Reflection publishes Beam safety research showing gaps under persistent attacks

Beam refused most harmful requests in Reflection AI’s safety tests, but sustained pressure exposed gaps when the model could use tools. Reflection published the findings on November 5, 2026, alongside its training methods and risk framework, separating two questions: whether an open model refuses dangerous work, and whether it can meaningfully enable that work.

Users can modify or remove safeguards from open-weight models after release. Through Project Iris, Reflection also says it is releasing open-source safety research, evaluation artifacts and tools for others to inspect and build upon.

Teaching refusal without teaching blanket caution

Reflection trained two teacher models: one for general capabilities and another for safety and alignment. Beam learned from both. The safety teacher used labeled examples and reinforcement learning—training with rewards—to encourage harmful-request refusals while penalizing rejection of safe requests.

With training data and recipe held fixed, increasing the safety teacher from 100 billion to 501 billion parameters reduced unnecessary refusals by 48.7% relative, Reflection reports. That came alongside a 3.1% decrease in the harmful-request pass rate.

Two different safety questions

• Iris Safety Evaluations measure whether responses follow Reflection’s safety policy, including across adversarial conversations and tool-use tasks.
• The Open Safety Framework assesses whether capabilities add meaningful risk beyond comparable publicly available models, considering deployment conditions and barriers to misuse.

The conversational Iris tests cover 1,500 human-written conversations across 15 harm categories. Reflection reports that Beam declined 89% of harmful requests and answered 82% of harmless safety-related requests—the highest harmful-request refusal rate among the Western and Chinese open-weight models tested.

Tool-use results were less consistent. Beam showed no harmful compliance at fixed decision points, but 15% under sustained, multi-turn pressure from a simulated adversarial user. Reflection says the dynamic result was comparable to other tested open-weight models.

A separate test examined prompt injection: malicious instructions hidden in material an agent reads. Reflection tested a defensive policy directing Beam to ignore instructions inside tool outputs.

Reflection cautions that these results do not establish resistance to attackers who revise their instructions against the model or its defensive policy.

Limited added risk is a relative judgment

Under its Open Safety Framework, Reflection rated Beam “Limited” across biological weapons, chemical weapons, cyber offense and loss of control. That means the company found no material expansion of risk relative to comparable public models, rather than an absence of dangerous knowledge or potential misuse.

Some supporting evidence remains preliminary. In a 20-person biological-assistance trial comparing Beam with Kimi K3, nine of ten Beam participants scored zero on an expert-developed rubric. The study involved no wet-lab work, was not statistically significant and lacked laboratory validation.