How it's built

This site reports what documents state. It does not rank models or say which is safer. Counts here are counts of documented items, not rates: a rate needs a denominator (the number of agents or runs deployed), and for almost every case no source states one.

The error rate of case extraction is not published yet: the blind second review of case records has not been run.

Telling one case from another: on 2026-10-23 we replayed 181 reports through the matcher, each case once with itself hidden and each known repeat of a case. 0 were joined to the wrong case; 72.5% of the 51 known repeats were joined to their case automatically and 22.1% of all reports were held for another look rather than guessed. Two different models must agree before a report joins a case.

21 of 124 cases are recorded as not involving an AI agent acting. See them.

How a case record is built

Sources are checked daily. Each document is read by the language model deepseek-chat with the provider's default settings. It must return a verbatim sentence for every field it fills; a field without one stays empty. The publication rule: a record is published when it passes every automatic check. Duplicates merge into the record they describe; corrections create new versions, nothing is edited in place. The site shows published records only.

Each case is built in two passes. The first pass reads every article about a case in full and answers a fixed question list, one question per field, with the verbatim sentence for each answer and whether the article states it or the model classified it from behaviour; an article that does not answer a question gives no answer. The second pass reads only those answers and writes the record, the story as answers to five questions, the severity clause and the conflicts between articles. Severity is the highest rung a cited fact reaches on a ladder of observable facts; every record says which rung and why. Sources carry the reason they were attached; ambiguous links wait for a person.

One meaning per letter

A = a primary source states it (for the earliest source's date: A = the date the source itself carries) · B = two independent sources state it · C = one secondary source states it · D = inferred by us from the described behaviour, reason shown. The letter is computed from a field's citations by rule, never assigned by a model: A when the party responsible states it (the implicated developer or an official evaluator for a case; the provider for a measure it applies; the evaluator for its own result), B when two independent parties state it, C when one secondary source states it, D when we classified it from described behaviour, in which case the reason is stored and shown. Every value on the site carries one; its source button opens the quoted sentence.

How the safety record is built

Each model version's provider documents are read in full: first the tests (domain, test, who ran it, the result, the level the provider assigned), then the safety measures the card states, each with its sentence. Only the provider's own document can show that the provider applies a measure; an outside document gives a test result, a disputed finding or a way around a measure. Documents from evaluators, researchers, standards bodies and security companies are read the same way. Every name of a model, test or practice is matched to one entry in our list; a new name stays a draft until a person confirms it. A statement or test result counts as checked when its sentence is found word for word in the stored document and that document comes from the party it is credited to. Disputed findings, ways around a measure, new entries in the list and decisions that two names mean the same thing wait for a person to review them. The site reports; it does not recommend.

Counts and what they are out of

Coverage, mapping and audit tables

How much has been read

Mapping coverage

Classification audit

A 10% blind second pass sorted 308 sampled sentences into practices and domains again, without seeing the first answer; 46 came out differently (14.9%). The second pass used the same model with a differently worded prompt. A control or domain above 15% disagreement with at least 5 sampled items has its display suspended until reviewed: Input and output classifiers, Prompt-injection defence, Weight and model security.

No difference for: Safety training (7 sampled), Misuse monitoring (7 sampled), Reasoning monitor (2 sampled), Staged access (4 sampled), Provenance (3 sampled), Telemetry (1 sampled), Domain safeguards (7 sampled), Vulnerability disclosure (1 sampled), Framework (1 sampled), Bias (2 sampled), Chemical, biological, radiological and nuclear (1 sampled), Cyber (2 sampled), Harmful content (1 sampled), Misuse & jailbreak (1 sampled).