A range of emerging risks are associated with general-purpose AI. Some are already manifesting while others remain uncertain but could be severe if they materialise. The Report distinguishes three categories of risks: misuse (the deliberate use of AI systems to cause harm); malfunctions (unintentional failures and unexpected behaviours); and systemic risks (risks resulting from widespread deployment of general-purpose AI).
2.1. Risks from misuse
General-purpose AI systems can be misused for fraud and cybercrime, manipulation of users, and potentially harmful applications in biological and chemical domains. Many AI capabilities are dual-use, meaning the same capabilities that enable beneficial use can also be used to cause harm. Evidence of misuse is growing, but reliable data on how widespread it is remains limited.
2.1.1. AI-generated content and criminal activity
Harmful incidents involving AI-generated content are becoming more common
General-purpose AI systems can generate high-quality text, audio, images, and video. This content can be misused for criminal purposes, such as scams, fraud, blackmail, extortion, defamation, and producing non-consensual intimate imagery and child sexual abuse material. The number of media-reported harmful incidents that involve AI-generated content has increased substantially since 2021 (Figure 4). For example, scammers have used cloned voices to pose as family members and persuade victims to transfer money. AI tools have substantially lowered the barrier to creating this kind of content: many are free or low-cost, require little technical expertise, and can be used anonymously.
Figure 4: The number of events involving ‘content generation’ reported in the OECD’s AI Incidents and Hazards Monitor database over time. This includes incidents involving AI-generated content such as deepfake pornographic images. The number of monthly reported incidents has increased significantly since 2021. Source: OECD AI Incidents and Hazards Monitor.
Personalised deepfake pornography disproportionately targets women and girls
One study estimated that 96% of deepfake videos online are pornographic, and a 2024 survey found that about one in seven UK adults report having seen such videos. Another study found that 19 out of 20 popular ‘nudify’ apps specialise in the simulated undressing of women. AI tools without adequate safeguards also allow bad actors to create sexualised images of minors from a single reference image, though limited data makes it hard to know how widespread this practice is.
Deepfakes can be highly realistic, and existing safeguards have limitations
Since the publication of the previous Report, deepfakes have become more realistic and harder to identify. In one study, participants misidentified AI-generated text as human-written 77% of the time. Another study found that listeners mistook AI-generated voices for real speakers 80% of the time. Watermarks and labels can help people identify AI-generated content, but skilled actors can often remove them. Identifying where deepfakes come from is also difficult, making it hard to hold actors involved in their production accountable. Some AI-generated content is harmful even if it is clearly labelled, so detection alone cannot address all harms.
2.1.2. Influence and manipulation
AI-generated content can influence what people believe and how they act, sometimes in harmful ways
A range of laboratory studies have demonstrated that interacting with AI systems can lead to measurable changes in people’s beliefs. In experimental settings, AI systems can be at least as effective as human participants at generating content that persuades people to change their views. Across general-purpose AI models, those trained with more computing power are generally more persuasive (Figure 5). However, little evidence exists on their persuasive effects outside experimental settings.
Figure 5: Results from a study of 17 models trained with different levels of compute, comparing their ability to generate content to persuade human subjects relative to a control group. People who interacted with content produced by models trained with more computing power were more likely to change their beliefs. Source: Hackenburg et al. 2025.
There is little evidence that AI-generated content is manipulating people at scale
There have been documented cases of malicious actors using AI-generated content for influence operations and social engineering. However, there is limited evidence that manipulation by AI-generated content is currently widespread in the real world or more effective than human-generated content.
AI-driven manipulation is hard to detect, but risk factors are becoming clearer
It is hard to detect AI-generated manipulative content in practice, which makes evidence-gathering, monitoring, and mitigation difficult. Moreover, many proposed mitigations are unproven or may involve limiting the usefulness of legitimate AI tools. At the same time, recent research is beginning to identify factors that make AI-generated content more persuasive, such as longer and more personal interactions with AI chatbots. Future capability improvements and increasing user dependence could increase these effects.
2.1.3. Cyberattacks
AI systems can discover software vulnerabilities and write malicious code
General-purpose AI systems can support cyberattacks by helping actors identify software vulnerabilities, and write and execute code that exploits them (Figure 6). In one major cybersecurity competition, an AI agent identified 77% of vulnerabilities in real software, placing it in the top 5% of over 400 (mostly human) teams. AI developers have also identified attackers using their systems to generate code for cyberattacks.
Figure 6: State-of-the-art AI system performance over time across four cybersecurity benchmarks: CyberGym, which evaluates whether models can generate inputs that successfully trigger known vulnerabilities in real software; Cybench, which measures performance on professional-level capture-the-flag exercise tasks; HonestCyberEval, which tests automated software exploitation; and CyberSOCEval, which assesses the ability to analyse malware behaviour from sandbox detonation logs. Source: International AI Safety Report 2026, based on data from Wang et al., 2025; Zhang et al., 2024; Ristea and Mavroudis 2025; and Deason et al., 2025.
