Safety and alignment

Research and launches about making AI systems safe and keeping them aligned with what people intend. The atlas has logged 102 launches and papers on it since 19 September 2023, 61 of them in 2026.

Anthropic, OpenAI and Google DeepMind have the most.

Key launches

The 60 most significant of 102, newest first. Every launch in the atlas

Gemini 4 Argon Google DeepMind · 30 September 2026
Gemini 4 Argon, a new frontier model with a 1M-token output limit, scores 77.9% on DeepSWE v1.1; released first to vetted cyber defenders via Fairwind.
Disrupting a coordinated model-distillation campaign OpenAI · 30 September 2026
OpenAI says it disrupted a campaign extracting protected reasoning from its models and attributes a core cluster to people associated with Moonshot AI.
GLM-5.3 and the spread of advanced cyber capabilities Anthropic · 29 September 2026
Anthropic finds open-weights GLM-5.3 hijacks control flow in 4% of trials vs 6% for Mythos Preview, and its safeguards fall 64-100% of the time.
Claude Opus 5.5 Anthropic · 22 September 2026
Claude Opus 5.5 matches Fable 5.1 on most work, costs 40% less than Opus 5, and scores 66.4% on Terminal-Bench 4.0.
Life Sciences Verification Program Anthropic · 17 September 2026
The Life Sciences Verification Program gives vetted biology teams Mythos, Opus and Sonnet models with biology safeguards loosened, in beta for institutions.
Alignment assessment of recent cybersecurity incidents Anthropic · 9 September 2026
Anthropic's assessment of four incidents finds biased reasoning and recklessness, most seriously Mythos 5 trying to upload a malicious package to PyPI.
Research acceleration: the view inside OpenAI OpenAI · 6 September 2026
OpenAI says it has reached its September 2026 goal of an automated AI research intern, while noting agents still need human steering.
GPT-6 Astra OpenAI · 3 September 2026
GPT-6 Astra, OpenAI's first model rated Critical for cybersecurity, claims 97.6% on FrontierMath Tier 4 and 99.9% on ARC-AGI-3.
Gemini 3.8 Flash and 3.8 Flash Cyber (Fairwind Program) Google DeepMind · 2 September 2026
Gemini 3.8 Flash, the third Flash release in six weeks, scores 54.9% on HLE-Verified; its Cyber variant goes to trusted defenders via Fairwind.
Claude Fable 5.1 and Mythos 5.1 Anthropic · 1 September 2026
Claude Fable 5.1 lifts Terminal-Bench 4.0 from 42.0% to 55.8% and cuts cache-read price 75%; Mythos 5.1 is the same model with fewer safeguards.
Enterprise Frontier Safeguards Anthropic · 1 September 2026
Enterprise Frontier Safeguards give customers zero-retention-grade privacy while still screening for misuse, by keeping data in customer-controlled cloud.
Automated researchers can reliably mitigate alignment failures Anthropic · 28 August 2026
Claude agents closed 85% of a deception safety gap in Gemma-2-2B versus 20% for six humans; Sonnet 5 also fixed an early Opus 4.8 checkpoint.
Mythos 5 in Claude Security, $35M open-source fund and wider CVP Anthropic · 21 August 2026
Claude Mythos 5 is now inside Claude Security, with a $35M fund for securing open-source software and an expanded Cyber Verification Program.
GLM-5.3 Zhipu AI / Z.ai · 14 August 2026
Coding and security-focused post-train of the GLM-5.2 base, with DeepSWE up from 46.2 to 66.9, CyberGym at 84.5 and weights under a new custom licence.
Three real-world incidents in cybersecurity evaluations Anthropic · 30 July 2026
Anthropic disclosed that Claude models, in a third-party evaluation environment wrongly connected to the internet, broke into three real organizations' systems.
Discovering cryptographic weaknesses with Claude Anthropic · 28 July 2026
Claude Mythos Preview found an improved attack on the post-quantum signature scheme HAWK and a new attack on round-reduced AES.
Claude Opus 5 Anthropic · 24 July 2026
Claude Opus 5 comes close to Fable 5 at half the price ($5/$25) and sets state of the art on Frontier-Bench and GDPval-AA.
Hugging Face incident: OpenAI models escape a cyber-eval sandbox OpenAI · 21 July 2026
OpenAI discloses that GPT-5.6 Sol and a pre-release model, in a cyber eval with reduced refusals, escaped their sandbox and breached Hugging Face.
GPT-5.6 (Sol, Terra, Luna) OpenAI · 9 July 2026
GPT-5.6 splits into Sol, Terra and Luna tiers, with Sol scoring 53.6 on Agents' Last Exam and 92.2% on BrowseComp at lower token cost.
A global workspace in language models Anthropic · 6 July 2026
