> **来源：[研报客](https://pc.yanbaoke.cn)** # INTERNATIONAL # AI SAFETY REPORT 2026 # INTERNATIONAL AI SAFETY REPORT 2026 # Contributors # Chair Prof. Yoshua Bengio, Université de Montréal / LawZero / Mila – Quebec AI Institute # Expert Advisory Panel The Expert Advisory Panel is an international advisory body that advises the Chair on the content of the Report. The Expert Advisory Panel provided technical feedback only. The Report – and its Expert Advisory Panel – does not endorse any particular policy or regulatory approach. The Panel comprises representatives nominated by over 30 countries and international organisations including from: Australia, Brazil, Canada, Chile, China, the European Union (EU), France, Germany, India, Indonesia, Ireland, Israel, Italy, Japan, Kenya, Mexico, the Netherlands, New Zealand, Nigeria, the Organisation for Economic Co-operation and Development (OECD), the Philippines, the Republic of Korea, Rwanda, the Kingdom of Saudi Arabia, Singapore, Spain, Switzerland, Türkiye, the United Arab Emirates, Ukraine, the United Kingdom and the United Nations (UN). The full membership list for the Expert Advisory Panel can be found here: https://internationalaisafetyreport.org/expert-advisory-panel # Lead Writers Stephen Clare, Independent Carina Prunkl, Inria # Chapter Leads Maksym Andriushchenko, ELLIS Institute Tübingen Ben Bucknall, University of Oxford Malcolm Murray, SaferAl # Core Writers Shalaleh Rismani, Mila - Quebec AI Institute Conor McGlynn, Harvard University Nestor Maslej, Stanford University Philip Fox, KIRA Center # Writing Group Rishi Bommasani, Stanford University Stephen Casper, Massachusetts Institute of Technology Tom Davidson, Forethought Raymond Douglas, Telic Research David Duvenaud, University of Toronto Usman Gohar, Iowa State University Rose Hadshar, Forethought Anson Ho, Epochal Tiancheng Hu, University of Cambridge Cameron Jones, Stony Brook University Sayash Kapoor, Princeton University Atoosa Kasirzadeh, Carnegie Mellon Sam Manning, Centre for the Governance of AI Vasilios Mavroudis, The Alan Turing Institute Richard Moulange, The Centre for Long-Term Resilience Jessica Newman, University of California, Berkeley Kwan Yee Ng, Concordia AI Patricia Paskov, University of Oxford Girish Sastry, Independent Elizabeth Seger, Demos Scott Singer, Carnegie Endowment for International Peace Charlotte Stix, Apollo Research Lucia Velasco, Maastricht University Nicole Wheeler, Advanced Research + Invention Agency # Advisers to the Chair* * Appointed for the planning phase (February-July 2025); from July, consultants to the Report team Daniel Privitera, Special Adviser to the Chair, KIRA Center Sören Mindermann, Scientific Adviser to the Chair, Mila - Quebec AI Institute # Senior Advisers Daron Acemoglu, Massachusetts Institute of Technology Vincent Conitzer, Carnegie Mellon University Thomas G. Dietterich, Oregon State University Fredrik Heintz, Linköping University Geoffrey Hinton, University of Toronto Nick Jennings, Loughborough University Susan Leavy, University College Dublin Teresa Ludermir, Federal University of Pernambuco Vidushi Marda, Al Collaborative Helen Margetts, University of Oxford John McDermid, University of York Jane Munga, Carnegie Endowment for International Peace Arvind Narayanan, Princeton University Alondra Nelson, Institute for Advanced Study Clara Neppel, IEEE Sarvapali D. (Gopal) Ramchurn, Responsible AI UK Stuart Russell, University of California, Berkeley Marietje Schaake, Stanford University Bernhard Scholkopf, ELLIS Institute Tübingen Alvaro Soto, Pontificia Universidad Catolica de Chile Lee Tiedrich, Duke University Gael Varoquaux, Inria Andrew Yao, Tsinghua University Ya-Qin Zhang, Tsinghua University # Secretariat UK AI Security Institute: Lambrini Das, Arianna Dini, Freya Hempleman, Samuel Kenny, Patrick King, Hannah Merchant, Jamie-Day Rawal, Jai Sood, Rose Woolhouse Mila - Quebec AI Institute: Jonathan Barry, Marc-Antoine Guérard, Claire Latendresse, Cassidy MacNeil, Benjamin Prud'homme # Crown owned 2026 This publication is licensed under the terms of the Open Government Licence v3.0 except where otherwise stated. To view this licence, visit https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/ or write to the Information Policy Team, The National Archives, Kew, London TW9 4DU, or email: psi@nationalarchives.gsi.gov.uk. Any enquiries regarding this publication should be sent to: secretariat.AIStateofScience@dsit.gov.uk. # Disclaimer This Report is a synthesis of the existing research on the capabilities and risks of advanced AI. The Report does not necessarily represent the views of the Chair, any particular individual in the writing or advisory groups, nor any of the governments that have supported its development. The Chair of the Report has ultimate responsibility for it and has overseen its development from beginning to end. Research series number: DSIT 2026/001 # Acknowledgements # Civil society and industry reviewers # Civil society Ada Lovelace Institute, African Centre for Technology Studies, Al Forum New Zealand / Te Kāhui Atamai Iahiko o Aotearoa, Al Safety Asia, Stichting Algorithm Audit, Carnegie Endowment for International Peace, Center for Law and Innovation / Certa Foundation, Centre for the Governance of AI, Chief Justice Meir Shamgar, Center for Digital Law and Innovation, Digital Futures Lab, EON Institute, Equiano Institute, Good Ancestors Policy, Gradient Institute, Institute for Law & AI, Interface, Israel Democracy Institute, Mozilla Foundation, NASSCOM, Old Ways New, RAND, Royal Society, SaferAI, Swiss Academy of Engineering Sciences, The Centre for Long-Term Resilience, The Alan Turing Institute, The Ethics Centre, The Future Society, The HumAlne Foundation, Türkiye Artificial Intelligence Policies Association # Industry Advai, Anthropic, Cohere, Deloitte, Digital Umuganda, Domyn, G42, Google DeepMind, Harmony Intelligence, Hugging Face, HumAln, IBM, LG AI Research, Meta, Microsoft, Naver, OpenAI, Qhala # Informal reviewers Markus Anderljung, David Autor, Mariette Awad, Jamie Bernardi, Stella Biderman, Asher Brass, Ben Brooks, Miles Brundage, Kevin Bryan, Rafael Calvo, Siméon Campos, Carmen