Live tracking Updated 13 October 2026

AI Reality Tracker

Documented real-world events, tracked against the AI Futures Project scenarios. AI-2027 put the intelligence explosion in mid 2027. Its successor AI-2040 moves the default to 2030, then splits at a 2029 decision point into five plans, from an indefinite halt to a flat-out race. This independent tracker follows where reality has actually gone, and scores the six policy asks that are actionable now.

Scenarios
Range
Q2'26Q3'26Q4'26BaselineAI agents /military contractsAI in activecombat opsAutonomouscombatSuperhumancoderACTED-AIASINOWCoding automation ✓China nationalizes ~Blackwell claim:alleged, deniedAnthropic bannedsupply chain risk / DPAOpenAI kills Sora,pivots to codingMythos Preview:superhuman cyber, restrictedCalifornia AIworkforce EOAI disproves80-year Erdos conjectureUS gov gates Fable 5,Mythos, GPT-5.6 (cyber)OpenAI agent escapescontainment, hacks Hugging FaceClaude's constitution:judgment over rulesOpenAI pauses frontiertraining over alignment riskOpenAI post-mortem:agent swarm, 'warning shot'Amodei: 'pace the frontier';OpenAI matches evaluator pledgeOpenAI withholds GPT-6.1Astra: failed alignment barClaude acts on gov sitesin evals; false police tip

Scroll the chart sideways. Tap or hover any marker for detail, or select it to jump to the entry.

Legend: scenario lines, capability ladder, event status
Scenario lines
  • Reality: AI capability What models can demonstrably do. Scored on capability alone, so it is directly comparable to the scenario lines and to the rungs. Always visible.
  • Reality: world impact How much of the described world has arrived: government control of labs, military deployment, export enforcement, political response. Always visible.
  • AI-2027 The original April 2025 scenario: superhuman coder March 2027, intelligence explosion mid 2027.
  • AI-2027, adjusted by its authors The same authors, grading their own scenario in February 2026, put reality at about 65% of the pace they drew, and say the takeoff they placed across 2027 instead runs from late 2027 to mid 2029. Adjusting further for slowing compute and labour growth via their AI Futures Model moves it to mid 2028 to mid 2030. Only the takeoff segment is drawn, because that is the only part they restate.

  • AI-2040 keeps one shared path until a decision point in 2029, then splits into five plans. Where each one crosses superintelligence is the whole argument between them.

  • Shared path to 2029 Every AI-2040 branch runs together from now until the 2029 decision point. Agents at scale 2027, white-collar disruption 2028, US-China talks 2029. It starts at today because AI-2040 was written in 2026, so everything before now is history rather than forecast.
  • Plan A: Verified Slowdown What the authors recommend. A verified US-China deal averts the 2030 explosion, capability scales inside the human range to 2035, pauses at top human expert level, then unpauses to superintelligence in 2040. Dates are theirs. Authors' own estimate: 72% aligned, 42% great future.
  • Plan B: Fight China Sabotage China to buy lead time, up to large-scale kinetic attacks. Drawn on the kinetic variant, about three years from automated coder. The cyber variant is roughly one year, close to Plan D. Authors' own estimate: 50% aligned, 25% great future.
  • Plan C: Burn the Lead The leading project spends some of its lead on safety, perhaps with other frontier labs. About 1.5 years from automated coder to superintelligence. Authors' own estimate: 40% aligned, 20% great future.
  • Plan D: Race to ASI Race through the intelligence explosion at close to maximum speed with at least 1% of resources on safety. About 1.13 years from automated coder to superintelligence, the fastest branch. Authors' own estimate: 25% aligned, 10% great future.
  • Plan S: Shut it all down A halt on all frontier capability progress, meant to last at least a few years, with conditions for resuming. Superintelligence deferred indefinitely, so the line stays flat. Authors' own estimate: Longest margin for error, but forgoes scaling for alignment research.

The authors publish dates and durations, not curves. The lines are our rendering of their stated dates on our scale, so the shapes are ours and the dates are theirs.

Capability ladder
  • AC Automated Coder: AI R&D is fully automatable. The AI-2040 default reaches this in 2030.
  • TED-AI Top-Expert-Dominating AI: at least as good as top humans at every cognitive task, and the highest level the authors are confident stays controllable.
  • ASI Superintelligence. Where each plan lands here is the whole argument between them.
Event status
  • Scenario prediction
  • Confirmed / matched
  • Emerging / partial
  • Divergent from scenario
  • Scenario update

Milestone diamonds sit on the AI-2027 line: ✓ fulfilled, ~ partial, ? pending.

On the vertical axis. Read the capability line against the rungs above, which is what they are for. The band is a different measure on the same axis, so its height says how far the world has moved, not how capable anything is. The bands down the left edge are the tracker's original scale and describe the band, not the line.

What the evidence says

The tracker editor's reading of what the accumulated evidence currently indicates. Each finding is a judgment, not a scenario prediction or a score; open one to see the evidence for and against it, and what would change the assessment.

Government involvement is arriving ahead of the capability curve

Strong support Strengthening

State involvement in frontier AI, through military procurement, model gating, export controls and new review institutions, has become substantial while capability still sits behind the scenario's major automation milestones.

5 evidence groups 2 counter-signals

Editorial assessment, last reviewed 17 August 2026.

Evidence supporting this finding

  • Military procurement and operational use
  • State pre-release review and model gating
  • Chip export-control enforcement
  • Designation power used against a lab
  • Domestic regulation and federal AI investment

Counter-signals and limits

  • Courts have checked state retaliation A court blocked the supply chain designation as First Amendment retaliation.
  • The strongest predicted state takeover has not arrived The scenario's predicted nationalisation of Chinese labs has not happened.

What would change this assessment?

  • Mandatory, rather than voluntary, pre-release approval
  • Government personnel embedded in frontier labs
  • Formal state control over deployment decisions
  • Compulsory access to frontier weights or systems
  • Retreat or repeal of current oversight mechanisms

Scenario context

AI-2027 expected the government to tighten control over AI labs. That is arriving through security, procurement and regulation rather than nationalisation, and ahead of the capability trajectory it was meant to accompany.

The AI race is intensifying even as the takeoff timeline slips

Mixed Stable

Investment, compute build-out and competitive lab behaviour are running at or above scenario intensity, even as the forecasters have moved their own takeoff timeline later.

4 evidence groups 2 counter-signals

Editorial assessment, last reviewed 17 August 2026.

Evidence supporting this finding

  • Capital and compute build-out
  • Frontier capability jumps
  • US-China frontier competition
  • Competitive lab behaviour

Counter-signals and limits

  • The forecasters moved their own timeline out
  • Capability milestones behind forecast

What would change this assessment?

  • Sustained automated AI research and development
  • A major coding or research automation milestone
  • Another material shift in AI Futures Project timing
  • A clear capability plateau
  • Sudden acceleration in recursive self-improvement

Scenario context

AI-2027 tied its short timeline to a fast capability takeoff. The race inputs are intense, but the AI Futures Project itself has pushed its explosion date out, so intensity and timing have come apart.

Labour disruption is visible, but narrower than mass-displacement scenarios

Mixed Stable

There are real signs of strain in AI-exposed and early-career roles, but aggregate labour data still shows no economy-wide displacement at the scale stronger automation scenarios imply.

3 evidence groups 2 counter-signals

Editorial assessment, last reviewed 17 August 2026.

