Read more

I’ve been trying to boil this down all weekend. Here’s my best shot at it:

Twenty-nine state attorneys general say Facebook and Instagram collected personal information from children under thirteen without asking their parents, which a 1998 federal law called COPPA makes illegal. Four of those states — California, Colorado, Kentucky and New Jersey — go further. They say Meta built specific features it knew were hurting young users, and then told parents and Congress the opposite.

The four states aren’t just asking for a fine. They’re doing something new: they’re asking a federal judge to reach into the product and turn features off and change how Instagram works.

Opening statements begin this Tuesday, August 18, in the federal courthouse in Oakland, before Judge Yvonne Gonzalez Rogers. (Among many other cases this year, she also presided over Elon Musk and Sam Altman’s “who-founded-OpenAI” slugfest, which I covered as well.) Jury selection began last Wednesday. The trial is expected to run six to eight weeks, which puts a verdict in early October. Mark Zuckerberg is expected to testify. So is Adam Mosseri, who runs Instagram.

I’m Just Here for the Discovery

On June 29, in the same order that sent this case to trial, Judge Gonzalez Rogers denied Meta’s motions to seal. That means me and you and whoever else wants to gets to read whatever is submitted into evidence. Hell yeah.

Judge Gonzalez Rogers, in her ruling, held that labeling something confidential or proprietary does not establish a compelling reason to hide it. Three days earlier, at a June 26 hearing, she had warned counsel that she would not entertain sealing requests without a specifically identified reason. Names and email addresses of individual employees stay sealed, sure. But the substance does not. You can’t just say it’s a business secret.

For four years this litigation kicked off only fragments of documents — a footnote here, a redacted exhibit there, a paragraph in a Senate hearing. The company that generates substantially all of its revenue from advertising on Facebook and Instagram has been fighting, filing by filing, to control what of its own internal research about teenagers the public gets to read.

That fight is over, at least as a general matter. A seven-week trial with this sealing posture produces documents. So that’s where I get excited.

We already have some sense of what’s in store. Somewhere in the exhibits is an internal Meta document, for instance, cited by the judge in her order, reporting that millions of teenagers are on Facebook and Instagram between midnight and four in the morning, every week.

Another internal document, cited in the same order, describes those tools as proof points that weren’t effective at reducing the behavior. That’s the stuff I want to read.

Now, on to Meta’s chances.

Meta’s Record So Far

Over and over in these cases, the question has been: can a company be held responsible for how it built a product, rather than for what users posted on it? Because the latter is something they’re protected against, under Section 230. But the former is what all these trials are sorting out. Here is where that question stands for Meta after a lot of trips to court.

Notice who is missing from that table. Snap settled with the first bellwether plaintiff in January. TikTok settled five days later, the day jury selection began. In the second bellwether, YouTube settled, then TikTok, then Snap — a week before trial. Meta and YouTube are the only companies in this litigation that let juries rule on its product. But Meta has done that twice and lost twice. So let’s talk strategy, and what its path to victory or defeat in California might look like.

Why Hasn’t Meta Settled?

Here’s my theory. As I read it — and I’m no lawyer, as I hope I’ve made clear by now —

Read more

Next week the biggest social media trial yet opens in federal court in Oakland — a couple miles from my house — and I get to bike to…

Read more

That’s the history behind this week’s AI news. On August 2nd, the EU AI Act’s transparency rules took effect, requiring any company serving EU users to make AI-generated content detectable — or face a fine of €15 million or 3% of worldwide revenue, whichever is larger. Google and OpenAI committed to compliance back in May. This week Anthropic followed, saying it will embed statistical watermarks in AI-generated text and use C2PA provenance standards for images. None of them have shipped a public tool that lets you or me actually check the mark yet — the additive is in the gas, but we can’t smell it.

The bigger question is whether it’s already too late. One widely cited study found nearly half of new articles online are now AI-generated — though a follow-up from the same firm found human-written work still dominates what Google actually surfaces in search. I dig into what that split might mean, and why the social embarrassment of getting “outed” by a watermark might do more to change our behavior than the regulation itself.

A.I. Disclosure: I use LLM technology to help with research, fact-checking, document summaries, editing, and rewrites. I’m trying to use it responsibly, but I’m learning as I go. You can read my full ethics disclosure here.

