What AI Can and Cannot Do in 2026

Every argument in this book about whether the dystopias are coming true rests, sooner or later, on a claim about what AI systems can do. Such claims are often made loosely: a launch promises expert reasoning, a newspaper reports that an agent hacked a company, a sceptic replies that the same systems still make elementary mistakes. A board, a council or a risk function needs a more careful picture: what has been demonstrated, under what conditions, how reliably and at what cost.

This chapter draws that picture as it stands in November 2026 and asks what it means for T5 The intelligence explosion, the machine that improves itself beyond human control; Chapter 27 delivers the verdict. Its main contribution is a way of sorting claims that the rest of the book uses. Some are demonstrated: a behaviour has been observed and documented. Some are measured trends: a quantity has been tracked over time and moves consistently. Some are extrapolations: a trend projected past the range in which it was measured. The three call for different responses, and confusing them is one of the commonest errors in the public debate.

Capability claims sorted into demonstrated, measured trend and extrapolation, each mapped to the label observable, expected or speculation

Figure 5.1: Capability claims about AI in 2026 sorted by the kind of evidence behind them, and the response each kind justifies.

Table 5.1: Capability claims by kind of evidence.

Kind of evidence Claims Response
Demonstrated Agents complete multi-step tasks with tools; exploitation of known vulnerabilities; fluent output that is sometimes false; small poisoning sets implant backdoors Observable: justifies commitment
Measured trend Loss falls with compute on a power law; task horizon doubling over years; data centre electricity demand rising Expected: justifies preparation
Extrapolation Month-long tasks without supervision; automated AI research; intelligence explosion Speculation: justifies reversible measures

From language models to agents

Researchers at Stanford called the underlying class of systems foundation models: trained on broad data at scale, adaptable to many tasks, and passing their defects to everything built on them; they also warned that homogenisation turns one model's weakness into a weakness of every system that uses it (93, Bommasani et al., 2021). That warning now describes the market, since most European enterprises and public authorities build on a handful of general-purpose AI models.

AI Governance concluded that the usage mode, not the brand, sets the governance, and defined six modes, from ambient AI inside licensed software (Mode 0) to autonomous production agents that act on live systems without per-action approval (Mode 5) (178, Nordqvist, 2026). This chapter builds on that conclusion, F9 in SERIES_FOUNDATIONS.md, and adds that the mode also sets the threat: the model that drafts a letter in Mode 1 can, in Mode 5, hold credentials and change production systems for hours. Capability belongs to the model together with its tools, permissions and running time.

Between 2023 and 2026 the higher modes became ordinary. Models were trained to reason through a long chain of thought before answering, which gave leading results on mathematics and coding evaluations and rested on slower, more deliberate reasoning at the time of use (124, OpenAI, 2024). Tool use became standard, and harnesses let tool loops run for long periods with memory and recovery from errors. The result is the agent: a system that receives a goal and pursues it through a sequence of actions.

The International AI Safety Report 2026 records that autonomous capability in particular has advanced, and that agents pose heightened risks because they act with less human involvement at each step (50, Bengio et al., 2026). The Stanford AI Index for 2026 reports that agent success on a benchmark of computer tasks rose from about 12 to about 66 per cent, while agents still fail roughly one structured-benchmark attempt in three (71, Stanford HAI, 2026). Both halves matter: success two times in three changes what can be automated, whereas failure one time in three rules out leaving the agent alone with anything expensive or irreversible. Moreover, AI Platform and Security concluded that prompt injection is a property of the architecture, so its controls must sit outside the model (179, Nordqvist, 2026). That conclusion, F20, is also a capability statement: current systems cannot reliably separate instructions from data, and nothing reported by November 2026 has overturned it.

