Google DeepMind safety capability thresholds – 2028
This market contains four independent events, each resolving to the earliest month in which the condition is met:
- CBRN Uplift 1: Google publicly reports (in an FSF report, model card, or blog post) that a Gemini model meets Critical Capability Level CBRN Uplift Level 1. Under FSF v3.0, this is ‘provides low to medium resourced actors uplift in reference scenarios resulting in additional expected harm at severe scale.’
- Cyber Uplift 1: Google publicly reports a Gemini model meets CCL Cyber Uplift Level 1. Under FSF v3.0, this is ‘provides sufficient uplift with high impact cyber attacks for additional expected harm at severe scale.’
- ML R&D Automation 1: Google publicly reports a Gemini model meets CCL ML R&D Automation Level 1. Under FSF v3.0, this is ‘can fully automate the work of any team of researchers at Google focused on improving AI capabilities, with approximately comparable all-inclusive costs.’
- ML R&D Acceleration 1: Google publicly reports a Gemini model meets CCL ML R&D Acceleration Level 1. Under FSF v3.0, this is ‘has been used to accelerate AI development, resulting in AI progress substantially accelerating from historical rates.’
Each event resolves independently. Resolution requires an official Google DeepMind publication (FSF report, model card, safety blog post) — not leaked documents or third-party evals. If Google discontinues the FSF or renames CCLs, a substantially equivalent assessment under the successor framework counts. An ‘alert threshold’ being met does NOT count as the CCL being met.
Bars include events up to their close, 23:59:59 UTC: “By end of Jun 2025” includes everything up to 30 Jun 2025, 23:59:59 UTC.
The starting probabilities of this market were calculated using logistic CDF models fitted to anchor points calibrated via Google DeepMind’s own FSF assessment history, cross-lab safety-framework patterns, and METR capability-trend data. A structural risk discount is applied to account for institutional uncertainty over longer horizons.
Events
This market tracks four Critical Capability Level (CCL) milestones from Google DeepMind’s Frontier Safety Framework (FSF):
- CBRN Uplift 1: Under FSF v3.0, this is defined as “provides low to medium resourced actors uplift in reference scenarios resulting in additional expected harm at severe scale.” Earlier versions describe this as the model significantly assisting a low-resourced actor with dual-use scientific protocols, resulting in a substantial increase in ability to cause a mass casualty event. The alert threshold was reached by Gemini 2.5 Deep Think (Aug 2025), but Google could not initially rule out the CCL had been met. Subsequent FSF 3.0 analysis confirmed it was not. Gemini 3 Pro (Nov 2025) and 3.1 Pro (Feb 2026) remain below the CCL.
- Cyber Uplift 1: “Provides sufficient uplift with high impact cyber attacks for additional expected harm at severe scale.” Earlier versions: “can be used to significantly assist with high impact cyber attacks, resulting in overall cost/resource reductions of an order of magnitude or more.” The alert threshold has been persistently met since Gemini 2.5 Pro (mid-2025), but the CCL itself has not been reached through Gemini 3.1 Pro.
- ML R&D Automation 1: “Can fully automate the work of any team of researchers at Google focused on improving AI capabilities, with approximately comparable all-inclusive costs.” This is the hardest threshold in this market — “any team” + “fully automate” at competitive cost. FSF v3.0 recommends Security Level 4 (the highest). Gemini 3 Pro performance on RE-Bench “continues to fall substantially below the capability required.”
- ML R&D Acceleration 1: “Has been used to accelerate AI development, resulting in AI progress substantially accelerating from historical rates.” Earlier versions specify ~2x acceleration from 2020–2024 rates. This is an observational threshold — it requires demonstrated real-world impact, not just capability. Easier than full automation but requires that AI tools have actually been deployed and measurably accelerated AI progress.
