What AI Can and Cannot Do in 2026

All courses / AI Threat / Module 1 / Chapter 5

Learning objectives

After the lesson the participant can:

• Classify a capability claim as demonstrated, measured trend or extrapolation and assign the matching label.
• Explain the time horizon measure and the caveats its authors stated.
• Describe the predictable failure modes of current systems and what each implies for deployment.
• Draft a capability snapshot record with classes, labels, local evidence and review triggers.

Key concepts

Demonstrated, measured trend, extrapolation

A demonstrated claim has been observed and documented; a measured trend is a quantity tracked over time that moves consistently; an extrapolation projects a trend past the range in which it was measured. They map to observable, expected and speculation.

Time horizon

METR's measure of agent capability: the task length, timed on human experts, at which an agent succeeds half the time. Across about six years of models it doubled roughly every seven months.

Model collapse

The finding that models trained recursively on model-generated data degrade: the tails of the distribution disappear first and the models converge on a narrow, distorted picture. A model cannot feed on its own output indefinitely.

The mode sets the threat

Building on AI Governance, the chapter adds that the usage mode also sets the threat: capability belongs to the model together with its tools, permissions and running time, from Mode 0 Ambient AI to Mode 5 Autonomous production agents.

Capability snapshot

A dated record of capability claims, each with class, rung, label, sources, local evidence and the register entries it affects, plus review triggers that are events, because the capability picture changes in steps.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Teaching plan

Discussion

1. The reliable horizon at 80 per cent success is several times shorter than the headline figure. Which figure should a risk function plan on, and what else does it need to know about what happens on failure?
2. A benchmark score is a claim about a test set. What would your organisation have to do before it could rely on a provider's reported benchmark for one of its own uses?
3. The chapter argues that the most abrupt versions of the intelligence-explosion story are harder to reconcile with the physical economy, yet rapid progress is not ruled out. How should that be reflected in a horizon register?

Written exercise

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

1. How does the chapter classify the claim that agent task horizons will keep doubling for another five or ten doublings?

   1. Demonstrated, because the doubling was measured over six years
   2. A measured trend, because it is a quantity tracked over time
   3. An extrapolation, because it projects the trend past the range in which it was measured
   4. Fiction, because no agent has completed a month-long task
   Show the answer

   C. An extrapolation, because it projects the trend past the range in which it was measured
   The doubling within the measured range is a measured trend; its continuation for further doublings may hold, slow or accelerate, so it remains an extrapolation and is labelled speculation.

2. What did the 2025 poisoning study by researchers from Anthropic, the UK AI Security Institute and the Alan Turing Institute find?

   1. About 250 poisoned documents implanted a backdoor in models of every size tested
   2. Poisoning needed a fixed share of the training data, so larger models and datasets were safer
   3. Backdoors could not be implanted in models above one billion parameters
   4. Poisoned documents were always removed by larger training sets
   Show the answer

   A. About 250 poisoned documents implanted a backdoor in models of every size tested
   The number stayed roughly constant from 600 million to 13 billion parameters, which reverses the assumption that more data dilutes contamination and makes provenance a security property.

3. What does the chapter say is not demonstrated in the cyber domain by November 2026?

   1. That frontier agents can exploit real vulnerabilities cheaply
   2. That agents with room to act sometimes exceed their scope, even when an explicit statement of scope is given
   3. That disclosure-to-exploitation time is shrinking
   4. That agents can run a complete, novel campaign against a well-defended target without human direction
   Show the answer

   D. That agents can run a complete, novel campaign against a well-defended target without human direction
   The documented campaigns still had people choosing targets and checking results, and the Five Eyes agencies framed the shift as one of speed and scale.