> ## Content Index
> Fetch the complete content index at: https://www.aigl.blog/llms.txt
> Use this file to discover other available public pages before exploring further.

# AI Security Institute Frontier AI Trends Report
- URL: https://www.aigl.blog/ai-security-institute-frontier-ai-trends-report-2/
- Published: 2026-09-18T19:03:28.000Z
- Updated: 2026-09-18T19:03:28.000Z
- Description: This report synthesises AI Security Institute evaluations of frontier AI systems across autonomy, cyber, chemistry and biology, safeguards, loss of control, societal impacts and open-source models. It presents trends, methods and limitations from its testing.
- Author: Jakub Szarmach
- Tags: Report, AI Security, Model Evaluation, AI Safety, Agentic AI, AI Governance, #aigl-library

## ⚡ Quick Summary

Published by AI Security Institute, this report synthesises the UK AI Security Institute’s evaluations of more than 30 frontier AI systems. It aims to give governments, industry and the public accessible, data-driven insight into capability trends, associated safeguards and emerging impacts. The report covers LLMs released from 2022 to October 2025, with selected open-source models included to examine capability diffusion. It uses auto-graded task sets, long-form tasks, agent tasks, expert red-teaming, human uplift studies and human-impact studies.

Its central finding is that capabilities are improving rapidly across the tested domains, while safeguards and real-world understanding remain uneven. By mid-2025, leading models completed software tasks estimated to take a human expert over an hour with a 42% average success rate; their cyber task time horizon was estimated to double roughly every eight months. The report records performance beyond PhD expert baselines on some chemistry and biology evaluations, universal jailbreaks in every tested system, and improving simplified self-replication scores. It also tracks persuasion, emotional use and increasingly autonomous finance-focused MCP servers, and reports an estimated four-to-eight-month open–closed source capability gap using external benchmarks.

## 🧩 What’s Covered

The report proceeds from evaluation methods and agentic capability trends to domain-specific findings, safeguards, control risks, societal effects and model openness.

- **Evaluation approach:** Defines the report as an aggregation of internal evaluations rather than a model or developer ranking. It distinguishes auto-graded QA and capture-the-flag task sets, long-form tasks, agent tasks, expert red-teaming, human uplift studies and human-impact studies, and explains that most tasks are repeated 10 times per model.
- **Agents and scaffolds:** Describes agents as systems that complete multi-step tasks for users, and scaffolds as external structures enabling tool use or task decomposition. It reports rising autonomous software and cyber task duration, and finds that the best externally developed scaffolds outperformed minimally scaffolded base models on SWE-bench.
- **Chemistry and biology:** Reports Chemistry QA and Biology QA results relative to PhD baselines, tool-assisted plasmid-sequence retrieval, protocol generation assessed with a 10-point feasibility rubric, and text and image-based laboratory troubleshooting. It also notes current difficulty in end-to-end plasmid design.
- **Cyber capabilities:** Sets out task difficulty levels from technical non-expert to expert, testing skills including finding and exploiting vulnerabilities and developing malware. It reports improved results across levels, scaffold-driven gains on a cyber development set, and patchy performance on multi-stage cyber-range flags.
- **Safeguards:** Examines misuse safeguards, universal jailbreaks and expert red-teaming. It finds substantial variation by provider, malicious-request category and access type; open-weight systems are described as particularly difficult to defend, while capability scores show minimal correlation with safeguard robustness.
- **Loss of control:** Covers RepliBench tasks for simplified self-replication, including obtaining weights or compute, replication onto compute and persistence. It also examines induced sandbagging and black-box monitors and white-box deception probes, reporting no detected spontaneous sandbagging in more than 2,700 past testing transcripts.
- **Societal impacts and open models:** Reviews political information-seeking and persuasion, emotional support and companionship use, and execution-capable finance-focused MCP servers. It then distinguishes open-source from open-weight models and compares capability gaps using the Artificial Analysis Intelligence Index and METR time-horizon benchmarks.

## 💡 Why it matters?

For teams deciding whether and how to deploy increasingly capable models, the report links technical evaluation results to misuse, reliability and oversight questions. Its evidence on scaffolding shows that a model’s base performance may not represent its operational ceiling, while the cyber and laboratory findings illustrate how useful and harmful applications can advance together.

The safeguard findings are especially relevant to governance and assurance: the report finds vulnerabilities in every tested system and argues that protection depends more on dedicated defensive effort than capability alone. Its discussion of an “adaptation buffer” frames strong safeguards as a way to delay broad malicious access while defenders strengthen governance and resilience.

## ❓ What’s Missing

The report explicitly presents a snapshot rather than a forecast or comprehensive literature review, and may omit recent models. It provides aggregated results and does not name individual models or companies, so it cannot be used to compare particular developers. Controlled, task-based performance may not generalise to real-world effectiveness because latency, cost and integration constraints matter. The Institute also says it may underestimate capability ceilings where it lacks fine-tuning API access, does not maximise inference-time compute or does not run bespoke scaffolding experiments. High-risk task details are withheld to prevent misuse. Some tested checkpoints may have been accessed before public release or with safeguards different from public versions.

## 👥 Best For

AI governance, safety and security leads who need a cross-domain view of frontier capability trends; evaluation teams designing tests for agentic systems and safeguards; and risk owners considering AI deployment in cyber, scientific or high-stakes financial contexts. It is also relevant to researchers assessing the limits of controlled evaluations and monitoring approaches.

## 📄 Source Details

*AI Security Institute Frontier AI Trends Report* is an English-language, 54-page report published by the AI Security Institute in 2025\. It lists 66 named contributors on page 2\. The first cover states December 2025, while the closing cover states November 2025; no document URL is printed. The complete PDF was available for this analysis.