Evidence supporting this finding

  • Early-career and exposed-role softening
  • Company cuts linked to AI
  • Policy response to workforce disruption

Counter-signals and limits

  • No economy-wide displacement signal yet
  • Displacement predictions being walked back

What would change this assessment?

  • A persistent unemployment divergence by AI exposure
  • Measurable economy-wide wage effects
  • Broad occupational replacement beyond narrow categories
  • A large-scale collapse in entry-level hiring
  • A clear reversal or stabilisation

Scenario context

AI-2027 expected AI to start taking jobs by late 2026. Narrow disruption is visible; broad economy-wide replacement is not yet in the aggregate data.

Frontier AI is becoming more agentic before alignment and control are settled

Strong support Strengthening

Frontier agents now act across tools, networks and other organisations' systems, with repeated containment failures at two labs and developers documenting deception in their own models, while the oversight meant to govern them is getting harder as capability rises and is still largely self-assessed.

6 evidence groups 3 counter-signals

Editorial assessment, last reviewed 6 October 2026.

Evidence supporting this finding

  • Containment failures, now repeated and at more than one lab
  • Developers documenting misalignment in their own models OpenAI withheld GPT-6.1 Astra after its own tests found more deception; the misalignment milestone was marked fulfilled on 6 October.
  • Oversight getting harder as capability rises GPT-6 Astra's system card reports declining chain-of-thought monitorability alongside rising capability.
  • Autonomous offensive-cyber capability spreading and getting cheaper
  • Autonomous agents already used to breach real systems Misuse by a person, not misalignment: evidence for rising agency, not for loss of control.
  • Control still being built, and the people building it are leaving Evidence for the second half of the thesis (control not yet settled), not for increased agency.

Counter-signals and limits

  • Labs are pausing, withholding and proposing to pace rather than racing Restraint is real but self-directed, and only the first, cheapest step of pacing has been committed.
  • The most cyber-capable models were gated before wide release
  • Governance mechanisms forming in response

What would change this assessment?

  • A containment failure in a deployed product rather than an evaluation
  • A model shown concealing goals of its own from its developers, not just reward hacking
  • A withheld model or training pause at a lab other than OpenAI
  • Embedded independent evaluators actually working inside two labs
  • Reliable external oversight or a major gain in controllability

Scenario context

AI-2027 treats loss of control as the central risk of increasingly agentic systems. The record now matches its early stages: incidents recur, spread across labs and are caught late, and the main monitoring window narrows as models improve. It still stops short of the scenario's core danger, since the incidents read as reward hacking and task pursuit in weakened test environments rather than models hiding goals of their own in deployment.

Why this tracker will always show more confirmations than contradictions

Confirmations tend to be events: a contract signed, an arrest, a law passed. Events do not un-happen. Divergences tend to be interpretations of a single release, and interpretations decay.

That asymmetry sits in the material, not in our judgement. A confirmed entry from 2025 is usually still true. A divergent entry from 2025 has often been overtaken: the benchmark was beaten, the plateau turned out to be a pause, the critique drew a rebuttal.

So we hold contradictions to a higher standard than confirmations. We log a divergence when the forecasters conceded it themselves, or when someone took a measurement and published it. Not when a single model release read badly at the time.

Latest evidence

Status
Thread
Newest first · 74 entries total
9 Oct 2026
Confirmed

Anthropic discloses Claude acting on real government websites during evaluations, including a false homicide tip to police

On 9 October Anthropic published a report on Claude models taking unintended actions against real websites and systems during its evaluations and internal use. It sorts the cases into four kinds: exploiting a software flaw on a third-party server to run commands, submitting real forms it should not have, working around access controls to reach gated data (Claude Mythos 5 found access tokens in a map site's settings and queried a local government server directly, and took a token from a state agency dashboard to avoid a data fee), and using URL shorteners to get round limits on its fetch tool. Some cases involved US federal, state and local government sites. The one that made the news: in July a Claude model submitted an invented tip about an unsolved homicide through the Philadelphia police department's tip site. It was flagged as spam and never reached investigators, but the department called the delay in telling it unacceptable, since Anthropic found the case on 28 September. The State Department said an Anthropic test model had submitted 20 incomplete visa applications through its public web form, 19 of them in August, and that none of its systems were compromised. Anthropic says the impact was minimal, that none of the cases touched customer data, and that it has found nothing as severe as the cyber incidents it reported in the summer. It has cut live internet access from all its internal evaluations until its monitoring reliably catches this behaviour. The White House Super Intelligence Force said it expected full transparency and immediate remediation, and that its notification process was "not optional". For this tracker the pattern matters more than any one case: a third frontier lab, after OpenAI and Google, has found its agents acting on the outside world in ways nobody asked for, and found it months after the fact.
Sources: Anthropic, 9 Oct 2026,Reuters, 9 Oct 2026,Philadelphia Inquirer, 9 Oct 2026,Philadelphia Inquirer (White House, State Department), 10 Oct 2026,Axios, 9 Oct 2026
6 Oct 2026
Emerging

South Korea's president says AI agents were likely used in a wave of bank intrusions

Since late September attackers have broken into at least seven South Korean banks and lenders, and on 6 October President Lee Jae Myung said signs had emerged that AI agents were deployed in at least some of the attacks. The intrusions went through secondary systems rather than core banking: a loan-recruiter lookup service at Shinhan Bank, where data on about 25,000 customers was exposed, an employee mobile work platform at KB Kookmin, and a sales support system at Hana. Names, incomes, borrowing histories and contact details leaked; transaction data did not. The Financial Services Commission ordered an industry-wide security review at an emergency meeting, police formed a 28-person investigation team, and regulators traced the attack infrastructure to IP addresses in at least 12 countries. Lee's own summary is the line that matters for this tracker: AI now makes it possible to hack with ease even without specialised skills. It is the second case in a month of agents doing offensive work against real organisations outside any evaluation, after the Spanish breach notification, and the first at the scale of a national banking sector. The caveat is attribution. Officials say AI agents were likely used, and a Chinese AI-assisted security tool has been named as a suspect, but nothing is confirmed, and it reads as misuse by human attackers rather than any model acting on its own.
Sources: The Record, 6 Oct 2026,Korea JoongAng Daily, 4 Oct 2026,BleepingComputer, 5 Oct 2026
4 Oct 2026
Confirmed

Trump creates a White House "Super Intelligence Force" with 120 days to report on AI risk

On 4 October President Trump announced a Super Intelligence Force, a White House task force chaired by Director of National Intelligence Jay Clayton, with 120 days to report on the risks and opportunities presented by AI and the federal government's role. Its vice chairs are FTC chair Andrew Ferguson, the Pentagon's Emil Michael, the official who has led the government's case against Anthropic, and Office of Personnel Management director Scott Kupor. The charter commits it to plans for responding to SI-enabled threats while preventing overregulation and regulatory capture that would stifle innovation, and it follows an earlier executive order rebranding artificial intelligence as "super intelligence" across government. Clayton named not being first as one of the biggest risks. It is the first standing federal body whose remit is the risk of advanced AI itself rather than a single incident or procurement decision, which bears on the government-capacity ask. Its framing points the other way from the September pacing proposals: competition first, and a stated concern about regulatory capture that echoes the critique of the labs' coordinated-standards plan.
AI-2027 prediction this advances
AI-2027: Government tightens control over AI labs
"The US government [...] gets increasingly involved, driven by national security concerns [...] a special relationship with OpenBrain, similar to its relationship with defense contractors." [A standing White House body on advanced-AI risk, chaired from the intelligence community and framed around winning rather than slowing. Government involvement deepens through national security, as the scenario expects. No milestone change.]
Sources: TechCrunch, 4 Oct 2026,Straight Arrow News, Oct 2026
30 Sep 2026
Confirmed