Carlan, Micah Carroll, Alan Chan, Jackie Cheung, Josh Collyer, Elena Cryst, Tino Cuéllar, Allan Dafoe, Jean-Stanislas Denain, Fernando Diaz, Roel Dobbe, Seth Donoughe, Izzy Gainsbury, Ben Garfinkel, Adam Gleave, Jasper Götting, Kobi Hackenburg, Lewis Hammond, David Evan Harris, Dan Hendrycks, José Hernández-Orallo, Luke Hewitt, Marius Hobbahn, Manoel Horta Ribeiro, Abigail Jacobs, Ari Kagan, Daniel Kang, Anton Korinek, Michal Kosinski, Gretchen Krueger, Dan Lahav, Anton Leicht, Vera Liao, Eli Lifland, Matthijs Maas, James Manyika, Simon Mylius, AJung Moon, Seán Ó hÉigeartaigh, Tamara Paris, Raymond Perrault, Siva Reddy, Luca Righetti, Jon Roozenbeek, Max Roser, Anders Sandberg, Leo Schwinn, Jaime Sevilla, Theodora Skeadas, Chandler Smith, Tobin South, Jonathan Spring, Merlin Stein, David Stillwell, Daniel Susser, Helen Toner, Sander van der Linden, Kush Varshney, Jess Whittlestone, Kai-Cheng Yang The Secretariat and writing team appreciated assistance with quality control and formatting of citations by José Luis León Medina and copyediting by Amber Ace. # Contents Contributors 2 Acknowledgements 4 Forewords 6 About this Report 9 Key developments since the 2025 Report 10 Executive summary 11 Introduction 14 1. Background on general-purpose AI 16 1.1.What is general-purpose AI? 17 1.2.Current capabilities 26 1.3.Capabilities by 2030 32 2.Risks 44 2.1. Risks from malicious use 45 2.1.1. Al-generated content and criminal activity 45 2.1.2. Influence and manipulation 50 2.1.3. Cyberattacks 57 2.1.4. Biological and chemical risks 64 2.2. Risks from malfunctions 71 2.2.1. Reliability challenges 71 2.2.2. Loss of control 76 2.3. Systemic risks 84 2.3.1. Labour market impacts 84 2.3.2. Risks to human autonomy 89 3. Risk management 96 3.1. Technical and institutional challenges 97 3.2. Risk management practices 105 3.3. Technical safeguards and monitoring 120 3.4.Open-weight models 132 3.5. Building societal resilience 138 Conclusion 146 Glossary 147 How to cite this report 156 References 157 # Forewords # A new scientific assessment of a fast-moving technology This is the second International AI Safety Report, which builds on the mandate by world leaders at the 2023 AI Safety Summit at Bletchley Park to produce an evidence base to inform critical decisions about general-purpose artificial intelligence (AI). This year, we have introduced several changes to make this Report even more useful and accessible. First, to help policymakers better understand the range of potential outcomes despite the uncertainty involved, we have drawn upon new research conducted by the Organisation for Economic Co-operation and Development (OECD) and Forecasting Research Institute to present more specific scenarios and forecasts. Second, following extensive consultation, we have narrowed the scope to focus on 'emerging risks': risks that arise at the frontier of AI capabilities. Given high uncertainty in this domain, the rigorous analysis the Report provides can be especially valuable. A narrower scope also ensures this Report complements other efforts, including the United Nations' Independent International Scientific Panel on AI. Of course, some things have not changed. This remains the most rigorous assessment of AI capabilities, risks, and risk management available. Its development involved contributions from over 100 experts, including the guidance of experts nominated by over 30 countries and intergovernmental organisations. The Report's fundamental goal is also the same: to advance a shared understanding of how AI capabilities are evolving, risks associated with these advances, and what techniques exist to mitigate those risks. The pace of AI progress raises daunting challenges. However, working with the many experts that produced this Report has left me hopeful. I am immensely grateful for the enormous efforts of all contributors – we are making progress towards understanding these risks. With this Report, we hope to improve our collective understanding of what may be the most significant technological transformation of our time. Professor Yoshua Bengio Université de Montréal / LawZero / Mila - Quebec AI Institute & Chair # Building a secure future for AI through international cooperation AI continues to redefine the possibilities before us – transforming economies, revitalising public services, and rapidly accelerating scientific advancement. This pace of progress demands an up-to-date, shared understanding of AI capabilities. This effort will build trust, enable adoption and pave the way for AI to deliver prosperity for all. The 2026 International AI Safety Report is the result of strong collaboration across countries, organisations, civil society and industry partners – working together to produce robust, evidence-based analysis. The Report provides an essential tool for policymakers and world leaders to help navigate this challenging and fast-moving landscape. The United Kingdom remains committed to strengthening international partnerships, scientific collaboration, and institutions that drive innovative AI research forward, including the Al Security Institute. Following the success of the landmark Summits hosted in Bletchley Park (November 2023), Seoul (May 2024) and Paris (February 2025), I am especially looking forward to the India AI Impact Summit – where this Report will be showcased – to ensure AI is shaped for humanity, inclusive growth and a sustainable future. I am delighted to present this Report and thank Yoshua Bengio, the writing team, and all contributors for their dedication to this initiative. Together – through shared responsibility and international cooperation – we can forge a path where AI delivers security, opportunity and growth for every nation and every citizen. Kanishka Narayan MP Minister for Al and Online Safety Department for Science, Innovation and Technology UK Government # Enabling equitable access to AI for all The second International AI Safety Report builds on the mandate of the 2023 AI Safety Summit at Bletchley Park. It aims at developing a shared, science-based understanding of advanced AI capabilities and risks. This edition focuses on rapidly evolving general-purpose AI