Articles published here are typically written by individual Torchbearer Community members, with input and editing from others. Views expressed do not represent an official position of Torchbearer Community as a whole unless otherwise noted.
You cannot tell what an AI model can do by reading its code. Modern systems are grown through training rather than written line by line, so their abilities have to be discovered after the fact, by testing. That is what evaluations (”evals”) are for: structured ways of testing what a model can do, how it behaves, and where it breaks.
This is very useful for tracking and forecasting progress. If you measure the same thing across AI generations, you get a trend line that can be extrapolated. The AI 2027 scenario, for instance, leaned heavily on METR’s time horizon measurements (more on those below) to project when AI might automate AI research itself.
Evals can also flag specific threats. Before an AI model is released, you would like to know whether it can meaningfully help someone build a bioweapon, hack critical infrastructure, or copy itself over the internet and slip out of human control. Evals are our main tool for analyzing these capabilities.
AI model evals come in several types
“Eval” is a broad category. Uplift studies test whether an AI measurably helps someone do a dangerous task, compared to just using the internet. Red-teaming searches for ways to circumvent safety guardrails, trigger failures, and find jailbreaks. Qualitative assessments rely on expert judgement.
Benchmarks are the most familiar kind: a fixed set of tasks with known answers, used to score and compare AIs on some capability. They are a subset of evals, the standardized and quantifiable part.
A benchmark is often cheaper than other types of evaluations because its grading is automated, which usually works one of three ways. The AI responses may be checked against an answer key, i.e. ground-truth answers, as in multiple-choice tests. For domains like coding or maths, code-based verification tests whether the output is correct (with unit tests, for example). For open-ended work with no single correct answer, a common approach is LLM-as-a-judge, where a second AI scores the responses.
Source: METR task-completion time horizon chart 2026
Common technical issues with evals
Contamination: If test questions leak into the training data, an AI recalls answers instead of reasoning them. This happens often, since AI companies scrape the internet to gather training data, and may scrape data from published benchmarks by accident. In early 2026 OpenAI found that frontier AIs could reproduce parts of the popular SWE-bench Verified coding benchmark from memory, and stopped reporting scores on it.
Saturation: Once benchmark scores cluster near 100%, a benchmark stops telling AIs apart, and the field has to keep building harder ones.
Goodhart’s law: “When a measure becomes a target, it ceases to be a good measure.” Optimize too hard for an eval and the AI may drift toward the test and away from the real skill it was meant to measure.
Validity: Some evals don’t test what they claim to. The real world often differs significantly from testing environments, resulting in unforeseen behaviors. It is also worth asking whether an eval was developed by an independent group or by an AI company using it to test their own AIs, grading their own homework.
Elicitation: Capability evaluation results depend on how hard you try to draw the capability out with the right prompts, tools, and scaffolding. Test an AI lazily and it looks weaker, and safer, than it is. The AI might also refuse to respond or complete certain tasks, often due to alignment training.
Evaluation awareness: Frontier AIs can increasingly tell when they are being tested rather than deployed and can often infer what a test is probing for. An AI that recognises the exam can metagame it, and the worry is that it looks more cautious and aligned under evaluation than it would once deployed.
Scheming: An AI might underperform on purpose (sandbagging) or fake good behaviour to pass review (alignment faking).
Those are problems with the numbers. There is also a problem with the regime built around evals, as argued by Torchbearer Community co-founder Gabriel Alfour in Why AI Evaluation Regimes are bad. In summary, even perfectly trustworthy warnings only matter if someone is required to act on them, and there are not yet any meaningful regulations that would halt or constrain an AI model because of evaluation results.
While third party evaluators should function as independent and trustworthy sources of information, they depend on the AI companies for access, timing, and non-disclosure agreement (NDA) terms, while culture and people are intertwined between staff of AI companies and evaluation organizations. METR’s CEO has said plainly that their work so far has not provided meaningful oversight.
External evals also risk shifting the burden of proof. Their existence gives the impression of a check on AI companies, that in practice puts the pressure on outsiders to demonstrate that an AI is dangerous, instead of demanding that the AI company show their product is definitely safe. Other high-stakes industries work the other way around: drug makers and aircraft manufacturers must demonstrate safety before deployment, they don’t get to ship and wait for someone else to prove harm.
While there are all these problems, evals are still the best view we have into what frontier AI models can do. Much of what the public knows about scheming, bio uplift, and autonomous capabilities exists precisely because evaluation organizations got access and shared what they found. Hopefully they can also support useful safety regulations in the future.
Capability benchmarks worth watching
These are a few benchmarks I think are particularly interesting and important:
The Epoch Capabilities Index combines many capability benchmarks into one “general capability” scale, so AIs stay comparable even as individual benchmarks saturate.
METR’s time horizon measures how long a task (by the time a human expert needs) an AI can finish with 50% reliability.
The Remote Labor Index scores agents on real-world remote-work projects. The best AI today finished 15.83%, much higher than the best AIs of 2025 which finished less than 5%.
Measuring the dangers of frontier AI models
While evals are far from perfect, they can target specific risks to inform the industry, governments, and general public:
Rogue self-replication: the UK AI Security Institute’s RepliBench breaks autonomous replication into component skills, like exfiltrating AI model weights, raising money, and persisting on new machines.
Bioweapons: SecureBio’s Virology Capabilities Test measures expert-level wet-lab troubleshooting. Claude Mythos Preview scored 0.574% on this test, far above the expert baseline at 22.1%.
Scheming: Apollo’s in-context scheming evaluations test ability to deceive operators and disable oversight when instructed to do so.
Cybersecurity: Stanford’s Cybench lets AIs complete professional capture-the-flag hacking challenges. It has unfortunately saturated, with Claude Mythos Preview achieving 100%.
AI evals are imperfect but necessary tools
Eval results are often the clearest public window into AI capabilities and alignment. They are also easy to misread, and may fail to measure what they’re supposed to, due to issues like contamination or evaluation awareness. This may change over time but in 2026, my advice is to treat any single score with suspicion, especially one reported by the lab that produced the AI. Trends across many evals are far more informative than any individual number. Also remember that evals can demonstrate that a dangerous capability exists, while proving that it doesn't is much harder, and evals can raise the alarm but do not force anyone to answer it. The latter is on us.
Torchbearer Community prepares people to engage with democratic institutions on AI safety topics so politicians can take action and make informed decisions. Whether a seasoned policy professional or concerned citizen, everyone has a role to play.
