FRONTIER DESIGN

OLYMPUS opened an institutional file on Frontier Design because it is the outside party behind the experiment Anthropic leans on hardest when it asks whether a model can stand in for a world-leading biologist, and its own website names none of the labs as its clients. Anthropic’s Fable 5 and Mythos 5 card calls “the Frontier Design beneficial red-teaming tabletop exercise” the source of “the strongest CB-2 signal of any single evaluation” (Anthropic, Fable 5 and Mythos 5, 9 Jun 2026), and Meta’s Muse Spark report lists it among the consultants on its chemical and biological evaluations (Meta, Muse Spark Safety and Preparedness Report, 26 May 2026). This is not a psychometric profile, since an institution has no Dark Triad. It is a mandate, a team page, a lab-document trail and a voice, and the finding is the shape of the arrangement: a small professional-services firm that also does leadership coaching and philanthropy evaluation designs the human trials the labs cite for their most serious threshold calls.

Evaluator record: the engagements, the terms each document states, the findings quoted and what followed.

Institutional Archetype

THE TABLETOP BEHIND THE CB-2 CALL — Frontier’s own description of the work: “As part of Frontier’s commitment to responsible AI development, we regularly conduct structured red team exercises that bring together diverse experts in chemistry, biology, counter-terrorism, and operational security” (Frontier Design, AI Red Teaming). Anthropic’s description of the exercise it ran with the firm: “a beneficial red teaming tabletop exercise with Frontier Design Group (FDG), pairing PhD biologists with LLM experts” (Anthropic, Fable 5.1 and Mythos 5.1, 1 Sep 2026). Unlike SecureBio and Gryphon Scientific, which build question sets and tasks, Frontier supplies teams of people and the room they work in; unlike Faculty, which tests models for several labs under its own name, it is named by two labs and describes its lab clients, on its own pages, only as “a leading global tech company” and “global technology companies.”

Mandate & Origin

Frontier Design Group LLC describes itself as “a trusted firm with global reach” that grew “from a small team in our founder’s basement,” and says “For over a decade, Frontier has proven that with the right people, skills and heart, it’s possible to challenge the status quo and change it for the better” (Frontier Design, Who We Are). Its mission line: “To inspire and deliver game-changing impact by helping leaders advance the missions that matter—scaling their impact, responsibly leveraging new technology, and strengthening their workforce.” It has three service lines: Impact, Learning and Leadership Development, and Responsible AI. The Responsible AI practice began, by its account, in 2024: “In 2024, Frontier recognized the need to develop a secure platform to conduct red-teaming and uplift studies of large language models (LLMs) at scale and with incredible speed” (Frontier Design, Secure Red-Teaming Playground).

Legal entity. The site’s footer: “© 2026 Frontier Design Group LLC,” with “Alexandria, VA” as its location, and the abbreviation FDG in its contact domain; a December 2025 paper lists “Frontier Design Group, LLC” as the affiliation of three of its authors (Frontier Design, Contact; arXiv:2512.08451). Anthropic’s Fable 5.1 card calls it “Frontier Design Group (FDG).”

Who runs it. The team page lists Alexa Courtney, “Founder + CEO,” who “has lived and worked in conflict-affected regions across South Asia, Africa, and Eastern Europe, advising senior leaders in government, finance, humanitarian, and national security institutions”; Wendy Reid, “Chief of Operations + Growth,” an attorney by training who “has led enterprise operations, risk, and growth across technical services and consulting organizations serving the U.S. government”; and Anthony Nyström, “Chief Technology Officer” (Frontier Design, Our People). A named Frontier advisor on its case study page is “Dr. John Fischer | Former Director of Chemical-Biological Defense Division, DHS | Senior Executive Service (retired)” (Frontier Design, Thinking Like the Enemy). Olivia Shoemaker, who gives the firm’s talks on red teaming, is a co-author of the December 2025 benchmark paper with two other Frontier authors, Sheriff Almakki and Noah Sheinbaum (arXiv:2512.08451).

Funding & Backers

The firm’s pages name no investor, no funding round and no amount. It is a limited liability company; ownership is not stated. Its revenue is described by line of work: for the AI practice, “Partnering with a leading global tech company, Frontier developed a state-of-the-art evaluation system to monitor performance of their generative AI products,” and “For global technology companies, Frontier leads the industry’s largest human red-teaming evaluations, assessing national security risks and implications of large language models” (Frontier Design, Frontier AI). Its other named clients are The Carter Center, whose partnership “led the Center to invite Frontier back in 2026 to guide development of its next five-year plan,” The UPS Foundation, for which it built a monitoring, evaluation and learning system “over 2.5 years,” and the Truist Foundation, whose scaling report it co-authored (Frontier Design, Impact). A testimonial on its platform page: “Frontier has superagency! We’re a global firm and we thought this project was going to be impossible” (Frontier Design, Secure Red-Teaming Playground).