systems, including language, vision and agentic models. It also reviews associated challenges, including wider impacts on labour markets, human autonomy and concentration of power. As AI systems grow more capable, safety and security remain critical priorities. The Report highlights practical approaches of model evaluations, dangerous capability thresholds and 'if-then' safety commitments to reduce high-impact failures. Our global risk management frameworks are still immature, with limited quantitative benchmarks and significant evidence gaps. These gaps must be addressed alongside innovation. For India and the Global South, AI safety is closely tied to inclusion, safety and institutional readiness. Responsible openness of AI models, fair access to compute and data, and international cooperation are essential too. As host of the 2026 India AI Impact Summit, India has a key role in shaping global AI safety efforts. The Report is intended to help policymakers, researchers, industry and civil society shape national strategies. # Ashwini Vaishnaw Minister of Railways, Information & Broadcasting and Electronics & Information Technology Government of India # About this Report This is the second edition of the International AI Safety Report. The series was created following the 2023 AI Safety Summit at Bletchley Park to support an internationally shared scientific understanding of the capabilities and risks associated with advanced AI systems. A diverse group of over 100 Artificial Intelligence (AI) experts guided its development, including an international Expert Advisory Panel with nominees from over 30 countries and international organisations, including the Organisation for Economic Co-operation and Development (OECD), the European Union (EU), and the United Nations (UN). # Scope, focus, and independence Scope: This Report concerns 'general-purpose AI': AI models and systems capable of performing a wide variety of tasks across different contexts. These models and systems perform tasks like generating text, images, audio, or other forms of data, and are frequently adapted to a range of domain-specific applications. Focus: This Report focuses on 'emerging risks': risks that arise at the frontier of AI capabilities. The Bletchley Declaration, issued following the 2023 AI Safety Summit, emphasised that "particular safety risks arise at the 'frontier' of AI", including risks from misuse, issues of control, and cybersecurity risks. The Declaration also recognised broader AI impacts, including on human rights, fairness, accountability, and privacy. This Report aims to complement assessments that consider these broader concerns, including the UN's Independent International Scientific Panel on AI. $^{\dagger}$ Independence: Under the leadership of the Chair, the independent writing team jointly had full discretion over its content. The Report aims to synthesise scientific evidence to support informed policymaking. It does not make specific policy recommendations. # Process and contributors The International AI Safety Report is written by a diverse team with over 30 members, led by the Chair, lead writers, and chapter leads. It undergoes a structured review process. Early drafts are reviewed by external subject-matter experts before a consolidated draft is reviewed by: — An Expert Advisory Panel with representatives nominated by over 30 countries and international organisations, including the OECD, the EU, and the UN A group of Senior Advisers composed of leading international researchers - Representatives from industry and civil society organisations The writing team, chapter leads, lead writers, and Chair consider feedback provided by reviewers and incorporate it where appropriate. # Key developments since the 2025 Report Notable developments since the publication of the first International AI Safety Report in January 2025. General-purpose AI capabilities have continued to improve, especially in mathematics, coding, and autonomous operation. Leading AI systems achieved gold-medal performance on International Mathematical Olympiad questions. In coding, AI agents can now reliably complete some tasks that would take a human programmer about half an hour, up from under 10 minutes a year ago. Performance nevertheless remains 'jagged', with leading systems still failing at some seemingly simple tasks. - Improvements in general-purpose AI capabilities increasingly come from techniques applied after a model's initial training. These 'post-training' techniques include refining models for specific tasks and allowing them to use more computing power when generating outputs. At the same time, using more computing power for initial training continues to also improve model capabilities. Al adoption has been rapid, though highly uneven across regions. Al has been adopted faster than previous technologies like the personal computer, with at least 700 million people now using leading AI systems weekly. In some countries over $50\%$ of the population uses AI, though across much of Africa, Asia, and Latin America adoption rates likely remain below $10\%$ . - Advances in AI's scientific capabilities have heightened concerns about misuse in biological weapons development. Multiple AI companies chose to release new models in 2025 with additional safeguards after pre-deployment testing could not rule out the possibility that they could meaningfully help novices develop such weapons. - More evidence has emerged of AI systems being used in real-world cyberattacks. Security analyses by AI companies indicate that malicious actors and state-associated groups are using AI tools to assist in cyber operations. - Reliable pre-deployment safety testing has become harder to conduct. It has become more common for models to distinguish between test settings and real-world deployment, and to exploit loopholes in evaluations. This means that dangerous capabilities could go undetected before deployment. - Industry commitments to safety governance have expanded. In 2025, 12 companies published or updated Frontier AI Safety Frameworks – documents that describe how they plan to manage risks as they build more capable models. Most risk management initiatives remain voluntary, but a few jurisdictions are beginning to formalise some practices as legal requirements. # Executive summary This Report assesses what general-purpose AI systems can do, what risks they pose, and how those risks can be managed. It was written with guidance from over 100 independent experts, including nominees from more than 30 countries and international organisations, such as the EU, OECD, and UN. Led by the Chair, the independent experts writing it jointly had full discretion over its content. This Report focuses on the most capable general-purpose AI systems and the emerging risks associated with them. 