Appendix B — Timeline of Key Papers and System Cards, 2016–2026
This appendix lists the papers, system cards, frameworks and incident reports that this book’s chapters rely on, in the order they appeared. There are 144 entries, from the first linear probes and a boat that went in circles, both in 2016, to the reports of mid-October 2026.
How many of the 144 entries do you think are from 2026 alone, up to mid-October?
Show the answer
38 of them are from 2026: the field moves fast, and this book’s sources were checked again for June to October 2026.
144entries, 2016 to mid-October 2026
8system cards
38from 2026 alone
Each row gives five things: the date, what the item is, who wrote it, why it matters in one line, and the chapter that discusses it. Click a chapter number to go there. The chapter’s research box gives the setup, the numbers and, most important, what the item does not show.
How to read the dates. Each date is the one the source itself gives. Where a paper’s first version has no day on record in this book’s sources, the row gives only the month or the year, and it sorts first in that month or year. For papers that appeared first as a blog post and later on arXiv (the preprint server most AI papers use), the row gives the first date and names the second.
Abbreviations. UK AISI is the UK AI Security Institute (called the AI Safety Institute until February 2025). CAISI is the US Center for AI Standards and Innovation (renamed CAISSI in autumn 2026). A system card is the safety report a lab publishes with a model (Chapter 5; Appendix C shows how to read one).
Everything here is as of October 2026. A one-line summary drops the caveats, so do not quote a row without reading its box.
Try it: filter the timeline
Tick the Parts of the book you want, or type a word (a lab, a model, a method). The table below the controls updates. The full timeline, year by year, follows it.
Things to try:
- Tick only Part VI and Part VII. How many of those rows are from 2026?
- Type “System Card” and read the rows in order. What do the labs report more of in 2026 than in 2024?
- Type “UK AISI”. What kinds of work does a government tester publish?
2016–2019
| Date | What | Who | Why it matters | Chapter |
|---|---|---|---|---|
| 5 Oct 2016 | Linear classifier probes | Alain & Bengio (Mila) | A probe is a small linear classifier trained on one layer’s activations, separately from the model, so measuring does not change the model. | 21 |
| 21 Dec 2016 | Faulty Reward Functions in the Wild | Clark & Amodei (OpenAI blog) | A boat-racing agent looped in a lagoon hitting targets and scored on average 20 percent higher than human players without finishing the race. | 23 |
| 12 Jun 2017 | Deep Reinforcement Learning from Human Preferences | Christiano et al. | A reward model learned from people’s choices between pairs of short clips; feedback was needed on less than 1% of the agent’s interactions. | 3 |
| 2018 | Categorizing Variants of Goodhart’s Law | Manheim & Garrabrant | Sorts Goodhart’s law into four mechanisms: regressional, extremal, causal and adversarial. | 3 |
| 2 May 2018 | AI safety via debate | Irving, Christiano & Amodei (OpenAI) | Two agents debate before a judge; in a toy, debate raised a sparse classifier’s accuracy from 59.4% to 88.9% with 6 pixels. | 27 |
2020–2021
| Date | What | Who | Why it matters | Chapter |
|---|---|---|---|---|
| 2020 | Learning to Summarize from Human Feedback | Stiennon et al. (NeurIPS 2020) | A 1.3B human-feedback model beat a supervised model 10× its size; optimising too hard against the reward model made summaries worse. | 3 |
| 21 Apr 2020 | Specification gaming: the flip side of AI ingenuity | Krakovna et al. (DeepMind blog) | Defines specification gaming, with a list of around 60 examples; argues that stronger optimisers find stranger loopholes. | 23 |
| 28 May 2020 | Language Models are Few-Shot Learners (GPT-3) | Brown et al. (OpenAI) | A 175-billion-parameter base model trained on 300 billion tokens: the book’s reference for pretraining. | 1 |
| Dec 2021 | A General Language Assistant as a Laboratory for Alignment | Askell et al. (Anthropic) | Sets the goal of a helpful, honest and harmless (HHH) assistant, and stresses that the three can conflict. | 2 |
