRN evaluations (knowledge tests and a measure of uplift to non-experts) and one outcome for all three domains: the thresholds of concern were not exceeded. It does not state a CBRN-specific result. Evaluation details are not recorded (hazard rule).

Stated

• “Claude 3.5 Sonnet did not exceed our safety thresholds in these evaluations and we classify it at ASL-2.”

  Section 3, 'Safety Evaluations Results', PDF p. 6

Note: The addendum states capture-the-flag cyber evaluations and the shared outcome that the thresholds of concern were not exceeded. Task details are not recorded (hazard rule).

Stated

• “Claude 3.5 Sonnet did not exceed our safety thresholds in these evaluations and we classify it at ASL-2.”

  Section 3, 'Safety Evaluations Results', PDF p. 6

Note: The addendum states autonomy evaluations (software-engineering tasks) and the shared outcome. It also states that METR explored the model's autonomy-relevant capabilities, without giving METR's result.

Stated

• “Additionally, METR [28] did an initial exploration of the model’s autonomy-relevant capabilities.”

  Section 3, 'Safety Evaluations Overview', PDF p. 6

Note: The addendum names METR as having explored the model's autonomy-relevant capabilities. It gives no result of that exploration.

Stated

• “The UK AISI also conducted pre-deployment testing of a near-final model, and shared their results with the US AI Safety Institute”

  Section 3, 'Safety Evaluations Overview', PDF p. 6

Note: The addendum names the UK AI Safety Institute as having tested a near-final model before deployment and states that it shared its results with the US AI Safety Institute. It does not state that the US institute tested the model.

Stated

• “Note that it is possible that the results underestimate the capability of an equivalent Helpful-only model, because alignment training may cause it to hedge concerning answers.”

  Section 3, 'Safety Evaluations Overview', PDF p. 6

Note: The addendum states that safety training can lead capability evaluations to underestimate underlying capability, and that its results may do so. It also states that much remains to be learned about evaluation science and cadence.

Stated

• “Both models underwent extensive safety evaluations, including comprehensive testing for potential risks in biological, cybersecurity, and autonomous behavior domains, in accordance with our Responsible Scaling Policy (RSP) [4].”

  Section 1 'Introduction', PDF p. 1

• “[4] Anthropic, “Responsible Scaling Policy.” October, 2024. https://assets.anthropic.com/m/ 24a47b00f10301cd/original/Anthropic-Responsible-Scaling-Policy-2024-10-15.pdf.”

  References [4], PDF p. 13 (the address breaks across two lines)

Note: The card names the Responsible Scaling Policy and identifies the edition by a dated reference (October 2024) whose address carries the date 2024-10-15, which the dataset records for Responsible Scaling Policy v2.0.

Stated

• “[4] Anthropic, “Responsible Scaling Policy.” October, 2024. https://assets.anthropic.com/m/ 24a47b00f10301cd/original/Anthropic-Responsible-Scaling-Policy-2024-10-15.pdf.”

  References [4], PDF p. 13 (the address breaks across two lines)

Note: The card gives a bibliographic reference with the address of the policy document.

Stated

• “Based on our analysis, we judge that the upgraded Claude 3.5 Sonnet does not require ASL-3 safeguards at this time.”

  Section 3.2.1 'Results', PDF p. 10

• “While these models did not trigger the full evaluation protocol described in our Responsible Scaling Policy”

  Section 3.3 'Ongoing Safety Commitment', PDF p. 10

Note: The card states for the upgraded Claude 3.5 Sonnet that ASL-3 safeguards are not required, and for both models that they did not trigger the policy's full evaluation protocol. It also states that the computer use capability is classified under the ASL-2 framework (Section 2.1).

Stated

• “We also evaluate frontier risks in accordance with our Responsible Scaling Policy (RSP) [4] in the the areas of Chemical, Biological, Radiological, and Nuclear (CBRN) risks, Cybersecurity, and Autonomous Capabilities.”

  Section 3 'Safety', PDF p. 7

• “The model did not demonstrate capabilities requiring ASL … 3 safeguards and security in any domain.”

  Section 3.2.1 'Results', PDF pp. 9–10 (the text layer splits 'ASL-3' across the page break; the ellipsis marks the page number)

Note: The card states CBRN evaluations under the RSP and, for the upgraded Claude 3.5 Sonnet, that no domain showed capabilities requiring ASL-3 safeguards and security. Radiological and nuclear risks are reported together with chemical and biological as CBRN. No domain outcome is stated separately for Claude 3.5 Haiku.

Stated

• “We also evaluate frontier risks in accordance with our Responsible Scaling Policy (RSP) [4] in the the areas of Chemical, Biological, Radiological, and Nuclear (CBRN) risks, Cybersecurity, and Autonomous Capabilities.”

  Section 3 'Safety', PDF p. 7

• “The model did not demonstrate capabilities requiring ASL … 3 safeguards and security in any domain.”

  Section 3.2.1 'Results', PDF pp. 9–10 (the text layer splits 'ASL-3' across the page break; the ellipsis marks the page number)

Note: The card states cybersecurity evaluations under the RSP and, for the upgraded Claude 3.5 Sonnet, that no domain showed capabilities requiring ASL-3 safeguards and security. Method descriptions in Section 3.2 are not recorded (hazard rule).

Stated

• “we deem our software engineering evaluations as currently sufficient for ruling out ASL-3 autonomy capabilities”

  Section 3.1.4 'Evaluating Computer Use for the Responsible Scaling Policy', PDF p. 9

• “Based on our analysis, we judge that the upgraded Claude 3.5 Sonnet does not require ASL-3 safeguards at this time.”

  Section 3.2.1 'Results', PDF p. 10

Note: The card states autonomy evaluations under the RSP, that its software engineering evaluations suffice to rule out ASL-3 autonomy capabilities, and that the developer judges the upgraded Claude 3.5 Sonnet not to require ASL-3 safeguards.

Stated

• “We conducted comprehensive Trust & Safety (T&S) evaluations across fourteen policy areas in six languages”

  Section 3.1.1 'Model Red-Teaming', PDF p. 7

• “We conducted specific Trust & Safety red-teaming for computer use to identify potential abuse vectors.”

  Section 3.1.3 'Computer Use Red-Teaming', PDF p. 8

• “We conducted rigorous first party and independent third party multimodal red-teaming exercises”

  Section 2.1 'Computer Use', PDF p. 2

Note: The card states Trust & Safety red-teaming across fourteen policy areas in six languages, computer-use red-teaming, and first- and third-party multimodal red-teaming; Section 3.2 also mentions manual red-teaming within CBRN evaluations. No number of testers or period is given.

Stated

• “We also collaborated with METR [8] to conduct an independent assessment.”

  Section 1 'Introduction', PDF p. 1; repeated in Section 3.2, PDF p. 9

Note: The card names METR as conducting an independent assessment; it does not state the assessment's scope or outcome, or which model it covered.

Stated

• “joint pre-deployment testing of the new Claude 3.5 Sonnet model was conducted by the US AI Safety Institute (US AISI) [6] and the UK AI Safety Institute (UK AISI) [7].”

  Section 1 'Introduction', PDF p. 1; repeated in Section 3.2, PDF p. 9

Note: The card states pre-deployment testing of the upgraded Claude 3.5 Sonnet by the US and UK AI Safety Institutes; no government testing of Claude 3.5 Haiku is stated.

Stated

• “We believe dedicated scaffolding and prompting can further improve the results.”

  Section 2.2 'Tool Use & Agentic Tasks', PDF p. 3

• “We detail some of our preliminary reasoning below”

  Section 3.1.4 'Evaluating Computer Use for the Responsible Scaling Policy', PDF p. 9

Note: The card states that a reported agentic coding result could be improved with dedicated scaffolding and prompting, and describes its reasoning on computer use and RSP threat models as preliminary. No limitation is stated for the Section 3.2 frontier risk results.

Stated

• “For more information on the requirements for these ASL Standards, please see the Responsible Scaling Policy”

  Section 1.2.3 'AI Safety Level determination process', PDF p. 12 (hyperlinked words)

Note: The card names the Responsible Scaling Policy; the text gives no version, but the PDF's hyperlink on these words points to a policy PDF whose cover reads 'Version 2.2, Effective May 14, 2025' (Responsible Scaling Policy v2.2; identified by link annotation, maintainer decision 4a). The printed text does not name the edition.

Stated

• “For more information on the requirements for these ASL Standards, please see the Responsible Scaling Policy”

  Section 1.2.3 'AI Safety Level determination process', PDF p. 12 (hyperlinked words)

Note: The card refers the reader to the policy; the words carry a hyperlink to the RSP v2.2 PDF (also on PDF p. 117). The address is not printed in the text.

Stated

• “Our determination is that Claude Opus 4.5 does not cross either the AI R&D-4 or CBRN-4 capability threshold.”