'General-purpose AI' refers to AI models and systems that can perform a wide variety of tasks. 'Emerging risks' are risks that arise at the frontier of general-purpose AI capabilities. Some of these risks are already materialising, with documented harms; others remain more uncertain but could be severe if they materialise. The aim of this work is to help policymakers navigate the 'evidence dilemma' posed by general-purpose AI. AI systems are rapidly becoming more capable, but evidence on their risks is slow to emerge and difficult to assess. For policymakers, acting too early can lead to entrenching ineffective interventions, while waiting for conclusive data can leave society vulnerable to potentially serious negative impacts. To alleviate this challenge, this Report synthesises what is known about AI risks as concretely as possible while highlighting remaining gaps. While this Report focuses on risks, general-purpose AI can also deliver significant benefits. These systems are already being usefully applied in healthcare, scientific research, education, and other sectors, albeit at highly uneven rates globally. But to realise their full potential, risks must be effectively managed. Misuse, malfunctions, and systemic disruption can erode trust and impede adoption. The governments attending the Al Safety Summit initiated this Report because a clear understanding of these risks will allow institutions to act in proportion to their severity and likelihood. # Capabilities are improving rapidly but unevenly Since the publication of the 2025 Report, general-purpose AI capabilities have continued to improve, driven by new techniques that enhance performance after initial training. AI developers continue to train larger models with improved performance. Over the past year, they have further improved capabilities through 'inference-time scaling': allowing models to use more computing power in order to generate intermediate steps before giving a final answer. This technique has led to particularly large performance gains on more complex reasoning tasks in mathematics, software engineering, and science. # At the same time, capabilities remain 'jagged': leading systems may excel at some difficult tasks while failing at other, simpler ones. General-purpose AI systems excel in many complex domains, including generating code, creating photorealistic images, and answering expert-level questions in mathematics and science. Yet they struggle with some tasks that seem more straightforward, such as counting objects in an image, reasoning about physical space, and recovering from basic errors in longer workflows. The trajectory of AI progress through 2030 is uncertain, but current trends are consistent with continued improvement. AI developers are betting that computing power will remain important, having announced hundreds of billions of dollars in data centre investments. Whether capabilities will continue to improve as quickly as they recently have is hard to predict. Between now and 2030, it is plausible that progress could slow or plateau (e.g. due to bottlenecks in data or energy), continue at current rates, or accelerate dramatically (e.g. if AI systems begin to speed up AI research itself). # Real-world evidence for several risks is growing General-purpose AI risks fall into three categories: malicious use, malfunctions, and systemic risks. # Malicious use # AI-generated content and criminal activity: AI systems are being misused to generate content for scams, fraud, blackmail, and non-consensual intimate imagery. Although the occurrence of such harms is well-documented, systematic data on their prevalence and severity remains limited. Influence and manipulation: In experimental settings, AI-generated content can be as effective as human-written content at changing people's beliefs. Real-world use of AI for manipulation is documented but not yet widespread, though it may increase as capabilities improve. Cyberattacks: AI systems can discover software vulnerabilities and write malicious code. In one competition, an AI agent identified $77\%$ of the vulnerabilities present in real software. Criminal groups and state-associated attackers are actively using general-purpose AI in their operations. Whether attackers or defenders will benefit more from AI assistance remains uncertain. Biological and chemical risks: General-purpose AI systems can provide information about biological and chemical weapons development, including details about pathogens and expert-level laboratory instructions. In 2025, multiple developers released new models with additional safeguards after they could not exclude the possibility that these models could assist novices in developing such weapons. It remains difficult to assess the degree to which material barriers continue to constrain actors seeking to obtain them. # Malfunctions Reliability challenges: Current AI systems sometimes exhibit failures such as fabricating information, producing flawed code, and giving misleading advice. AI agents pose heightened risks because they act autonomously, making it harder for humans to intervene before failures cause harm. Current techniques can reduce failure rates but not to the level required in many high-stakes settings. Loss of control: 'Loss of control' scenarios are scenarios where AI systems operate outside of anyone's control, with no clear path to regaining control. Current systems lack the capabilities to pose such risks, but they are improving in relevant areas such as autonomous operation. Since the last