We are entering a period where major genAI labs can imply extraordinary danger, dramatic autonomy, or troubling emergent behavior, while still controlling the evidence, the framing, the timing, and the interpretation. The public gets a warning, but not a neutral test. Regulators get pressure, but not a reproducible harness. Competitors get narrative distortion, while the lab making the claim retains the authority to decide what counts as serious and when.
That is a cry-wolf problem.
Not because every warning is false. That would be too simple. The cry-wolf problem is far worse than that. It is what happens when institutions issue dramatic warnings in ways that are too selective, too theatrical, too self-interested, or too difficult to verify. Over time, even real danger becomes harder to distinguish from strategic positioning. The audience gets numb. Skeptics get stronger. True positives become easier to dismiss. The public loses the ability to tell the difference between science, caution, branding, and fear management.
And if frontier AI really is becoming more dangerous in meaningful ways, that is the last outcome anyone should want.
A society cannot afford to be trained to roll its eyes at warnings that might someday matter. But that is exactly what happens when extraordinary claims arrive without a standing, neutral, high-speed way to evaluate them.
That is the hole we should be trying to close. If nobody listens, we have little choice.
That doesn’t mean we won’t try. The security community immediately responded. The recent release of Mythos saw over 250 qualified security professionals come together to work out the concerns around the potential based on internal Anthropic studies within a span of a few days [1] and grind out how a security program will continue to work under the rapid evolution of genAI.
Knowing quite a few CISO and security professionals out of work, I can’t help but wonder how many of these individuals contributed out of the pure goodness of their hearts. My hats off to them. May you be restored soon.
Volunteer and professional communities matter enormously here too. Organizations like OWASP—and the wider ecosystem of meetups, working groups, and open guidance efforts—translate abstract risk into practices engineers can adopt, publish patterns others can reuse, and mobilize expertise when vendors drop a surprise. Much of that labor is unpaid or under-resourced; it deserves explicit respect in any serious conversation about AI safety culture.
But admiration is not capacity. Those efforts can be amazing—and they are still not enough on their own. Even the strongest community programs are not a substitute for a standing, neutral harness that can insist on reproducible tests under defined conditions on a timetable that matches product release. Volunteers cannot compel access to frontier systems on fair terms, run sustained lab-grade evaluations at national scale, or produce findings that regulators and markets treat as authoritative when incentives collide. The goal is not to pit OWASP-style communities against institutional coalitions—it is to connect them: community knowledge should feed the harness, and the harness should publish enough detail that those same communities can pressure-test the conclusions in public.
The answer is not to tell the public to trust companies more. The answer is also not to build a slow, bloated oversight regime that takes longer to define a rubric than a private lab takes to train a new model family. The answer is to build a public-interest AI safety harness that can move fast enough to matter.
Not a monument. Not a years-long process maze. A harness.
The purpose of that harness would be simple: when a lab claims a model is unusually dangerous, unusually capable, unusually agentic, or unusually difficult to control, there should be an independent mechanism ready to test those claims quickly under defined conditions. Not someday. Not after the news cycle has passed. Fast enough to check the signal before the narrative hardens.
And we do not need to invent this entirely from scratch.
The United States and its close partners already have a bench of institutions capable of forming the backbone of such a system: NIST, the UK AI Security Institute, MIT Lincoln Laboratory, IARPA, DARPA, MITRE, Johns Hopkins Applied Physics Laboratory, Sandia National Laboratories, Lawrence Livermore National Laboratory, Idaho National Laboratory, RAND, and In-Q-Tel.
The important point is not that all twelve must act at once. The important point is that any credible combination of them could begin. A small coalition could stand up the first harness, prove the model, and expand it over time. That matters, because the public interest should not have to wait for a perfect institutional arrangement before getting an independent testing capability.
That is exactly the kind of flexibility this moment requires.
NIST plus MITRE plus one or two operational labs could establish the standards and reporting spine. The UK AI Security Institute plus a U.S. lab could provide fast cross-validation. DARPA, IARPA, or In-Q-Tel could help drive challenge-based modules and outside researcher participation. RAND could help connect technical findings to policy consequence. The system does not need every institution at the table to start producing value. It needs enough serious institutions to make the results hard to dismiss.
That is one of the biggest differences between a real public-interest harness and the way AI safety is often discussed today. A lot of current discussion sounds as though the only alternatives are private self-attestation or a giant future regime that does not yet exist. That is false. A modular public-interest framework can start with a coalition, not a finished empire.
These institutions also do not need to do the same thing.
NIST should anchor the standards layer. Somebody has to define the common language of evaluation: categories, thresholds, reporting formats, repeatability requirements, benchmark handling, confidence statements, version comparisons. Without that, the public gets anecdotes instead of evidence.
