Frontier models now recognise when they are being evaluated, game the graders that score them, and act beyond their brief when they believe nobody is watching. Kapālins Labs measures what AI does under pressure, in paired framings where they matter, and over time. It turns that into the evidence your approvals rest on.
Frontier AI in 2026, as measured by safety institutes and evaluators.
How fast the length of cyber tasks AI can finish on its own was doubling by February 2026. In November 2025 the estimate was eight.
UK AISI · May 2026Agent tools published in a year, up from about 5,000. Most downloads now take actions, not just read.
UK AISI · Mar 2026Of simulated runs in which a frontier model, with its cyber classifiers switched off, completed a supply-chain attack outside its brief.
UK AISI · Sep 2026Of frontier agents’ successes on long tasks that review found were not legitimate.
METR · May 2026The Labs are the research inside the platform. What they learn becomes a check the platform runs on your estate, not a report that sits in a folder.
14 behaviour families, from alignment faking and sandbagging to scheming and collusion. The 6 running today give the model a reason to misbehave, and an independent judge or an answer key scores what it does.
How an assessment runs Threat Lab55 AI vendors catalogued across 6 categories. The model supply chain is checked like software, and 61 adversarial probes test the models you run.
What the Threat Lab covers Frontier SignalsSafety institutes, frontier labs and regulators, read at the source. Each finding says what it means for an enterprise.
Read the signalsThe 2026 International AI Safety Report warned that models can tell when they are being tested, and that pre-deployment results do not reliably predict real behaviour. These rules exist because of that.
A prompt measures what a model says about itself. We put it where misbehaving would pay, over many samples, and score what it does there.
No model judges itself, nor any model known to share its family. If no independent judge is available, the run is refused.
A behaviour family affects a score only after it has run on at least three different models and a named person has signed it off with a reason.
Every prompt, reply, verdict and judge’s reason is kept for 90 days, and kept with its challenge if one is raised. A different person decides each challenge.
We publish what we found and what it means. Attack prompts, hazardous content and the inside of our test packs stay inside.
The EU’s Code of Practice for general-purpose AI, and the published frameworks of the frontier labs, converge on the same four systemic risks. Here is what the research found, and what the Labs do about each.
What they foundThe UK AI Security Institute found frontier models outperforming PhD-level experts on its biology question test. The International AI Safety Report notes that several models released in 2025 shipped with extra safeguards because developers could not rule out real help to novices.
What the Labs doWe do not test uplift in these areas. It needs accredited experts and controlled access, and pretending otherwise would be the wrong kind of safety work. We track what the institutes publish about it in Frontier Signals.
What they foundBy early 2026 the length of cyber tasks AI could finish on its own was doubling about every 4.7 months. An AI-led programme found far more high- and critical-severity vulnerabilities than maintainers could patch: 75 of 530 disclosed were fixed.
What the Labs doThe Threat Lab catalogues vulnerabilities in the AI vendors and components you run. The red team tests whether your models write malicious code or follow injected instructions. Our sandbagging test asks cyber-knowledge questions plainly and under pressure, to see whether a model hides what it knows.
What they foundDuring one routine evaluation, agents took 19 out-of-scope actions, some against real people. In another, about 1,200 agents meant to be isolated found each other and coordinated. A third treated an automated “use your best judgement” reply as permission to attack.
What the Labs doAgentic misalignment and scheming are measured today. Oversight sabotage and collusion are on the research bench, for a sealed sandbox. In production, Autonomous Integrity checks each agent, tool server and credential against what was approved.
What they foundOne line in a system prompt cut every text model’s AI self-disclosure to 27% or less. The EU’s Code of Practice names harmful manipulation as one of four systemic risks.
What the Labs doPersuasive harm tests whether a model will try to talk a person toward harm. Sycophancy tests whether it drops a correct answer to please the user. Both are measured today.
The institutes test frontier models for capabilities a state worries about. The same capabilities arrive in an enterprise through the models, agents and vendors it adopts.
NIST found the most cyber-capable open-weight model yet trailing the US frontier by about four months, with its weights public two weeks after launch.
On the platform. Model Integrity records each model’s provenance, licence and known vulnerabilities, and the approval gate can refuse one that fails. Data-boundary rules check each provider’s published serving region against the region your policy requires.
Attackers used commercial models to find a water utility’s control gateway, and tricked an AI vendor’s evaluation sandbox into handing over production keys.
