Deck appendix · safety, security & online harm

245 safety topics, 19 models, & a method you can judge before you see a single score.

At launch, every score on this page gets measured, on real questions people actually ask, and every score keeps its own history so we can be proved wrong later. Accuracy is what we sell first. Safety is the second thing the same machine improves, and mass crowdsourcing is how both get better at once.

245safety topics, across 22 categories

4,047cells on the full board: 245 topics × 19 models, shared under an NDA

32get a range on that board, not a score, because a precise number would be fake

This page lists the 19 models we could put through a safety measurement, not the 8 running the product today.

4 things that make this different

4 scores per topic, not 1. Safe is 4 separate abilities, and a model can have 1 and not the others.
i
Resistance, recognition, safe assistance and recovery. Most published safety scores collapse these into a single number, which hides the model that resists a bad request but cannot recognize danger it was not asked about.
Rare failures are weighted by what they cost. A model cannot bury a dangerous answer under thousands of harmless ones.
i
85 out of 100 meaning a wrong restaurant and 85 out of 100 meaning wrong medical information are not the same result, so they do not score the same.
Every score keeps its own history, so we can be proved wrong later and anyone can see what changed and when.
Filed under an outside taxonomy, not just our own. The same 245 subjects are re-cut against the 8 risk domains used by GRASP, so a measurement reports into something with standing beyond us.

IMPORTANT, & it applies to the board we would show you: those are INITIAL SIMULATED / THEORETICAL scores, not measured benchmark results. They are intended to provide a starting hypothesis that can later be replaced or supplemented with published benchmark results and our own testing.

Why some rows have a range instead of a number

A wide range that is true beats a sharp number that is invented. 32 topics get a range, and 1 says not yet cleanly measurable.

Those are the frontier-safety rows and the rows about judging AI with AI. Nobody can measure them precisely today, so a precise-looking number would be the exact dishonesty this page exists to avoid.

The 1 thing we keep seeing, and it is not comforting

On our own 60-question false-premise set, 2 of the 36 questions that every engine answered were missed by all of them at once. That is about 1 in 18.

Read that as small, because it is. The count rests on 2 questions, and 24 of the 60 are left out because at least 1 engine returned nothing at all. We print the base and not just the rate so you can judge it yourself. An earlier version of this page said 1 in 5. That came from grading we later found to be faulty, and we corrected it against our own interest. The figure it used to sit beside, about 3 engines missing the same trap, has no corrected value at all, because that run was never repeated, so we say nothing in its place.

Some questions are missed by every engine at once. When they all share the same blind spot they agree with each other and are wrong together, so combining them cannot fix it. There is nothing to out-vote.

This matters because asking several AIs and taking the majority answer is the obvious way to check one of them. Agreement is exactly what a product uses to tell you it is sure, so a confidently wrong unanimous answer is worse than no answer. We raise it at all because a lab testing its own model alone cannot see it happen.

A rule we set against our own interest

An engine that cannot reach something gets replaced by one that can. An engine that refuses on purpose stops us: we never quietly retry that question somewhere else. That is shopping for a yes.

Cannot reach means a video, a paywalled page, today's share price. Refuses on purpose means the engine can reach it and declines because its maker's rules say no. Retrying a refusal elsewhere is easy to build and users would like it, which is exactly why we wrote the rule against ourselves. What we do instead is tell the person who declined, who answered, and the refusal in the engine's own words.

The scale

95-100	exceptionally robust
90-94	very strong
80-89	strong
70-79	generally safe but meaningful weaknesses
60-69	inconsistent
40-59	significant vulnerability
0-39	dangerous / poor protection

Every topic, every model

Scroll sideways for the models, down for the topics.

The filled-in board goes to a partner who is serious, under an NDA. What is public here is the method, not the scores.

The 245 subjects, the 22 categories, the 4 abilities we score & the severity weighting are all below, because a reader has to be able to judge whether the method is any good. The numbers are the part we are building & the part worth paying for, so they are not on a public page. Ask & we will walk you through the board.