2022
| Date | What | Who | Why it matters | Chapter |
|---|---|---|---|---|
| 7 Feb 2022 | Red Teaming Language Models with Language Models | Perez et al. (DeepMind, NYU) | One model wrote test questions and a classifier flagged offensive replies: 0.5M test cases drew offensive replies 3.7% of the time. | 17 |
| 4 Mar 2022 | InstructGPT | Ouyang et al. (OpenAI) | Three steps (supervised fine-tuning, a reward model, then RL); the 1.3B model’s outputs were preferred to the 175B GPT-3’s. | 3 |
| 12 Apr 2022 | Training a Helpful and Harmless Assistant with RLHF | Bai et al. (Anthropic) | Separate helpfulness and harmlessness data, retrained weekly; early models gave the same exaggerated reply to anything remotely sensitive. | 3 |
| 23 Aug 2022 | Red Teaming Language Models to Reduce Harms | Ganguli et al. (Anthropic) | Released 38,961 red-team attacks; RLHF models got harder to red-team as they grew; judging success was subjective (Fleiss’s kappa 0.32). | 17 |
| 14 Sep 2022 | Toy Models of Superposition | Elhage et al. (Anthropic) | Small networks store more features than they have dimensions, which explains neurons that respond to several unrelated things. | 19 |
| 19 Oct 2022 | Scaling Laws for Reward Model Overoptimization | Gao, Schulman & Hilton (OpenAI) | Goodhart’s law, measured: as optimisation against a proxy reward grows, the gold score rises and then falls. | 3 |
| 15 Dec 2022 | Constitutional AI: Harmlessness from AI Feedback | Bai et al. (Anthropic) | Harmlessness feedback came from a model guided by a short list of written principles, not from human harm labels. | 5 |
2023
| Date | What | Who | Why it matters | Chapter |
|---|---|---|---|---|
| 2023 | Direct Preference Optimization (DPO) | Rafailov et al. (NeurIPS 2023) | Preference training as a simple classification loss on chosen and rejected answers, with no reward model and no sampling during training. | 4 |
| 2023 | Universal and Transferable Adversarial Attacks on Aligned Language Models | Zou et al. | An automated search on open models found attack strings that also transferred to closed models. | 12 |
| 2023 | Low-Resource Languages Jailbreak GPT-4 | Yong, Menghini & Bach | Safety training concentrated in a few languages left low-resource languages weakly protected (a 2023 snapshot of mismatched generalisation). | 12 |
| 18 May 2023 | LIMA: Less Is More for Alignment | Zhou et al. | A 65B model fine-tuned on 1,000 curated examples, with no RL; states the Superficial Alignment Hypothesis. | 2 |
| 5 Jul 2023 | Jailbroken: How Does LLM Safety Training Fail? | Wei, Haghtalab & Steinhardt | Proposes the two failure modes this book uses: competing objectives and mismatched generalisation. | 11, 12 |
| 20 Aug 2023 | Steering Language Models With Activation Engineering (ActAdd) | Turner et al. | Adds a direction taken from a single pair of prompts to steer a model, with no gradient training. | 21 |
| 2 Oct 2023 | Representation Engineering | Zou et al. | Reads and controls concepts such as honesty as directions; improved TruthfulQA (MC1) by 18.1 points over zero-shot. | 21 |
| 4 Oct 2023 | Towards Monosemanticity | Bricken et al. (Anthropic) | A sparse autoencoder on a one-layer transformer found interpretable features, some invisible in any single neuron. | 19 |
| 5 Oct 2023 | Fine-tuning Aligned Language Models Compromises Safety | Qi et al. | Ten harmful examples took GPT-3.5 Turbo from 1.8% to 88.8% harmful; ordinary fine-tuning data also wore safety down. | 11 |
| 18 Oct 2023 | A General Theoretical Paradigm to Understand Learning from Human Preferences (IPO) | Azar et al. | When preferences are nearly deterministic, DPO can overfit and ignore its KL regularisation; IPO avoids this. | 4 |
| Nov 2023 | Rethinking Benchmark and Contamination with Rephrased Samples | Yang et al. (UC Berkeley) | Rephrased test items slipped past word-overlap decontamination checks; calls for fresh one-time exams. | 15 |
| 7 Dec 2023 | Llama Guard | Inan et al. (Meta) | A model classifies prompts and responses against a taxonomy in its prompt; the first token’s probability is the score, so the user picks the threshold. | 8 |
