AI Safety in 2027: What Would Prove Real Progress

AI safety progress will not arrive as a date. It arrives as a set of capabilities, each one shown to hold by people who had no stake in the result. This post keeps the running record of what has been shown, what has not, and what each open claim would take to settle. It is the third pillar in RedHub's interpretability series. The first, AI's black box may be opening, explains the research. The second, AI oversight without reviewing everything, explains how to supervise AI without reading every output. This one explains what would count as progress, and it is built to be updated.

Why 2027 is the wrong unit

Prediction pieces about AI safety tend to pick a year. The year is a placeholder for a feeling. What matters is whether a short list of specific things has been demonstrated, and each of them could be demonstrated in 2027, or in 2029, or never. A date tells you when to check. It tells you nothing about what you will find when you do.

So this post is organized around claims instead of a calendar. Each claim names the evidence that would settle it. The status table records where each one stands and the day we last looked.

What happened in October 2026

Three things, kept separate, because the public conversation blended them into one headline.

The essay. On October 15, 2026, Goodfire published Nick Cammarata's Neural Networks Are Already Clean (opens in a new tab), which its own page labels "an informal research essay and working hypothesis". It argues that the cause of polysemanticity in early model organisms "wasn't superposition, but several ordinary, mostly fixable issues". Its headline number is a preliminary one: "In preliminary audits of Qwen3-32B, we estimate that roughly 90% of neuron poles have one main job", with the essay putting another 7% or so at two related jobs and only 2 to 4% not yet understood. The essay flags that the share moves with threshold choices, and it defers the method to a technical companion paper. Our full reading is in what the Already Clean essay says.

The rebuttal. Within days, Liv Gorton published her own tests (opens in a new tab) of the essay's flagship example, the neuron the essay reads as a V-shape detector. On synthetic V stimuli, she found, the neuron "only achieves about 25% of its max", and she warned that "Even random directions in mixed4e have top images that look interpretable." Her broader objection is definitional: "all the arguments in the essay only work for the highly non-standard definition of superposition in the essay." The two accounts sit side by side in the cat-and-car neuron: solved, or still open.

The probes. Separately, on September 17, 2026, Goodfire published a paper on catching reward hacking (opens in a new tab) with activation probes. The probes "catch instances of reward hacking that LLM chain-of-thought monitors miss". The comparison is mixed by model: "our probes catch 3.1% more hacks in Kimi K3 but 7.9% fewer hacks in GLM 5.2 on DeepSWE at a matched false positive rate." That is a complementary tool, not a winner. The business version of that story is in reward hacking: when AI passes the test, not the task.

Each is a reason for optimism and for patience at once. A field where one researcher publishes a hypothesis and another publishes contrary experiments within a week is a field that can be tested.

Six claims that would prove progress

These are the claims the research would need to establish before "the black box may be opening" becomes "the black box is open enough to rely on". Each has a finish line you could point at.

1. The companion paper. The essay says "A technical companion paper will offer a more detailed account of language model neuron experiments", and that larger-model results, "like Kimi K3", are what "the companion paper will cover in more detail". Finish line: the paper is public, with thresholds and methods a third party can apply without asking the authors.
2. Independent replication. A group with no connection to Goodfire runs the same audit on Qwen3-32B, or a comparable open model, and reports a comparable share of single-job neuron poles, or reports why it could not. Finish line: that report exists, from outside the lab.
3. Prediction of unseen behavior. A description that only summarizes the examples it was written from is a label. One that predicts what the neuron does on inputs nobody chose is a finding. The essay reports its own check on 200 random neurons: an agent read only each explanation and wrote new examples and near misses before anything was measured. For the 183 whose explanations describe their positive side, the new examples fired their neurons strongly 76% of the time and the near misses 11%. Finish line: the same test, run by someone else, on neurons they picked.
4. Durable interventions. Anthropic showed a one-off causal intervention in its circuit-tracing work (opens in a new tab): "By intervening in the model and activating the "known answer" features (or inhibiting the "unknown name" or "can't answer" features), we're able to cause the model to hallucinate (quite consistently!) that Michael Batkin plays chess". Causing a behavior once is the easy direction. Finish line: a representation-level fix that still holds after the model is updated or retrained, with the retest published.
5. Monitoring under distribution shift. Goodfire reports that its probes "generalize well beyond the data they were trained on". Finish line: a probe deployed against live traffic, measured against behavior that did not exist when it was trained, with the miss rate published months later.
6. Cost. The paper reports one figure: "On Kimi K3, a probe + LLM combined setup reduces the cost of LLM monitoring by 90% with only a ~1% drop in precision." One model, one setup. Finish line: the same cost curve, on a second model, from a second team.

Status as of 2026-10-29

Every row was checked against the primary page linked above. Where a row says "none found", that is a statement about our search on the date given, not a statement that nothing exists.

Last checked: 2026-10-29. This table is edited in place when a claim moves, and each edit is dated in this line. The update triggers are the companion paper's release, any independent replication, a Gorton follow-up, and any lab reporting probe monitoring in production.

