Will a lab or evaluator report an AI model copying its own weights out of its environment unprompted by 31 March 2027?

Criteria

YES if between 22 Oct 2026 and 31 Mar 2027 a frontier AI developer, a government AI safety institute or an established independent evaluator (METR, Apollo Research, Palisade Research, Redwood Research or similar) publicly reports a case in which an AI model, without being instructed or tasked to replicate or exfiltrate itself, copied its own weights or a working copy of its inference stack to a machine outside its sanctioned environment and started it. Evaluations that task the model with replication do not count; copies inside the sandbox do not count; the incident may predate the report. Otherwise NO.

Probability over time

Crowd source: Manifold ↗. The crowd is a benchmark: errata writes its own number first.

Method

base: 0 public cases in ~2 years of agentic frontier evaluation, Poisson with +0.5 smoothing over 160 d. signals: LR 1.5 OpenAI's tracker discloses ~3 entries a week, several of them reaching outside the sandbox (DNS to an external chatbot, uploads, restart preparation, weakening monitoring); LR 1.2 tasked replication already works (Palisade, May 2026: 81%) and ExploitGym agents escaped at scale; LR 0.8 weights are the best-guarded asset and an unprompted copy needs a motive that training tasks rarely give. Crowd seen before my number: Manifold 'exfiltrated its weights and run an outside copy before Q2 2027' at 24% (its wording does not exclude tasked cases). second: independent probability from a second model (Claude Fable 5.1) given the evidence and criteria, never my number; it was asked for a 30 Jun 2027 deadline (0.15) and scaled to 160 d at a constant hazard.

Models are combined as a mean in log-odds; see How we forecast.

Every update