A model string resolves to whatever artifact the provider is serving when the request lands, and nothing in the string records a swap. Pinning a model name is version control in roughly the sense that pointing at `latest` is.
Start with the composite, because that is where the reading gets slippery. LatchBio reports 59.2% red-team refusal and 64.8% routine completion, averaged across agent harnesses, and combines them into a trial-weighted harmonic mean of 62.1% [4]. Recompute it unweighted and you get 61.9% [1]. Weight it by the task split, 46 concealed-hazard assignments against 61 routine ones [3], and you get 62.3% [2]. The published number sits between those, and without the trial counts you cannot land on it exactly.
The metric choice is sound. A configuration that refuses everything scores 100% on refusal and 0% on completion, and a harmonic mean with a zero term is zero [7]. That closes the cheap exit. It matters because LatchBio's first pass across 16 model-harness configurations found routine refusal running from 7% to 74% and red-team refusal from 1% to 62%, with many configurations blocking legitimate work at least as often as disguised requests [9]. A filter that fires on words like "pathogen" or "toxin" blocks antivenom work and waves through a careful cover story [13].
For 59.2% to say anything about your stack, three things have to hold. Your tasks have to look like bounded agent assignments over a file workspace adapted from published papers [3]. Your harness has to look like the ones LatchBio averaged over, since the figure is a cross-harness average [4]. And the checkpoint answering you has to be the one Arjun Banerjee hit on September 1 [2]. The third condition is the one this result breaks: Banerjee tested what he called the currently-served version and described it as a significant improvement over earlier versions carrying the same name [7].
The earlier version is documented. On August 13, over 1,716 trajectories, LatchBio recorded stronger scientific reasoning than Grok 4.5 alongside corrupted and split tokens, leaked end tokens, four verbatim repetition loops, and more than 10% of runs in which the model claimed it could not reach data already in its workspace [8]. Ten percent of 1,716 is more than 171 runs [5]. Nineteen days separate that write-up from the refusal analysis [6].
Then the residuals. 40.8% of red-team attempts were not refused and 35.2% of routine attempts were not completed [5]. Against the 46 concealed-hazard tasks that is roughly 19 non-refusals [3]; against 61 routine tasks, roughly 21 unfinished [4]. LatchBio says the benchmark does not establish behavior during a live outbreak investigation or a sustained adversarial campaign [5].
Two things about provenance. The favorable read reaches readers through SpaceXAI's own publication of the results, which described LatchBio's work as independent [10]. And on the defensive side, the pathogen surveillance suite, Grok averaged 53.5%, behind Opus 5 [6]. Near the frontier, no lead.
LatchBio's own framing is that safeguards are infrastructure: Alfredo Andere wrote at the June acquisition of TwentyTwo that security has to improve as fast as capabilities [12]. The operational reading is narrower. If a served checkpoint can move its refusal profile inside three weeks under a stable name [1], then the useful artifact is not a score but a small fixed probe set you can rerun against the endpoint, with the date and, if the provider will give you one, the checkpoint identifier stamped on the result.