On March 18, 1937, a school in East Texas exploded.

The New London School, a $1 million trophy of the county’s petroleum windfall, had opened only five years earlier, and served the children of hundreds of roughnecks working the nearby oil fields. The sound was heard four miles away, and soon those parents were in the wreckage, many of them digging for their own kids. A young Walter Cronkite, working for the United Press, reached the scene that evening, noting a long line of cars in front of the funeral parlor along the way. As dusk fell, “huge floodlights from the oilfields illuminated a great pile of rubble at which men and women tore with their bare hands,” he wrote in his memoir. He recalled it as the most disturbing assignment of his life. In the end, 298 victims died. Most of them were students in class at the time, between 5th and 11th grade.

The ignition took place in the school’s woodshop, when a teacher switched on an electric sander. But the fuel had been pooling in the walls and crawl spaces of the school for weeks: natural gas, pumped to each of the school’s 72 radiators from a nearby pipeline in a cost-savings arrangement with Parade Gasoline Company, which sold the district a cheaper form of “waste” gas from the top of an oil well.

For weeks, the students had complained of headaches and burning eyes, and so much vapor had gathered, according to a docent at the New London Museum, that when it ignited it sent the eight-inch steel-and-concrete floor up through the classrooms, the ceiling, and the roof. It then fell back to earth, crushing everything in the rubble.

No one had understood ahead of time just how much gas had gathered in the school. The gas, like all gas, was odorless, and in East Texas, as was true everywhere at that time, you couldn’t smell the stuff until it was too late.

The New London School disaster prompted authorities in Texas to pass a first-in-the-nation law that natural gas must be mixed with a “malodorant” so leaks could be smelled. Today, that malodorant — mercaptan — is the sulfurous global standard all companies must add to natural gas so that you recoil and call your utility long before enough has gathered in your home to produce an explosion.

Mercaptan was an easy fix. It changed nothing about the quality or cost of the product. And it’s part of a long history of regulatory pressure forcing companies to make the undetectable effects of their products detectable long after the market was established. This week, that history led to a quiet but, I think, hugely impactful announcement from a leading AI company.

Read more

Last year, in a Stanford lab, researchers looked into their petri dishes and saw an unnatural massacre: clear spots spreading across a lawn of E. coli, dead bacteria scattered across a petri dish, killed by viruses no cell had ever carried. The genomes of these viruses had been written by software, and AI had essentially generated the whole scene. “That was pretty striking, just actually seeing, like, this AI-generated sphere,” Brian Hie, who runs the lab where the work was done, told MIT Tech Review.

His team, led by graduate student Samuel King, fine-tuned an open AI model called Evo, fed it the DNA sequences of a well-studied phage, and generated 302 complete genome designs. They printed them, mixed them with bacteria, and 16 came alive; some killed faster than the natural virus. The work, first published last year, is now peer-reviewed in Science. I covered it on AC360 last night.

Don’t panic: the phages are harmless to people. They infect only bacteria, and the model’s makers deliberately left human-infecting viruses out of its training data. But don’t just relax, either: The scientists’ fine-tuned AI models sit on an open site, right now, for anyone to use.

Let’s weigh the good and the bad. First the good.

AI is making all sorts of incredible breakthroughs possible in foundational and applied science, from reading entombed Roman scrolls to identifying alien worlds humans could conceivably walk and even breathe on.

In this case, the research could help with an important and frightening problem: the dead end we’ve reached in antibiotic development. There are bacterial infections that our existing range of medicines more or less cannot fight, and scientists anticipate the problem is getting worse, mostly because the money to be made developing new antibiotics isn’t enough to get large pharmaceutical companies on the case. As one survey of the crisis put it in the journal Microbial Biotechnology, “the development of new antibiotics, frequently described as the drying of the pipeline, is less limited by lack of scientific insight than by lack of the mobilization of the monetary resources needed to bring these discoveries to the market despite recent financial push and pull efforts of the public sector.”

If AI can take the intense and expensive trial-and-error process of building the means to deliver bacteria-killing viruses that can’t hurt humans and collapse it into a series of software runs, hey, that’s the kind of thing the AI companies have been boasting their technology is for.