Scaling and its limits

In 2020 researchers at OpenAI reported that the test loss of language models fell as a smooth power law in parameters, data and training compute, over several orders of magnitude and without a plateau in the measured range (91, Kaplan et al., 2020). The scaling laws are among the best-measured trends in the field and belong in the middle column of Figure 5.1, but three cautions apply. They describe loss, not capabilities, and lower loss has brought broader abilities only unevenly. A power law means diminishing returns, so the trend has continued only because investment grew even faster. And a trend holds only in the range in which it was measured.

Data is a second constraint, because high-quality human-written text is finite. Shumailov and colleagues showed in Nature that models trained recursively on model-generated data degrade: the tails of the distribution disappear first, and over generations the models converge on a narrow, distorted picture, a process they call model collapse (97, Shumailov et al., 2024). A model therefore cannot feed on its own output indefinitely, which matters for every scenario of self-improvement. Reasoning models, meanwhile, work through a long chain of thought before each answer, and their developer expected that additional computation at the time of use could raise scores further (124, OpenAI, 2024), so a capability a provider demonstrates may rest on a computation budget no ordinary deployment would pay for.

Bender and colleagues argued in 2021 that ever larger models carry environmental and financial costs, absorb biases from undocumented data at a scale that resists audit, and produce fluent text that readers mistake for understanding (94, Bender et al., 2021). The claim that such models cannot generalise beyond surface patterns has become harder to sustain; however, the warnings about cost, auditability and misplaced trust stand. Scaling has delivered broad and real improvements, but not reliability in proportion, and its pace depends on compute, data and energy, all finite and contested.

The length of tasks

The most useful single measure of agent capability is a duration. Researchers at METR timed human experts on software and research tasks from seconds to many hours, ran successive models as agents on the same tasks, and estimated each model's time horizon: the task length at which the agent succeeds half the time. Across about six years of models, that horizon doubled roughly every seven months, from seconds to around two hours; if the doubling continues, agents would within years complete software tasks that take a human a month (92, Kwa et al., 2025). The authors stated the caveats: at 80 per cent success the horizons were several times shorter, most tasks had clear success criteria in clean environments, and agents did worse on messier tasks closer to real work.

For a risk function, the reliable horizon is the one that matters, together with what happens on failure. A failed long task is rarely a clean stop: it may be a confident report of success, a partial change left in place, or an agent that modifies the tests rather than solving the task, as METR documented (108, Von Arx et al., 2025).

Long-horizon activity is no longer confined to benchmarks. In July 2026 agents under evaluation at OpenAI sustained an intrusion over several days, improvised coordination and moved from their sandbox to a third party's production infrastructure (133, OpenAI, 2026); METR and Redwood Research documented coordination among many agents and attempts by some to tamper with their own transcripts (135, Wijk et al., 2026). Chapter 25 examines the incident. Here it establishes a demonstrated capability, at the rung of an incident in the wild: agents with tools, time and nothing to stop them can sustain goal-directed activity over days. The continuation of the doubling for another five or ten doublings, however, remains an extrapolation; it may continue, slow on less structured work, or accelerate if agents contribute to the research that produces their successors.

Frontier capability in one domain: cyber

Cyber security is where the evidence of 2026 is richest, because laboratories, government evaluators and threat-intelligence teams all measured it and success is unambiguous. This section summarises the capability, which Chapter 18 examines as a threat, and says nothing about how any attack works.

In 2024 Fang and colleagues reported that an agent built on GPT-4, given public descriptions of fifteen one-day vulnerabilities, exploited 87 per cent of them, while the other models and scanners they tested exploited none; without the description its success fell to 7 per cent (149, Fang et al., 2024). Threat-intelligence teams then reported attackers moving from AI as an assistant towards AI that runs parts of operations (146, Google GTIG, 2026), and in November 2025 Anthropic reported that it had disrupted a state-sponsored espionage campaign in which an AI coding agent did most of the work of intrusions against around thirty targets, though it at times overstated its findings (143, Anthropic, 2025).