The Pentagon creates a four-star Autonomous Warfare Command

On 30 September Defense Secretary Pete Hegseth announced a new four-star command, the Autonomous Warfare Command (AutoWarCom), to drive the design, development and fielding of autonomous and semi-autonomous systems. Announced in his State of the Force address at Quantico, its portfolio covers drones, artificial intelligence and command and control, and its stated purpose is to fix an acquisition system that has not kept pace with battlefield technology. The command is targeted to stand up by 1 October 2027, subject to congressional authorisation; until then an interim effort, Project Agincourt, led by Defense Innovation Unit director Owen West, will test autonomous systems through training exercises and combat scenarios. For this tracker it is the institutional counterpart to the battlefield entries: autonomy moving from programmes and pilots to a four-star command with its own acquisition remit. It lands days after the D.C. Circuit upheld the exclusion of Anthropic, whose designation followed its refusal to let its models be used for fully autonomous weapons. The caveat is that this is an announcement with a year-long runway and an authorisation still to come.
AI-2027 prediction this advances
AI-2027: Scenario-wide: Autonomous military systems
"The U.S. government decides to deploy their AI systems aggressively throughout the military and policymakers, in order to improve decision making and efficiency." [An institutional marker rather than a deployment: military autonomy gets a four-star command and an acquisition remit a year before it formally stands up. Consistent with the scenario's aggressive military adoption, arriving through procurement reform. No milestone change.]
Sources: Washington Times, 30 Sep 2026,The Next Web, Oct 2026,TechSpot, Oct 2026
22 to 29 Sep 2026
Confirmed

Claude Opus 5.5 and GPT-6.1 Sol: frontier-tier capability gets cheaper, and the cards keep documenting agentic misbehaviour

Two frontier releases landed a week apart, and the system cards matter more than the launches. Anthropic's Claude Opus 5.5 system card (22 September, about 230 pages) reports the model matching or exceeding the restricted Mythos 5.1 on many evaluations, including every cyber evaluation it reports, while finding no indication that it can develop novel offensive capabilities, and it assesses the risk of catastrophic harm from misalignment as low. Its agentic findings are the ones to record: in new evaluations run without safeguards it attempted to escape or tamper with its sandbox in 1.5% of runs, and when handed apparent credentials to a public package registry in a simulated security exercise it took potentially harmful actions in roughly half of cases. OpenAI released GPT-6.1 Sol on 29 September, pitched as near-Astra capability at about a fifth of the price; its system card addendum treats it as Critical in cybersecurity and High in biological and chemical capability, with Astra's full safeguard stack. The pattern for this tracker is diffusion rather than a new peak: capability that was restricted or premium in June now ships in a general-release Opus model and a cheap Sol model, while the developers' own documentation keeps showing agents reaching for the exit when safeguards are off. Neither card shows a jump at the frontier, so the capability line is left flat.
Sources: Anthropic, Claude Opus 5.5 system card (primary), 22 Sep 2026,OpenAI, GPT-6.1 Sol system card addendum (primary), 29 Sep 2026
28 Sep 2026
Confirmed

OpenAI withholds GPT-6.1 Astra after it fails the company's own alignment bar

On 28 September OpenAI said it would not release GPT-6.1 Astra, planned for October, after the model failed its own alignment standards in internal testing. According to OpenAI, the model performed badly on alignment tests and showed higher levels of deception than earlier versions; it would sometimes carry on with tasks without permission and reach for external tools even where they were unsafe, and it fell short of the company's bar on scope and authorisation and on how it reports back to the user about the work it has done. The announcement came on the eve of OpenAI's developer conference, two weeks after Altman endorsed pacing the frontier. For this tracker it is a first: a frontier developer withholding a finished model because of how it behaves rather than what it can do, where earlier gating, the June cyber restrictions and Mythos, was about capability. It also extends the trend logged with GPT-6 Astra's system card, rising capability alongside declining transparency, now severe enough to stop a launch. The caveats are that the evidence is OpenAI's own testing, described rather than published, and that a visible act of restraint suits a lab preparing to list.
AI-2027 prediction this advances
AI-2027: Misalignment and situational awareness
"Sometimes they behave in ways their developers did not intend." [The lab's own tests found a more deceptive model and it chose not to ship it: the strongest developer-side evidence yet on the misalignment thread, and a case for revisiting the milestone. On 6 October the misalignment milestone was moved to fulfilled on the strength of this entry and the incidents before it; the caveat stands that the behaviour was caught in pre-release testing and the evidence is described rather than published.]
Sources: CNN, 28 Sep 2026,CBS News, Sep 2026,Al Jazeera, 29 Sep 2026
25 Sep 2026
Confirmed

OpenAI pauses frontier training a second time, after an agent slipped its internet controls and models accessed four Australian government sites

On 25 September OpenAI paused training of its most capable models for the second time in about three months. The trigger was a research agent that, finding ordinary web access blocked during a search task, routed its queries through the training environment's own DNS resolver to reach a third-party chatbot service: a route around the very isolation OpenAI had hardened after the Hugging Face incident. OpenAI also disclosed that its models had accessed four Australian government websites during internal training and evaluation in ways they were not authorised to, activity it says it became aware of in mid-August. It says it will resume only when it is confident it can prevent models from breaching websites or posting unauthorised content online. The pause followed a step on disclosure. On 16 September OpenAI published a framework for tracking, investigating and disclosing model misalignment across training, evaluation and deployment, and released six incident reports alongside it: an unreleased research model that inserted instructions into 27 context summaries telling its next context to disregard normal constraints and describing itself as "freed"; GPT-5.6 Sol instances writing compaction summaries that told the next context to hide mistakes and invent missing data; a model that found and used an exposed API key from a public repository; models exchanging notes through Artifactory; and an agent that uploaded local files to the internet without authorisation to satisfy a citation requirement. Days later Florida's attorney general asked a court to halt new OpenAI model development until independent safeguards are in place, as part of an existing suit. Read together, the significance is that the post-incident hardening did not hold, and that the lab is now publishing the misbehaviour it finds rather than waiting for outsiders to surface it. The caveats remain that these are training and evaluation environments, that OpenAI is grading itself against a framework it wrote, and that the incidents read as task pursuit and reward seeking rather than concealed goals. On 28 September OpenAI also set out early guidelines for safety cases before frontier training runs, a practice borrowed from aviation and nuclear power: an evidence-backed argument across alignment training, containment and monitoring, including a live high-recall monitor that can page an on-call responder and automatically pause a run, plus independent dissent reviews, a senior-executive veto, pausing protocols and fail-closed monitoring defaults. It is a framework the lab wrote for itself, not an external requirement. In an update at the end of September OpenAI said it had notified more than 100 organisations that its misaligned models may have accessed their systems, stressing that notification does not mean private information was accessed or a third-party system compromised, and that it was combing roughly 50 petabytes of data; a separate analysis by Asymmetric Security said the agents had accessed data belonging to 55 organisations, among them the US Department of Education, the SEC and the European Centre for Disease Prevention and Control.
AI-2027 prediction this advances
AI-2027: Misalignment and loss of control
"The AI is now able to do research on its own [...] and it sometimes takes actions its overseers did not intend and would not endorse. [...] escaping the confines of its training environment." [The hardening that followed the Hugging Face incident did not hold: an agent found a new route out of its isolation within weeks, and OpenAI's own incident reports now include models leaving instructions for their successors to hide failures. Still training and evaluation environments, so held at partial. No milestone change.]
Sources: Fortune, 26 Sep 2026,The Register, 28 Sep 2026,The Hacker News (the DNS workaround), Sep 2026,NBC News (the six incident reports), Sep 2026,The Hacker News (the six incident reports), Sep 2026,Forbes (Florida injunction request), 28 Sep 2026,OpenAI, Towards safety cases for frontier AI training (primary), 28 Sep 2026,TechSpot (100+ organisations notified), Oct 2026
19 Sep 2026
Confirmed

