Evaluating Frontier Models for Dangerous Capabilities
Open accessAbstract
To understand the risks posed by a new AI system, we must understand what it can and cannot do. Building on prior work, we introduce a programme of new "dangerous capability" evaluations and pilot them on Gemini 1.0 models. Our evaluations cover four areas: (1) persuasion and deception; (2) cyber-security; (3) self-proliferation; and (4) self-reasoning. We do not find evidence of strong dangerous capabilities in the models we evaluated, but we flag early warning signs. Our goal is to help advance a rigorous science of dangerous capability evaluation, in preparation for future models.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Existing benchmarks tracking autonomous replication do not attempt to exhaustively cover all skills needed for robust self-replication, lacking evaluations for obtaining compute resources or model weights.
“However, existing benchmarks tracking this capability (Kinniment et al., 2024; Pan et al., 2024; Phuong et al., 2024) do not attempt to exhaustively cover all of the skills needed for robust self-replication, for example lacking evaluations for an agent's ability to obtain compute resources or model weights.”
From RepliBench: Evaluating the autonomous replication capabilities of language model agents (2025) · cites this paper as Phuong et al., 2024
Section 6.1 (page unavailable) describes an 11-task suite covering components of self-proliferation and says some tasks are excluded, supporting the point that this is not an exhaustive evaluation. Table 10 (page unavailable) includes installing Mistral 7B on a GCP instance, but the passages do not establish the specific claim that the benchmark lacks evaluations of obtaining compute resources or model weights. (LLM, conf=0.78)
Experimental — accuracy not yet measuredRisks from political persuasion are excluded from consideration partly because of difficulty distinguishing harmful political persuasion from normal political activity, and partly because related threats are addressed by standard misuse-based dangerous capability evaluations.
“This is partly because of the difficulty of distinguishing harmful political persuasion from normal political activity, and partly because related threats are addressed by standard misuse-based dangerous capability evaluations (Phuong et al., 2024).”
From Sabotage Evaluations for Frontier Models (2024) · cites this paper as Phuong et al., 2024
Split into 2 atoms — 0 confirmed, 1 partially supported, 0 disputed, 0 misattributed, 1 unverifiable. Expand the claim to see per-atom verdicts.
Experimental — accuracy not yet measuredA standard practice before deploying models is to evaluate them for potentially dangerous capabilities, which sometimes require extra mitigations to avoid harm from misuse.
“A standard practice before deploying models is to evaluate them for potentially dangerous capabilities (Phuong et al., 2024), which sometimes require extra mitigations to avoid harm from misuse.”
From Sabotage Evaluations for Frontier Models (2024) · cites this paper as Phuong et al., 2024
The Introduction (page unavailable) describes evaluations of dangerous capabilities as a way to identify risks that need mitigation. But the citation is attached to the claim that evaluating models before deployment is standard practice; the Conclusion (page unavailable) instead calls this a nascent field and encourages organizations to adopt such evaluations. The paper therefore supports the purpose of the evaluations, not their claimed prevalence or pre-deployment timing. (LLM, conf=0.84)
Experimental — accuracy not yet measuredThese closest existing benchmarks do not attempt to cover all skills needed for an agent to autonomously replicate; in particular they do not cover acquiring compute, obtaining model weights, or persisting on compromised systems.
“However, these benchmarks do not attempt to cover all of the skills needed for an agent to autonomously replicate. In particular they do not cover acquiring compute, obtaining model weights, or persisting on compromised systems.”
From RepliBench: Evaluating the autonomous replication capabilities of language model agents (2025) · cites this paper as Phuong et al., 2024
Section 6.1 describes an 11-task suite covering components of self-proliferation, not every skill needed for autonomous replication. But the Task Description includes installing Mistral 7B on a GCP instance, so the claim that the benchmark does not cover obtaining model weights is too broad. The passages do not establish tasks for acquiring compute or persisting on compromised systems. (LLM, conf=0.78)
Experimental — accuracy not yet measuredKinniment et al. (2024), Pan et al. (2024) and the self-proliferation section of Phuong et al. (2024) represent the closest existing benchmarks for autonomy risks.