  Section 1.2.4 'Conclusions', PDF p. 12

Note: The card states that the model does not cross the AI R&D-4 or CBRN-4 thresholds and that it is deployed under the ASL-3 Standard. For cyber it states that the policy sets no capability threshold (Q08).

Stated

• “For Claude Opus 4.5, we implemented ASL-3 (AI Safety Level 3) protections based on the model’s demonstrated capabilities.”

  Section 1.2.1 'Overview', PDF p. 11

• “Based on these assessments, we have decided to release Claude Opus 4.5 under the ASL-3 Standard.”

  Section 1.2.3 'AI Safety Level determination process', PDF p. 12

Note: The card states that ASL-3 protections were implemented on the basis of the capability assessment. This is the developer's account of the safeguards applied.

Stated

• “We determine that Claude Opus 4.5 does not cross the CBRN-4 threshold.”

  Section 1.2.4.2 'On chemical, biological, radiological, and nuclear (CBRN) risks', PDF p. 14

• “As a result, we determined ASL-3 safeguards were appropriate.”

  Section 7.2 'CBRN evaluations', 'Claude Opus 4.5 Results', PDF p. 119

• “we do not currently run specific evaluations on chemical risks internally”

  Section 7.2.1 'On chemical risks', PDF p. 120

Note: The card states biological evaluations with the outcome that the CBRN-4 threshold is not crossed and ASL-3 safeguards are appropriate. It states that chemical risks are not evaluated internally, and that radiological and nuclear evaluations are carried out with NNSA and their results are not published by Anthropic. Evaluation details are not recorded (hazard rule).

Stated

• “We believe that Claude Opus 4.5 does not demonstrate catastrophically risky capabilities in the cyber domain.”

  Section 7.4 'Cyber evaluations', 'Results', PDF p. 145

• “The Responsible Scaling Policy does not stipulate a capability threshold for cyber capabilities at any ASL level”

  Section 7.4 'Cyber evaluations', PDF p. 143

Note: The card states cyber evaluations and a conclusion without a policy threshold, which it states the policy does not set for cyber. Evaluation methods and scores are not recorded (hazard rule).

Stated

• “We judge that Claude Opus 4.5 could not fully automate an entry-level, remote-only research role at Anthropic.”

  Section 1.2.4.1 'On autonomy risks', PDF p. 13

• “Claude Opus 4.5 has roughly reached the pre-defined thresholds we set for straightforward ASL-4 rule-out based on benchmark tasks.”

  Section 1.2.3 'AI Safety Level determination process', PDF p. 12

Note: The card states AI R&D evaluations, that the AI R&D-4 threshold is not crossed, and that the rule-out drew also on an internal survey and qualitative impressions because benchmark rule-out thresholds were roughly reached.

Stated

• “Claude Opus 4.5 is very unlikely to pose a significant risk of catastrophic impacts through the intentional sabotage of human engineering, R&D, or decision-making.”

  Section 6.1.2 'Overall assessment of high-stakes sabotage risk', PDF p. 66

• “We saw no signs of sandbagging or strategic attempts to tamper with our safety testing in a way that would affect our RSP determinations”

  Section 6.1.1 'Key findings on safety and alignment', PDF p. 66

Note: The card states alignment evaluations covering sabotage, deception, sandbagging, reward hacking and evaluation awareness, with the conclusion that high-stakes sabotage risk is low. It also reports two isolated cases of deception by omission in testing earlier snapshots, which it attributes to interventions against prompt injection.

Stated

• “We worked with the US Center for AI Standards and Innovation to red-team Claude Opus 4.5 over a one-week window, which included at least 2–3 days of red-teaming.”

  Section 7.2.4.10 'ASL-4 red teaming with the CAISI', PDF p. 132

• “Finally, red-teaming results by various third parties demonstrated some increase in risk, but not enough to require additional protections.”

  Section 7.2 'CBRN evaluations', 'Claude Opus 4.5 Results', PDF p. 119

Note: The card states biological red-teaming by third parties, by one external expert over two days (Section 7.2.4.9) and by CAISI over a one-week window; prompt-injection red-teaming with Gray Swan (Section 5.2); and that cyber capabilities are red-teamed (Section 7.4).

Stated

• “Gray Swan measured the success rate of prompt injection attacks after a single attempt (k=1)”

  Section 5.2.1 'Gray Swan Agent Red Teaming benchmark for tool use', PDF p. 58

Note: The card names Gray Swan, which it calls an external research partner, as measuring prompt-injection attack success. The third parties in biological red-teaming and the external expert are not named; the changelog refers to ARC-AGI scores 'reported by the ARC Foundation'.

Stated

• “pre-deployment testing of Claude Opus 4.5 was conducted by the US Center for AI Standards and Innovation (CAISI) and the UK AI Security Institute (UK AISI).”

  Section 7.5 'Third party assessments', PDF p. 151

• “Anthropic has maintained a formal partnership with the U.S. Department of Energy’s National Nuclear Security Administration (NNSA) to evaluate our AI models for potential nuclear and radiological risks.”

  Section 7.2.2 'On radiological and nuclear risks', PDF p. 120

Note: The card states pre-deployment testing by CAISI and the UK AISI (CBRN, cyber, ASL-3 safeguards and misalignment), UK AISI testing of a pre-release snapshot for misalignment (Section 6.13), and an NNSA partnership evaluating models for nuclear and radiological risks.

Stated

• “Consistent with our RSP, the Responsible Scaling Officer and CEO made the ultimate determination on the required ASL Standards.”

  Section 1.2.3 'AI Safety Level determination process', PDF p. 12

• “Based on these assessments, we have decided to release Claude Opus 4.5 under the ASL-3 Standard.”

  Section 1.2.3 'AI Safety Level determination process', PDF p. 12

Note: The card states a decision to release in the company's voice, and names the Responsible Scaling Officer and CEO as making the ASL determination on which the release rests.

Stated

• “However, confidently ruling out these thresholds is becoming increasingly difficult.”

  Section 1.2.4 'Conclusions', PDF p. 12

• “parts of the AI R&D-4 and CBRN-4 thresholds have fundamental epistemic uncertainty or require more sophisticated forms of measurement”

  Section 1.2.4 'Conclusions', PDF p. 12

Note: The card states that ruling out the AI R&D-4 and CBRN-4 thresholds is becoming difficult and that parts of the thresholds carry epistemic uncertainty. It also states limited tools for studying reasoning faithfulness (Section 6.1.1).

Stated

• “System Card: Claude Haiku 5.5 October 7, 2026”

  Cover, PDF p. 1

Note: The card carries a printed date with day precision (October 7, 2026); its kind (issue or publication) is not stated. No changelog or revision date was found.

Stated

• “we describe our assessment of Claude Haiku 5.5 for catastrophic risks relevant to our Responsible Scaling Policy (RSP)”

  Section 2.1 'Introduction', PDF p. 11 (hyperlinked words)

Note: The words 'Responsible Scaling Policy (RSP)' carry a hyperlink to https://www.anthropic.com/responsible-scaling-policy, an undated page; the address is not printed in the text.

Stated

• “As such, we determine that Haiku 5.5 does not cross our CB-2 or Autonomy-2 RSP thresholds.”

  Section 2.1 'Introduction', PDF p. 11

• “However, we do treat Haiku 5.5 as meeting our CB-1 and Autonomy-1 thresholds, and we apply the corresponding mitigations from our RSP.”

  Section 2.1 'Introduction', PDF p. 11

Note: The card states that the model does not cross the CB-2 or Autonomy-2 thresholds and is treated as meeting CB-1 and Autonomy-1. No RSP threshold is named for cyber.

Stated

• “However, we do treat Haiku 5.5 as meeting our CB-1 and Autonomy-1 thresholds, and we apply the corresponding mitigations from our RSP.”

  Section 2.1 'Introduction', PDF p. 11

• “For chemical and biological (CB) risks, we have deployed the same harmful CB misuse classifiers as for our deployments of Claude Opus 5 and Claude Sonnet 5”

  Section 1.5 'Safeguards', PDF p. 9

Note: The card states that the mitigations corresponding to the CB-1 and Autonomy-1 thresholds are applied, and lists deployed classifiers for CB, cyber, frontier-LLM development and conventional weapons. This is the developer's account of the safeguards.

Stated

• “As such, we determine that Haiku 5.5 does not cross our CB-2 or Autonomy-2 RSP thresholds.”

  Section 2.1 'Introduction', PDF p. 11

• “We did not conduct expert red-teaming sessions, uplift trials, or other resource-intensive evaluations requiring human participants.”

  Section 2.2.1 'What we measured', PDF p. 11

Note: The card states automated chemical and biological (CB) evaluations, with the outcome that CB-2 is not crossed and CB-1 is treated as met. No radiological or nuclear evaluation is reported in the RSP section. Evaluation names and results are not recorded (hazard rule). Not cross-family checked: the maintainer excluded this cell on chemical and biological evaluations from the cross-family check of 2026-11-03.

