A capability evaluation is a targeted security assessment used to determine whether a system crosses a risk-relevant threshold. Unlike a broad benchmark, it asks a narrower question: can the model do something dangerous, such as produce convincing phishing text, assist with malware development, follow adversarial instructions, or use tools in ways that increase misuse risk?
This matters because security decisions are often threshold-based. If a model exceeds a defined level of capability, defenders may require stronger controls, restricted access, human review, or a block on deployment. In practice, these evaluations use carefully designed tasks, adversarial prompts, and scoring rules that focus on behaviors linked to abuse or loss of control. Good capability evaluations are repeatable and hard to game, so they can support audits and release decisions.