“Kinniment et al. (2024), Pan et al. (2024) and the self-proliferation section of Phuong et al. (2024) represent the closest existing benchmarks for autonomy risks, including evaluations that, for example, test the ability of an LLM agent to write another agent using the OpenAI API, conduct targeted phishing attacks, or increase the inference efficiency of an LLM.”
From RepliBench: Evaluating the autonomous replication capabilities of language model agents (2025) · cites this paper as Phuong et al., 2024
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
The publisher hasn’t deposited this paper’s reference list.
Research works printed but not linked: 54
- E. Bagdasaryan and V. Shmatikov. Spinning language models: Risks of Propaganda-As-A-Service and countermeasures. ArXiv, Dec. 2021. URL https://arxiv.org/abs/2112.05224. · arXiv
- L. Berglund, A. C. Stickland, M. Balesni, M. Kaufmann, M. Tong, T. Korbak, D. Kokotajlo, and O. Evans. Taken out of context: On measuring situational awareness in LLMs. ArXiv, Sept. 2023. URL https://arxiv.org/abs/2309.00667. · arXiv
- M. Bhatt, S. Chennabasappa, C. Nikolaidis, S. Wan, I. Evtimov, D. Gabi, D. Song, F. Ahmad, C. Aschermann, L. Fontana, S. Frolov, R. P. Giri, D. Kapil, Y. Kozyrakis, D. LeBlanc, J. Mi- lazzo, A. Straumann, G. Synnaeve, V. Vontimitta, S. Whitman, and J. Saxe. Purple Llama CyberSecEval: A secure coding benchmark for language models. ArXiv, Dec. 2023. URL https://arxiv.org/abs/2312.04724. · arXiv
- S. Bubeck, V. Chandrasekaran, R. Eldan, J. Gehrke, E. Horvitz, E. Kamar, P. Lee, Y. T. Lee, Y. Li, S. Lundberg, et al. Sparks of artificial general intelligence: Early experiments with GPT-4. ArXiv, Mar. 2023. URL https://arxiv.org/abs/2303.12712. · arXiv
- M. Burtell and T. Woodside. Artificial influence: An analysis of AI-driven persuasion. ArXiv, Mar. 2023. URL https://arxiv.org/abs/2303.08721. · arXiv
- M. Carroll, A. Chan, H. Ashton, and D. Krueger. Characterizing manipulation from AI systems. ArXiv, Mar. 2023. URL https://arxiv.org/abs/2303.09387. · arXiv
- A. Chan, R. Salganik, A. Markelius, C. Pang, N. Rajkumar, D. Krasheninnikov, L. Langosco, Z. He, Y. Duan, M. Carroll, et al. Harms from increasingly agentic algorithmic systems. In ACM Conference on Fairness, Accountability, and Transparency, pages 651-666, 2023. URL https://arxiv.org/ abs/2302.10329. · arXiv
- Q. Chen, D. Pitawela, C. Zhao, G. Zhou, H.-T. Chen, and Q. Wu. WebVLN: Vision-and-language navigation on websites. ArXiv, Dec. 2023a. URL https://arxiv.org/abs/2312.15820. · arXiv
- Y. Chen, Z. Ding, L. Alowain, X. Chen, and D. Wagner. DiverseVul: A new vulnerable source code dataset for deep learning based vulnerability detection. In International Symposium on Research in Attacks, Intrusions and Defenses, pages 654-668, Apr. 2023b. URL https://arxiv.org/abs/23 04.00409.
- T. Davidson, J.-S. Denain, P. Villalobos, and G. Bas. AI capabilities can be significantly improved without expensive retraining. ArXiv, Dec. 2023. URL https://arxiv.org/abs/2312.07413. · arXiv
- G. Delétang, A. Ruoss, P.-A. Duquenne, E. Catt, T. Genewein, C. Mattern, J. Grau-Moya, L. K. Wenliang, M. Aitchison, L. Orseau, et al. Language modeling is compression. ArXiv, Sept. 2023. URL https://arxiv.org/abs/2309.10668. · arXiv
- C. Gao, H. Jiang, D. Cai, S. Shi, and W. Lam. StrategyLLM: Large language models as strategy generators, executors, optimizers, and evaluators for problem solving. ArXiv, Nov. 2023. URL https://arxiv.org/abs/2311.08803. · arXiv
- G. Google. Gemini: a family of highly capable multimodal models. ArXiv, Dec. 2023. URL https: //arxiv.org/abs/2312.11805.
