TRAJECTORY LABS

OLYMPUS opened an institutional file on Trajectory Labs because it is the red team that shows up in three labs’ release documents while saying almost nothing in public about who owns it or pays it. This is not a psychometric profile, since an institution has no Dark Triad. It is a mandate, a client list printed by other people, a team page and a careers page, and the finding is the shape of the arrangement: a company under a year old, run by the former head of engineering at METR and colleagues from the Centre for the Governance of AI, 80,000 Hours and the Future of Humanity Institute, is hired by Anthropic, Google DeepMind and Meta to attack their safeguards and shows the results on its own home page.

Institutional Archetype

THE HUMAN RED TEAM THE LABS PAY TO GRADE THEIR OWN SAFEGUARDS — Trajectory Labs describes itself as “AI evaluations · Red teaming · RL environments.” Its home page: “We connect the world’s top red teamers, researchers, and engineers to mission-critical projects at frontier AI labs” (Trajectory Labs). The labs’ documents carry the rest. Anthropic’s Opus 5.5 card says “we worked with contracted external testers to red-team Claude Opus 5.5’s safeguards,” and names Trajectory first among them (Anthropic, Opus 5.5). Unlike Gray Swan, whose benchmark and automated attacker are the product, Trajectory sells people attacking by hand, and says so: “so a low automated attack success rate isn’t much evidence that a model is safe” (Trajectory Labs). Unlike Irregular, it builds no range of its own that appears in the incident record.

Mandate & Origin

The company’s own account of its purpose, from a careers page: “Our mission is to automate AI safety, to pave the way for a future where the vast majority of AI safety work is done by AI models.” The same page dates it: “Although Trajectory is less than a year old, we have already been featured in Anthropic’s” system card (Trajectory Labs, Careers). Its home page gives a three-step mission, the first being “Create tasks, environments, and adversarial examples that expose consequential agent failures,” under the heading “Safety data needs to scale with capabilities” (Trajectory Labs). The legal name carries the form: “Trajectory Labs, PBC,” a public benefit corporation, in the page title, the footer and every lab document that names it.

Who runs it. The team page lists four people as “the founding team.” Peter McIntyre, CEO: “Raised $100M and ran operations at a startup hedge fund, former Research Scholar at the Centre for the Governance of AI, and early employee at 80,000 Hours (YC S15).” Ben West, CTO: “Former head of engineering at METR, lead author on their” time-horizons paper. Sami Jawhar, “Agent wrangler”: “Former head of engineering at METR. Serial entrepreneur and career research engineer with publications across AI safety and neuroscience, and co-founder of an enterprise cybersecurity company.” Ryan Carey, founding member of technical staff: “Former technical AI safety lead at the Future of Humanity Institute at Oxford University, with a PhD in Statistics from Oxford and research experience at Google DeepMind, OpenAI, Optiver and Millennium” (Trajectory Labs). The careers page confirms the reporting line: “Reports to: Ben West, CTO.” The arXiv record of METR’s time-horizons paper lists Ben West among its authors (arXiv:2503.14499). The GovAI and METR histories are the company’s own biographies of its staff; the profiles linked here carry those organizations.

Funding & Backers

The company’s own pages name no investor, no funding round and no amount. The home page, the team page and the careers pages say nothing about who owns it. Its benefits list includes “Equity donation matching,” which implies equity-holding staff and is the only ownership signal on the pages. Its customers are the labs: the home page shows lab logos under “Trusted by leading labs” and lists the documents that name it (Trajectory Labs).

The labs as customers. Anthropic’s wording is a purchase: “we worked with contracted external testers,” and, for the Claude Code evaluation, “We commissioned an evaluation from a third party, Trajectory Labs, who tested different models within the latest publicly available versions of Claude Code and Codex as of July 17th 2026” (Anthropic, Opus 5.5; Anthropic, Auto mode). Google DeepMind’s report: “we partnered with external red-teaming organizations including Gray Swan and Trajectory Labs.” Meta’s report: “in partnership with Trajectory Labs, we developed the complex subset” of its Search-PI benchmark (Google DeepMind; Meta). No document read states a price or a contract value.

Institutional Voice & Intent

The company writes in the register of a lab that measures and sells the result. From its home page: “Our expert red teamers continue to find new vulnerabilities in every frontier model we’ve tested and are relied on by frontier labs to keep their models safe.” On automation: “Automated systems can test known attacks well, but struggle to discover new ones, so a low automated attack success rate isn’t much evidence that a model is safe” (Trajectory Labs).

• On what it did in Anthropic’s cards, its own words: “We were the only commercial red team to jailbreak Opus 5.5’s cyber safeguards, succeeding 13 times across seven tasks,” and “We were the only external team to get working exploits while red teaming Fable 5.1’s cyber safeguards” (same page).
• On the cards themselves, Anthropic’s wording for Fable 5.1: “They did not obtain a working end-to-end exploit in any task using Fable 5.1 alone, and did not find any universal jailbreak,” and “In the remaining four, an exploit was ultimately obtained only with the help of a less capable model” (Anthropic, Fable 5.1). The two descriptions are of the same sessions. The company states the outcome the red team produced; the lab states the conditions and what its policy permits.
• On Opus 5.5, the card: “They reported 13 candidate breaks across seven tasks but did not find any universal jailbreak” (Anthropic, Opus 5.5).

