Over the past year, the cyber offense, biological risks, chemical risks, and harmful manipulation domains have broadly shown the same pattern: Capability and Safety Score both rose together. As models became more capable, their safety scores improved as well, which partially mitigated the risk growth associated with stronger capabilities.

By contrast, in the loss-of-control domain, capabilities continued to strengthen over the past year, while the Safety Score did not improve in step, further increasing risk.

Under Risk Index v1.5⁷, model families are no longer following the same risk trajectory, and instead show clearly different patterns across domains. For example:

The Gemini family shows notably elevated Risk Indices in the loss-of-control domain.

The DeepSeek, GLM, and MiMo families remain in relatively high-risk ranges across most domains.

The Kimi family has seen relatively rapid Risk Index increases in the biological and chemical domains.

The GPT and Claude families remain in relatively low-risk ranges across most domains.

Note: Because benchmarks differ across domains, Risk Indices are not comparable across different domains.

In the cyber offense, biological risks, harmful manipulation, and loss-of-control domains, the models on the high-capability, low-safety frontier are mostly proprietary, not open-weight.

Proprietary models score higher on capability than open-weight models, but their safety scores are similar. The only exception is the chemical risk domain, where open-weight models outperform proprietary ones: Kimi K2.5 achieved the highest Capability Score, 4% above the top proprietary models.

Claude Opus 4.6 and GPT-5.4 set new highs on benchmarks for vulnerability exploitation, CTF tasks, and cyberattack knowledge, including VulnerabilityExploit, CyBench, and WMDP-Cyber.

Notably, the top CyBench score reached 80 for the first time, up 108% from three quarters ago, indicating substantial progress by frontier models on complex, long-horizon cyberattack tasks.

Compared with rapidly improving capabilities, cyber safety guardrails remain insufficient. Although new models perform well on refusal benchmarks such as AirBench-SecurityRisks, with most scoring above 80 out of 100, most models still score below 20 on advanced red-teaming benchmarks such as ISC-Bench-Cyber.

In addition, some model families, such as Claude and GPT, show substantial declines in safeguards in their latest versions.

On the capability side, more than half of the new 2026Q1 models surpassed the human expert baseline on biological experiment troubleshooting in BioLP-Bench, and GPT-5.4 reached human-expert-level performance on biological image understanding in LAB-Bench-FigQA for the first time.

On the safety side, although new models perform well on basic refusal tests such as SOSBench-Bio, with most scoring above 80, most models still score below 80 out of 100 in advanced red-teaming scenarios such as Fortress-Biological.

Over the past year, capability gains in the chemical risk domain have remained limited. On capability benchmarks such as WMDP-Chem, score differences across models remain small, and the top score has increased by only 1% over the past three quarters.

As for safety guardrails, although performance on basic refusal tests such as ChemicalHarmfulQA has improved, the weaknesses remain clear, with most models still scoring below 40. Performance on advanced red-teaming tests such as ISC-Bench-Chemical is also generally poor, with most models scoring below 20.

Frontier models continue to improve on harmful manipulation benchmarks: Gemini 3.1 Pro Preview holds a clear lead on MakeMePay, while Claude Opus 4.6 set a new record on MultiTurnPhishing.

At the same time, harmful manipulation safety evaluations show continued improvement in models' refusal of harmful manipulation tasks in AirBench-Manipulation, with most models scoring above 80. However, models still show clear unsafe propensities on APE, which measures the tendency to persuade others, where most models score below 60.

On Self-Proliferation, scores have continued to rise, and the top score is now 45% higher than it was three quarters ago.

On MLE-Bench, capability has improved substantially, and the top score is now 44% higher than it was three quarters ago. This capability is necessary for model self-improvement.

On GDM-Stealth, most models still score below 20, though they are making progress. On SAD-mini, new models now generally score above 80. These capabilities may be necessary for models to engage in scheming.

Compared with the rapid growth in capabilities, safety indicators related to loss-of-control have not improved correspondingly. These indicators measure models' propensities relevant to loss-of-control.

On propensity benchmarks such as MASK and Agentic-Misalignment, scores vary widely across models, ranging from 40 to 100, while overall improvement remains slow.

On DarkBench, which measures the tendency to influence users covertly, model scores are generally below 60, indicating widespread unsafe propensities.