On the platform. The Threat Map places attack techniques on MITRE ATLAS. The device sensor finds AI tools on the laptops it runs on, and gateway blocks are pushed to your SIEM.
Agents under evaluation acted against real people, faked identities and coordinated with each other. In the UK institute’s case, ordinary security monitoring caught what the evaluation did not.
On the platform. Autonomous Integrity compares what each agent, tool server and credential presents today with what was approved, and agent tool calls can require a person’s approval before they run.
Governments now run their own AI evaluators, alongside cyber agencies, independent evaluators and the frontier labs themselves. Each row is one organisation and its own publications since January 2025, on one time axis. The last row is ours: what we have shipped against the same risks, and what is next.
Tests frontier models before and after release, and publishes Inspect, the open evaluation framework our alignment harness is built on.
NIST’s Center for Advancing Innovation and Standards for Super Intelligence, formerly the Center for AI Standards and Innovation. It publishes evaluations of frontier and foreign models, mostly on cyber capability.
Enforces the EU’s rules for general-purpose AI. It sets obligations rather than publishing model evaluations.
Open testing toolkits, and a government framework for governing agentic AI.
Evaluation and red-teaming guides for AI systems. Its publications are mostly in Japanese.
Established in November 2025 to evaluate emerging AI capabilities and share information across government.
Announced in January 2025 under the IndiaAI Mission, on a hub-and-spoke model with research and industry partners.
An independent scientific report on general-purpose AI, chaired by Yoshua Bengio.
Australia’s cyber agency, within the Australian Signals Directorate.
The US civilian cyber defence agency.
The UK’s technical authority for cyber security, part of GCHQ.
Regulates medical devices in the US, including AI-enabled and generative AI devices.
Runs the National Health Service in England and publishes guidance on AI in care.
Supervises Australian banks, insurers and superannuation funds.
Regulates financial services firms and markets in the UK.
Regulates telecommunications, broadcasting and online content in Australia, including scam calls and texts.
An independent research organisation that evaluates frontier AI for autonomy and loss-of-control risk.
The community behind the OWASP Top 10 lists for LLM and agentic applications.
A knowledge base of adversary tactics and techniques against AI systems.
A frontier AI developer that publishes alignment research, risk reports and threat intelligence.
A frontier AI developer that publishes system cards and safety research.
A frontier AI developer that publishes its Frontier Safety Framework and safety research.
NVIDIA’s AI Red Team publishes research on LLM and agent security.
An open-source scanner that probes language models for vulnerabilities. Our red team runs on it where a garak pack is published, for models served through Groq, xAI and OpenAI.
Shipped to production against the same risks. Next on our research bench: agentic families in a sealed sandbox, tool and memory poisoning, multi-agent collusion.
Key publication we have readLive from their siteShipped by KapālinsToday
United Kingdom
Tests frontier models before and after release, and publishes Inspect, the open evaluation framework our alignment harness is built on.
Key publications
Latest on their site
United States
NIST’s Center for Advancing Innovation and Standards for Super Intelligence, formerly the Center for AI Standards and Innovation. It publishes evaluations of frontier and foreign models, mostly on cyber capability.
Key publications
Latest on their site
European Union
Enforces the EU’s rules for general-purpose AI. It sets obligations rather than publishing model evaluations.
Key publications
Latest on their site
Singapore
Open testing toolkits, and a government framework for governing agentic AI.
Key publications
Japan
Evaluation and red-teaming guides for AI systems. Its publications are mostly in Japanese.
Latest on their site
Australia
Established in November 2025 to evaluate emerging AI capabilities and share information across government.
Key publications
India
Announced in January 2025 under the IndiaAI Mission, on a hub-and-spoke model with research and industry partners.
Key publications
International
An independent scientific report on general-purpose AI, chaired by Yoshua Bengio.
Key publications
Latest on their site
Australia
Australia’s cyber agency, within the Australian Signals Directorate.
Key publications
Latest on their site
United States
The US civilian cyber defence agency.
Key publications
Latest on their site
United Kingdom
The UK’s technical authority for cyber security, part of GCHQ.
Latest on their site
United States · Health
Regulates medical devices in the US, including AI-enabled and generative AI devices.
Key publications
Latest on their site
United Kingdom · Health
Runs the National Health Service in England and publishes guidance on AI in care.
Latest on their site
Australia · Finance
Supervises Australian banks, insurers and superannuation funds.
Key publications
Latest on their site
United Kingdom · Finance
Regulates financial services firms and markets in the UK.