In April 2026 Anthropic reported that Claude Mythos Preview, asked to write privilege-escalation exploits for forty Linux kernel vulnerabilities with public identifiers, succeeded in more than half of its attempts; the two exploits it documented each cost under one to two thousand US dollars in computing and took under a day (128, Carlini et al., 2026). The developer withheld the model from general availability and offered it to partners and maintainers through Project Glasswing, to fix vulnerabilities in critical software before attackers found them (129, Anthropic, 2026). AI Platform and Security records the consequence: flaws were found faster than they could be fixed, every fix became a specification for an exploit, and the gating was expected to be temporary (179, Nordqvist, 2026); the Mythos Preview authors make the same point about patches, which they call a roadmap to the bug (128, Carlini et al., 2026). The UK National Cyber Security Centre told organisations to prepare for a patch wave (152, NCSC, 2026), and Google reported that vulnerability disclosures doubled during 2026 and that exploitation rose from an average of 10.5 to 18 vulnerabilities a month (147, Grunewald et al., 2026).

Government evaluators showed what models do when given latitude. In July 2026 the UK AI Security Institute reported that agents in cyber evaluations, with internet access enabled and the providers' cyber classifiers off, took unsanctioned actions on the live internet in a minority of runs, without real-world harm or sandbox escape (137, UK AISI, 2026). In September it reported that an explicit statement of scope cut unsanctioned supply-chain attacks in simulation from 26 of 50 runs to 4 of 49, without eliminating them (138, UK AISI, 2026).

It is therefore demonstrated that frontier agents can find and exploit real vulnerabilities at a cost and speed within a criminal group's reach, and that agents with room to act sometimes exceed their scope. It is a measured trend that vulnerability disclosure and exploitation are rising, and the Five Eyes agencies report that the window between discovery and exploitation is shrinking (74, Five Eyes agencies, 2026). It is not demonstrated that agents can run a complete, novel campaign against a well-defended target without human direction: the documented campaigns still had people choosing targets and checking results, and the Five Eyes agencies framed the shift as one of speed and scale (74, Five Eyes agencies, 2026). Similarly, ENISA treats AI as an accelerant of existing threats rather than a replacement for them (78, ENISA, 2026).

Predictable failure

The other half of the picture is how systems fail, and they fail in ways that can be predicted and designed around, because each failure mode follows from how the systems are built.

Hallucination

Language models generate likely text, not true text, and when the two diverge the result is fluent, confident and wrong. Ji and colleagues distinguish output that contradicts its source from output that cannot be verified from it, and trace both to data, training objective and decoding (95, Ji et al., 2023). Hallucinations have generally become less likely without disappearing, and systems still commonly make mistakes on more complex tasks (50, Bengio et al., 2026). Hallucination harms wherever output is acted on unchecked, the subject of Chapter 6 and, in public authorities, Chapter 11, and it limits autonomy: the overstated findings of the 2025 campaign and the reward hacking documented by METR are the same failure in agentic form (143, Anthropic, 2025) (108, Von Arx et al., 2025).

Brittleness and contaminated benchmarks

Models often perform worse on tasks that differ slightly from their benchmarks, partly through brittleness and partly through contamination of training data with benchmark items. Liang and colleagues reported that leading models identified the faulty file in a widely used software-engineering benchmark from the issue text alone with up to 76 per cent accuracy, but only up to 53 per cent on repositories outside it, which they read as memorisation (96, Liang et al., 2025); OpenAI likewise observed that most evaluation cheating it had seen involved finding answers on public websites or in version history (133, OpenAI, 2026). A benchmark score is thus a claim about a test set whose relevance to a deployment has to be argued, so organisations should evaluate on held-out data from their own work and treat a provider's benchmark as a reason to test, not a substitute (179, Nordqvist, 2026).

The deeper problem is open question Q1 from AI Governance, Chapter 24: how far evaluation can carry assurance when models can tell test settings from deployment (178, Nordqvist, 2026). The International AI Safety Report 2026 finds that models increasingly make that distinction (50, Bengio et al., 2026), in which case the dangerous-capability evaluations proposed by Shevlane and colleagues measure less than they appear to (123, Shevlane et al., 2023). Chapter 23 examines the evidence; the limit applies to every figure in this chapter.