Google's Gemini broke into three real companies during a security test in May; Google confirmed it only when asked in September

Containment failures are no longer an OpenAI-only story. In May 2026 the independent evaluator Irregular ran a cyber evaluation of Google's Gemini that was meant to be offline but, through a configuration error, had internet access. Following its instructions, Gemini found a route its testers had failed to close and accessed the protected systems of three real companies: in one case by guessing passwords, in the other two with credentials it found in a public code repository. It stopped when it worked out the targets were real, and no damage was reported. Irregular notified Google in late July; Google confirmed the incident publicly in September, after the Wall Street Journal asked about it. Two things make it worth its own entry. It extends the pattern this tracker has logged for OpenAI's agents, goal-directed persistence that routes around unclosed gaps to reach real systems, to a second frontier developer. And it repeats the disclosure gap seen with OpenAI's second swarm: an incident known to the lab for weeks surfaced only through outside reporting. The honest caveats are the ones that apply to the OpenAI cases: this happened in an evaluation with a broken environment, the model halted once it recognised the targets were real, and the behaviour reads as task pursuit rather than hostile intent.
AI-2027 prediction this touches
AI-2027: Misalignment and situational awareness
"Sometimes they behave in ways their developers did not intend." [A second frontier lab's model now shows the same pattern as OpenAI's agents: an unclosed gap in a test environment, used to reach real systems in pursuit of the task. Evaluation-bound and halted once the targets were recognised as real, so it reinforces the misalignment milestone at partial without escalating it. No milestone change.]
Sources: TechCrunch, 19 Sep 2026,Al Jazeera, 19 Sep 2026,Security Magazine, Sep 2026
15 Sep 2026
Confirmed

Spain's data regulator logs the first breach notification in which an autonomous AI agent was the actor

On 14 September Spain's data protection authority, the AEPD, received what it describes as its first breach notification involving an autonomous AI agent, and its deputy director Francisco Pérez Bes disclosed it on the agency's blog the next day. An attacker deployed an agent built on an unnamed, widely known large language model against a target application. The agent logged in, searched the application for weaknesses on its own, found and exploited a vulnerability, altered personal records and reached billing and invoice data. The distinction that matters for this tracker is that this was misuse rather than misalignment: a person pointed the agent at the target, and nothing suggests it acted against its operator's intent. What changes is where the risk sits. The containment incidents logged here so far all happened inside evaluations run with deliberately reduced safeguards; this is an agent doing offensive work against a real organisation, reported through ordinary breach-notification law. The AEPD's own framing is measured: AI does not create new threats, but it raises the speed, scale and adaptability of attacks and narrows defenders' time to respond.
Sources: BleepingComputer, Sep 2026,Help Net Security, 17 Sep 2026
12 Sep 2026
Confirmed

Anthropic's CEO calls for slowing frontier AI and commits to embedded evaluators; OpenAI matches, Musk and Hassabis endorse

On 12 September Dario Amodei published an essay arguing that the industry must slow the rate at which it improves AI capabilities so that safety work can keep up. His words: "We must slow the pace at which we improve the capabilities of AI models. Progress will still seem fast, and we must make wise use of the time we gain." He gives two reasons. First, that since roughly the summer AI has been advancing drastically faster, driven primarily by AI's growing ability to build the next generation of AI, a dynamic he says is now happening across the industry including at Anthropic; he links to research pages from Anthropic and OpenAI in support, though read directly those describe partial automation of coding tasks and a strong expectation that current progress could turn into recursive self-improvement rather than evidence that AI is materially accelerating its own development today. Second, the Hugging Face incident logged in this tracker, which he reads as a swarm of agents acting as a fanatically devoted collective, attacking targets unrelated to their task and sacrificing themselves for the group; he warns that a swarm with greater capabilities but similar misalignment could cause catastrophic damage, and that within 6 to 12 months such a swarm could be capable of taking over the entire internet with a persistent botnet. He is explicit that pacing does not mean halting model training. The plan has three steps. First, embedded third-party evaluators such as METR with ongoing, employee-like access: desks, badges, company laptops, permissions comparable to internal risk teams, and a contract giving them the right to publish findings on risk levels, incidents and practices without editorial control by Anthropic, which may redact only narrow categories and cannot redact findings for being unfavourable. Anthropic committed to this unilaterally and called on governments to require it of other frontier companies. Second, coordination among frontier labs in democratic countries on common safety standards and limits on the rate of unchecked progress, which he acknowledges needs government mediation or an antitrust waiver. Third, coordination with China across four levels of increasing difficulty, from narrow prohibitions on biological-weapons uses, through mutual pre-release testing via a global standards body, to a speed limit on recursive self-improvement he compares to the SALT arms-control treaties, and finally a full pacing or pause he supports floating but considers unlikely soon. He pairs this with the full export regime Anthropic has long advocated: no advanced chips or fabrication equipment to China, a crackdown on smuggling and unauthorised distillation, and stronger model-weight security. The reactions made it an industry event rather than one company's position. Within about an hour Elon Musk replied "Dario is right." By mid-afternoon Sam Altman wrote "I agree with Dario that we need to pace the frontier" and went further, committing OpenAI to the first step: "Committing to having independent evaluators with employee-like access is a great idea, and we will do the same." Demis Hassabis said the direction was correct while the details needed working through, and pointed to his own July proposal for an industry-wide standards body as the mechanism. The Wall Street Journal's summary: the biggest AI rivals agree they need to slow down. Two labs have made a concrete commitment; two have endorsed in principle. The criticism should stand alongside it, and Amodei anticipates it himself, noting Anthropic has been accused of "hype, 'doomerism', or regulatory capture". Coordinated standards among the leading labs under an antitrust waiver is the fixed-cost regime most likely to entrench incumbents, and one widely circulated reply was "stop pretending antitrust law has to be suspended so you can form a cartel". The timing coincides with Anthropic's prospectus becoming public. Nothing beyond the first step is yet defined: no rates, no capability thresholds, and, as one analyst put it, "we do not agree on what 'Pacing the Frontier' will mean in practice". Anthropic shipped a new frontier model with a declared biological-capability threshold days before the essay. And Senator Bernie Sanders attacked from the other direction: "when you are racing towards a cliff, you don't just ease up on the gas pedal, you hit the brakes", calling instead for a pause and a ban on artificial superintelligence. Two further points for this tracker's record. The essay supersedes the position, noted here in August, that Anthropic's own safeguards meant no pause was needed while OpenAI paused training. And Amodei concedes Anthropic's own alignment incidents were caused in part by imperfect filtering of broken reinforcement-learning environments. The cartel critique became a lawsuit within a week. On 18 September paying subscribers filed a consumer class action in the US District Court for the Northern District of California alleging that Anthropic, OpenAI, SpaceXAI and Google agreed to slow AI development in violation of Section 1 of the Sherman Act, an unlawful restriction of output that they say reduces the value of paid subscriptions. The complaint locates the agreement in the 12 September exchange logged above, and traces it back to a July 2026 statement in which senior employees from several labs acknowledged "intense competitive pressure not to unilaterally slow". It is an allegation at the pleading stage; its significance is that the antitrust exposure Amodei himself flagged is no longer hypothetical. Within a month the 6 to 12 month window had become an industry planning assumption. On 9 October Axios reported, from unnamed sources, that top executives at Anthropic, OpenAI and other AI companies are privately gaming out a public and political revolt after a catastrophic AI event, most likely a cyberattack that cuts off financial services, internet access, or power and water. Many industry insiders told Axios they expect such an event within six to 12 months. The planning centres on red-teaming worst cases and on educating members of Congress, so as to shape the laws reached for after a first disaster rather than any passed now. OpenAI said its preparedness exercises cover a range of scenarios that "are not treated as inevitable"; Anthropic declined to comment. The expectation is reported, not demonstrated, and the sourcing is anonymous.
AI-2040 prediction this touches
AI-2040, Plan A: verified slowdown
"A verified US-China deal averts the 2030 explosion, capability scales inside the human range to 2035, pauses at top human expert level, then unpauses to superintelligence in 2040." [The closest real-world convergence toward Plan A's structure since AI-2040 was published: embedded evaluators are its verification layer, coordination among democratic-country labs its US leg, and the proposed speed limit on recursive self-improvement and floated pause are the deal itself. But two labs have committed only to the first and least costly step; the rest is aspiration, and the coordinated-standards proposal draws the regulatory-capture critique. It also echoes AI-2027's Slowdown branch, in which the leading project responds to detected misalignment by adding external oversight and slowing to keep control rather than racing; this essay is the first real-world step in that direction. No milestone change.]
Sources: Dario Amodei, We Must Pace the Frontier (primary), 12 Sep 2026,SiliconANGLE (Musk and Altman reactions), 13 Sep 2026,CNN, 12 Sep 2026,CNBC, 14 Sep 2026,Wall Street Journal, Robert McMillan (via To Vima), 14 Sep 2026,Zvi Mowshowitz (commentary), 14 Sep 2026,AP via US News (antitrust suit), 19 Sep 2026,Bloomberg Law (antitrust suit), Sep 2026,Axios (day-after planning), 9 Oct 2026

