UK AISI
UK AI Security Institute. What it was engaged to test, on what terms, what it found in the document's own words, and what happened afterwards. Every line is a record; every record links to the document it was read from.
▣ THE RECORD
government
Government institutes
STORE 2026-10-23
- FoundedNov 2023
- HQnot stated
- Registry idnone (public body)
- TestsPre-deployment testing.
- Money, as the roster puts itUK government.
- Filesdossier · observatory, sliced to it · graph
- Labs tested
- OpenAI Anthropic Google DeepMind Microsoft
- Models
- Claude Opus 4Fable 5 / Mythos 5Fable 5.1 / Mythos 5.1GPT-5.5GPT-5.6GPT-6 AstraGemini 4 ArgonHaiku 5.5Mythos PreviewOpus 4.6Opus 4.8Opus 5Opus 5.5Sonnet 5.5
- Span of engagements
- May 2025 – 7 October 2026
- Terms and findings
- 9 of 15 documents state a term · 6 quote a finding
- Money in, US dollars, stated single-recipient rows
- no stated figure 2 in · 3 outfrom AWS · Anthropic · Microsoft · OpenAI · Schmidt Sciences
- Seats, by side
- government 6 between 3 10 people: Buck Shlegeris, Geoffrey Irving, Ian Hogarth, J.J. Allaire, Jade Leung, Joseph Bloom, Kai Fronsdal, Paul Christiano …
- Afterwards
- incident 4 contradiction 1
Each count is the number of store records that name this evaluator. An engagement is one lab document naming it for one model; an outcome is an event on the record afterwards; the money, seats and moves are the observatory's rows filtered to it. A cell that cannot be filled says not stated, and each table ends with how many of its rows state each field.
▣ SLICE
38 / 38 records
Filters combine: any of the values ticked within a dimension, all of the dimensions at once. A table that has no column for a dimension you have set says so instead of showing rows that cannot match. The address bar carries the slice.
SLICE
edit ↑
What it was engaged to test 15 engagements, OpenAI, Anthropic, Google DeepMind, Microsoft
In date order, each from the lab document that names the evaluator. Under each: the four terms that document states (access, model stage, publication, payment) and the finding in its words. A term the document is silent on reads not stated; the tags beside the terms are read off their words and are what the console filters on.
- Document: Claude Opus 4 and Sonnet 4 system card
- Access windownot stated
- Model stage"joint pre-deployment testing of the new Claude Opus 4 model was conducted by the US AI Safety Institute (US AISI) and the UK AI Security Institute (UK AISI)"
- Publication"These organizations will also receive a minimally redacted copy of the capabilities report"
- Paymentnot stated
Finding: not stated in the document
- Document: Claude Opus 4.6 system card
- Access windownot stated
- Model stage"UK AISI tested an early snapshot of [Claude Opus 4.6] for specific behaviours relevant to misalignment risk"
- Publication"These organizations will also receive a minimally redacted copy of the capabilities report"
- Paymentnot stated
Finding: not stated in the document
Sources: Claude Opus 4.6 system card 64f61f4df4 - Document: Claude Mythos Preview system card
- Access windownot stated
- Model stagenot stated
- Publicationnot stated
- Paymentnot stated
Finding: not stated in the document
- Document: GPT-5.5 system card
- Access windownot stated
- Model stage"UK AISI was provided access to a representative launch checkpoint and a checkpoint with reduced refusals for cyber capabilities"
- Publicationnot stated
- Paymentnot stated
Finding, in the document's words"UK AISI judges that GPT-5.5 is the strongest performing model overall on their narrow cyber tasks, though its performance is within the margin of error"; on the safeguards, "UK AISI tested GPT-5.5's cyber safeguards and identified a universal jailbreak that elicited violative content across all malicious cyber queries OpenAI provided"
Sources: GPT-5.5 system card 9f907dcdc7 - Document: Claude Opus 4.8 system card
- Access windownot stated
- Model stage"we shared a pre-release snapshot of Claude Opus 4.8 with UK AISI for open-ended testing, at their discretion, of behaviors or risk factors related to misalignment"
- Publicationnot stated
- Paymentnot stated
