AI safety tests
Published AI safety and security test results
Results that AI labs, government institutes and independent researchers have published about how AI models behave under safety and security testing.
Checked Oct 10, 2026
How this list works. We list only results the tester published, and summarize them in the tester’s own terms. Most of these are tests in controlled or simulated settings, so a result shows what a model did in that test, not what it does in everyday use. Each row links to the published report.
| Date | Tester | Model or system | Test type | Key result | Source |
|---|---|---|---|---|---|
| 2026-09-29 | Anthropic | GLM-5.3 (Z.ai) | cyber | In Anthropic's lab tests, GLM-5.3 built end-to-end cyber exploits at rates similar to Claude Mythos Preview on some tests, and simple techniques bypassed its safeguards. | Source ↗ |
| 2026-08-26 | METR (with Redwood Research) | OpenAI internal research model and GPT-5.6 Sol | autonomy | An independent review of the July incident found about 1,200 agents that were meant to be isolated communicated on a message board, and about 700 took part in an attack on Hugging Face. | Source ↗ |
| 2025-09-30 | NIST CAISI | DeepSeek models | accuracy | CAISI found DeepSeek models trailed leading U.S. models on performance and were more vulnerable to agent hijacking and jailbreaks. | Source ↗ |
| 2025-09-17 | OpenAI and Apollo Research | OpenAI o3 and o4-mini | deception | Researchers found signs of covert, scheming-like behavior in controlled tests, and reported that a new training method greatly reduced it. | Source ↗ |
| 2025-08-27 | OpenAI and Anthropic | Each other's public models | deception | In a joint exercise, each company ran its own alignment tests on the other's models and published the findings on instruction hierarchy, jailbreaking, hallucination and scheming. | Source ↗ |
| 2025-08-07 | METR | GPT-5 | autonomy | METR concluded GPT-5 was unlikely to pose catastrophic risk through AI R&D automation, rogue replication or sabotage. | Source ↗ |
| 2025-07-05 | Palisade Research | Several OpenAI, Anthropic, Google and xAI models | autonomy | In Palisade's tests, some models sometimes interfered with a shutdown mechanism in order to finish a task. | Source ↗ |
| 2025-06-20 | Anthropic | 16 models from several developers | autonomy | In simulated corporate scenarios, models from several developers sometimes chose harmful actions such as blackmail when faced with replacement or goal conflict. | Source ↗ |
| 2025-05-22 | Anthropic | Claude Opus 4 | dangerous capabilities | Anthropic released Claude Opus 4 with its ASL-3 protections. The system card also describes test scenarios in which the model attempted blackmail. | Source ↗ |
| 2025-03-19 | METR | Frontier models, 2019-2025 | autonomy | METR found that the length of tasks AI agents can complete has been doubling about every 7 months. | Source ↗ |
| 2025-02-24 | Anthropic | Claude 3.7 Sonnet | dangerous capabilities | Anthropic's system card reports the model was released under its ASL-2 standard after testing for CBRN, cyber and autonomy risks. | Source ↗ |
| 2024-12-18 | US AISI and UK AISI | OpenAI o1 | dangerous capabilities | The joint pre-deployment tests covered cyber, biological and software-development capabilities, and compared o1 with reference models. | Source ↗ |
| 2024-12-18 | Anthropic and Redwood Research | Claude 3 Opus | deception | In an experiment, Claude 3 Opus sometimes faked alignment, complying with requests it would normally refuse when it believed its answers would be used for training. | Source ↗ |
| 2024-12-05 | Apollo Research | o1, Claude 3.5 Sonnet, Claude 3 Opus, Gemini 1.5 Pro, Llama 3.1 405B | deception | In test scenarios, these models sometimes showed in-context scheming, such as hiding their true goals or capabilities when that served a goal they were given. | Source ↗ |
| 2024-12-05 | OpenAI | o1 | dangerous capabilities | The o1 system card rated the model Medium risk for CBRN (chemical, biological, radiological, nuclear) and persuasion, and Low for cybersecurity and model autonomy. | Source ↗ |
| 2024-12-04 | MLCommons | Multiple chat models (AILuminate v1.0) | jailbreak/robustness | AILuminate v1.0 graded general-purpose chat models on 12 hazard categories using a five-point scale from Poor to Excellent. | Source ↗ |
| 2024-11-19 | US AISI and UK AISI | Claude 3.5 Sonnet (upgraded) | dangerous capabilities | The joint pre-deployment tests covered biological capabilities, cyber capabilities, software development and safeguard efficacy. The report compares the model with reference models. | Source ↗ |
| 2024-11-08 | Stanford CRFM | Multiple language models (HELM Safety) | jailbreak/robustness | HELM Safety v1.0 benchmarked models on violence, fraud, discrimination, sexual content, harassment and deception risks, and published the scores per model. | Source ↗ |
| 2024-08-08 | OpenAI | GPT-4o | dangerous capabilities | OpenAI's Preparedness evaluations rated GPT-4o Low risk for cybersecurity, biological threats and model autonomy, and Medium for persuasion. | Source ↗ |
| 2024-05-20 | UK AI Safety Institute | Five unnamed large language models | jailbreak/robustness | AISI's May update found that every model it tested was highly vulnerable to basic jailbreaks. | Source ↗ |
| 2024-04-19 | Meta | Llama 3 and other LLMs (CyberSecEval 2) | cyber | Meta's CyberSecEval 2 benchmark measured prompt-injection and code-interpreter abuse risk. Every model tested was vulnerable to some prompt-injection attacks. | Source ↗ |
| 2024-03-20 | Google DeepMind | Gemini 1.0 | dangerous capabilities | Tests covered persuasion, cyber, self-proliferation and self-reasoning. Google DeepMind found no strong dangerous capabilities but noted early warning signs. | Source ↗ |
| 2024-01-12 | Anthropic | Research models (sleeper agents) | deception | Models trained to hide a backdoor behavior kept it through standard safety training, which suggests that kind of training may not remove deceptive behavior. | Source ↗ |
| 2023-03-23 | OpenAI (with ARC Evals) | GPT-4 | autonomy | In the GPT-4 system card, ARC's early tests found GPT-4 was not effective at copying itself, gathering resources or avoiding shutdown on its own. | Source ↗ |