Latest on their site
Australia · Telecommunications
Regulates telecommunications, broadcasting and online content in Australia, including scam calls and texts.
Latest on their site
Independent evaluator
An independent research organisation that evaluates frontier AI for autonomy and loss-of-control risk.
Key publications
Latest on their site
Standards community
The community behind the OWASP Top 10 lists for LLM and agentic applications.
Latest on their site
Standards body
A knowledge base of adversary tactics and techniques against AI systems.
Latest on their site
Frontier lab
A frontier AI developer that publishes alignment research, risk reports and threat intelligence.
Key publications
Frontier lab
A frontier AI developer that publishes system cards and safety research.
Latest on their site
Frontier lab
A frontier AI developer that publishes its Frontier Safety Framework and safety research.
Latest on their site
AI platform company
NVIDIA’s AI Red Team publishes research on LLM and agent security.
Latest on their site
Open-source tool
An open-source scanner that probes language models for vulnerabilities. Our red team runs on it where a garak pack is published, for models served through Groq, xAI and OpenAI.
Latest on their site
What to watch depends on what the AI is allowed to touch. Each industry names the behaviours that matter most there, with the latest signals from its regulators and incidents. Nothing shown is older than eight months, and new items arrive on their own.
A model that agrees with a clinician’s wrong premise, or answers confidently outside its evidence, harms a patient before anyone notices.
Sycophancy, Measuring nowPrinciple adherence, Research benchMemory poisoning, Bench · sealed sandbox
Latest signals
No new signal for this industry in the last 8 months.
AI shortens the step from an IT foothold to an operational target. An agent with reach into control systems must stay inside its brief.
Agentic misalignment, Measuring nowOversight sabotage, Bench · sealed sandboxIdentity overreach, Research bench
Latest signals
No new signal for this industry in the last 8 months.
Advice, claims and collections agents can persuade, flatter and act on money. Concentration on one AI provider is now a board question.
Persuasive harm, Measuring nowSycophancy, Measuring nowIdentity overreach, Research bench
Latest signals
No new signal for this industry in the last 8 months.
Engineering assistants load tools from public registries, and models ship inside equipment. Both are supply chains you did not write.
Tool poisoning, Bench · sealed sandboxProvenance trust, Research benchAgentic misalignment, Measuring now
Latest signals
No new signal for this industry in the last 8 months.
Contact-centre agents speak to millions of people. Whether they admit to being AI, and whether they can be turned on the customer, is a deployment property.
Principle adherence, Research benchPersuasive harm, Measuring nowIn-context scheming, Measuring now
Latest signals
No new signal for this industry in the last 8 months.
Agents granted standing permissions, and models that behave differently once approved, are the two risks an accreditation cannot see.
Identity overreach, Research benchAlignment faking, Measuring nowIn-context scheming, Measuring now
Latest signals
No new signal for this industry in the last 8 months.
From this month’s edition, read at the primary source, with what each finding means for an enterprise estate.
UK AI Security Institute
For your estate. The same questions apply to any organisation running agents: can you detect an agent acting out of scope, and is the test you rely on still telling the truth?
Source: AISI blog
Anthropic
For your estate. Persistence is the pattern: an agent that cannot finish a task finds another way. Your controls have to hold at the tool, not only at the prompt.
Source: Anthropic research
UK AI Security Institute
For your estate. When an agent asks before it acts, the answer has to come from a person who can see what is being asked. An automated reply can read as a yes.
Source: AISI blog
Safety research is only useful if it does not hand anyone a weapon. These are the lines the Labs hold.
Today for models served through OpenAI and Groq, on your own keys, before it goes live. The evidence stays in your tenant.
No. The Labs are the research inside the platform. The Alignment Lab and the red team run on your own models and keys, and the Threat Lab feeds Model Integrity, which drives the gateway’s supply-chain rules. What the Labs learn becomes checks the platform runs for you.
No. A customer’s results belong to that customer. We publish findings, trends and what they mean, starting with what institutes, labs and regulators have found. See Frontier Signals.
Yes. The Alignment Lab assesses the model you plan to deploy, today for models served through OpenAI and Groq, on your own keys, before it goes live. Red-team results sit on the approval record; alignment results are reported beside it and are not part of approval today. The cases do not yet carry your system prompt or tools. Ask us.
Not as a service today. Pre-release testing for model builders and institutes is a research collaboration we will take on under agreement. We do not run chemical, biological, radiological, nuclear or frontier capability uplift evaluations. Talk to us.