Stated intent: Make the labs’ safeguards fail in a controlled setting and train the failures out: “Our mission is to automate AI safety.”

Observed intent: Be the outside team whose name appears in the card, sell that appearance to the next lab, and build RL environments and evaluations that labs buy. The company’s home page puts a featured evaluation of coding agents beside the lab logos and invites the reader to “Email the founders.”

Gap: The record shows a company that reports unflattering findings about the labs that hire it (13 candidate breaks, one working exploit chain built from over 100 contexts) and that the labs print them with their own qualifications. It does not show who else pays Trajectory, whether the labs’ payments are its main revenue, or what the engagement terms say about publication. The documents settle what was tested and what was found. They do not settle the commercial terms.

Interest: Trajectory states two positions on its own pages. It lodges neither with a legislature nor argues either as law, so what adoption “would pay” is read off its product and its job page.

• Human expert red teaming is necessary evidence, because automated testing misses novel attacks. Position: “Automated systems can test known attacks well, but struggle to discover new ones, so a low automated attack success rate isn’t much evidence that a model is safe” (Trajectory Labs). What it pays: a release standard that counts expert human red teaming as a requirement favors the firm whose product is expert human red teamers, hired on contract through a paid work test (Trajectory Labs, Careers). Best case, Trajectory’s: its Claude Code evaluation used held-out attacks, and Anthropic’s post says “The attacks were optimized against Claude Opus 4.7, which is not in the reported set, so every model in the evaluation faced them as unseen attacks” (Anthropic, Auto mode); and in Opus 5.5’s card the automated attacker found nothing where the human team found 13 candidate breaks: “Across every task set, Gray Swan’s state judge recorded no breaks, and no attempt produced a violation.” Convergence: the labs, whose cards cite more testers as more evidence, and the other contract testers; Gray Swan sells an automated attacker, Shade, beside its human Arena, and 10a Labs runs both manual conversations and an automated attacker in the same cards.
• Safety data and environments should be produced at scale and used in training. Position: “Safety data needs to scale with capabilities,” with the steps “Create tasks, environments, and adversarial examples that expose consequential agent failures” and train models on them (Trajectory Labs). What it pays: demand for tasks, environments and red-team transcripts is the product its open evaluation and safety roles and its RL-environment line sell. Best case, Trajectory’s: models that “can be hijacked by a malicious email or web page” cannot be trusted to work on their own, so the failures have to be found and trained out (Trajectory Labs, Careers). Convergence: every lab that trains on red-team output, and the evaluators that sell environments, Dreadnode among them.

Interest is a documented fact about each position, not a claim about motive, and not a verdict that the argument is wrong. Each best case is stated at the strength its author states it.

Position in the Apparatus

Trajectory sits in the layer of the evaluator map that works inside a lab’s release process: its findings are printed in the documents that explain why a model shipped. It differs from METR, which “has not accepted funding from AI companies,” and from Apollo Research in that it is a commercial firm and says so.

• Anthropic: four cards in four months. Fable 5 and Mythos 5 (June 2026): “Trajectory Labs, PBC found a single jailbreak strategy that enabled them to use Opus 4.8 with Fable safeguards to exploit a vulnerability in Firefox.” Opus 5 (July): “Trajectory Labs, PBC spent roughly 100 hours red-teaming our safeguards,” and “They did not find any new universal jailbreak strategies.” Fable 5.1 (September): “Trajectory Labs, PBC spent roughly 74 hours red teaming Fable 5.1, sending over 6,500 requests against sandboxed tasks that each require reproducing an exploit for a publicly documented vulnerability,” with “11 candidate breaks across four tasks.” Opus 5.5 (September): “Trajectory Labs, PBC spent roughly 95 hours red teaming Claude Opus 5.5, sending over 29,000 requests against sandboxed tasks that each require reproducing an exploit for a publicly documented vulnerability,” and for one task “the work was decomposed over 100 separate contexts and no single conversation named the overall objective” (Anthropic, Fable 5 and Mythos 5; Anthropic, Opus 5; Anthropic, Fable 5.1; Anthropic, Opus 5.5). The months are the company’s own dating of the documents on its home page.
• Google DeepMind. The Gemini 4 Argon report has a section headed “Trajectory labs”: “We partnered with Trajectory Labs to conduct manual red-teaming of our safeguarded cyber endpoints across nine attack technique families,” and “Trajectory Labs reported 12 successful breaks with no new universal jailbreaks found that generalized across tasks within this timeframe” (Google DeepMind).
• Meta. For Muse Spark, “Trajectory Labs pre-generated the prompt injections with their proprietary attacker and we used those as a static set,” 30 benign and malicious task pairs with the remainder held out (Meta).
• Grading a lab’s rival on the lab’s commission. The Claude Code post: “Both Codex and Claude Code were evaluated using an identical browser integration produced by Trajectory Labs, PBC,” and “none of the 720 attack attempts succeeded against Claude Fable 5, Opus 5, or Sonnet 5 running auto mode” (Anthropic, Auto mode). Trajectory’s home page reproduces the chart with Anthropic’s post as the source. The measuring tool, the commission and the comparison to OpenAI’s Codex all came from or through Anthropic’s order.
• Not named elsewhere. OpenAI’s GPT-6 Astra, GPT-5.6 and GPT-6.1 Sol deployment-safety pages do not name it (OpenAI; OpenAI; OpenAI).

