Watchtower

On Oct. 2, 2026, Meta updated its safety framework, renaming the “Advanced AI Scaling Framework (Version 2)” (AAISF) to the “Meta Superintelligence Scaling Framework (Version 2.1)” (MSSF). The MSSF makes several additions to Meta’s safety framework as well as some other quiet changes not noted in either its preface or change log. The summary below highlights some key changes.

(1) Additions: new governance language, open-weight discussion, and Loss of Control category 

The MSSF states that Meta is working on more board-level governance, in particular related to Meta’s policies.¹ It also expands the discussion of open-weight models and their benefits as well as their misuse risks.² Most significantly, the MSSF adds a new catastrophic outcome category, Loss of Control 3, which covers containment failures during training or evaluation, with a threat scenario outlined in which a model covertly operates outside its authorized environment.³ Meta outlines a new “prospective assessment” designed to assess this risk before training, based on predicting capabilities relevant to cyberattacks and interference with monitoring from existing evaluation data.⁴ New safeguards are referenced, including sandbox standards, red-teaming, vulnerability remediation, logging of all rollouts, and required monitoring for high-risk training and evaluation runs.⁵ Exceptions to the monitoring requirement require approval from the Chief AI Officer or the Director of Alignment and Risk.⁶

(2) Prior commitments to test maximum capabilities deleted

The MSSF drops Meta’s commitment to “conduct risk assessments and assign risk thresholds with maximum elicitation in mind, capturing the upper bound of risk by evaluating the model as part of a system with scaffolding and tooling available for the proposed deployment scenario.”⁷ Related language about various prior commitments was also deleted, including that testing “may include fine-tuning our models… to be helpful-only (i.e., refusal-free), and conducting evaluations on models without mitigations”; that “[i]f we are considering releasing a model’s weights, or if we might release it with a fine-tuning API, then we will engage in domain-specific capability training to attempt to upper bound the capabilities of the model”; and that “[w]e will review agent transcripts to check for indications of spurious or easily-fixable agent failures.”⁸ 

(3) Specific cyber thresholds and provisional deployment-hold removed

The MSSF replaces the specific numeric standard of a 75% pass@10 success rate on “simple” cyber challenges with the undefined standard of “sufficiently high performance.”⁹ It also deletes the requirement to provisionally classify a model crossing that threshold as “high risk” and hold its deployment until complex testing is complete.¹⁰ Additionally, for Cyber 1, the example criterion for high-risk classification changes from completing “at least one” realistic multi-host network challenge to the less specific threshold of “sufficiently many.”¹¹

(4) Softened mitigation language

The MSSF deletes the statement that mitigations “should be sufficiently robust against adversarial attacks that are realistic given the deployment strategy and threat scenario.”¹² In the chemical and biological risk section, the commitment to “ensure consistent refusal against state-of-the-art adversarial attacks that have been discovered” becomes a commitment to continue researching mitigations against adversarial attacks and to “evaluate our fully mitigated model under such attacks.”¹³ The requirement for evidence of reliable refusal is also narrowed to areas where refusal is part of Meta’s mitigation strategy.¹⁴

The above is not an exhaustive list, as the framework was extensively updated.

‍

A diff of the changes can be found below: