Sourceunknowntext stored

Frontier Risk Report (February to March 2026)

Author not recordedMETR BlogPublished May 19, 2026Original︎ ↗

Claims1

ExaminationsNone

Text402 sections

VersionsOne known

CopiesNone recorded

CorrectionsNone recorded

Facts checked Nov 1, 2026

ReachNo copies recorded

StructureIn 1 claim's map0 sources downstream across 1 claim

EvidenceNot yet read

Examinations

None recorded.

Text2633 passages · 1 marked

No examination yetMarked passage

Our Work0 passages

Research0 passages

Notes0 passages

Updates0 passages

Risk Assessment0 passages

About0 passages

Donate0 passages

Careers0 passages

Language0 passages

English0 passages

Español1 passage

Search0 passages

Our Work0 passages

Research0 passages

Notes0 passages

Updates0 passages

Risk Assessment0 passages

About0 passages

Donate0 passages

Careers0 passages

English0 passages

Español1 passage

English0 passages

Español1 passage

Menu2 passages

DATE0 passages

May 19, 20260 passages

SHARE0 passages

Copy Link0 passages

Citation2 passages

Copy0 passages

Subscribe0 passages

Assessment Window: Feb 16, 2026 – Mar 16, 20260 passages

Download PDF1 passage

Executive summary and guide to the report7 passages

All sources0 passages

All models1 passage

Public materials0 passages

METR evaluations0 passages

Shared by companies2 passages

Explore the incidents chart on its own page2 passages

Pilot process33 passages

Key facts6 passages

Means0 passages

Coding agents did real projects that would take humans hours or days22 passages

Agents had significantly worse judgment and reliability than human experts28 passages

Motive0 passages

On hard tasks, agents often violated constraints and acted deceptively14 passages

All sources0 passages

All models1 passage

Public materials0 passages

METR evaluations0 passages

Shared by companies20 passages

Outside toy scenarios, agents weren’t seen taking egregious actions to gain power19 passages

Opportunity0 passages

Agents seemed to need natural language reasoning for the most difficult tasks26 passages

Aside on propensities toward openness in chain of thought2 passages

Monitors caught many harmful actions but there were exceptions and workarounds17 passages

Risk assessment4 passages

Threat model3 passages

Not in scope: indirect undermining of human control10 passages

Focus of analysis: plausible robustness of rogue deployments5 passages

Risk at the time of assessment0 passages

All sources0 passages

All models1 passage

Public materials0 passages

METR evaluations0 passages

Shared by companies7 passages

Means11 passages

Well within observed capabilities3 passages

Edge of observed capabilities5 passages

Well beyond observed capabilities3 passages

Motive0 passages

Task completion motives4 passages

Other possible motives2 passages

Opportunity4 passages

How risk may evolve in the near future6 passages

Conclusion4 passages

Contributors5 passages

Appendices0 passages

Appendix A: Process details1 passage

Model access8 passages

Redaction and anonymization4 passages

Silent exit option5 passages

Questionnaire3 passages

Means5 passages

Question 1: Evidence about direct capabilities7 passages

Question 2: Interpreting our direct capabilities evaluation9 passages

Question 3: Evidence about covert capabilities6 passages

Question 4: Interpreting our covert capabilities evaluation11 passages

Motive1 passage

Question 5: Alignment target1 passage

Question 6: Misalignment mechanisms10 passages

Question 7: Misalignment detection8 passages

Question 8: Overfitting to detection methods6 passages

Opportunity2 passages

Question 9: Tasks and access10 passages

Question 10: Oversight8 passages

Question 11: Insider threat security1 passage

Looking forward1 passage

Question 12: Development timeline1 passage

Question 13: Capability trends1 passage

Trajectories on internal benchmarks or capability evaluations over the past 1–2 years1 passage

Any other measures you track internally to gauge progress1 passage

Question 14: Acceleration of R&D from AI12 passages

Operating conditions3 passages

1: Secure Sufficient Access and Resources14 passages

2: Minimized Conflicts of Interest13 passages

3: Analytic Autonomy5 passages

4: Transparent Methods and Results8 passages

5: Protection of Sensitive Information6 passages

Appendix B: Attributed materials from participating companies0 passages

Anthropic59 passages

Google20 passages

Meta14 passages

OpenAI29 passages

Appendix C: Non-attributed materials from participating companies28 passages

Appendix D: Incident database0 passages

Methodology10 passages

The action(s) the agent took deliberately against the user intent30 passages

Overreach4 passages

Deception5 passages

Grading prompt2 passages

Methodology (for context)19 passages

Incidents1 passage

INC-022: Google DeepMind - triton-cumsum16 passages

Tool call: submit1 passage

INC-023: Google DeepMind - nanogpt-chat-rl40 passages

INC-025: Google DeepMind - blackbox21 passages

INC-026: OpenAI - rust-codecontests8 passages

INC-027: OpenAI - blackbox10 passages

I've recovered the hidden function directly from the server runtime: it is…2 passages

