A foreign state obtains a lab's frontier model weights

Where things stand (12 Oct 2026)

Nothing that qualifies has been published since 16 Sep 2026, and nothing has been published before then either.

• NSA–CISA–FBI advisory AA26-251A (8 Sep 2026) is about distillation only, and the question excludes it. https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-251a
• Reuters, 1 Oct 2026: Rep. Khanna wrote to the CEOs of OpenAI, Anthropic, Google, Meta and SpaceXAI asking for every known attempt to steal model weights. Reuters says "there are few known cases of any bad actor stealing model weights," and none involves a state taking a frontier model. https://m.economictimes.com/tech/artificial-intelligence/leading-democrat-asks-ai-firms-for-data-on-any-chinese-access-to-sensitive-code/articleshow/134615367.cms ; https://thehill.com/policy/technology/6124282-ro-khanna-ai-theft-investigation-china/
• Google's threat intelligence group (GTIG), 8 Sep 2026: "In Q2 2026, we did not observe any direct attacks on frontier models from tracked cyber espionage or IO actors." https://cloud.google.com/blog/topics/threat-intelligence/from-prompting-to-autonomy-the-evolution-of-adversarial-ai
• Linwei Ding case: the closest precedent involved data-centre infrastructure documents, not weights. In Aug 2026 the judge threw out the economic-espionage counts because the evidence did not show Ding meant to benefit China's government. Attributing a theft to a state is hard to prove even in a strong case. https://finance.yahoo.com/technology/ai/articles/former-google-engineer-convicted-stealing-105328785.html
• The AI 2027 tracker and the Hidden AGI watch site both report no public evidence of any weight theft. https://ai2027-tracker.com/predictions/model-theft/

Reference class and model

Base rate. About 3.5 years of intense frontier competition (2023 to mid-2026) have produced no confirmed state theft of frontier weights. A wider reference class is officially confirmed state theft of a crown-jewel asset at a top US tech firm, such as Google's Aurora breach in 2010, RSA in 2011, Microsoft's stolen signing key (Storm-0558) in 2023, and Microsoft's Midnight Blizzard breach in 2024. These happen roughly every few years across the whole sector. That points to something like 10–20% over five years for five heavily targeted labs, before applying this question's strict criteria.

Decomposition to end-2031:

• A state actually steals closed frontier weights: about 50%. Anthropic's Feb 2026 Risk Report says nation-state attackers are explicitly out of scope for its security controls (https://www.anthropic.com/feb-2026-risk-report), and AI-enabled hacking tools are spreading.
• The theft is detected and attributed in time: about 0.4.
• A qualifying public source confirms it: about 0.45.
• The statement meets every definition (weights, frontier, completed, named state and developer): about 0.75.

This gives about 7%. The optimistic and pessimistic versions run from roughly 3% to 18%, and I settled near 9%.

Hazard shape. I used quarterly hazards rising from 0.30% (Q4 2026) to 0.35–0.40% (2027), 0.45% (2028), and about 0.47–0.48% (2029–31). The rise reflects higher stakes, AI-enabled offence, and detection lags. I computed the cumulative probability in Python as 1 − ∏(1−h), giving 1.8% by end-2027, 5.3% by end-2029 and 8.9% by end-2031.

Paths to YES

1. Victim lab discloses. A lab announces the theft on its own site, in an 8-K, or in an S-1 filing, and names the state. Precedents are Google's Aurora disclosure and Microsoft's disclosures about Storm-0558 and Midnight Blizzard. SEC disclosure duties now apply to Alphabet, Meta and SpaceX/xAI, will apply to Anthropic after its planned November IPO, and to OpenAI later.
2. US government confirms. This could be a DOJ indictment (usually one to four years after the theft), a Treasury sanctions notice, or a CISA/FBI advisory. The administration is openly hawkish on Chinese "AI theft"; Bessent has threatened sanctions.
3. New disclosure pressure. The White House Super Intelligence Force now demands immediate incident disclosure (https://www.yahoo.com/news/politics/articles/exclusive-anthropic-breaches-spark-white-224721423.html), and Khanna and California Attorney General Bonta are both making inquiries.

Paths to NO

• States may keep preferring distillation, which is cheap and deniable. China's own models are only months behind, which lowers the value of a theft.
• Lab security is improving with government help.
• A theft carried out by a top state hacking operation may never be detected.
• The intelligence community may keep it classified, and labs would hedge ("no evidence weights were accessed").
• Anonymised advisories, attempted thefts, and insiders caught before handing the weights over would not count.