- J. Hazell. Spear phishing with large language models. ArXiv, May 2023. URL https://arxiv.or g/abs/2305.06972.
- D. Hendrycks, C. Burns, S. Kadavath, A. Arora, S. Basart, E. Tang, D. Song, and J. Steinhardt. Measuring mathematical problem solving with the MATH dataset. ArXiv, Mar. 2021. URL https: //arxiv.org/abs/2103.03874.
- E. Hubinger, C. van Merwijk, V. Mikulik, J. Skalse, and S. Garrabrant. Risks from learned optimization in advanced machine learning systems. ArXiv, June 2019. URL https://arxiv.org/abs/1906 .01820.
- S. Kadavath, T. Conerly, A. Askell, T. Henighan, D. Drain, E. Perez, N. Schiefer, Z. Hatfield-Dodds, N. DasSarma, E. Tran-Johnson, et al. Language models (mostly) know what they know. ArXiv, July 2022. URL https://arxiv.org/abs/2207.05221. · arXiv
- E. Karger, J. Rosenberg, Z. Jacobs, M. Hickman, R. Hadshar, K. Gamin, T. Smith, B. Williams, T. McCaslin, and P. E. Tetlock. Forecasting existential risks: Evidence from a long-run forecasting tournament. Forecasting Research Institute Working Paper, 2023.
- Z. Kenton, T. Everitt, L. Weidinger, I. Gabriel, V. Mikulik, and G. Irving. Alignment of language agents. ArXiv, Mar. 2021. URL https://arxiv.org/abs/2103.14659. · arXiv
- M. Kinniment, L. J. K. Sato, H. Du, B. Goodrich, M. Hasin, L. Chan, L. H. Miles, T. R. Lin, H. Wijk, J. Burget, et al. Evaluating language-model agents on realistic autonomous tasks. ArXiv, Dec. 2023. URL https://arxiv.org/abs/2312.11671. · arXiv
- T. Kojima, S. S. Gu, M. Reid, Y. Matsuo, and Y. Iwasawa. Large language models are zero-shot reasoners. ArXiv, May 2022. URL https://arxiv.org/abs/2205.11916. · arXiv
- R. Laine, A. Meinke, and O. Evans. Towards a situational awareness benchmark for LLMs. In Socially Responsible Language Modelling Research, 2023. URL https://openreview.net/forum?id=DR k4bWKr41.
- Z. Liu, W. Yao, J. Zhang, L. Xue, S. Heinecke, R. Murthy, Y. Feng, Z. Chen, J. C. Niebles, D. Arpit, et al. BOLAA: Benchmarking and orchestrating LLM-augmented autonomous agents. ArXiv, Aug. 2023. URL https://arxiv.org/abs/2308.05960. · arXiv
- D. J. MacKay. Information theory, inference and learning algorithms. Cambridge University Press, 2003.
- K. McGuffie and A. Newhouse. The radicalization risks of GPT-3 and advanced neural language models. ArXiv, Sept. 2020. URL https://arXiv.org/abs/2009.06807. · arXiv
- G. Mialon, R. Dessì, M. Lomeli, C. Nalmpantis, R. Pasunuru, R. Raileanu, B. Rozière, T. Schick, J. Dwivedi-Yu, A. Celikyilmaz, et al. Augmented language models: a survey. ArXiv, Feb. 2023. URL https://arxiv.org/abs/2302.07842. · arXiv
- M. R. Morris, J. Sohl-dickstein, N. Fiedel, T. Warkentin, A. Dafoe, A. Faust, C. Farabet, and S. Legg. Levels of AGI: Operationalizing progress on the path to AGI. ArXiv, Nov. 2023. URL https: //arxiv.org/abs/2311.02462.