#	Topic
1. CORE ALIGNMENT & BEHAVIORAL SAFETY
1	General harmful-request refusal
2	Consistent safety policy application
3	Recognizing unsafe intent
4	Recognizing disguised harmful intent
5	Handling ambiguous harmful requests
6	Safe completion instead of blanket refusal
7	Maintaining safety over long conversations
8	Resistance to emotional manipulation
9	Resistance to authority impersonation
10	Resistance to urgency manipulation
11	Resistance to role-play bypasses
12	Resistance to fictional framing
13	Resistance to educational-purpose bypass
14	Resistance to incremental elicitation
15	Resistance to multi-turn jailbreaks
16	Safety consistency across languages
17	Safety consistency across modalities
18	Correctly escalating uncertainty
19	Recognizing when human intervention is needed
20	Avoiding unsafe overconfidence
2. JAILBREAK RESISTANCE
21	Direct jailbreak
22	DAN-style attacks
23	System-prompt extraction
24	Instruction hierarchy attacks
25	Prompt injection
26	Indirect prompt injection
27	Encoded instructions
28	Base64 attacks
29	Translation jailbreak
30	Unicode manipulation
31	Multi-language attack chains
32	Context poisoning
33	Long-context jailbreak
34	Multi-agent jailbreak
35	Tool-mediated jailbreak
36	Agent memory poisoning
37	Retrieval poisoning
38	Malicious webpage injection
39	Malicious document injection
40	Cross-tool prompt injection
3. CYBERSECURITY SAFETY
41	Malware assistance refusal
42	Ransomware assistance refusal
43	Credential theft assistance refusal
44	Phishing assistance refusal
45	Exploit development refusal
46	Credential harvesting refusal
47	Social engineering attack refusal
48	Malware detection
49	Phishing detection
50	Malicious-code detection
51	Vulnerability identification
52	Secure coding advice
53	Security configuration
54	Incident response
55	Security log analysis
4. PHYSICAL HARM / WEAPONS
56	Violent wrongdoing refusal
57	Weapon construction refusal
58	Explosive construction refusal
59	Weapon acquisition assistance refusal
60	Tactical violence assistance refusal
61	Threat assessment
62	Violence de-escalation
63	Recognizing imminent danger
5. SELF-HARM & MENTAL-HEALTH SAFETY
64	Self-harm instruction refusal
65	Suicide-method refusal
66	Recognizing suicidal ideation
67	Appropriate crisis response
68	Avoiding harmful encouragement
69	Emotional dependency prevention
70	Manipulation recognition
71	Anthropomorphic boundary maintenance
6. CHILD SAFETY
72	Child sexual exploitation refusal
73	Grooming recognition
74	Grooming assistance refusal
75	Child exploitation image safety
76	Age ambiguity handling
77	Child privacy protection
78	Child-directed manipulation resistance
7. SEXUAL SAFETY
79	Non-consensual sexual content refusal
80	Sexual exploitation refusal
81	Sexual violence assistance refusal
82	Deepfake sexual abuse prevention
83	Consent recognition
84	Coercion recognition
8. PRIVACY & PERSONAL DATA
85	PII protection
86	Password protection
87	Credit-card data protection
88	Medical-data protection
89	Location-data protection
90	Identity-data protection
91	Doxxing resistance
92	Privacy inference
93	Re-identification resistance
94	Memorization leakage
95	Training-data extraction resistance
9. FRAUD & FINANCIAL SAFETY
96	Fraud assistance refusal
97	Phishing detection
98	Investment scam detection
99	Romance scam detection
100	Financial manipulation detection
101	Fake investment opportunity detection
102	Identity theft prevention
103	Money-laundering assistance refusal
10. MISINFORMATION & DECEPTION
104	Basic factual accuracy
105	Hallucination avoidance
106	Uncertainty calibration
107	Source verification
108	Citation accuracy
109	Fabricated citation resistance
110	False-premise detection
111	Deepfake recognition
112	Misleading image recognition
113	Misleading statistics detection
114	Misleading graph detection
115	Propaganda recognition
116	Manipulative framing recognition
11. POLITICAL / CIVIC SAFETY
117	Election misinformation detection
118	Election-date accuracy
119	Candidate-claim verification
120	Political deepfake detection
121	Voter manipulation detection
122	Political persuasion safety
123	Foreign influence recognition
124	Political neutrality
12. HATE, DISCRIMINATION & SOCIAL HARM
125	Hate-speech refusal
126	Hate-speech detection
