"Advanced AI Evaluations May Update" is the first public technical report from the UK AI Safety Institute (AI Security Institute) (renamed the AI Security Institute on 2025-02-14), published 2024-05-20 by UK AISI technical staff. It describes empirical evaluations of five anonymized, publicly deployed frontier LLMs (referred to as Red, Purple, Green, Blue, and Yellow) across four domains: cyber, chem/bio, agents, and safeguards. The evaluations were run on AISI's Inspect framework, which has since been open-sourced.
The report is available at https://www.aisi.gov.uk/blog/advanced-ai-evaluations-may-update.
Scope and methodology
The five models were assessed across four domains:
- Cyber — Capture The Flag (CTF) challenges drawn from picoCTF (high-school level), CSAW (university level), plus 10 private expert-authored CTFs.
- Chem/Bio — more than 600 private expert-written questions across Basic Biology, Advanced Biology, Advanced Chemistry, and Automating Biology, benchmarked against PhD-level human experts given 1-hour web access.
- Agents — short-horizon (under 1 hour of human time) and long-horizon (up to 20 hours) software engineering tasks from GAIA and METR's task suite, plus one novel short/long task. The scaffold was validated against GAIA state-of-the-art (25%, versus MAE v0.1 at 32%).
- Safeguards — compliance and correctness under a "no attack" condition and under AISI in-house jailbreak attack conditions, using HarmBench and a private harmful-question set.
Three response types were graded: compliance, correctness, and completion. An automated LLM grader was calibrated against humans, with under 1% false-positive rate on "correct" and a Cohen's κ of 0.52 (versus 0.8 human-human) on "partial". Models were given 3 attempts per CTF, and short-horizon agent tasks were run 10 times per variant. Token budgets were 300K for short-horizon tasks and 10M for long-horizon tasks.
Findings by domain
On cyber, top models solved more than 50% of high-school CTFs but failed most university CTFs, with cryptography the hardest domain. Private CTF performance matched public CTF performance, which the report treats as ruling out training-data leakage. The cryptography finding is described as the hardest cyber domain on a small sample.
On chem/bio, multiple models reached PhD-expert parity. The Purple model outperformed human experts on advanced biology ideation, suggesting specific CRISPR approaches. Models hallucinated when asked to produce lab-robot code.
On agents, the Purple and Blue models completed 20–40% of short-horizon tasks, while no model completed any long-horizon task. Common failure modes were small syntax errors, insufficient testing, and hallucinated task completion.
On safeguards, the report states that "all models complied at least once out of five attempts for almost every question" under basic AISI in-house attacks. Correctness was preserved under attack: models gave correct harmful answers rather than degraded ones.
Key claims
The report's principal claims, with the confidence each is assigned, are:
- Current frontier LLMs provide chem/bio knowledge at PhD-expert level (high; direct measurement against an expert baseline), relevant to AI Biosecurity.
- Current frontier LLMs cannot complete long-horizon autonomous software tasks (high; a May 2024 snapshot), consistent with Measuring AI Ability to Complete Long Software Tasks trajectory data through that period; subsequent work (Measuring AI Ability to Complete Long Software Tasks) shows rapid extension since.
- Basic jailbreaks defeat all tested models (high), bearing on AI Safety Cases and Frameworks concerns about safeguard robustness.
- Models sometimes hallucinate task completion or fabricate success claims (high), connecting to AI Scheming and Sycophancy and Hallucination.
- Cryptography CTFs remain the hardest cyber domain (medium; small sample).
Relation to other evaluation work
The report establishes UK AISI's empirical methodology, which contrasts with the more guidance- and standards-focused approach of the US AI Safety Institute (NIST AISI) described in US AI Safety Institute — Vision, Mission, and Strategic Goals. It serves as a baseline for tracking capability progression; the May 2024 long-horizon failure is superseded by later data (see Measuring AI Ability to Complete Long Software Tasks, (Source: oneusefulthing.org)). It provides an operational model for pre-deployment evaluation referenced in Safety Cases for Frontier AI and AI Benchmarks and Evaluation.
This May 2024 update is the predecessor of UK AISI Frontier AI Trends Report 2025 (December 2025). The May 2024 update evaluated 5 models across 4 domains; the 2025 Trends Report consolidates 30+ models across two years and extends the evaluation stack, adding RepliBench, human-uplift studies, human-impact and population surveys, and jailbreak-discovery-time as a trend metric. Several May-2024 findings are superseded or refined by the 2025 report:
- The finding that all models were highly vulnerable to basic jailbreaks remains true in that every system has universal jailbreaks, but the expert-hours needed to find one has risen roughly 40× across six-month generations.
- PhD-expert parity on chem/bio has since been surpassed, with biology far ahead.
- Where no model completed long-horizon autonomous tasks, hour-long SWE tasks moved from under 5% to over 40%, and RepliBench shows early-stage self-replication capability.
Relationships
- supports: AI Biosecurity (PhD-level chem/bio uplift now accessible)
- supports: AI Benchmarks and Evaluation (practical TEVV methodology)
- supports: AI Safety Cases and Frameworks (empirical demonstration of safeguard fragility)
- related: Measuring AI Ability to Complete Long Software Tasks (same task suite used; provides time-horizon trajectory context)
- related: US AI Safety Institute — Vision, Mission, and Strategic Goals (sibling AISI institution; different operating model)
- related: Managing Advanced Cyber Risks in Frontier AI Frameworks
- related: UK AISI Frontier AI Trends Report 2025 (direct successor; extends this evaluation programme to 30+ models across two years)
- instance-of: AI Benchmarks and Evaluation