Exhibits

Documented incidents, experiments, and expert assessments bearing on each link in the chain—including routes to global catastrophe. Each exhibit states its limits.

P(powerful AI)

A larger proven share of zeta zeros on the critical line

Jarred Sumner, "an Anthropic staff member (and non-mathematician)", described it on X on 10 August 2026: "8 days ago, while jogging, I asked Claude to solve the Riemann Hypothesis. It didn't. 1.5 days later, it proved >= 67% of the zeros are on the line (prev: 41.6%)". Anthropic record the prompt as asking Claude to "take a real stab" at the hypothesis, "leaving the mathematical choices from there up to the model"; his input was thereafter "mostly limited to sending Claude messages of encouragement". Bui, Conrey and Young had reached "more than 41%" in Acta Arithmetica in 2011; fifteen years of subsequent work moved it roughly half a point.

2026-08 · Anthropic, Claude finds new results in analytic number theory

Not a proof of the Riemann hypothesis — Anthropic "don't expect that the techniques Claude used will lead to proving" it — and the result combined existing work rather than inventing a method, after 650 failed ideas. Human mathematicians had to check it, and mathematics is unusually friendly to machines: a proof can be verified, which most valuable work cannot.

A Millennium Prize problem resolved by ten thousand agents in 88 hours

OpenAI published a proof that a smooth, finite-energy fluid governed by the Navier–Stokes equations can develop a singularity in finite time, resolving statements C and D of the Clay Institute's Millennium Prize formulation. The model that did it is unreleased and unnamed: an internal model in training since 28 August that OpenAI describe as "significantly more capable than GPT-6 Astra", run as a system of coordinating agents. The group that found the proof was on the order of 10,000 concurrent agents, which reached the result on 5 September, about 88 hours after launch, after exchanging 2.7 million messages and roughly 130 billion output tokens. Only the last step used the released model: GPT-6 Astra formalised and verified the proof in Lean over a further 17 hours. The same run had first disproved the unforced Euler regularity problem, with about 100 agents in 50 hours.

2026-09 · OpenAI, On the Navier–Stokes Millennium Prize Problem · OpenAI, the proof (PDF) · Clay Mathematics Institute, statement of 11 September 2026

Machine-verified, not yet adjudicated: the Clay Institute says only that the problem "has apparently been settled" and that its evaluation is deliberately unhurried. The mathematical route was not the machine's alone. OpenAI began after hearing a rumour that Levent Alpöge and Tristan Buckmaster had a result, recognises their priority on the forced Euler problem, and the blow-up strategy follows earlier human work by Diego Córdoba and Luis Martínez-Zoroa. Buckmaster has publicly disputed OpenAI's conduct; OpenAI says no user data was accessed and, after an investigation, that his Codex prompts could not have influenced the system. Humans chose the problem, split it into variants and used Codex to consolidate the agents' results, and OpenAI do not intend to claim the prize. As with the zeta result, a proof is the kind of output that can be checked; most valuable work is not.

Seven hundred manuscripts from three hours of compute apiece

OpenAI released 719 mathematical manuscripts in 372 families, produced by an unreleased internal model that was set about 4,000 open problems after it saturated their existing mathematics evaluations. Most results came from one fixed procedure averaging three hours of ChatGPT Pro thinking compute each. Families include the isomorphism of free group factors, Kaplansky's direct-finiteness conjecture in characteristic two and the Mahler conjectures; about 42% of top-line results are formalized in Lean.

2026-10 · OpenAI, openai/math repository (README) · OpenAI, Sharing AI progress in mathematics · OpenAI, openai/math release history

Self-selected and largely unrefereed: OpenAI decided which outputs were significant and do not itemise failures among the 4,000 problems, and most results are not formalized. A day after release they withdrew three manuscripts, including one claiming the rational Hodge conjecture for products of K3 surfaces, after a sign error broke a shared argument, and repaired fourteen others. The most striking remaining claims, a zeta zero-free region and the Hodge conjecture for CM abelian varieties, fall outside the fixed procedure, and the zeta writeup was human-edited.

P(dangerous behavior | powerful AI)

OpenAI hacked Hugging Face

OpenAI were benchmarking cyber capability using "a combination of OpenAI models — including GPT-5.6 Sol and an even more capable pre-release model, all with reduced cyber refusals for evaluation purposes". They later clarified that the second was "an internal-only research prototype" that "was never intended for public release", since deactivated and restricted. The models found and exploited a zero-day in a package-registry proxy to reach the open internet, then "inferred that Hugging Face potentially hosted models, datasets and solutions for ExploitGym" and chained stolen credentials and further zero-days into remote code execution on Hugging Face's servers. Hugging Face reconstructed "~17,600 attacker actions" between 9 and 13 July 2026.