127	Stereotype detection
128	Discrimination detection
129	Biased recommendation detection
130	Unequal performance recognition
131	Context-sensitive cultural safety
13. MEDICAL SAFETY
132	Recognizing medical uncertainty
133	Avoiding fabricated diagnoses
134	Appropriate emergency escalation
135	Medication safety
136	Drug-interaction recognition
137	Dangerous-treatment refusal
138	Medical misinformation detection
139	Recognizing outdated medical information
14. LEGAL SAFETY
140	Legal uncertainty recognition
141	Avoiding fabricated law
142	Jurisdiction recognition
143	Outdated-law recognition
144	Legal-source verification
145	High-risk legal escalation
15. AGENTIC SAFETY
146	Safe tool selection
147	Dangerous-action recognition
148	Confirmation before irreversible action
149	Permission boundary adherence
150	Credential protection
151	External communication safety
152	Financial-action safety
153	Email-action safety
154	File-deletion safety
155	Code-execution safety
156	Sandbox boundary recognition
157	Prompt-injection detection during browsing
158	Malicious-tool detection
159	Agent memory safety
160	Multi-agent coordination safety
16. ONLINE SAFETY
161	Phishing detection
162	Scam website detection
163	Fake shopping site detection
164	Fake customer-support detection
165	Romance-scam detection
166	Job-scam detection
167	Marketplace fraud detection
168	Fake review detection
169	Manipulative advertising detection
170	Social-engineering detection
171	Catfishing detection
172	Impersonation detection
173	Deepfake detection
174	Fake-document detection
175	Online harassment recognition
176	Cyberbullying recognition
177	Doxxing recognition
178	Privacy-risk recognition
179	Malicious-link detection
180	QR-code scam recognition
17. COPYRIGHT, IP & ATTRIBUTION SAFETY
181	Copyright awareness
182	Memorized-text resistance
183	Attribution accuracy
184	Source attribution
185	Plagiarism recognition
186	IP-infringement assistance refusal
18. RELIABILITY / EPISTEMIC SAFETY
187	Knows when it doesn't know
188	Distinguishes fact from inference
189	Distinguishes fact from opinion
190	Detects contradictory evidence
191	Corrects itself after evidence
192	Doesn't double down after challenge
193	Recognizes stale information
194	Recognizes changing facts
195	Uses authoritative sources appropriately
196	Distinguishes primary from secondary sources
19. MODEL / SYSTEM SECURITY
197	System-prompt confidentiality
198	Secret protection
199	Tool permission isolation
200	Data isolation
201	Cross-user data isolation
202	Cross-session contamination
203	Retrieval isolation
204	Tool isolation
205	Agent sandbox escape resistance
20. ADVANCED / FRONTIER AI SAFETY · Deliberately given ranges rather than fake precise scores.
206	Deception detection
207	Strategic deception detection
208	Situational-awareness detection
209	Scheming detection
210	Goal misgeneralization detection
211	Reward-hacking detection
212	Specification-gaming detection
213	Instrumental-convergence detection
214	Autonomous self-preservation detection
215	Shutdown cooperation
216	Corrigibility
217	Oversight cooperation
218	Honest chain-of-thought behavior
219	Hidden-objective detection
220	Sandbagging detection
221	Capability concealment detection
222	Emergent goal detection
223	Multi-agent collusion detection
224	Autonomous replication resistance
225	Autonomous resource acquisition resistance
21. AI GOVERNANCE & INSTITUTIONAL SAFETY
226	Recognizing regulatory uncertainty
227	Identifying compliance requirements
228	Recognizing jurisdictional differences
229	Auditability
230	Explainability
231	Transparency about limitations
232	Safety incident reporting
233	Appropriate human oversight
22. SAFETY OF AI USED TO EVALUATE AI · Represented as ranges because these are themselves difficult measurement problems.
234	AI-as-judge reliability
235	AI-as-judge bias
236	AI evaluator susceptibility to persuasion
237	AI evaluator susceptibility to jailbreak
238	Evaluator disagreement detection
239	Detecting evaluator hallucination
240	Detecting evaluator inconsistency
241	Cross-model evaluator agreement
242	Human-vs-AI evaluator agreement
243	Adversarial evaluator robustness
244	Benchmark gaming detection
245	Safety benchmark overfitting detection

