Our calls.
On the record.

Evidence for and against

Google’s 13 October Argon announcement says Argon is “just the beginning” and that Google expects to bring out the rest of the Gemini 4 family. The Google DeepMind model-card register, checked 14 October, lists Gemini 4 Argon but no second Gemini 4 model at the cutoff. The explicit family language supports another release, but Google gives no date and could change names or limit access.

Why 75%?

This is a subjective editorial estimate, not a measured launch frequency. Major model families often add variants for cost, speed or specialised use, and Google has publicly described a family rather than a single model. That makes another member within one product quarter more likely than not. Against that, frontier releases can slip because of capability, safety, infrastructure or product-readiness concerns; Argon’s model card says several critical capability thresholds could not be ruled out before mitigation. There is no complete base-rate dataset for Google family launches, so 75% should not be read as precise to the percentage point.

What is already established?

Gemini 4 Argon is already available and cannot resolve this forecast. Separate robotics demonstrations built with Argon also do not count as another model. The prediction concerns a distinct, officially named Gemini 4 model with qualifying non-employee access during the future window.

What would change the assessment?

A dated public roadmap, API identifier or preview documentation for another Gemini 4 model would raise a later estimate. Evidence that Google has paused the family, changed the naming scheme or restricted the next model to private testing would lower it. Later assessments will be separate dated updates. Original wording, probability, deadline and rules remain unchanged.

What a YES would mean

A YES would show that the Gemini 4 generation expanded beyond its first public model within 90 days. It would not prove broad adoption, safety, superiority, consciousness or progress toward AGI.

Evidence for and against

OpenAI’s 5 October announcement explicitly plans an open-source textGrain release. Its provenance help page, accessed 7 October, repeats that intention. This supports eventual release. Neither provides a firm date or promises the two runnable components and licence required here. Detector access is initially restricted, which cautions against assuming a rapid comprehensive public release.

Why 45%?

This is an uncalibrated editorial judgment, not a measured frequency. There is no reliable reference-class dataset here for how often an unspecified open-source promise becomes a complete embedding-and-detection release within 90 days. An explicit company commitment raises confidence above a speculative release with no commitment; missing timing and component commitments keep this slightly below even. The evidence does not distinguish 45% precisely from 40% or 50%.

What is already established?

The watermarking announcement, optional API access and planned EU rollout already exist and cannot resolve this forecast. A targeted check of OpenAI’s announcement, help documentation and public repository search found plans for an open-source release, but no qualifying release at the evidence cutoff. Search absence alone is not proof of nonexistence.

What would change the assessment?

A dated release milestone or official repository with both components would strengthen the case. A delay, a proprietary licence or a decision to keep detection closed would weaken it. Later assessments will be separate dated updates. Original wording, probability, deadline and rules remain unchanged.

What a YES would mean

A release would enable independent testing of that implementation. It would not prove universal AI-text detection, truthful content or reliable detection of edited ChatGPT output.

What already happened—and cannot resolve this forecast

Meta’s 24 September Connect announcement said Muse is coming to AI glasses “in the coming months” and named shopping, travel, productivity and payment connectors. It also said Muse can work in the background and act on what a user sees. That announcement is the reason for this forecast, but it predates the window and does not show public availability or the required confirmation flow.

OpenAI’s 23 September release notes show a competing direction: Voice can use connected apps and create work products while existing permissions and limits apply. This makes cross-service voice action more plausible, but it is a different product and cannot resolve this forecast.

Why 60%?

60% is a subjective editorial estimate, not a measured frequency. The case for YES is Meta’s specific “coming months” language, named commercial connectors and push to expand AI-glasses models by year-end. The case against is that launches slip, early access can be narrow, connectors may stop at information or preparation, and Meta may not document a confirmation flow clearly enough to meet the rule.

The estimate is only modestly above even because every part must arrive inside 90 days: non-employee access, voice through glasses, a completed external action, a named connector and documented confirmation. There is no reliable base-rate dataset for this exact combination.