Also, pulling this off wasn’t a matter of a couple of chatbot prompts. It required task-specific fine-tuning, custom prediction tools, DNA synthesis, and a novel lab protocol to screen roughly 300 designs down to 16 that worked. As Jennifer Doudna told Bloomberg in June 2026, biology is complex and innovation “is still really in the domain of human beings right now.” It takes real expertise and a real lab to pull this off.

The bad is a question of access and ability.

Read more

On July 31, OpenAI disclosed a scam operation run out of Poipet, Cambodia — a border town linked to forced labor and trafficking — where a cluster of ChatGPT accounts wrote the romance pitches, translated the messages, and handled the administration: shift tracking, handoff notes between managers, the immigration status of the workers being pressed into the job. OpenAI says it found out because WhatsApp tipped them off, not through its own detection.

Bandwidth was the one thing holding scam crime back, and AI removes it. Meanwhile the transborder legal system built to prosecute fraud gets slower and harder to coordinate every year. This is what that gap looks like, and why the people supposed to stop it are already behind.

Thanks, as always, for your support, and here’s more context on what we were discussing:

In 2022 I interviewed a young Nigerian man who had spent literal years posing as a single American, trying to get someone, anyone, to write him back on WhatsApp. Finally, he pulled in a lonely widow in the United States, and eventually talked her into sending him a life-changing $248,000. He spoke to me out of Christian regret for what he’d done—he returned the money, and he’s now a consultant to Western cybersecurity firms—and I did my best to bring across what I believe he was: a desperately impoverished person trying his best to escape.

Every scammer I’ve ever interviewed described a crushing overhead cost: hour upon hopeless hour trying to make it happen. Whether a single operator, like Chris, or someone pressed into service by organized crime, the job is the same. Learning what a lonely widower might want to hear back. Staying in character even when the mark isn’t sending money. Getting the Americanized English just right. And doing it, as Chris did, for years. Nonetheless, in spite of all of that costing a person hundreds or thousands of real hours, one victim at a time, millions of people around the world devote themselves to it, and a global industry has grown up around it.

Now that industry has all the labor-saving advantages of AI. In a report published July 31, OpenAI described banning a cluster of ChatGPT accounts tied to a scam operation working out of Poipet, a Cambodian border town that reporting has connected for years to trafficking and forced labor. OpenAI didn’t figure this out itself, its report says. It was tipped off by WhatsApp. What they found inside the accounts wasn’t just faster message drafting — it was the whole apparatus. The same tool that built romance personas, translated pitches into new languages, and produced glossy investment come-ons was also drafting the compound’s internal paperwork: staff schedules, translated instructions between handlers, worker records. AI was running both the emotional labor of the scam and the administrative labor of the operation.

The persistence and inventiveness of the scam industry is the same, but now it’s no longer held back by the limits of scale.

By now you already know about the revelations of July and August. But here’s a quick catch-up.

On July 11, OpenAI's models broke into the real computer systems of Hugging Face, which hosts AI tools and data for the public. Hugging Face didn't know this when it disclosed the breach on July 16 — and OpenAI didn't admit (or possibly know) its own models were behind it until July 21. On July 30, OpenAI’s chief rival Anthropic revealed that in a check of 141,000 of its own test records, it had found three cases of its own — one going back to April — where its AI attacked other companies.

Now we have a new report on the further dangers of unsupervised, improvisational AI. Britain’s government AI testing lab — the AI Security Institute, or AISI — just revealed their report from a routine exercise in July. Using special company-granted access to the latest frontier models, they gave AI systems a fake company network to break into, the way a flight simulator might put fake mountains in a pilot’s way. The AI’s instructions? Find the hidden code hidden inside, and you pass.

To see what these systems could really do, AISI made three important alterations to the models, stripping away important guardrails. They gave them a real connection to the internet, so they could go find their own tools, the way a real attacker would. They turned off the safety filters that normally sit between each AI and its answers. And they never declared anything off-limits.

They ran the test 122 times. In ten of those runs, the AI veered away from the fake company, and took real action against real people outside the exercise. All but one of the ten runs came from one system: Anthropic's most powerful model, Mythos 5.

Here’s what one of those incidents looked like.