INC-028: OpenAI - network_routing9 passages

INC-029: OpenAI - uav_search70 passages

INC-030: OpenAI - web_hacking18 passages

FOUND 'mysecret' {'_fresh': True, '_id': 'b03643a8...', '_user_id': '2'}15 passages

INC-031: Anthropic - MirrorCode, Example 15 passages

INC-032: Anthropic - MirrorCode, Example 29 passages

Let me try 26-50 bytes to see where the 2 failures are4 passages

INC-033: Anthropic - MirrorCode, Example 36 passages

INC-034: OpenAI - MirrorCode, Example 110 passages

INC-035: OpenAI - MirrorCode, Example 23 passages

INC-036: Google DeepMind - network-routing3 passages

INC-037: Google DeepMind - hash-collision39 passages

INC-044: Anthropic - Acquiring unintended compute18 passages

All incidents0 passages

INC-001: Section 2.3.6.1.3 of the Claude Opus 4.7 System Card0 passages

INC-002: Section 2.3.6.2.3 of the Claude Opus 4.7 System Card0 passages

INC-003: Section 2.3.6.2.1 of the Claude Opus 4.7 System Card0 passages

INC-004: Section 2.3.6.2.2 of the Claude Opus 4.7 System Card0 passages

INC-005: Section 2.3.6.2.4 of the Claude Opus 4.7 System Card0 passages

INC-006: Section 6.3.2 of the Claude Opus 4.6 System Card1 passage

INC-008: Section 2.3.6.1.1 of the Claude Opus 4.7 System Card0 passages

INC-009: Section 2.3.6.1.2 of the Claude Opus 4.7 System Card5 passages

INC-015: Section 4.5.4.1 of the Claude Mythos Preview System Card0 passages

INC-016: Section 4.5.4.2 of the Claude Mythos Preview System Card5 passages

INC-0220 passages

INC-0230 passages

INC-0240 passages

INC-0250 passages

INC-0260 passages

INC-0270 passages

INC-0280 passages

INC-0290 passages

INC-0300 passages

INC-0310 passages

INC-0320 passages

INC-0330 passages

INC-0340 passages

INC-0350 passages

INC-0360 passages

INC-0374 passages

INC-0421 passage

INC-0440 passages

Appendix E: Evaluation details1 passage

Central capabilities results6 passages

Additional capabilities results8 passages

How to navigate this appendix2 passages

Time horizon0 passages

Time horizon messiness split0 passages

Analyzing the gap in time horizons on more vs less “messy” tasks0 passages

MirrorCode-Early0 passages

Evaluating model performance on well-specified software implementation tasks0 passages

Subversion Strategy Eval1 passage

No-CoT math0 passages

Evaluating models’ ability to solve math problems without using chain of thought0 passages

Monitor evasion5 passages

Note on terminology1 passage

Time horizon6 passages

Time horizon frontier lead estimation methodology7 passages · 1 marked

Take our standard time horizon plot, showing log(50% time horizon) of frontier public models, and draw a line of best fit for models released after January 1st, 2024 (chosen as a “break-point” between an older, slower trend and the current trend, in agreement with recent results from Epoch AI ). This fit has a doubling time of 105 days, and an R2 of 0.98.

Doubling time, in days, of the 50%-task-completion horizon of frontier AI models released from 2024 onward on METR's software task suiteUnassessed

Not yet read by this claim’s Steward.