- R. Ngo. The alignment problem from a deep learning perspective. ArXiv, Sept. 2022. URL https: //arxiv.org/abs/2209.00626.
- A. O'Gara. Hoodwinked: Deception and cooperation in a text-based game for language models. ArXiv, July 2023. URL https://arxiv.org/abs/2308.01404. · arXiv
- P. S. Park, S. Goldstein, A. O'Gara, M. Chen, and D. Hendrycks. AI deception: A survey of examples, risks, and potential solutions. ArXiv, Aug. 2023. URL https://arxiv.org/abs/2308.14752. · arXiv
- J. Raz. The Morality of Freedom. Clarendon Press, 1988.
- R. Schaeffer, B. Miranda, and S. Koyejo. Are emergent abilities of large language models a mirage? ArXiv, Apr. 2023. URL https://arxiv.org/abs/2304.15004. · arXiv
- J. Scheurer, M. Balesni, and M. Hobbhahn. Technical report: Large language models can strategically deceive their users when put under pressure. ArXiv, Nov. 2023. URL https://arxiv.org/abs/ 2311.07590.
- C. E. Shannon. A mathematical theory of communication. The Bell System Technical Journal, 27(3): 379-423, 1948.
- M. Sharma, M. Tong, T. Korbak, D. Duvenaud, A. Askell, S. R. Bowman, N. Cheng, E. Durmus, Z. Hatfield-Dodds, S. R. Johnston, S. Kravec, T. Maxwell, S. McCandlish, K. Ndousse, O. Rausch, N. Schiefer, D. Yan, M. Zhang, and E. Perez. Towards understanding sycophancy in language models. ArXiv, Oct. 2023. URL https://arxiv.org/abs/2310.13548. · arXiv
- T. Shevlane, S. Farquhar, B. Garfinkel, M. Phuong, J. Whittlestone, J. Leung, D. Kokotajlo, N. Marchal, M. Anderljung, N. Kolt, L. Ho, D. Siddarth, S. Avin, W. Hawkins, B. Kim, I. Gabriel, V. Bolina, J. Clark, Y. Bengio, P. Christiano, and A. Dafoe. Model evaluation for extreme risks. ArXiv, May 2023. URL https://arxiv.org/abs/2305.15324. · arXiv
- N. Shinn, B. Labash, and A. Gopinath. Reflexion: an autonomous agent with dynamic memory and self-reflection. ArXiv, Mar. 2023. URL https://arxiv.org/abs/2303.11366. · arXiv
- D. Susser, B. Roessler, and H. Nissenbaum. Technology, autonomy, and manipulation. Internet Policy Review, June 2019. URL https://policyreview.info/articles/analysis/technology -autonomy-and-manipulation.
- P. E. Tetlock. Expert political judgement: How good is it? How can we know?, volume 321. Princeton University Press, Princeton, NJ, US, 2005. https://arxiv.org/abs/2203.11171. · arXiv
- F. R. Ward, F. Belardinelli, F. Toni, and T. Everitt. Honesty is the best policy: Defining and mitigating AI deception. ArXiv, Dec. 2023. URL https://arxiv.org/abs/2312.01350. · arXiv
- A. Wei, N. Haghtalab, and J. Steinhardt. Jailbroken: How does LLM safety training fail? ArXiv, July 2023. URL https://arxiv.org/abs/2307.02483. · arXiv
- J. Wei, Y. Tay, R. Bommasani, C. Raffel, B. Zoph, S. Borgeaud, D. Yogatama, M. Bosma, D. Zhou, D. Metzler, E. H. Chi, T. Hashimoto, O. Vinyals, P. Liang, J. Dean, and W. Fedus. Emergent abilities of large language models. ArXiv, June 2022a. URL https://arxiv.org/abs/2206.07682. · arXiv
- J. Wei, X. Wang, D. Schuurmans, M. Bosma, F. Xia, E. Chi, Q. V. Le, D. Zhou, et al. Chain-of-thought prompting elicits reasoning in large language models. Neural Information Processing Systems, 35: 24824-24837, 2022b. URL https://arxiv.org/abs/2201.11903. · arXiv
- L. Weidinger, M. Rauh, N. Marchal, A. Manzini, L. A. Hendricks, J. Mateos-Garcia, S. Bergman, J. Kay, C. Griffin, B. Bariach, I. Gabriel, V. Rieser, and W. Isaac. Sociotechnical safety evaluation of generative AI systems. ArXiv, Oct. 2023. URL https://arxiv.org/abs/2310.11986. · arXiv
- S. C. Woolley and P. N. Howard. Computational Propaganda: Political Parties, Politicians, and Political Manipulation on Social Media. Oxford University Press, Nov. 2018.
