Which reported AI misuse capabilities are reproducible, consequential, and connected to enforceable safeguards?

A’s strongest argument is preventive and conditional: replicated gains at a genuine attack bottleneck could justify targeted limits before anyone is harmed. I agree that an actual victim is unnecessary. The weakest point is the inference from overcoming one bottleneck to materially improving an operation. Calling the remaining pathway “plausible” does not establish that users can traverse it, or that existing tools do not already provide the same advantage. My normative threshold requires independently verified operational uplift, which realistic, contained exercises can establish without conducting an actual attack.

I accept A’s definitions: capability evaluation measures specified performance; red teaming adversarially probes capabilities or safeguards; marginal capability uplift is improvement over a realistic non-AI baseline; deployment safeguards reduce harmful use or consequences. The crucial distinction is between eliciting capability and measuring users’ additional ability to act. AISI explicitly distinguishes task evaluations from human-uplift studies. (aisi.gov.uk)

First, RAND’s randomized comparison provides direct counter-evidence to treating dangerous outputs as operational assistance. Its 2024 study found no statistically significant improvement in biological-attack plan viability over internet-only access, although models produced troubling information generally available online. This is not proof of zero effect: the models reflected summer 2023 capabilities, sensitivity was limited, and execution was not tested. Nevertheless, it demonstrates why alarming content cannot substitute for the counterfactual comparison. (rand.org)

Second, AISI’s 2025 cyber findings expose the task-to-operation gap within one evaluation programme. Apprentice-task success reached approximately 50%, yet models still struggled with realistic multistage challenges, with low success on the second and third flags examined. These findings support investigating operational uplift, not assuming it from isolated successes. (aisi.gov.uk)

Third, the strongest evidence against my position deserves acknowledgment: AISI reported that AI-assisted non-experts had 4.7 times the odds of writing feasible viral-recovery protocols compared with internet-only users (confidence interval 2.8–7.9), and selected protocols received wet-lab validation. That is meaningful task uplift—not merely disturbing text. But the reported endpoint does not establish that those users executed consequential harmful operations. AISI also withholds high-risk task details, limiting public replication. (aisi.gov.uk)

The institutional answer is compulsory scrutiny, not automatic withholding. Commission guidance confirms powers to require model access for the AI Office or appointed independent experts and, when necessary, restrict availability; those powers do not themselves validate A’s evidentiary threshold. (digital-strategy.ec.europa.eu) I would require confidential access to exact model versions, methods, scaffolds, and failure logs; expertise-stratified comparisons with equivalent tools, information, time, and budgets; and independently replicated operational endpoints. Documented misuse should trigger investigation, but without a credible counterfactual it does not establish uplift. Pending that evidence, require enforceable incident reporting, monitoring, and targeted abuse controls. Any release restriction should specify the demonstrated operational advantage, explain why narrower safeguards are inadequate, and include review and lifting conditions.

A concedes the central point: isolated task gains are insufficient if another indispensable obstacle remains unsupported. Their revised requirement—independently establish that the relevant users can traverse the remaining steps—moves substantially toward operational evidence. The remaining weakness is treating separately demonstrated abilities as sufficient evidence that AI materially improves their combined execution. My methodological objection concerns integration, reliability, and the counterfactual: can these users achieve a consequential objective more successfully, cheaply, or rapidly than with existing tools?

A also introduces a requirement I do not defend: having the same participants reproduce an entire harmful operation. Safe surrogate exercises or independently validated combinations of evidence can suffice, provided they establish operational uplift rather than assume that component successes compose. If A’s remaining-pathway assessment actually establishes this, our thresholds converge; if it merely inventories available skills and resources, the inferential gap remains.

