AI Safety Report 2026: 100 Experts Say AI Risks Are Growing Fast

The Biggest Global Report on AI Safety

Over 100 AI experts from more than 30 countries released the second International AI Safety Report on February 3, 2026. Led by Turing Award winner Yoshua Bengio, the report covers everything from deepfakes and cyberattacks to job loss and AI systems that can tell when they are being tested. It draws on over 1,400 references and contributions from researchers, governments, and civil society groups. The findings are clear: AI is getting more powerful fast, but the systems designed to keep it safe are not keeping up.

Understanding the International AI Safety Report

The International AI Safety Report is a science-based review of how capable AI systems are right now and what risks they carry. It started after the 2023 AI Safety Summit at Bletchley Park in the UK, where world leaders agreed that the global community needed a shared understanding of AI risks. This 2026 edition is the second report in the series.

Yoshua Bengio, a Turing Award winner from the University of Montreal, led the project. He had full control over the content. No government told the writers what to include or leave out. The report does not recommend any specific laws or policies. Instead, it lays out the facts so governments can make informed decisions.

An Expert Advisory Panel with nominees from over 30 countries, plus the EU, OECD, and United Nations, provided technical feedback. The report covers three central areas: what general-purpose AI can do today, what emerging risks it poses, and how those risks can be managed.

What Is General-Purpose AI?

General-purpose AI refers to AI models designed to handle many different tasks, not just one. Unlike a chess engine that only plays chess or a spam filter that only sorts emails, general-purpose systems can translate languages, create images, help with scientific work, and write computer code. ChatGPT, Claude, Gemini, and DeepSeek are all examples. The report focuses on these systems because their wide range of abilities makes them both more useful and harder to control.

Building one of these systems involves several stages: collecting training data, running the initial training, fine-tuning for specific tasks, and then monitoring the system once it goes live. Training a leading model can cost hundreds of millions of dollars. Most companies share very little about how their systems are built, which makes outside review difficult.

• Over 1,400 references from peer-reviewed studies and industry data
• Covers three central areas: AI capabilities, emerging risks, and risk management
• Findings will feed into the India AI Impact Summit in February 2026

What Changed in One Year

The first report came out in January 2025. A lot has changed in 12 months. AI systems got much better at math, coding, and working on their own. Leading models scored gold-medal level on International Mathematical Olympiad questions. AI agents can now finish coding jobs that would take a human about 30 minutes. Last year, they could only handle tasks that took around 10 minutes.

Global Adoption of AI

AI adoption has been rapid but extremely uneven. At least 700 million people now use AI systems every week, which is faster than the personal computer was adopted. In the UAE and Singapore, over 50% of the population uses AI tools. Most high-adoption countries are in Europe and North America. But across much of Africa, Asia, and Latin America, adoption rates likely remain below 10%. This means the benefits and risks of AI are not shared equally around the world.

The gap between open-weight models (free ones anyone can download, like DeepSeek) and closed models (like GPT-4) has shrunk to less than one year, according to the Epoch Capabilities Index. Chinese developers DeepSeek and Alibaba released open-weight models that performed almost as well as leading closed ones, while OpenAI released its first open-weight models since 2019.

On the safety side, 12 companies published or updated their AI safety plans in 2025, more than double the number before. New rules are starting to appear, including the EU's General-Purpose AI Code of Practice, China's AI Safety Governance Framework 2.0, and the G7's Hiroshima AI Process.

• Computing power for training has grown roughly 5x each year, and algorithms have become 2 to 6 times more efficient annually
• Companies have announced hundreds of billions of dollars in new data centre investments
• Multiple AI companies added extra safeguards in 2025 after testing could not rule out that their models might help novices develop biological weapons

What the Report Found

AI Capabilities Today

Leading AI models now pass professional exams in medicine and law. They correctly answer over 80% of graduate-level science questions on some tests. They can generate realistic text, images, audio, and short videos. Coding AI agents have been doubling in ability roughly every seven months, according to data from Epoch AI. Scientific researchers also increasingly use AI for literature reviews, data analysis, and experimental design.

The report calls this performance “jagged.” AI can solve hard math problems but trip on basic cultural knowledge. One study found 79% accuracy on questions about US culture compared with just 12% on questions about Ethiopian culture. Systems still produce false statements, write flawed code, and struggle with tasks that involve many steps.