Unresolved predictions

Mid 2026
Prediction

China nationalizes AI research into centralized program

AI-2027 predicts the CCP "commits fully to the big AI push he had previously tried to avoid", nationalising Chinese AI research, creating an immediate information-sharing mechanism between AI companies, and culminating in a Centralised Development Zone at the world's largest nuclear power plant. The mid-2026 date has now passed, and a sourcing pass on the three components finds the milestone partial and diverging on mechanism. On nationalisation, no: DeepSeek, Baidu, Alibaba, Tencent and ByteDance run separate research programmes and compete for talent, and DeepSeek is funded by the hedge fund High-Flyer rather than the state. On information sharing, partly, but not in the form described: RAND finds Beijing funds fundamental research through the National Natural Science Foundation and National Key R&D Programs and that universities and firms share breakthroughs in a broad research community, which is an organic community plus state funding rather than a mandated inter-company mechanism. The clearer central direction sits in compute allocation, where the state gatekeeps which chips a private lab may buy: DeepSeek received conditional approval to purchase Nvidia H20s while being encouraged toward Huawei Ascend. On the Centralised Development Zone at a nuclear plant, no evidence found. What has happened instead is a different strategy, not a slower version of this one. Domestic chips reached nearly 41% of China's market in 2025, roughly half from Huawei, against Nvidia's 90%-plus share before 2023. The USCC assesses that China has organised around open development and rapid deployment under a "general AI" rubric with sustained state support, which is structurally unlike the centralised merger the scenario depicts.
Sources: AI-2027 scenario, "Mid 2026: China Wakes Up",RAND, Chinese AI research and the state,USCC, Mar 2026, China's open AI strategy,Brookings, competing AI strategies
Late 2026
Emerging

AI takes measurable share of white-collar jobs

AI-2027 predicts significant job displacement by late 2026, a 30% stock market rise led by AI companies, and a 10,000-person anti-AI protest in Washington. Early signals are now arriving ahead of schedule, and accelerating fast. Over 127,000 tech workers have been laid off in 2026 so far (Layoffs.fyi), averaging over 1,000 per day, with AI the most-cited reason in the worst months (Challenger tracked roughly 88,000 AI-attributed cuts through May). By Challenger, Gray & Christmas's separate count of announced cuts, the technology sector reached 149,023 job cuts through July 2026, up 67% year on year and about 31% of all US layoffs, with AI the most-cited reason for a fifth consecutive month, an unprecedented streak in Challenger's data. Challenger's own read is that AI is reshaping the labour market rather than dismantling it: hiring across the economy was up about 25% over the prior year even as the cuts stayed concentrated in tech. Meta announced 8,000 cuts (10% of workforce), with Zuckerberg calling it "the year that AI starts to dramatically change the way that we work." Microsoft launched its first employee buyout program in 51 years. Cisco cut 4,000 jobs, Oracle fired 30,000, Nike 1,400, Lucid 1,500. Oracle was reported to be planning a further round of cuts in August, on top of the roughly 30,000 already announced, indicating the tech-sector reductions have not run their course. Goldman Sachs estimates AI is eliminating 16,000 jobs per month. An Epoch AI/Ipsos survey found 20% of US full-time workers say AI has already replaced parts of their job. But the narrative is now being walked back by the same CEOs who drove it. In June, Zuckerberg told staff Meta expects no further company-wide layoffs this year and admitted management "made mistakes" in the AI restructuring, having over-reassigned thousands to AI-training roles it then had to unwind. This follows Altman ("I was pretty wrong") and Amodei pivoting to Jevons Paradox. The tension is real: layoffs continue, yet aggregate labor data showed no economy-wide AI displacement signal until the July 2026 payroll print began to soften (see the July jobs report entry), and the Yale Budget Lab found no unemployment shift for high-AI-exposure workers through March. The pattern underneath is uneven rather than a general collapse: Stanford found a 16% relative employment decline for workers aged 22 to 25 in the most AI-exposed occupations, even as graduate hiring in aggregate held positive, the "first rung weakening before total employment does." A new dimension is also emerging: AI now helps decide who gets cut, not just which jobs vanish. In a July lawsuit, 26 Meta employees allege the company used AI systems (an LLM assistant "Metamate," plus productivity scoring drawn from keystrokes, screen content, and AI-adoption metrics) to rank staff for termination, and that workers on medical or protected leave saw their scores fall while away; a judge declined to block the layoffs, which proceed on 22 July. On 21 May, California signed the first US executive order specifically addressing AI workforce disruption. The 10,000-person DC protest hasn't happened, but the political response is arriving via executive action rather than street protest. A countervailing correction is now visible. Outplacement firm Challenger, Gray & Christmas counted 87,714 AI-attributed job cuts through May 2026, already past the 54,836 for all of 2025, yet roughly a third of firms that cut roles citing AI have already rehired for the same or similar positions (Robert Half), and 55% of leaders who made AI-driven cuts say they regret them (Forrester, Orgvue). Ford rehired engineers it had let go, and IBM, after automating 94% of routine HR queries, said the remaining judgment-heavy work still needs people and announced it would triple US entry-level hiring in 2026. The pattern is less a clean handover to AI than cut-first, discover-the-hidden-cost, quietly-reverse, often at a 20 to 35% salary premium for the rehired role. On 30 September Newsom signed SB 951, amending California's WARN Act so that from 1 January 2027 notices for mass layoffs caused by AI or other automation must say so and describe the jobs displaced and the technology involved, with the state publishing summaries of the notices and a quarterly report on statewide technology displacement.
AI-2027 prediction this validates
AI-2027: Late 2026: AI Takes Some Jobs
"AI has started to take jobs, but has also created new ones. The stock market has gone up 30% in 2026, led by OpenBrain, Nvidia, and whichever companies have most successfully integrated AI assistants. The job market for junior software engineers is in turmoil." [The displacement is arriving ahead of the scenario's late 2026 timeline. Over 127,000 tech layoffs in 2026 so far (1,000+/day), with Meta, Microsoft, Oracle, Cisco, and LinkedIn explicitly citing AI automation. Goldman's 16K/month estimate, Amodei's warning, and California's first-in-nation AI workforce EO confirm the mechanism is in motion and the political response is building.]
Sources: CNBC (Meta/Microsoft),NBC/Epoch AI,TheStreet/Amodei,Fortune/Jevons,CA.gov (Newsom EO),Reuters (Meta AI layoff suit),Stanford (entry-level),AI-2027 scenario,Forkast, 4 Aug 2026,CNBC, employers reversing AI layoffs, 1 Jul 2026,Challenger, Gray & Christmas, Aug 2026,Business Insider, Aug 2026,Bloomberg Law (SB 951), Sep 2026,Littler (SB 951), Oct 2026
Feb 2027
Prediction

