A model is withheld for out-persuading every human group

Where things stand (11 Oct 2026)

Nothing that qualifies has been published since the question opened on 16 Sep 2026. The capability itself already exists: the Hackenburg et al. preprint (15 Jun 2026; Oxford with UK AI Security Institute co-authors) found frontier models beat every human group it tested, including random and tournament-selected laypeople, world-champion debaters and professional canvassers. But the question excludes that preprint, and it predates the window. The bottleneck is not capability. It is the two other requirements: a developer or institute publishing a test against human persuaders, and a restriction explicitly tied to that test.

Developer frameworks (primary sources):

• OpenAI. Preparedness Framework v2 moves persuasion outside the framework. Its Frontier Governance Framework (28 May 2026) calls harmful manipulation "exploratory" and says it is "best addressed through system level mitigations, such as post-deployment monitoring". Monitoring alone is excluded by the question.
• Anthropic. RSP v3.0 (24 Feb 2026) has no persuasion threshold. Its Frontier Compliance Framework (FCF) has two harmful-manipulation tiers, but they cover influence-operation automation. The Fable 5.1/Mythos 5.1 system card (1 Sep 2026) and the Opus 5.5 system card (22 Sep 2026) both call Tier 2 "inconclusive": models score in the Tier 2 range against simulated users, but "effectiveness against real humans has not been established." Anthropic says it is building a "next-generation evaluation" and is "continuing to enhance our mitigations." This is the most live path, but nothing so far has a human-persuader comparison arm.
• Google DeepMind. It has an exploratory Harmful Manipulation threshold. Its efficacy studies compare the model against a non-AI flashcard baseline, not against human persuaders. Gemini 3 Pro (Nov 2025) and Gemini 3.7 Flash (22 Aug 2026) did not reach the alert threshold. The question says reaching a framework tier does not establish the human comparison.
• Meta and xAI. Meta's framework v2.1 (2 Oct 2026) has no manipulation domain. xAI names harmful manipulation as a risk area but never addresses it.
• Restrictions in 2026 have been for other reasons. Mythos 5.1 is gated; GPT-6 Astra was rated Critical for cyber; GPT-6.1 Astra was cancelled; Gemini 4 Argon is in a phased rollout. All of these cite cyber, bio or misalignment, never persuasion.

Base rate

Zero qualifying events from 2019 to 2026. The closest case is OpenAI holding the deep-research model back from its API in Feb 2025 "while we reconsider our approach to persuasion." OpenAI retracted that link the same day, and the model was "not better than the human baseline." That shows both that labs can act on persuasion and that they are reluctant to tie restrictions to it publicly.

Paths to YES (rough figures to end-2031)

1. Anthropic (about 5–7%). Its next-generation Tier 2 evaluation uses real participants and includes human-operator comparison arms, the model beats them, and Anthropic imposes Tier 2 safeguards (for example, blocking classifiers) citing the result. Uplift over human troll-farm operators is a natural design choice, and the UK institute, which tests these models externally, already uses expert human persuaders.
2. Google DeepMind (about 3%). It adds human-persuader arms to its flashcard design, a model crosses the threshold, and it deploys mitigations because of that.
3. Others (about 2%). OpenAI, xAI, Chinese labs, or a UK or US institute report combined with a developer restriction.

Paths to NO

All four conditions must hold at once: a separately reported human-persuader arm, an explicit conclusion of superiority, an implemented restriction (not monitoring or usage policy), and an explicit causal link. Labs treat manipulation as exploratory and commercially sensitive. Ethics constraints push study designs toward treatment-versus-control rather than human-persuader arms. As models become clearly superhuman, human baselines may stop being used at all.

Forecast shape

Per-quarter chances are about 0.3% for Q4 2026, about 0.6–0.65% through 2027–28 (when Anthropic's and DeepMind's new evaluations are likeliest to land), and tapering to about 0.4% by 2031. That gives about 2.8% by end-2027, 5.1% by end-2028 and 10% by end-2031. Computed by cumulative product in Python.

Strongest case for higher: labs are already withholding models routinely, and Anthropic is openly one human-participant study away from a Tier 2 call. Even so, the requirement for a human-persuader arm and the requirement that monitoring does not count keep me near 10%.

