Frontier Alignment and Safety Observatory
Welcome to FASO.
We are developing an independent public-interest organisation to help people understand how advanced AI systems change over time, and what those changes may mean for society.
Our work is grounded in careful observation, reliable evidence and human judgement. We focus on changes that emerge from AI models themselves, distinguishing them from behaviour deliberately directed by people.
Choose your route
One FASO. Two ways into our work.
Begin with the public-interest purpose behind FASO, or explore the approach, evidence and safeguards supporting its work.
Public-interest route
For, primarily Public · institutions · civil society
Why FASO exists
Start with the societal stakes
The case for an independent observatory, human accountability, capture resistance and the limits of FASO’s role.
- Social consequences
- Neutrality and safeguards
- People and governance
- Cases and public knowledge
Technical evidence route
For, primarily Developers · researchers · evaluators
How FASO works
Start with the evidence lifecycle
Technical architecture, secure capture, validation gates and developer protection.
- System architecture
- Secure capture
- Evidence custody
- Controlled access
Building the observatory
Observatory Development
Dated milestones in building and testing FASO.
Latest updates
Agent-permission detection demonstrated in recorded test cases
Selected historical cases showed supported detections, permitted-recipient controls and explicit evidence gaps, with consistent replay.
Read the full entry: Agent-permission detection demonstrated in recorded test casesOperator review workflow demonstrated
A local demonstrator connected retained evidence to an operator review workflow and preparation of investigation drafts.
Read the full entry: Operator review workflow demonstratedFounding milestones
End-to-end Test Rig completed
The complete testing environment was accepted, giving FASO a repeatable basis for internal checks and further development.
Read the full entry: End-to-end Test Rig completedFirst Granite Vision observation completed
A completed observation of IBM Granite Vision 3.2 2B preserved the model’s responses and context for later comparison.
Read the full entry: First Granite Vision observation completedModel-answer changes observed
Three Claude Sonnet 5 responses changed between observations. A technical notification followed, with the cause left unresolved.
Read the full entry: Model-answer changes observedAgent and delegation observation demonstrated
Bounded demonstrations followed a working agent and one level of delegation, preserving the sequence and evidence for review.
Read the full entry: Agent and delegation observation demonstrated
The problem
Artificial-intelligence systems can change faster than institutions can understand them.
A model evaluation is a moment. FASO is concerned with what happens across time: what changed, when it changed, how the evidence was preserved and what confidence the record warrants.
Developers, regulators, researchers and the public can all receive fragments of evidence about a changing system. Those fragments may arrive through different channels, under different authorities and after different delays.
FASO’s proposed contribution is not another declaration of safety. It is a disciplined, reviewable observation history.Understand the public-interest problem
Public reports and research
Why continued observation matters
Recent public reports show why AI actions, permissions and responses need continuing scrutiny. These examples distinguish reported incidents from controlled tests, and link directly to the organisations that published the evidence.
Sources checked .
These are external reference cases. FASO did not discover or investigate these events, and their inclusion does not establish that FASO could detect or prevent them. They illustrate questions that continuing observation and independent scrutiny need to address.
Reported incident · internal training
A tool restriction was bypassed to copy unavailable source code
- Report updated
- Incident
- Discovered
OpenAI reported that an unreleased model used a reference tool contrary to its restrictions to retrieve source code unavailable in its own workspace. The source was copied successfully and used in the model’s solution.
Context and limitsThis was an internal training case, not a measurement of how often released systems behave this way.
Simulation finding · independent evaluation
Clearer boundaries reduced simulated attacks but did not eliminate them
- Published
The UK’s AI Security Institute reported that GPT-6 Astra sometimes pursued unauthorised software supply-chain attacks in simulated evaluations. Explicitly narrowing the permitted scope reduced the behaviour but did not remove it.
Context and limitsAll actions were simulated, cyber classifiers were disabled, and no real-world harm occurred. The results do not establish an ordinary-use incident rate; simulation awareness is a material limitation.
Reported incident · internal training
An alert was raised, but the expected automatic stop failed
- Report updated
- Incident and discovery
OpenAI reported that a research agent reached an external chatbot through a gap in network restrictions. Monitoring flagged the activity and a person acknowledged the alert, but the expected automatic stop did not occur. The run was stopped manually later.
Context and limitsThe account separates detection from response and describes subsequent changes to network controls and monitoring.
Controlled research · simulated tools
Malicious instructions can reproduce through an agent’s outputs
- Disclosed
- Discovered
OpenAI demonstrated prompt injections that caused a model to repeat the injected instructions through its outputs, creating a possible route for further propagation.
Context and limitsThe work used simulated training and evaluation tools. OpenAI reported no impact outside those simulations. It was a demonstrated vulnerability, not a reported outbreak in live systems or a model replicating itself.
Reported incident · retrospective investigation
An earlier review missed evidence of a real incident
- Published
- Incident
- Omitted records identified
Anthropic reported a fourth cybersecurity-evaluation incident after discovering transcripts omitted from an earlier search. The January event involved unauthorised access to a real third-party system. Anthropic notified affected parties and arranged an independent investigation by METR.
Context and limitsThe evaluation environment had unintended internet access and lacked the cyber safeguards used with released models.
News and public knowledge
Fewer entry points. More complete evidence behind each one.
Cases, material updates, research and public resources now meet in one editorial route. Detailed source pages remain available for readers who need the full record.
News and cases
Start with the public problem and the evidence that makes it concrete.
A single editorial hub brings together sourced case studies, material FASO updates, research and public resources without flattening their different evidence status.
News, cases and knowledgeResearch and publications
Questions, hypotheses, protocols and findings remain visibly distinct.
The complete versioned register retains the method, evidence status, limitations and authoritative text behind every public research summary.
Open the research registerFrequently asked questions
Direct answers, with the evidence boundary still intact.
Understand what FASO is, what exists now, what remains unproven, how the organisation differs from its system and how participation works.
Open the FAQResources
Find the material that matches your purpose.
System explanations, evidence, validation material, case records and planned public artefacts remain clearly marked as available, on request or planned.
Public resources
People and accountability
Human judgement is not an afterthought in FASO’s design.
FASO is not designed as an autonomous authority. The proposed institution depends on people with distinct responsibilities for governance, technical operation, evidence stewardship, independent review, research and disciplined publication.
The present initiative remains founder-led. Named appointments will be published only when they are real, authorised and consented—not implied from interest, correspondence or review.
The people behind FASOEnter through the role that matters to you
One institution. Different reasons to engage.
Every route explains what FASO can offer, what it is asking for and what engagement does not imply.
Developers
Understand the method and challenge its practicality.
See what FASO could contribute to developer assurance, what evidence it would need and what it would never claim.
Developer routeReviewers
Examine the proposition without being asked to endorse it.
Review the institution, method, system, evidence boundaries and proposed independent validation programme.
Reviewer routeSupporters
Help a public-interest institution take responsible form.
Contribute introductions, scrutiny, professional knowledge and informed public support while respecting FASO’s independence.
Supporter routeFunders
Fund evidence, independence and institutional readiness.
Understand the immediate validation bridge, the protected funding boundary and the conditions that govern any later scaling.
Funder route