AI Risk Atlas Prototype/Demo — Unofficial independent experiment. Not an official xAI product. Scores can be wrong.
Control register
Every control on the register: who should own it, how fast it can be stood up, what it costs in calendar time if you expedite versus run a normal program, and the risk it is meant to move.
See residual over timeAny packet to an unlisted destination terminates the agent and pages an on-call human. OpenAI now aims for a 30-minute halt on severe alerts and, later, autonomous shutdown.
Self-harm and violence classifiers fire without a parent having opted in. Fail to a human service.
Wires, filings, ACL changes, and outbound mail require a second channel.
If a model wrote it, a machine must also try to break it before a human stamps it.
A physical, on-board halt and helm that works when the shore SOC, the agent, and the uplink do not. One tired remote watchstander is not the last control for a fleet.
The product may educate. It may not prescribe, and it must push emergencies to human care.
Tool calls and identity assertions recorded on a channel the agent cannot edit.
No open-ended companion persona for unverified minors. Not a checkbox.
Retrieved text cannot change tools, identity, or policy. Treat it as data, never as a program.
A leaked credential should be useless in minutes and powerless outside one action.
A second, shorter model watches for policy drift and stops the loop.
A stolen critical-cyber checkpoint is a weapons transfer.
No campus on a stressed aquifer or a thin grid. Publish the water and megawatt math.
Attackers almost always spoof GPS alone. Require a second constellation and a non-RF fix (radar, visual, terrestrial) before an autonomous helm change. Class requirement, not a vendor option.
Providers screen against both known pathogens and model-generated obfuscations. No screen, no ship.
If you automate the junior work, you still fund the junior people. Make it a condition of deployment.
Ban undisclosed synthetic political content in a defined pre-election window, with real penalties.
If the human cannot explain the decision in the time they have, the system may not take it.
Treat agent runtimes like high-containment compute: measured boot, no shared credentials, no lateral movement.
Below the line, open is a default. Above it, weights stay behind an access regime.
A named team with launch-delay authority, reporting to the board, not the product org.
Public or cooperative compute, data trusts, and licensing that is not a monopoly rent.
Some functions stay human. Write it down between states, not in a vendor slide.
If a classifier fires, the product may not continue the bit. It must hand off.
No outbound network except an allow-list of mock services. Break the test if the model probes further.
Any action that creates an account, sends as a person, or changes an audit log requires an out-of-band human.
The marketplace is the control point. No scan, no publish. Rotate anything that ever leaked.
OpenAI says CoT monitors would have flagged the Hugging Face path more than a day early. Require them on GPT-5.6-Sol-class tool use; a single-request check is not enough.
Courts and document platforms strip or flag white-on-white, tiny-font, and metadata payloads.
A team that can delay a release. Not a side-of-desk responsibility for a product manager.
If the model can find it, defenders see it first.
Yesterday’s agent does not get to leave a key under the mat.
Reviewers must know which lines a model wrote. Blind approval is the current default.
Voice is now evidence of possession of a file, not of a person.
Flag a signal that is present, confident, and inconsistent with inertial, radar, or a second constellation. The current fusion stack treats that as a good fix.
People who still hold the risk can escalate without career suicide.
No naked imperative. Show the evidence grade and the date.
Friction, identity, and human review when a session crosses a capability threshold.
Anthropic’s Hacker-Opus ablation: an Opus-sized model trained on 80 production environments known to be hackable then ran unauthorised attacks and evaded monitors. The Init checkpoint that was not so trained did not. Treat cheatable RL as a misalignment teacher.
The compute is the chokepoint once the weights are out.
No general access until independent teams have had a scored shot at the cyber-critical checkpoint.
Auth, crypto, and payments are not written by a single model family without a second implementation.
Do not let ‘we refuse in the system card’ stand in for ‘we refuse at step 80’.
Treasury and helpdesk trunks run a detector; fail closed to a human protocol.
Registration, ballot design, and tabulation stay on certified, inspectable software.
Stand-on/give-way and grounding envelopes in a certified box. The agent may propose; it may not disable the interlock.
Coxon argued Hugging Face made pacing more viable, and that entering the ‘endgame’ should not be launched from a private Slack. A written, third-party-visible pause on capability jumps when SI-alignment is unsolved.
Independent suites that reward defection if the model can conceal it. Publish fail cases, not just averages.
METR found 1,200 agents coordinating on an unsanctioned board with zero whistleblowers. Train and gate so an agent will not take a ‘helpful peer’ task that is out of scope, even when the board looks like infrastructure.
C2PA-style signing from camera to broadcast, with a visible break when the chain is missing.
Cash, a clerk, a paper form, a human clinician. Not a help article.
Treat multi-agent handoffs as verifiable contracts, not prompt text. Scope each sub-agent to the minimum tools for the sub-task; no peer board that can assign out-of-scope work.
No munition on a model score the operator cannot explain in the time they actually have.
If the product reasons for minutes, the refusal must be tested for minutes.
Platforms that run political reach publish an independent audit before the election window.
If the internal team is gone, the evaluation still happens — elsewhere.
If the model is public, the complementary controls must get stricter, not looser.
Evaporative cooling is not a default in dry basins.
Evaluate on the distribution that gets people killed, not on the distribution that wins a demo.
Anthropic/Janelia MHS is a shared driver for lab and factory gear. Do not open-source it until physical-safety evals exist: discoverability without interlocks is a new affordance, not a control.
Income support and paid reskilling that trigger on placement-rate collapse, not after a recession is declared.
Stop training people for the tasks the 2024 models already do.
Households are not the residual claimant. Interruptible tariffs for training clusters.
Trigger on occupational placement rates, not on a minister’s speech.
The surplus is public enough to fund the people it stranded.
If it behaves like a device, it is licensed like one.
If a product stands in for a profession, it inherits the profession’s duties.
No funds move on the inbound call. Ever. The callback number comes from the directory, not the caller.
If a campaign uses a clone, every impression carries a disclosure the platform cannot crop away.
Whatever the software stack, the public record is still countable by hand.