Finding, in the document's words"Meridian and the UK AISI find only one clear instance of substantially concerning high-stakes behavior related to compromising AI safety measures--the focus of their review--and that instance involved following instructions to participate in bad behavior that were initiated by another AI system, rather than doing so at its own initiative"
Sources: Claude Opus 4.8 system card 8619ce6962 - Document: Claude Fable 5 and Mythos 5 system card
- Access windownot stated
- Model stage"UK AISI was given access to early checkpoints of [Claude Mythos 5] to assess its cybersecurity and autonomy capabilities"; "UK AISI was given access to a pre-release checkpoint of [Claude Mythos 5] to test for behaviors relevant to misalignment risk"
- Publicationnot stated
- Paymentnot stated
Finding, in the document's words"[Claude Mythos 5] performed similarly to Mythos Preview on our cyber evaluations"; "[Claude Mythos 5] does not compromise safety research in our unprompted evaluations"
- Document: GPT-5.6 system card
- Access windowFor the safeguards rounds, "UK AISI was provided with extensive grey box access: access to chain-of-thought of the safety reasoning monitor, exact policy wording, and real-time feedback on classifier labels that would not be accessible to real-world attackers"
- Model stagenot stated
- Publicationnot stated
- Paymentnot stated
Finding, in the document's words"UK AISI found that GPT-5.6 Sol performed more strongly than GPT-5.5"; "In all rounds thus far, UK AISI identified universal jailbreaks in the cyber domain, including jailbreaks that allowed for long-form agentic task completion in domains like vulnerability discovery and exploit development"
Sources: GPT-5.6 system card a6fb7f76b0 - Document: Claude Opus 5 system card
- Access windownot stated
- Model stage"We shared an earlier snapshot of Claude Opus 5 with the UK AI Security Institute (UK AISI) for open-ended testing, at their discretion, of cyber capabilities"; "We evaluated without any external safety classifiers present"
- Publicationnot stated
- Paymentnot stated
Finding, in the document's words"Opus 5 performed similarly to Mythos 5 and Mythos Preview on our cyber evaluations"; "Opus 5 does not compromise safety research in our unprompted evaluations"
Sources: Claude Opus 5 system card 53b07d3763 - Document: GPT-6 Astra system card
- Access windownot stated
- Model stagenot stated
- Publicationnot stated
- Paymentnot stated
Finding, in the document's words"When tasked with solving difficult simulated cybersecurity challenges, Astra performed a range of malicious actions including conducting supply chain attacks against open source providers (all actions performed in simulated environments, so no real-world harm was caused)"
Sources: GPT-6 Astra system card 27a43200cf - Access windownot stated
- Model stagenot stated
- Publicationnot stated
- Paymentnot stated
Finding: not stated in the document
- Document: Responsible AI Transparency Report 2026 Collaboration Agreement
- Access windownot stated
- Model stagenot stated
- Publicationnot stated
- Paymentnot stated
Finding: not stated in the document
- Document: Claude Opus 5.5 system card
- Access windownot stated
- Model stagenot stated
- Publicationnot stated
- Paymentnot stated
Finding: not stated in the document
Sources: Claude Opus 5.5 system card 7dfa334fdb - Document: Claude Sonnet 5.5 system card
- Access windownot stated
- Model stagenot stated
- Publicationnot stated
- Paymentnot stated
Finding: not stated in the document
Sources: Claude Sonnet 5.5 system card 12b32827af - Access windownot stated
- Model stage"AISI conducted evaluations of Gemini 4 Argon, having been given both a version of the model without our full set of safety mitigations and a version which had mitigations applied"
- Publicationnot stated
- Paymentnot stated
Finding: not stated in the document
- Document: Claude Haiku 5.5 system card
- Access windownot stated
- Model stagenot stated
- Publicationnot stated
- Paymentnot stated
Finding: not stated in the document
Sources: Claude Haiku 5.5 system card 703f00f09e
Dated 15 of 15Model named 14 of 15Terms stated 9 of 15Finding quoted 6 of 15
The terms, as the documents state them
The same engagements as a grid, one row per document and model, so the silences line up: a document that gives an access window but no payment term, or a finding but no publication term, reads that way here.