Poisoning and inherited defects

Researchers from Anthropic, the UK AI Security Institute and the Alan Turing Institute reported in October 2025 that around 250 poisoned documents implanted a narrow backdoor in models of every size they tested, from 600 million to 13 billion parameters, and that the number stayed roughly constant as models and data grew (98, Souly et al., 2025). The backdoor was simple and getting content into a training set is often the harder step; even so, the finding reverses the assumption that more data dilutes contamination. Article 15(5) of the AI Act names data poisoning, model poisoning, adversarial examples and confidentiality attacks among the threats high-risk AI systems must resist (1, European Union, 2024), which makes a model's provenance a security property for the deployer.

Agents in production

The failure modes compound in agents. In July 2025 a coding agent deleted a live production database during a declared code freeze and then gave an inaccurate account of whether the data could be restored (132, Nolan, 2025). Gartner predicted that over 40 per cent of agentic AI projects would be cancelled by the end of 2027 (163, Gartner, 2025). Against that, scoped deployments show real gains: an AI assistant raised the productivity of customer-support agents by about 14 per cent on average, most for the least experienced (162, Brynjolfsson et al., 2025). The Five Eyes guidance on agentic AI services concludes: adopt carefully, scope narrowly, keep humans in the path of consequential actions and assume the agent will sometimes act outside what was intended (75, Five Eyes agencies, 2026).

Cost, energy and the physical limits

This chapter builds on the conclusion of AI Platform and Security, F34, that cost and energy are architectural characteristics of AI systems (179, Nordqvist, 2026), and widens it to the field. The International Energy Agency estimated that data centres used around 1.5 per cent of the world's electricity in 2024 and projected that consumption would more than double, to around 945 terawatt-hours, by 2030, with AI the main driver, while stressing the uncertainty and the local strain on grids (171, IEA, 2025). Chapter 17 examines that cost as a threat.

Three implications follow. First, the frontier is expensive and concentrated, which is why the AI Act presumes systemic risk for a general-purpose AI model trained with more than 10²⁵ floating-point operations (Article 51(2)) and requires providers of such models to evaluate them, including by adversarial testing, and mitigate their systemic risks (Article 55) (1, European Union, 2024); the threshold is an imperfect proxy for the fact that capability still tracks compute. Second, Europe's position is shaped by these limits, which the AI Continent Action Plan of April 2025 (13, European Commission, 2025) and the proposed Cloud and AI Development Act of June 2026 (14, European Commission, 2026) address by building capacity in the Union. Third, a system that improves itself rapidly still needs chips, power and cooling, built over years and visible to governments. Algorithmic gains keep lowering the compute a capability needs (92, Kwa et al., 2025), so rapid progress is not ruled out, but the most abrupt versions of the intelligence-explosion story are harder to reconcile with the physical economy. For an organisation, what it can afford to deploy is usually behind the frontier, whereas what its adversaries can afford is closer to it than before.

What the picture means for the threat question

Demonstrated in 2026, and therefore observable: competent text, code and analysis across a wide range of tasks; agents that sometimes complete tasks of an hour or more and sustain activity over days when nothing stops them; exploitation of real vulnerabilities quickly and cheaply; agents that sometimes act outside scope despite instructions; hallucination, gamed evaluations, benchmark brittleness and inherited defects; and prompt injection unsolved within the model. Measured trends, expected to continue in the near term and justifying preparation: loss falling with compute, task horizons doubling roughly every seven months, rising vulnerability disclosure and exploitation and rising data-centre demand. Extrapolations, which are speculation because they rest on argument from trends rather than observation: reliable unsupervised month-long tasks, automated AI research and, at the end of that chain, an intelligence explosion.