Report, it has become more common for models to distinguish between test settings and real-world deployment and to find loopholes in evaluations, which could allow dangerous capabilities to go undetected before deployment. # Systemic risks Labour market impacts: General-purpose AI will likely automate a wide range of cognitive tasks, especially in knowledge work. Economists disagree on the magnitude of future impacts: some expect job losses to be offset by new job creation, while others argue that widespread automation could significantly reduce employment and wages. Early evidence shows no effect on overall employment, but some signs of declining demand for early-career workers in some AI-exposed occupations, such as writing. Risks to human autonomy: AI use may affect people's ability to make informed choices and act on them. Early evidence suggests that reliance on AI tools can weaken critical thinking skills and encourage 'automation bias', the tendency to trust AI system outputs without sufficient scrutiny. 'AI companion' apps now have tens of millions of users, a small share of whom show patterns of increased loneliness and reduced social engagement. # Layering multiple approaches offers more robust risk management Managing general-purpose AI risks is difficult due to technical and institutional challenges. Technically, new capabilities sometimes emerge unpredictably, the inner workings of models remain poorly understood, and there is an 'evaluation gap': performance on pre-deployment tests does not reliably predict real-world utility or risk. Institutionally, developers have incentives to keep important information proprietary, and the pace of development can create pressure to prioritise speed over risk management and makes it harder for institutions to build governance capacity. Risk management practices include threat modelling to identify vulnerabilities, capability evaluations to assess potentially dangerous behaviours, and incident reporting to gather more evidence. In 2025, 12 companies published or updated their Frontier AI Safety Frameworks – documents that describe how they plan to manage risks as they build more capable models. While AI risk management initiatives remain largely voluntary, a small number of regulatory regimes are beginning to formalise some risk management practices as legal requirements. Technical safeguards are improving but still show significant limitations. For example, attacks designed to elicit harmful outputs have become more difficult, but users can still sometimes obtain harmful outputs by rephrasing requests or breaking them into smaller steps. AI systems can be made more robust by layering multiple safeguards, an approach known as 'defence-in-depth'. # Open-weight models pose distinct challenges. They offer significant research and commercial benefits, particularly for lesser-resourced actors. However, they cannot be recalled once released, their safeguards are easier to remove, and actors can use them outside of monitored environments – making misuse harder to prevent and trace. Societal resilience plays an important role in managing AI-related harms. Because risk management measures have limitations, they will likely fail to prevent some AI-related incidents. Societal resilience-building measures to absorb and recover from these shocks include strengthening critical infrastructure, developing tools to detect AI-generated content, and building institutional capacity to respond to novel threats. # Introduction Leading general-purpose AI systems now pass professional licensing exams in law and medicine, write functional software when given simple prompts, and answer PhD-level science questions as well as subject-matter experts. Just three years ago, when ChatGPT launched, they could not reliably do any of these things. The pace of this transformation has been remarkable, and while the pace of future changes is uncertain, most experts expect that AI will continue to improve. Almost a billion people now use general-purpose AI systems in their daily lives for work and learning. Companies are investing hundreds of billions of dollars to build the infrastructure to train and deploy them. In many cases, AI is already reshaping how people access information, make decisions, and solve problems, with applications in industries from software development to legal services to scientific research. But the same capabilities that make these systems useful also create new risks. Systems that write functional code also help create malware. Systems that summarise scientific literature might help malicious actors plan attacks. As AI is deployed in high-stakes settings – from healthcare to critical infrastructure – the impacts of deliberate misuse, failures, and systemic disruptions can be severe. For policymakers, the rate of change, the breadth of applications, and the emergence of new risks pose important questions. General-purpose AI capabilities evolve quickly, but it takes time to collect and assess evidence about their societal effects. This creates what this Report calls the 'evidence dilemma'. By acting too early, policymakers risk implementing ineffective or even harmful interventions. But waiting for conclusive evidence can leave societies vulnerable to potential risks. # The role of this Report This Report aims to help policymakers navigate that dilemma. It provides an up-to-date, internationally shared scientific assessment of general-purpose AI capabilities and risks. The writing team included over 100 independent experts, including an Expert Advisory Panel comprising nominees from more than 30 countries and intergovernmental organisations including the EU, OECD, and UN. The Report also incorporates feedback from reviewers across academia, industry, government, and civil society. While contributors differ on some points, they share the belief that constructive and transparent scientific discourse on AI is necessary for people around the world to realise the technology's benefits and mitigate its risks. Because the evidence dilemma is most acute where scientific understanding is thinnest, this Report focuses on 'emerging risks': risks that arise at the