New AI safety work targets comparable thresholds, while enforcement remains unresolved (2026)

The measurement problem is becoming more concrete

The newest safety work is converging on a practical question: when a model crosses a dangerous-capability threshold, who can verify that fact, and what must happen next? A July 17 preprint proposes a common measurement procedure for several frontier-risk thresholds. A July 2026 international consensus report turns similar concerns into a shared research and agent-management agenda. Australia's July 20 announcement puts safety into legal and administrative workstreams. An external scorecard still finds that company frameworks often lack measurable triggers, independent audits, or clear authority to halt a deployment.

These sources do not establish a common enforcement regime. They do show what a more credible regime would need: a defined condition, a reproducible test, an accountable decision-maker, and a consequence that is specified before the system is released.

Research: translating company thresholds into comparable tests

Harmonizing AI Safety Thresholds, an arXiv preprint posted on July 17, takes aim at the mismatch between frontier companies' safety frameworks. The authors define harmonization as a common minimum floor plus a shared measurement procedure. A company could still adopt a stricter internal standard, but its public threshold would become comparable and open to third-party audit. 1

The paper does not force every risk into one formula. For cyber and biological misuse, it models expected harm through the attack pathway, the probability of success, the harm per successful event, and the model's release conditions. For automated AI research and development, it instead asks whether a system produces a substantial increase in the rate of AI progress. That distinction matters because an AI system that accelerates research is not a single misuse pathway, while a cyber-enabled attack can be decomposed into sequential steps.

The paper's most useful result is its treatment of missing evidence. Its cyber analysis is a worked calibration, but the parameter values are author-calibrated priors rather than independently verified estimates. The biorisk analysis becomes a diagnostic: the available evidence is too thin to support a defensible quantitative floor. For automated AI R&D, the authors propose an operational rate-of-progress floor that they say covers the threshold language of three major companies. They present the result as a method for comparison and audit, not a complete set of validated policy numbers. 1

That is an important boundary for a newcomer to keep in view. A threshold can be quantitative and still depend on uncertain assumptions. The gain is that the assumptions become inspectable. A reviewer can ask whether the attack volume, success probability, release-condition multiplier, or progress baseline is supported by incident data, controlled evaluations, or audited safeguard performance. Without that structure, different companies can use similar words for triggers that cannot actually be compared.

A shared agenda now includes agents and societal resilience

The 2026 Singapore Consensus on Global AI Safety Research Priorities, published in July, was produced through the second International Scientific Exchange on AI Safety. The organizers describe more than 100 contributors from 13 countries, including researchers, government safety institutes, companies, and civil society. The report updates the 2025 consensus around the growth of autonomous agents, open-weight models, misuse incidents, and AI systems used to oversee other AI systems. 2

The report groups the agenda into four areas: risk assessment, development, control, and societal resilience. The fourth is a material change in emphasis. The report argues that prevention will not be sufficient when open weights can be modified, safeguards can be bypassed, or failures spread across institutions and borders. It therefore calls for work on incident reporting, ecosystem monitoring, defensive cyber capabilities, provenance, and the resilience of organizations that have to absorb failures.

Its companion report on agentic risk management names ten principles, including least privilege, traceable identity, auditability, validated deployment, runtime assurance, interruptibility, legibility, and human oversight. These are concrete controls for systems that can act through tools, rather than only generate a response. The report also says that maturity varies: some practices have interoperable tooling, while multi-agent systems and agentic supply chains remain open research problems. 2

The distinction between agenda and obligation matters. The Singapore Consensus explicitly describes itself as a scientific consensus on technical research priorities, not a policy document. Its value is to make several research needs legible across institutions: agreed thresholds, secure infrastructure for third-party evaluation, organizational safety, shared incident reporting, and ways to verify commitments without exposing proprietary information. It does not itself give a regulator power to compel any of those practices.

Australia turns broad goals into named workstreams

Australia's government announced five AI consumer-safety priorities on July 20. The announcement is useful because it makes the institutional owner and policy mechanism visible, while also showing what remains prospective. 3

Workstream	Proposed mechanism	Status in the announcement
Digital Duty of Care	Put the onus on AI companies to build in safety and address potential harm	Legislation to be pursued
Privacy	Strengthen and modernize personal-data protections	Consultation on a second reform tranche
Workplace safety	Make AI safety one of the priorities of the tripartite workplace forum	Forum workstream
Consumer protection	Examine risks such as retail surveillance pricing and agentic commerce under consumer law	Options under examination
Federal automated decisions	Create a framework for fair, accurate, and transparent automated decisions in federal agencies	Framework to be developed

The release also says Australia's AI Safety Institute has begun testing frontier systems, partnered with CSIRO on alignment research, completed a multi-agent-risk project with the Gradient Institute, and is collaborating on measurement and evaluation practice. Those are active workstreams, not evidence that the proposed legal duties already apply. The same distinction should be made whenever a government announcement uses verbs such as "legislate," "consult," "examine," or "develop": they describe intended action, not a completed obligation. 3

For an aspiring safety researcher, the scope is instructive. The operational problem is not limited to frontier capability evaluations. It includes data protection, workplace deployment, consumer-facing agents, and government decision systems. A threshold that has no owner in one of those settings is unlikely to become a usable safeguard, even if the technical test itself is sound.

External scrutiny finds weak links from thresholds to action

The Future of Life Institute's Summer 2026 AI Safety Index assesses nine companies across six domains using public material, company surveys, and a seven-member expert panel. Its scorecard gives Anthropic a C+ with 2.66 points, OpenAI a C with 2.28, and Google DeepMind a C with 2.01; no company receives an A. The index identifies existential safety as the weakest domain across the companies it reviews. 4

The scorecard is not a live measurement of current model risk. Its evidence collection ended on June 3, and the report warns that comparisons across regulatory contexts are difficult. Its narrower finding is still relevant to the threshold debate: published frameworks may contain evaluation language without specifying quantitative, risk-tiered triggers, independent audits, or a decision authority that cannot be overridden when a trigger is crossed. 4

That finding lines up with the arXiv proposal in a useful way. The preprint supplies a candidate method for translating heterogeneous threshold language into auditable quantities. The index reports that existing frameworks often stop before that point. Neither source demonstrates that the proposed method is correct for every risk, or that companies and regulators will adopt it. Together they identify the part of the safety chain that remains underdeveloped: connecting measurement to authority and consequence.

What to track next

A threshold with its measurement protocol. Ask what test, data, model access, and release condition determine whether the threshold was crossed. A number without those details is not yet comparable.
The treatment of uncertainty. The threshold preprint is a useful example because it labels the cyber assumptions and says where biorisk evidence is insufficient. Stronger work should replace illustrative priors with incident data, independent evaluations, and audited safeguard performance.
A named authority and a precommitted response. Research agendas and government plans become safety practice only when someone can require a pause, restrict access, notify an authority, or change the deployment conditions.
Agent controls that survive deployment. The Singapore report's least privilege, identity, auditability, runtime assurance, and interruptibility principles are testable targets. The hard question is whether they continue to work across tool chains, multiple agents, and open-weight modification.

The near-term progress is therefore measurable even before a global standard exists. Researchers are defining more explicit tests, governments are naming implementation tracks, and external reviewers are asking whether safety frameworks can be checked by someone other than the developer. The unresolved step is the one that turns a failed test into a decision.

New AI safety work targets comparable thresholds, while enforcement remains unresolved