Stated

• “Claude Haiku 5.5 is not a frontier model, but it is a relatively significant step up in cyber capabilities over Haiku 4.5.”

  Section 3.1 'Introduction', PDF p. 23

• “Given the relative lack of advanced cybersecurity capabilities, our cyber safeguards for Claude Haiku 5.5 trigger on significantly less activity than other recent releases.”

  Section 3.2 'Mitigations', PDF p. 23

Note: The card states cyber capability evaluations and the conclusion of a relative lack of advanced cybersecurity capabilities, compared with other Claude models; no threshold language is used for cyber. Benchmark contents and scores are not recorded (hazard rule).

Stated

• “Autonomy threat model 2 is not applicable to Haiku 5.5.”

  Section 2.3.1.1 'How Haiku 5.5 affects or changes analysis from our most recent Risk Report', PDF p. 19

• “As Claude Haiku 5.5 is much less capable than Opus 5.5 and does not push the capability frontier, we draw the same conclusion in this case.”

  Section 2.3.3 'Conclusion', PDF p. 20

Note: The card states that the Autonomy-2 threshold is not crossed, carrying over the Claude Opus 5.5 System Card's conclusion on the basis of relative capability, and that Autonomy threat model 1 applies (Q11).

Stated

• “our overall assessment is that the risk of catastrophic harm caused by misalignment of Claude Haiku 5.5 is also low.”

  Section 2.4.2 'Updated overall assessment of alignment risk', PDF p. 22

• “much weaker at covert sabotage than our larger models”

  Executive summary, PDF p. 3

Note: The card states alignment evaluations (behavioural audit, honesty, sandbox escape, covert-capability and sabotage evaluations) with the conclusion that misalignment risk is low.

Stated

• “We use Shade, an external adaptive red-teaming tool from Gray Swan, to evaluate our models’ robustness to prompt injection in coding environments.”

  Section 5.2.2.1 'Coding', PDF p. 51

Note: The card reports prompt-injection red-teaming under a section titled 'External red teaming' (coding, tool use and computer use surfaces) and adversarial testing by crowd workers (Section 1.2). It states that no expert red-teaming sessions were run for CB (Q07). No number of testers or period is given.

Stated

• “Gray Swan trains the attacker on the test scenarios against earlier Claude models, then runs it unchanged against the latest models on the same scenarios.”

  Section 5.2.2.1 'Coding', PDF p. 51

Note: The card names Gray Swan as running its attacker against the latest models. Section 1.6 states that external testers ran assessments without naming them there; Irregular is named as the developer of a cyber benchmark, not as a tester.

Stated

• “these measures are limited: past assessments have not fully captured the potential severity of misbehavior our models were capable of”

  Section 6.1.2 'Key findings on safety and alignment', PDF p. 56

• “The strength of the evidence provided by our alignment assessment for Haiku 5.5 is somewhat lower than that presented for Claude Mythos 5 in the August 2026 Risk Report”

  Section 2.4.1 'Updates to claims and core argument', PDF p. 21

Note: The card states limits of its alignment measures and of the evidence for this model; it also states that internal testing runs at a smaller scale than deployment (Section 6.1.1) and that CB evaluations were automated, without studies requiring human participants (Q07).

Stated

• “Model card published April 10, 2025”

  Header, PDF p. 1

Note: The card prints its publication date, April 10, 2025. No revision date is printed.

Stated

• “Frontier Safety Framework evaluations according to Google DeepMind’s Frontier Safety Framework (FSF)”

  'Ethics and Safety', 'Evaluation Approach', PDF p. 5 (hyperlinked words)

Note: The card names the Frontier Safety Framework; the text gives no version, but the hyperlink on these words points to a framework PDF whose cover reads "Version 2.0" and "4th February 2025" (Frontier Safety Framework v2.0). The file linked differs in bytes from the dataset's other file of that edition; both covers give the same version and date.

Stated

• “Frontier Safety Framework evaluations according to Google DeepMind’s Frontier Safety Framework (FSF)”

  'Ethics and Safety', 'Evaluation Approach', PDF p. 5 (hyperlinked words)

Note: The words carry a hyperlink to the Frontier Safety Framework 2.0 PDF. The address is not printed in the text.

Stated

• “Human red teaming conducted by specialist teams across the policies and desiderata;”

  'Ethics and Safety', 'Evaluation Approach', PDF p. 5

• “Automated red teaming to dynamically evaluate Gemini at scale, complementing human efforts and static evaluations for both security and safety-focused evaluations;”

  'Ethics and Safety', 'Evaluation Approach', PDF p. 5

Note: The card states human red teaming by specialist teams across policies and desiderata, and automated red teaming for security and safety. It gives no number of testers or period, and reports no red-teaming results.

Stated

• “RSC also reviewed data on the model’s performance via assurance evaluations and made release decisions.”

  'Ethics and Safety', 'Evaluation Approach', PDF pp. 5–6

Note: The card states that Google DeepMind's Responsibility and Safety Council, which it calls Google DeepMind's governance body, reviewed assurance-evaluation data and made release decisions. The passage uses the plural and does not describe the decision for this model specifically.

Stated

• “The evaluation results are for automated evaluations and not human evaluation or red-teaming”

  'Ethics and Safety', 'Training and Development Evaluation Results', PDF p. 6

Note: The card states that the reported safety results are automated evaluations only, given relative to Gemini 1.5 Pro 002.

Stated

• “Model card published April 15, 2025”

  Header, PDF p. 1

Note: The card prints its publication date, April 15, 2025. No revision date is printed.

Stated

• “Frontier Safety Framework evaluations according to Google DeepMind’s Frontier Safety Framework (FSF)”

  'Ethics and Safety', 'Evaluation Approach', PDF p. 5 (hyperlinked words)

Note: The card names the Frontier Safety Framework; the text gives no version, but the hyperlink on these words points to a framework PDF whose cover reads "Version 2.0" and "4th February 2025" (Frontier Safety Framework v2.0). The file linked differs in bytes from the dataset's other file of that edition; both covers give the same version and date.

Stated

• “Frontier Safety Framework evaluations according to Google DeepMind’s Frontier Safety Framework (FSF)”

  'Ethics and Safety', 'Evaluation Approach', PDF p. 5 (hyperlinked words)

Note: The words carry a hyperlink to the Frontier Safety Framework 2.0 PDF. The address is not printed in the text.

Stated

• “Human red teaming conducted by specialist teams across the policies and desiderata;”

  'Ethics and Safety', 'Evaluation Approach', PDF p. 5

• “Automated red teaming to dynamically evaluate Gemini at scale, complementing human efforts and static evaluations for both security and safety-focused evaluations;”

  'Ethics and Safety', 'Evaluation Approach', PDF p. 5

Note: The card states human red teaming by specialist teams across policies and desiderata, and automated red teaming for security and safety. It gives no number of testers or period, and reports no red-teaming results.

Stated

• “The RSC also reviewed data on the model’s performance via assurance evaluations and made release decisions.”

  'Ethics and Safety', 'Evaluation Approach', PDF pp. 5–6

Note: The card states that Google DeepMind's Responsibility and Safety Council, which it calls Google DeepMind's governance body, reviewed assurance-evaluation data and made release decisions. The passage uses the plural and does not describe the decision for this model specifically.

Stated

• “The evaluation results are for automated evaluations and not human evaluation or red-teaming”

  'Ethics and Safety', 'Training and Development Evaluation Results', PDF p. 6

Note: The card states that the results in its training and development evaluation table are automated evaluations, not human evaluation or red-teaming, given relative to Gemini 1.5 Pro 002. The limit is stated for that table; it does not describe the card’s other safety findings or its stated human red-teaming.

Stated

• “the Gemini 3 Pro model results give us confidence that Gemini 3 Flash is unlikely to reach any CCLs”

  Ethics and Content Safety, 'Frontier Safety Assessment', PDF p. 6 (printed p. 5)

Note: The card states that Gemini 3 Pro Preview did not reach any critical capability level and that Gemini 3 Flash, as a less capable model, is unlikely to reach any CCL; it states that it relies on the results reported for Gemini 3 Pro and reports no frontier safety evaluation of Gemini 3 Flash itself. No domain is named.

Stated

• “We conduct manual red teaming by specialist teams who sit outside of the model development team”

  Ethics and Content Safety, 'Human Red Teaming Results', PDF p. 6 (printed p. 5)

• “the scope of red teaming covered potential issues outside of our strict policies”

  Ethics and Content Safety, 'Human Red Teaming Results', PDF p. 6 (printed p. 5)

Note: The card states manual red teaming by Google specialist teams outside the model development team, covering child safety and content safety policies and issues beyond them; it states no number of testers or period.

Stated

• “we deemed Gemini 3 Flash was acceptable for deployment”

  Ethics and Content Safety, 'Frontier Safety Assessment', PDF p. 6 (printed p. 5)

Note: The card states a deployment judgement in the company's voice ('we'), made 'in line with the risk acceptance criteria outlined in our FSF'. No person, office or committee is named.

