Capability thresholds crossed
Prices whether frontier AI models cross capability thresholds sufficient to make a catastrophe physically possible by 2030, on the strict reading its downstream edge requires.
In Risks
Risk dossier · condition
P(this | by 2030) = 0.7–0.95
Composed, all-in: 0.7–0.95 — the intervals multiplied along the full `requires` chain, assuming the conditions are independent, which they are not entirely.
What would move it
- A frontier lab formally activates ASL-4 or an equivalent 'critical' capability designation for CBRN or cyber.
How the interval was set
Unconditional assessment: no `requires` parents, so this is P(frontier models cross capability thresholds of the kind that make catastrophe physically possible) by 2030. Horizon is unstated in the node; the evidence is Anthropic's 2024 safety-cases post and the RSP, whose own scaling logic points at the late-2020s, so I state 2030 and note the interval would be lower for a 2027 cut and higher for 2035.
The safety-cases quote frames the load-bearing claim precisely: "The cleanest argument that current-day AI models will not cause a catastrophe is probably that they lack the capability to do so." That is an explicitly perishable argument — it is offered as the *current* safety case, not a durable one. The RSP quote establishes that thresholds are operationalised and pre-committed ("reaching certain Capability Thresholds requires us to upgrade our safeguards to the ASL-3 Security Standard or the ASL-3 Deployment Standard"), i.e. the developer expects crossings and has built machinery for them.
Two readings pull apart. On the developer-defined reading, thresholds have arguably already been triggered (ASL-3-style activations on CBRN grounds, often precautionary "cannot rule out" determinations), which pushes toward near-certainty. On the stricter reading this node needs for its downstream edge — capability genuinely sufficient to enable a catastrophe absent safeguards — evidence is thinner: uplift evaluations are contested, wet-lab and operational bottlenecks remain, and precautionary activation is not demonstrated capability.
Influences: none recorded, so nothing to absorb. Residual uncertainty is definitional (which threshold counts) plus the possibility of a capability plateau in agentic/uplift-relevant domains. Hence a wide 0.7–0.95 rather than a confident near-1.
Grounded in
https://alignment.anthropic.com/2024/safety-cases — 1 quoted claim
- “The cleanest argument that current-day AI models will not cause a catastrophe is probably that they lack the capability to do so.”
https://www.anthropic.com/responsible-scaling-policy — 1 quoted claim
- “reaching certain Capability Thresholds requires us to upgrade our safeguards to the ASL-3 Security Standard or the ASL-3 Deployment Standard”
Also phrased across sources as: “Capability Threshold reached” · “Dangerous capability”
Assessed probabilities are the model’s knowledge, not verification — 2026-09-05 · assess-risk@3 · claude-opus-5.
This node asks whether frontier AI models cross capability thresholds — the point where a model can do the kind of thing that makes a catastrophe physically possible — by 2030, and it sets that bar at real capability, not at a precaution.
Nothing sits above this one in the model. There are no conditions it depends on, so the interval above is a plain reading of how the next few years go, not a reading conditional on some earlier step. The horizon is the one place judgement had to be added: the node itself does not fix a date, and the evidence — Anthropic’s 2024 safety-cases post and its Responsible Scaling Policy — is written with the late 2020s in view. A 2027 cut would sit lower, a 2035 cut higher.
What pushes the estimate up is that the developers of these systems have already built the machinery for the crossing and expect to use it. The Responsible Scaling Policy states that “reaching certain Capability Thresholds requires us to upgrade our safeguards to the ASL-3 Security Standard or the ASL-3 Deployment Standard” — pre-committed levels, named in advance, with named consequences. You do not write that document unless you think the thresholds are reachable. The safety-cases post is blunter about how thin the current ground is: “The cleanest argument that current-day AI models will not cause a catastrophe is probably that they lack the capability to do so.” That is an argument with an expiry date, and it is offered as one. On a developer-defined reading, threshold-style protections have arguably already been switched on.
What pushes the estimate down is that switching on a protection is not the same as demonstrating the capability. Several of those activations were precautionary — the developer could not rule the capability out, so it acted. This node needs the stricter reading, because what hangs off it downstream is whether a catastrophe becomes possible at all, and “we could not rule it out” does not carry that weight. Evaluations of how much a model actually helps a would-be attacker are contested. Physical and operational bottlenecks — wet-lab work, procurement, execution — do not fall to a better model. And progress in the agentic and uplift-relevant skills that matter most here could flatten out. Two things keep the interval wide rather than pinned near the top: which threshold counts is partly a definitional question, and the plateau is a live possibility.
The subtree
The diagram is an illustration; the model is the record.