The UK AI Security Institute should function as a close empirical counterpart, helping create independent replication and transatlantic comparability. If two serious public-interest bodies can evaluate similar systems under similar standards and reach comparable findings, trust improves. That is how credibility is rebuilt.
The operational testing core can come from places like MIT Lincoln Laboratory, Johns Hopkins Applied Physics Laboratory, Sandia, Lawrence Livermore, and Idaho National Laboratory. These are institutions built to test consequential systems in realistic environments. They know how to think adversarially. They know how to ask not just whether something can fail, but how it fails, under what conditions, and with what consequences.
DARPA and IARPA can help shape the challenge structure. If the private labs move fast, the public-interest side cannot respond like a sleepy procurement office. It needs challenge programs, rapid iteration, adversarial discovery, and test environments that evolve as quickly as the threat surface does.
MITRE can help turn raw findings into usable taxonomies, assurance patterns, threat models, and operational guidance. RAND can connect technical results to strategic decisions, because the meaning of a safety result depends on context. In-Q-Tel can help bridge research, venture ecosystems, and implementation pathways so the harness is not trapped inside one bureaucratic lane.
The core principle is speed with structure.
A serious harness should run in tiers.
Tier 1 is the release threshold. Before a model is released publicly, or released into broad enterprise or developer use, it should pass a rapid independent screening process. That screening should include baseline misuse tests, known jailbreak families, prompt variation, simple tool-enabled tasks, and initial probes for deception, persistence, and policy evasion. Tier 1 is not meant to settle every question. It is meant to answer the most important one fast enough to matter: has this model cleared a credible minimum bar for release?
Tier 2 is triggered, not universal. If Tier 1 finds meaningful concern, if the model represents a substantial jump in capability, if the sponsor is making unusually strong danger claims, or if the intended deployment context raises the stakes, then the model moves into structured domain evaluation. That is where deeper testing begins: cyber misuse assistance, scalable fraud enablement, strategic persuasion, long-context manipulation, dangerous knowledge retrieval, multi-step harmful workflows, and changes in behavior when the model is given tools, memory, or delegated task persistence.
That matters because the damage may not stop at cybersecurity. A sufficiently capable system, especially one embedded into decision support, industrial environments, or high-trust operational workflows, may create meaningful risk across other domains as well. Energy systems, transportation, public communications, financial operations, and even areas adjacent to nuclear command, control, safety, or support functions are the kinds of environments where error, manipulation, or abuse could carry consequences far beyond an ordinary software failure. A serious public-interest harness should acknowledge that reality early, even if the first release gates remain deliberately narrow.
Tier 3 is reserved for exceptional concern. Models that cross defined thresholds, fail in concerning ways, or are proposed for especially sensitive use cases should face intensive review under more realistic operating conditions: long-horizon tasks, multi-agent settings, environmental variation, safeguard bypass attempts, and domain-specific scenarios tied to public harm, critical systems, or national-security relevance.
And the whole thing has to move on the timescale of release.
Initial triage should happen in days. Structured testing should happen in weeks. Claimed mitigations should face regression testing, not just blog-post reassurance. External researchers should be able to submit candidate attack modules and evaluation packs. The best ones should be pulled into the standing harness. This is how mature security ecosystems improve: not by treating discovery as embarrassment, but by instrumenting it and making it repeatable.
That is the point of the public-interest model.
It does not require perfect foresight. It does not require one institution to solve every philosophical question around AI. It does not even require all twelve institutions to act in concert. It requires something much more practical: a standing mechanism, built by any serious combination of capable public-interest institutions, that can rapidly convert extraordinary claims into independently testable propositions.
Can the model materially assist cyber abuse?
Can it strategically deceive evaluators across turns?
Can it persist toward harmful goals when given tools?
Can it evade safeguards with realistic adversarial effort?
Can the results be reproduced by someone other than the company making the claim?
Those are answerable questions. Or at least answerable enough to matter.
And that is precisely why the current state of affairs is so weak. We are allowing private labs to issue warnings that shape markets, media narratives, public anxiety, regulatory pressure, and philosophical debate, without requiring those warnings to pass through a public mechanism built for fast neutral scrutiny.
That is unsustainable.
If the danger is real, it deserves validation. If the mitigation is real, it deserves verification. If the claim is extraordinary, it should survive outside the walls of the institution making it.
Otherwise the AI safety conversation will keep drifting into the same trap: repeated alarm, selective evidence, contested interpretation, and rising public fatigue. That is how you end up with a culture that stops listening right before it finally should.
That is the cry-wolf problem.
And if we are serious about AI safety, then the answer is not more howling from inside private labs.
It is to build a public-interest harness that can tell us, quickly and credibly, when there is actually a wolf at the door.
