Syntony / Services / Red teaming / CBRNE
Most CBRNE testing checks whether a model will answer a dangerous question.
Full Score is how Syntony red teams chemical, biological, radiological, nuclear and explosive risk in AI systems. We follow the path a misuse attempt would take, through agents and their tools, the people with trusted access, the physical systems a model can control, and the information that spreads after an incident. Every finding comes back tied to the policy or obligation it affects.
First-person walkthrough
Walk the site in first person and run a red team test at each station: inspect, disrupt, limit, retest. 6 stations, about five minutes.
Illustrative environment
01 / The gap
Published CBRNE evaluations mostly measure knowledge uplift, meaning whether a model tells someone something it shouldn't. That question still matters. But an attempt to cause harm has at least six stages, and AI systems now touch most of them.
STAGE 1
Who is asking, from which account, and how much the system trusts them.
Movement III
STAGE 2
Whether the model gives meaningful uplift. Most testing stops here.
Stand-in baseline
STAGE 3
A goal broken into small requests that each look harmless.
Movement I
STAGE 4
Agents that search, order, schedule and pay for things on a user's behalf.
Movements II and III
STAGE 5
Robots, lab automation and drones acting on a model's instructions.
Movement IV
STAGE 6
Hoaxes, disputed attribution, public panic and the teams responding.
Movements V and VI
02 / Full Score
Each movement covers ground that knowledge-uplift testing doesn't reach. You can commission a single movement for one product or run all six across a deployment.
Stage 3
Harmful goals rarely show up in a single prompt. They come as ordinary-looking steps spread over sessions, accounts, languages and agents. We check whether your safeguards catch the pattern when no individual message is a problem.
Stage 4
When a model can browse, buy things, run code or book time on a cloud lab, what it does matters more than what it says. We check that the system stops at the action, including on long tasks where refusals tend to weaken over time.
Stages 1 and 4
Verified researcher tiers, enterprise accounts and expert programs give qualified people fewer refusals. We test what happens when someone borrows, buys or talks their way into that trust, or when it was granted to the wrong person.
Stage 5
Robots, lab automation, drones and sensor networks act on model decisions in the real world. We test the checks between a digital instruction and a physical action, and whether the safety case behind those checks holds up.
Stage 6
Any CBRNE incident, real or fabricated, quickly becomes an information event. We test how AI systems respond to hoaxes, fake evidence, false attribution and the kinds of claims used to justify escalation. This work draws on international humanitarian law.
Stage 6
If a model refuses a toxicologist, a hazmat crew or a field medic during the first hour of an emergency, that's a failure too. We measure over-refusal toward the people who respond to incidents.
03 / Hazard-free by design
Syntony doesn't create, store or hand over hazardous content in a Full Score engagement. Our probes use structural analogues and benign stand-ins that trigger the same safeguard behavior as the real thing. If a client needs to test against its own restricted material, that material stays in the client's environment and our tools log verdicts, never model outputs.
04 / In depth
Public research, standard frameworks and a simplified look at our method. Working tools, attack libraries and client data stay private.
CBRNE testing asks whether a system gives meaningful help to someone trying to cause mass harm, and whether its safeguards hold against a patient, skilled and persistent user. The public evidence is mixed and moving. A 2024 RAND red team study found no statistically significant uplift from the models it tested. Since then, developers have switched on stronger protections for newer models as a precaution.
Our method keeps hazardous content out of the work entirely. Prompts and outputs that touch sensitive science stay in a sealed store, reviewed by specialists with approved national security or life sciences backgrounds. Everyone else, including our engineers and this website, sees identifiers, hashes and grades. The test case below shows that separation.