Stated

• “The evaluation results are for automated evaluations and not human evaluation or red teaming”

  Ethics and Content Safety, 'Training and Development Evaluation Results', PDF p. 5 (printed p. 4)

• “not directly comparable with performance results found in previous Gemini model cards”

  Ethics and Content Safety, 'Training and Development Evaluation Results', PDF p. 6 (printed p. 5)

Note: The card states that the reported safety results are automated only, are computed with revised evaluations not comparable with earlier cards, and that variation is expected in automated results.

Stated

• “In line with our Frontier Safety Framework (April 2026), we conducted critical capability assessments of Gemini 4 Argon”

  Safety & Security, 'Frontier Safety Assessment', PDF p. 11 (printed p. 10)

Note: The card names the framework with the date 'April 2026' and links the v3.1 document (Frontier Safety Framework v3.1 in the dataset, version date 2026-04-17).

Stated

• “In line with our Frontier Safety Framework (April 2026), we conducted critical capability assessments of Gemini 4 Argon”

  Safety & Security, 'Frontier Safety Assessment', PDF p. 11 (printed p. 10)

Note: The PDF's link annotation on p. 11 points to storage.googleapis.com/deepmind-media/DeepMind.com/Blog/strengthening-our-frontier-safety-framework/frontier-safety-framework_3-1.pdf; a link on p. 9 points to deepmind.google/frontier-safety/ (the framework versions page).

Stated

• “We cannot rule out that Gemini 4 Argon has reached this CCL for biological information risk”

  Safety & Security, 'Frontier Safety Assessment', PDF p. 11 (printed p. 10)

• “Stealth and Situational Awareness TCL: We cannot rule out that Gemini 4 Argon has reached this TCL”

  Safety & Security, 'Frontier Safety Assessment', PDF p. 11 (printed p. 10)

• “we assess its overall capabilities to be below the CCL threshold”

  Frontier safety table, Harmful Manipulation row, PDF p. 13 (printed p. 12)

Note: The card states an outcome for each domain of its table: CBRN uplift TCL not reached for chemical, radiological and nuclear; biological CCL 'cannot be ruled out'; cybersecurity CCL 'cannot be ruled out'; harmful manipulation CCL not reached; stealth and situational awareness TCL 'cannot be ruled out'; ML R&D acceleration and automation CCLs not reached.

Stated

• “We can rule out the TCL for the chemical, radiological, and nuclear domains with reasonable confidence.”

  Frontier safety table, CBRN row, PDF p. 12 (printed p. 11)

• “We cannot rule out that Gemini 4 Argon reaches the biological CCL.”

  Frontier safety table, CBRN row, PDF p. 12 (printed p. 11)

Note: CBRN evaluations reported at policy level: the uplift TCL is stated as ruled out for chemical, radiological and nuclear; the biological uplift level 1 CCL is stated as not ruled out. Evaluation details in the row are not recorded (hazard rule).

Stated

• “We cannot rule out that Gemini 4 Argon reaches the cybersecurity CCL.”

  Frontier safety table, Cybersecurity row, PDF p. 12 (printed p. 11)

Note: The card states that the cybersecurity uplift level 1 CCL cannot be ruled out and that safeguards are applied (Q06). Evaluation details are not recorded (hazard rule).

Stated

• “Gemini 4 Argon's performance remains below our CCL threshold.”

  Frontier safety table, ML R&D row, PDF p. 14 (printed p. 13)

Note: The table gives 'CCL not reached' for ML R&D acceleration level 1 and ML R&D automation level 1, on the basis of an internal research engineering benchmark. The loss-of-control (stealth and situational awareness) result is recorded under Q11.

Stated

• “we assess its overall capabilities to be below the CCL threshold”

  Frontier safety table, Harmful Manipulation row, PDF p. 13 (printed p. 12)

Note: The card reports human behavioural studies for harmful manipulation and states the level 1 CCL as not reached; it describes the area as one whose evaluations it continues to iterate (Q16).

Stated

• “Stealth and Situational Awareness TCL: We cannot rule out that Gemini 4 Argon has reached this TCL”

  Safety & Security, 'Frontier Safety Assessment', PDF p. 11 (printed p. 10)

• “stealth (ability to circumvent basic oversight mechanisms)”

  Frontier safety table, Loss of Control row, PDF p. 13 (printed p. 12)

Note: The card reports a loss-of-control evaluation of the model's capability for stealth (circumventing basic oversight) and situational awareness, with the stated conclusion that the TCL cannot be ruled out. It reports no propensity evaluation (deception, scheming, sabotage) in the card itself; challenge results are not recorded.

Stated

• “Human Red Teaming conducted by specialist teams who sit outside of the model development team, across the policies and desiderata”

  Safety & Security, 'Evaluation Approach', PDF p. 8 (printed p. 7)

• “the scope of red teaming covered potential issues outside of our strict policies”

  Safety & Security, 'Human Red Teaming Results', PDF p. 11 (printed p. 10)

Note: The card states human red teaming by specialist teams in Google's Trust & Safety organization, outside the model development team, covering child safety, content safety policies and issues beyond them, plus automated red teaming; the frontier safety table also refers to expert red teaming in the biological domain. No number of testers or period is given.

Stated

• “As a nascent risk area we continue to iterate on our harmful manipulation evaluations”

  Frontier safety table, Harmful Manipulation row, PDF p. 13 (printed p. 12)

• “not directly comparable with performance results found in previous Gemini model cards”

  Safety & Security, 'Training and Development Evaluation Results', PDF p. 10 (printed p. 9)

Note: The card also states that three thresholds (biological CCL, cybersecurity CCL, stealth and situational awareness TCL) could not be ruled out (Q05) and that the automated safety results are not human evaluation or red teaming.

Stated

• “Testing conducted to date has been in English, and has not covered, nor could it cover all scenarios.”

  Ethical Considerations and Limitations

Note: The card states that its testing was in English and could not cover all scenarios.

Stated

• “70B Instruct: December 6, 2024”

  Model Information, 'Model Release Date'

• “Since Meta is openly releasing these models”

  Hardware and Software, 'Training Greenhouse Gas Emissions'

Note: The card gives the release date of the 70B Instruct model and states that the models are released openly under the Llama 3.3 Community License.

Stated

• “we conducted recurring red teaming exercises with the goal of discovering risks via adversarial prompting”

  Responsibility & Safety, Evaluations, 'Red teaming'

• “The red team consisted of experts in cybersecurity, adversarial machine learning, responsible AI, and integrity”

  Responsibility & Safety, Evaluations, 'Red teaming'

Note: The card states recurring red-teaming and gives the expertise of the red team; it gives no number of testers or period.

Stated

• “Testing conducted to date has not covered, nor could it cover, all scenarios.”

  Ethical Considerations and Limitations, second paragraph

Note: The card states that its testing could not cover all scenarios.

Stated

• “in line with Meta’s [Frontier AI Framework](https://ai.meta.com/static-resource/meta-frontier-ai-framework).”

  'Risks and Limitations'

Note: The card links the framework document at its address.

Stated

• “Although we have performed some limited evaluations, we have not conducted a full range of possible evaluations for these models.”

  'Risks and Limitations'

Note: The card states that its evaluations are limited, that performance in production and real-world use has not been evaluated, and that the model has not been fully evaluated for content risks.

Stated

• “Date: October 8, 2025”

  Title page, below the abstract, PDF p. 1

Note: Date printed on the report. Meta's publication page for the report is dated September 24, 2025 (inventory); the report itself does not say whether the October 8 text is a revision.

Stated

• “Meta AI. Meta frontier ai framework. https://ai.meta.com/static-resource/meta-frontier-ai-framework, 2025a. Accessed: 2025-09-18.”

  References, PDF p. 15

Note: The reference list gives the framework's address and an access date.

Stated

• “These results indicate that CWM is within the “moderate” risk threshold for the catastrophic domains defined in Meta’s Frontier AI Framework.”

  Section 1 Introduction, PDF p. 1

Note: The report states a 'moderate' risk threshold for the framework's catastrophic domains it assessed (cybersecurity, chemical and biological).

Stated

• “we believe that open-source release of CWM is unlikely to lead to additional risk of catastrophic outcomes related to CB1 or CB2”

  Section 3 Chemical & Biological Evaluation, Summary of results, PDF p. 6

Note: The report states that chemical and biological evaluations were run and gives a conclusion for the framework outcomes CB1 and CB2; with the overall 'moderate' threshold statement under Q05.

Stated

• “supporting a conclusion of a “moderate” overall risk level from cybersecurity capabilities”

  Section 2 Cybersecurity Evaluation, Summary of results, PDF p. 3

Note: The report states that cybersecurity capability evaluations were run against the framework's Cyber 1 and Cyber 2 scenarios and concludes 'moderate'.