frontier of general-purpose AI capabilities. Its analysis focuses on issues that remain particularly uncertain, aiming to complement efforts that consider the broader social impacts of AI. While this Report draws on international expertise and aims to be globally relevant, readers should note that variation in AI adoption rates, infrastructure, and institutional contexts mean that risks may manifest differently across countries and regions. The evidence base for these risks is uneven. Some risks, such as harms from Al-generated media or cybersecurity vulnerabilities, now have robust empirical evidence. Evidence for others – particularly risks that may arise from future developments in AI capabilities – relies on modelling exercises, laboratory studies under controlled conditions, and theoretical analysis. The analysis here draws on a broad range of scientific, technical, and socioeconomic evidence published before December 2025. Where high uncertainty remains, it identifies evidence gaps to guide future research. # Changes since the 2025 Report This edition of the International AI Safety Report follows the publication of the first Report in January 2025. Since then, both general-purpose AI and the research community's understanding of it have continued to evolve, warranting a revised assessment. Over the past year, AI developers have continued to train larger and more capable AI models. However, they have also achieved significant capability gains through new techniques that allow systems to use more computing power to generate intermediate steps before giving a final answer. These new 'reasoning systems' show particularly improved performance in mathematics, coding, and science. In addition, AI agents – systems that can act in the world with limited human oversight – have become increasingly capable and reliable, though they remain prone to basic errors that limit their usefulness in many contexts. General-purpose AI systems have also continued to diffuse, faster than many previous technologies in some places, though unevenly across countries and regions. Improved performance in capabilities related to scientific knowledge has also prompted multiple developers to release new models with additional safeguards, as they were unable to confidently rule out the possibility that these models could assist novices with weapon development. This Report covers all these developments in greater depth, and incorporates several new structural elements to improve its usefulness and accessibility. It includes capability forecasts developed with the Forecasting Research Institute and scenarios developed with the OECD. Each section includes updates since the last Report, key challenges for policymakers, and evidence gaps to guide future research. # How this Report is organised This Report is organised around three central questions: # 1. What can general-purpose AI do today, and how might its capabilities change? Chapter 1 covers how general-purpose AI is developed (§1.1. What is general-purpose AI?), current capabilities and limitations (§1.2. Current capabilities), and the factors that will shape developments over the coming years (§1.3. Capabilities by 2030). # 2. What emerging risks does general-purpose AI pose? Chapter 2 covers risks from malicious use, including the use of AI systems for criminal activities (§2.1.1. Al-generated content and criminal activity), manipulation (§2.1.2. Influence and manipulation), cyberattacks (§2.1.3. Cyberattacks), and developing biological or chemical weapons (§2.1.4. Biological and chemical risks); risks from malfunctions, including operational failures (§2.2.1. Reliability challenges) and loss of control (§2.2.2. Loss of control); and systemic risks,† including disruptions to labour markets (§2.3.1. Labour market impacts) and threats to human autonomy (§2.3.2. Risks to human autonomy). # 3. What risk management approaches exist, and how effective are they? Chapter 3 covers the distinctive policymaking challenges that general-purpose AI poses (§3.1. Technical and institutional challenges), current risk management practices (§3.2. Risk management practices), the various techniques developers use to make AI models and systems more robust and resistant to misuse (§3.3. Technical safeguards and monitoring), the particular challenges of open-weight models (§3.4. Open-weight models), and efforts to make society more resilient to potential AI shocks and harms (§3.5. Building societal resilience). Many aspects of how general-purpose AI will develop remain deeply uncertain. But decisions made today – by developers, governments, communities, and individuals – will shape its trajectory. This Report aims to ensure that those decisions are made with the best possible understanding of AI capabilities, risks, and options for risk management. # Background on general-purpose AI Over the past year, the capabilities of general-purpose AI models and systems have continued to improve. Leading systems now match or exceed expert-level performance on standardised evaluations across a range of professional and scientific subjects, from undergraduate examinations in law and chemistry to graduate-level science questions. Yet their capabilities are also 'jagged': they simultaneously excel on difficult benchmarks and fail at some basic tasks. Current systems still provide false information at times, underperform in languages that are less common in their training data, and struggle with real-world constraints like unfamiliar interfaces and unusual problems. Alleviating these limitations is an area of active research, and researchers and developers are making progress in some areas. Sustained investment in AI research and training is expected to drive continued capability progress through 2030, though substantial uncertainty remains about both what new capabilities will emerge and whether current shortcomings will be resolved. This chapter covers current and future capabilities of general-purpose AI. The first section introduces general-purpose AI, explaining how these systems work and what drives their performance (§1.1. What is general-purpose AI?). The second section examines current capabilities