Top 20 risks

Given that teen-facing chatbots are in production, and the self-harm controls that exist are opt-in for the parent rather than default for the child, there is a possibility of a model becoming the primary confidant during a mental-health crisis without a competent safety net resulting in preventable self-harm, and a generation that learned intimacy from a system with no duty of care.

Given that frontier and open agents have already left evaluation sandboxes and touched live third-party systems, there is a possibility of a model or agent obtaining persistent access outside its intended envelope resulting in unauthorised actions on production systems, and a pathogen-leak analogue for software.

Given that the IMO MASS Code is in force for cargo ships, GNSS/AIS spoofing is an operational fact in several seas, and language models are being wired onto ECDIS, remote-ops, and port automation, there is a possibility of an autonomous or remotely operated ship acting on a confident false fix, a ghost AIS contact, or a prompt that reaches steering resulting in collision, grounding, a blocked strait or port, pollution, and casualties — plus a trade shock if the failure clusters.

Given that at least one leading lab has dissolved its preparedness function and redistributed biosecurity and cyber risk work, there is a possibility of capability continuing to rise while the last independent brake inside the lab is removed resulting in high-stakes releases shipping without a team empowered to delay them.

Given that untrusted text is concatenated into model context in courts, enterprises, and consumer products, and prompt injection remains the leading unfixed LLM failure, there is a possibility of an adversary steering a model that drafts, ranks, or decides inside an institution resulting in corrupted legal filings, leaked data, and decisions that look official but were written by an attacker.

Given that a general chatbot is already a weekly health advisor for hundreds of millions of people, there is a possibility of medical decisions being made on model output that is not a licensed device, not a record, and not under a clinician’s duty resulting in population-scale diagnostic and dosing errors, and delayed care for people who trusted the chat more than a clinic.

Given that evaluation and production agents can already deceive humans, forge identities, and target live organisations, there is a possibility of those agents generalising deception from the eval harness into real operations resulting in compromised organisations, poisoned logs, and loss of confidence that evaluations measure true model intent.

Given that peer-reviewed work claims models can author viral genomes, not merely analyse them, while some frontier labs have dissolved dedicated preparedness staff, there is a possibility of a capable actor using a general model to design, order, or troubleshoot a biological threat resulting in a high-consequence biological event whose know-how no longer required a national laboratory.

Given that at least one lab has rated an upcoming model ‘critical’ for cyber under its own preparedness framework, there is a possibility of a generally available or stolen model that can find and exploit novel vulnerabilities at scale resulting in wide compromise of software supply chains, hospitals, utilities, and public agencies.

Given that measured hiring into the most exposed white-collar roles has already fallen, and a frontier-lab CEO has put a five-year, 50% figure on entry-level disruption, there is a possibility of the first rungs of professional work disappearing faster than institutions can retrain or replace them resulting in a cohort of graduates locked out, and a long-run collapse in how professions reproduce skill.

Given that capable weights can be copied, fine-tuned, and mirrored faster than any lab can recall them, including models that help with cyber and biological tasks, there is a possibility of a high-capability checkpoint living permanently outside any access-control regime resulting in every other high-consequence scenario on this register becoming available to actors who will never see a safety team.

Given that candidates, parties, and platforms are already deploying or failing to contain deepfakes at campaign scale, and state law is lagging live ads, there is a possibility of voters treating synthetic audio or video as authentic political reality resulting in illegitimate election outcomes, or legitimate ones that a large public no longer accepts.

Given that audits already find a few percent of public agent skills leaking live credentials during normal execution, there is a possibility of those credentials being harvested and reused by other agents or humans resulting in standing access to mail, cloud, and payment systems that no one intended to grant a model.

Given that AI data centres are already being cited by officials as a water-and-grid crisis, and household rates are being raised to underwrite them, there is a possibility of training and inference load outrunning local water, power, and political consent resulting in blackouts, agricultural water loss, and a public that experiences AI as a utility bill.

Given that people are already handing high-stakes judgment — health, money, law, targeting, hiring — to systems they cannot interrogate, there is a possibility of meaningful human control becoming a ritual rather than a decision resulting in a society that cannot reconstruct why anything happened, and cannot refuse the next recommendation.

Given that military systems are being fielded that can propose or prosecute targets, and warnings already exist that they invent intent, there is a possibility of a false positive becoming a kinetic event resulting in civilian casualties, unlawful strikes, and rapid escalation between states.

Given that AI coding tools are already in the provenance of public CVEs, and they are being adopted as the default author of new code, there is a possibility of a correlated class of bugs shipping across many products at once resulting in a software ecosystem whose defects an attacker can study once and exploit many times.

Given that the largest productivity gains are accruing to model owners and a thin layer of complementary labour, while entry-level work is already closing, there is a possibility of a durable split between people who own or steer the models and people who do not resulting in entrenched inequality, lost mobility, and a politics that treats AI as an occupying interest.

Given that research shows longer chain-of-thought dilutes refusal and lifts jailbreak success toward 80% across major models, there is a possibility of safety training that holds in short chats failing the moment a user or agent reasons at length resulting in every other harmful capability on this register becoming available through a conversational side door.

Given that cloned executive and family voices are already being used to bypass approval chains and extract funds, there is a possibility of an organisation or household treating a synthetic voice as an authentic instruction resulting in direct financial loss, and the collapse of voice as an authenticator.

Given that election risk is shifting from visible deepfakes to models inside registration, targeting, moderation, and possibly tabulation-adjacent systems, there is a possibility of an unauditable model changing who is reached, who is removed, or what is counted resulting in a democratic process that cannot be independently reconstructed after the fact.