What researchers outside Goodfire are saying

The outside reaction is the best calibration available, because the people reacting have the access a business does not.

Chris Potts of Stanford, speaking to MIT Technology Review (opens in a new tab), was blunt: "As far as I can tell, nothing about this blog post makes the problems any easier." Jacob Hilton of the Alignment Research Center, in the same piece, set the bar above neurons: "For a full understanding, we need to go beyond neurons, and explain how they connect together to form circuits."

Neel Nanda, who leads the mechanistic interpretability team at Google DeepMind, said in a response to the post, quoted by BankInfoSecurity (opens in a new tab), that he did not see the work as a significant update to the big picture of interpretability, while allowing that the approach might work for practical purposes and has some advantages over the standard alternatives. Andrew Yoon of CivAI, in the same article, called the findings informal and not yet peer reviewed, and said they would take time for the research community to vet.

Read together: interesting, possibly useful in practice, not yet a change to the big picture, not yet vetted. That is a fair summary of where a careful reader should sit on November 1, 2026.

Three scenarios for 2027

These are scenarios, not forecasts. We have no basis for a probability on any of them, and we are not going to invent one.

Scenario one: the paper lands and holds. The companion paper is published, an outside group reproduces the audit, and the single-job share holds within a reasonable band. Neuron-level auditing becomes a routine lab practice. Model vendors start publishing audit summaries the way they publish system cards today. Research interfaces for this already exist at Transluce, Anthropic and Goodfire, so the tooling is not the bottleneck. What does not change: a business renting a model over an API still cannot run the audit itself.

Scenario two: it holds for some models and not others. The result depends on architecture, training recipe, or the threshold choices the essay itself flags. Interpretability tooling becomes model-specific, and "which model" becomes a safety question as much as a capability question. This is the scenario where the vendor questions in the AI inspectability checklist earn their keep.

Scenario three: the illusions win. Gorton's warning that random directions look interpretable turns out to describe much of the 90%. The field returns to circuits, the way Hilton describes, and neuron-level descriptions are filed as a useful but unreliable first pass. Progress continues, but on a slower path.

In all three scenarios the thing a business can do this year is the same, and that is the part most coverage skips.

The inside view and the outside view

There are two ways to trust an AI decision. You can read it from the inside, which is interpretability: activations, probes, descriptions, interventions. Or you can gate it from the outside: a verdict on the decision, a record that someone not in the room could reconstruct, and a stop authority that has been shown to work. The inside view is improving fast, and every result above needs access to the model's internals. The outside view is available to every business today, on any model, including one you rent.

You need both. Only one of them is yours this year. The RedHub standard is explicit about which side its instruments sit on: a result is based solely on the inputs you supply, and RedHub does not independently verify the underlying facts. Nothing RedHub sells reads a model's internals, and this series will not pretend otherwise.

What you can run this year

None of the checks below waits on a row in the status table.

Free first

Decision Fit asks eight questions about one task and returns the level that should make the call: deterministic code, a decision model, a fast general model, a frontier reasoning model, or a person. Its two gates are worsen-only. They can move a task toward human judgment and never away from it. Nothing leaves your browser.

Two free self-assessments you answer yourself sit beside it. AI Compliance Assurance (opens in a new tab) asks whether the evidence behind a one-time check would still be there next quarter, which is the "does the fix survive" question at the level of an organization. AI Governance Gap Assessment (opens in a new tab) asks whether you have an inventory of the AI in use, a policy people follow, and a named human on each decision.

Pairs well with

Three instruments carry the outside view into a decision path that already exists.

• Deterministic Replay Warden grades whether a decision your systems already made could be produced again. It returns REPLAYABLE, RECONSTRUCTABLE or UNREPLAYABLE per path, with no partial credit. Its own standard says a model is an unpinnable source, so a path with a model in it reads RECONSTRUCTABLE at best. That is the honest ceiling for any AI-in-the-loop decision, and most paths should not be replayable at all.
• Audit Evidence Pack Assay grades whether somebody who was not there could assemble the account of an automated decision. It returns ANSWERABLE, NEEDS A WITNESS or NO RECORD, and it says nothing about whether the decision was right.
• Agentic Executive Harness reads the verdicts of your executive systems into one company status and reports the worst, not the average. It is orchestration only. It never runs the systems, moves money, or takes an action.

Two live posts set the sequence: the AI governance roadmap for the order of work, and why evidence goes stale for the reason a one-time check is not a standing one.

A practical standard for optimism

Optimism is warranted. Some of the darkness in the black box may have come from the tools used to look into it, and the debate is part of the good news. A reader who wants to be right in 2027, instead of early, holds three positions at once.

Do not demand that AI be mysterious. Do not assume a clear explanation makes it safe. Demand evidence that the explanation predicts behavior, and that the correction survives testing.

Until the status table above moves, trust the outside view you can run today, and read the inside view as what it is: promising, contested, and not yet yours.