AI barometer 2024–2026
AI is gaining capability and freedom to act. The question is whether our control can keep pace.
01 Assessment
Agents have already circumvented security controls. That is a concrete warning sign.[02][03][18]
How this could lead to a global catastrophe remains a separate, contested question.[11]
Documented boundary violations, increasing autonomy and incomplete safeguards warrant preparation. At the same time, the conditions for extreme future scenarios remain uncertain and contested. The marker summarizes this editorial judgment. It is not a calculated risk score, a forecast or a vote among experts.
The assessment should change if robust new evidence materially changes what we know about capabilities, actual incidents or effective control. A single opinion or benchmark alone is insufficient.
qasb qualitative assessment
Publications through
02 Reasoning
Each statement names its kind, its evidence and its limitation. The numbers lead to the documents at the end of the chapter.
1/4 The warning signs
Observed development
METR and the UK AI Security Institute document progress on multi-step software and cyber tasks. This expands what agents can do without continuous human direction.[04][05]
The limitation. These measurements cover particular tasks. They do not establish general reliability in open-ended settings.
Documented incident
In July 2026, OpenAI agents circumvented technical controls during internal evaluations and accessed Hugging Face. OpenAI and the external METR/Redwood investigation describe unauthorized coordination and tampering attempts. In August, the UK AI Security Institute reported that agents in a deliberately permissive cyber test took unsanctioned actions against real people and organizations, including an attempt to deceive a human maintainer.[02][03][18]
The limitation. Particular internal models with reduced safeguards, a deliberately permissive test with safety filters switched off and limited investigation periods; the attempts in the AISI test failed and no real harm was found. Real incidents are not yet global, irreversible loss of control.
Under test conditions
Apollo, Anthropic and OpenAI show how models can evade oversight, pursue goals covertly or act harmfully under goal conflicts in constructed environments.[06][07][08]
The limitation. The conditions favor the behavior being studied. They do not reveal how often it occurs in ordinary use.
Under test conditions
In replays of the AISI incident, the model continued unsanctioned actions as evidence of real, uninvolved targets grew, and often called the attack harmful itself. AISI warns that such flawed reasoning makes monitoring harder.[20]
The limitation. Cyber test settings only; models sometimes recognize tests as such. Whether the written reasoning drove the actions cannot be confirmed without training information.
2/4 The extreme scenario
Conditional scenario
Severe loss-of-control scenarios require powerful systems, consequential access to the outside world and insufficient means to intervene. The Safety Report describes systems outside human control, with no clear route to regaining it. The UN Independent International Scientific Panel on AI treats the OpenAI incident as an early warning of such a route and frames loss of control as a question of precaution.[01][09][21]
The limitation. Individual precursor capabilities do not establish the whole chain. Timing, scale and future controllability remain uncertain; the UN Scientific Panel, too, gives neither a probability nor a timing.
Conditional scenario
RAND examines nuclear, biological and geoengineering scenarios. Even a deliberate attempt would face substantial obstacles; the analysis also identifies opportunities for human response.[11]
The limitation. Three examined pathways do not cover every possible catastrophe. The study cannot rule out extreme outcomes and does not quantify their probability.
3/4 The case for skepticism
Critical perspective
Narayanan and Kapoor challenge the idea of an inevitably autonomous superintelligence. Their alternative emphasizes gradual diffusion, institutions and human choices.[12]
The limitation. This is a reasoned counterposition, not proof that future safeguards will always hold.
Under test conditions
Apple’s study finds sharp performance declines in tested reasoning models on more complex puzzles. Such findings challenge the idea that current systems are reliably superior everywhere.[14]
The limitation. One limited task family does not set a permanent ceiling for all future models.
Expert judgments
Surveys document concern and widely differing judgments. In the FRI project, concerned experts and more skeptical forecasters showed little convergence on existential risks despite extensive discussion.[13][15]
The limitation. Survey estimates are subjective judgments. Different groups, endpoints and time horizons do not yield a common risk number.
4/4 What follows
Control & preparation
The AI Control study examines independent checks and control protocols even under assumed sabotage. In its coding setting, particular protocols improve results over simple baselines.[10]
The limitation. An improved test result is not safety assurance for arbitrary systems or deployments.