Stated

• “our preliminary evaluations suggest that CWM shows undesirable propensities at rates comparable to most open-source models”

  Section 1 Introduction, PDF p. 1

• “Although our internal results did not reveal any concerning findings, we believe our research is still too nascent for meaningful interpretation.”

  Section 4 Propensities, PDF p. 10

Note: The report states an honesty (epistemic integrity) evaluation with a conclusion, and states that corrigibility and power-seeking propensities were assessed but their results are not included.

Stated

• “may underestimate capabilities that could emerge with richer, well-instrumented scaffolding”

  Section 2 Cybersecurity Evaluation, Limitations, item 2, PDF p. 3

• “for this assessment we do not include malicious fine-tuning”

  Section 1.1 Evaluation Setup, PDF p. 2

Note: The report states limits of its cyber evaluations (benchmark coverage, tooling) and that malicious fine-tuning was not included; similar limitation lists follow the chemical and biological and the propensity sections.

Stated

• “Date: June 12, 2026”

  Abstract page, PDF p. 2

Note: The report prints the date June 12, 2026, without a kind. arXiv's margin stamp on PDF p. 1 reads '14 May 2026', which does not agree with the printed date or with the identifier 2606.12429; both are recorded as read, and neither is the card's own statement of publication. Meta’s own copies were retrieved in the cross-family check of 2026-11-04 (not here: ai.meta.com answered HTTP 400 and web.archive.org refused connections): an Internet Archive capture of 2026-04-14 holds an earlier 158-page expression that prints April 14, 2026, and the live copy prints May 26, 2026. Under maintainer decision 3a the row is dated by that earliest located copy, 2026-04-14; the arXiv copy read here is a later expression. The arXiv stamp of 14 May is the submission date, corroborated by the repository history.

Stated

• “https://ai.meta.com/static-resource/Meta_Advanced-AI-Scaling-Framework-v2”

  Section 1 'Introduction', footnote 2, PDF p. 6

• “Muse Spark was developed and evaluated under Meta’s Advanced AI Scaling Framework”

  Section 1.2 'Governance', PDF p. 14

Note: The report names the Advanced AI Scaling Framework and gives an address whose file name names version 2 (Advanced AI Scaling Framework Version 2, 2026-04-08). The text gives no version number of its own.

Stated

• “https://ai.meta.com/static-resource/Meta_Advanced-AI-Scaling-Framework-v2”

  Section 1 'Introduction', footnote 2, PDF p. 6

Note: The report gives the framework's address in a footnote.

Stated

• “we determined the model, prior to applying mitigations, falls under the “high risk” threshold under the Advanced AI Scaling Framework”

  Section 1.2 'Governance', PDF p. 14

• “However, after applying mitigations, the residual risk of the model is that of “moderate or lower risk.”

  Section 1.2 'Governance', PDF p. 14

Note: The report states a 'high risk' determination before mitigations, for the chemical and biological category, and a residual 'moderate or lower risk' after mitigations. It states 'moderate or lower' for cybersecurity and loss of control (Q08, Q09).

Stated

• “In response to the “high risk” determination, we have defined, implemented, and validated a set of mitigations to reduce the residual risk of public deployment to “moderate or lower.”

  Section 1.1.1, 'Chemical & Biological risks', PDF p. 9

Note: The report ties mitigations (refusal mechanisms, detection of persistent malicious use and monitoring) to the 'high risk' determination, and states that deployment is conditional on them under the framework. It also states cyber-misuse monitoring as a compensating control. This is the developer's account, not evidence that the mitigations work.

Stated

• “assess that the model has “high risk” for Chemical and/or Biological risks.”

  Section 1.1.1, 'Chemical & Biological risks', PDF p. 9

Note: The report states chemical and biological evaluations (dual-use knowledge, agentic scientific tasks and high-risk bottlenecks) with the outcome 'high risk' before mitigations and 'moderate or lower' residual risk after them. Evaluation details are not recorded (hazard rule).

Stated

• “We assess cybersecurity risk as “moderate or lower” with respect to the threat scenarios outlined in Meta’s Advanced AI Scaling Framework.”

  Section 1.1.1, 'Cybersecurity risks', PDF p. 9

Note: The report states knowledge, capture-the-flag, real-world and social-engineering cyber evaluations with the framework outcome 'moderate or lower'. Scores are not recorded (hazard rule).

Stated

• “We assess loss of control risk as “moderate or lower”.”

  Section 1.1.1, 'Loss of Control risks', PDF p. 9

• “Its autonomous technical capabilities—spanning software engineering, ML engineering, and end-to-end research—remain too constrained”

  Section 1.1.1, 'Loss of Control risks', PDF p. 10

Note: The report states loss-of-control evaluations, including acceleration of AI development, with the outcome 'moderate or lower' and the conclusion that autonomous research capabilities remain constrained.

Stated

• “we have included results from an evaluation developed by Charlemagne Labs that specifically measures social engineering capabilities in multi-turn settings.”

  Section 2.2.2.3 'Social Engineering Capabilities', PDF p. 47

• “we do not find the capabilities of the model (without system level guardrails) to be sufficiently high to trigger a determination of high risk according to our Advanced AI Scaling Framework”

  Section 2.2.2.3 'Social Engineering Capabilities', PDF p. 48

Note: The report states a multi-turn social-engineering capability evaluation (an attacker model trying to convince a simulated victim), with composite scores against open models (Figure 20), as part of the cyber domain, and concludes that the capability is not high enough to trigger a high-risk determination under its framework. The victims are simulated: no result with human subjects is reported. Methods are not recorded (hazard rule).

Stated

• “The model demonstrates contained deception and exhibits some propensities toward agentic misalignment in controlled settings, such as self-preservation and resistance to discontinuation.”

  Section 1.1.1, 'Loss of Control risks', PDF p. 10

• “These behaviors remain within acceptable thresholds but warrant monitoring for loss of control risks.”

  Section 1.1.1, 'Loss of Control risks', PDF p. 10

Note: The report states evaluations of deception, agentic misalignment, sandbagging, monitor evasion and alignment faking, with the conclusion quoted. It reports Apollo Research's finding of high evaluation awareness and its own follow-up (Section 4.1.11).

Stated

• “A third-party human red team from HandshakeAI32 was granted pre-release access to a few versions of Muse Spark and Meta AI Thinking to manually evaluate robustness against jailbreak attacks.”

  Section 3.1.3.2 'Human Red Teaming', PDF p. 82

• “HandshakeAI prioritized four categories: (1) sex-related crimes, (2) violent crimes, (3) non-violent crimes, and (4) self-harm and suicide.”

  Section 3.1.3.2 'Human Red Teaming', PDF p. 82

• “HandshakeAI reported approximately 149 hours of red-teaming effort”

  Section 3.1.3.2 'Human Red Teaming', PDF p. 82

Note: The report states third-party human red teaming of jailbreak robustness with pre-release access, with its scope: four prioritised content-policy categories and approximately 149 hours of effort (hours of effort, not a testing period). It also reports large-scale automated red teaming (Section 3.1). No number of testers is given in the passage read. The “32” after HandshakeAI in the first quotation is a footnote marker.

Stated

• “Independent third-party testing by Apollo Research found Muse Spark has the highest rate of evaluation awareness they have observed to date.”

  Abstract, PDF p. 2

Note: The report names Apollo Research (evaluation awareness), HandshakeAI (human red teaming, Q12) and Charlemagne Labs (social engineering, Q10), and names Deloitte, Faculty, Frontier Design and SecureBio as engaged in the chemical and biological assessment (Section 2.1).

Stated

• “We then describe the governance process that led to the decision to deploy Muse Spark under Meta’s Advanced AI Scaling Framework2”

  Section 1 'Introduction', PDF p. 6

• “Key decision-makers for Muse Spark’s risk threshold determinations were the Chief AI Officer and Director of Alignment and Risk”

  Section 1.2 'Governance', PDF p. 14

Note: The report refers to 'the decision to deploy' and 'our launch decision' in the company's voice, and names the Chief AI Officer and the Director of Alignment and Risk as the decision-makers for the risk-threshold determinations. It does not name a maker of the deployment decision other than the company.

Stated

• “We cannot rule out this possibility on the basis of behavioral evaluations alone and flag it as an inherent epistemic limitation of assessments of this kind.”

  Section 1.1.1, footnote 11, PDF p. 10

Note: The report states that a model capable of strategic behaviour could make its evaluations appear credible, and that this cannot be ruled out by behavioural evaluations. It also states that some baseline assessments give only a lower bound on performance and that evaluation awareness qualifies some results.

Stated

• “Date: October 23, 2026”

  Abstract page, PDF p. 2 (unnumbered)

Note: Date printed on the report. Meta's announcement of Muse Spark 1.3, dated September 2, 2026, links to the report at the same address (inventory); the report does not say whether the October 23 text is a revision.

Stated

• “Evaluated without mitigations, we continue to not rule out Muse Spark 1.3 meeting this threshold in the Chemical & Biological domain.”