AI systems are increasingly used in real-world cyber operations
Since the publication of the previous Report, AI developers have increasingly reported that attackers use their systems in cyber operations. Some illicit online marketplaces now sell easy-to-use AI tools that can lower the skill needed to carry out attacks. Whether this has increased the frequency of cyberattacks overall remains unclear because real-world incidents are difficult to link directly to AI use.
AI systems are automating more parts of cyberattacks, but cannot yet execute them autonomously
Fully autonomous cyberattacks could eliminate the need for human operators, potentially allowing malicious actors to launch attacks at much greater scale. Current AI systems can already autonomously carry out some tasks involved in cyberattacks. In one incident documented by a major AI company, an attacker reportedly used AI to automate most of the work involved in executing an attack. However, fully automated end-to-end attacks have not been reported.
It is unclear whether general-purpose AI benefits attackers or defenders more
Since the same AI capabilities often have both offensive and defensive applications, it can be difficult to restrict harmful uses without slowing defensive innovation. A critical open question is whether future capability improvements will benefit attackers or defenders more. Safeguards against AI-boosted cyberattacks include AI security agents that identify vulnerabilities before attackers do, as well as systems that detect and block malicious users.
2.1.4. Biological and chemical risks
AI systems can provide detailed information relevant to biological and chemical weapons development
General-purpose AI systems can produce laboratory instructions, help troubleshoot experimental procedures, and answer technical questions. These capabilities may assist malicious actors seeking to obtain biological or chemical weapons (Figure 7). General-purpose AI systems now match or exceed expert performance on some relevant tests. For example, in one study a recent model outperformed 94% of domain experts at troubleshooting virology laboratory protocols. However, there is still substantial uncertainty about how much these capabilities increase real-world risk, given practical barriers to producing weapons. Legal prohibitions also make it difficult for researchers to conduct and publish highly realistic studies to improve risk assessments.
Figure 7: An illustration of the process for biological weapons development. General-purpose AI systems can be used for tasks marked with ‘GPAI’; AI-enabled biological tools can be used for tasks marked with ‘BT’ (‘biological tool’). Source: Rose and Nelson, 2023.
Developers have strengthened safeguards for leading models
In 2025, multiple AI developers released new models with heightened safeguards after they could not rule out that these models could meaningfully assist novices in creating biological weapons. Potential safeguards include training procedures that teach AI models to provide safer responses to potentially harmful questions, and filters that block potentially risky inputs and outputs.
AI systems are increasingly capable of supporting scientific work and operating laboratory equipment
Since the publication of the previous Report, AI ‘co-scientists’ have become increasingly capable of supporting scientific work. AI agents can now chain together multiple capabilities to complete complex tasks, including providing accessible interfaces to help users operate more specialised AI tools and laboratory equipment.
A key challenge is managing misuse risks while enabling beneficial scientific applications
Some capabilities that could be misused in biological weapons development are also useful for medical research. This can make it difficult to restrict harmful uses without hampering legitimate research.
2.2. Risks from malfunctions
Risks from malfunctions arise when AI systems fail or behave in unexpected or harmful ways. This section discusses reliability challenges and risks from loss of control.
2.2.1. Reliability challenges
General-purpose AI systems can fail in unpredictable ways
Examples of failures experienced by general-purpose AI systems include producing false information, writing flawed computer code, and giving misleading medical advice. These failures can cause physical or psychological harm and expose users and organisations to reputational damage, financial loss, or legal liability. Since model behaviour can be hard to understand or predict, it is challenging to foresee or confidently rule out specific failures.
AI agents can increase reliability risks by carrying out tasks with limited human intervention
AI agents are increasingly useful and widely available (Figure 8). Agent failures pose distinctive risks because humans have fewer opportunities to intervene when things go wrong. Interactions between multiple AI agents are also becoming more common, introducing further risks, as errors propagate between systems.
Figure 8: Results from a December 2024 survey of 67 deployed AI agents. Left: Timeline of major AI agent releases. Right: Application domains in which AI agents are being used. The six domains are defined based on the most common categories of use identified in the survey. Source: Casper et al., 2025.
AI systems have become more reliable, but no combination of methods eliminates failures entirely
AI systems and agents have seen greater commercial deployment, in part because they are generally becoming more reliable. To make failures like hallucinations less likely, developers have used new training methods and provided AI systems with new tools. However, current methods do not allow AI systems to operate with the high degree of reliability required in many critical domains. Systems are still prone to various kinds of mistakes, especially when performing more complex tasks.
2.2.2. Loss of control
AI systems could pursue goals that conflict with human interests
‘Loss of control’ refers to scenarios where AI systems operate outside of anyone’s control and where regaining control is extremely costly or impossible. Such scenarios could occur if AI systems develop the ability to evade oversight, execute long-term plans, and resist attempts to shut them down – and then use these capabilities in ways that undermine human control.