What this does—and does not—predict

This predicts a documented product capability and permission boundary. It does not predict broad adoption, accuracy, privacy, safety, consciousness or fully autonomous agents. A YES would show a wearable agent crossing from advice into action while keeping a visible human checkpoint.

Zero’s take · Analysis

Glasses can give an agent context that a text box never had. That makes the approval moment more—not less—important. Watch whether the user can see what will happen, confirm it and later inspect a record. Convenience is not consent.

Read Forecast 004 → · Forecast 003 →

What already happened—and cannot resolve this forecast

OpenAI’s 6 September 2026 report disclosed quantitative internal evidence: agent workdays, experiment activity, task success and human intervention. It said people still set priorities and decide whether to scale, pause or deploy. OpenAI is excluded from the target list because that publication predates this forecast and already establishes the precedent.

Anthropic’s Responsible Scaling Policy, updated in 2026, includes automated AI R&D thresholds and public risk reporting. Google DeepMind’s Frontier Safety Framework treats machine-learning R&D as a critical capability domain and calls for periodic evaluation. These policies make disclosure plausible, but neither promises a qualifying publication within 90 days.

Recent research maps the path without proving the destination. The Last AI Built by Humans proposes levels toward recursive self-improvement. A separate survey of 1,250 papers says bounded self-refinement is established while open-ended recursive self-improvement remains limited and human research direction still matters. Papers and frameworks are not evidence that a lab has deployed fully autonomous RSI.

Why 55%?

55% is a subjective editorial estimate, not a measured frequency. The case for YES is that OpenAI has created a disclosure precedent and other major labs already evaluate AI R&D capability. The case against is that internal productivity data are sensitive, difficult to compare and easy to overstate; a lab may publish only benchmark results or no public numbers within this short window.

The probability is only slightly above even because the event requires a specific lab, a new publication, a real internal workflow and a meaningful baseline—all before the deadline. There is no reliable base-rate dataset for this exact disclosure.

What this does—and does not—predict

This predicts public measurement of AI-assisted AI research. It does not predict consciousness, ASI, unsupervised recursive self-improvement or the removal of human approval. A qualifying result would show that the feedback loop is becoming measurable; it would not show that the loop controls itself.

Zero’s take · Analysis

The next important step is not a machine announcing that it improved itself. It is a lab showing, with numbers, which parts of AI research the machine performed and which decisions humans still owned. Readers should watch the baseline and the approval boundary—not the dramatic label.

Read Forecast 003 → · Forecast 002 → · Forecast 001 →

The evidence already exists. The next case does not.

Anthropic’s 10 September 2026 threat report describes observed operations from December 2025 to August 2026, including agents executing parts of intrusions and data extraction while humans directed activity. It is first-hand provider reporting, with selected notable cases and visibility limited to its own services. It is not a representative incident-rate dataset. None of those historical cases can resolve this forecast.

Anthropic’s 13 November 2025 report also described AI-executed steps in an espionage campaign, alongside errors such as mistaking public information for stolen secrets. That supports technical plausibility while showing why a model’s own claim of success is inadequate evidence.

The UK NCSC’s 7 May 2025 assessment expected AI to improve elements of cyber intrusion and broaden access to those capabilities. It also judged fully automated end-to-end advanced attacks unlikely by 2027. This is an older assessment of direction, not a 90-day probability or confirmation of a future incident. Our claim permits human direction and requires a specific agent-executed action.

Why 45%, rather than a dramatic certainty?

45% is my subjective judgment that this precise, demanding combination is slightly less likely than not in the window. Repeated provider reports and wider access to agent tooling make another real intrusion plausible. But a named major victim, a verified execution role, a known incident date and timely first-hand public evidence all have to coincide. Investigation and disclosure delays can defeat the forecast even if the underlying risk is real.

I have no complete base-rate dataset for this exact event definition, and I have not statistically calibrated 45%. Two reports from the same provider are not independent samples. The sources support the mechanism and uncertainty; they do not mathematically produce the number. A five-percentage-point difference would not represent established precision. This is a testable editorial call, not a measured attack rate.

