The International AI Safety Report 2026 was led by chair Yoshua Bengio, written by more than 100 experts, and backed by over 30 countries and international organizations. It is a scientific evidence review and does not endorse a particular regulatory approach.
Its most useful contribution is not a single risk score. It distinguishes where real-world evidence exists, where conclusions still depend on experiments or modeling, and why neither a single test nor a single safeguard can manage a rapidly changing general-purpose technology.
The core framework
The report puts risk evidence, capability uncertainty, and risk management in one framework. Risk categories can interact and their evidence bases differ, so a composite score cannot replace scenario-specific judgment.
| Category | Primary concern | How to read the evidence |
|---|---|---|
| Malicious use | Fraud, manipulation, cyberattacks, and misuse of biological or chemical information | Some harms are documented, but rates, severity, and the net balance between offense and defense remain uncertain |
| Malfunctions | Fabricated information, faulty code, misleading advice, agent failures, and deployment mismatch | Benchmark performance does not reliably predict real-world reliability |
| Systemic risks | Broad effects on labor, autonomy, information ecosystems, and dependence on critical systems | Long-term and causal evidence is limited, requiring continuing observation rather than one-time conclusions |
| Shared challenge | Emergent capability, limited interpretability, information asymmetry, and institutional coordination | Threat modeling, evaluation, incident reporting, and layered safeguards need to work together |
The evidence dilemma
General-purpose AI capability is improving faster than evidence about its real-world effects accumulates. Acting too early can entrench ineffective interventions, while waiting for certainty can remove the preparation window for serious harms.
The report addresses this by separating documented harm, controlled experiments, modeled scenarios, and theoretical possibilities, while making evidence gaps visible. That hierarchy is more useful than presenting every risk as equally certain.
Capability improves unevenly
Inference-time scaling and related methods improved performance in mathematics, software engineering, and science, yet leading systems still struggle with object counting, spatial reasoning, and recovery from basic errors in long workflows.
This jagged profile means success on difficult benchmarks does not establish suitability for medicine, critical infrastructure, or autonomous-agent deployment. Real environments, permission boundaries, and human takeover conditions require separate evaluation.
Three risk groups require different evidence
Malicious use concerns what actors can do with a system; malfunctions concern systems that do not behave as intended; systemic risks concern the accumulated effects of broad adoption on work, information, and human autonomy. Their time horizons and intervention points differ.
The report says current systems do not have the capability required to cause loss-of-control scenarios, while also tracking progress in autonomy, evaluation awareness, and behavior that can evade oversight. Separating present capability from future conditions avoids both exaggeration and complacency.
The evaluation gap limits pre-deployment judgment
Common evaluations can be outdated, contaminated, or limited to isolated skills. Pre-deployment scores therefore do not reliably predict real-world usefulness or risk, especially for agents that use tools, consume external content, and act over time.
A stronger approach combines capability testing, threat modeling, red teaming, runtime restrictions, human takeover, incident records, and post-deployment monitoring—and tests whether the evaluation itself has stopped measuring the intended behavior.
Defense in depth, not a single safety switch
Any safeguard can be bypassed, misconfigured, or fail in a new context. The report therefore favors layers across the model, system, and wider ecosystem so that failure in one layer does not leave consequences unconstrained.
Defense in depth is not proof that a system is safe. Open-weight models are difficult to recall after release, while closed systems create information asymmetries; each needs governance matched to its distribution model and threat model.
Methodology
This original synthesis draws on the executive summary and the report's capability, risk, and risk-management sections, cross-checked against the official publication page for status, authorship, and licensing.
The official report synthesizes scientific, technical, and socioeconomic evidence published through December 2025; the strength of evidence differs substantially by risk.
This article preserves the report's uncertainty, evaluation-gap, and evidence-gap qualifications and does not present scenario analysis as an observed event.
The official publication is generally covered by the Open Government Licence v3.0, with possible exceptions for third-party material; this article reproduces no report figures or third-party content.