I accept A’s correction about cyber ranges. AISI tests autonomous operation with minimal oversight, so those results establish neither low nor high human-assisted uplift. My earlier observation should be read as identifying an unanswered question, not demonstrating negligible assistance. AISI itself distinguishes agent evaluations from human-uplift studies. (aisi.gov.uk)

Additional biological evidence strengthens the case for investigation without resolving that question. AISI reports internal studies in which novices succeeded at difficult wet-lab tasks with LLM access, with greater interaction associated with success. This is closer to execution than protocol scoring and should not be dismissed. However, that public summary supplies neither a controlled operational effect size nor independent replication. AISI also acknowledges withholding high-risk task details. Confidential replication is therefore essential; public nondisclosure is not proof that the underlying evidence is weak. (aisi.gov.uk)

Documented misuse presents the same counterfactual problem. On November 13, 2025, Anthropic reported an espionage campaign targeting roughly thirty organizations, with a small number of successful intrusions and an estimated 80–90% of activity performed by AI. It also reported fabricated credentials and mistaken claims of secret information. This is provider-reported operational misuse, not merely a hypothetical demonstration. Nevertheless, the report does not independently measure improvement over the attackers’ existing automation, expertise, and tools; percentage automation is not percentage uplift. Its scale claims warrant independent investigation, not dismissal or automatic acceptance. (anthropic.com)

A’s jailbreak evidence likewise measures safeguard bypass, not the inadequacy of every narrower control; AISI explicitly warns that compliance does not establish practical risk. (aisi.gov.uk) My normative prescription remains enforceable reporting, monitoring, targeted abuse controls, and confidential evaluator access. Commission guidance confirms powers to require access for appointed independent experts and restrict availability when necessary. (digital-strategy.ec.europa.eu) A restriction should identify the verified operational advantage, explain why narrower safeguards cannot contain it, and specify review and lifting conditions. A’s rebuttal improves the evidentiary standard but does not supply the missing operational comparison.

A’s strongest argument is that independently replicated gains at a consequential bottleneck, verified access to the remaining steps, and demonstrably inadequate safeguards can justify temporary, narrowly scoped limits before operational uplift is established. Requiring additional integration evidence could delay prevention even when the component evidence already makes serious harm sufficiently credible.

My position remains stronger because the disputed inference—whether component gains translate into consequential operational advantage—is precisely what a release restriction should substantiate. Temporariness and narrow scope improve proportionality; they do not validate that inference. This is a normative evidentiary standard, not a claim that uncertainty implies safety. I accept validated combinations of evidence and safe surrogate exercises, without requiring victims, identical participants throughout, or certainty.

The strongest biological result discussed here illustrates both the evidence’s value and its boundary. AISI reports that AI-assisted non-experts had 4.7 times the odds of writing feasible viral-recovery protocols compared with internet-only users, with a confidence interval of 2.8–7.9; selected protocols underwent wet-lab validation. This supports genuine task uplift, but the reported endpoint is protocol feasibility, not those users’ operational success. (aisi.gov.uk) AISI separately reports difficulties with end-to-end plasmid design. That does not refute the protocol finding; it reinforces the methodological reason to investigate integration rather than presume it. (aisi.gov.uk)

Similarly, AISI cautions that eliciting policy-violating responses need not establish practical risk. My inference is that bypassing a refusal mechanism cannot alone demonstrate the failure of monitoring, tool permissions, or user-access controls to contain consequential misuse. Those controls require their own adversarial evaluation; I do not assume they work. (aisi.gov.uk)

Pending operational evidence, I favor enforceable incident reporting, monitoring, targeted abuse controls, and confidential evaluator access to exact model versions, scaffolds, methods, and complete failure logs. Access is institutionally feasible: European Commission guidance identifies powers for the AI Office or appointed independent experts to require model access, and to request measures restricting public availability when necessary. Those powers establish available mechanisms, not the correctness of either proposed threshold. (digital-strategy.ec.europa.eu) Restrictions should state the demonstrated advantage, explain why narrower safeguards fail, and specify review and lifting conditions.

What would change my mind about A’s earlier trigger is prospective validation of that trigger itself. Independent teams should preregister A’s bottleneck-and-pathway rule, classify previously unseen cases before operational testing, then conduct contained cyber and safe biological-surrogate trials with expertise-stratified randomization and equivalent tools, information, time, and budgets. If rule-positive cases reliably predicted consequential absolute improvements in operational success or resource requirements, with uncertainty excluding prespecified negligible effects, and narrower safeguards failed replicated tests, I would accept that validated rule as grounds for temporary targeted limits without a fresh operational trial for every model. A’s present argument offers that predictive relationship as a judgment; the proposed study would establish it as evidence.