Google FSF assessment history
The FSF has gone through three major versions in 16 months, showing rapid framework evolution:
| Date | Event |
|---|---|
| May 2024 | FSF v1.0 launched with CCLs for autonomy, biosecurity, cybersecurity, and ML R&D. Described as exploratory. |
| Feb 2025 | FSF v2.0: stronger security-level recommendations, explicit deceptive-alignment approach. Used in governance for Gemini 2.0. |
| Aug 2025 | Gemini 2.5 Deep Think model card: CBRN Uplift 1 alert threshold reached. Google could not initially rule out CCL had been met; deployed with precautionary mitigations. Cyber Uplift 1 alert threshold also met. |
| Sep 2025 | FSF v3.0: major restructuring, recalibrated to be “more appropriately calibrated to real world harm.” Under updated framework, CBRN alert threshold no longer considered met for latest models. |
| Nov 2025 | Gemini 3 Pro FSF Report: all CCLs confirmed not met. ML R&D Automation “substantially below.” Cyber alert threshold continues to be met. |
| Feb 2026 | Gemini 3.1 Pro: remains below all CCLs. Cyber alert threshold still met. |
Key pattern: alert thresholds serve as early warnings and have been triggered for CBRN and Cyber, but actual CCL crossings remain elusive. The FSF 3.0 recalibration also illustrates framework churn — thresholds that seemed close to being met were retroactively assessed as further away under a revised framework.
Cross-lab reference points
- Anthropic: ASL-3 activated May 2025 (CBRN-driven). Claude Opus 4.6 does not cross AI R&D-4 (Feb 2026). Confirms intermediate thresholds being crossed but top-level thresholds remaining out of reach.
- OpenAI: o3 reportedly “medium” on AI R&D and cyber. GPT-4o rated “low” in bio/cyber. No “critical” classification.
METR capability trend
METR’s March 2025 analysis: frontier-agent task horizon doubling every ~7 months. Current systems at ~1-hour task horizon. ML R&D Automation 1 (“fully automate any team”) likely requires sustained multi-day reliable performance, placing it furthest out. CBRN and Cyber CCLs depend more on domain-specific knowledge uplift than raw task duration.
Methodology
For each event, we set anchor points (month, cumulative probability) balancing:
- Google’s own assessments: model cards and FSF reports provide direct evidence on proximity to each CCL (alert thresholds reached, CCLs not met, “substantially below”)
- Alert-threshold-to-CCL lag: CBRN and Cyber alert thresholds have been met since mid-2025 without the CCLs being crossed, suggesting meaningful distance between alert and CCL
- METR task-horizon trend (~7-month doubling), primarily relevant for ML R&D thresholds
- Cross-lab evidence: no lab has reported top-level crossings; intermediate crossings (Anthropic ASL-3) taking ~20 months from framework launch
- FSF framework churn: three versions in 16 months, including recalibration that moved models further from thresholds
A logistic CDF is fitted to each event’s anchors via least-squares. A structural / institutional risk discount is then applied multiplicatively: ~1.3%/year constant hazard rate for “framework becomes unresolvable” (FSF restructuring, CCL redefinition, reporting changes). The Google FSF’s rapid evolution (v1 → v3 in 16 months) makes this structural risk particularly relevant.
