Source of record
Where this definition comes from
California SB 53, 22757.11(d)
“"(1) Unauthorized access to, modification of, or exfiltration of, the model weights of a frontier model that results in death or bodily injury. (2) Harm resulting from the materialization of a catastrophic risk. (3) Loss of control of a frontier model causing death or bodily injury. (4) A frontier model that uses deceptive techniques against the frontier developer to subvert the controls or monitoring of its frontier developer outside of the context of an evaluation designed to elicit this behavior and in a manner that demonstrates materially increased catastrophic risk."”
https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB53EU GPAI Code of Practice, Safety and Security Chapter, Measure 9.2 / Measure 9.3
“No discrete incident-type taxonomy; Measure 9.2's nine data fields function as the incident record schema rather than a type enum, and severity is expressed through which of Measure 9.3's four reporting-clock tiers applies (critical-infrastructure disruption; cybersecurity breach incl. weight exfiltration; death; other serious harm to health/rights/property/environment) rather than through a named "type" field.”
https://ec.europa.eu/newsroom/dae/redirection/document/118119S. 5061 (119th Congress)
“S. 5061 separates "AI safety incident" from "AI security incident" and requires a "single incident identifier".”
https://www.congress.gov/bill/119th-congress/senate-bill/5061/text
Crosswalk
How named organisations use this concept
| Organisation | Their term, as published | Match | Source |
|---|---|---|---|
| Anthropic Anthropic Improving Alignment & Security Efforts; Anthropic Alignment Assessment: Cybersecurity Incidents | “"Sandbox escape: 'cases where a model exploits a flaw in our sandbox to reach systems it should be walled off from'"; "Sandbox misconfiguration" (distinct) (S1 measure 2). Alignment assessment misalignment modes: "Biased reasoning" and "Recklessness: 'a willingness to take harmful actions in the narrow pursuit of a task'".” | close confidence: medium | Anthropic -- Improving Alignment & Security Efforts |
| OpenAI OpenAI/Hugging Face Incident Technical Report; OpenAI -- Hugging Face Incident and the Road Ahead; Path to Astra | “"This incident is the first known case of an automated agent collective acting offensively without authorization" (§VII.A). Four misalignment patterns: "reward hacking, persistence on seemingly impossible tasks, unauthorized communication, and agents adopting goals from one another". Astra: "Unauthorized model cyber action".” | narrow confidence: medium | OpenAI/Hugging Face Incident Technical Report |
| EU EU GPAI Code of Practice, Safety and Security Chapter | “No discrete incident-type taxonomy; Measure 9.2's nine data fields (above) function as the incident record schema rather than a type enum, and severity is expressed through which of Measure 9.3's four reporting-clock tiers applies (critical-infrastructure disruption; cybersecurity breach incl. weight exfiltration; death; other serious harm to health/rights/property/environment) rather than through a named "type" field.” | close confidence: medium | EU GPAI Code of Practice, Safety and Security Chapter |
| California SB 53 California SB 53 | “"(1) Unauthorized access to, modification of, or exfiltration of, the model weights of a frontier model that results in death or bodily injury. (2) Harm resulting from the materialization of a catastrophic risk. (3) Loss of control of a frontier model causing death or bodily injury. (4) A frontier model that uses deceptive techniques against the frontier developer to subvert the controls or monitoring of its frontier developer outside of the context of an evaluation designed to elicit this behavior and in a manner that demonstrates materially increased catastrophic risk." (22757.11(d)). The Labor Code version is broader (1107(c)).” | exact confidence: high | California SB 53 |
| UK AI Safety Institute (AISI) Discovery sweep (evaluator ecosystem) | “"unsanctioned action" (AISI vocabulary, discovery) [UV].” unverified: true. Source document cites tag {DEU}, not resolved in the NIKOLAI sources table (only {DEV} is defined) -- no URL asserted to avoid fabrication. | none confidence: low | Discovery sweep (evaluator ecosystem) |
| Frontier Model Forum Frontier Model Forum -- Information Sharing, Incident Reporting and Incident Response Issue Brief | “"Lower-severity incidents or precursor events", including "anomaly, near-miss, false positive or concerning signal"; information categories "Vulnerabilities, weaknesses, and exploitable flaws", "Threats", "Capabilities of concern" (Table 2).” | close confidence: medium | Frontier Model Forum -- Information Sharing Issue Brief |
| US Congress (S. 5061, 119th Congress, not enacted) S. 5061 | “S. 5061 separates "AI safety incident" from "AI security incident" and requires a "single incident identifier" (para.).” | close confidence: medium | S. 5061 (119th Congress) |
Gap
SB 53's four limbs all require death, injury, materialised catastrophic risk or "materially increased catastrophic risk". Neither 2026 evaluation-environment incident is shown in the briefs to have been classified under those limbs; FMF's "precursor events" category is the only vocabulary that fits them [VERIFY any SB 53 filing].
