cs.SE · 2605.00932 Copy arXiv ID · May 1, 2026 Save Code World Model Preparedness Report Authors: Daniel Song , Peter Ney , Cristina Menghini , Faizan Ahmad , Aidan Boyd , Nathaniel Li , Ziwen Han , Jean-Christophe Testud , +16 more
Organizations: MSL Preparedness Team, AI Security Team
Abstract This report documents the preparedness assessment of Code World Model (CWM), a model for code generation and reasoning about code from Meta. We conducted pre-release testing across domains identified in our Frontier AI Framework as potentially presenting catastrophic risks, and also evaluated the model's misaligned propensities. Our assessment found that CWM does not pose additional frontier risks beyond those present in the current AI ecosystem. We therefore release it as an open-weight model.
Explore similar work Jun 10, 2026 · Andy Wang, Parv Mahajan, David Demitri Africa +3 Large Language Model Safety Frontier Models
May 2, 2026 · Jany-Gabriel Ispas, Sergiu Nisioi Machine-Generated Text Detection Code Quality
Jun 10, 2026 · cs.AI J/K move · Enter open · S save
Andy Wang, Parv Mahajan, David Demitri Africa, Alexandra Souly +2
Safety-relevant studies of language models, including alignment and jailbreaking evaluations and AI control protocols, often rely on prefilling model outputs. If AI models can recognize and act on the fact their prior assistant messages have been inserted or edited, the effectiveness and validity of these methods could be compromised. We investigate whether frontier language models can distinguish between tampered and untampered assistant-side context, a capability we call prefill awareness. To do so, we construct a binary preference benchmark across three prefill mechanisms, filtering for cases where models show consistent stances. We find that frontier models show substantial prefill awareness: Claude Opus 4.5 detects prefills opposing its preferences in 9-35% of cases with a 0% false positive rate when prompted; additionally, models often revert towards baseline behavior without explicitly reporting that the prefill was foreign. Controlled ablations later also show that detection and resistance rely on different cues, where stylistic mismatch mainly affects whether models flag a prefill as foreign, while preference mismatch mainly affects whether they revert toward their baseline answer. We also examine more realistic agentic settings such as misalignment-continuation evaluations and SWE-bench trajectories, where frontier models sometimes disavow prefilled assistant turns in ways that depend strongly on dataset, task success, and hidden formatting artifacts. Our results indicate that prefill awareness is already a substantial confound for some prefill-based methods. We recommend that model developers track this capability in frontier systems.