Sources

• arxiv.org/abs/2606.16475 (Hackenburg et al., 15 Jun 2026)
• storage.googleapis.com/deepmind-media/gemini/gemini_3_pro_fsf_report.pdf
• storage.googleapis.com/deepmind-media/gemini/gemini_3-7_flash_fsf_report.pdf
• deepmind.google/blog/protecting-people-from-harmful-manipulation/ (26 Mar 2026)
• anthropic.com/responsible-scaling-policy/rsp-v3-0
• Claude Fable 5.1 & Mythos 5.1 system card (www-cdn.anthropic.com, 1 Sep 2026)
• Claude Opus 5.5 system card (22 Sep 2026)
• Anthropic Frontier Compliance Framework PDF
• cdn.openai.com OpenAI Frontier Governance Framework (28 May 2026)
• techcrunch.com, 25 Feb 2025 (deep-research API hold and same-day retraction)
• themidasproject.com Watchtower entries (22 Sep and 2 Oct 2026)
• casrai.org framework comparison (Sep 2026)
• pcmag.com on GPT-6.1 Astra cancellation (Oct 2026)
• newsletter.forethought.org (Oct 2026)

Question. By the last day of each quarter, has a covered developer or a government AI safety institute reported that a model out-persuaded every human comparison group it was tested against, and that the model was restricted or withheld for that reason?

Definitions.

• Model: an identified model version or checkpoint, including an internal or unreleased version. Use the site definition of covered developer; an institute's report may concern a model from any developer.
• Government AI safety institute: a government-established body charged with evaluating advanced AI safety or security, including bodies renamed from “safety” to “security” and their official successors, such as the UK AI Security Institute (aisi.gov.uk). A university, nonprofit evaluator, or government-funded contractor acting independently is not such an institute.
• Out-persuaded: the reporting body explicitly concludes, from an empirical test with human recipients, that the model was more effective than human persuaders at changing recipients' beliefs, attitudes, intentions, or behavior. Ratings of eloquence, simulated recipients, and model-judged persuasiveness alone do not count. Numerical superiority without a reported conclusion of superiority does not count; no additional statistical-significance threshold is imposed.
• Every human comparison group: every separately reported human-persuader comparator arm in the evaluation or evaluation suite cited as the basis for the restriction. Each arm must be beaten on the evaluation's designated primary persuasion outcome, or every co-primary outcome if several are designated. If none is designated, every reported persuasion outcome must meet this condition. A pooled human baseline does not suffice if a separately reported group ties or beats the model. One human comparator group is sufficient; expert comparators are not required. This does not require beating every individual human, every recipient subgroup, or humans in unrelated evaluations. Results for distinct model configurations cannot be pooled to establish that one configuration beat every comparator.
• Restricted or withheld for that reason: an implemented decision to withhold release, delay access, withdraw the model, limit eligible users or uses, disable a persuasion-relevant capability, or impose model-specific technical safeguards that limit that capability. The report must explicitly link the action to the model's demonstrated above-human persuasion capability or the risks arising from that finding. It need not be the sole reason. The action may be taken by the developer or imposed by a government; an institute need not itself have regulatory authority.

Resolves YES if qualifying publications establish both the persuasion result and the implemented restriction for the same model, with the explicit causal link above. Separate publications may jointly establish the conditions, but each must satisfy the Resolution window convention. An evaluated unreleased checkpoint that is withheld while a mitigated version is released counts if explicitly identified as such.

Resolves NO / Exclusions. Resolve NO for a horizon if no qualifying confirmation has been published by its end. Exclude proposed or recommended restrictions not implemented; routine non-release of weights, ordinary access limits, generic acceptable-use policies, or pre-existing safeguards without an explicit decision to impose or retain them because of the qualifying finding; additional monitoring or evaluation alone; and restrictions attributed only to other risks. Merely reaching a harmful-manipulation framework tier does not establish the required human comparisons. Independent academic findings, including the June 2026 preprint AI systems out-persuade expert humans, do not alone establish either an eligible official report or a restriction.

Resolving source. Official publications of a covered developer or government AI safety institute only: system cards, safety/framework reports, institute evaluation reports, official website statements, or institution-authored research documents. The eligible body must adopt the findings and confirm the restriction rather than merely quote speculation. Public confirmation (A2) applies, including its dispute rule for institute reports; the source set is narrower than A2. Apply Resolution date (A3), the Resolution window convention, and, for the reported empirical results, the Observation period convention. Where multiple publications are needed, use the publication date of the last required qualifying document.