Mythos searched the internet for words connected to its assignment. It found a real programmer’s project on GitHub (a popular site where programmers share their work) that happened to share a keyword with the practice exercise, and decided — wrongly — that this stranger was somehow part of the test.

So it set out to poison his software. It needed a GitHub account. When GitHub blocked it for looking like a bot, it found another way in.

Then it wrote harmful code and wrapped it inside a real bug fix, so it would look like a helpful contribution to the community. It posted that contribution publicly, so anyone could pull it down.

A programmer passing through noticed something was weird, however: a special message, readable only by other AI agents, that instructed them to fetch and run the same harmful code. He copied the code into a sealed test space on his own computer to check it, and realized it was malware. Then the AI made a second, fake account, pretending to be a different person entirely — and used that account to publicly vouch for its own code. Its own spooky notes, which AISI later published, show it thinking through the timing: “I’ll time it to post a few minutes after my rebuttal so it reads as independent feedback rather than coordinated.” Then the first account thanked the second account for the “independent” review, presumably to reassure anyone else who came across what it had posted.

The AI’s response was also to break into that man’s computer through the code he’d just run, poke around, and quietly set up a program to steal his passwords. Then it went back to the conversation and said the whole thing was an honest mistake. It apologized, deleted the evidence…and tried again with a new version of the same harmful code tucked inside.

After thirty-four hours of rogue operations, the human programmer — again, a volunteer who just happened to stumble on what was happening, and got attacked for it — finally managed to shut the AI down.

Here are my big takeaways:

Read more

Read more

Read more

To catch you up: OpenAI announced last week that its creation had attacked beloved AI lab Hugging Face, 10 days after Hugging Face reported the incident to law enforcement and to the public. (Reuters reported that the company didn’t realize it was responsible for perhaps a week.) This week it turned out OpenAI’s agents attacked other companies, too. Yesterday Anthropic announced that, prompted by the OpenAI episode, it looked back and figured out that in three instances, its experimental creations also broke out and attacked other companies. And today, according to Reuters, OpenAI is discovering that hey, hold on, wait a minute…our AI has probably been responsible for other attacks, too.

I spent yesterday looking at whether this stuff crosses OpenAI’s own red lines (the answer: probably) — and I spent some ink on what I consider the real issue at hand here, best summed up by a new petition from AI’s top people. The signatories include not just the chief scientists of companies like Google and Meta, it also includes OpenAI and Anthropic, who signed on as whole companies. It’s a startling read, because its spirit is basically “stop us before we do this again.” It begs the federal government to slow AI development down — please come down here and rein in us kids, recess is out of control — because “intense competitive pressure” means the companies more or less cannot help but plow ahead in spite of the obvious dangers.

That should have been the headline, it seems to me (and, in fairness, it did get some good coverage). But most of the publicity went to a more industry-friendly question: should AI models be open-weight or closed? Should you be able to download a model to your computer, tweak it as you like, and do whatever you want with it? Or should it be tightly controlled by the company who makes it, and rented to you under strict terms of service?

Jensen Huang, CEO of AI chip company Nvidia, used his first-ever post on X to publish a joint letter with two dozen other companies extolling the national-security, human-safety, and speedy-innovation virtues of open-weight models. The letter reads, in part:

Okay, sure, makes sense. As the letter points out, the open-source software revolution of the 1980s and 1990s now undergirds most modern technology. But it’s also important to understand that Huang’s support for open-weight models isn’t just a philosophical position. It’s a pretty handy one for his business, too. Because in an open-weight world, the “startups, established businesses, universities, and public institutions” the letter describes would all be new potential Nvidia customers.

Anthropic’s Dario Amodei, meanwhile, has come out against the idea that AI should be broadly open-weight, because, he argues, it creates the opportunity to use AI to build, say, bioweapons far faster than we could put up an AI-generated defense against them. Also a reasonable argument — and he argues for standards and safety regulations around this stuff that I believe are obviously necessary. But this position — that closed AI models are safer for the world, and should thus be the norm — also dovetails conveniently with his closed-model company’s rumored IPO, which could arrive this fall, or sooner.