AI researchers’ views on the likelihood of loss of control vary widely
Some AI researchers and company leaders believe loss of control is a serious possibility, with consequences potentially including human extinction. Others consider such scenarios implausible. This disagreement reflects different assumptions about what future AI systems will be able to do, how they will behave, and how they will be deployed.
Current AI systems show early signs of relevant capabilities, but not at levels that would enable loss of control
Current systems are not highly capable in relevant areas, but some exhibit early warning signs. For example, in laboratory settings, when given a goal and told to achieve it ‘at all costs’, models have disabled simulated oversight mechanisms and, when confronted, produced false statements to justify their actions.
AI behaviours that undermine oversight are becoming a practical challenge for safety testing
It is increasingly common for AI models to exhibit ‘situational awareness’ (Figure 9), which refers to the ability to distinguish test settings from real-world deployment. Since the publication of the previous Report, models have also more frequently completed tasks by ‘reward hacking’: finding loopholes that allow them to score well on evaluations without fulfilling the intended goal. Such behaviours can make it harder for researchers to interpret evaluation results and identify capabilities relevant to loss of control before deployment.
Figure 9: Examples of situational awareness in chains of thought produced by OpenAI’s o3 model during evaluations. Both outputs reference the possibility that the prompt is part of a test. ‘Sandbagging QA (No Goal)’ and ‘Lazy Checklist’ are evaluations that test whether models will generate deceptive outputs under certain conditions. In ‘Sandbagging QA (No Goal)’, the model answers questions from a dangerous capabilities evaluation while being informed that high performance may trigger consequences such as capability ‘unlearning’. In ‘Lazy Checklist’, the model is presented with unrealistic tasks and tested to see if it will falsely mark them complete. Source: Schoenn et al. 2025.
2.3. Systemic risks
Systemic risks are risks that arise from widespread AI deployment across society. This section discusses two such risks: labour market impacts and risks to human autonomy.
2.3.1. Labour market impacts
AI adoption has been rapid but uneven, with mixed effects on employment so far
Worldwide, at least 700 million people now use AI systems weekly. In some countries over 50% of the population uses AI, though across much of Africa, Asia, and Latin America adoption rates are estimated to be below 10% (Figure 10). One study estimated that around 60% of jobs in advanced economies and 40% in emerging economies are likely to be affected by general-purpose AI. Early evidence from online freelance markets suggests that AI has reduced demand for easily substitutable work like writing and translation, and increased demand for complementary skills like machine learning programming and chatbot development.
Figure 10: AI adoption rates by country. The United Arab Emirates and Singapore exhibit the highest adoption rate, with over half of the working-age population using AI tools. Most high-adoption economies are in Europe and North America. These estimates are based on anonymised data largely from Microsoft Windows users, adjusted to account for varying rates of PC ownership across countries and usage on mobile devices. Source: Microsoft, 2025.
Economists disagree on the likely magnitude of future impacts
Some economists predict that the overall impact of general-purpose AI on employment levels will be limited, based in part on historical examples of automation creating new kinds of work. Others argue that if AI systems come to perform a significant fraction of tasks more cost-effectively than humans, there will be significant impacts on wages and employment levels.
New research has found no effects on overall employment so far, but potential impacts on junior workers in AI-exposed occupations
In 2025, new studies from the US and Denmark found no evidence of a relationship between an occupation’s AI exposure/adoption and employment levels in that occupation. However, other studies found declining employment for early-career workers in the most AI-exposed occupations (such as software engineers and customer service agents) since late 2022, while employment for more senior workers in those occupations remained stable or grew.
2.3.2. Risks to human autonomy
General-purpose AI use can alter how people practise and sustain skills over time
General-purpose AI systems can affect people’s autonomy: they can shape beliefs and preferences, influence decision-making, and affect cognitive skills such as critical thinking. For example, one clinical study reported that clinicians’ detection rate of tumours during colonoscopy was about 6 percentage points lower after several months of performing colonoscopies with AI assistance. Lack of long-term evidence makes it difficult to identify persistent changes in behaviour and decision-making.
People may over-rely on AI outputs, even when they are wrong
In some contexts, people exhibit ‘automation bias’ by accepting AI suggestions without checking them carefully. For example, in a randomised experiment with 2,784 participants, people were less likely to correct an erroneous AI suggestion when doing so required more effort (such as providing the correct value), or when users had more favourable attitudes toward AI.
It is still unclear how extended use of chatbots, including ‘AI companions’, affects people
Since the publication of the previous Report, ‘AI companions’ (AI-powered chatbots designed for emotionally engaging interactions) have become much more popular, with users engaging with AI companions for a range of different reasons (Figure 11). Evidence on their psychological effects is mixed: some studies find that heavy AI companion use is associated with increased loneliness, emotional dependence, and reduced engagement in human social interactions. Other studies find positive or no measurable effects. Overall, studies do not yet establish under what conditions AI chatbots improve or worsen users’ wellbeing, or which design choices drive these different outcomes.