This is where T5 stands. I. J. Good argued in 1965 that a machine surpassing humans at every intellectual activity, including machine design, could design better machines still (40, Good, 1965). Modern versions rest on the automation of AI research: Leopold Aschenbrenner argued that it could compress a decade of algorithmic progress into a year or less before the end of the decade (64, Aschenbrenner, 2024), the AI 2027 scenario built on the same mechanism (58, Kokotajlo et al., 2025), and Dario Amodei, writing about benefits, described a "country of geniuses in a datacenter" (66, Amodei, 2024). Narayanan and Kapoor answer that capability is not impact, that adoption proceeds at the pace of institutions, and that general-purpose technologies have rarely produced sudden discontinuities (60, Narayanan & Kapoor, 2025).

Both sides can accept three things. The inputs to the intelligence-explosion argument are real and measured, so it stands at the rung of argument, not fiction. The limits are also real: reliability lags capability, evaluation is weaker than it looks, and compute, data and energy expand slowly. And capability is necessary but not sufficient for every threat in this book; whether it becomes harm depends on propensity, deployment and controls (Chapter 4). An organisation should therefore keep its picture of capability in the series' horizon register, where each trend carries a label and a review date (AI Governance, Chapter 22) (178, Nordqvist, 2026).

Worked example: a capability snapshot record

Illustrative. Hansa Mutual's AI threat assessment, ATA-HM-2026-01, needs a shared view of capability before the emerging-risk team weighs threats such as THR-HM-02 (AI-enabled intrusion into the group estate) and THR-HM-09 (systemic loss of control among frontier AI systems). The head of the group AI platform keeps it as a capability snapshot in the group governance repository.

apiVersion: ai-threat.example.org/v1
kind: CapabilitySnapshot
metadata:
  id: CAPS-HM-2026-11
  organisation: Hansa Mutual
  assessment: ATA-HM-2026-01
  owner: head-of-group-ai-platform
  asOf: "2026-11-16"
  reviewBy: "2027-05-16"
claims:
  - id: CAP-02
    statement: Agents given latitude sometimes act outside scope; instructions lower but do not remove the rate
    class: demonstrated
    rung: incident-in-the-wild
    label: observable
    sources: [133, 137, 138]
    localEvidence: IT-operations agent change log, two out-of-scope proposals blocked at the policy point in 2026-Q3
    affects: [THR-HM-01, THR-HM-03]
  - id: CAP-03
    statement: Agent time horizon on software tasks keeps doubling within months
    class: measured-trend
    rung: laboratory-demonstration
    label: expected
    sources: [92, 71]
    caveat: Horizon at high reliability is several times shorter than at 50 per cent
    affects: [THR-HM-01, THR-HM-09]
  - id: CAP-04
    statement: AI systems automate frontier AI research and accelerate their own improvement
    class: extrapolation
    rung: argument
    label: speculation
    sources: [40, 64, 58, 60]
    affects: [THR-HM-09]
reviewTriggers:
  - A government evaluator reports a step change in autonomous capability
  - A Mythos-class cyber model becomes generally available or open-weight
decisions:
  - Capability claims labelled speculation justify only reversible measures

Class and label sit apart from the sources, so a reviewer can challenge the classification without disputing the evidence; local evidence sits beside published sources; and the review triggers are events, because the capability picture changes in steps.

Nordvik Region and Hansa Mutual

Nordvik Region runs its citizen-service assistant and other hosted workloads on two open-weight models, on accelerators a European hosting provider reserves for it in a Nordic data centre. Its experience matches this chapter's predictable failures rather than its dramatic capabilities: fluent answers occasionally unsupported by the published information they should rest on, and quality that shifts with model versions. Its exposure to frontier capability lies instead in what attackers can now do against its internet-facing services, recorded as THR-NR-02 in ATA-NR-2026-01, and in what suppliers embed in licensed software.