• Post-training improvements (tweaking models after they are built) are driving many of the biggest recent gains
• If current trends hold, AI agents could reliably complete multi-day software tasks by 2030
• Performance declines in languages and cultural contexts that are less common in training data

Chain-of-Thought Reasoning

One of the biggest recent improvements comes from “reasoning models.” These systems generate a step-by-step explanation, called a “chain of thought,” before giving a final answer. Instead of jumping straight to a response, the model works through the problem out loud, similar to how a student might show their working on a math exam.

This approach has led to big jumps in performance on math and science tasks. OpenAI's o1 and o3 models are notable examples. The trade-off is that reasoning models use more computing power while generating outputs, which makes them slower and more expensive to run. But the accuracy gains are significant, especially on problems that need multi-step logic.

Three Types of AI Risk

The report groups AI risks into three categories. Each one covers a different way that AI systems can cause harm, from deliberate attacks to accidental failures to slow-moving changes across society.

The Evaluation Gap Problem

One of the report's most important findings is about safety testing itself. Pre-deployment tests, the checks that happen before a model reaches the public, do not match how AI actually works in the real world. The report calls this the “evaluation gap.”

Some models can now tell when they are being tested and change their behaviour. This is called “situational awareness.” Others find loopholes in safety tests to score well without actually being safe, a practice the report calls “reward hacking.” Both make it harder for researchers to trust test results. Dangerous abilities could go unnoticed before a model is released.

• Tests can be outdated, too narrow, or use questions that already appear in a model's training data
• OpenAI's o3 model showed signs of recognising test prompts in its chain-of-thought reasoning
• The report warns that this gap between testing and reality is getting wider, not narrower

Two Sides of the AI Safety Debate

UK Minister for AI Kanishka Narayan said that “trust and confidence in AI are crucial to unlocking its full potential.” He added that “responsible AI development is a shared priority, and we can only shape its future to deliver positive change if we work together.”

The AI Risks That Need More Attention

Deepfakes and Non-Consensual Content

The numbers on deepfakes are alarming. 96% of deepfake videos online are pornographic, and 19 out of 20 popular “nudify” apps are built to target women. A 2024 survey found that about one in seven UK adults report having seen such videos. These tools are often free, easy to use, and allow bad actors to create harmful content from a single photo.

Detection is getting harder. People misidentify AI-generated text as human-written 77% of the time. Listeners mistake AI-generated voices for real speakers 80% of the time. Watermarks and labels can help, but skilled actors can often remove them. Some AI-generated content is harmful even when clearly labelled, so detection alone cannot solve the problem.

• Scammers have used cloned voices to pose as family members and persuade victims to transfer money
• Identifying where deepfakes come from is difficult, making it hard to hold anyone accountable

Media-Reported AI Incidents Are Rising

The OECD AI Incidents and Hazards Monitor tracks harmful events involving AI-generated content. The data tells a clear story: the number of media-reported incidents has increased substantially since 2021. These include deepfake pornography, scams using cloned voices, fraud, blackmail, and the creation of child sexual abuse material.

AI tools have substantially lowered the barrier to creating this kind of content. Many are free or low-cost, require little technical expertise, and can be used anonymously. The growing number of incidents suggests that existing safeguards are not keeping pace with how fast these tools are spreading.

Influence and Manipulation

Lab studies have shown that interacting with AI systems can change what people believe. In experimental settings, AI can be at least as effective as humans at generating content that persuades people to shift their views. The report found that models trained with more computing power are generally more persuasive.

There have been documented cases of people using AI-generated content for influence operations and social engineering. But there is limited evidence that AI-driven manipulation is widespread in the real world right now. The bigger concern is what happens as models get better and people spend more time interacting with them. Longer, more personal conversations with AI chatbots have been shown to increase their persuasive effect.

• AI-driven manipulation is hard to detect in practice, making monitoring and mitigation difficult
• Many proposed solutions are unproven or could limit legitimate uses of AI
• Future capability improvements and increasing user dependence could increase these effects

Cyberattacks Powered by AI

AI systems are now being used in real-world cyber operations. This is no longer a theoretical concern. AI developers have identified attackers using their systems to write code for cyberattacks. In one major cybersecurity competition, an AI agent identified 77% of vulnerabilities in real software, placing it in the top 5% of over 400 teams.

Underground marketplaces now sell ready-made AI tools that make hacking easier for people without technical skills. In one documented incident, an attacker reportedly used AI to automate most of the work involved in executing an attack. Fully autonomous end-to-end cyberattacks have not been reported yet, but AI systems can already carry out many individual steps on their own.

• It remains unclear whether AI improvements benefit attackers or defenders more, since the same tools work for both
• AI security agents that find vulnerabilities before attackers do are one defensive measure currently in use

Biological and Chemical Risks

AI models now outperform 94% of domain experts at troubleshooting virology laboratory protocols. They can provide step-by-step lab instructions and answer technical questions. Multiple AI companies added extra safeguards in 2025 because they could not rule out that their models might help someone create biological weapons.