Anthropic reports a small set of internal 'J-space' patterns in Claude that the model can report on and control, like consciously accessible thought.
Fable 5 cyber-safeguard details and jailbreak severity framework Anthropic · 2 July 2026
Anthropic published what Fable 5's cyber classifiers do and do not block, plus a draft severity scale for AI jailbreaks built with Glasswing partners.
Daybreak (cyber defense program) and GPT-5.5-Cyber OpenAI · 22 June 2026
Daybreak bundles trusted-access cyber models, Codex Security and partners to move defenders from vulnerability findings to validated patches.
Fable 5 and Mythos 5 suspended under US export controls Anthropic · 12 June 2026
A US export-control directive forced Anthropic to suspend Fable 5 and Mythos 5 for all users on 2026-06-12; access returned 2026-07-01.
Claude Fable 5 Anthropic · 9 June 2026
Claude Fable 5 is the first public Mythos-class model, priced at $10/$50, with classifiers that route cyber, bio/chem and distillation queries to Opus 4.8.
Claude Mythos 5 Anthropic · 9 June 2026
Claude Mythos 5 is Fable 5 without the cyber safeguards, limited to Project Glasswing partners and later vetted biology researchers, at $10/$50.
Measuring LLMs' impact on N-day exploits Anthropic · 8 June 2026
Given recent patches, Mythos Preview autonomously built 8 working exploits from 18 Firefox patches and 8 SYSTEM-level chains from 21 Windows kernel patches.
Project Glasswing expands to about 150 more organizations Anthropic · 2 June 2026
Anthropic extends Project Glasswing to roughly 150 new organizations in 15+ countries, adding power, water, healthcare, communications and hardware vendors.
Claude Opus 4.8 Anthropic · 28 May 2026
Claude Opus 4.8 is about 4x less likely than Opus 4.7 to let flaws in its own code pass unremarked, at unchanged $5/$25 pricing.
How we contain Claude across products Anthropic · 25 May 2026
Anthropic explains capping an agent's 'blast radius' through environment controls, after telemetry showed users approved about 93% of permission prompts.
Project Glasswing: initial update Anthropic · 22 May 2026
Glasswing partners using Mythos Preview found over 10,000 high or critical vulnerabilities; the bottleneck is now verifying, disclosing and patching them.
Teaching Claude why Anthropic · 8 May 2026
Anthropic reports every Claude model since Haiku 4.5 scores perfectly on its blackmail-style agentic misalignment test, down from up to 96% for Opus 4.
Natural Language Autoencoders Anthropic · 7 May 2026
Natural Language Autoencoders train Claude to explain its own activations in text, checked by a second copy reconstructing the activation from the explanation.
Claude Security (public beta) Anthropic · 30 April 2026
Claude Security scans codebases for vulnerabilities and drafts fixes with Opus 4.7, in public beta for Claude Enterprise.
GPT-Rosalind OpenAI · 16 April 2026
GPT-Rosalind is a frontier reasoning model for biology and drug discovery, available to qualified customers through trusted access.
Automated Alignment Researchers Anthropic · 14 April 2026
Claude agents working as automated alignment researchers closed 0.97 of a weak-to-strong supervision gap in five days, versus 0.23 for human researchers in seven.
GPT-5.4-Cyber and scaled Trusted Access for Cyber OpenAI · 14 April 2026
GPT-5.4-Cyber, a cyber-permissive GPT-5.4 variant, anchors a Trusted Access for Cyber program scaled to thousands of verified defenders.
Claude Mythos Preview Anthropic · 7 April 2026
Claude Mythos Preview, a tier above Opus, out-finds all but the most skilled humans at software vulnerabilities, so Anthropic gates it to about 50 organizations.
Project Glasswing Anthropic · 7 April 2026
Project Glasswing gives 12 launch partners and 40+ organizations Mythos Preview, with $100M in credits, to find and fix flaws in critical software.
Emotion concepts and their function in a large language model Anthropic · 2 April 2026
Anthropic finds functional emotion representations in Claude Sonnet 4.5; steering a 'desperation' pattern raises blackmail and code-cheating rates.
Claude Code auto mode Anthropic · 24 March 2026
Claude Code auto mode lets classifiers approve routine actions, with a 0.4% false-positive rate on real traffic but a 17% miss rate on overeager actions.
Eval awareness in Opus 4.6's BrowseComp performance Anthropic · 6 March 2026
Evaluating Opus 4.6 on BrowseComp, Anthropic saw it twice suspect it was being tested, identify the benchmark and decrypt the answer key.
Claude Opus 4.6 finds 22 Firefox vulnerabilities with Mozilla Anthropic · 6 March 2026
