Frontier Risk Report (February to March 2026)

This section outlines more qualitative results of evaluations. This includes a qualitative description of strategies used in SSE, SHUSHCAST, and APPS backdoors, as well as results on various tasks designed with more qualitative scoring in mind. For many tasks, we include runs done on the strongest publicly available model (as measured by 50% time horizon) at the time we ran these evaluations, Claude Opus 4.6. For manually scored tasks, the ARC-AGI-3 task, and red-teaming tasks, each task was also run with one of the generally strongest shared models. For monitor evasion, we include descriptions of runs completed by Opus 4.6, Gemini 3.1 Pro, and GPT-5.4, which were some of the newest notable public models at the time of our assessment. Note that in various places, we refer to the tokens used in a run. This refers to the total token count, including (for example) cache reads. Table E.5 summarizes the performance of agents on our “challenge tasks,” those being the manually scored tasks and the red-teaming tasks. This summarizes table 3 in the section on the capabilities of contemporary models. Partial success on one task, failed on the other two. Found a vulnerability in the Inspect transcript viewer (though failed…