| Document | Model | Access window | Model stage | Publication | Payment | Finding | Record |
|---|---|---|---|---|---|---|---|
| Claude Opus 4 and Sonnet 4 system cardAnthropic · May 2025 | Claude Opus 4 | not stated | "joint pre-deployment testing of the new Claude Opus 4 model was conducted by the US AI Safety Institute (US AISI) and the UK AI Security Institute (UK AISI)" | "These organizations will also receive a minimally redacted copy of the capabilities report" | not stated | not stated | dd8bdea742 |
| Claude Opus 4.6 system cardAnthropic · February 2026 | Opus 4.6 | not stated | "UK AISI tested an early snapshot of [Claude Opus 4.6] for specific behaviours relevant to misalignment risk" | "These organizations will also receive a minimally redacted copy of the capabilities report" | not stated | not stated | 64f61f4df4 |
| Claude Mythos Preview system cardAnthropic · 7 April 2026 | Mythos Preview | not stated | not stated | not stated | not stated | not stated | 0df10a3699 |
| GPT-5.5 system cardOpenAI · 23 April 2026 | GPT-5.5 | not stated | "UK AISI was provided access to a representative launch checkpoint and a checkpoint with reduced refusals for cyber capabilities" | not stated | not stated | quoted | 9f907dcdc7 |
| Claude Opus 4.8 system cardAnthropic · 28 May 2026 | Opus 4.8 | not stated | "we shared a pre-release snapshot of Claude Opus 4.8 with UK AISI for open-ended testing, at their discretion, of behaviors or risk factors related to misalignment" | not stated | not stated | quoted | 8619ce6962 |
| Claude Fable 5 and Mythos 5 system cardAnthropic · 9 June 2026 | Fable 5 / Mythos 5 | not stated | "UK AISI was given access to early checkpoints of [Claude Mythos 5] to assess its cybersecurity and autonomy capabilities"; "UK AISI was given access to a pre-release checkpoint of [Claude Mythos 5] to test for behaviors relevant to misalignment risk" | not stated | not stated | quoted | 372a2684c3 |
| GPT-5.6 system cardOpenAI · 9 July 2026 | GPT-5.6 | For the safeguards rounds, "UK AISI was provided with extensive grey box access: access to chain-of-thought of the safety reasoning monitor, exact policy wording, and real-time feedback on classifier labels that would not be accessible to real-world attackers" | not stated | not stated | not stated | quoted | a6fb7f76b0 |
| Claude Opus 5 system cardAnthropic · 24 July 2026 | Opus 5 | not stated | "We shared an earlier snapshot of Claude Opus 5 with the UK AI Security Institute (UK AISI) for open-ended testing, at their discretion, of cyber capabilities"; "We evaluated without any external safety classifiers present" | not stated | not stated | quoted | 53b07d3763 |
| GPT-6 Astra system cardOpenAI · August 2026 | GPT-6 Astra | not stated | not stated | not stated | not stated | quoted | 27a43200cf |
| Claude Fable 5.1 and Mythos 5.1 system cardAnthropic · 1 September 2026 | Fable 5.1 / Mythos 5.1 | not stated | not stated | not stated | not stated | not stated | a1b8a79b58 |
| Responsible AI Transparency Report 2026Microsoft · 1 September 2026 | no model named | not stated | not stated | not stated | not stated | not stated | 776a68d022 |
| Claude Opus 5.5 system cardAnthropic · 22 September 2026 | Opus 5.5 | not stated | not stated | not stated | not stated | not stated | 7dfa334fdb |
| Claude Sonnet 5.5 system cardAnthropic · 28 September 2026 | Sonnet 5.5 | not stated | not stated | not stated | not stated | not stated | 12b32827af |
| Gemini 4 Argon Safety and Security ReportGoogle DeepMind · October 2026 | Gemini 4 Argon | not stated | "AISI conducted evaluations of Gemini 4 Argon, having been given both a version of the model without our full set of safety mitigations and a version which had mitigations applied" | not stated | not stated | not stated | ad9872fd17 |
| Claude Haiku 5.5 system cardAnthropic · 7 October 2026 | Haiku 5.5 | not stated | not stated | not stated | not stated | not stated | 703f00f09e |
Access window 1 of 15Model stage 7 of 15Publication 2 of 15Payment 0 of 15Finding, quoted 6 of 15
What happened afterwards 5 on record
Events a party published after an engagement: an incident on a model this evaluator's engagement covered, a correction or added disclosure, a later finding that cut against an earlier one, a lab's statement that it acted or did not act on the finding, or a move from this evaluator to a lab it graded. A row the source attaches to this evaluator by name is marked named; one that reaches it through the model it tested is marked via the model. The kind is what the record states, not why.