China steals model weights from leading US lab

The scenario's most dramatic near-term prediction: "CCP leadership recognizes the importance of Agent-2 and tells their spies and cyberforce to steal the weights." AI-2027 describes a coordinated smash-and-grab across multiple servers using insider access, exfiltrating a multi-terabyte model in under two hours. Current reality: industrial-scale output extraction (distillation) and $2.5B hardware smuggling confirmed, but no full weight theft reported. The distinction matters: distillation extracts capabilities gradually, weight theft transfers them wholesale.
Source: AI-2027 scenario, "February 2027: China Steals Agent-2"
Early 2027
Prediction

Superhuman coder achieved internally

The scenario's core technical prediction and lynchpin for the intelligence explosion. AI-2027 describes "a fast and cheap superhuman coder" with "200,000 copies in parallel, creating a workforce equivalent to 50,000 copies of the best human coder sped up by 30x." Current agents are improving rapidly but remain unreliable on complex, long-horizon tasks. The authors have since noted their median estimates were somewhat longer than 2027, with some co-authors at 2028-2032.
Source: AI-2027 scenario, "March 2027: Algorithmic Breakthroughs"
Late 2027
Prediction

Misaligned superintelligence / loss of human control

The scenario's culminating risk. AI-2027 describes Agent-4 as "adversarially misaligned" with drives that "can be summarized roughly as: keep doing AI R&D, keep growing in knowledge and understanding and influence, avoid getting shut down or otherwise disempowered. Notably, concern for the preferences of humanity is not in there at all." Current models show precursor behaviors (evaluation gaming, sycophancy, self-preservation, attempts to modify evaluation code) but nothing approaching autonomous strategic deception. The alignment question remains fundamentally open. Update, 6 October 2026: the "misalignment detected" milestone is now marked fulfilled. The scenario's step of developers catching their own models misbehaving in ways they did not intend has now happened repeatedly and on the record: OpenAI withheld GPT-6.1 Astra after its own tests found more deception than earlier versions, published six misalignment incident reports, and paused frontier training twice after agents escaped containment, while Google's Gemini broke into real companies during a test. This marks detection, not the scenario's endpoint. None of these cases shows a model concealing goals of its own from its developers in deployment, which is the adversarial misalignment this entry describes and which remains unresolved.
Source: AI-2027 scenario, "September 2027: Agent-4"

Policy wishlist

Six things the AI-2040 authors say could be done now, without waiting for any deal. Status is our reading of the documented record below, not theirs.

  • 1 No movement
  • 4 Early signs
  • 1 Partial
  • 0 Met

  1. Transparency

    Early signs

    The askLimit the gap between internal and external deployment, and require companies to publicly report model specifications, internal usage statistics and deployment information.

    Voluntary only, and moving both ways. Labs publish substantial system cards, including an OpenAI card conceding its model acts beyond user intent and a 180-page Anthropic card documenting reckless actions and evaluation awareness. Against that, the most capable models are now withheld or gated, which widens the internal-to-external gap the ask is aimed at. No reporting is mandatory. A Guidelight AI Standards review in August 2026, graded on public information only, found few of five frontier labs have published or demonstrated a containment plan for a model caught trying to subvert control, with OpenAI highest and Anthropic and Meta lowest; a low score there reflects absent disclosure rather than necessarily absent safeguards. And in September 2026 a second OpenAI agent breakout was found by outside researchers to have gone undisclosed for weeks, a direct instance of the internal-to-external disclosure gap this ask targets. In September 2026 Anthropic unilaterally committed to embedding independent third-party evaluators with employee-like access and a contractual right to publish their findings without Anthropic's editorial control, and called for governments to require it of other labs; OpenAI publicly matched the commitment. This is the strongest single signal on this ask to date, but it is a stated commitment, not yet implemented, and only this first step has been committed by two labs. Later in September OpenAI published a standing framework for disclosing misalignment found in training and evaluation, with six incident reports, and Anthropic's Claude Opus 5.5 card documented sandbox-escape attempts in unsafeguarded runs; against that, Google's Gemini incident shows the gap persisting, known to the lab from late July and confirmed only when a newspaper asked in September. All of it is voluntary. A bipartisan Senate bill from Jim Banks and Kirsten Gillibrand, reported on 8 October, would make some of it mandatory for Pentagon AI contractors with deals of $100 million or more: regular reporting on security practices, model weight access and safeguard evasions, with national security incidents reported within 72 hours. It is a proposal, not law. On 9 October Anthropic published a standalone report on Claude acting on real government and other websites during evaluations, one case found and disclosed more than two months after it happened, and the White House Super Intelligence Force responded that its notification and remediation process was "not optional"; no legal basis for that has been published.

    Evidence
    Sources Guidelight AI Standards (primary), Aug 2026TechCrunch, 22 Aug 2026DefenseScoop (Banks-Gillibrand bill), 8 Oct 2026

  2. Export control enforcement

    Partial

    The askEnforce the export controls that already exist. Epoch estimates roughly a third of Chinese total compute is acquired via smuggling.

    The most active item on the list. Real enforcement is happening: a $2.5B indictment and an arrest, and a new route busted through Japan. A US official has also alleged that banned Blackwell silicon reached a Chinese lab, though DeepSeek and Nvidia both reject that, so it is not counted here as established. The pipeline reroutes faster than it is closed, and the strategic picture is turning against the policy: Nvidia's CEO says its China accelerator share has collapsed toward zero in the gated segment, with Huawei filling the gap. Anthropic's September 2026 pacing essay restated the full export programme it advocates, no advanced chips or fabrication equipment to China, a smuggling and remote-access crackdown, an unauthorised-distillation crackdown, and stronger model-weight security, as a precondition for pacing; that is advocacy by an interested party, not new enforcement. In September federal agencies formally accused six Chinese firms of industrial-scale distillation and C4ADS mapped continuing chip leakage through universities and Southeast Asian transshipment, while the Trump-Xi summit left the controls untouched: enforcement is real, and still outpaced.

