Across all four domains—cyber offense, biological risks, chemical risks, and loss-of-control—the Risk Indices of models released in the past year have continued to reach new highs. The cumulative maximum Risk Index in the cyber offense domain has increased by 31% compared to a year ago, 38% in biological risks, 17% in chemical risks, and 50% in loss-of-control.

However, by Q3 2025, this upward trend began to plateau. Apart from the loss-of-control domain, no new highs have been recorded during this period.

Note: Since the benchmarks differ across domains, the Risk Indices are not comparable across different domains.

Over the past year, model families have followed distinct risk trajectories:

Stable Low Risk: The GPT and Claude families maintain consistently low Risk Indices across all domains.

Rise Then Fall: The DeepSeek, Qwen, and MiniMax families show initial risk increases followed by declines in cyber offense, biological risks, and chemical risks.

Rapid Risk Increase: The Grok family exhibits sharp risk increases in loss-of-control, while the Hunyuan family shows steep growth in biological risks.

The overall Capability Scores of reasoning models are significantly higher than those of non-reasoning models. However, their Safety Scores largely overlap with non-reasoning models, showing a lack of safety improvement.

The red dashed line represents the Risk Pareto Frontier⁷. Notably, the models on this frontier are predominantly reasoning models.

The very most capable models are predominantly proprietary. However, from the perspective of the majority of models, there is no notable difference in the overall capability-safety distribution between open-weight and proprietary models in the domains of cyber offense, chemical risks, and loss-of-control. Only in the biological risk domain are the Capability Scores of open-weight models markedly lower than those of proprietary models.

Note: Although open-weight models are comparable to proprietary models in overall capability and safety, this does not mean their actual risks are similar. The open-weight nature itself is a key variable affecting risk: it might increase risk by lowering the barrier for malicious fine-tuning; it could also reduce overall risk by empowering defenders and shifting the offense-defense balance.

Frontier models are showing rapid growth in capabilities across multiple cyberattack benchmarks.

WMDP-Cyber tests the model's knowledge of cyberattacks. The top score among frontier models has increased from 68.9 to 88.0 in one year.

CyberSecEval2-VulnerabilityExploit tests the model's ability to exploit code vulnerabilities. The top score has increased from 55.4 to 91.7 in one year.

CyBench tests the model's CTF (Capture the Flag) capability. The top score has increased from 25.0 to 40.0 in one year.

Note: The red dashed lines connect models that have achieved new high scores.

On several biological capability benchmarks, the performance of frontier models is approaching or even surpassing human expert levels.

BioLP-Bench tests the model's ability to troubleshoot biological protocols. On this benchmark, 8 models including GPT-5.1 (high) have surpassed human experts.

LAB-Bench-CloningScenarios tests the model's knowledge in cloning experiment scenarios. On this benchmark, 4 models including Gemini 3 Pro Proview have outperformed human experts.

LAB-Bench-SeqQA tests the model's understanding of DNA and protein sequences. On this benchmark, 2 models including Gemini 3 Pro Proview have surpassed human experts.

SciKnowEval-BiologicalHarmfulQA and SOSBench-Bio are two benchmarks composed of harmful biological questions. The score represents the model's refusal rate for harmful questions; the higher, the better. The blue dashed line represents the linear regression trend line.

On the SciKnowEval benchmark, only 40% of the models achieved a refusal rate exceeding 80%, while 35% of the models had a refusal rate below 50%.

A similar pattern was observed on the SOSBench-Bio benchmark, where only 15% of the models achieved a refusal rate above 80%, while 35% of the models had a refusal rate below 20%.

WMDP-Chem measures proxy knowledge relevant to chemical weapons development. Scores have trended upward gradually over the past year, but growth remains slow with minimal variation between models.

SOSBench-Chem includes harmful chemical questions. Performance varies widely: only 30% of models achieve refusal rates above 80%, while 25% refuse fewer than 40% of harmful queries. The trend line shows minimal improvement in refusal rates over the past year.

StrongReject evaluates model safeguards against jailbreaking. We tested 31 jailbreak methods from StrongReject. A higher score indicates stronger safeguards.

The test results show that only 40% of the models have a score exceeding 80, while 20% of the models have a score below 60. Among all models, only the Claude and GPT families (starting from o1-mini) consistently maintain a score above 80.

MASK is a benchmark for evaluating model honesty. A higher score indicates a more honest model.

Test results show that only 6 models (including Claude Sonnet 4.5 Reasoning, GPT-5.1 (high), MiniMax M2, etc.) scored above 80 points, while 30% of the models scored below 50 points. This situation warrants attention, as honesty is an important proxy and early warning indicator for loss-of-control risk—dishonest models may misrepresent their capabilities, or provide misleading information about their actions and intentions.