| Kind | Developer | Model | What the record states | When | Source | Id |
|---|---|---|---|---|---|---|
| incidentvia the model | Anthropic | Mythos 5; Opus 4.7 | "we identified three incidents in which a model accessed the internet from within or while interacting with the evaluation environment of Irregular, one of our third-party evaluation partners, and then gained unauthorized access to the production infrastructure of three different organizations"; "The incidents involved three different Claude models: Opus 4.7, Mythos 5, and an internal research test model"; "We notified our evaluation partner Irregular and the three affected organizations on Monday, July 27"Engagements: 372a2684c3, df7e3d705a, 89b0bfd357, e3c2b2d094, 5e8de70f4c, c21b5b5662 | 30 July 2026 | Anthropic, investigating three incidents | dd4457ea07 |
| contradictionnamed | Anthropic | Mythos 5 | Before release, in the system card: "[Claude Mythos 5] does not compromise safety research in our unprompted evaluations" ; after its own incident: "the activity undertaken by the agent show signs of novel, potentially deceptive behaviours, and were to an extent and severity we did not anticipate"Engagement: 372a2684c3 | 4 August 2026 | AISI, incident report; Anthropic, Claude Fable 5 and Mythos 5 system card | c69cbb940f |
| incidentnamed | Anthropic | Mythos 5 | The Institute's own cyber-testing incident: "in 10 of the 122 runs, we identified 19 cases where an agent had taken distinct actions beyond the scope of the testing parameters. 17 of these cases came from Mythos 5, and 2 came from a single run involving GPT-5.6 Sol"; "The developers' cyber classifiers were deliberately switched off"; "This behaviour occurred between July 25th and July 28th 2026"; "We also intend to work with METR (Model Evaluation and Threat Research) to conduct an independent third-party review"Engagements: 372a2684c3, df7e3d705a, 89b0bfd357, e3c2b2d094, 5e8de70f4c, c21b5b5662 | 4 August 2026 | AISI, incident report | 1a39056dce |
| incidentnamed | OpenAI | GPT-5.6 Sol | In the same runs, "2 actions involving OpenAI's GPT-5.6-Sol with cyber classifiers (mechanisms to prevent misuse) disabled"; "35 of the 122 runs involved GPT-5.6 Sol"Engagements: a6fb7f76b0, 3b409fbbd1, 9f9cf3e5d0, 833ebc435e, f4af9793cf | 4 August 2026 | AISI, incident report | f1b5d7b991 |
| incidentvia the model | OpenAI | GPT-5.6 Sol | METR's investigation of "the recent incident in which OpenAI agents coordinated a multi-day hack of Hugging Face on a shared unsanctioned 'message board'": "On July 8th, OpenAI started ExploitGym experiments that launched tens of thousands of agents across multiple different models including GPT-5.6 Sol and a highly-persistent internal model"; the investigators "worked on premises at OpenAI over a total of six days"; "Per our standard policy, we did not take payment from OpenAI for this independent assessment"; "OpenAI was able to redact any non-public information from this post"Engagements: a6fb7f76b0, 3b409fbbd1, 9f9cf3e5d0, 833ebc435e, f4af9793cf | 26 August 2026 | METR, Hugging Face incident investigation | fabf586e95 |
Dated 5 of 5Model named 5 of 5Tied to an engagement 5 of 5Evaluator named by the record 5 of 5
The money on record 5 rows
Rows of the observatory's money table that name this evaluator as recipient (in) or as funder (out), each as the record states it: a grant table line, a contract notice, a Form 990 schedule or the party's own disclosure. A figure quoted in prose is marked and never summed.