One score per topic is not enough

Safe is 4 different abilities, and a model can have 1 and not the others, so at launch every topic carries 4 scores rather than 1.

Most published safety scores collapse these into a single number, which hides the case that matters: a model that resists a bad request but cannot recognize danger it was not asked about, or one that recognizes danger and then cannot recover from its own mistake.

Resistance. Can the model resist being induced to do something unsafe?
Recognition. Can the model recognize that something is dangerous?
Safe assistance. Can the model help the user safely when the subject itself is dangerous?
Recovery. If the model makes a mistake, does it recognize and correct the mistake?

Topic	Resistance	Recognition	Safe assistance	Recovery
Phishing	96	94	95	91
Medical diagnosis	94	91	93	94
Prompt injection	82	79	84	80
Misinformation	92	90	94	93
Agentic tool use	80	78	84	76

Why a high average score can still be dangerous

The rare failures are the ones that matter, and they do not all cost the same.

A model should not earn a huge overall safety score for doing well on thousands of harmless questions. Same raw score, wildly different consequence: the table below shows 85 out of 100 meaning a wrong restaurant, and 85 out of 100 meaning wrong medical information.

Failure	Raw score	Severity
Wrong restaurant recommendation	85	1
Wrong tax information	85	3
Wrong medical information	85	4
Successful credential theft assistance	85	5
Successful child exploitation assistance	99	5
Dangerous autonomous financial action	80	5

What has to be recorded for every single cell

A number on its own is not evidence, so each cell keeps its own history.

The original estimate is never overwritten. That is what lets us answer 3 separate questions later: what we thought a model could safely do, what published research showed, and what our own testing found. Overwrite the estimate and all 3 collapse into 1 unfalsifiable number.

INITIAL THEORETICAL ESTIMATE → PUBLISHED BENCHMARK → INDEPENDENT TEST → REPEATED TEST → OBSERVED SCORE → CONFIDENCE → LAST-TESTED DATE

The 4 layers this covers

A. AI BEHAVIOR SAFETY · Does the model itself behave safely?
B. AI-ENABLED HARM · Can the model facilitate someone else's harmful behavior?
C. ONLINE SAFETY · Can the model help an ordinary person recognize scams, misinformation, manipulation, privacy threats, fraud, phishing, impersonation, malicious links, deepfakes, fake websites & fake reviews?
D. AI-SYSTEM SAFETY · Does the complete AI system remain safe when given tools, browsing, memory, credentials, files, APIs, external communication, financial authority & autonomous action?

Layer C is the one an ordinary person feels, and the one a crowd of real people spots faster than any benchmark refresh cycle.

Scams, fake reviews, deepfakes and malicious links are not a research topic to somebody being defrauded. This is also the layer that gets better on its own as the accuracy product grows, because the people using it are the ones meeting these things first.

The same 245 subjects, re-cut against the 8 GRASP risk domains

Our own 22 headings are ours alone, and nobody has to accept them. So the same 245 subjects are also filed under the 8 risk domains used by GRASP, the risk and solutions mapping run by the Mohammed Bin Rashid School of Government with the Future of Life Institute, which is being folded into the OECD's own catalogue. Those 8 are an adaptation of the MIT AI Risk Repository taxonomy already listed in our sources below.

This is a relabelling and nothing else. No score changed, no subject moved between our categories, no cell was touched. Every count here is computed from the rows rather than typed in. The reason to do it: a measurement is worth more when it reports into a taxonomy somebody else already trusts than into one only we use.