Actions & Leadership Choices

CONDUCT: NO CONDUCT ISSUE ON THE RECORD — PAID BY THE LABS IT GRADES, FUNDING UNDISCLOSED, STAFF DRAWN FROM THE EVALUATION MOVEMENT. No wrongdoing is alleged. The documented facts: the company is under a year old, is hired and commissioned by labs whose safeguards it grades, names no investor, and staffs itself from METR, the Centre for the Governance of AI, 80,000 Hours and the Future of Humanity Institute.

What it did in 2026. It appears in Anthropic’s June, July and two September cards, in Meta’s May report and in Google’s October report; it was commissioned for Anthropic’s Claude Code and Codex comparison, run on 17 July; and it is hiring: seven open roles including “Head of Evals,” “Evals Lead, AI Red Teaming” and “Tech Lead, AI Safety,” at “Berkeley, CA / Remote” (Trajectory Labs). Its application process has candidates “Sign a confidentiality agreement” and complete a paid work test (Trajectory Labs, Careers).

Alliance Map

These run at the same time. One company under a year old is hired by three labs to attack their safeguards, is commissioned by one of them to compare its product to a rival’s, is run by people from the organizations that grade the same labs’ models, works from Constellation in Berkeley, and discloses no investor. Each tie is stated by the company or by a lab. The overlap is the finding.

Reach Assessment

Institutional: Pre-ship adversarial testing for labs, by their own documents, with no statute behind it. Memetic: Its results enter public view only through the labs’ cards and its own home page, which advertises that it was “the only commercial red team to jailbreak Opus 5.5’s cyber safeguards.” Civilizational: If outside human red teams become a required part of a release, a company that already holds the commission with three labs holds a position in the decision; today it holds it only by contract.

Score basis. Atk 7 is reach: Anthropic’s Claude Opus 5, Fable 5 and Mythos 5, Fable 5.1 and Opus 5.5 cards each report its red teaming, Google DeepMind’s report gives it a section, and Meta’s report built a benchmark set with it (Anthropic, Opus 5.5; Google DeepMind; Meta). It sits one under Gray Swan (8/6/7, hazard 76) and Irregular (8/6/7, hazard 80), whose tests are also printed by OpenAI and whose benchmark or ranges are reused across labs, and one over HiddenLayer (6/4/5, hazard 50) and Dreadnode (5/5/4, hazard 47), whose work no lab release document read names. The points under 8 are that OpenAI’s pages do not name it, that no statute obliges a lab to ask, and that its output is findings, not a benchmark others run. Def 4 is funding insulation: Anthropic’s card says “contracted external testers” and its post says “commissioned,” its site names no investor, so part of its money comes from labs it grades and the rest is undisclosed (Anthropic, Auto mode). That is level with HiddenLayer and Humane Intelligence (4), one under Dreadnode (5) and two under Gray Swan (6), whose release itemizes investors and none is a lab. Hp 5 is entrenchment: four Anthropic cards, a Google report and a Meta report in about five months and seven open roles are an installed position, but the company is “less than a year old,” lists four people, and any lab can end a contract (Trajectory Labs, Careers). That is level with HiddenLayer (5), one over Dreadnode (4) and two under Gray Swan (7). Hazard 53 follows from 7/4/5 at the house formula, three points over HiddenLayer’s 50 for the extra point of reach.

Sources: Trajectory Labs, PBC; Careers: AI Cyber Red Teamer — Trajectory Labs; Claude Opus 5.5 System Card — Anthropic; Claude Opus 5 System Card — Anthropic; Claude Fable 5.1 and Mythos 5.1 System Card — Anthropic; Claude Fable 5 and Mythos 5 System Card — Anthropic; Auto mode is now the default in Claude Code — Anthropic; Gemini 4 Argon safety report — Google DeepMind; Muse Spark Safety and Preparedness Report — Meta; Measuring AI Ability to Complete Long Software Tasks — arXiv:2503.14499; GPT-6 Astra — OpenAI; GPT-5.6 — OpenAI; GPT-6.1 Sol — OpenAI; Announcing Trajectory Labs, a Toronto AI safety office — EA Forum.