This is an immutable historical record. Its evidence, synthesis, forecasts, citations, and caveats are frozen as published. Any later correction is disclosed separately; editorial revision appears in a later edition's forecast journal, not as a silent rewrite.
Evidence legend
Edition dated September 2, 2026
Reported fact
Stated by a named, linked source. Company and laboratory reports establish what those organizations reported; they do not substitute for independent replication.
Editorial synthesis
Our reading across several cited sources. The sources are linked; the interpretation is ours.
Forecast / hypothesis
A bounded outlook with a time horizon and a stated observation that would disconfirm it.
Executive synthesis and edition metadata
Executive view
Two frontier laboratories moved cyber capability behind restricted access, monitoring, and paced release on the same day, and a third reported externally assayed biological design results. The common thread is that capability claims now arrive bundled with access control or with an external validation step, rather than with open artifacts.
Every headline number below is vendor reported. None of the three items shipped matched baselines, complete artifacts, or independent replication at review time.
Edition metadata
Data current through: 2026-09-02 09:50 PDT / 2026-09-02 16:50 UTC Evidence window: last 24 hours first; seven-day catch-up; trailing 90-day context Editorial status: Reviewed
Reviewed developments (3)
01Frontier cyber capability now triggers restricted access, monitoring, and release pacing
Evidence maturity: primary vendor capability reports and release policy statements.
What changed: OpenAI designated Astra its first Critical cyber model. OpenAI reports 100 percent on the public ExploitBench, two zero-day findings within a 20-vulnerability internal V8 set, and working exploit chains against hardened browser and operating-system targets. Google released Gemini 3.8 Flash Cyber to trusted defenders, reporting above 70 percent on an internal 20-language vulnerability set and 47.2 percent pass@1 on the external CWE-Bench patching benchmark.
Why it matters: the release decision, not only the score, is now part of the capability claim. Access gating, named-defender programs, usage monitoring, and pacing are becoming standard infrastructure for a single model rather than a company-wide policy.
Application: defender teams should plan for gated evaluation access, prove monitoring requirements before onboarding, and treat patch-validation throughput, not vulnerability discovery alone, as the operational constraint.
Bottleneck and caveat: both results are vendor controlled. Models, tools, and compute budgets are unmatched across the two reports, the Astra system card was pending at review time, and replication is restricted by design.
Disconfirming observation: an independent evaluation under matched tooling and budget finds no capability separation from open models, or comparable cyber capability ships without restriction and without published incident evidence.
02Agentic video understanding turns frame selection into a tool-use policy
Evidence maturity: primary vendor product report with best-case figures.
What changed: Google describes an agentic video mode that dynamically selects which video windows to inspect, at what frame rate, and whether to use audio or transcript. Google reports up to 88 percent fewer tokens, 66 percent lower cost, and 7 percent higher accuracy.
Why it matters: observation becomes a decision the system makes, not a fixed preprocessing setting. That reframes long-context cost as a policy-learning problem.
Bottleneck and caveat: the reported numbers are best-case vendor figures. No full distributions, traces, or matched-latency comparisons were published at review time.
Disconfirming observation: matched static sampling reaches equal quality at equal cost, or the adaptive mode misses brief events that uniform sampling catches.
03Anthropic reports model-generated protein binders validated outside the model loop
Evidence maturity: first-party report of externally executed assays; not peer reviewed.
What changed: Anthropic reports that Mythos 5.1 designed protein binders for 12 targets with a hit rate near 50 percent overall, and that three targets showed roughly ten times the affinity of earlier Adaptyv competition winners. External organizations performed the assays. Anthropic also reports 1.4x to 2.5x speedups for seven open biological models, with code promised later.
Why it matters: validation happened outside the model loop, which is the part of an AI-for-science claim that usually stays internal.
Bottleneck and caveat: at review time there were no complete sequences, no protocols, no design funnel, no negative results, no matched compute budget, and no kernel code. The report is first-party and not peer reviewed.
Disconfirming observation: an independent group with the published information cannot approach the reported hit rate, or the advantage disappears against an open baseline under a matched design budget.
Topic impact review. Six topics were revised and given a currentThrough of 2026-09-02: safety, security, and alignment (current state, reproduction lab, claim test, teams, bottleneck, forecast); reliability, uncertainty, and evaluation (current state, reproduction lab, claim test, teams, bottleneck, forecast); agent planning and cognitive architectures (current state, reproduction lab, claim test, teams); infrastructure, efficiency, and open ecosystems (current state, reproduction lab, claim test, bottleneck); AI for science (current state, reproduction lab, claim test, teams, bottleneck, forecast); and embodied AI and world models (current state and claim test). The other five topic dates are unchanged. No new topic met the creation threshold, and the stable 1960-2025 lineage was not rewritten.