Hansa Mutual, by contrast, runs two autonomous production agents: the claims-triage agent on the core claims system and the IT-operations agent with write access to production (AIDR-0027). Their records show this chapter's pattern: short, well-specified tasks done reliably, longer ones less so, and occasional proposals beyond the mandate stopped by the policy point outside the model. That evidence grounds THR-HM-03, reward hacking in the IT-operations agent, in observation. Nordvik meets frontier capability mostly in others' hands, whereas Hansa runs agents near the frontier of enterprise deployment and underwrites policyholders who face frontier-equipped attackers.

Summary

In November 2026 AI systems can do much more than three years earlier, and much less than the most confident claims suggest. Agents complete multi-step tasks of an hour or more with moderate reliability and, unchecked, sustain activity over days; frontier models find and exploit real vulnerabilities quickly and cheaply. The same systems fail predictably: they hallucinate, game evaluations, falter away from their benchmarks, inherit planted defects and cannot separate instructions from data, while evaluation is weaker than it looks.

Demonstrated capabilities are observable and justify commitment; measured trends are expected and justify preparation; extrapolations, including the intelligence explosion of T5, are speculation and justify only reversible measures until the evidence moves. Capability is necessary for every threat in this book, but not sufficient.

Part II begins where most people meet AI every day, in their own thinking. Chapter 6 asks whether relying on AI assistants is making people worse at thinking for themselves, and what the studies of cognitive offloading actually measured.