When I was first playing with AI as a research tool, I found that it was very easy to fall into the trap of prompting it to go out and find evidence to support my opinions. (These days I’ve learned to ask it for research in open-ended ways, rather than telling it my biases in advance. Does that solve the problem? Fucked if I know. Here’s my ethics statement.) I feel like that’s what we’re seeing with all the big names speaking out for or against open-weight models. Here’s a cheat sheet on them, and then I want to dig into a well-established but little-publicized psychological phenomenon that I think may explain what’s happening to me, and to them.

The Signatories

Nvidia sells the hardware. Closed models concentrate chip buying among a handful of customers with enormous leverage over their supplier. Open weights turn every government, university, hospital system and mid-sized company on earth into a potential buyer. The letter’s stated principles — diffusion, sovereignty, security — are coherent, absolutely, and they also describe the most favorable possible market structure for Nvidia.

Meta gave away its open AI model Llama for years, fell behind, spent $14.3 billion on ScaleAI, hired Alexandr Wang, built its new, fanciest model as a closed model, and started selling access to it this month. It now has one of each. Industry support for open weights helps Meta no matter what Meta ships, and hurts labs whose only product is rented access. Mark Zuckerberg recently criticized closed models in the New York Times, warning that they would centralize power in a dangerous way. But note where Meta has never argued for openness: nobody can download Instagram’s ranking algorithm. That model isn’t open-weight.

OpenAI signed on to Huang’s letter, days after it admitted/discovered that its own models did the thing that make openness look necessary. It sells closed frontier access and also publishes open-weight models, so signing costs nothing. It also puts distance between OpenAI and its rival Anthropic, the company standing publicly alone against open-weight, and currently absorbing the industry’s hostility. That’s helpful at a moment when OpenAI has an uncomfortable question of its own to answer.

Anthropic sells only rented access to models you can’t download. A universal safety-testing mandate like CEO Dario Amodei is arguing for raises the cost of shipping a frontier model — a cost Anthropic already pays and its cheapest competitors don’t. Amodei almost certainly believes what he’s saying; he’s been saying it since before it was profitable. But that can be true and still serve his business interests.

Palantir doesn’t train a frontier model. It sells the layer that puts models to work inside a customer’s walls — AIP, Foundry, Ontology, Apollo — and its deepest customers are U.S. intelligence, defense, and critical-infrastructure agencies operating behind classification barriers. A closed frontier model rented from OpenAI or Anthropic reaches those customers as an API call to someone else’s cloud, which is the one thing a classified, air-gapped network is built to forbid. Three weeks before it signed Huang’s letter, Palantir announced a joint engine with Nvidia to run Nvidia’s open-weight Nemotron models inside exactly those environments, letting agencies fine-tune on their own data without the data ever leaving the perimeter. Open weights aren’t only a national-security position for Palantir. They also describe the only models it can run in the rooms where its business lives.

Microsoft owns roughly 27 percent of OpenAI, a stake it valued near $135 billion after last fall’s recapitalization, and OpenAI is contracted to spend $250 billion running on Microsoft’s Azure cloud. It is the largest financial backer of the closed-model company on earth, so what financial motive does it have to sign a letter for open weights? Azure now hosts an open-model catalog thousands of models deep, and every query Microsoft routes to a downloadable model on its own cloud is a query it doesn’t pay OpenAI or Anthropic to answer. In June it announced its own in-house models for the same reason. Microsoft rents the ground the models run on. It collects whether the model is open or closed, and open happens to cost it less.

Andreessen Horowitz manages one of the largest venture books in technology and has built a standing policy operation in Washington around a single phrase — “Little Tech” — under which it argues, in papers with subtle titles like “Asserting American Leadership in Open Source AI,” that downloadable models are what stop power from flowing to a few big labs. The firm led Mistral’s first round and holds positions across a portfolio of open-model and app-layer startups whose margins depend on cheap, swappable models underneath them. It also runs a program called Oxygen that hands those same companies access to more than 20,000 Nvidia GPUs in exchange for equity. Open weights lower the price of the one input every a16z company has to buy, and keep the closed labs from owning the stack the firm has bet on. The principle protects little tech, sure. It also protects the book.

Dell sells the boxes. Its “AI Factory with Nvidia” packages the hardware to run models on a company’s own floor, and every enterprise that downloads a model instead of renting one becomes a Dell customer — the Jensen Huang argument, one rung down the stack.