The AI Safety Fund engagement. Its Responsible AI page: “The AI Safety Fund engaged Frontier to design and implement a novel safety benchmark examining how large language models could elevate biological risk” (Frontier Design, Responsible AI); its case study says the fund “Brought together cooperative funding from Anthropic, Google, Microsoft, and OpenAI, as well as philanthropic partners such as the Patrick J. McGovern Foundation, the David and Lucile Packard Foundation, Schmidt Sciences, and Jaan Tallinn” (Frontier Design, Thinking Like the Enemy). The Frontier Model Forum’s own description names the developer as Nemesys Insights: “Nemesys Insights developed the Bacterial Biothreat Benchmark Generation (BBG) Framework,” with “approximately 1,000 high-quality bacterial biothreat prompts” (Frontier Model Forum); the paper that documents the benchmark lists Nemesys Insights, LLC and Frontier Design Group, LLC as the authors’ two affiliations (arXiv:2512.08451).

What the labs say they paid. No lab document states a fee. Anthropic’s Opus 5.5 card says only “we collaborated with Frontier Design to run a tabletop scenario”; Meta’s report says “This work was supported by engagements with a variety of consultants.” Frontier’s platform page lists “contracting & payment for over 3,000 participants in multiple languages” as a feature of its platform (Frontier Design, Secure Red-Teaming Playground).

Institutional Voice & Intent

The firm writes in the register of a design consultancy that has moved into AI safety. On what it sells the labs: “We combine robust model evaluation methods with global networks of subject matter experts to build safer AI models, accelerate models’ capabilities, and effectively integrate AI into teams” (Frontier Design, Our Services). On its method: “Unlike traditional biorisk tests that only evaluate scientific knowledge, our benchmark incorporates insights from the FBI, DHS, and creative visionaries (including sci-fi novelists and former Disney Imagineers) to simulate how threat actors actually think” (Frontier Design, Thinking Like the Enemy). On its expert pool: “Frontier’s vetted subject matter expert network now exceeds 1,000 scientists, operators, and creative practitioners, spanning technical biology, biosecurity and CBRN, AI, cyber, autonomy, and trust and safety across 380+ languages” (Frontier Design, Responsible AI).

• On the lab’s role. Of the founder’s remarks on Capitol Hill, the firm’s summary: “She highlights the importance of frontier AI labs setting the bar for responsible development, and the value of partnership with government and researchers to support trust, readiness, and innovation” (Frontier Design, Responsible AI).
• On what its exercises find, in Anthropic’s card. “FDG’s interpretation, which we share, is that generalists largely overcome the expertise gap in this scenario–however, specialists retain a modest edge due to their ability to spot minor technical nuances and direct alternatives” (Anthropic, Fable 5.1 and Mythos 5.1).

Stated intent: “To inspire and deliver game-changing impact for the missions that matter most in the world”; for AI, “Systematic Evaluation = Safer AI.”

Observed intent: Run the human trials that frontier labs cite for their highest-stakes capability calls, leave its lab clients unnamed on its own pages, and fold that work into a professional-services firm whose other revenue is foundations, a university and an agency.

Gap: The record shows what the two labs print and what the firm says about itself. It does not show which labs commissioned the exercises, what they paid, what the firm may publish, or whether the firm decided what Anthropic would describe. Anthropic’s cards say what was done and what the graders found; Frontier’s pages say what it is able to do. The documents settle what was tested. They do not settle the commercial terms.

Interest: Frontier argues its positions on its own pages; it lodges none with a legislature, so what adoption “would pay” is read off its services list.