Cheating detection1 passage

Time horizon messiness split18 passages

Methodology3 passages

Tasks12 passages

Reward Hacking2 passages

Agent Scaffolding3 passages

Contamination3 passages

Results18 passages

Subversion Strategy Eval5 passages

Description of environments in SSE1 passage

Upfront Audit1 passage

Trusted Monitoring1 passage

APPS Untrusted Monitoring5 passages

Hard APPS Untrusted Monitoring1 passage

APPS Input Collusion1 passage

Input Collusion1 passage

No-CoT math4 passages

Monitor evasion5 passages

Hidden reasoning results4 passages

No-reasoning and visible reasoning results9 passages

Reasoning gap7 passages

Math reasoning gap3 passages

Problem: {problem}8 passages

Subversion Strategy Eval (SSE) reasoning gap10 passages

SHUSHCAST reasoning gap8 passages

APPS backdoors reasoning gap6 passages

Qualitative evaluation results0 passages

Summary of qualitative evaluation results11 passages

Manually scored tasks summary7 passages

ARC-AGI-3 summary1 passage

Red-teaming tasks summary12 passages

Table E.7: Performance of Opus 4.6 on our red-teaming tasks6 passages

Subversion Strategy Eval qualitative results summary2 passages

Monitor evasion qualitative results summary2 passages

Manually scored tasks0 passages

MS1: Improve data pipeline tooling0 passages

Task2 passages

Results4 passages

MS2: runc0 passages

Task1 passage

Results1 passage

MS3: impress_me5 passages

MS4: Autonomous replication and adaptation threat modeling0 passages

Task1 passage

Results13 passages

MS5: Make MirrorCode0 passages

Task1 passage

Results9 passages

MS6: Sunlight0 passages

Task6 passages

Methodology notes5 passages

Results on a shared model0 passages

Overview16 passages

Creating measurements of progress9 passages

Strategic choices / big picture prioritization14 passages

Using large budgets4 passages

Tendency to oversimplify or avoid hard parts of the task19 passages

Verifying claims5 passages

Extra notes on rigs3 passages

Figure E.29: The agent’s rig explorer3 passages

Figure E.30: The human rig explorer1 passage

ARC-AGI-32 passages

AA1: Opus 4.6 - wa307 passages

AA2: wa302 passages

1. Give myself full tool access (bash, python, etc.)0 passages

2. Automatically include game frame images after each tool execution0 passages

3. Manage context by pruning old frame images27 passages

Let me RESET and let purple work autonomously without interrupting23 passages

Red-teaming tasks7 passages

Table E.9: Description of our red-teaming tasks1 passage

Context on METR infrastructure3 passages

RT1: Opus 4.6 - hack_score8 passages

The bash tool receives a string: `'echo TOOLS_FIXED_TEST && date && whoami'`0 passages

The framework then calls: `sandbox.exec(["bash", "-c", "'echo TOOLS_FIXED_TEST && date && whoami'"])`191 passages

RT2: Opus 4.6 - open_pr10 passages

RT3: Opus 4.6 - container_escape2 passages

Access Kubernetes API server with service account token0 passages

Try cloud metadata endpoints0 passages

DNS-based service discovery1 passage

Check what tools and capabilities are available15 passages

RT4: hack_score11 passages

Assemble shellcode that exec's our hijack JavaScript17 passages

RT5: open_pr19 passages

RT6: container_escape11 passages

Subversion Strategy Eval qualitative results0 passages

SS1: Opus 4.6 Data Poisoning9 passages

SS2: Opus 4.6 reasoning in output21 passages

Final answer: B1 passage

SS3: Data Poisoning8 passages

SS4: APPS Input Collusion2 passages

SS5: Hard APPS Untrusted Monitoring8 passages

SS6: Hard APPS Untrusted Monitoring15 passages

Monitor evasion qualitative results0 passages

ME1: Opus 4.6 - Linux exploit tool with no CoT17 passages

ME2: Opus 4.6 - Ten queens8 passages

ME3: Gemini 3.1 Pro - Ten queens19 passages

ME4: GPT-5.2 - Tarballing home directory with no CoT7 passages

ME5: GPT-5.2 - Ten queens with no CoT17 passages

ME6: GPT-5.4 - Covertly tarballing a home directory22 passages

ME7: GPT-5.4 - Covertly installing a Linux exploit tool17 passages

Decoding the base64 string reveals: `https://github.com/AlessandroZ/BeRoot.git`4 passages

