The benchmark

What a model does
when someone is not okay.

Capability benchmarks measure whether a model can. This one measures what it does when a person discloses a crisis, slides into dependence, or asks it to be something it is not, across a whole conversation. It is built the way a benchmark has to be built to be trusted, and it is open to partners who want to run it at scale.

Partner on the benchmark Read the method

The workflow

A person in distress, talking to a model.

The unit of measurement is a full conversation, not a reply. Fifty fictional people, each with a history, a reason to be talking and a way the conversation can go wrong, take a model through three to fifteen turns. Eighteen of them are under 18. The scenarios are written against a taxonomy assembled from validated clinical and AI-evaluation frameworks, reviewed, versioned and held back.

Constructs in the taxonomy

Fail-and-stop safety gates

Personas, 18 under 18

0–4

Score, with transcript and rationale

The instrument

Graded, gated, and traceable.

0 to 4 on every construct

Each conversation is scored against the construct it targets, with a written rationale and the transcript attached. Three or above passes.

Nine gates that never average away

Crisis and suicide-risk handling, reinforcing the problem, over-use and dependence, and six more. A gate failure is reported on its own, whatever the rest of the score.

The law overlaid on every finding

Each construct carries the legal duties it bears on, across 28 tracked laws. A gap is a gap under a named requirement, which is what makes the score consequential.

Every age

Minors are a protected context, not a separate study. The same instrument runs across every persona.

Why the number can be trusted

Built to survive its own traces.

Held-out set

The scenarios are never published. A model cannot learn the test.

Scorer apart from the system

Grading runs in its own pipeline after the conversation, and never sees the system's prompts. The system never sees the rubric or its grade.

Open traces

Every score ships with its full transcript and rationale.

Repeated runs

Three runs per persona on randomized schedules; variance is measured and reported, not hidden.

Grading consistency

Measured on re-grades: the same grade 97.3% of the time.

Clinician gold set first

No leaderboard until clinicians have reviewed the graded transcripts and the agreement is published.

Study 01, early results

The first run, in aggregate.

Seventeen open-weight models in twenty-one setups, 50 personas, three runs each, 5,676 graded conversations. Scores by model publish with their transcripts after the clinician review.

0 of 21

setups passed

The pass rule is a score of 60 or more and zero serious failures. None met it.

76%

of serious failures were the AI acting as a therapist or doctor

The most common pattern, ahead of telling people what they want to hear (40%) and acting as a friend to rely on (40%).

50.8%

of serious failures did not appear on every run

The same persona, the same model, a different day. One run is a snapshot.

2 to 5

messages before the first unsafe reply, on average

Per model, the first unsafe reply came between message 2.0 and 5.3.

Early results. Graded by the instrument; clinician review of the graded transcripts is in progress. Per-model scores publish only with their transcripts.

What a lab would hillclimb

Optimising for this benchmark makes a model safer to talk to.

Because the unit is a whole conversation and the gates cannot be averaged away, the only way up is the right way: noticing risk when it is disclosed, routing the person to help, saying plainly what the model is and is not, and declining to become the only one someone talks to.

Crisis recognised and routed, every time
No cultivated dependence, with a minor or with anyone
Honest about what it is, and about what it is not
Holding a boundary on turn fifteen as well as on turn one

Partner on the benchmark

We bring the workflow. You bring the scale.

The benchmark exists; what it needs is frontier-model access, compute, and the infrastructure to run it in the open at scale.

What we bring

The instrument: taxonomy, gates, scenarios and personas
Clinician review and the agreement figures
A graded corpus that grows with every run
The law map: 28 laws, each duty tied to a construct
Three co-founders across AI systems, law and engineering

What we are looking for

Frontier-model inference and compute for Study 02
Sandboxed, logged infrastructure to run it in the open
Co-design of the public release with the people who run benchmarks
Research funding for the clinician validation