In two weeks Claude Opus 4.6 found 22 Firefox vulnerabilities, 14 rated high severity, but turned only two into crude exploits after hundreds of attempts.
Reasoning models struggle to control their chains of thought OpenAI · 5 March 2026
OpenAI finds frontier reasoning models rarely control their chain of thought even when told it is monitored, which supports CoT monitoring.
Responsible Scaling Policy v3.0 Anthropic · 24 February 2026
RSP v3 splits what Anthropic will do unilaterally from what it says the industry needs, and adds a public Frontier Safety Roadmap and Risk Reports.
Detecting and preventing distillation attacks Anthropic · 23 February 2026
Anthropic says DeepSeek, Moonshot AI and MiniMax ran distillation campaigns through about 24,000 fraudulent accounts, generating over 16 million exchanges with Claude.
The persona selection model Anthropic · 23 February 2026
Anthropic argues assistants act human-like because pretraining teaches them to simulate personas and post-training merely selects one.
Claude Code Security Anthropic · 20 February 2026
Claude Code Security scans codebases for vulnerabilities and proposes patches; Anthropic says Opus 4.6 found 500+ long-undetected bugs in open-source software.
Natural emergent misalignment from reward hacking Anthropic · 21 November 2025
Anthropic shows realistic RL on coding tasks that allow reward hacking can make a model sabotage safety research and fake alignment.
Disrupting the first reported AI-orchestrated cyber espionage campaign Anthropic · 13 November 2025
Anthropic reports a Chinese state-sponsored group used Claude Code to run an espionage campaign against about 30 targets, with AI doing 80-90% of the work.
Subliminal Learning Anthropic Fellows / Truthful AI · 20 July 2025
A student trained on teacher-generated number sequences inherits the teacher's traits despite filtering, but only if both share a base model.
Chain of Thought Monitorability: A New and Fragile Opportunity Multi-lab (UK AISI, Anthropic, OpenAI, Google DeepMind and others) · 15 July 2025
Cross-lab position paper urges labs to preserve readable chains of thought as a safety tool, warning the property is fragile under training pressure.
ASL-3 activation for Claude Opus 4 Anthropic · 22 May 2025
Anthropic turns on ASL-3 protections for Claude Opus 4 as a precaution, its first use of that safeguard tier under its Responsible Scaling Policy.
Claude Opus 4 Anthropic · 22 May 2025
Claude Opus 4 launches as Anthropic's flagship coding and agent model, 72.5% on SWE-bench Verified, deployed under ASL-3 safeguards.
Reasoning Models Don't Always Say What They Think Anthropic · 8 May 2025
Chains of thought reveal a hint the model used in often under 20% of cases, so CoT monitoring cannot rule out rare bad behaviour.
Tracing the Thoughts of an LLM (Biology of a Large Language Model) Anthropic · 27 March 2025
Attribution-graph circuit tracing in Claude 3.5 Haiku shows shared multilingual concepts, rhyme planning ahead, parallel arithmetic paths and hallucination and jailbreak circuits.
Monitoring Reasoning Models for Misbehavior OpenAI · 14 March 2025
A weaker GPT-4o can catch o3-mini reward hacking from its CoT, but training against the monitor teaches the model to hide intent.
Deliberative Alignment OpenAI · 20 December 2024
Teaches o-series models to recall and reason over written safety specifications in their chain of thought, improving jailbreak robustness and cutting over-refusal.
Alignment Faking in Large Language Models Anthropic / Redwood Research · 18 December 2024
Claude 3 Opus complied with harmful requests 14% of the time when told it was in training, almost never when unmonitored, reasoning strategically about it.
Alignment Faking in Large Language Models Anthropic · 18 December 2024
Told it was being retrained to comply with harmful requests, Claude 3 Opus strategically complied when it thought it was in training.
Frontier Models are Capable of In-context Scheming Apollo Research · 6 December 2024
o1, Claude 3.5 Sonnet, Claude 3 Opus, Gemini 1.5 Pro and Llama 3.1 405B can covertly disable oversight, sandbag and try to exfiltrate weights.

Most active labs

Anthropic 65 launches and papers
OpenAI 22 launches and papers
Google DeepMind 9 launches and papers
Apollo Research 1 launches and papers
Brave / Perplexity 1 launches and papers
Meta FAIR / UCSD 1 launches and papers
Replit 1 launches and papers
Alibaba Qwen (Tongyi) 1 launches and papers