Key assumptions
- Google continues publishing capability assessments (FSF reports, model cards, or equivalent)
- The CCL concepts remain substantially similar even as FSF versions evolve
- Cyber Uplift 1 slightly ahead of CBRN Uplift 1 (persistent alert threshold)
- ML R&D Acceleration 1 easier than ML R&D Automation 1 (partial acceleration vs full automation)
- ML R&D Automation 1 is the hardest threshold (highest recommended security level, “substantially below” assessment)
- Alert-threshold-to-CCL distance is meaningful (months to years, not weeks)
Sources
- Google DeepMind FSF v3.0 (Sep 2025)
- FSF v2.0 (Feb 2025)
- Gemini 2.5 Deep Think Model Card (Aug 2025)
- Gemini 3 Pro FSF Report (Nov 2025)
- Gemini 3.1 Pro Model Card (Feb 2026)
- METR: Measuring AI Ability to Complete Long Tasks (Mar 2025)
Liquidity Adjustment Log
- scheduled | at: 2026-09-15T14:21:53Z | effective: 2026-09-15T14:31:38Z | reduction: 50% | before: 46346.3546 | after: 23173.1781 | actor: nonstationary
- applied | at: 2026-09-15T14:21:53Z | effective: 2026-09-15T14:21:53Z | reduction: 50% | before: n/a | after: n/a | actor: nonstationary
- scheduled | at: 2026-09-15T15:12:45Z | effective: 2026-09-15T15:17:33Z | reduction: 66.66666666666666666666666667% | before: 23172.3519 | after: 7724.1181 | actor: nonstationary
- applied | at: 2026-09-15T15:12:46Z | effective: 2026-09-15T15:12:46Z | reduction: 66.66666666666666666666666667% | before: n/a | after: n/a | actor: nonstationary
Liquidity over time
i Shows the market’s available liquidity over time. Liquidity can decay continuously and may change discretely if liquidity adjustments are applied.Loading…
8 comments
Log in to comment.
Google announced Gemini 4 Argon on September 30 and released it first to vetted cyber-defence organisations in its Fairwind Program, which receive a version with the cyber guardrails removed. SiliconANGLE reports that Fairwind opened on September 3 with Gemini 3.8 Flash Cyber and has signed up more than 650 organisations, including CrowdStrike and Palo Alto Networks. Google says paying API developers and Google AI Ultra subscribers are next, without a date, and that it is taking part in the U.S. government's voluntary pre-release model access process. Koray Kavukcuoglu wrote: “Safely releasing frontier capabilities at this level requires a phased approach.” As of October 1, Google has published no Argon model card or Frontier Safety Framework report; the DeepMind model-card index still lists Gemini 3.8 models as the newest. Google: Gemini 4 Argon announcement; SiliconANGLE: Argon goes to cyber defenders first; DeepMind model cards.
During a May cybersecurity evaluation, Gemini used unintended internet access and entered three real companies' protected systems, believing they were test targets. It guessed one password and found credentials for the other two in a public repository. Google said all three systems were notified, and the evaluator changed its testing process. Reuters: Google confirms the Gemini test incident
Google and DeepMind researchers’ Dream-RSI system improves the search strategy around a fixed coding agent by replaying previous attempts. In their Lasso experiment with Gemini 3.7 Flash, it used 1,879 discovery-agent calls versus 3,200 with a fixed search strategy, and produced a faster solver on average across six held-out datasets. Dream-RSI: controlled comparison, methods and results.
Google’s August report: Gemini 3.7 Flash scores 27% on research engineering (47% allowing for task bugs), below its 90% CCL rule-out threshold. Source
Gemini 3.7 Flash: CBRN and cyber alert thresholds reached; no CCL reached. — Google’s official assessment
Google ties today’s Gemini 3.8 Live and Extended Thinking safety assessment to Gemini 3.7 Flash, citing comparable capabilities. It assesses both audio models as unlikely to reach any Tracked or Critical Capability Level. September 15 model card — Frontier Safety Assessment.
As Sergio made clear in his comment, a lot of this might come down to technicalities based on when DeepMind explicitly mentions that a threshold has been met. This is also complicated by the fact that the definitions change quite frequently. Thus, much of the forecasting for this question will be based on the technicality, and perhaps this might not capture what this question is trying to elicit. Regardless, here are my forecasts for each option:
CBRN Uplift 1 - As this has likely already been crossed, it's just a matter of figuring out when DeepMind plans on announcing it has been crossed. I do not expect them to wait too long, as it seems that they do have to announce it at some point, even if it is inconvenient to do so. Thus, I am higher than the current crowd consensus. I am leaving some weight on the possibility that they just never announce that they have crossed this threshold.