Unresolved watch items.
Publication of the Astra system card and of matched-budget cyber comparisons.
Full distributions, traces, and matched-latency baselines for adaptive video sampling.
Release of binder sequences, protocols, negative results, and kernel code.
Bounded outlook
Forecast A, high confidence, 3 to 12 months. Capability-gated access becomes model-specific infrastructure: restricted access, named-defender programs, usage monitoring, and paced release attach to individual models rather than to whole product lines. Disconfirm if: comparable cyber capability expands without restriction and without published incident or misuse evidence.
Forecast B, medium confidence, 6 to 18 months. Adaptive observation becomes a standard long-context primitive across video, audio, and document pipelines. Disconfirm if: matched static or compressed baselines erase the reported advantage.
Forecast C, medium confidence, 6 to 18 months. AI-for-science releases face an artifact-completeness test covering sequences, protocols, design funnels, negative results, and code. Disconfirm if: adoption continues to grow without reproducible artifacts.
Forecast journal
How this edition treated earlier forecast lineages. Statuses are recorded explicitly and use a controlled vocabulary: baseline, introduced, carried forward, reframed, strengthened, weakened, resolved, retired, or not reassessed.
Three forecast lineages were introduced in this edition: capability-gated model access, adaptive observation as a long-context primitive, and an artifact-completeness test for AI-for-science releases. Every earlier active forecast remains not reassessed, because this evidence does not directly bear on it.
New bounded prediction, high confidence, 3 to 12 months. Forecast: frontier cyber capability increasingly ships behind restricted access, named-defender programs, usage monitoring, and paced release rather than open availability. Basis: OpenAI designated Astra its first Critical cyber model and paced its release; Google released Gemini 3.8 Flash Cyber to trusted defenders. It would be disconfirmed by unrestricted expansion of comparable cyber capability without published incident or misuse evidence.
Adaptive observation becomes a standard long-context primitive.
New bounded prediction, medium confidence, 6 to 18 months. Forecast: selecting what to observe, at what resolution, becomes an explicit tool-use policy across video, audio, and document pipelines rather than a fixed preprocessing choice. Basis: Google reports an agentic video mode that dynamically selects windows, frame rate, audio, and transcript. It would be disconfirmed if matched static or compressed sampling baselines erase the reported advantage.
AI-for-science releases face an artifact-completeness test.
New bounded prediction, medium confidence, 6 to 18 months. Forecast: readers, reviewers, and buyers increasingly judge AI-for-science claims by whether sequences, protocols, design funnels, negative results, and kernel code are published. Basis: Anthropic reports externally assayed protein binders and kernel speedups without releasing sequences, protocols, or code at review time. It would be disconfirmed if adoption continues to grow without reproducible artifacts.
This edition did not explicitly evaluate the earlier forecast.
Not reassessedskill-provenance-expiry
Persistent agent skills gain provenance and expiry controls.
Prior edition: August 28, 2026.
This edition did not explicitly evaluate the earlier forecast.
Not reassessedconfidential-evaluation
Confidential evaluation becomes a standard high-stakes test option.
Prior edition: August 27, 2026.
This edition did not explicitly evaluate the earlier forecast.
Not reassessedalignment-auditor-validation
Alignment-auditor training adds human and cross-family evaluation.
Prior edition: August 27, 2026.
This edition did not explicitly evaluate the earlier forecast.
Not reassessedagent-evaluation-artifacts
Long-horizon agent benchmarks score intermediate artifacts and recovery.
Prior edition: August 27, 2026.
This edition did not explicitly evaluate the earlier forecast.
Not reassessedagent-inference-efficiency
Context-routing becomes part of agent infrastructure benchmarks.
Prior edition: August 27, 2026.
This edition did not explicitly evaluate the earlier forecast.
Not reassessedagent-sandbox-controls
Agent sandboxes become a published frontier-lab control surface.
Prior edition: August 26, 2026.
This edition did not explicitly evaluate the earlier forecast.
Not reassessedcovert-channel-evaluation
Agent evaluations add impossible-task and covert-channel tests.
Prior edition: August 26, 2026.
This edition did not explicitly evaluate the earlier forecast.
Not reassessedcontrolled-usage-data
Independent usage-data programs expand, but remain controlled.
Prior edition: August 26, 2026.
This edition did not explicitly evaluate the earlier forecast.
Forecast labels are editorial judgments, not statistical posterior probabilities. The absence of a forecast from a later edition is not evidence that it was withdrawn or disproved.
Source coverage and unresolved watches
Monitored for these forecast lineages: OpenAI, Google DeepMind, Anthropic, Adaptyv, METR, the UK AI Security Institute, and NIST.
Editorial status. Reviewed against direct sources before publication.