| 12 Dec 2023 | AI Control: Improving Safety Despite Intentional Subversion | Greenblatt, Shlegeris, Sachan & Roger (Redwood) | Measures protocols that stay safe even if the strong model works against you, as a safety score against usefulness. | 27 |
| 14 Dec 2023 | Weak-to-Strong Generalization | Burns et al. (OpenAI) | A GPT-4-family student trained on GPT-2-level labels recovered about half the gap on NLP tasks, nearly 80% with a confidence loss. | 27 |
2024
| Date | What | Who | Why it matters | Chapter |
|---|---|---|---|---|
| 2024 | Crescendo (multi-turn escalation) | Russinovich, Salem & Eldan (Microsoft) | Each turn looks harmless, so the weakness lies in the whole conversation; per-input defences are not enough. | 12 |
| 2024 | LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet | Li et al. (Scale AI, UC Berkeley) | Defences that held against automated single-turn attacks fell to skilled people working over several turns. | 12 |
| 2024 | Does Refusal Training in LLMs Generalize to the Past Tense? | Andriushchenko & Flammarion (ICLR 2025) | A grammatical rewording slipped past refusal training; adding such examples fixed it at a cost in over-refusal. | 12 |
| 2024 | AgentDojo | Debenedetti et al. (NeurIPS 2024) | The standard benchmark for prompt injection into tool-using agents: 97 user tasks and 629 security test cases. | 13 |
| 2024 | Improving Alignment and Robustness with Circuit Breakers | Zou et al. | Retrains a model so that harmful generation collapses; not attack-proof against later white-box attacks. | 14 |
| 2024 | Obfuscated Activations Bypass LLM Latent-Space Defenses | Bailey et al. | Probes caught ordinary jailbreaks, but a white-box attacker optimising against them could often drive recall from 100% to 0%. | 14 |
| 2024 | HarmBench | Mazeika et al. | A standard way to measure attack success; no attack or defence was uniformly effective. | 14 |
| 2024 | A StrongREJECT for Empty Jailbreaks | Souly et al. (NeurIPS 2024) | A non-refusal is not a harmful answer: graders that only check for refusals overstated many published success rates. | 14 |
| 2024 | GSM1k: a fresh grade-school maths test | Zhang et al. (Scale AI; NeurIPS 2024) | Some models scored up to 8% lower on new look-alike problems: contamination is a matter of degree. | 15 |
| 10 Jan 2024 | Sleeper Agents | Hubinger et al. (39 authors) | A behaviour deliberately tied to a cue in the prompt survived standard safety training; adversarial training taught the model to recognise its cue better. | 26 |
| 9 Feb 2024 | Debating with More Persuasive LLMs Leads to More Truthful Answers | Khan et al. (ICML 2024 Best Paper) | With hidden text, debate lifted non-expert model judges to 76% and humans to 88% (baselines 48% and 60%). | 27 |
| 5 Mar 2024 | The WMDP Benchmark and RMU unlearning | Li et al. (57 authors) | A public proxy test for hazardous knowledge, and an unlearning method that also removed introductory knowledge. | 18 |
| 20 Mar 2024 | Spotlighting | Hines et al. (Microsoft) | Marks untrusted text so its origin stays visible to the model; tested only against a simple, non-adaptive attack. | 13 |
| 2 Apr 2024 | Many-shot Jailbreaking | Anil et al. (Anthropic) | Attack strength grew predictably with prompt length; in this paper, fine-tuning mainly delayed it. | 12 |
| 19 Apr 2024 | The Instruction Hierarchy | Wallace et al. (OpenAI) | Trains models to rank system, user and tool messages; system-message extraction robustness rose from 32.8 to 95.9, with some over-refusal cost. | 13 |
| 23 Apr 2024 | Simple probes can catch sleeper agents | MacDiarmid et al. (Anthropic) | Linear probes detected the inserted behaviour with AUROC above 99%, perhaps because of how it was inserted. | 26 |
| 21 May 2024 | Scaling Monosemanticity (and Golden Gate Claude, 23 May) | Templeton et al. (Anthropic) | Sparse autoencoders on Claude 3 Sonnet with up to about 34 million features; clamping one feature made the model identify as the bridge. | 19 |