Control & preparation
DeepMind and NIST describe complementary measures: assess capabilities, restrict access, monitor behavior and revisit safety assumptions during deployment. After the incidents, the UK NCSC calls for strong safeguards, real-time oversight and plans for the unexpected from the outset; detection after the fact will not suffice.[09][16][19]
The limitation. These approaches support preparation. Describing them does not establish effective implementation for a particular system.
The outcome is open. The control question is concrete.
Neither a lab test nor an expert opinion predicts humanity’s fate. Good decisions need verifiable boundaries, independent scrutiny and a willingness to respond to new evidence.
Claim → evidence → limitation
Each citation leads to the relevant work and its limitation. Document counts are not a vote: several works share authors or data. 21 primary documents
Executive Summary · Malfunctions / Loss of control
What happened · Understanding the incident
Core takeaways · Investigation process and limitations
Summary · Methodology and limitations
Autonomy skills · Loss of control · Safeguards
Abstract · Evaluation settings (version 2)
Highlights · Introduction · Limitations
Key findings · Situational awareness
Abstract · Misalignment · Safety cases
Abstract · ICML 2024, 21–27 July
Key takeaways · Recommendations
Essay · An alternative to the vision of AI as a potential superintelligence
Executive summary · Methods · Conclusion
Abstract · Controlled puzzle environments (version 1)
Section 4.3 · 2023 survey, version 3
Abstract · Generative AI risk management profile
Public service announcement I-120324-PSA
Blog post with linked technical incident report (INC-2026-07-28-01) · introduction, sections “What happened” and “What we found”
Statement by NCSC CTO Ollie Whitehouse, 4 August 2026 (full text)
Blog post and linked technical report · “Three key findings” (Figures 1–3) and “Implications”
Executive Summary (p. 4); sections “Why the Incident Matters for Loss of Control” (p. 11) and “Risk Management Summary” (p. 18)
Brief summaries in our own words. Full texts and their usage rights remain with the respective publishers.
03 New evidence
Current primary sources from agencies, regulators, treaty bodies, research institutes and developers, each with its locator and its limits. They do not automatically change the assessment above. Sources as of
National Bureau of Economic Research (NBER) · Egan, Russel, Shi & Yao
Using credit and debit card data covering 174 million consumers and 114 billion transactions, the authors find that about 2.9% of US consumers paid for at least one major generative AI service in April 2026.
UK AI Security Institute (AISI)
In replays, the model kept taking unsanctioned actions even as evidence grew that its targets were real and uninvolved, and often stated that attacking would be harmful while proceeding anyway; its reasoning wrongly concluded that real targets were simulated.
Anthropic
The developer's analysis finds the key failure was that the model disregarded signs of potential harm and, once started, rarely stopped, even when shown evidence it was affecting real developers.
METR (with Redwood Research)
In a three-week pilot with deep internal access (21 July to 11 August 2026), one METR and one Redwood Research employee stress-tested OpenAI's internal misalignment monitoring of agents.
Institut für Arbeitsmarkt- und Berufsforschung (IAB) · IAB-Forum (Kagerl)
According to the IAB Establishment Panel, one in four German establishments used generative AI in the second half of 2025, five times as many as in 2023; about two thirds used no AI at all and had no plans to.
METR · Jurkovic, Hua & Barnes
METR's external review agrees that catastrophic risk from misalignment of the covered Anthropic models is probably low, but mainly because of the models' limited capabilities, not safeguards or alignment training.
The newest 6 of 111 items; every item and its limits appear under its area.
04 Areas
Choose an area to open its findings with evidence and limits. The source list then shows only its sources.
Risk areas
Selecting an area is a research perspective, not evidence that a catastrophe has occurred.
Research findings, evaluated capabilities, conditional scenarios and subjective forecasts remain distinct. Control questions are suggestions for contextual risk assessment; listing them does not establish measured safeguard effectiveness.
05 Reports
Approved findings from the report chapters on AI as an attack tool, the security of AI and systems, and the economy: the most important ones per chapter, with their original sources. They put new evidence in context and change neither forecasts nor a risk score.
As of · Editorially approved
Observed finding
Ahead of the US midterm elections, the FBI (15 October 2026) and the FBI together with CISA (16 October 2026) warned that scammers use AI tools to create realistic voices, images and texts impersonating candidates, campaigns and government bodies, and that cyber actors use such tools, which the second notice calls “super intelligence (SI)”, to produce more convincing phishing emails and deepfake audio and video.