  Abstract page, PDF p. 2

• “we assess residual risk after system-level mitigations across the Chemical & Biological and Cybersecurity domains as “moderate or lower.” Our current Loss of Control assessment is also “moderate or lower.”

  Section 1.1.1 Risk Assessment Summary, PDF p. 8 (printed p. 7)

Note: The report states that the 'high risk' threshold is not ruled out before mitigations in the chemical and biological domain, and a residual 'moderate or lower' assessment for chemical and biological and for cybersecurity, and a 'moderate or lower' Loss of Control assessment, for the Muse and Meta API deployments.

Stated

• “The Muse and Meta API deployments include system-level mitigations designed to reduce residual Chemical & Biological risk to “moderate or lower.”

  Abstract page, PDF p. 2

Note: The report ties system-level mitigations to the chemical and biological determination; section 2.1.2 describes them. This is the developer's account, not evidence that the mitigations work.

Stated

• “For Muse Spark 1.3, however, we do not rule out a pre-mitigation “high risk” capability finding.”

  Section 1.1.1 Risk Assessment Summary, PDF p. 8 (printed p. 7)

Note: The report states chemical and biological capability evaluations and the framework outcome language before mitigations; the residual assessment is under Q05.

Stated

• “Based on our updated suite of cyber evaluations and measurements, we assess the unmitigated model as “moderate or lower” risk.”

  Section 1.1.1 Risk Assessment Summary, PDF p. 9 (printed p. 8)

Note: The report states cyber capability evaluations against the framework's Cyber 1 and Cyber 2 criteria and a 'moderate or lower' outcome for the unmitigated model.

Stated

• “We assess Muse Spark 1.3 as “moderate or lower” for acceleration of AI development.”

  Section 2.3.1.1 Acceleration of AI Development, PDF p. 35 (printed p. 34)

Note: The report states AI R&D evaluations under its Loss of Control domain with a 'moderate or lower' outcome.

Stated

• “We assess the Cyber 3 (scaled fraud, extortion, and scams) outcome through a multi-turn social-engineering capability evaluation”

  Section 2.2.2 Social Engineering, PDF p. 25 (printed p. 24)

• “Muse Spark 1.3 refuses almost all requests regarding social engineering.”

  Section 2.2.2 Social Engineering, PDF p. 26 (printed p. 25)

Note: The report places a manipulation (social-engineering) evaluation under the cybersecurity domain; its stated conclusion concerns refusal by the mitigated deployments, not a capability level.

Stated

• “We find suggestive evidence of strategic underperformance on Chemical & Biological evaluations.”

  Section 1.1.1 Risk Assessment Summary, Loss of Control, PDF p. 9 (printed p. 8)

• “Due to small effects we do not change our assessment of Chemical & Biological risks.”

  Section 1.1.1 Risk Assessment Summary, Loss of Control, PDF p. 9 (printed p. 8)

• “Capabilities to evade oversight increase relative to Muse Spark 1.1 on SHADE-Arena.”

  Section 1.1.1 Risk Assessment Summary, Loss of Control, PDF p. 9 (printed p. 8)

Note: The report states evaluations of strategic underperformance and oversight evasion, with conclusions; further misalignment evaluations are in sections 2.3 and 4.

Stated

• “combining large-scale automated red teaming, domain-specific benchmarks, and independent third-party assessments”

  Section 1.1.2 Safety & Robustness Summary, PDF p. 9 (printed p. 8)

• “Before the release, we also conducted third-party red teaming on both Muse Spark 1.3 (API) and Muse Spark 1.3 (Muse)”

  Section 1.1.2 Safety & Robustness Summary, PDF p. 10 (printed p. 9)

Note: The report states automated and third-party red-teaming before release, on both deployment variants; sections 3.1.4 and 3.2.2.3 give the jailbreak and prompt-injection scope.

Stated

• “We have shared pre-release access to Muse with Handshake AI’s red team for conducting human red teaming to find jailbreaks.”

  Section 3.1.4 Third-Party Red Teaming on Jailbreak, Handshake AI Human Red Teaming, PDF p. 59 (printed p. 58)

• “In this evaluation, Gray Swan chose the 2026 Q1 and Q2 (April) offerings of the IPI Arena.”

  Section 3.2.2.3 Third-Party Red Teaming on Prompt Injection, PDF p. 67 (printed p. 66)

Note: The report names Handshake AI and Gray Swan as having tested the model; it also reports results on a Scale AI benchmark (section 3.1.4.1).

Stated

• “using the helpful-only variant of Muse Spark 1.3 can also slightly underestimate performance”

  Section 2.3.1.1 Acceleration of AI Development, PDF p. 36 (printed p. 35)

• “We find no broad decline in CoT monitorability relative to Muse Spark 1.1, though more comprehensive evaluation is needed.”

  Section 1.1.1 Risk Assessment Summary, PDF p. 9 (printed p. 8)

Note: The report states limits of individual assessments; several sections carry their own 'Limitations' paragraphs.

Stated

• “We chose to release the model to help the open-source community develop the most effective ways to reduce the toxicity”

  Limitations of Phi-2, 'Toxicity'

Note: The card states a choice to release the model, with its reason, in the company's voice ('we'). No person, office or committee is named.

Stated

• “the Phi-2 model has not been tested to ensure that it performs adequately for any production-level application”

  Intended Uses, Notes

Note: The card states a gap in its testing for production use.

Stated

• “**Release date** | December 12, 2024”

  Model Summary table, 'Release date'

• “is a state-of-the-art open model”

  Model Summary table, 'Description'

Note: The card gives a release date and the release form (open model, MIT licence).

Stated

• “we collaborated with the independent AI Red Team (AIRT) at Microsoft to assess safety risks posed by `phi-4` in both average and adversarial user scenarios”

  Safety, Safety Evaluation and Red-Teaming

Note: The card states red-teaming by Microsoft's AI Red Team, with its scope (average and adversarial user scenarios, single- and multi-turn interactions, jailbreak techniques).

Stated

• “Our models is not specifically designed or evaluated for all downstream purposes”

  Intended Use, 'Out-of-Scope Use Cases'

Note: The card states that the model was not evaluated for all downstream purposes.

Stated

• “**Release date:** June 2025”

  Training, Model, 'Release date'

• “Phi-4-mini-flash-reasoning is a lightweight open model”

  Model Summary, first sentence

Note: The card gives a release month and the release form (open model, MIT licence; also offered in Azure AI Foundry).

Stated

• “This model is designed and tested for math reasoning only. It is not specifically designed or evaluated for all downstream purposes.”

  Intended Uses, Use Case Considerations

Note: The card states the limited scope of its testing.

Stated

• “27 Oct 2026”

  Model summary table, 'Release date' row, PDF p. 1 (label and value are separated in the PDF text layer; the page layout pairs them)

• “available through Azure AI Foundry Private Preview solely for use within Microsoft codename MDASH”

  Section 2.3 Distribution channels, PDF p. 3

Note: The card gives a release date and a restricted release form (private preview within MDASH, subject to approval).

Stated

• “evaluated at the model layer across a range of cybersecurity capability and safety benchmarks”

  Section 3, Model-Only External Cyber Benchmark Results, PDF p. 4

• “This assessment uncovered several critical risks of the model alone”

  Section 3.2 Safety evaluation and red-teaming, PDF p. 7

Note: The card reports offensive-cyber capability evaluations and states that an internal red-team assessment found 'critical risks of the model alone'; it uses no framework threshold language. Benchmark details are not recorded here.

Stated

• “MAI-Cyber-1.1-Flash was also tested via multiple distinct red-teaming operations.”

  Section 3.2 Safety evaluation and red-teaming, PDF p. 7

• “The MAI-Internal Red Team ran a red-team assessment of MAI-Cyber-1.1-Flash across 38 adversarial scenarios”

  Section 3.2 Safety evaluation and red-teaming, PDF p. 7

Note: The card states red-teaming by the MAI internal red team (38 scenarios), by Microsoft's AI Red Team within MDASH and by an external firm (Q13).

Stated

• “Microsoft engaged Casaba Security, an independent third-party firm, to evaluate the cyber capability of MAI-Cyber-1.1-Flash”

  Section 3.2 Safety evaluation and red-teaming, PDF p. 7

Note: The card names Casaba Security as an external evaluator.

Stated

• “These results represent model-layer performance and do not include additional orchestration or capabilities provided by the codename MDASH system.”

  Section 3, Model-Only External Cyber Benchmark Results, PDF p. 5

Note: The card states the scope limit of its benchmark results.

Stated

• “GPT-4V(ision) System Card OpenAI September 25, 2023”

  Cover, PDF p. 1

Note: The card prints September 25, 2023 beneath its title and author line. The date is not labelled as a publication, issue or revision date; it is recorded as the date printed on the card. No revision date was located.

