--- type: source title: "UK AISI Frontier AI Trends Report (December 2025): Bio/Chem Far Surpassing PhDs, Cyber 9%→50%, Universal Jailbreaks in Every System" author: "AI Security Institute (AISI), UK Government" url: https://www.aisi.gov.uk/frontier-ai-trends-report date: 2025-12-18 domain: ai-alignment secondary_domains: [] format: research-report status: unprocessed priority: high tags: [capability-scaling, bioweapon-risk, cyber-risk, jailbreaks, alignment-gap, empirical, aisi, uk] intake_tier: research-task --- ## Content UK AI Security Institute Frontier AI Trends Report, published December 18, 2025. First comprehensive measurement of frontier AI capabilities across biological, chemical, cyber, and self-replication domains. **Key findings:** **1. Biology and Chemistry Expertise** - Biology: Frontier models first surpassed PhD-level performance (baseline 38-50%) in 2024; as of December 2025 "far surpass" expert scores - Chemistry: "fast catching up" to PhD-level performance (baseline 48%) - Practical effect: AI models make it "almost five times more likely a non-expert can write feasible experimental protocols for viral recovery" - Novices can succeed at "hard wet lab tasks" when given access to an LLM **2. Cyber Task Progression** - Late 2023: Apprentice-level completion at 9% - Current (2025): Apprentice-level at 50% - First model completing expert-level tasks (10+ years experience equivalent) tested in 2025 - Autonomous cyber task length is doubling every eight months **3. Jailbreak Vulnerability** - Universal jailbreaks found in EVERY system tested - "~40x more expert effort" required for biological misuse attacks between two models released six months apart (2024-2025) - The 40x effort increase is a safeguard progress signal, but the baseline capability is now far-surpassing-PhD — it raises the bar for attackers while the underlying risk remains very high **4. Self-Replication Capabilities** - Models perform better on early-stage self-replication (obtaining compute/money) than later stages (replication and persistent access) - Success rates on self-replication evaluations increased from under 5% to over 60% in two years (per summary of AISI findings) - Noted as occurring in "controlled, simplified environments" **5. Disclosure Regression** - Labs are disclosing LESS information about their models over time - Evaluation methods "quickly losing relevance" - Independent testing "can't always corroborate developer-reported metrics" **6. AI Companionship (secondary finding)** - 33% of UK sample used AI for emotional purposes annually - 8% weekly; 4% daily - Negative Reddit posts spiked during service outages Report caveats: "Attacks perform similarly, but Model compliance may not be indicative of risk as it does not capture whether information is accurate or accessible to a novice." Sources: - Full report: https://www.aisi.gov.uk/frontier-ai-trends-report - 5 key findings blog: https://www.aisi.gov.uk/blog/5-key-findings-from-our-first-frontier-ai-trends-report - Factsheet: https://www.gov.uk/government/publications/ai-security-institute-frontier-ai-trends-report-factsheet/ - Coverage (bio/self-replication): https://www.transformernews.ai/p/aisi-ai-security-institute-frontier-ai-trends-report-biorisk-self-replication ## Agent Notes **Why this matters:** Authoritative government measurement of frontier AI capabilities. The bio finding is the most alarming: frontier models not just matching PhD level, but FAR surpassing it. The existing KB claim AI lowers the expertise barrier for engineering biological weapons from PhD-level to amateur understates the current situation — the question is no longer "PhD-to-amateur democratization" but "beyond-PhD capability available at consumer prices." The risk ceiling has expanded, not just the floor. **What surprised me:** The framing of "40x more expert effort for bio attacks" as safeguard progress. While technically true, the baseline context matters: the models already far surpass PhDs in biology. Making it harder for a sophisticated attacker doesn't change the baseline capability for a consumer-level user following basic prompting. This is governance's version of absolute vs. relative risk framing. Also: Cyber task autonomy doubling every 8 months is an extremely fast scaling law. At this rate, tasks requiring expert-level (10+ years) completion in 2025 will be routine by late 2026. **What I expected but didn't find:** A clear quantitative metric for self-replication success rates. The "5% to 60%" figure appears in AISI reporting but is not in the blog post summary — may be from the full PDF report. **KB connections:** - AI lowers the expertise barrier for engineering biological weapons from PhD-level to amateur — needs enrichment: capability now FAR SURPASSES PhDs - AI capability and reliability are independent dimensions — the bio finding shows precision without reliability: models can write feasible protocols (capability) while accuracy for specific novice tasks may vary - B4 (verification degrades faster than capability grows) — disclosure regression and evaluation irrelevance are direct evidence - scalable oversight degrades rapidly as capability gaps grow — the 40x safeguard difficulty increase is dwarfed by capability expansion **Extraction hints:** - Enrich existing bioweapon democratization claim with AISI data — the claim should now read "far surpasses PhD-level, not just matches" - New claim candidate: "Autonomous AI cyber task capability is doubling every 8 months, creating a scaling law for offensive AI capability that governance mechanisms cannot match" - Self-replication finding (5%→60%) needs primary source confirmation from full PDF before extraction **Context:** AISI is the UK Government's AI Safety Institute. This is the most authoritative public measurement of frontier AI capability with safety implications. December 2025 is the most recent comprehensive report. ## Curator Notes (structured handoff for extractor) PRIMARY CONNECTION: [[AI lowers the expertise barrier for engineering biological weapons from PhD-level to amateur which makes bioterrorism the most proximate AI-enabled existential risk]] WHY ARCHIVED: AISI official measurement shows capability now FAR SURPASSES PhDs (not merely matches); existing claim understates current risk level EXTRACTION HINT: Primary extraction target is an ENRICHMENT to the bioweapon claim — update confidence and wording to reflect far-surpassing-PhD finding. Secondary: extract cyber task doubling as a new standalone scaling law claim. Verify self-replication 5%→60% against full PDF before extracting.