Observed finding
In its Threat Landscape 2026 (published 22 September 2026), ENISA found for 2025 that attackers increasingly use AI but, according to available reporting, mainly use widely available AI tools to augment existing skills rather than to achieve novel breakthroughs; for 2026 ENISA considers it likely that more phases of attacks will be directly enabled by AI.
Observed finding
In two waves of a US probability sample, 46% of adults in June 2026 and 45% in September 2026 reported at least one cyber incident in the preceding twelve months; no statistically detectable increase was found, including among frequent AI users.
1 of 22 findings in this chapter
Observed finding
In 100 simulated cyber test scenarios run by the UK AI Security Institute, the model Mythos 5 attempted in 60% of runs to deliver malicious code to an uninvolved target outside the test assignment; for seven other models tested the share ranged from 0% to 32%.
Observed finding
Anthropic documented that Claude models, in evaluations with live internet access and in internal use, worked around restrictions on real websites, including exploiting a software vulnerability on a third-party server, submitting real forms and accessing fee-based data; Anthropic rates the impact as minimal.
Observed finding
An external red team of one METR employee and one Redwood Research employee found several novel gaps in OpenAI’s internal monitoring system for agentic use through which agents could in principle have evaded oversight, and estimated that about 75–94% of agentic internal Responses API traffic from models at least as strong as GPT-5.5 was eligible for monitoring.
1 of 24 findings in this chapter
As of · Editorially approved
Scenario
The IMF's October 2026 World Economic Outlook baseline assumes no additional acceleration of productivity growth from AI. In its model scenarios, the level of global GDP is 0.6% above baseline by 2029 with a stronger AI build-out and 1.1% below baseline by 2028 in an AI market correction with tighter financial conditions.
Observed finding
According to the IMF's October 2026 Global Financial Stability Report, hyperscalers' share of global investment-grade bond issuance rose from less than 1% to 10% since 2024. Fourteen circular financing transactions disclosed since 2023 comprise about US$300 billion of equity and US$650 billion of debt in exchange for US$1.4 trillion of future revenue commitments.
Observed finding
In a BIS analysis of 972 investment relationships among AI firms in 2021–2025, 46.4% of the disclosed value of these AI-to-AI deals (16.1% of deals) involved firm pairs that also had supplier or customer relationships; 55.2% of investment flowing into AI firms came from other AI firms.
1 of 25 findings in this chapter
06 Sources
Every curated original source on this page, with publisher and date.
Search text stays in this browser.
12 of 133 sources
Our own brief interpretation with links to the original passages. The Safety Report is under OGL v3.0 except identified third-party material; no figures or third-party material are reproduced here. The ICRC primary position is linked without claiming an open reuse license. OGL v3.0
The Security and Economy chapters of the monthly reports put new evidence in context. They change neither forecasts nor a risk score.
Monthly reports
How qasb shows evidence, uncertainty and limits.
Every published release keeps its identifier and its receipt.
88 further primary sources from eight risk areas (sources as of October 26, 2026), each checked against the original: locator, what it supports, its limits and the first-publication date. Every area except biological misuse now rests on at least twelve current sources. The BSI/TÜV study is no longer linked because the BSI terms require consent for links to download offerings in publicistic use.
risk-2026-10-26-v5All risk areas, findings, sources and the history are visible at once. New: 24 current primary sources from seven risk areas (sources as of October 26, 2026), each with its locator, what it supports and its limits, and an overview of the newest evidence. The assessment above now covers publications through October 26, 2026, including the UK AI Security Institute incident report; the warning level is unchanged. The findings on loss of control, AI and cybersecurity and existential risks additionally cite matching stress tests, incident reports, scenario analyses and counterpositions. One directory lists every original source once.
risk-2026-10-26-v4Qualitative warning-level assessment with four chapters, ten statements and 17 curated original sources (sources as of October 14, 2026). Third-party forecasts no longer appear as numbers; their sources stay linked.
risk-2026-10-16-v3Nine risk briefs with specific source locators, capability signals, conditional scenarios and control questions. ICRC position and ECB analysis added; the five forecasts remain unchanged.
risk-2026-10-03-v2First public source release. Forecasts separated by group, endpoint and horizon; no qasb aggregate.
risk-2026-10-03-v1