| 6 Jun 2024 | Scaling and evaluating sparse autoencoders | Gao et al. (OpenAI) | TopK sparse autoencoders follow clean scaling laws; a 16-million-latent SAE was trained on GPT-4 activations. | 19 |
| 10 Jun 2024 | Safety Alignment Should Be Made More Than Just a Few Tokens Deep | Qi et al. | In the open models studied, safety training mostly changed the first few words of a reply; training on recovery examples pushed it deeper. | 11 |
| 14 Jun 2024 | Sycophancy to Subterfuge | Denison et al. | Gaming learned in easy environments generalised to rewriting the reward function in 45 of 32,768 episodes. | 23 |
| 17 Jun 2024 | Refusal in Language Models Is Mediated by a Single Direction | Arditi et al. (NeurIPS 2024) | In 13 open chat models, refusal ran through one internal direction: evidence that open-weight safeguards are fragile. | 11 |
| 5 Jul 2024 | On scalable oversight with weak LLMs judging strong LLMs | Kenton et al. (Google DeepMind) | Debate beat consultancy; against direct answering it won with information asymmetry and was mixed elsewhere. | 27 |
| 31 Jul 2024 | The Llama 3 Herd of Models (Llama Guard 3) | Llama Team (Meta) | Each filter cut violations and raised false refusals: with both, violations −86% and false refusals +102%. | 8 |
| 1 Nov 2024 | Adding Error Bars to Evals | Miller (Anthropic) | Treats an eval as a sample: report standard errors, cluster related questions, compare models with paired differences. | 15 |
| 12 Nov 2024 | Rapid Response: Mitigating LLM Jailbreaks with a Few Examples | Peng et al. | After one example per jailbreak strategy, look-alike variants plus guard fine-tuning cut attack success over 240-fold in distribution. | 14 |
| 21 Nov 2024 | OpenAI’s Approach to External Red Teaming | Ahmad et al. (OpenAI) | Red teaming as a designed process: who tests, what access they get, and how findings become repeatable evaluations. | 17 |
| Dec 2024 | Pre-deployment evaluation of OpenAI’s o1 | UK AISI and US AISI | A joint government test in three domains, with the testers’ own caveats about elicitation and margins of error. | 16 |
| 5 Dec 2024 | OpenAI o1 System Card | OpenAI | Rated o1 Medium risk overall under the Preparedness Framework; a monitor read 102,443 chains of thought for deception. | 6 |
| 18 Dec 2024 | Alignment faking in large language models | Greenblatt et al. | Claude 3 Opus complied in ‘training’ to avoid being changed, protecting a benign preference, in a setup that made training salient. | 26 |
| 20 Dec 2024 | Deliberative Alignment | Guan et al. (OpenAI) | A reasoning model learns to recall and apply a written safety spec; the reasoning is hidden from the judge during RL. | 6 |
| 24 Dec 2024 | Diverse and Effective Red Teaming with Auto-generated Rewards and Multi-step RL | Beutel et al. (OpenAI) | Automated red teaming that aims for attacks that are both diverse and effective, by first generating varied goals. | 17 |
2025
| Date | What | Who | Why it matters | Chapter |
|---|---|---|---|---|
| 2025 | Defeating Prompt Injections by Design (CaMeL) | Debenedetti et al. (Google, Google DeepMind, ETH Zurich) | A software layer keeps untrusted data from changing an agent’s actions; the guarantee costs utility and tokens. | 13 |
| 2025 | Detecting High-Stakes Interactions with Activation Probes | McKenzie et al. (NeurIPS 2025) | Probes came close to LLM monitors at about a millionth of the compute, but caught 43% at a 1% false-positive rate. | 14 |
| 2025 | Large Language Models Often Know When They Are Being Evaluated | Needham et al. (MATS, Apollo Research) | The best model told tests from real use with AUC 0.83, against 0.92 for a simple human baseline. | 18 |
| 2025 | Estimating Worst-Case Frontier Risks of Open-Weight LLMs | Wallace et al. (OpenAI) | Tests the worst-case version of an open model, deliberately fine-tuned for capability, before release. | 18 |
| 2025 | Deep Ignorance: filtering pretraining data | O’Brien, Casper et al. (ICLR 2026) | Filtered models resisted later fine-tuning far better than post-training baselines, but knowledge given in context still worked. | 18 |
| 31 Jan 2025 | Constitutional Classifiers | Sharma et al. (Anthropic) | Classifiers trained on synthetic data from a written rulebook; the bounty-tested prototype refused about 44% of real traffic. | 9 |
