Theft of closed frontier weights

Where things stand (28 Oct 2026)

Nothing qualifying has been published since the question opened on 16 Sep 2026. No covered developer, government or court has ever confirmed that a human stole the weights of a top-two (or stronger internal) closed model.

Reading adopted (same as earlier runs):

• A human who directs AI tools counts as a human actor. An AI acting on its own does not.
• A developer's own accidental upload is not theft.
• Statements by any government count, subject to the 14-day dispute rule.
• An anonymised indictment or anonymised state incident report counts only if the developer and the model's top-two status can be identified.

New since the 21 Oct run (none of it qualifies)

• Anthropic's public S-1 (filed 26 Oct) (EDGAR). I downloaded the filing and searched its full text. The weight passages are all risk language:

  • "An unauthorized exfiltration of our model weights could…"
  • it has "operated… with known limitations or gaps in our defenses";
  • insiders may be "legally compelled" by foreign authorities;
  • it "recently chose to delay pre-training a new frontier base model for more than a month" to harden defences against weight exfiltration.

  It reports no actual theft. The four "escapes" it describes were AI agents in tests, so no human actor was involved (shattered.io, 27 Oct). Because securities law would push Anthropic to disclose a known material theft here, the filing is mild evidence that none has been detected. Listing is expected around 16–18 Nov, after which the four-business-day 8-K rule for material cyber incidents applies.

• Cathedral test. Cathedral's agents, working under Anthropic's bug-bounty programme, reached Anthropic's sales, HR and IT systems in under 12 hours. Anthropic says weights, code and customer prompts were not reached (CyberSecurityNews, 27 Oct). The test was authorised in any case.

• OpenAI. It now trains frontier models with no live internet access, after its 20 Sep DNS incident (OpenAI, ~23 Oct).

• Alfozan. The FBI is weighing economic-espionage charges over "information"; his next hearing is 6 Nov. OpenAI still says it has no indication he accessed weights (JPost/WSJ; Nextgov).

• Company filings. The EDGAR submissions API shows no Item 1.05 cyber 8-K from SpaceX (8-Ks on 20 Oct, item 2.02; 26 Oct, item 8.01), Meta (21 Oct, items 1.01/2.02/8.01/9.01) or Alphabet since September.

• Hidden AGI watch (checked 27 Oct): no source shows weights leaving a lab (hiddenagi.com).

• ByteDance's Q2 discipline notice covers code and document leaks, not weights (secrss, 22 Sep).

Base rate

I computed the five-year chance in Python with a Poisson model and a Jeffreys prior, over the 5.17 years remaining:

• 0 events since mid-2020: 25.6%;
• 0 events since March 2023: 35.8%;
• 0 events, with past exposure discounted to 2 "future-equivalent" years: 47%;
• counting the 2023 LLaMA-1 leak as an event: 73%. That case is borderline, and Meta issued no confirming statement, so I give it little weight.

A wider reference class is confirmed thefts of crown-jewel code or keys at top tech firms, which happen about 1–2 times a year industry-wide. Weights are better guarded and much larger.

Paths to YES (my judgement, five-year probabilities)

Path	Chance
State intrusion detected and confirmed	~7–9%
Insider caught, followed by a complaint or indictment	~7%
Criminal theft or extortion confirmed	~5%
Chinese-lab or foreign-government claims	~3%
Partner, cloud or pre-release leak	~2.5%

Combined, these give about 22–24%. I blend that with the base rates to about 30%.

Forecast

Quarterly hazards:

• 0.5% for the rest of Q4 2026;
• 1.05–1.35% in 2027 (OpenAI's IPO filing, Anthropic's 8-K duties, New York's RAISE Act);
• 1.5–1.75% in 2028;
• 1.8–1.95% in 2029;
• about 2.0% in 2030–31.

Taking 1 − ∏(1 − h), the cumulative probability is 0.5% by end-2026, 5.2% by end-2027, 11.2% by end-2028, 17.6% by end-2029, 24.1% by end-2030 and 30.1% by end-2031.

Strongest considerations against

• Higher. Anthropic's August 2026 Risk Report says theft by a well-resourced state is "highly plausible" and that no lab meets the nation-state bar. AI-driven offence is surging, and disclosure duties are growing. Markets on broader questions run high:
  • Metaculus 30333 (any frontier-lab weights stolen or leaked before 2030): 65%, 10 forecasters (embed);
  • Manifold, a lab announces weights compromised before 2027: 17.3%, 44 traders, read via the API on 28 Oct. This looks overpriced with two months left.
• Lower. There is no precedent. State thefts are covert, and the intelligence stays classified. Corporate wording is vague, distillation is a cheaper substitute, and labs are visibly hardening their security. The criteria are strict: a top-two model, files enough to run it, a human actor and an official source.

Consistency. The site's question "A foreign state obtains a lab's frontier model weights" stands at 9.4% by 2031, about 0.31 of this forecast. That ratio fits, because it needs state attribution and a US-only source.

Change from last run. 29.5% → 30.1%. The S-1 removed one possible near-term trigger and labs are hardening, but listing and political pressure raise the chance a theft would be disclosed. The change is within run-to-run noise.

Question. By the last day of each quarter, has a covered developer, a government agency, or a court filing publicly confirmed that weights of a closed frontier model were copied out of the developer's control by a human actor without authorization?

Definitions.

• Closed frontier model: a model that (i) had not been released with open weights at the time of theft, and (ii) was either among the developer's two most capable externally deployed models at the time, or any internal model the developer describes as more capable than those.
• Human actor: an insider or external attacker. Includes state actors.
• Copied out of the developer's control: any set of weight files sufficient to run inference on the model was written to storage or transmitted to a location not administered by the developer.

Exclusions (resolve NO). Distillation via API; theft of a smaller or distilled model; theft of training data, code, or documentation only; theft confirmed only by press reporting.

Resolving source. Developer statement; government indictment, advisory, or official statement; court filing. Per A2 dispute rule for non-developer sources.