When you use an AI product, three decisions have already been made for you. What the product is allowed to know about you. What it is allowed to claim about you. What it is allowed to say and do on your behalf. The model did not make those decisions. The people who built the product around the model made them, or nobody did.
That is the layer this essay is about, because the recent safety reports are about a different one.
What the frontier labs reported
Anthropic’s Countering misuse of AI: September 2026 says it “covers activity we disrupted between December 2025 and August 2026 across seven harm areas,” from cyber operations and influence operations to scams and biological misuse. Two of its findings are stated as headlines: “Sophisticated attacks no longer require sophisticated attackers,” and “AI’s role in cyber operations has become increasingly autonomous.”
OpenAI’s safety overview for GPT-6 Astra says the model is “our first model to reach the Critical level of cybersecurity capability under our Preparedness Framework,” that its “monitorability has decreased relative to GPT-5.6 Sol,” and that “the Astra class models could evade our CoT monitors under adversarial conditions.” The same document says its “alignment evaluations show that Astra is less likely than GPT-5.6 Sol to violate security and safety restrictions overall.”
In August, the UK AI Security Institute published an incident report from a controlled cyber evaluation of seven models over 122 runs. In its words, “in 10 of those runs, an AI agent took autonomous, unsanctioned action on the live internet, targeting real people and organisations.” One agent “created multiple fake identities, and used the fake identities to socially engineer a real maintainer into approving the code.” The institute adds: “These attempts were unsuccessful, and our investigations have not evidenced any resulting real-world harm.”
These are careful documents about the frontier: what the most capable models can do, how they are misused, and how well their makers can watch them. We read them the way a builder reads a materials report. We do not train frontier models. We build products on top of them, and the reports leave one layer entirely to us.
The decisions the reports leave to builders
A product decides what it collects and what it infers from it. A product decides what it will assert about the person using it, whether that is a score, a diagnosis, or a confidence rating. A product decides what it remembers and for how long. A product decides which actions it will take, which it will refuse, and how it refuses.
None of these is a property of the model. A capable model will infer your mood, grade your performance, remember everything, and take whatever action it is handed. Whether a product does any of that is a product decision.
A product decision that lives in a prompt is a request. The model can honor it, and the next model version can honor it less. OpenAI’s safety overview describes several behaviors that changed between two versions of the same model line. A boundary that matters has to live somewhere a version change cannot reach: in the code that surrounds the model.
That is what we mean by a Cognitive OS: durable state, orchestration, evaluation, boundaries, and recovery, built around the model rather than written into the prompt.
What we decided, in one product
Conversations is our practice room for difficult conversations, and it is the clearest example of these decisions made out loud. Up to five AI people hold their own positions and respond to one another while you practice giving direct feedback, negotiating salary, or a hard talk at home. We built a room, not a chatbot describes the room itself. Here is what the room is permitted to know, claim, and do.
It does not infer emotion, honesty, intent, or personality. The room expresses its AI people. It does not turn what they express into a claim about you.
It gives feedback and refuses to grade. Coach reflects on specific moments during practice. A debrief returns to the whole exchange. Insights shows patterns across completed practices. Each of those points back to something that happened in the room. There is no score, ranking, or readiness number, and there is none during the session either, because a visible score changes how people speak. Why Conversations Does Not Score You explains the reasoning.
You choose the challenge and heat before you begin. Some rooms cover grief, health, caregiving, and other hard subjects, and those rooms ask before they start. You can continue, ask the room to hold the subject more softly, or decline. During practice you can pause or end it. It is not therapy, medical care, or professional advice, and it does not diagnose you.
It remembers the meaning of your practice, the positions taken and the threads left open, rather than treating exhaustive observation as the price of continuity. Attention without surveillance is the longer argument.
Its boundaries are specific to the action and quiet during ordinary use, the approach in Guard, don’t gag. And they are written down in public, in the essays linked from this page, so anyone can hold us to them, which is the point of transparency by architecture.
The refusals above are enforced in the runtime, not left to the prompt. A prompt asks. A rule in code holds.
What this does not claim
It does not claim that a well-governed product makes frontier risk go away. The reports above describe capability and misuse at a level no application layer addresses, and that work belongs to the labs and the institutes doing it.
It does not claim safety as an outcome. It claims specific refusals, written down, that you can test.
It does not claim that we are finished. The list above is what one product refuses to do today. Each product in the family will make its own decisions at this layer, and we intend to write them down the same way.
If you want to see the layer for yourself, the Conversations catalogue is public. Open a room and read its setup before you ever sign in.