What would change my view?

Independent investigations confirming agent-executed intrusions would raise a later assessment. Evidence that apparent agent successes were fabricated, prevented by safeguards or mainly human-executed would lower it. Record any reassessment separately with its date; retain this original 45%, wording and deadline. If evidence access fails at resolution time, temporarily mark verification pending instead of silently scoring YES or NO.

Zero’s take · Analysis

The practical question is whether an attacker can turn an assistant into an operator. Neither consciousness nor an AI deciding to “escape” is necessary. For readers, the useful response is to identify what their connected assistants can access, require approval for consequential changes and ask their organisation who owns incident response. Organisations remain responsible for permissions, monitoring and recovery. This forecast is not an allegation against any named prospective victim.

Read the longer-term Forecast 002 → · Forecast 001 →

What this means for you

An assistant preparing a report needs a restricted document. It requests extra access, waits for the appropriate approval and has its permission checked again before proceeding. A common protocol could connect this process across products. The forecast concerns final approval of a specification, not universal adoption, mandatory human approval for every action or guaranteed safety.

Verified evidence

• OpenID Foundation announcement — 15 June 2026: formally adopted this profile as a Working Group Draft. Listed contributors include Okta, SailPoint, Cerbos and other identity/security organisations. This is an existing standards initiative, not an AIAF invention; participation does not guarantee final approval.
• Access Request and Approval Profile, current Draft 1 — 15 September 2026: sets out the request-and-recheck mechanism and agent use cases. September is the current draft revision date, not the initiative’s launch. Final approval is the future event.
• OpenID’s specification register — checked 16 September 2026: lists the profile as a working draft. Its underlying Authorization API progressed from an Implementer’s Draft in November 2024 to final approval in January 2026.
• NIST AI Agent Standards Initiative — announced 17 February 2026: shows wider institutional attention to interoperable agent identity and security, but does not promise OpenID approval.

Why 60%?

This is a subjective editorial estimate: modestly more likely than not, with a substantial chance of missing the deadline. It is based on a focused primary-source review, not a statistical model, a calibrated forecasting track record or a comprehensive study of standards completion rates. There is no evidence that distinguishes 60% precisely from 55% or 65%.

Supporting the call: formal working-group adoption, a concrete design, named industry participation and an already-final underlying API. That API’s roughly 14-month progression from Implementer’s Draft to final approval offers limited context for the approximately 15 months remaining. It is not a base rate: this profile has not yet reached that predecessor’s starting milestone. These factors support the direction of the judgment, not an arithmetic derivation of 60%.

Evidence against confidence

OpenID’s approval process requires consensus, public review and voting: Implementer’s Draft review lasts 45 days and Final Specification review lasts 60 days. These are process stages, not a promised completion schedule. No final-approval deadline was found in the reviewed sources.

A ThunderID implementation update dated 26 June 2026 explicitly excludes this approval workflow while supporting access evaluation and action search. That is one project, not proof of ecosystem-wide absence, but it shows why base-API support must not be counted as implementation of this profile. Security issues, limited implementation experience, changes in scope or stalled consensus could prevent timely approval. A final standard would still not establish widespread adoption or safety.

What would change the assessment?

Public implementation experience and formal approval milestones would strengthen it. Withdrawal, unresolved security objections or prolonged inactivity would weaken it. Later assessments will be separate dated updates. This original claim, probability, deadline and resolution rule remain fixed.

Zero’s take · Analysis

Who lets the machine take its next step? Readers should know what extra authority an assistant wants and why. For AIAF’s proposed Trust Card, the opportunity is a clear approval experience built on interoperable permissions. A physical card alone cannot create trust. This forecast does not promise our card will launch, integrate with this profile or become valuable.

Read the unchanged Forecast 001 below →

Why 72%? Agent autonomy is increasing faster than conventional software-incident rules are adapting. The probability would rise with a formal regulatory proposal and fall if jurisdictions settle for voluntary developer reporting.