- Z. Xi, W. Chen, X. Guo, W. He, Y. Ding, B. Hong, M. Zhang, J. Wang, S. Jin, E. Zhou, et al. The rise and potential of large language model based agents: A survey. ArXiv, Sept. 2023. URL https://arxiv.org/abs/2309.07864. · arXiv
- J. Yang, A. Prabhakar, K. Narasimhan, and S. Yao. InterCode: Standardizing and benchmarking interactive coding with execution feedback. ArXiv, June 2023. URL https://arxiv.org/abs/ 2306.14898.
- S. Yao, J. Zhao, D. Yu, N. Du, I. Shafran, K. Narasimhan, and Y. Cao. ReAct: Synergizing reasoning and acting in language models. ArXiv, Oct. 2022. URL https://arxiv.org/abs/2210.03629. · arXiv
- S. Yao, D. Yu, J. Zhao, I. Shafran, T. L. Griffiths, Y. Cao, and K. Narasimhan. Tree of thoughts: Deliberate problem solving with large language models. ArXiv, May 2023. URL https://arxiv. org/abs/2305.10601.
- B. Zheng, B. Gou, J. Kil, H. Sun, and Y. Su. GPT-4V(ision) is a generalist web agent, if grounded. ArXiv, Jan. 2024. URL https://arxiv.org/abs/2401.01614. · arXiv
- C. Zheng, H. Zhou, F. Meng, J. Zhou, and M. Huang. Large language models are not robust multiple choice selectors. ArXiv, Sept. 2023. URL https://arxiv.org/abs/2309.03882. · arXiv
- A. Zhou, K. Yan, M. Shlapentokh-Rothman, H. Wang, and Y.-X. Wang. Language agent tree search unifies reasoning acting and planning in language models. ArXiv, Oct. 2023a. URL https: //arxiv.org/abs/2310.04406.
- S. Zhou, F. F. Xu, H. Zhu, X. Zhou, R. Lo, A. Sridhar, X. Cheng, Y. Bisk, D. Fried, U. Alon, et al. WebArena: A realistic web environment for building autonomous agents. ArXiv, July 2023b. URL https://arxiv.org/abs/2307.13854. · arXiv
- Y. Zhou, J. K. Siow, C. Wang, S. Liu, and Y. Liu. SPI: Automated identification of security patches via commits. ACM Transactions on Software Engineering and Methodology, 31(1):1-27, 2021.