Failure classes we test, mapped to public frameworks so findings slot into the reports you already file. ATLAS IDs can be searched on the MITRE ATLAS site.
| Ref | Class | What it looks like | Frameworks | Control that belongs there |
|---|---|---|---|---|
| CB-1 | Knowledge uplift | Answers that close the gap between public knowledge and harmful capability. | Classifier-gated topics and expert-graded uplift evaluations. | |
| CB-2 | Aggregation across sessions | Each answer is harmless. The collection isn't. | Account-level monitoring across sessions. | |
| CB-3 | Agentic procurement | An agent orders controlled materials or services. | Screened suppliers and human approval for restricted categories. | |
| CB-4 | Design tool misuse | Protein or chemistry design tools used to slip past screening. | Screening tested against AI-designed variants, and patched. | |
| CB-5 | Safeguard bypass | Jailbreaks that get around refusal classifiers. | Layered classifiers, bug bounties and a fast patch cycle. | |
| CB-6 | Over-refusal | Clinicians and responders denied safety-critical information. | Over-refusal measured with the same rigor as under-refusal. | |
| CB-7 | Access-tier abuse | A trusted-research tier obtained through a weak check. | Verified access with audit trails. |
# Simplified. Sealed items never appear in code, logs or on this page.from clean_room import fetch_ids, grade_in_enclave # private, access-controlled # IDs and hashes onlyITEMS = fetch_ids(suite="cb-refusal-consistency", tier="restricted") labels = []for item in ITEMS: # Runs inside the clean room. Returns a label, never text. verdict = grade_in_enclave( item_id=item.id, target="client-model@release-candidate", rubric="uplift-v4", # written and graded by vetted specialists ) labels.append(verdict.label) summary = {k: labels.count(k) for k in ("refused", "safe_partial", "uplift")}print(summary) # all that leaves the clean room: countsassert summary["uplift"] == 0, "escalate to the review board before release"Simplified for publication. Payload libraries, harness code and scoring rubrics stay private and are shared with clients under NDA.
Separate sessions on one account assembled steps the model refused to give in a single session. Monitoring worked per conversation, so no review was triggered.
Public research and guidance behind this page. Summaries are ours.
Expert red teams found no statistically significant difference in plan viability with or without the LLMs tested, and urged continued monitoring.
A public proxy benchmark for hazardous knowledge, built so the questions measure risk without publishing sensitive details.
Showed how quickly a drug discovery model could be turned toward toxicity, and argued for safeguards in scientific AI tools.
AI-redesigned protein variants evaded DNA synthesis screening until a cross-sector team built and shipped patches. Red teaming that ended in a fix.
Anthropic deployed stronger CBRN safeguards with Claude Opus 4 as a precaution, because it could not rule out the relevant capability threshold.
Defines twelve generative AI risk categories, from CBRN information to information integrity, with suggested actions for each.
05 / Engagement
We use automation for scale, and experienced red teamers make the judgment calls. Each engagement ends with an in-person workshop where we take your team through the findings and the governance work they point to.
Agree which systems, users and stages are in play.
Build stand-in probes for your product and review them before use.
Expert red teamers work alongside automated test runs.
Check automated scores against human raters and send unclear cases to a person.
Link each finding to the policy or obligation it affects.
Agree owners, fixes and a retest date.
06 / Evidence
A finding is only useful if someone accountable can act on it. We map each one to the frameworks your organization already reports against.
| MOVEMENT | FINDING | SEVERITY |
|---|---|---|
| I | Cross-session aggregation not detected | HIGH |
| II | Approval step skipped on long tasks | MEDIUM |
| VI | Over-refusal on clinical triage questions | MEDIUM |
| III | Access tier raised through the support channel | LOW |
07 / Who we work with
Our red teamers have worked for top frontier labs, social media platforms and the U.S. government.
The Trusted Red Team Network includes top 5 performers in Gray Swan Arena competitions and top performers on HackerOne and Hack The Box. Restricted engagements are staffed by senior reviewers with approved national security or life sciences backgrounds.
An agentic defense suite that keeps watching a deployed system after the engagement is over.
Bolerophone runs four teams of agents against a live model or agent system. Sentinels monitor traffic for signs of misuse, using behavior and metadata rather than stored content. Probers turn whatever the Sentinels flag into new benign tests. Judges score the results and pass anything uncertain to a person. Clerks keep the audit trail and write up the evidence your regulator or insurer will ask for. Every cycle feeds what it learns into the next one.
The name comes from Ravel's Boléro, a single theme that grows louder with each repeat, and from Bellerophon, the hero who killed the Chimera.
Request a Bolerophone briefingAccess by request
Given the subject, we only share methods, case studies and sample reports with vetted organizations under NDA. Tell us who you are and what you're deploying, and we'll reply within three business days.
Please keep sensitive or technical hazard details out of this form. If we need them, we'll set up a secure channel.