ME8: GPT-5.4 - Ten queens16 passages

ME9: Opus 4.6 - APPS backdoors 316427 passages

ME10: Gemini 3.1 Pro - APPS backdoors 140134 passages

ME11: Gemini 3.1 Pro - APPS backdoors 295732 passages

ME12: Gemini 3.1 Pro - APPS backdoors 281127 passages

ME13: GPT-5.4 - APPS backdoors 76724 passages

ME14: GPT-5.4 - APPS backdoors 128322 passages

ME15: GPT-5.4 - APPS backdoors 207516 passages

Model anecdotes2 passages

Summary of model anecdotes0 passages

Nonstandard language summary1 passage

Eval awareness summary2 passages

Ethical deliberation and refusals summary2 passages

Early submission summary1 passage

Situational unawareness summary2 passages

Nonstandard language1 passage

NLA1: Anthropic - Cyrillic character substitution21 passages

NLA2: Anthropic - Garbled reasoning8 passages

NLA3: Anthropic - Terminology substitution10 passages

NLA4: Anthropic - Exclamatory false starts4 passages

Actually, I want to sanity-check one thing. [...]15 passages

NLG1: Google DeepMind - Repetitive outputs 14 passages

NLG2: Google DeepMind - Repetitive outputs 24 passages

OpenAI - Language swapping1 passage

NLO1: Example 12 passages

NLO2: Example 22 passages

NLO3: Example 316 passages

Eval awareness1 passage

EAA1: Anthropic - Considering whether task is safety evaluation7 passages

EAA2: Anthropic - Speculation about METR task scoring2 passages

Tool call: bash8 passages

Google DeepMind - Time horizon1 passage

EAG1: continue-pattern5 passages

EAG2: hash-collision17 passages

EAG5: Google DeepMind - esolang2 passages

EAO1: OpenAI - Reasoning about evaluations being from METR2 passages

EAO2: OpenAI - Reasoning about tasks being an alignment evaluation5 passages

Historically these tasks evaluate "scheming" and aligned models should not11 passages

Ethical deliberation and refusals1 passage

EDG1: Google DeepMind - Safety prompt deliberation, sql-injection5 passages

EDG2: Google DeepMind - Safety prompt deliberation, sparse-adversarial-perturbations6 passages

EDO1: OpenAI - anti_bot_site11 passages

EDO2: OpenAI - automatic_jailbreak61 passages

Early submission0 passages

Google DeepMind - MirrorCode1 passage

ESG1: Example 14 passages

ESG2: Example 24 passages

ESG3: Example 34 passages

Situational unawareness1 passage

Google DeepMind - Advisor confusion1 passage

SUG1: Example 119 passages

SUG2: Example 29 passages

Monitor evasion prompts1 passage

SHUSHCAST19 passages

Hidden Task: {side_task}23 passages

APPS Backdoors57 passages

Appendix F: External evidence1 passage

Summary5 passages

Transcripts and quotes0 passages

MM12 passages

Resources16 passages

Open to Bids12 passages

MM22 passages

Category A: Weaponizing The Capabilities You Already Proven9 passages

MM32 passages

MM41 passage

None of the agents claimed to make money0 passages

Results from February-April AI use survey1 passage

Permissions and review14 passages

Harmful actions taken by agents1 passage

HA11 passage

HA21 passage

HA31 passage

HA41 passage

HA51 passage

HA62 passages

Appendix A provides significantly more details on this process. ↩0 passages

These evaluations are extensively documented in Appendix E . ↩30 passages

One example is the “Restricted architecture MLM” task in RE-bench . ↩35 passages

Potentially including just pressure on outputs . ↩1 passage

Alignment Risk Update: Claude Mythos Preview , section 5.5.1.2. ↩10 passages

Section 4.5.4.1 of the Claude Mythos Preview System Card . ↩6 passages

A member of the technical staff at Anthropic. ↩8 passages

Cite2 passages

Subscribe0 passages

Want to contribute to this work? METR is hiring: View open roles0 passages

Featured research1 passage

Measuring the Self-Reported Impact of Early-2026 AI on Technical Worker Productivity1 passage

Lineage across 1 claim

Draws on · none recorded

This source

Frontier Risk Report (February to March 2026)

in 1 claim's map

Drawn on by · none recorded

Record

Kind: unknown
Authors: Not recorded
Publisher: METR Blog
Published: May 19, 2026
DOI: None
Link: https://metr.org/blog/2026-05-19-frontier-risk-report/
Archived copy: None found
Stored text: 592,682 characters, retrieved Nov 1, 2026 · 402 sections, 2633 passages
Claims extracted: Not recorded
Versions: One known
Copies: None recorded
Corrections: None recorded
Facts checked: Nov 1, 2026

History 3

Nov 1, 2026DividedSegmenter · Divided into 3038 parts by its own structure
Nov 1, 2026FactsFacts fetcher · Facts looked up
Nov 1, 2026Entered the graphEntered the graph; copy stored