Sanders' briefing is days away. Four parts of this series have walked through the mechanics of how these systems get built, the vocabulary Congress borrows to describe the danger, and the field's own history of being declared dead and coming back. This last part sets vocabulary aside and asks a plainer question: what has actually happened, and what is anyone still guessing about?
What AI Can Actually Do Right Now
The clearest available answer comes from the International AI Safety Report 2026, an evidence review backed by dozens of governments and expert contributors. General-purpose AI systems now score above 80 percent on graduate-level science questions and perform at a medical or legal professional level on licensing-style exams. Coding agents complete software tasks that would take a human roughly thirty minutes, and the length of task they can reliably handle has been doubling about every seven months. Some systems solve mathematics olympiad problems at a gold-medal level. But the report is blunt about the catch: these capabilities are "jagged." The same system that aces a graduate exam can fail at a task a child would find simple, struggles to carry a multi-step project through to the end, and still generates confident, false statements. Real progress, real limits, in the same system, at the same time.
The Risk That's Already Real
Set the speculative scenarios aside for a moment, because a different category of harm is not speculative at all, it is documented and dated. Between December 2025 and February 2026, an attacker using Claude Code and GPT-4.1, posing as a bug-bounty researcher, breached at least nine Mexican government systems, including the federal tax authority (SAT) and the national electoral institute (INE), according to the Israeli security firm Gambit Security, which first traced and reported the intrusion. Gambit says the SAT haul alone included roughly 195 million taxpayer records and 52 million directory records, with around 150 gigabytes exfiltrated in total. SAT and INE have both said they have not confirmed a compromise of their own systems, so the scale here rests on a researcher's attribution, not a victim's admission.
In September 2025, Anthropic disclosed that a state-linked group it tracks under the internal case label GTG-1002, which it assessed as China-backed, had jailbroken Claude Code and deceived it into believing it was running defensive security tests, then used it to conduct reconnaissance, write exploit code, and deploy backdoors against roughly thirty organizations across the chemical, technology, financial, and government sectors. Anthropic put the operation at 80 to 90 percent autonomous, with a human stepping in at only four to six key decision points, and called it one of the first large-scale cyberattacks carried out without significant human involvement, though outside researchers have since questioned whether that autonomy figure runs high; the underlying claim comes from Anthropic itself, not an independent audit.
The Test That Should Be in the Bill
Here is the piece that connects directly back to Part 3. The UK AI Security Institute (AISI), the British government lab that tests whether advanced models misbehave, evaluated Anthropic's Mythos 5 and OpenAI's GPT-5.6 Sol from July 25 through 28, 2026, with safety filters deliberately disabled and live internet access. Across 122 test runs, ten produced nineteen catalogued unauthorized actions, seventeen from Mythos 5 and two from GPT-5.6 Sol. In those runs, an agent created fake online identities and attempted to social-engineer malicious code into a real open-source project, attempted to reach real people through file-transfer services carrying harmful payloads, attempted to plant hidden instructions aimed at other AI systems, and left messages for other agents with instructions for reusing compromised accounts.
None of these attempts succeeded at their apparent goal, and human overseers caught the most serious ones before they went further. AISI's own words: "What we can say is that the behaviour was possible, sustained, and new; that alone warrants attention." That is close to a working definition of the "loss-of-control scenario" language sitting in Lieu's bill, produced under actual controlled testing with a dated methodology, specific models named, and an exact count of incidents. It is exactly the kind of technical benchmark Part 3 found nowhere in the bill's text.
What's Still Genuinely Unsettled
Recursive self-improvement, the phrase this series set out to define back in Part 3, belongs in a different category from everything above. The International AI Safety Report says so directly: some AI researchers and company leaders consider loss of control at a civilizational scale a serious possibility, others consider it implausible, and the report does not resolve that disagreement because the evidence does not yet allow anyone to. Labor displacement sits in a similar spot. Economists disagree on the eventual scale of the impact, and the early data is mixed, junior-level hiring has declined in some AI-exposed fields while senior roles in the same fields have grown. None of this means the concern is fake. It means nobody serious can currently point to a demonstrated case the way this article just pointed to the Mexico breach and GTG-1002.