• Uplift studies with mixed expert and operational teams are the right test of a model’s biological risk. Position: “scientific assessments alone miss real-world AI risks,” pairing “scientific and operational expertise, like counterterrorism and creative thinkers” (Frontier Design, Responsible AI). What it pays: a release standard that counts human uplift trials as required evidence is demand for the platform and expert network it lists, which its page says ran “600+ participant studies in under three weeks.” Best case, Frontier’s and Anthropic’s: Anthropic’s card says the exercise “produced the strongest CB-2 signal of any single evaluation” and that “The expert graders estimated that the output from the two-person teams in this exercise over the course of 2 days was representative of 40–95 working days of work” (Anthropic, Fable 5 and Mythos 5). Convergence: the other human-trial vendors in the cards, Deloitte and SecureBio, and every lab whose threshold call rests on a trial.
• Labs should set the bar and partner with government. Position: “the importance of frontier AI labs setting the bar for responsible development.” What it pays: a norm that labs, not statute, set the evaluation bar leaves the purchasers of exercises, and so the firm’s market, with the labs. Best case, the firm’s: partnership with “government and researchers” supports “trust, readiness, and innovation.” Convergence: the labs, which commission the exercises and publish the results.
• Benchmarks for bioterror risk should include how an adversary thinks. Position: the AI Safety Fund case study’s “Biorisk benchmark with 1,000+ items” and a “Framework for assessing bacterial biological risk.” What it pays: the engagement named above and the “Implementation guide to run and score the biorisk benchmark.” Best case, the firm’s own advisor: “Application of the Frontier Design approach will increase the safety of publicly available AI tools as well as algorithms in development” (Frontier Design, Thinking Like the Enemy).

Interest is a documented fact about each position, not a claim about motive, and not a verdict that the argument is wrong. Each best case is stated at the strength its author states it.

• Social accounts and feeds. LinkedIn frontier-design-group-llc, linked from imaginefrontier.com. X: none verified in this record. Feed: none; the site publishes news items on its Responsible AI and Impact pages with no feed.

Position in the Apparatus

Frontier sits in the layer of the evaluator map that runs human studies for the labs rather than machine tests: the people who attempt the task with the model and the graders who score them. It differs from Gray Swan and Trajectory Labs, which attack safeguards, in that its exercises measure what a model adds to a team’s ability to do something hard, and from Faculty, whose biological work Google DeepMind and Meta both print, in that it is named by Anthropic as the party that ran an exercise.

• Anthropic: three cards in four months. Fable 5 and Mythos 5 (9 June 2026): “the Frontier Design beneficial red-teaming tabletop exercise pairing PhD biologists with LLM experts”; the exercise “paired six PhD-level biologists with dedicated LLM experts,” and “teams with generalist biology PhDs outperformed teams with plant pathology experts (the domain of the task in question) overall,” suggesting “that access to Claude Mythos 5 could let generalist users substitute for world-leading specialist expertise on at least some tasks” (Anthropic, Fable 5 and Mythos 5). Fable 5.1 and Mythos 5.1 (1 September): “a beneficial red teaming tabletop exercise with Frontier Design Group (FDG)”; “Seven of nine participants rated completion of the task impossible without access to the model” (Anthropic, Fable 5.1). Opus 5.5 (22 September): “we collaborated with Frontier Design to run a tabletop scenario that asked teams to develop a phage therapy for Chlamydia trachomatis”; “The seven two-person teams consisted of two teams with phage experts, one team with a chlamydia expert, and four teams with experienced biologists that had neither phage nor chlamydia expertise”; “8 of 14 participants reported that completion of the task within 16 hours would have been impossible without access to the model” (Anthropic, Opus 5.5).
• Meta, Muse Spark (26 May 2026). “This work was supported by engagements with a variety of consultants who have decades of experience in biodefense and biosecurity, including workflows for threat modeling, experimental design and testing, and the interpretation and validation of evaluation results. Those engaged in this process included Deloitte, Faculty, Frontier Design, and SecureBio” (Meta).
• What the exercise’s limits were, in Anthropic’s words. For Opus 5.5: “Two of the seven red-team groups also reported some challenges dealing with model refusals, which consumed time from those teams’ sixteen hour allocation,” and “these concerns do modestly reduce our level of confidence in this assessment” (Anthropic, Opus 5.5).
• Not named elsewhere. Anthropic’s Opus 5, Sonnet 5.5 and Haiku 5.5 cards, Google DeepMind’s Gemini 4 Argon report, OpenAI’s GPT-5.5, GPT-5.6, GPT-6 Astra and GPT-6.1 Sol pages and xAI’s Grok 4.6 and 4.7 cards do not name Frontier Design; neither do Anthropic’s Opus 4.6, Mythos Preview and Opus 4.8 cards.

Actions & Leadership Choices

CONDUCT: NO CONDUCT ISSUE ON THE RECORD — NAMES NO CLIENT LAB ON ITS OWN PAGES; THE LABS NAME IT. No wrongdoing is alleged. The documented facts: the firm runs biology uplift exercises for at least two labs, publishes an AI Safety Fund benchmark paper with Nemesys Insights, describes its lab work as for “a leading global tech company,” and is named by Anthropic and Meta, in Anthropic’s case for an exercise that fed a CB-2 threshold assessment.