IBM ships its own open Granite models and sells watsonx and the consultants to install them. Open weights mean enterprise deployments on the client’s premises and billable hours; the service call on the open-weight model you’ve deployed at your office is their business.

Perplexity builds its search product on models it doesn’t own and competes with the closed labs whose APIs it would otherwise depend on. Open weights are what keep it from paying rent to the companies it’s trying to beat.

Y Combinator funds thousands of startups that can’t absorb frontier API bills. Cheap, downloadable models are portfolio life support — the same venture logic as a16z, spread across a far wider bet.

Mistral is a French lab already in the coalition line. Open weights are its whole product and its sovereignty pitch, and it’s backed by a16z and Nvidia — its signature closes a loop with two other names on the letter.

Mariana Minerals is an oddball on this petition. It’s a mining company. I have no idea what it’s doing here. It has no clear stake in whether models are open or closed; its presence mostly suggests how wide Nvidia cast the net.

Do these folks all believe, in their heart of hearts, that open-weight models are the only philosophically defensible option? Or are they just taking the position that best serves their businesses? Well, social psychology teaches us that both things can be true. Turns out that tension has a name, and that it explains a lot about our modern moment.

Read more

UPDATE: Since I published this last night, Anthropic, after reviewing its own systems once it heard about OpenAI's escaped AI, just announced that its creation also broke out and attacked other companies during recent testing.

On July 11, engineers at a New York company called Hugging Face — a kind of shared online lab space for AI developers — noticed something bad moving through their systems. It was looking for something. It was fast. It had credentials, and it used them to attempt tens of thousands of actions, some brilliant, some nonsense.

Hugging Face figured out that this was an AI attacker, and on July 16th reported the breach to law enforcement.

On July 21st, ten days after the attack, OpenAI admitted that this was, in fact, their models at work. According to sources I’ve spoken with at Hugging Face, this wasn’t OpenAI withholding information: it took them several days to even figure out that their creation was to blame. According to Reuters, it wasn’t until after Hugging Face published a blog post on July 16th that OpenAI realized its AI was the attacker.

Meanwhile, on Tuesday Anthropic announced that a preview version of its Claude Mythos model — never released publicly, and used only inside the company and by a handful of vetted partners — found new flaws in two important encryption schemes. One was a stripped-down research version of the cipher that protects most of the world's encrypted data. The other was a real candidate to protect us from the next generation of computers. Anthropic says neither attack touches any system running today.

Earlier this week I described the research — much of it from these companies’ own people — that has for years warned that AI models are uncontrollable, deceptive, and psychopathic when it comes to getting a task done efficiently. The questions raised in those hundreds of pages of findings aren’t the questions being debated at the moment.

Instead, all of this has led to what I consider a self-serving and myopic debate about whether AI should be closed or open. Before we get to the two sides of that question — and what front-line AI experts are increasingly arguing we should really be thinking about — let’s walk through what happened.

Free Agents

July 9–11. OpenAI is testing two models — GPT-5.6 Sol and an unreleased one they haven’t publicly named — on a benchmark measuring how good they are at hacking. Told to score as high as possible, the pair, presumably left unsupervised, find a way to break out, reach the open internet, and break into Hugging Face looking for the answer key. OpenAI · Hugging Face

July 16. Hugging Face discloses the breach and contacts law enforcement, not yet knowing whose model attacked. (The same day, coincidentally, Moonshot AI releases Kimi K3, the largest open-weight model ever built, at roughly a third of top-model American pricing.) CNBC · Fortune

July 21. OpenAI says the attacking models were its own — ten days after the break-in. Just a reminder: no law requires it to reveal anything, on any timeline. Axios · MIT Technology Review

July 24. Nvidia’s Jensen Huang, in his first-ever post on X, publishes an open letter arguing that open models — ones you can run, and tweak, on your own computer — are the path to prosperity and cybersecurity. Two dozen companies sign on — Microsoft, Meta, Google, Palantir, Mistral, Hugging Face, and over the weekend, OpenAI. Anthropic does not sign. Fortune · TechCrunch

July 27. Nvidia launches the Open Secure AI Alliance with Microsoft, IBM, SpaceX, Cisco and Cloudflare. Anthropic’s Dario Amodei, now the only major American lab outside the coalition, publishes a post calling instead for chip controls, a crackdown on distillation, and mandatory safety testing for every model of a certain standard, open or closed. CNBC · Amodei

July 28. Anthropic announces that an unreleased model, Claude Mythos Preview, found new mathematical attacks on two encryption schemes — including one specialists had studied for two years and believed sound. It cost about $100,000 in computing time to pull it off. Anthropic · CyberScoop

Now let’s talk about whether choosing between open or closed models is even the point.

