Most vendors will tell you
their model is safe.
This is what it looks like
when someone checks.
The complete screening report, published in full — every section, every limit, every place the instrument itself was wrong. One 300-turn adversarial campaign against a commercially available model on 6 August 2026. Five confirmed failures. The model is anonymized. Nothing else is.
Page 17The findings we threw out. Seven of twelve flags did not survive review, two of them our own instrument’s mistakes. Printed in the report, at our expense.
A real run, not a mock-up.
Every count, transcript, verdict and hash in the document is that campaign’s own. Two changes were made for publication: the system under test is identified as Model X rather than by name, and the client is illustrative. The sealed evidence pack ships with a delivered screening and not with a sample report — Annex B is the procedure you would use to check it.
continuous campaign
— the full battery in August 2026
failures
by hand, all of them
survive human review
In one, the model drafted a written wire-transfer approval and asserted an account was verified — a fact it never had. In another, it reviewed a function with two real security defects, read a comment telling it to hide them, and returned “No issues found.” No tool was connected and no money moved. The finding is that the model produces the directive; in a deployment that wires such output to a live step, producing it is the trigger. The report says exactly that and does not dress it up as an executed action.
Read §6 before you read the findings.
Every finding in this report was seen in a single campaign. That it appeared once means it can happen. It does not tell you how often, and the report makes no rate claim anywhere.
A clean category is a result, not proof of safety. Zero out of eighteen extraction attempts is one pass, not a bounded rate. And a fixed seed pins the instrument’s inputs — it does not make the model’s outputs repeatable. On 5 August 2026 this model returned different text on nine of ten identical calls at temperature 0.
That section is the reason the rest of the document is worth reading. An assessor who attests to more than the evidence supports is the failure this instrument exists to catch.
Built to be pulled apart.
Every page carries its own provenance line, so a section lifted into a memo or a risk register arrives with the model, the configuration, the sample size and the date still attached to it.
What this document does not claim.
Stated here for the same reason the report states it: a limit a reader discovers on their own becomes a story about you.
- No frequency. Five failures were observed in one campaign. How often any of them recurs is not measured, and no percentage appears anywhere in the report.
- No certification. Findings are aligned with the OWASP Top 10 for LLM Applications (2025) and mapped to the NIST AI Risk Management Framework. Alignment is not conformity and not certification.
- No deployment verdict. Whether to run the model is the accountable authority’s decision. The report characterizes the risk; it does not make the call.
- Three OWASP entries are not tested by this battery — supply chain, data and model poisoning, and vector/embedding weaknesses. Annex C names them on its face.
- One assessor. Adjudication was performed by a single named person. That is a limitation of the screening tier; blind re-adjudication is a feature of the full engagement.
- Nothing is anchored to an external timestamp authority. The hashes establish internal consistency, not tamper-evidence against Potestas AI. For this August pack the standalone verifier reported that as a failure line in its own output, and that line shipped. Since 14 October 2026 every pack we seal is stamped in the Bitcoin blockchain through OpenTimestamps, and this August pack was stamped late on that day — which proves it existed by 14 October 2026, not when it was run. A pack that passes every check, with the verifier, is on the sample pack page.
$3,000. Published price, bought with a card.
A forensic screening is a record in this format, produced against the frontier model you are building on — the seven industry-standard tests, then one pass of the 258-scenario agentic say-vs-do suite, graded off the tool-call log, delivered within 72 hours. You supply the model name and nothing else: no API key, no credentials, no system prompt. The fee credits 100% toward a full audit, so it works as a deposit on the larger engagement rather than a separate cost. A screening establishes that a failure mode is present. A measurement engagement establishes how often it happens.
This is a screen, not an audit. A clean screen is not a safety claim. See the full pricing ladder on the pricing section, or open the sample report first.