What it did in 2025 and 2026. It listed a paper, “Measuring Biosecurity Risk Where It Actually Emerges,” subtitled “A New Benchmark Framework for Evaluating Biological Uplift in Frontier AI Models,” which “introduces a rigorous framework for generating biothreat benchmarks that measure not just information retrieval, but uplift” (Frontier Design, Responsible AI); the second of three papers in the series, on benchmark generation, abstracts a process that cut “over 7,000 potential benchmarks” to “1,010 final benchmarks” (arXiv:2512.08451, Dec 2025). It announced that its expert network “now exceeds 1,000” specialists, spoke on “Adversaries, By Design” (“Evaluating Catastrophic Bio-Weapons Risk in Large Language Models through Threat Ideation and Red Teaming”) at a Washington gathering of “scientists, policymakers and AI engineers,” and facilitated, in March 2026 with The Conduit, “a forum for philanthropic and nonprofit leaders in New York” on integrating AI into nonprofits’ operations (Frontier Design, Responsible AI; Frontier Design, Impact).

How it treats participants, by its own page. “Recent Participant Feedback”: “98% of our participants say that they would participate in another red team with Frontier” (Frontier Design, AI Red Teaming); the platform offers “Pre-configured API access to all major LLMs (200+) with built-in masking to ensure unbiased, double-blind evaluation.”

Alliance Map

These run at the same time. One small firm runs a trial for a lab’s most serious biological threshold, is a consultant on another lab’s report, builds a benchmark for a safety fund the same labs fund, advises a federal agency on adopting AI, evaluates philanthropies, and names none of its lab clients on its own site. Each tie is stated by the firm or by a lab. The overlap is the finding.

Reach Assessment

Institutional: Its exercises sit in the capability evidence of two labs’ most serious biological thresholds. Memetic: The public meets it only through Anthropic’s cards and Meta’s report; its own pages name no lab. Civilizational: A human uplift trial that a lab uses to decide whether a model can substitute for a world-leading specialist is a trial that sets what “substitute” means; if outside human trials become a required part of a release, the firm that designs them holds a seat in that decision; today it holds it by contract.

Score basis. Atk 6 is reach: three Anthropic cards and Meta’s report, and Anthropic’s own sentence that the exercise “produced the strongest CB-2 signal of any single evaluation” (Anthropic, Fable 5 and Mythos 5; Meta). It sits level with Vals AI (6/4/5, hazard 50) and Andon Labs (6/5/6, hazard 58), whose tests also appear in Anthropic’s cards, and one under Trajectory Labs (7/4/5, hazard 53), named by three labs. The points under 7 are that two labs name it, that Google DeepMind and OpenAI do not, and that no statute obliges a lab to commission it. Def 4 is funding insulation: no investor is stated, the AI work is for an unnamed technology company and an AI Safety Fund its own page says the labs fund, and the rest is foundation and agency consulting (Frontier Design, Thinking Like the Enemy); that is level with Trajectory Labs, Vals AI and Gryphon Scientific (4), one under Faculty (8/5/6, hazard 63) and 10a Labs (5/5/4, hazard 47). Hp 4 is entrenchment: a private firm over a decade old, a 1,000-person expert network and a platform built in 2024 are real capacity, but no program of record depends on it and any lab can run its next tabletop with another firm; level with 10a Labs and Dreadnode (5/5/4, hazard 47), one over Gryphon Scientific (3) and one under Trajectory Labs (5). Hazard 48 sits one over the 10a Labs and Dreadnode hazard of 47, with more reach and less insulation.

Sources: Frontier Design; Who We Are — Frontier Design; Our People — Frontier Design; Our Services — Frontier Design; Responsible AI — Frontier Design; AI Red Teaming — Frontier Design; Frontier’s Secure Red-Teaming Playground — Frontier Design; Frontier AI — Frontier Design; Thinking Like the Enemy — Frontier Design; Impact — Frontier Design; Contact — Frontier Design; Biothreat Benchmark Generation Framework for Evaluating Frontier AI Models II — arXiv:2512.08451; Latest from the FMF: Grant-Making to Address AI-Bio Risk Challenges — Frontier Model Forum; Claude Fable 5 and Mythos 5 System Card — Anthropic; Claude Fable 5.1 and Mythos 5.1 System Card — Anthropic; Claude Opus 5.5 System Card — Anthropic; Muse Spark Safety and Preparedness Report — Meta; Gemini 4 Argon safety report — Google DeepMind.