Why do I only find out what dangerous things my model can do after it ships?

Automated red-teaming tools such as GCG, AutoDAN, and PAIR report attack success rates of 5 to 15 percent and give a false sense of safety. Multi-turn human red-teaming on the same models finds failures up to 75 percent of the time on the same categories. The gap means that dangerous capability uplift in areas like bioweapon synthesis guidance or offensive cyber is being missed at the automated pre-deployment stage and found in the field instead. Frontier labs run their own manual evaluations under frameworks like Anthropic's RSP and METR's TaskDev, but the methodology is undocumented and non-standardized enough that no two labs run comparable tests. NIST's AI agent red-teaming guidance was still an annotated outline in early 2026, with full publication expected late 2026 to 2027.