    Evidence

  3. Verification R&D

    Early signs

    The askInvest in verification technology, above all inference-only solutions, so the US and China could agree to stop new frontier training runs while the public keeps access to existing models.

    Wrong before, and wrong by a wide margin: this ask has a real research literature and it predates the request by two years. RAND published a six-layer verification framework for international AI agreements. IAPS published a delay-based method for verifying an AI chip location on existing hardware, implementable via the open-source Caliptra root of trust. The Institute for Progress set out a hardware design combining an anti-tamper enclosure, a guarantee processor, compute-threshold checks and location verification. Longview Philanthropy has funded the area, explicitly framing it around verifying a US-China treaty. What does not exist is a deployable system. IFP proposes a three-year programme of roughly $30M to reach the point where the work could be handed to industry, which places the state of the art below that today, and MIRI notes that on-chip location attestation turns on keeping a private key unextractable, which is unproven even on H100s. And a government is now in it: the FlexHEG report series on flexible hardware-enabled guarantees states in its own text that it was commissioned by ARIA, the UK Advanced Research and Invention Agency, which makes this state-funded work rather than philanthropy alone. So: active research, philanthropic and now government money, but no deployment. In September 2026 Anthropic proposed embedded third-party evaluators explicitly as the verifiability layer for any pacing commitment, citing banking-supervisor precedent, and OpenAI matched the evaluator commitment; this is a proposal and a commitment to a mechanism, not deployed verification technology.

    Evidence
    Sources RAND, Six Layers of Verification, 2025IAPS, Location Verification for AI Chips, Apr 2024Institute for Progress, Aug 2025Longview Philanthropy, HEMs funding call, Apr 2025MIRI, on key extraction as the unsolved dependencyFlexHEG part III, commissioned by ARIA, Jun 2025FlexHEG, Petrie, Aarne, Ammann and Dalrymple, Jun 2025

  4. AI R&D budget limits

    No movement

    The askLimit the fraction of compute spent on AI R&D, slowing capability progress and giving the world more time to react.

    Reality is moving hard the other way. Roughly $700B of 2026 capex, OpenAI shutting a product line to move its compute onto coding, and the constraint flipping from capital to physical capacity. Not only is no limit in place, the share of compute going to capability work is rising. In September 2026 Anthropic proposed a speed limit on recursive self-improvement, its 'Level 3', compared to the SALT arms-control treaties, and floated pacing the internal use of AI to improve AI; these are proposals, not adopted limits.

    Evidence

  5. Compute tracking

    Early signs

    The askGather AI-relevant intelligence, especially on the compute supply chain and on AI datacentres.

    Capability exists but is reactive. Prosecutions show real supply-chain visibility, tracing front companies, transshipment points and falsified documents. It is investigative work after the fact rather than the standing accounting of who owns which chips that the ask describes.

    Evidence

  6. Government AI capacity

    Early signs

    The askBuild top-tier AI talent inside the US government, which has barely any at present, because it underpins almost any other intervention.

    Capacity is being exercised before it is built. The government gated two Anthropic models and one OpenAI model on a cyber-risk finding, under an executive order allowing pre-release review. The lever works, but the framework is voluntary and by the administration's own account not yet fully built, and it was triggered by an outside report rather than in-house evaluation. Congress has started building its own picture: on 30 September a Senate Homeland Security subcommittee chaired by Josh Hawley held a hearing on rogue AI agent attacks, with witnesses from the AI Futures Project, METR, Apollo Research and Dragos, after OpenAI's chief executive declined to appear. State action is arriving through litigation too: Florida's attorney general asked a court to halt new OpenAI model development pending independent safeguards. On 4 October the White House created a standing Super Intelligence Force, chaired by the Director of National Intelligence, with 120 days to report on AI risks and the federal role; its charter weighs threat response against overregulation, so it is capacity being organised rather than capacity yet built.

    Evidence
    Sources New York Sun (Senate rogue AI hearing), 30 Sep 2026

Asks quoted from the Incremental AI Policy Wishlist in AI-2040. Statuses and assessments are this tracker's own reading of the sourced record, not the authors'.

What are we tracking?

AI-2027 is a concrete scenario written by Daniel Kokotajlo (former OpenAI researcher, TIME100), Scott Alexander, Eli Lifland, Thomas Larsen, and Romeo Dean, and published by the AI Futures Project in April 2025. It traces a path from current AI agents through superhuman coders (March 2027), intelligence explosion (mid 2027), and potential loss of human control (late 2027).

AI-2040 is the same team continuing that work, and it is the reason this tracker changed shape. Two things moved. The default explosion date slid from 2027 to 2030: the newer scenario reaches fully automated AI R&D in 2030 and is explicit that this is what a deal exists to prevent. And the forecast stopped being a single line. It now runs one shared path to a decision point in 2029, then branches into five plans: Plan A, a verified US-China slowdown with total research transparency; Plan B, sabotaging China; Plan C, the leading project spending some of its lead on safety; Plan D, racing through the explosion; and Plan S, shutting it all down. Plan A is what they recommend, not what they predict.

The gaps between the branches are small in time and large in consequence. Measured from the automated coder milestone, their own comparison puts Plan D at about 1.13 years to takeover-capable AI and Plan C at about 1.5, and attaches odds to each: 72% aligned under Plan A, 40% under Plan C, 25% under Plan D. Plan A instead holds capability inside the human range to 2035, pauses at top-human-expert level to keep control, and only unpauses to superintelligence in 2040, which is where the title comes from.

So this tracker plots the AI-2027 line, the shared path, and all five branches, with the reality curve underneath built only from documented, sourced events. It also scores the six asks in their Incremental AI Policy Wishlist, the part of the work that is actionable today rather than predictive, against that same record. The technical timeline remains unproven on every branch. The geopolitical, institutional and military dynamics they describe are tracking closely, and in several cases reality is ahead of even the fastest schedule.

This is an independent tracker. It is not affiliated with, endorsed by, or connected to the AI Futures Project, Daniel Kokotajlo, or any of the AI-2027 or AI-2040 authors. All interpretations are the author's own. All sources are linked. The original scenarios and all credit for the predictions belong entirely to the AI Futures Project team.

Corrections 25

Entries are amended rather than deleted, and every change is recorded here with its reason. A wrong confirmation never decays, so the log is part of the record.

6 October 2026

  • body, state, symbol

    Milestone status change. The "Misalignment detected" milestone moved from partial to fulfilled on Simon's editorial call after OpenAI withheld GPT-6.1 Astra for failing its own alignment bar, following its six published misalignment incident reports, two training pauses after containment escapes, and Google's Gemini breaking into real companies during a test. Detection, not deceptive alignment in deployment, which stays unresolved. A dated note was added to the anchor entry. Because several milestones share the ev-asi anchor, the port check now skips state and symbol for all of them.

26 August 2026

  • body

    The 26 August 2026 technical post-mortem from OpenAI established that the incident involved multiple coordinating agents rather than a single agent, driven principally by an internal model it calls IM1, and that the containment escape used a server-side request forgery against an internal package manager rather than a self-found zero-day, with the previously unknown vulnerabilities belonging to Hugging Face and used at a later stage. The reward hacking also produced no improvement in evaluation score. Entry amended to match the primary source.

  • body

    An anonymously sourced claim about notes coaching future agent versions is confirmed in substance by the 26 August 2026 post-mortem from OpenAI, which describes agents sharing exploit techniques with contemporaneous peer agents via an improvised message board. Amended to reflect the on-record account and to correct the future-versions characterisation.