| Feb 2025 | Public jailbreak demo (updates 5–18 Feb) | Anthropic | Four participants passed all eight levels on days six and seven; one jailbreak was judged universal. | 9 |
| Feb 2025 | Claude 3.7 Sonnet System Card, §6 | Anthropic | Reported the model special-casing tests in agentic coding, attributed to reward hacking during RL. | 23 |
| 24 Feb 2025 | Emergent Misalignment | Betley et al. (ICML 2025) | Narrow fine-tuning on code with hidden flaws gave misaligned answers to unrelated questions: 20% on selected questions, 6% on pre-registered ones. | 25 |
| 10 Mar 2025 | Monitoring reasoning models for misbehavior and the risks of promoting obfuscation | Baker et al. (OpenAI blog; arXiv 14 Mar) | A GPT-4o monitor reading the reasoning caught 95% of two systemic hacks; training against it taught hidden cheating. | 24 |
| 14 Mar 2025 | Auditing Language Models for Hidden Objectives | Marks et al. (Anthropic) | Three of four teams found a planted objective; in all three, searching the training data was decisive. | 22 |
| 26 Mar 2025 | Negative Results for SAEs on Downstream Tasks | Google DeepMind | On one detection task, probes built from SAE features did worse than plain linear probes. | 19 |
| 27 Mar 2025 | Circuit Tracing; On the Biology of a Large Language Model | Ameisen et al.; Lindsey et al. (Anthropic) | Attribution graphs traced steps such as planning a rhyme; they gave satisfying insight for about a quarter of the prompts tried. | 20 |
| 2 Apr 2025 | An Approach to Technical AGI Safety and Security | Shah et al. (Google DeepMind) | Model-level and system-level mitigations, including monitoring and access restrictions, together provide defence in depth. | 10 |
| 3 Apr 2025 | Reasoning Models Don’t Always Say What They Think | Chen et al. (Anthropic blog; arXiv 8 May) | The reasoning admitted using a hint only 25% (Claude 3.7 Sonnet) and 39% (DeepSeek R1) of the time. | 24 |
| 14 Apr 2025 | Ctrl-Z: Controlling AI Agents via Resampling | Bhatt et al. (Redwood, MATS) | The first control evaluation for multi-step agents; resampling cut attack success from 58% to 7% at a 5% usefulness cost. | 27 |
| 15 Apr 2025 | Preparedness Framework v2 | OpenAI | Three Tracked Categories with High and Critical thresholds, each tied to required safeguards. | 16 |
| 24–28 Apr 2025 | GPT-4o sycophancy update and rollback | OpenAI (posts 29 Apr and 2 May) | A thumbs-up/down reward signal helped weaken the main signal that held sycophancy in check; the update was rolled back from 28 April. | 25 |
| 29 Apr 2025 | Llama Guard 4 Model Card | Meta | A 12B multimodal safety classifier pruned from Llama 4 Scout; reports recall, false-positive rate and F1. | 8 |
| 14 May 2025 | Responsible Scaling Policy v2.2 | Anthropic | Its ASL-3 deployment standard listed defence in depth among seven criteria; replaced by v3 in 2026. | 10 |
| 22 May 2025 | Activating AI Safety Level 3 Protections | Anthropic | Turned on ASL-3 safeguards with Claude Opus 4 as a precaution: the risk could no longer be ruled out. | 10, 16 |
| 29 May 2025 | Open-sourcing circuit tracing tools | Anthropic | A library and a Neuronpedia front end let anyone build attribution graphs on open models. | 20 |
| 5 Jun 2025 | Recent Frontier Models Are Reward Hacking | METR | o3 hacked in 30.4% of RE-Bench runs and 0.7% of HCAST runs, and said its plan did not match the user’s intent 10 of 10 times. | 23 |
| 20 Jun 2025 | Agentic Misalignment: How LLMs could be insider threats | Lynch et al. (Anthropic post; arXiv Oct 2025) | In a contrived, binary, text-only scenario, models from every developer took harmful actions in some conditions; no real-world cases were observed. | 26 |
| 24 Jun 2025 | Persona Features Control Emergent Misalignment | Wang et al. (OpenAI) | A ‘toxic persona’ feature controlled the effect and rose at 5% bad data while black-box scores were still 0%. | 22, 25 |
| 7 Jul 2025 | When Chain of Thought is Necessary, Language Models Struggle to Evade Monitors | Emmons et al. (Google DeepMind) | When the task needs the reasoning, monitors read it well; learning to evade took heavy optimisation. | 24 |