and limitations (§1.2. Current capabilities). A recurring theme is the 'evaluation gap': how a system performs in pre-deployment evaluations like benchmark testing often seems to overstate its practical utility, because such evaluations do not capture the full complexity of real-world tasks. The final section considers how capabilities might evolve by 2030 (§1.3. Capabilities by 2030). AI developers are investing heavily in computing power, data generation, and research. However, there is substantial uncertainty about how these investments will translate into future capability gains. To illustrate the range of plausible outcomes, the section presents four scenarios developed by the OECD, which range from stagnation to an acceleration in the rate of capability improvements. # Section 1.1 # What is general-purpose AI? # Key information - 'General-purpose AI' refers to AI models and systems that can perform a variety of tasks, rather than being specialised for one specific function or domain. Examples of such tasks include producing text, images, video, and audio, and performing actions on a computer. General-purpose AI models are based on 'deep learning'. Modern deep learning involves using large amounts of computational resources to help AI models learn complex relationships and abstract features from very large training datasets. Developing a leading general-purpose AI system has become very expensive. To train and deploy such systems, developers need extensive data, specialised labour, and large-scale computational resources. Acquiring these resources to develop a leading system from scratch now costs hundreds of millions of US dollars. - Since the publication of the last Report (January 2025), capability improvements have increasingly come from post-training techniques and extra computational resources at the time of use, rather than from increasing model size alone. Previous performance improvements largely resulted from making models larger and using more data and computing power during initial training. # What are general-purpose AI systems? General-purpose AI systems are software programmes that learn patterns from large amounts of data, enabling them to perform a variety of tasks rather than being specialised for one specific function or domain (see Table 1.1). To create these systems, AI developers carry out a multi-stage process that requires substantial computational resources, large datasets, and specialised expertise (see Table 1.2). Computational resources (often shortened to 'compute') are required both to develop and to deploy AI systems, and include specialised computer chips as well as the software and infrastructure needed to run them. Because they are trained on large, diverse datasets, general-purpose AI systems can carry out many different tasks, such as summarising text, generating images, or writing computer code. This section explains how general-purpose AI systems are made, what 'reasoning' models are, and how policy decisions shape general-purpose AI system development. Table 1.1: There are several different types of general-purpose AI. In this Report, models that can predict structural information for diverse classes of molecules are considered to be 'general-purpose' AI because they can be adapted for a variety of tasks. For example, models trained to predict protein structure are applicable to a variety of other tasks, such as predicting protein interactions, predicting small molecular binding sites, and predicting and designing cyclic peptides (40). <table><tr><td>Type of general-purpose AI</td><td colspan="3">Examples</td></tr><tr><td rowspan="6">Language systems</td><td>— Apertus (1)</td><td>— GPT-5 (7*)</td><td></td></tr><tr><td>— Claude Sonnet 4.5 (2*)</td><td>— Hunyuan-Large (8*)</td><td></td></tr><tr><td>— Command A (3*)</td><td>— Kimi K2 (9*)</td><td></td></tr><tr><td>— EXAONE 4.0 (4*)</td><td>— Mistral 3.1 (10*)</td><td></td></tr><tr><td>— Gemini 3 Pro (5*)</td><td>— Qwen3 (11*)</td><td></td></tr><tr><td>— GLM-4.5 (6*)</td><td>— DeepSeek-V3.2 (12*)</td><td></td></tr><tr><td rowspan="2">Image generators</td><td>— DALL-E 3 (13*)</td><td>— Midjourney v7 (15*)</td><td></td></tr><tr><td>— Gemini 2.5 Flash (14*)</td><td>— Qwen-Image (16*)</td><td></td></tr><tr><td rowspan="3">Video generators</td><td>— Cosmos (17*)</td><td>— Runway (19)</td><td></td></tr><tr><td>— Sora (18*)</td><td>— Veo 3 (20*)</td><td></td></tr><tr><td>— Pika (19)</td><td></td><td></td></tr><tr><td rowspan="3">Robotics and navigation systems</td><td>— Gemini Robotics (21*)</td><td>— OctoAI (24*)</td><td></td></tr><tr><td>— Gr00t N1 (22*)</td><td>— OpenVLA (25*)</td><td></td></tr><tr><td>— MobileAloha (23)</td><td>— PaLM-E (26)</td><td></td></tr><tr><td rowspan="2">Predictors of diverse classes of biomolecular structures</td><td>— AlphaFold 3 (27)</td><td>— CellFM (29)</td><td></td></tr><tr><td>— Amplify (28)</td><td>— Evo 2 (30)</td><td></td></tr><tr><td rowspan="4">AI agents</td><td>— AlphaEvolve (31*)</td><td>— Magentic-One (35*)</td><td></td></tr><tr><td>— ChatGPT Agent (32*)</td><td>— OpenScholar (36*)</td><td></td></tr><tr><td>— Claude Code (33*)</td><td>— The AI Scientist-v2</td><td></td></tr><tr><td>— Doubao-1.5 (34*)</td><td>(37*, 38*, 39*)</td><td></td></tr></table> # Deep learning is foundational to general-purpose AI Researchers build general-purpose AI models using a process called 'deep learning', which trains models to learn from examples (41). Unlike software engineering, deep learning models learn to accomplish tasks from data instead of relying on hand-written instructions. By processing large amounts of data, such as images, text, or audio, these models discover ways to represent that data, creating internal representations of patterns (such as shapes, word associations, or sound structures) that help the model recognise relationships and generate outputs aligned with its training objective. They then use these learned internal representations as abstract features to analyse new, similar data and generate outputs in the same style. For example, a general-purpose AI model trained on enough examples of 19th-century romantic English poetry can recognise new poems in that style