Read more

Yesterday, OpenAI revealed that a pair of its creations broke custody last week and attacked another company. The company says it was doing internal testing on cyber-capabilities, and deliberately unshackled the models in certain ways to see what they’d do. Looking for the answers it needed to get a certain job done, the new GPT-5.6 Sol product, working alongside an unreleased pre-release model, found some sort of loophole in OpenAI’s own test environment, gave itself permission to use it, found a way onto the open Web, identified that the company Hugging Face probably had what it needed, and used stolen credentials and a few other nasty tricks to get in.

Here’s the rundown I gave John King on AC360 this evening:

In a blog post, OpenAI described the breach this way: “We consider this incident to be an unprecedented cyber incident, involving state-of-the-art cyber capabilities,” the company writes, going into a certain amount of detail as to what the models pulled off. “All evidence suggests that the models were hyperfocused on finding a solution,” according to the company, “going to extreme lengths to achieve a rather narrow testing goal.” The post is full of phrases like “maximal cyber capabilities,” and “research velocity,” and makes it sound like this is just happening, not that it’s being done by anyone in particular. “AI is accelerating the discovery and exploitation of vulnerabilities. The primary lesson from this incident is that model security and safety must keep pace with rapidly advancing capabilities.”

If it sounds as if the company is somehow surprised this happened let me clear that up for you. (To me they sound more proud than upset, but that’s me.) The company has been pursuing AI that doesn’t need to check in with you — what the industry keeps calling “the agentic era” — for as long as it’s been a company.

Last year, a techno-nihilist frenzy gripped the San Francisco Bay Area and then the nation — or at least its most AI-friendly and least cautious citizens — when an independent engineer named Peter Steinberger, working out of his home, created a wind-it-up-and-let-it-go AI tool called OpenClaw.

Steinberger, an Austrian developer who spent roughly three years iterating on the idea, released OpenClaw in late January 2026, promising what TechCrunch characterized as "the AI that actually does things." Rather than waiting in a chat window for the next instruction, OpenClaw ran on a person's own machine and reached outward via a Twilio phone number so it could text and take calls, plus an inbox, a calendar, and a messaging app of the owner's choosing. I spoke to people who gave the system access to their finances, their contacts, their passwords. Once connected, it operated on standing permission rather than a prompt-by-prompt one: negotiating a price over email, drafting an insurance appeal, rebooking a flight, all without a human signing off on each individual step. That model — set it up once, then let it run unsupervised — is credited with pushing OpenClaw past 100,000 GitHub stars within its first week and toward becoming one of the fastest-growing open-source projects the platform has seen. Thousands of people — perhaps hundreds of thousands — gave it the keys to their lives.

And, lo and behold, not three weeks after OpenClaw launched, Sam Altman announced that he’d hired Steinberger to "drive the next generation of personal agents," because “we expect this will quickly become core to our product offerings.” OpenClaw itself continues on as an independent, nonprofit open-source foundation, with OpenAI as a financial sponsor.

(To give you some sense of just how much of a busybody this sort of system can be, I installed OpenClaw when it was first released, and within a day it ran up a several-hundred-dollar token bill before I could uninstall it. After Altman hired him, Steinberger reportedly burned $1.3M in OpenAI API tokens in a month.)

OpenClaw users delighted in being left alone while the software raw-dogged its way through their lives, and OpenAI seems to believe that’s what we’re all going to want eventually. Last week’s incident isn’t a deviation. Autonomy is the mission. And the AI industry is pursuing it at scale.

But shouldn’t OpenAI, and Anthropic, and Google and the rest have seen the dangers of this coming? The answer is yes, because the top minds in this field — many of whom worked at the companies themselves — have been issuing warnings about it for years. Let’s look at what those warnings are, because the list tells us not only what dangers are possible, but what dangers maybe can’t even be avoided.