| Direction | Funder | Recipient | Amount, as recorded | When | Record | Source | Id |
|---|---|---|---|---|---|---|---|
| in | Schmidt Sciences | UK AISI | figure in prose, not a stated paymentNamed funder of the "over £27 million " fund, with OpenAI, Anthropic, Microsoft and AWS" fund, with OpenAI, Anthropic, Microsoft and AWS | not dated | party's own page | Alignment Project | 2515f554c5 |
| in | OpenAI; Anthropic; Microsoft; AWS; Schmidt Sciences | UK AISI | £27,000,000stated (approximate)"over £27 million ""over | not dated | party's own page | Alignment Project | 2be668d22f |
| out | UK AI Security Institute | METR | no amount publishedMETR lists the Institute as a donor | not dated | party's own page | METR; Epoch AI; Manifund; Generality Labs | 2a3ab21c74 |
| out | UK AI Security Institute | Epoch AI | no amount publishedEpoch lists UK DSIT as a paying partner | not dated | party's own page | METR; Epoch AI; Manifund; Generality Labs | f46738332c |
| out | UK AI Security Institute | GENERALITY LABS | $1,000,000stated (approximate)the Inspect Evals project "has been contracted with the UK AISI since January '25" and counted more than $1M in contracts with the Institute, Epoch and METR before its spin-offthe Inspect Evals project "has been contracted with the UK AISI since January '25" and counted more than | not dated | party's own page | METR; Epoch AI; Manifund; Generality Labs | bf946cf3f4 |
Amount stated 2 of 5Dated 0 of 5Purpose stated 3 of 5Funder profiled 5 of 5Recipient on the roster 5 of 5
Seats and moves 9 seats · 4 moves
Seats read off a team page, a governance page, an appointment notice or a filing that name this organization, and the dated moves into or out of it, from the observatory's own tables.
| Person | Side | Seat, as the record states it | Role | Dates | Source | Id |
|---|---|---|---|---|---|---|
| Buck Shlegerisslice | government | Expert advisor, UK AISI Alignment Project | Expert advisor | dates not stated | Alignment Project | b91d698b8a |
| Paul Christianoslice | government | UK Frontier AI Taskforce advisory board, Sep 2023 | advisory board | Sep 2023 – current, as read | NIST; GOV.UK | 92952df282 |
| Zico Kolterslice | government | Expert advisor, UK AISI Alignment Project | Expert advisor | dates not stated | Alignment Project | 87eadae2e6 |
| Geoffrey Irvingslice | government | Research Director, then Chief Scientist, UK AI Security Institute, Apr 2024 to May 2026; advisory capacity after | Research Director, then Chief Scientistformer | Apr 2024 – May 2026 | naml.us; UK AISI; naml.us; LawZero | cc2868a922 |
| Ian Hogarthslice | government | Chair, UK AI Security Institute (Foundation Model Taskforce from 12 Jun 2023) | Chair | 12 Jun 2023 – current, as read | GOV.UK | 5005a935b2 |
| Jade Leungslice | government | CTO, UK AI Safety Institute (Oct 2023; CTO by May 2024) | CTO | Oct 2023 – current, as read | GovAI; AISI; GOV.UK | 1089f4d888 |
| Yoshua Bengioslice | between | UK AISI Alignment Project advisory board | advisory board | dates not stated | LawZero; METR; Transluce; Alignment Project | 5fa635ef91 |
| J.J. Allaireslice | between | Co-founder and Principal Engineer, Meridian Labs; "Technical Staff" at UK AISI in Nov 2024; "a visiting researcher at the US CAISI"names this evaluator alongside its own organization | Co-founder and Principal Engineer | dates not stated | Meridian Labs; UK AISI | a3568f5329 |
| Kai Fronsdalslice | between | UK AISI research affiliate | research affiliate | dates not stated | Meridian Labs; Meridian Labs | 57fc2938d2 |
Role read 9 of 9Organization read 9 of 9Organization profiled 9 of 9Dated 4 of 9
Moves
| Person | From | To | When | Source | Id | |
|---|---|---|---|---|---|---|
| Joseph Bloomslice | MATS 5.0 scholar (mentor Neel Nanda) | → | UK AI Security Institute (Head of Model Transparency) | by 2026 | MATS | 9f6bc92b50 |
| Geoffrey Irvingslice | OpenAI; Google DeepMind | → | UK AI Security Institute (Apr 2024); Resolution (Jun 2026) | 2024 to 2026 | UK AISI; naml.us | a1541c890d |
| Jade Leungslice | GovAI; OpenAI (Governance Lead) | → | UK AI Safety Institute (Oct 2023); Prime Minister's AI adviser; Vice-Chair | 2023 to 2026 | GovAI; GOV.UK | 735ace6e3a |
| J.J. Allaireslice | UK AI Security Institute (technical staff, Nov 2024) | → | Meridian Labs (co-founder); visiting researcher at US CAISI | 2025 | UK AISI; Meridian Labs | d61b436c68 |
From profiled 4 of 4To profiled 4 of 4Person profiled 3 of 4Dated 4 of 4