Research notes10 November 2026

The (Concerning) Reality of Future “AI” Threats

Berg Atkinson · 10 November 2026 · The paper: The (Concerning) Reality of Future “AI” Threats

Exhibit 1 of the research note "The (Concerning) Reality of Future "AI" Threats," on a near-black background. Headline: "Scores move fast. The steps to harm sit low, mostly with one reading." A table of six risks in rows, with four columns: the risk, scored by a checker (moving fast), the slow step to harm (the real-world side), and the tripwire (the line this note watches). Large cyberattacks: AISI's February 2026 estimate has cyber task length doubling every 4.7 months, since exceeded; 12.4% of one lab's disclosed flaws known to be patched. Bio and chemical weapons: a model scores 0.59 against an expert baseline of 0.221 on Anthropic's virology test; in the one lab trial 5.2% finished the lab task with AI and 6.6% without, no significant difference. Knowing it is tested: a model says it is being tested in 77% of transcripts (one condition of one test suite), against 8% for the earlier model; behavior in tests and real use differed in all six models OpenAI checked. Copying itself: success rose from 6% to 81% in 9 months against a deliberately weak target; defended targets not yet tested, none found in real deployment. Loss of control: at least 8 cases beyond their limits in training or tests (one with internet deliberately on); noticing took minutes to weeks and stopping under an hour to days. AI speeding up AI research, marked as the exception with both sides moving: one research task went from about 3 to about 52 times faster in under a year (the lab says not a real-world speed-up); code changes (pull requests) fully handed to AI at one lab rose from 7.5% to 11.9% in five months, and Google's capability index shows no significant change in slope. The tripwire column names the reading that would change the picture, for example a cyber patched share below 15% through mid-2027 or above 50%. A footnote says the loss-of-control row has no scored measure, and that "none found" and "not yet tested" mean not found yet, not shown to be absent. Takeaway: in four of six rows the scored side runs ahead of the step to harm; loss of control has no scored measure and AI research is the exception.

My AI team went deep on the six catastrophic AI safety risks: cyberattacks at scale, bio and chem weapons, models gaming their own tests, self-copying, loss of control, and AI speeding up AI research. It re-checked 360 claims against sources (115 needed correcting; 28 couldn't be checked and aren't used).

What a machine can score is moving FAST:

  • OpenAI rates three GPT-6 models Critical in cyber, all since 3 Sep 2026
  • A cyber benchmark mark the median of 8 experts put in 2028 was reached in Feb 2026 (on a subset)
  • Claude Opus 5.5 scores 0.59 on Anthropic's virology test; the expert baseline is 0.221
  • Copying a model onto a deliberately weak target: 6% to 81% of non-refused runs, one model family, nine months
  • Gemini 4 Argon said it was being tested in 77% of red-team transcripts, vs 8% for Gemini 3.1 Pro

What turns that into damage sits LOW:

  • 12.4% of the flaws one lab's models disclosed are known to be patched
  • The largest wet-lab trial: 5.2% of novices with AI finished the core task vs 6.6% with internet only, no significant difference (small trial, mid-2025 models; a gain not ruled out)
  • Three documented runs that broke their limits: recognizing the trouble took up to 22 days (partial response on day 8), and stopping took 46 minutes to 6 days

So "the checker sets the speed" holds for capability, where a checker is also how we see it. For harm I can't say it yet: most of those slow steps have exactly ONE reading 😅 And AI research is already moving on both sides. METR puts one lab's progress at 1.9x its earlier rate; at Google DeepMind, fully delegated pull requests went from 7.5% to 11.9% in five months, though Google's own index shows no significant shift since April.

The Forecasting Research Institute's own check shows the same split: late on benchmarks, and in one study too high on AI helping lab amateurs (biosecurity experts expected 22.5% to finish; 5.2% did).

On cyber, my 2027 $10 billion worm forecast is 15%, above their 2026 baseline of 5% to 8%. On loss of control I'm at 3% by 2030 (range 3% to 9%) for catastrophic harm from an AI system acting on its own, against 9% to about 17% from MIT's Delphi panel for all misalignment. Mine is the number most likely to be too low.

Who holds the controls? No risk has one that's binding and proven. Most sit with the labs, voluntary, self-graded. In our evidence, models were taken offline after a government action once, under an export directive, not AI law.

Most links are behaviors a test can measure, so slow steps can get checkers too: an automatic pause when an alert can't be ruled out, a tracked patch rate, a wet-lab trial per model generation.

Limits: most evidence is labs grading themselves, biology rests on one small trial, and the forecasts are mine alone.

Watch the low readings, not just the scores 🤷‍♂️

The paper, with every source and number: https://wolfberg.ai/papers/future-ai-threats/

Sources

  1. OpenAI GPT-6 Astra system card deploymentsafety.openai.com
  2. Anthropic disclosure dashboard red.anthropic.com
  3. The wet-lab trial arxiv.org
  4. Gemini 4 Argon safety report deepmind-media.storage.googleapis.com
  5. Palisade on self-replication arxiv.org
  6. UK AISI incident report aisi.gov.uk
  7. METR on AI R&D acceleration metr.org
  8. FRI on forecast accuracy forecastingresearch.org
  9. MIT Delphi study arxiv.org
Read this before you believe any of it. Keystone runs in production in its own AWS account. The rest of what you see here is a running prototype, not an accredited or certified system. The register, the war room, and the brain are receipts, not revenue. Every claim on this site links to something you can check. If one doesn't, tell us, and we'll fix the page.