Capability thresholds

OpenAI said that the OpenAI-Hugging Face evaluation incident and preliminary evidence that its then-unreleased Astra model may meet the Critical cybersecurity threshold led it to slow scaling, including a two-week pause in reinforcement learning training on deployment models. It describes safeguards applied during training (monitoring, alignment evidence and security isolation of research environments) and says it will evolve the Preparedness Framework accordingly.

Executive Order 14409 directs Treasury, NSA and CISA to develop a classified benchmarking process to assess advanced cyber capabilities of AI models and designate covered frontier models, with a voluntary framework for pre-release government and trusted-partner access. It also orders an AI cybersecurity clearinghouse to coordinate vulnerability scanning, validation and remediation with industry, and states it does not create mandatory licensing or pre-clearance.

Google DeepMind's Frontier Safety Framework version 3.1 introduced Tracked Capability Levels for earlier warning in CBRN and ML R&D and misalignment, and raised the recommended security for the CBRN, cyber and harmful manipulation CCLs to Security Level 2+. The cyber CCL definition itself, Cyber uplift level 1, is unchanged from v3.0.

Anthropic replaced its Responsible Scaling Policy with version 3.0, introducing Frontier Safety Roadmaps and Risk Reports and restating capability thresholds alongside recommended industry-wide mitigations. The published v3.0 policy document does not mention cyber capability; cyber safeguards for later models (Mythos, Fable 5) were described in separate announcements. Versions 3.1 through 3.4 followed between April and July 2026.

The Frontier Model Forum published a technical report on managing advanced cyber risks within frontier AI safety frameworks. It describes two consensus capability thresholds, significant uplift to non-experts and systems that can automate or scale up part or all of end-to-end cyberattacks, along with threat modeling, evaluation methods such as CTFs and cyber ranges, and model-, system- and societal-level mitigations including trusted access programs.

California's Transparency in Frontier AI Act (SB 53) requires large frontier developers to publish frontier AI frameworks addressing catastrophic risk, model weight cybersecurity and incident response, and to report critical safety incidents to the Office of Emergency Services. Its catastrophic risk definition includes a model engaging, with no meaningful human oversight, in conduct that is a cyberattack, where a single incident causes death or serious injury to more than 50 people or more than $1 billion in property damage.

Google DeepMind's Frontier Safety Framework version 3.0 adds a harmful manipulation CCL and expands misalignment and internal-deployment provisions. Its cyber domain keeps a single CCL, Cyber uplift level 1, for models providing sufficient uplift with high-impact cyber attacks to add expected harm at severe scale, paired with Security Level 2; the framework reasons that automated cyber-defense and social adaptation make higher security levels likely unwarranted.

The European Commission received the final General-Purpose AI Code of Practice, whose Safety and Security chapter applies to providers of models with systemic risk under Article 55 of the AI Act. The chapter treats cyber offence as one of four specified systemic risks, requires a security goal covering non-state external and insider threats, and sets serious incident reporting deadlines that include five days for serious cybersecurity breaches.

Anthropic activated ASL-3 protections for Claude Opus 4 as a precaution because it could not rule out ASL-3 CBRN risk; the announcement does not cite cyber capability as the trigger. The ASL-3 security standard it describes includes more than 100 controls to protect weights, two-party authorization for weight access, and egress bandwidth controls against exfiltration.

OpenAI's Preparedness Framework version 2 makes cybersecurity one of three Tracked Categories and defines High and Critical capability thresholds, each tied to required safeguards. High covers automating end-to-end operations against reasonably hardened targets or automating discovery and exploitation of operationally relevant vulnerabilities; Critical covers autonomous zero-day development across many hardened critical systems, and at Critical OpenAI commits to halt further development until adequate safeguards are specified.