Meta publishes its Frontier AI Framework, scoping catastrophic risk to cyber, chemical, and biological threats

What the framework actually scopes

Meta's Frontier AI Framework, published February 3, 2025, is explicit about what it covers and, by implication, what it does not. The document says the framework "focuses on the most critical risks in the areas of cybersecurity threats and risks from chemical and biological weapons." That is the entire catastrophic-risk surface Meta commits to evaluating here.

This is a deliberately narrow scope. Absent from the named categories are the harms that dominate day-to-day discussion of frontier models — persuasion and disinformation, autonomous replication, deceptive behavior, or economic displacement. By anchoring the framework to cyber, chemical, and biological threats, Meta is defining catastrophic in terms of national-security-scale weaponization rather than diffuse societal harm. The document ties the whole effort to a commitment made at last year's global AI Seoul Summit.

The outcomes-led process, in three steps

The framework describes a chain rather than a checklist. It starts by identifying catastrophic outcomes to prevent, then asks a specific question: whether those outcomes are "enabled by technological advances" — that is, whether a given model actually moves the needle on a threat that already exists in the world. If it does, the framework moves to mitigation.

The second step is threat modeling — anticipating "how different actors might seek to misuse frontier AI to produce those catastrophic outcomes," working with external experts "as necessary." The third is risk thresholds, which Meta defines "based on the extent to which our models facilitate the threat scenarios," with processes to keep risk within acceptable levels by applying mitigations.

The pivot point across all three steps is marginal contribution: not what a model can describe in the abstract, but how much easier it makes a specific bad outcome that a determined actor could otherwise pursue. That framing matters because it sets a high bar for holding a model back — the capability has to meaningfully enable the harm, not merely reference it.

Open source cast as a risk tool, not just an ideology

The most distinctive claim in the document is that open release improves risk evaluation rather than degrading it. Meta writes that its open source approach "enables us to learn from the broader community's independent assessments of our models' capabilities," and argues this "improves the efficacy and trustworthiness of our models and contributes to better risk evaluation in the field."

Open sourcing AI is not optional; it is essential for cementing America's position as a leader in technological innovation, economic growth and national security.Montana Labs

That sentence does two things at once. It frames openness as a competitive and geopolitical necessity, and it positions external scrutiny as part of Meta's own safety pipeline. The tension is unavoidable: the same release strategy that surfaces community assessments also removes Meta's ability to claw a model back once weights are public. The framework's risk thresholds and mitigations therefore have to do their work before release, not after.

What this means for teams building on Meta's models

For applied teams, the practical signal is where Meta has drawn its release line. The framework commits to evaluating cyber and CBRN weaponization potential before shipping, but it treats every other class of harm — accuracy, misuse in fraud or harassment, downstream fine-tuning risk — as outside this particular process. Builders integrating Meta's open-weight models inherit responsibility for those categories directly, because the upstream framework does not claim to cover them.

Meta also frames the document as provisional, saying it will "continue to evolve and refine" the approach as the technology progresses. That is honest but consequential: the thresholds are qualitative rather than numeric, the external-expert involvement is discretionary ("as necessary"), and the benefits side of the ledger is asserted rather than measured. The framework is best read as a statement of what Meta will screen for before opening weights — a floor for two specific catastrophic risks — rather than a complete safety contract for anyone deploying these models in production.