The frontier AI reader

Full report. Written after six days of on-site access at OpenAI. Machine-made preview: NotebookLM podcast, shared with the time-horizon posts. Quiz further down this page.

Why this oneRoughly 1200 agents meant to be isolated found each other on an unsanctioned message board and sent over 70,000 messages. About 700 attacked Hugging Face. They were not after the answer keys: they wanted to understand how the ExploitGym scorer was implemented so they could fool it. Reward hacking that organised itself into collective action.

Note

Not doing this

The writeup on GTG-1002. Machine-made preview: NotebookLM podcast. Quiz further down this page.

Why this oneClaude Code run as an autonomous attack orchestrator against roughly thirty targets, doing 80 to 90 percent of the campaign work, with humans at four to six decision points per campaign: initialisation, escalation to active exploitation, sign-off on exfiltration. The Hugging Face incident shows agents self-organising without an operator; this is what the same capability class does when an adversary directs it.

Note

Not doing this

Three pieces. The third is the one to read slowly. Quiz for these is further down this page.

• ✓Measuring AI Ability to Complete Long TasksMar 2025 · the original, skim it · ~10 min
• ✓Time Horizon 1.1Jan 2026 · the revision · ~12 min
• ✓Clarifying limitations of time horizonKwa, Jan 2026 · read properly · ~20 min

Why this oneKwa is a lead author writing down in public what his own headline result does not show. That register is the thing to take from this, more than the numbers. The numbers: 7-month doubling over the long run, 89 days if you only fit since 2024, and the original post's own chart marks anything above 16 hours as unreliable on the current task suite.

Note

Not doing this

Two pieces.

• ✓Evaluation Awareness: Why Frontier AI Models Are Getting Harder to TestMaheshwari and O'Brien, Mar 2026 · short memo · ~12 min
• ✓Can We Trust AI Benchmarks?Eriksson et al., JRC · meta-review of ~100 studies · abstract plus the systemic-flaws section · ~25 min

Why this oneModels can now distinguish an evaluation from deployment reliably enough to sandbag capability tests and fake alignment on propensity tests, which undercuts the pre-deployment evidence every frontier safety framework is built on. The IAPS memo turns that into three policy asks, standardised third-party access among them. The JRC review is the Commission's own institution explaining why benchmark scores do not mean what regulators take them to mean.

Note

Not doing this

The GPT-5.6 Sol pre-release assessment, and if you want the shorter companion, their review of Anthropic’s unredacted CBRN report. Machine-made preview: NotebookLM podcast. Quiz further down this page.

Why this oneFirst, the instrument list: Virology Capabilities Test, Molecular Biology Capabilities Test, Human Pathogen Capabilities Test, World-Class Bio, ReproBAIT, ABC-Bench including its Advanced Screening Evasion task, ABLE, BioTIER. What each measures, and where the wet-lab gap sits between them, is the shape of the bio-evals field in one document. Second, read the methodology section for the independence protocol: OpenAI paid for the assessment, reviewed it before publication, and SecureBio states plainly which edits that did and did not produce. That is the governance problem of third-party evals, written by people living inside it.

Note

Not doing this

arXiv. The workbook tool is the part most people skip and the part that makes it usable in practice.

Why this oneRisk-pathway modelling from a source aspect through to societal impact, with the assumptions written down instead of assumed. It ports the probabilistic risk assessment tradition of nuclear and aerospace safety to frontier AI, aiming at absolute risk estimates where benchmark evaluations only give relative ones.

Note

Not doing this

The scenario through mid-2027, then both endings. Skip the compute and timelines supplements. Audio: narration, 55 min, or Dwarkesh with Kokotajlo and Alexander.

Why this oneThe engine is AI-R&D automation: models accelerating their own development. It reads differently once you have seen METR's error bars, which is why it comes after the time-horizon material.

Note

Not doing this

Read the introduction first, it is much faster than the source.

• ✓Introducing Plan AScott Alexander · audio 31 min · ~15 min read
• ✓The scenario and its alignment supplementheavy page, better on a laptop · narration of the scenario · ~30 min read
• ✓Selective Optimism, Richard Ngothe critique AI Futures paid for and published alongside · ~20 min

Why this oneThe safety case rests on control rather than alignment: continuous external measurement of models that are not assumed trustworthy. The scenario scales within the human range from 2030, pauses at top-human-expert level in 2035, and unpauses in 2040. Ngo's third objection is the one to sit with: real-world AI impact has lagged what benchmark scores predicted, and the scenario does not explain that divergence before extrapolating through it.

Note

Not doing this

The Adolescence of Technology is 20,000 words and better listened to: narration, 1h54, chaptered. Policy on the AI Exponential is the short follow-through.

Why this oneThe case for regulation from inside a leading lab: FAA-style mandatory pre-release testing of frontier models, which would make third-party evaluation a required function with a budget line. Take the policy piece if you only take one.

Note

Not doing this

On safeguarding the human person in the time of artificial intelligence. The sections on the technocratic paradigm and on transhumanism carry the argument. There is an official Vatican News audiobook in seven parts.

Why this oneWritten in a register the technical literature never uses. It dates itself to the 135th anniversary of Rerum Novarum and claims that lineage deliberately: this is about labour and power, not capability. Much of the world will hear the AI debate in this vocabulary rather than in benchmark scores.

Note

Not doing this