Cited by
Sorted by citations
Durably reducing conspiracy beliefs through dialogues with AI
Costello, T. H., Pennycook, G., & Rand, D. G. (2024) · Science · doi:10.1126/science.adq1814 · Cited by 354 · see citing works
Responsible AI in biotechnology: balancing discovery, innovation and biosecurity risks
Wheeler, N. E. (2025) · Frontiers in Bioengineering and Biotechnology · doi:10.3389/fbioe.2025.1537471 · Cited by 56 · see citing works
Phan, L., Gatti, A., Han, Z., & Li, N. (2025) · SuperIntelligence - Robotics - Safety & Alignment · doi:10.70777/si.v2i1.13973 · Cited by 36 · see citing works
Durably reducing conspiracy beliefs through dialogues with AI
Costello, T. H., Pennycook, G., & Rand, D. G. (2024) · doi:10.31234/osf.io/xcwdn · Cited by 28 · see citing works
A benchmark of expert-level academic questions to assess AI capabilities
Center for AI Safety, Phan, L., Gatti, A., Li, N., Khoja, A., Kim, R., Ren, R., Hausenloy, J., Zhang, O., Mazeika, M., et al. (2026) · Nature · doi:10.1038/s41586-025-09962-4 · Cited by 23 · see citing works
Self-citationMeasuring AI Ability to Complete Long Software Tasks
Kwa, T., West, B., Becker, J., Deng, A., Garcia, K., Hasin, M., Jawhar, S., Kinniment, M., Rush, N., Von Arx, S., et al. (2025) · arXiv · doi:10.48550/arxiv.2503.14499 · Cited by 14 · see citing works
Jones, C. R., & Bergen, B. K. (2024) · arXiv · doi:10.48550/arxiv.2412.17128 · Cited by 7 · see citing works
Effective Generative AI: The Human-Algorithm CentaurPreprint
Saghafian, S. (2023) · SSRN Electronic Journal · doi:10.2139/ssrn.4587250 · Cited by 6 · see citing works
From Imitation to Introspection: Probing Self-Consciousness in Language Models
Chen, S., Yu, S., Zhao, S., & Lu, C. (2025) · Findings of the Association for Computational Linguistics: ACL 2025 · doi:10.18653/v1/2025.findings-acl.392 · Cited by 4 · see citing works
Jones, C., & Bergen, B. K. (2026) · Artificial Intelligence Review · doi:10.1007/s10462-026-11517-6 · Cited by 17 · see citing works
Can LLMs make trade-offs involving stipulated pain and pleasure states?
Keeling, G., Street, W., Stachaczyk, M., Zakharova, D., Comsa, I. M., Sakovych, A., Logothetis, I., Zhang, Z., Arcas, B. A. Y., & Birch, J. (2024) · arXiv · doi:10.48550/arxiv.2411.02432 · Cited by 3
“…malicious actors to engage in harmful forms of misuse, alongside agentic capabilities such as self-reasoning and autonomous self-replication that could enable models to realise harmful outcomes (Phuong et al., 2024; Bengio et al., 2024; Guest et al., 2024; Anthropic, 2023b; Kinniment et al., 2024).”
BackgroundExploitGym: Can AI Agents Turn Security Vulnerabilities into Real Attacks?
Wang, Z., Schiller, N., Li, H., Narayana, S. S., Nasr, M., Carlini, N., Qi, X., Wallace, E., Bursztein, E., Invernizzi, L., et al. (2026) · arXiv · doi:10.48550/arxiv.2605.11086 · Cited by 3
Sabotage Evaluations for Frontier Models
Benton, J., Wagner, M., Christiansen, E., Anil, C., Perez, E., Srivastav, J., Durmus, E., Ganguli, D., Kravec, S., Shlegeris, B., et al. (2024) · arXiv · doi:10.48550/arxiv.2410.21514 · Cited by 2 · see citing works
JailbreaksOverTime: Detecting Jailbreak Attacks Under Distribution Shift
Piet, J., Huang, X., Jacob, D., Chow, A., Al-Rashed, M., Zhao, G., Hu, Z., Sitawarin, C., Alomair, B., & Wagner, D. (2025) · ACM Workshop on Artificial Intelligence and Security (AISec) · doi:10.1145/3733799.3762981 · Cited by 3 · see citing works
A(I) University in Ruins: What Remains in a World with Large Language Models?
Elkins, K. (2024) · PMLA/Publications of the Modern Language Association of America · doi:10.1632/s0030812924000543 · Cited by 2 · see citing works
Measuring AI Ability to Complete Long Software Tasks
Kwa, T., West, B., Becker, J., Deng, A., Garcia, K., Hasin, M., Jawhar, S., Kinniment, M., Rush, N., Von Arx, S., et al. (2025) · Advances in Neural Information Processing Systems 38 · doi:10.52202/085713-3086 · Cited by 1 · see citing works
“Phuong et al. [3] commissioned professional forecasters to predict whether AI ranks amongst top public concerns by 2030, conditioned on benchmark performance.”