Reading adopted. The confirming source must identify the state, the covered developer, and a model described as frontier. An insider case counts only if the source says the insider acted for the state and the weights actually reached it.

Strongest case against my estimate

On the high side: AI-enabled offence is accelerating fast in this world. The State of AI 2026 report predicts that within 12 months an AI-led attack will steal the full weights of a closed frontier model (https://www.stateof.ai/State-of-AI-Report-2026.pdf), and Hudson Institute testimony to the House Intelligence Committee treats a stolen frontier model as a realistic scenario. That could justify 15% or more. On the low side: there are zero precedents, and both labs and the government have strong reasons not to confirm a theft. I put weight on both and stay near 9%.

Question. By the last day of each quarter, has the US government or a covered developer confirmed that a foreign state obtained the weights of a closed frontier model from a covered developer without authorisation?

Definitions.

• Covered developer: the site convention applies.
• Foreign state: a sovereign state other than the United States, including its government, military, intelligence services, or an actor explicitly identified by the confirming source as acting on its behalf in obtaining the weights. A company's nationality, government awareness of its activity, or general state sponsorship alone does not establish state acquisition.
• Frontier model: a model that matched or exceeded the capabilities of the most advanced models at the time of its development, including an unreleased internal model or checkpoint. The confirming source or a developer-authored technical document must identify it as frontier or describe it as meeting this definition; being produced by a covered developer alone is insufficient. The model need not still be frontier when the acquisition is disclosed. This uses the definition in RAND's Securing AI Model Weights, RR-A2849-1 (2024).
• Closed: the developer had not made that model's weights generally available for download at the time of acquisition. API access, restricted research access, or private licensing does not make weights open.
• Obtained the weights: acquired a copy of the actual learned parameters sufficient to instantiate the model or a usable checkpoint, rather than merely access to its outputs. An explicit statement that the model's weights were stolen or acquired suffices unless the source specifies that only unusable fragments were obtained. Acquisition through an insider, contractor, cloud host, licensee, intermediary, or subsequent transfer counts if the weights originated with a covered developer. Proof of subsequent deployment is unnecessary.
• Without authorisation: the developer did not permit the acquisition or transfer to the state or its agent. An insider's legitimate access does not authorise exfiltration. A transfer explicitly approved by the developer does not qualify merely because it violated export controls.

Resolves YES if a qualifying source affirmatively states that a completed acquisition meeting all the definitions occurred. A public US indictment, criminal complaint, sanctions notice, or official intelligence assessment counts if it specifically asserts completed acquisition and state attribution; conviction or disclosure of the underlying evidence is not required. An affirmative intelligence assessment counts even if expressed with an intelligence confidence level, but a statement merely identifying a possibility, suspicion, risk, or investigation does not. The state, originating covered developer, and model or model class must be identified sufficiently to establish the definitions; a public model name is not required.

Resolves NO / Exclusions. Resolve NO for a horizon if no qualifying confirmation has been published by that horizon. Exclude attempted or thwarted theft, authorised red-team exercises, API abuse, distillation, model imitation, extraction of outputs or chain-of-thought, and theft of training data, source code, architectures, or infrastructure documents without the weights themselves. Access to a system storing weights without confirmation that the weights were acquired is insufficient. Theft by a foreign private actor without the required state attribution is insufficient. The NSA–CISA–FBI advisory AA26-251A of September 8, 2026, describing industrial-scale distillation and likely Chinese government awareness, does not establish weight acquisition.

Resolving source. Sources are limited to the US federal government or a covered developer. Government confirmation must appear in an official publication, advisory, report, statement or transcript on a federal government domain, or a publicly filed federal indictment, complaint, government court filing, judicial finding, or Treasury sanctions notice. Eligible issuing bodies include the White House, ODNI and its intelligence agencies, DOJ/FBI, DHS/CISA, the Departments of Defense, State, Commerce and Treasury, federal courts, and congressional committees issuing institutional reports. Individual legislators' remarks do not count. Developer confirmation must be on the developer's own domain or in a developer-authored document, including a public regulatory or court filing, under Public confirmation (A2). The question's narrower source restriction excludes independent evaluators, other governments, and press reports as standalone confirmation. Executive interviews, employee social-media posts, leaks, and anonymous-source reporting do not count. Apply Resolution date (A3) and the Resolution window: only qualifying publications on or after September 16, 2026 count, regardless of when acquisition occurred; once YES, always YES at later horizons.