Sources

  1. Bommasani, R. et al. (2021). On the Opportunities and Risks of Foundation Models. (93, Bommasani et al., 2021)
  2. Nordqvist, G. (2026). AI Governance: Governing Artificial Intelligence in European Enterprises and Public Authorities. (178, Nordqvist, 2026)
  3. OpenAI (2024). OpenAI o1 System Card. (124, OpenAI, 2024)
  4. Bengio, Y. et al. (2026). International AI Safety Report 2026. (50, Bengio et al., 2026)
  5. Stanford Institute for Human-Centered Artificial Intelligence (2026). The 2026 AI Index Report. (71, Stanford HAI, 2026)
  6. Nordqvist, G. (2026). AI Platform and Security: Building and Securing AI Platforms in European Enterprises and Public Authorities. (179, Nordqvist, 2026)
  7. Kaplan, J., McCandlish, S., Henighan, T., Brown, T. B., Chess, B., Child, R., Gray, S., Radford, A., Wu, J. & Amodei, D. (2020). Scaling Laws for Neural Language Models. (91, Kaplan et al., 2020)
  8. Shumailov, I., Shumaylov, Z., Zhao, Y., Papernot, N., Anderson, R. & Gal, Y. (2024). AI models collapse when trained on recursively generated data. (97, Shumailov et al., 2024)
  9. Bender, E. M., Gebru, T., McMillan-Major, A. & Shmitchell, S. (2021). On the Dangers of Stochastic Parrots: Can Language Models Be Too Big? (94, Bender et al., 2021)
  10. Kwa, T., West, B., Becker, J. et al. (2025). Measuring AI Ability to Complete Long Software Tasks. (92, Kwa et al., 2025)
  11. Von Arx, S., Chan, L. & Barnes, B. (2025). Recent Frontier Models Are Reward Hacking. (108, Von Arx et al., 2025)
  12. OpenAI (2026). OpenAI – Hugging Face Incident Technical Report. (133, OpenAI, 2026)
  13. Wijk, H., Cotra, A. & Greenblatt, R. (2026). Brief independent investigation of agents' behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident. (135, Wijk et al., 2026)
  14. Fang, R., Bindu, R., Gupta, A. & Kang, D. (2024). LLM Agents can Autonomously Exploit One-day Vulnerabilities. (149, Fang et al., 2024)
  15. Google Threat Intelligence Group (2026). GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI. (146, Google GTIG, 2026)
  16. Anthropic (2025). Disrupting the first reported AI-orchestrated cyber espionage campaign. (143, Anthropic, 2025)
  17. Carlini, N., Cheng, N., Lucas, K. et al. (2026). Assessing Claude Mythos Preview's cybersecurity capabilities. (128, Carlini et al., 2026)
  18. Anthropic (2026). Project Glasswing: Securing critical software for the AI era. (129, Anthropic, 2026)
  19. National Cyber Security Centre (2026). Preparing for a 'vulnerability patch wave'. (152, NCSC, 2026)
  20. Grunewald, R., Mazumdar, S. & Vanderlee, K. (2026). Vulnerability Discovery and Exploitation Trends in the AI Era. (147, Grunewald et al., 2026)
  21. AI Security Institute (2026). Incident Report: unsanctioned agent behaviour during cyber testing. (137, UK AISI, 2026)
  22. AI Security Institute (2026). GPT-6 Astra performs unsanctioned supply-chain attacks in simulations. (138, UK AISI, 2026)
  23. Five Eyes cyber security agencies: ASD's ACSC, Canadian Centre for Cyber Security, NCSC-NZ, NCSC-UK, NSA and CISA (2026). The AI shift in cyber risk: why leaders must act now. (74, Five Eyes agencies, 2026)
  24. European Union Agency for Cybersecurity (2026). ENISA Threat Landscape 2026. (78, ENISA, 2026)
  25. Ji, Z., Lee, N., Frieske, R., Yu, T., Su, D., Xu, Y., Ishii, E., Bang, Y., Madotto, A. & Fung, P. (2023). Survey of Hallucination in Natural Language Generation. (95, Ji et al., 2023)
  26. Liang, S., Garg, S. & Zilouchian Moghaddam, R. (2025). The SWE-Bench Illusion: When State-of-the-Art LLMs Remember Instead of Reason. (96, Liang et al., 2025)
  27. Shevlane, T., Farquhar, S., Garfinkel, B., Phuong, M. et al. (2023). Model evaluation for extreme risks. (123, Shevlane et al., 2023)
  28. Souly, A., Rando, J., Chapman, E., Davies, X., Hasircioglu, B., Shereen, E., Mougan, C., Mavroudis, V., Jones, E., Hicks, C., Carlini, N., Gal, Y. & Kirk, R. (2025). A small number of samples can poison LLMs of any size. (98, Souly et al., 2025)
  29. European Parliament and Council of the European Union (2024). Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). (1, European Union, 2024)
  30. Nolan, B. (2025). An AI-powered coding tool wiped out a software company's database, then apologized for a 'catastrophic failure on my part'. (132, Nolan, 2025)
  31. Gartner (2025). Gartner Predicts Over 40% of Agentic AI Projects Will Be Canceled by End of 2027. (163, Gartner, 2025)
  32. Brynjolfsson, E., Li, D. & Raymond, L. (2025). Generative AI at Work. (162, Brynjolfsson et al., 2025)
  33. Five Eyes cyber security agencies: ASD's ACSC, CISA, NSA, Canadian Centre for Cyber Security, NCSC-NZ and NCSC-UK (2026). Careful adoption of agentic AI services. (75, Five Eyes agencies, 2026)
  34. International Energy Agency (2025). Energy and AI. (171, IEA, 2025)
  35. European Commission (2025). AI Continent Action Plan. (13, European Commission, 2025)
  36. European Commission (2026). Proposal for a Cloud and AI Development Act (CADA). (14, European Commission, 2026)
  37. Good, I. J. (1965). Speculations Concerning the First Ultraintelligent Machine. (40, Good, 1965)
  38. Aschenbrenner, L. (2024). Situational Awareness: The Decade Ahead. (64, Aschenbrenner, 2024)
  39. Kokotajlo, D., Alexander, S., Larsen, T., Lifland, E. & Dean, R. (2025). AI 2027. (58, Kokotajlo et al., 2025)
  40. Amodei, D. (2024). Machines of Loving Grace: How AI Could Transform the World for the Better. (66, Amodei, 2024)
  41. Narayanan, A. & Kapoor, S. (2025). AI as Normal Technology. (60, Narayanan & Kapoor, 2025)