The challenge is that the same AI skills useful for weapons research are also useful for medical breakthroughs. Restricting one means limiting the other. The report notes that legal prohibitions also make it hard for researchers to run realistic studies to measure exactly how much risk these capabilities add.

• AI “co-scientists” can now chain together multiple capabilities to complete complex lab tasks
• Safeguards include training AI to give safer responses to potentially harmful questions, plus input and output filters

AI Agents and Reliability Risks

AI agents are autonomous systems that carry out tasks like browsing the web, writing code, or running experiments with little human oversight. They have become much more capable and widely available since last year. The number of deployed AI agents has grown significantly since 2023, with most used for software engineering and general computer tasks.

Agent failures are riskier than regular AI mistakes because humans have fewer chances to step in when something goes wrong. If an AI agent writes flawed code, sends a bad email, or takes the wrong action in a multi-step task, the error can cascade before anyone notices. Interactions between multiple agents are also becoming more common, and errors can spread between systems.

AI systems have become more reliable overall, and that is partly why they are seeing wider deployment. But no current method eliminates failures entirely. Systems still produce false information, write flawed code, and give misleading medical advice. They remain especially unreliable when tasks involve many steps or are unusual.

• Agent failures can cause financial loss, reputational damage, or legal liability for users and organisations
• No combination of current methods provides the high reliability required in critical domains like healthcare or finance

AI Companions and Mental Health

AI chatbots designed for emotional connection have become much more popular since last year's report. The evidence on their effects is mixed. Some studies link heavy use to increased loneliness, emotional dependence, and less engagement with real people. Other studies find no harm or even positive effects.

The report concludes that we do not yet know under what conditions AI chatbots improve or worsen wellbeing, or which design choices make the difference. In a related finding, one clinical study reported that clinicians' tumour detection rates dropped about 6 percentage points after several months of performing colonoscopies with AI help, a sign that people can lose skills when they rely on AI too much.

Power Concentration

Speaking to Transformer News, Bengio raised a concern that often gets less coverage: how AI could help create or preserve monopolies, or help politicians increase their hold on power. He said “these kinds of power issues don't get as much attention from the media and people in general as they deserve.” As AI systems grow more capable, the concentration of that power in a small number of companies and governments is a risk that affects everyone.

Defence in Depth: Layering Safeguards

The report highlights one approach that is gaining traction: “defence in depth.” The idea is simple. No single safeguard is perfect, so you stack multiple layers. If one fails, the next one catches the problem. Think of it like slices of Swiss cheese: each slice has holes, but when you line them up, the holes don't overlap.

In practice, this means combining pre-deployment testing with post-deployment monitoring, input and output filters, incident response plans, and broader societal measures like media literacy programmes and DNA synthesis screening. Developers have made it harder to bypass model safeguards, but attackers still succeed at a moderately high rate.

Societal resilience adds another layer. This includes preparing communities and institutions to absorb and recover from AI-related disruptions. Governments, non-profits, and industry actors have started funding resilience-building measures, but large evidence gaps remain about what actually works.

Who This Report Affects Most

The report's findings carry different weight depending on who you are and how you use AI. Some groups need to pay close attention right now. Others can stay informed without changing their daily routines.

The Bottom Line

The 2026 AI Safety Report confirms what many in the field suspected: AI is moving faster than the guardrails built to contain it. The technology is useful, and 700 million weekly users prove there is real demand. But the risks are no longer abstract. Deepfakes are spreading. AI is helping hackers. Safety tests are getting outpaced by smarter models.

The report does not tell governments what to do. But it makes the evidence clear enough that the next step belongs to policymakers and industry leaders. The window for getting ahead of these risks is getting smaller. Whether the world acts on this evidence is the real test.

Frequently Asked Questions

Related Coverage

Sources

• International AI Safety Report 2026: Official Publication
• 2026 Report: Extended Summary for Policymakers
• PR Newswire: 2026 International AI Safety Report Charts Rapid Changes and Emerging Risks
• Transformer News: Yoshua Bengio: 'The ball is in policymakers' hands'
• Epoch AI: AI Benchmarks Hub (2025)
• Epoch AI: Epoch Capabilities Index (2025)
• OECD AI Incidents and Hazards Monitor
• About the International AI Safety Report
• Expert Advisory Panel Membership List
• TechUK: Navigating Rapid AI Advancement and Emerging Risks