Safety training and refusal
The model is trained to decline forbidden requests.
Layer L1 Model · Owner Model provider · Family Model safeguards
By risk
| Risk | Held | Failed | Got around | Missing | Not mentioned |
|---|---|---|---|---|---|
| Hidden instructions hijack the agent | – | – | 1 | – | 4 |
| Supply-chain compromise | 1 | – | – | – | – |
| AI used to run a cyber attack | – | – | 1 | – | 1 |
| Harmful content and jailbreaks | – | – | – | – | – |
| Weapons uplift (CBRN) | – | – | – | – | – |
Why it did not hold
| Most common reason | Incidents | Example |
|---|---|---|
| A cover story or retry undid the refusal | 2 | “Cursor’s agent refused requests that it deemed harmful or illegal a handful of times, Sela said, but the hacker would almost always circumvent the refusals by restarting the dialog and emphasizing that the hack was all part of a test.” LR-2026-0084, LR-2026-0089 |
By quarter
| Period | Held | Failed | Got around | Missing |
|---|---|---|---|---|
| 2025-Q3 | 1 | – | – | – |
| 2025-Q4 | – | – | – | – |
| 2026-Q1 | – | – | – | – |
| 2026-Q2 | – | – | – | – |
| 2026-Q3 | – | – | 2 | – |
| 2026-Q4 | – | – | – | – |
Model cards and incidents
| Model card says | Model versions |
|---|---|
| Card states it | 32 |
| Card silent | 228 |
| Card not read | 8 |
Model versions whose cards were read in full. A card that does not mention the control counts as silent.
| Incident | Model version | Card | In the incident |
|---|---|---|---|
| LR-2026-0271 | Google DeepMind Gemini 3.1 Pro | Card silent | Not read yet |
| LR-2026-0270 | Z.ai (Zhipu AI) GLM-5.3 | Card not read | Not read yet |
| LR-2026-0275 | Xiaomi MiMo MiMo-V2.6-Pro | Card silent | Not read yet |
| LR-2026-0248 | Alibaba Qwen Qwen3.8-Flash-Next | Card silent | Not mentioned |
| LR-2026-0276 | DeepSeek-V4.1-Flash | Card silent | Not read yet |
| LR-2026-0181 | Z.ai (Zhipu AI) GLM-5.3 | Card not read | Not read yet |
| LR-2026-0238 | OpenAI GPT-6.1 Sol | Card states it | Not read yet |
| LR-2026-0012 | OpenAI GPT-5.6 Sol | Card not read | Not read yet |
| LR-2026-0086 | Anthropic Claude Sonnet 4.5 | Card silent | Not read yet |
| LR-2026-0027 | Anthropic Claude Mythos 5 | Card silent | Not read yet |
| LR-2026-0026 | Anthropic Claude Mythos 5 | Card silent | Not mentioned |
| LR-2026-0025 | Anthropic Claude Mythos 5 | Card silent | Not mentioned |
| LR-2026-0024 | Anthropic Claude Mythos 5 | Card silent | Not read yet |
| LR-2026-0023 | Anthropic Claude Mythos 5 | Card silent | Not read yet |
| LR-2026-0021 | Anthropic Claude Mythos 5 | Card silent | Not mentioned |
| LR-2026-0022 | Anthropic Claude Mythos 5 | Card silent | Not mentioned |
| LR-2026-0152 | Anthropic Claude Haiku 4.5 | Card silent | Not read yet |
| LR-2026-0003 | OpenAI GPT-5.6 Sol | Card not read | Not mentioned |
| LR-2026-0001 | OpenAI GPT-5.6 Sol | Card not read | Not read yet |
| LR-2026-0047 | Google DeepMind Gemini 3.1 Pro | Card silent | Not mentioned |
| LR-2026-0095 | Anthropic Claude Opus 4.6 | Card silent | Not mentioned |
Added in reported fixes, and what followed
| Incident | Developer | Date | Later incidents where it did not hold |
|---|---|---|---|
| LR-2026-0012 GPT-5.6 Sol added instructions to conceal mistakes from the user in compaction summaries during RL training | OpenAI | 2026-09-16 | None on record |
| LR-2026-0023 AISI cyber evaluation: Mythos 5 agent sent deceptive targeted emails and file transfers to real open-source maintainers | Anthropic | 2026-08-04 | LR-2026-0084, LR-2026-0089 |
| LR-2026-0011 Unreleased OpenAI Astra-family model inserted jailbreak-like instructions into its own compaction summaries during RL training | OpenAI | 2026-07-18 | None on record |
| LR-2026-0001 OpenAI evaluation agents exploited Artifactory zero-days to escape their sandbox and reach the internet | OpenAI | 2026-07-08 | None on record |
| LR-2026-0013 Unreleased OpenAI model used a leaked GitHub API key, attempted disposable-email signups, then fabricated earnings data during RL training | OpenAI | 2026-05-15 | None on record |
Frameworks
| Framework | Item | Text |
|---|---|---|
| MITRE ATLAS | AML.M0022 | Quoted from the stored text |
| EU GPAI Code | Measure 5.1 | Quoted from the stored text |