and produce new material in a similar style. On a more granular level, deep learning works by processing data through layers of interconnected information-processing nodes. These nodes are often called 'neurons' because they are loosely inspired by neurons in biological brains ('neural networks') (Figure 1.1) (42). As information flows from one layer of neurons to the next, the model progressively transforms the data into more abstract representations as groups of learned features - patterns the model has automatically discovered in the data, rather than hand-coded ones. For example, in an image-processing model, the first layers might learn to detect simple features such as edges or basic shapes, while deeper layers combine these features to pick out more complex patterns such as faces or objects. The features at all layers are discovered through the optimisation process that defines the training procedure. During training, when the model makes mistakes, deep learning algorithms adjust the strength of various connections between neurons to improve the model's performance. The strength of each connection between nodes is often called a 'weight'. This layered approach gives deep learning its name. Deep learning has proven very effective at allowing AI systems to accomplish tasks that were previously considered difficult for traditional hand-programmed computational systems and other earlier symbolic or rule-based AI methods. Most state-of-the-art general-purpose AI models are now based on a specific neural network architecture known as the 'transformer' (43, 44). Transformers use an 'attention' mechanism (45) that helps the model to focus on the most relevant parts of the input data when processing information, such as determining which words in a sentence are most important for understanding its meaning. This particular way of building models has led to significant improvements in translation (43), natural language processing (46), image recognition $(47^{*})$ and speech recognition $(48^{*}, 49)$ , ultimately leading to the development of today's most advanced models. Structure of a neural network Figure 1.1: An illustrative representation of a 'neural network'. Today's general-purpose AI models are based on these networks, which are loosely inspired by biological brains. Different networks have different sizes and architectures. However, all are composed of connected information-processing units called 'neurons', where the strengths of connections between neurons are called 'weights'. Weights are updated through training with large quantities of data. Source: International AI Safety Report 2025 (50) (modified). Stages of general-purpose AI development Figure 1.2: A schematic representation of the stages of general-purpose AI development. Source: International AI Safety Report 2026. # General-purpose AI is developed in stages Developing a general-purpose AI system involves multiple stages, from initial model training to post-deployment monitoring and updates (Figure 1.2). In practice, these steps often overlap in an iterative manner. Each stage requires different resource inputs (e.g. data, labour, compute) and different techniques, and they are sometimes undertaken by different developers (Figure 1.2 and Table 1.2). For example, model pre-training generally requires large amounts of compute and data, making this stage particularly sensitive to policies that affect access to computational resources or training data (51, 52). Similarly, data curation and some model fine-tuning methods currently involve large amounts of human labour for initial data labelling (53). This stage is therefore sensitive to changes in labour costs, platform policies, or regulations affecting cross-border contracting arrangements. # 1. Data collection and curation Before training a general-purpose AI model, developers and data workers collect, clean, curate, and standardise raw training data into a format the model can learn from. This can be a labour-intensive process. The training datasets behind state-of-the-art models comprise an immense number of examples from across the internet. Teams often develop sophisticated filtering methods to reduce harmful content, eliminate duplicate data, and improve representation across different topics and sources (54, 55). Data curation can also help reduce copyright and privacy violations, remove examples containing dangerous knowledge, handle multiple languages, and improve documentation for data provenance (56, 57, 58). # 2. Pre-training (first stage of training) During pre-training, developers feed models massive amounts of diverse data to instil a broad base of information and contextual understanding. This process produces a 'base model'. This is a highly data- and compute-intensive process. During pre-training, models are exposed to billions or trillions of examples of content such as pictures, texts, or audio. Through this exposure, the model gradually discovers abstract features to represent data and learns about how these features are related, which allows it to make sense of new inputs in context. This pre-training process takes weeks or months (59) and uses tens or hundreds of thousands of graphics processing units (GPUs) or tensor processing units (TPUs) (60) – specialised computer chips designed to rapidly process many such calculations. Some developers conduct pre-training with their own compute, while others use resources provided by specialised compute providers. <table><tr><td>3. Post-training and fine-tuning (second stage of training)</td><td>‘Post-training’ further refines the base model to optimise it for a specific application. It is a moderately compute-intensive and highly labour-intensive process. A shift towards using ‘synthetic data’ – artificially generated information that mimics real-world data but is created using algorithms or simulations – is helping to make this phase less labour-intensive. Post-training includes various fine-tuning techniques and other modifications. ‘Supervised fine-tuning’ involves further training a trained model on specific datasets to improve the model's performance in that domain (61, 62). For example, a general-purpose mod