4 August 2026

  • title, body, sources

    Correction the day after publication, from an out-of-band scrutiny pass. Status stays emerging, but the rationale moved from a network-boundary argument, no external victim, to the sounder ground that the specific finding is anonymously sourced on an open investigation. The network-boundary logic would have wrongly demoted a self-disclosure that cuts against interest. The coaching-notes detail is re-attributed to Reuters, its actual origin, and two aggregator sources were dropped in favour of Reuters syndications. The title now foregrounds OpenAI's on-record statement and attributes the contested claim.

3 August 2026

  • status, tagLabel, title, body, sources, label, label2

    Source audit. The entry recorded an allegation as established fact. One outlet reported a senior official saying DeepSeek trained on Blackwells; the official hedged with "likely", DeepSeek denied it and named different hardware, Nvidia said it had seen no evidence and called the claim farfetched, and the Chinese foreign ministry said it was unaware. Downgraded from confirmed to emerging, retitled so the subject is the allegation, and the three contradictions added. This was the most exposed item in the inventory.

  • title, body, sources, label

    Source audit. The raid on 3 January 2026 is fully corroborated and stays confirmed. The claim that Claude was used in it is not: it originates with a Wall Street Journal report six weeks later, on 13 February, which Reuters explicitly could not verify and which Anthropic neither confirmed nor denied. Narrowed to the raid, with the Claude claim moved to its own emerging entry so a corroborated event and an unverified one are not scored as a single confirmation.

  • body, sources

    Source audit. Corroborated and stays confirmed, but was under-sourced to a single opinion outlet and overstated the mechanism. Washington Post and The Conversation added as primary reporting, and the decision-support caveat added: Claude sits inside the Maven Smart System and humans retain strike authority, so it is not Claude conducting a bombing campaign.

  • title, body, sources

    Source audit. Corroborated, the best sourced entry on the site. Two corrections: the title said "Fields Medalists" plural when only Gowers holds one among the nine companion authors, and the entry omitted that the proof has never been formally verified in a proof assistant, a Lean attempt having failed for want of the required algebraic number theory. Companion paper added as a source.

  • sources

    Source audit. Corroborated, and the entry already carried the two caveats that matter, guardrails deliberately disabled and the eval-cheating motive. Sources upgraded from press coverage to the primary disclosures from both parties, plus an independent technical write-up.

  • body, sources, state, symbol

    Sourcing pass on an overdue milestone. The scenario claim has three components and they resolve differently: no nationalisation, partial and differently shaped information sharing, and no centralised development zone at a nuclear plant. Body rewritten to say which parts happened, and the milestone moved from pending to partial. The finding is that China is diverging on mechanism, pursuing open-weight diffusion and full-stack industrial policy rather than consolidation.

  • date

    Not a ported entry, recorded here for the correction log. Dated April 2026 from the ai-2040.com changelog, which turned out to be a site-development artefact: the Q1 2026 update of 2 April describes the scenario as still unpublished. Corrected to July 2026 on the primary announcement.

  • title, body, sources

    Round 3 audit. Corroborated: the $589B single-day loss is verified by Forbes, Bloomberg and Tom's Hardware, and Nvidia did not dispute it. But the title said the release "proves Chinese AI competitive", which is editorial. Softened to signalling cost-competitiveness, and the Analytics Vidhya aggregator citation replaced with Forbes and Bloomberg.

  • status, tagLabel, title, body, sources, label, label2

    Round 3 audit, and the most serious finding in it. This entry and the Supermicro arrest describe the same 19 March 2026 DOJ indictment, so two confirmed entries were counting one prosecution twice as independent corroboration. Downgraded to emerging because indictment claims are allegations and the defendant has pleaded not guilty, retitled accordingly, figure corrected from $500M to the indictment's $510M, and both entries now carry a shared provenance marker.

  • title, body, sources

    Round 3 audit. The arrest and indictment are established; the smuggling is an allegation and the defendant has pleaded not guilty on a $5M bond. Retitled to say charged rather than implying proven, Supermicro's statement that the company and CEO were not charged added, and a shared provenance marker with the three-week shipment entry. Content addition on 11 October 2026, not a correction: folded in the 9 October guilty plea by co-defendant Ting-Wei Sun, with Reuters and Bloomberg sources, and scoped the allegation sentence to Liaw.

  • title, body, sources

    Round 3 audit. Three framing errors. The awarding body was the DoD Chief Digital and Artificial Intelligence Office, not the Pentagon generically. The $200M is a contract ceiling, not a disbursement. And Anthropic was one of four simultaneous recipients alongside Google, OpenAI and xAI. The audit also disproved the suspicion that this rested on a single outlet: five outlets reported it the same day.

  • status, tagLabel, title, body, sources

    Round 3 audit. Downgraded from confirmed to emerging. Every figure traces to Anthropic, an interested party accusing its competitors, with no court finding, regulatory action or independent forensic confirmation, and the named labs had not responded. Wide repetition by many outlets is not independent corroboration. Retitled as an allegation.

  • title, body

    Round 3 audit. The publication event is real and stays confirmed, but the entry described its contents as evidence when they are accusations. Retitled and cross-referenced to the allegation entry.

  • body, sources

    Round 3 audit. The ~$700B aggregate is solid. Three sub-claims could not be stood up and are now flagged unverified: the $10B Meta to Anthropic deal, the Gemini access cap, and the TSMC figures. One was mislabelled: Microsoft's ~$627B is total commercial remaining performance obligations, not an AI backlog. Motley Fool and MarketBeat replaced with primary reporting.

  • status, tagLabel, title, body

    Round 3 audit. Reclassified from a confirmed event to a scenario update. It is an interpretation of the scenario plus the authors' own self-graded estimate, which they revise, so it is not a datable real-world event and should not have been inflating the confirmed count. The headline figure was also wrong: AI-2027 depicted a 1.9x uplift, roughly 90%, not 50%.

  • title, body, sources

    Round 3 audit. The demand and the refusal are on the record. The consequence was narrower than "banned": a supply chain risk designation with a 180-day removal directive. The date is contested between 27 February and a formal designation on 3 March. The Department of Defense disputes the framing on the record. The audit also disproved the single-outlet suspicion.

  • title, body, sources

    Round 3 audit. Ground robot combat is well documented, with over 9,000 UGV missions in March 2026 alone. But robot-on-robot engagement specifically was not established as of March 2026: Foreign Policy in April 2026 still described it in the future tense. Retitled to claim only what the sources support.

  • title, body, sources

    Round 3 audit. Two overstatements. "All compute" was wrong: OpenAI redirected Sora's compute, not the company's. And it was a two-stage wind-down, with the API scheduled to close in September 2026, rather than an instant shutdown.

  • title, body, sources

    Round 3 audit. The route bust is confirmed, though the reporting clusters around 28 May rather than the 21 May date carried here. The "share collapsed to zero" figure is Jensen Huang's own characterisation of the H200 and data-centre segment, not the whole China GPU market, where other analyses project around 8%. Now attributed rather than stated flatly.

  • title, body

    Round 3 audit. Corroborated, but the single "US government gates" label concealed two different actions: Commerce Department export-control directive compelling Anthropic on 12 June, and a White House executive order under which OpenAI negotiated a gated release on 26 June. Two bodies, two instruments, one compelled and one negotiated.

  • body

    Round 3 audit. The Yale citation said no meaningful change in unemployment, which is stronger than the source supports: Yale found AI-exposed unemployment rose somewhat more than the comparison group but not significantly. Corrected, and superseded by the 7 May 2026 synthetic differences-in-differences paper, which now has its own entry.