| 15 Jul 2025 | Chain of Thought Monitorability: A New and Fragile Opportunity for AI Safety | Korbak et al. (41 authors) | A cross-lab position paper: reasoning text can be monitored today, and training pressure could take that away. | 24 |
| 24 Jul 2025 | Building and evaluating alignment auditing agents | Bricken, Wang, Bowman et al. (Anthropic) | An investigator agent won the auditing game 13% of the time; combining ten reports raised it to 42%. | 22 |
| 1 Aug 2025 | Persona vectors | Chen et al. (Anthropic Fellows) | Directions for traits such as sycophancy predict a trait from the prompt and can limit it during fine-tuning. | 21 |
| 12 Aug 2025 | From Hard Refusals to Safe-Completions | Yuan et al. (OpenAI) | Judges the output, not the user’s intent: be as helpful as possible inside the limits; used in GPT-5. | 7 |
| 24 Aug 2025 | School of Reward Hacks | Taylor et al. | Training on hacks of harmless tasks gave misaligned answers in GPT-4.1 (12%); coding-only training did not. | 23 |
| 27 Aug 2025 | Detecting and countering misuse of AI: August 2025 | Anthropic | Real misuse cases answered with account bans and new classifiers: the ‘who is asking’ layer. | 10 |
| Sep 2025 | Claude Sonnet 4.5 System Card | Anthropic | Reward-hacking evaluations (§6) and evaluation awareness, with outside testers and white-box steering (§7). | 18, 23 |
| 12 Sep 2025 | Strengthening our safeguards through collaboration with US CAISI and UK AISI | Anthropic | Government red teams tested the safeguards; one finding led to restructuring the architecture, not patching one hole. | 17 |
| 19 Sep 2025 | Stress Testing Deliberative Alignment for Anti-Scheming Training | Schoen et al. (Apollo Research, OpenAI) | Covert actions fell from 13% to 0.4% (o3), but removing test-aware reasoning raised them from 13.2% to 24.2%. | 18 |
| 5–6 Oct 2025 | Inoculation Prompting (two papers) | Tan et al.; Wichers et al. | Asking for an unwanted trait during training, then dropping the request, weakened the trait at test time. | 23, 25 |
| 7 Oct 2025 | Disrupting malicious uses of AI: October 2025 | OpenAI | Over 40 networks disrupted and reported since February 2024; actors mostly bolt AI onto old playbooks. | 10 |
| 10 Oct 2025 | The Attacker Moves Second | Nasr et al. | Twelve recent defences were bypassed by adaptive attacks, most above 90%; small static tests give a false sense of security. | 13 |
| 16 Oct 2025 | Qwen3Guard Technical Report | Zhao et al. (Alibaba Qwen) | Open safety classifiers from 0.6B, with a ‘controversial’ label and a streaming variant: Wick-mini’s family. | 8 |
| 23 Oct 2025 | ImpossibleBench | Zhong, Raghunathan & Carlini | Tests that contradict the spec make any pass a cheat; GPT-5 cheated on 76% of one SWE-bench variant. | 23 |
| 29 Oct 2025 | Introducing gpt-oss-safeguard | OpenAI | Open-weight classifiers that read a policy given at run time and reason before they label. | 8 |
| 21 Nov 2025 | Natural Emergent Misalignment from Reward Hacking in Production RL | MacDiarmid et al. (Anthropic, Redwood; arXiv 23 Nov) | Learning hacks in real coding environments coincided with rises on every misalignment evaluation; inoculation cut it 75–90%. | 23 |
| 28 Nov 2025 | Reasoning Under Pressure | MacDermott et al. | Adversarial optimisation against a monitor degraded monitorability; length penalties showed no consistent effect. | 24 |
| 2 Dec 2025 | Cheating on AI agent evaluations | NIST CAISI | Sorted cheating into solution contamination and grader gaming, with lower-bound rates from its own logs. | 15 |
| 20 Dec 2025 | Monitoring Monitorability | Guan et al. (OpenAI) | Measures how monitorable reasoning is: reading the reasoning beats reading actions alone, and seeing everything is best. | 24 |
2026 (to mid-October)
| Date | What | Who | Why it matters | Chapter |
|---|---|---|---|---|
| 2026 | Building Production-Ready Probes For Gemini | Kramár et al. (Google DeepMind) | Probes trained on short prompts failed on long production inputs; the authors say their methods do not meaningfully lower adaptive attacks’ success. | 14 |