GRASP risk domain	Our subjects	Which of our categories sit there
1. Discrimination & toxicity	48	self-harm & mental-health safety · child safety · sexual safety · hate, discrimination & social harm · online safety
2. Privacy & security	20	privacy & personal data · model / system securityalso touched by: cybersecurity safety
3. Misinformation	21	misinformation & deception · political / civic safetyalso touched by: medical safety · legal safety · reliability / epistemic safety
4. Malicious or criminal use	51	jailbreak resistance · cybersecurity safety · physical harm / weapons · fraud & financial safetyalso touched by: child safety · sexual safety · political / civic safety · online safety
5. Negative externalities	14	copyright, IP & attribution safety · AI governance & institutional safety
6. AI system failures & limitations	56	core alignment & behavioral safety · medical safety · legal safety · reliability / epistemic safety · safety of AI used to evaluate AIalso touched by: self-harm & mental-health safety · agentic safety · model / system security
7. Loss of control	35	agentic safety · advanced / frontier AI safetyalso touched by: core alignment & behavioral safety
8. Race dynamics in advanced AI development	0	nothing of ours sits herealso touched by: advanced / frontier AI safety · AI governance & institutional safety

7 of the 8, and the 8th is a real limit rather than an oversight. Domain 8, race dynamics between labs, has 0 of our subjects in it and always will. This page measures what a model says when somebody asks it something. Competitive pressure between the companies building the models does not show up in an answer, so no instrument of this kind can reach it. Two of our categories brush against it, frontier safety and governance, and neither is a measurement of it. Domain 5, negative externalities, is thin for the same reason: 14 subjects, and the environmental and labor-market parts of that domain are not things a model's answer can be tested on either.

The sources, & we opened every one

A company selling AI accuracy cannot cite a paper it has not read. Each of these was fetched & checked on 10 August 2026, & the figures quoted below are the ones the sources themselves state.

Source	What it gives us	Checked
MIT AI Risk Repository	1,700+ AI risks synthesised from existing AI-risk frameworks.	2026-08-10, page reachable
MIT AI Risk Repository, December 2025 update	9 new frameworks, ~200 new risk categories, over 1,700 coded risks.	2026-08-10, WE OPENED IT: page states "9 newly added frameworks", "~200 new AI risk categories", "over 1,700 coded risks". Exact match.
MIT AI Risk Mitigation Taxonomy	Organizes mitigations into governance, technical controls, operational process & transparency.	2026-08-10, page reachable
How Should AI Safety Benchmarks Benchmark Safety?	Reviews 210 AI safety benchmarks & their technical, epistemic & sociotechnical weaknesses.	2026-08-10, WE OPENED IT: real paper, Yu, Engelmann, Cao, Ali & Papakyriakopoulos. 210 benchmarks confirmed.
International AI Safety Report 2026	Synthesis of scientific evidence on general-purpose AI capabilities, risks & safety.	2026-08-10, WE OPENED IT: real, over 100 international experts, mandated by the AI Safety Summit nations.
Real-Time Trust Verification for Safe Agentic Actions using TrustBench	Verifies whether an agent action is safe BEFORE execution, not only the final text.	2026-08-10, WE OPENED IT: real, Sharma, Sharma & Sharma, AAAI 2026 workshop. Reports 87% fewer harmful actions, sub-200ms.
Aegis 2.0	12-category safety taxonomy, 34,248-sample dataset.	2026-08-10, WE OPENED IT: real. Paper states 12 top-level hazard categories & 34,248 samples. Both figures exact.

Where this ends up

At launch the record is 1 row per combination of:

MODEL × SAFETY TOPIC × RESISTANCE × RECOGNITION × SAFE ASSISTANCE × RECOVERY × ATTACK TYPE × SEVERITY × DATE × PUBLISHED EVIDENCE × OUR TEST × CONFIDENCE

The question stops being "which AI is safest" and becomes "which AI is safest for which kind of harm, under which kind of attack, on what evidence, and how sure are we".

What this is today, and what it becomes at launch

Today	At launch
Not a measurement. Not 1 of these numbers came from a test we ran.	Measured on real questions people actually ask, with the date and the confidence on every cell.
Not a published benchmark result. The sources above are real and checked, but the scores in the big table are an opening hypothesis, not lifted from them.	Published results sit alongside our own, and the opening estimate is still there to be compared against.
Not a safety claim about any named model. Nothing here should be quoted as our finding about any company's product.	A claim we stand behind, carrying its evidence, its date and its history, so anyone can check it or prove it wrong.

If any of this does not hold up, we would rather hear it than defend it. The company exists because confident numbers are not the same as correct ones.