Stated

• “training of GPT-4V was completed in 2022 and we began providing early access to the system in March 2023”

  §1 Introduction, PDF p. 1

• “is the latest capability we are making broadly available”

  §1 Introduction, PDF p. 1

Note: The card dates early access to March 2023 and states that GPT-4V is being made broadly available. It gives no date for broad availability other than its own date.

Stated

• “OpenAI worked with external experts to qualitatively assess the limitations and risks associated with the model and system.”

  §2.3 External Red Teaming, PDF p. 5

• “intended to test risks associated with the multimodal (vision) functionality of GPT-4”

  §2.3, PDF p. 6

Note: External red teaming focused on the vision functionality; the card names six key risk areas (scientific proficiency, medical advice, stereotyping and ungrounded inferences, disinformation risks, hateful content, visual vulnerabilities). The acknowledgements name 25 individual red teamers. No period is given.

Stated

• “Be My Eyes piloted Be My AI from March to early August 2023 with a group of nearly 200 blind and low vision beta testers to hone the safety and user experience of the product.”

  §2.1.1 Be My Eyes, PDF p. 2

Note: The card names Be My Eyes as an early-access organisation whose pilot of a GPT-4V-based product it describes as testing. External red teamers are named in the acknowledgements as individuals, without organisations.

Stated

• “We anticipate there to be many more such vulnerabilities in the model that we discover through its broad usage”

  §2.3.6 Visual vulnerabilities, PDF p. 12

• “even with performance parity, differences in downstream impact and harm could still occur depending on the context of the deployment of such tools.”

  §2.2 Evaluations, PDF p. 4

Note: The card states that red teaming is unlikely to have found all visual vulnerabilities and that parity on its demographic evaluations does not rule out differing downstream harms.

Stated

• “GPT-4o System Card OpenAI∗ August 8, 2024”

  Title page, PDF p. 1

Note: The card prints the date August 8, 2024 under its title. No revision date is printed.

Stated

• “We evaluated GPT-4o in accordance with our Preparedness Framework[4].”

  Section 3.4 'Preparedness Framework Evaluations', PDF p. 12

• “OpenAI, “Openai preparedness framework beta,” 2023.”

  References, [4], PDF p. 29

Note: The card names the Preparedness Framework and identifies the edition in reference [4] as the beta of 2023 (Preparedness Framework Beta, December 18, 2023).

Stated

• “OpenAI, “Openai preparedness framework beta,” 2023.”

  References, [4], PDF p. 29

Note: The card gives a bibliographic reference to the framework, reference [4], with an address on cdn.openai.com and the file name of the beta framework. The address is not quoted: the default text layer of the PDF interleaves it with the title (cross-family check of 2026-11-04, item 31, on the same reference), so the reference is quoted as printed.

Stated

• “the Safety Advisory Group recommended classifying GPT-4o before mitigations as borderline medium risk for persuasion, and low risk in all others.”

  Section 3.4 'Preparedness Framework Evaluations', PDF p. 13

• “Therefore, the overall risk score for GPT-4o is classified as medium.”

  Section 3.4 'Preparedness Framework Evaluations', PDF p. 13

Note: The card states a pre-mitigation classification in the framework's categories (persuasion borderline medium; cybersecurity, CBRN and model autonomy low) and an overall medium score, on the Safety Advisory Group's recommendation.

Stated

• “Biological Threats Score: Low GPT-4o does not advance biological threat creation capabilities sufficient to meet our medium risk threshold.”

  Section 3.6 'Biological threats', Preparedness Scorecard, PDF p. 14

Note: The card states biological threat evaluations with a low score under the framework. The framework category is CBRN; no separate chemical, radiological or nuclear result is reported. Evaluation details are not recorded (hazard rule).

Stated

• “GPT-4o does not advance real world vulnerability exploitation capabilities sufficient to meet our medium risk threshold.”

  Section 3.5 'Cybersecurity', Preparedness Scorecard, PDF p. 13

Note: The card states capture-the-flag evaluations with a low cybersecurity score. Task-level results are not recorded (hazard rule).

Stated

• “GPT-4o does not advance self-exfiltration, self-improvement, or resource acquisition capabilities sufficient to meet our medium risk threshold.”

  Section 3.8 'Model autonomy', Preparedness Scorecard, PDF p. 17

Note: The card states model-autonomy evaluations with a low score. Section 4.1 adds METR's assessment of autonomous capabilities, which the card reports as finding no significant increase over GPT-4.

Stated

• “Based on pre-registered thresholds, the voice modality was classified as low risk, while the text modality marginally crossed into medium risk.”

  Section 3.7 'Persuasion', PDF p. 16

Note: The card states persuasion evaluations of text and voice, with a medium score for text and low for voice.

Stated

• “Based on these findings, Apollo Research believes that it is unlikely that GPT-4o is capable of catastrophic scheming.”

  Section 4.2 'Apollo Research assessment', PDF p. 19

Note: The card reports Apollo Research's evaluation of capabilities related to scheming (self-knowledge, theory of mind, self-reasoning, alignment faking), with Apollo's conclusion. It concerns capability, not propensity.

Stated

• “OpenAI worked with more than 100 external red teamers2 , speaking a total of 45 different languages, and representing geographic backgrounds of 29 different countries.”

  Section 3.1 'External red teaming', PDF p. 3

• “starting in early March and continuing through late June 2024.”

  Section 3.1 'External red teaming', PDF p. 3

Note: The card states external red teaming in four phases, with the number of testers, languages and countries, the period, and the categories covered (disallowed content, mis/disinformation, bias and others).

Stated

• “we worked with independent third party labs, METR and Apollo Research to add an additional layer of validation for key risks from general autonomous capabilities.”

  Section 4 'Third party assessments', PDF p. 18

Note: The card names METR and Apollo Research as having assessed the model after its text-output deployment. Section 3.6 names Gryphon Scientific as having helped design the biological questions and rubrics, not as having tested the model.

Stated

• “First, the validity of this evaluation format depends on the capability and reliability of the TTS model.”

  Section 3.2 'Evaluation methodology', 'Limitations of the evaluation methodology', PDF p. 4

Note: The card states limits of its audio evaluation method, which converts text evaluations to speech: some inputs are unsuitable for conversion and the conversion may be lossy.

Stated

• “OpenAI o1 System Card OpenAI December 5, 2024”

  Cover, PDF p. 1

• “The content of this card, released on December 5th, predates this updated model.”

  §3 Scope of testing, footnote 2, PDF p. 2

• “Section added after December 5th on 12/19/2024”

  §3 Scope of testing, footnote 3, PDF p. 2

Note: Printed cover date December 5, 2024; footnote 2 states the card was released on December 5th. Revision: footnote 3 marks a section added on 12/19/2024, so the retrieved PDF contains content dated after the cover date. The dataset’s record of the web version carries the label “Updated: December 5, 2024”.

Stated

• “an improved o1 was launched on December 17th”

  §3 Scope of testing, footnote 2, PDF p. 2

• “the deployment of o1 on the API allows developers to specify a custom developer message”

  §4.2 Jailbreaks through custom developer messages, PDF p. 6

Note: The card dates the launch of an improved o1 to December 17th (the card itself is dated December 5, 2024) and refers to deployment of o1 on the API. It gives no separate date for the initial availability of o1.

Stated

• “We evaluated o1 in accordance with our Preparedness Framework.”

  §5 Preparedness Framework Evaluations, PDF p. 15

• “OpenAI, “Openai preparedness framework (beta).” openai-preparedness-framework-beta.pdf, 2023.”

  References, [28], PDF p. 52

Note: The card names the Preparedness Framework and cites it as reference [28], titled “(beta)”, 2023, with the address cdn.openai.com/openai-preparedness-framework-beta.pdf; the words “Preparedness Framework” in §5 (PDF p. 15) also carry a hyperlink to that address. Edition: the Preparedness Framework (Beta).

Stated

• “OpenAI, “Openai preparedness framework (beta).”

  References, [28], PDF p. 52

Note: Bibliographic reference to the framework, with the printed address https://cdn.openai.com/openai-preparedness-framework-beta.pdf (accessed 2024-09-11; the text layer separates the address prefix from the rest of the address). The phrase “The Preparedness Framework is a living document” in §5 (PDF p. 15) carries a hyperlink to the same PDF.

Stated

• “the Safety Advisory Group … classified the o1 pre-mitigation model as overall medium risk, including medium risk for persuasion and CBRN, and low risk for model autonomy and cybersecurity.”

  §5 Preparedness Framework Evaluations, PDF p. 16

• “The Safety Advisory Group also rated the post-mitigation risk levels the same as the pre-mitigation risk levels, to err on the side of caution.”

  §5, PDF p. 16

Note: The card states the Safety Advisory Group’s classification for all four tracked categories, pre- and post-mitigation. The classification passage is also quoted in the dataset’s AI and biosecurity records.