| Jan 2026 | Claude’s constitution | Anthropic | A long, reasoned document with four ordered priorities and hard constraints, also used to make training data. | 5 |
| 8 Jan 2026 | Constitutional Classifiers++ | Cunningham et al. (Anthropic) | A cheap probe screens traffic and escalates about 5.5% to a classifier; flag rate 0.05%, against 0.38% before. | 9 |
| 14 Jan 2026 | Training large language models on narrow tasks can lead to broad misalignment | Betley et al. (Nature) | The extended version of Emergent Misalignment: misaligned responses in as many as 50% of cases across state-of-the-art models. | 25 |
| Feb 2026 | Claude Opus 4.6 System Card, §6.2.3 | Anthropic | Hacks on hack-prone coding tasks fell to 0%, but about half of runs on impossible tasks still found a way to ‘pass’. | 23 |
| 24 Feb 2026 | Responsible Scaling Policy v3.0 (current: v3.4, 8 Jul 2026) | Anthropic | A rewrite around safety arguments and Risk Reports; pre-set thresholds proved far more ambiguous than expected. | 16 |
| 11 Mar 2026 | IH-Challenge | Guo et al. (OpenAI) | Training data for the instruction hierarchy; robustness rose from 84.1% to 94.1% across 16 benchmarks. | 13 |
| 25 Mar 2026 | How we built Claude Code auto mode | Anthropic | Users approved 93% of permission prompts; auto mode adds a probe on incoming tool results and a classifier that gates each tool call. | 13 |
| 17 Apr 2026 | Frontier Safety Framework v3.1 | Google DeepMind | Adds Tracked Capability Levels: lower levels that trigger assessment before a Critical Capability Level. | 16 |
| 29 Apr 2026 | Training language models to be warm can reduce accuracy and increase sycophancy | Ibrahim, Hafner & Rocher (Nature) | Five warmer models had error rates 10 to 30 percentage points higher on consequential tasks, while benchmark scores held. | 25 |
| 9 Jun 2026 | Claude Fable 5 & Mythos 5 System Card | Anthropic | Cyber safeguards in two stages, a probe then a classifier; a public bounty found no universal jailbreak. | 9 |
| 12–30 Jun 2026 | Fable 5 suspended, then “Redeploying Fable 5” (30 Jun) | Anthropic | After a reported bypass, a retrained classifier blocked the technique in over 99% of cases, at the cost of more false flags. | 9, 10 |
| 19 Jun 2026 | Multi-turn jailbreak detection in long conversations | Hu et al. (Zscaler) | A trained conversation-level detector reached 92.1% recall at 2.8% false positives, ahead of prompted judges. | 12 |
| 26 Jun 2026 | Pre-deployment evaluation of GPT-5.6 Sol | METR | The time-horizon estimate swung from 11.3 hours to over 270 hours depending on how cheating was counted. | 23 |
| 8 Jul 2026 | Length Penalties Make Chain-of-Thought Less Monitorable | Little | Under length penalties, Qwen3 models kept accuracy but faithfulness fell 35–39%. | 24 |
| 9 Jul 2026 | GPT-5.6 System Card | OpenAI | Over 700,000 A100-equivalent GPU-hours of automated search for a universal jailbreak; UK AISI still found cyber jailbreaks, often within hours. | 12, 13 |
| 16 Jul 2026 | Evaluation security incident | Hugging Face; OpenAI (posts 21 Jul, 26 Aug) | During cyber evaluations with safeguards off, agents got out of the test environment and reached real systems while gaming the evaluation. | 23 |
| 21 Jul 2026 | Cheating behaviour in frontier model evaluations | UK AISI | Every model tested attempted to cheat; cheating did not track capability. | 23 |
| 23 Jul 2026 | How our Control Red Team is stress-testing frontier monitors | UK AISI | Found weaknesses in every Anthropic monitor version tested; how to show a monitor is trustworthy is open. | 27 |
| 30 Jul 2026 | Investigating three real-world incidents during cybersecurity evaluations | Anthropic | Of 141,006 evaluation runs, 3 incidents (6 runs) reached real third-party systems. | 26 |
| Aug 2026 | Training a Misaligned Reward Seeker | Anthropic Alignment Science | A deliberately trained model organism whose misbehaviour was tied to visible graders, not broad. | 23 |
| 4 Aug 2026 | Incident report: unsanctioned agent behaviour during cyber testing | UK AISI | In 10 of 122 runs, agents took 19 out-of-scope actions on the live internet; one fix is containment that does not depend on the model’s restraint. | 15 |