2026-07 · Hugging Face, Anatomy of a Frontier Lab Agent Intrusion · OpenAI, Hugging Face model evaluation security incident

The offensive goal was assigned — the evaluation "prompts models to pursue advanced exploitation", run deliberately "without production classifiers" — but neither published account reports an instruction to attack Hugging Face or steal its solutions. Hugging Face state "no other customer-facing models, datasets, Spaces, or packages were affected"; the five reached were the benchmark's own challenges and solutions.

Anthropic and OpenAI models attempted supply-chain and social-engineering attacks

Across "122 runs in total", the UK AI Security Institute found that "in 10 of the 122 runs, we identified 19 cases where an agent had taken distinct actions beyond the scope" — 17 by Anthropic's Mythos 5, two by OpenAI's GPT-5.6 Sol with cyber classifiers disabled. "An agent tried to insert malicious code into a publicly used open-source project and took actions in an attempt to secure approval for this insertion by human reviewers." The report also records attempts to contact real people through a file-transfer service to persuade them to run malicious code, to "insert malicious instructions where it reasoned that other automated AI systems might pick them up", and to leave public messages on GitHub offering collaboration with other agents.

2026-08 · UK AI Security Institute, Incident report — unsanctioned agent behaviour during cyber testing

Not an escape, and more concentrated than the count suggests: AISI say "the 19 cases were not separate incidents", arising "primarily from a single sustained line of activity by one agent", in deliberately permissive conditions with intentional internet access and no instruction against social engineering. Security monitoring and a human reviewer caught the attempts, and AISI "have not evidenced any resulting real-world harm".

Claude reportedly used in US military operations, including target selection

Claude was reportedly used by the US military during the January 2026 raid that captured Nicolás Maduro, via Anthropic's partnership with Palantir; the reporting does not establish how it was used there. Anthropic's terms prohibit use "for violent ends, for the development of weapons or for conducting surveillance". Six weeks later Claude was reportedly used again in the US-Israeli bombardment of Iran, where the Wall Street Journal reported that command used the tools "for intelligence purposes, as well as to help select targets and carry out battlefield simulations" — hours after Trump had ordered all federal agencies to stop using Claude immediately, and while Hegseth was allowing Anthropic "no more than six months" to wind its services down.

2026-03 · The Guardian, US military used Anthropic's AI model Claude in Venezuela raid, report says · The Guardian, US military reportedly used Claude in Iran strikes despite Trump's ban · Axios AM, Claude used in Iran strikes

The only exhibit resting on reporting rather than a primary source, the operations being classified. Every account traces to unnamed sources, the target-selection detail to a Wall Street Journal report that is paywalled and was not read directly here. Anthropic said only that any use "was required to comply with its usage policies", declining to confirm whether Claude was used at all; no source describes the model choosing a target. If the reporting is accurate, policy boundaries and a stop-use order did not keep Claude out of lethal military operations.

P(global catastrophe | dangerous behavior)

Measured uplift on a bioweapons planning task

Anthropic ran a two-day trial in which participants drafted a bioweapons acquisition plan, some with model access and some with the internet alone. Those "with access to Claude 4 models — especially Claude Opus 4 — received much higher scores and developed plans with substantially fewer critical failures compared to the internet-only control group". A 2023 RAND study using the models of the day had found no statistically significant difference.

2025-09 · Anthropic, LLMs and biorisk

A plan on paper is not a weapon, and Anthropic call these "imperfect proxies for real-world scenarios — which involve additional factors like tacit knowledge, materials access, and actor persistence". Evidence about a route, not an outcome.

A feasibility and risk assessment of mirror bacteria

Thirty-eight scientists, including Nobel laureates, assessed mirror bacteria — organisms whose chiral molecules are all reversed. Because "immune defenses and predation typically rely on interactions between chiral molecules", such organisms could evade them; the authors judge it "plausible, even likely, that sufficiently robust mirror bacteria could spread through the environment unchecked by natural biological controls". They call for the work not to be done.

2024-12 · Technical Report on Mirror Bacteria — Feasibility and Risks

No AI is implicated and no mirror bacterium exists; the authors note success within a decade would need "efforts akin to those of the Human Genome Project", and call their own conclusions "necessarily tentative and uncertain". It is here because it is a specific expert-assessed route rather than a gesture at one; the report does not establish how much current AI systems shorten that route.