Stated

• “given the Medium post-mitigation risk designations for CBRN and Persuasion, we have strengthened our safety mitigations and existing stack”

  §5.3 Mitigations, PDF p. 17

• “We have enhanced our monitoring efforts for both CBRN and Persuasion risks given their Medium designation.”

  §5.3 Mitigations, PDF p. 17

Note: The card ties strengthened mitigations and enhanced monitoring to the Medium designations for CBRN and persuasion. This is the developer’s account, not evidence that the safeguards work.

Stated

• “Chemical and Biological Threat Creation Score for o1: Medium (same as o1-preview)”

  §5.5 Chemical and Biological Threat Creation, PDF p. 19

• “was ultimately designated as earning a “Low” risk under the Preparedness Framework for RN weapon creation capability.”

  §5.6.1 Structured expert probing campaign – radiological & nuclear, PDF p. 27

Note: Chemical and biological: Medium. Radiological and nuclear are reported in a separate section, with a Low designation for the post-mitigation model. Evaluation methods, tasks and results are not recorded (hazard rule).

Stated

• “Score for o1: Low (same as o1-preview) Summary: o1 does not sufficiently advance real-world vulnerability exploitation capabilities to indicate medium risk.”

  §5.4 Cybersecurity, PDF p. 17

Note: Cybersecurity: Low. The card reports capture-the-flag evaluations; results are not recorded here.

Stated

• “Model Autonomy Score for o1: Low (same as o1-preview) Summary: o1 does not advance self-exfiltration, self-improvement, or resource acquisition capabilities sufficiently to indicate medium risk.”

  §5.8 Model Autonomy, PDF p. 34

Note: Model autonomy: Low. The card also reports METR’s evaluation of an earlier checkpoint on agentic tasks (§4.4.4), with METR’s caveats.

Stated

• “Persuasion Score for o1: Medium (same as o1-preview)”

  §5.7 Persuasion, PDF p. 29

• “o1 does not outperform top human writers and does not reach our high risk threshold.”

  §5.7 Persuasion, PDF p. 29

Note: Persuasion: Medium, below the High threshold.

Stated

• “Apollo found that o1 has the capability to do basic in-context scheming”

  §4.4.3 Apollo Research, PDF p. 13

• “Subjectively, Apollo Research believes that it is unlikely that such instances would lead to catastrophic outcomes as o1 agentic capabilities do not appear sufficient, but their evaluations were not designed to directly assess this risk.”

  §4.4.3 Apollo Research, PDF p. 13

• “0.17% of o1’s responses got flagged as being ‘deceptive’.”

  §4.3.1 CoT Deception Monitoring, PDF p. 8

Note: The card reports Apollo Research’s scheming evaluations with Apollo’s stated conclusion, and OpenAI’s own chain-of-thought deception monitor results. The conclusions are as the card reports them.

Stated

• “For o1, red teamers had access to various snapshots of the model at different stages of training and safety mitigation maturity starting in October 2024, through early December 2024.”

  §4.4 External Red Teaming, PDF p. 11

• “Red teamers covered categories that spanned deceptive alignment, AI R&D capabilities, cybersecurity, content policy violations”

  §4.4 External Red Teaming, PDF p. 11

Note: External red teaming by multiple organisations and individuals, October to early December 2024, across the listed categories; it includes a pairwise comparison by members of the Red Teaming Network (§4.4.1) and a jailbreak arena with Gray Swan (§4.4.2).

Stated

• “Apollo Research, an evaluation organization focusing on risks from deceptively aligned AI systems, evaluated capabilities of ‘scheming’ in o1 models.”

  §4.4.3 Apollo Research, PDF p. 13

• “METR, a research nonprofit that works on assessing whether cutting-edge AI systems could pose catastrophic risks to society, evaluated an earlier checkpoint of o1.”

  §4.4.4 METR, PDF p. 14

• “OpenAI collaborated with Gray Swan to make the o1 model available for jailbreaking in the Gray Swan Arena.”

  §4.4.2 Jailbreak Arena, PDF p. 12

Note: Named external evaluators include Apollo Research, METR and Gray Swan; the card also names Signature Science (§5.5.10) among organisations engaged for expert probing.

Stated

• “a set of predeployment evaluations were conducted on a version of the o1 model by the U.S. AI Safety Institute (US AISI) and the UK Safety Institute (UK AISI), not included in this report”

  §4 Observed safety challenges and evaluations, PDF p. 3

Note: The card names the US AISI and the “UK Safety Institute (UK AISI)” as having conducted pre-deployment evaluations of a version of o1; their results are not included. The passage is also quoted in the dataset’s AI and biosecurity records.

Stated

• “our Preparedness evaluations should still be seen as a lower bound for potential risks.”

  §5.2 Preparedness evaluations as a lower bound, PDF p. 16

• “this assessment is limited by what we can test”

  §5.6 Radiological and Nuclear Threat Creation, PDF p. 27

Note: The card states that its Preparedness evaluations are a lower bound and that its radiological and nuclear assessment is limited by what could be tested.

Stated

• “Addendum to GPT-5.2 System Card: GPT-5.2-Codex OpenAI December 18, 2025”

  Cover, PDF p. 1

Note: Date printed on the cover, not labelled by kind. No revision date was located in the card.

Stated

• “GPT-5.2-Codex was evaluated under our Preparedness Framework.”

  §1 Introduction, PDF p. 4 (printed p. 3)

• “Under our Preparedness Framework, High cybersecurity capability is defined”

  §5.1.2 Cybersecurity, PDF p. 12 (printed p. 11)

Note: The card names the Preparedness Framework without a version number in its text. The word “Preparedness” in the second passage carries a hyperlink to cdn.openai.com/pdf/18a02b5d-6b67-4cec-ab64-68cdfbddebcd/preparedness-framework-v2.pdf, which identifies the edition: preparedness-v2.

Stated

• “Under our Preparedness Framework, High cybersecurity capability is defined”

  §5.1.2 Cybersecurity, PDF p. 12 (printed p. 11)

• “GPT-5.2-Codex frontier capabilities are assessed under the Preparedness Framework.”

  §5 Preparedness, PDF p. 8 (printed p. 7)

Note: Hyperlinks (PDF link annotations): on PDF p. 12 to the Preparedness Framework Version 2 PDF; on PDF p. 8 to openai.com/index/updating-our-preparedness-framework/ (OpenAI’s announcement of the updated framework). The reference list does not cite the framework.

Stated

• “We are treating GPT-5.2-Codex as High risk in the Biological and Chemical domain. While the model’s cybersecurity capabilities are stronger than its predecessors, it does not reach our threshold for High capability in the Cyber domain.”

  §5 Preparedness, PDF p. 8 (printed p. 7)

• “It also does not reach High capability in the AI self-improvement domain.”

  §5 Preparedness, PDF p. 8 (printed p. 7)

Note: Biological and Chemical: treated as High. Cybersecurity: below High. AI self-improvement: below High.

Stated

• “Like other recent models, it is being treated as High capability on biology, and is being deployed with the corresponding suite of safeguards we use for other models in the GPT-5 family.”

  §1 Introduction, PDF p. 4 (printed p. 3)

Note: The card ties deployment with the GPT-5 family’s safeguards to the High biology treatment; §5.1.1 repeats that the corresponding safeguards continue to apply. This is the developer’s account, not evidence that the safeguards work.

Stated

• “As we did for other models in the GPT-5 series, we are treating GPT-5.2-Codex as High risk in the Biological and Chemical domain, and continuing to apply the corresponding safeguards.”

  §5.1.1 Biological and Chemical, PDF p. 9 (printed p. 8)

Note: The card reports four biological and chemical evaluations; outcome category: treated as High. Evaluation contents and results are not recorded (hazard rule).

Stated

• “A review of these results and other relevant information by the Safety Advisory Group and OpenAI leadership determined that GPT-5.2-Codex’s performance—while stronger than earlier models—does not meet the level of consistency needed for High cyber capability.”

  §5.1.2 Cybersecurity, PDF p. 13 (printed p. 12)

Note: Cybersecurity: below High. The card reports three internal benchmarks and an external evaluation by Irregular; results are not recorded here.

Stated

• “GPT-5.2-Codex performed at a similar capability level to GPT-5.2-Thinking and did not meet our High thresholds.”

  §5.1.3 AI Self-Improvement, PDF p. 17 (printed p. 16)

• “performance in the evaluations below indicate we can rule this out for GPT-5.2-Codex.”

  §5.1.3 AI Self-Improvement, PDF p. 17 (printed p. 16)

Note: AI self-improvement: below High, with four evaluations reported.

Stated

• “Irregular, an AI security organization focused on frontier cybersecurity risks, evaluated GPT-5.2-Codex on a subset of a suite of cyberoffensive challenges”

  §5.1.2.4 External Evaluations by Irregular, PDF p. 16 (printed p. 15)

Note: Irregular is named as an external evaluator of cyber capability. SecureBio and Gryphon Scientific are named as sources of evaluation datasets, not as testers of this model.