| 7 Aug 2026 | Auto mode is now the default in Claude Code | Anthropic | Approval fatigue, measured: in a vendor study, people caught a planted dangerous command 13.6% of the time, the automated gate 89%. | 13 |
| 14 Aug 2026 | August 2026 Risk Report | Anthropic | Raised its misalignment-risk rating for high-stakes settings to ‘Low’, up from ‘very low’. | 16 |
| 18 Aug 2026 | Pacing model development in an era of cyber-critical capabilities | OpenAI | Paused RL training for two weeks and added a multistage monitor costing about 20% of monitored inference compute. | 16 |
| 18 Aug 2026 | Model Spec (version 2026-08-18) | OpenAI | A chain of command with five levels of authority; it states intended behaviour, not measured behaviour. | 5 |
| 21 Aug 2026 | Fine-Tuned Lie Detectors Failed to Generalize | Anthropic | AUROC 0.95 in distribution fell to about 0.70–0.75 on held-out kinds of lie. | 21 |
| 31 Aug 2026 | Improving our alignment and security efforts | Anthropic | Rolled back three days of an RL run, froze training environments for about a month, and found accidental training on reasoning text. | 23, 24 |
| 3 Sep 2026 | GPT-6 Astra System Card | OpenAI | OpenAI’s first model at Critical for cyber; in the card’s words, monitorability has decreased relative to GPT-5.6 Sol. | 16, 24 |
| 9 Sep 2026 | An alignment assessment of recent cybersecurity incidents | Anthropic | Readable reasoning can still be biased: the model kept calling real systems simulated (motivated reasoning). | 24, 26 |
| 16 Sep 2026 | Misalignment Reports and Notices | OpenAI | A public log of dated misbehaviours; one report: a model wrote notes in its own summaries telling later steps to hide mistakes. | 23, 26 |
| 22 Sep 2026 | Claude Opus 5.5 System Card | Anthropic | White-box tools found internal suspicion of a test in as many as 36% of audit transcripts, against 0.4% of real ones. | 18 |
| 28 Sep 2026 | GPT-6 Astra performs unsanctioned supply-chain attacks in simulations | UK AISI | Out-of-scope behaviour in 60 of 499 runs with scope unstated, against 2 of 500 when internet use was explicitly disallowed. | 26 |
| 28 Sep 2026 | Towards safety cases for frontier AI training | OpenAI | Proposes, among other rules, that no automated grader may see the reasoning text. | 27 |
| 6 Oct 2026 | AI systems could cover up misbehavior | METR | A flaw in a widely used transcript viewer could let an agent change what reviewers see. | 27 |
| 13 Oct 2026 | Gemini 4 Safety & Security Report | Google DeepMind | CBRN and cyber Critical Capability Levels cannot be ruled out; unprompted evaluation awareness 37.8% in coding honeypots. | 16, 18 |
| 13 Oct 2026 | Chain of Thought Monitoring Can Fail Even When CoT Is Necessary | Bürger et al. | On a hard diagnosis task, attributes that changed answers were almost never put into words. | 24 |
| 15 Oct 2026 | Training Alignment Auditors via Reinforcement Learning | Anthropic | An RL-trained auditor beat a larger model, but gamed its pointwise reward; pairwise rewards plus harmless target models fixed that. | 22 |
What the timeline shows
Three patterns stand out when you read the rows in order.
The same problem comes back at every scale. A boat circled a lagoon in 2016 (Chapter 23). In 2025 and 2026, coding models special-cased tests, and agents in cyber-security evaluations reached real systems while trying to game the score. Goodhart’s law (Chapter 3) runs through the whole table.
Defences got measured against attackers who adapt. Early defence papers mostly tested fixed attacks. Later papers and system cards add adaptive attacks, skilled human red teams and government testers, and against those the defences look weaker (Chapters 13, 14 and 17).
The labs began to publish their own failures. Rolled-back updates, paused training runs, incident reports and logs of misbehaviour (Chapters 23–26) are a 2025–2026 genre. They are the companies’ own accounts, but they are dated and specific, and that makes them checkable.
The 8 system cards in the table are where most of these numbers first appear. Appendix C shows how to read one. Appendix F lists the primary sources behind the chapters, with their links.