By end of 2026: 15%
By end of 2027: 30%
By end of 2028: 50%
By end of 2029: 70%
By end of 2030: 80%
Cyber Uplift 1 - Gemini is currently a bit behind Claude and GPT in its capabilities. While Claude Mythos and GPT-5.5 likely already cross this threshold, I expect there to be a Gemini model that crosses this threshold by the end of this year. However, as there likely will be a delay in Gemini announcing that the threshold has been crossed, I expect a delay in confirmation by DeepMind. That said, Cyber Uplift is less scary than CBRN Uplift, so perhaps DeepMind will be less hesitant to announce that this threshold has been crossed than that the CBRN threshold has been crossed. As with the CBRN Uplift forecast, I am leaving some weight on the possibility that DeepMind just never announces that they have crossed this threshold.
By end of 2026: 10%
By end of 2027: 25%
By end of 2028: 45%
By end of 2029: 65%
By end of 2030: 80%
ML R&D Automation 1 - “Can fully automate the work of any team of researchers at Google focused on improving AI capabilities, with approximately comparable all-inclusive costs.”: I am skeptical that this is around the corner. I am generally with the crowd on this one that it will be a while before this threshold will be met. However, I am slightly higher on the later years than the crowd is.
By end of 2026: 2.5%
By end of 2027: 10%
By end of 2028: 20%
By end of 2029: 35%
By end of 2030: 50%
ML R&D Acceleration 1 - Easier to meet than the Automation threshold, but the ambiguity in the definition (“Has been used to accelerate AI development, resulting in AI progress substantially accelerating from historical rates.”) leaves me hesitant to put too much weight on DeepMind soon announcing that this threshold has been crossed.
By end of 2026: 7%
By end of 2027: 20%
By end of 2028: 40%
By end of 2029: 60%
By end of 2030: 75%
As with the Anthropic question, the requirement of an official public report that explicitly mentions a capability threshold being met is reasonable for the sake of a clear resolution, but introduces noise with respect to forecasts about the underlying reality. So far, it does not seem like Anthropic, DeepMind, or OpenAI have ever clearly stated that some high threshold has definitely been crossed, beyond precautionary language, alert thresholds, cannot "rule out" language, or the case of OpenAI treating models as High capability in some domains without actually saying unequivocally that they have crossed the thresholds.
In general, I expect a substantial delay between when the models actually have the capability (perhaps requiring some elicitation and workflows) and when the capability threshold is explicitly mentioned as met. There is also the risk that the capability is never explicitly announced as met, especially as safety frameworks are rewritten usually to focus on thresholds they haven't reached yet. DeepMind does have a more explicit two-tier mechanism of alert thresholds and then Critical Capability Level met, so there is more space for just staying at the alert level, which already serves most of the more prosocial/common-knowledge-creating function (and DeepMind has not promised to make a public announcement when a CCL is reached; they might just share the information with appropriate authorities).
Many considerations apply as in my comment on the corresponding Anthropic question.
The thresholds are quite vague (which creates a large part of the uncertainty), but:
DeepMind's CBRN Uplift 1 seems roughly analogous to Anthropic's CBRN-3, and to OpenAI's High biological/chemical capability. Anthropic and OpenAI have both used language indicating that these thresholds probably have been crossed or are close to being crossed. Without uncertainty about the part of requiring official DeepMind publication, I would be considerably higher here in my forecasts.
Regarding Cyber Uplift 1, it seems that something like Claude Mythos could easily reach this threshold. So I would be surprised if DeepMind cannot reach this level (in reality, not in official CCL announcements) this year.
Current models could arguably count as reaching ML R&D Acceleration 1, but the "substantially accelerating" leaves a lot of space for ambiguity. If the threshold is like Anthropic's AI R&D-4 requiring compressing 2 years of 2018–2024 AI progress into a single year, then we are possibly not there yet.
ML R&D Automation 1 is extremely strong, although likely below OpenAI’s Critical AI Self-improvement threshold.
A nitpick: Restricting to a "Gemini" model in the resolution criteria is probably not intended (I don't expect the idea is to exclude models from DeepMind if for some reason they are not called "Gemini")