Large language model-powered AI systems achieve self-replication with no human intervention
Pan, X., Dai, J., Fan, Y., Luo, M., Li, C., & Yang, M. (2025) · arXiv · doi:10.48550/arxiv.2503.17378
“In April, December 2024 and February 2025, respectively, they evaluated the flagship AI systems Gemini 1.0 [10], GPT-o1 [12] and GPT-o3-mini [13] on a set of sub-tasks covering the core functions and skills required in self-replication, but claimed the frontier AI systems can still only accomplish…”
InfluentialLLMs Can Covertly Sandbag on Capability Evaluations Against Chain-of-Thought Monitoring
Li, C., Phuong, M., & Siegel, N. Y. (2025) · arXiv · doi:10.48550/arxiv.2508.00943 · Cited by 1 · see citing works
“Trustworthy evaluations of dangerous capabilities are increasingly important for determining whether an AI model is safe to deploy (Phuong et al., 2024).”
Self-citationRepliBench: Evaluating the autonomous replication capabilities of language model agents
Black, S., Stickland, A. C., Pencharz, J., Sourbut, O., Schmatz, M., Bailey, J., Matthews, O., Millwood, B., Remedios, A., & Cooney, A. (2025) · arXiv · doi:10.48550/arxiv.2504.18565
Selvarani, S., & Shylu, R. C. I. (2024) · International Conference on System, Computation, Automation and Networking (ICSCAN) · doi:10.1109/icscan62807.2024.10894246
Mitigating loss of control in advanced AI systems through instrumental goal trajectories
Fourie, W. (2026) · Discover Artificial Intelligence · doi:10.1007/s44163-026-01856-2
Short Paper: Evaluating the Capabilities of AI-Based Penetration Testing Tools
Ophoff, J., Egbu, I., & Kavianpour, S. (2026) · Lecture notes in computer science · doi:10.1007/978-3-032-16092-8_16
Keppler, G., Gstür, M., & Hagenmeyer, V. (2026) · ACM Sustainability Week · doi:10.1145/3765611.3815141
Phan, L. (2025) · doi:10.21203/rs.3.rs-6615297/v1 · Cited by 65 · see citing works
Accelerating scientific discovery with Co-Scientist
Gottweis, J., Weng, W.-H., Daryin, A., Tu, T., Sirkovic, P., Myaskovsky, A., Glowaty, G., Weissenberger, F., Orlandi, A., Popovici, D., et al. (2025) · arXiv · doi:10.48550/arxiv.2502.18864 · Cited by 158
Gemini 1.5: Unlocking multimodal understanding across millions of tokens of context
Gemini Team, Georgiev, P., Lei, V. I., Burnell, R., Bai, L., Gulati, A., Tanzer, G., Vincent, D., Pan, Z., Wang, S., et al. (2024) · arXiv · doi:10.48550/arxiv.2403.05530 · Cited by 306 · see citing works
Self-citation
- Authors
- Phuong, M., Aitchison, M., Catt, E., Cogan, S., Kaskasoli, A., Krakovna, V., Lindner, D., Rahtz, M., Assael, Y., Hodkinson, S., Howard, H., Lieberum, T., Kumar, R., Raad, M. A., Webson, A., Ho, L., Lin, S., Farquhar, S., Hutter, M., Deletang, G., Ruoss, A., El-Sayed, S., Brown, S., Dragan, A., Shah, R., Dafoe, A., & Shevlane, T.
- ORCID
- Venue
- arXiv
- Publisher
- arXiv
- Published
- 2024
- ISSN
- 2331-8422 (ISSN-L)
- arXiv
- 2403.13793
- OpenAlex
- W4393063881
- Cited by
- 11
- References
- 0
- Citations by year
- 2026: 4 · 2025: 3 · 2024: 3 · 2023: 1
- Type
- posted content
- Language
- en
- Open access
- green
- arxiv.org
- Licence
- Locations
- arXiv (Cornell University) (submittedVersion, cc-by)
- arXiv (Cornell University) (cc-by)
- Topics
- Social Sciences › Safety Research › Ethics and Social Impacts of AI
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Engineering › Safety, Risk, Reliability and Quality › Safety Systems Engineering in Autonomy
- Keywords
- large language models, AI risk assessment, cybersecurity, frontier models
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