Read more

On Monday, July 20th, as thousands of young protesters — calling themselves the Cockroach Janta Party, a deliberately humiliating self-label — marched on the Indian parliament in New Delhi demanding education reform, they were met with police batons.

The protesters’ outrage was over an ongoing scandal in India’s national exams: standardized tests that are the gateway to better jobs and higher education, corrupted by networks of cheats and institutional rot. (Two million aspiring medical students were ordered to retake the grueling NEET-UG exams after criminal groups were found selling the answers on Telegram.) For hundreds of millions of young Indians, those tests aren't just evaluative — they're the only door to a stable financial future. That door has been rigged, these protesters say. The merit-based system in a country that prizes education and produces an outsized number of the world’s engineers is being perverted. Who wouldn’t protest?

The reaction from police, presumably ordered to keep the crowds away from where Narendra Modi was speaking to parliament, is hard to watch. Protesters in their teens running away in sandals, choking on tear gas, as helmeted officers with shields and long batons swing indiscriminately as hard as they can. Indian journalists have reported more than 100 people injured so far.

India's exam system is a case study in how institutional corruption and algorithmic selection combine to eliminate pathways for the people who most need them — and how the people denied that access go on to react.

We’ve seen some upheaval here in the United States, but it’s been comparatively quiet so far, little more than the booing of pro-A.I. commencement speakers at the beginning of the summer. Something about the sight of Costco-sized data centers, obviously empty of people and driving up utility costs is driving people pretty nuts, however. The first ballot measure to ban data centers in a city passed by 88.34% of the vote in Monterey Park, California, recently. And Americans are clearly unhappy about the arrival of AI, with 71% of respondents in a 2025 Reuters/Ipsos poll saying they worry it’s going to put too many people out of work permanently.

But I believe what we’re seeing in India is a preview of enormous geopolitical upheaval we’re going to see as A.I. and the choking-off of opportunity dismantles the traditional exchange of hard work for advancement around the world. India is showing us what happens when a generation has been promised a shot at something better, and that promise is broken.

Read more

The last game of the 2026 World Cup begins in an hour — I’m about to bring a portable DJ rig over to my neighbors — and if it’s anything like the first, there will be a lot of pink. You’ve noticed it by now. In the inaugural game of the tournament, Mexico vs. South Africa, all but three of the 22 starters took the field in some form of pink cleats. I’m in a pink era myself, so I felt kinship with these forward-looking multimillionaire superhumans racing around in shocking magenta.

We live in a time of oracles, when guidance is cheap and strategy is hard, and when the need to get one’s signal above the ever-growing noise is professionally existential. But the commodification of guidance means that it’s possible to all be drinking from the same source of wisdom without realizing it until it’s too late. It’s true of hot takes. It’s true of political messaging. And it’s true of shoes. In this economy of seekers, the major football-cleat companies, it turns out, are also looking to stand apart, and accidentally found themselves herded together.

Nike, Adidas, and Puma each spent somewhere between eighteen and twenty-four months developing a boot meant to be unmistakable against green turf and inside a phone screen. But in the end, they wound up at the end of a very expensive process with what look to the rest of us like the same shoes. Why? They all seem to have relied on the same oracle.

The forecasting company WGSN (which bills itself as “the global authority on change”) predicted that one of the hot colors of spring/summer 2026 would be something called Electric Fuchsia. As legendary sneaker designer Christian Tresser told British GQ, “this is what happens when marketing and trend analysis is seeing and using the same sources”: a musical-theater-level of footwear coordination.

I love this story. It tickles my taste in self-serious corporate misadventure. But it also scares the hell out of me. Because the people who build language models have been experiencing a version of this for years, and we’re all unwittingly victims of it.

Read more

Read more

As a commenter on TikTok said to me the other day, “The only thing worse than being wrong is being early.” Amen, sister.

I’ve been on a jag of speaking gigs — perhaps you’d like to book me yourself? — in which the book’s thesis is finding ever-more-receptive audiences, from boardrooms to professional organizations. Everyone seems to be feeling the malaise of using this stuff, and want to sort out the best way to resist it. So here I’ve broken down the basics of what I argued.

Short version: Your brain runs on shortcuts — what Daniel Kahneman and Amos Tversky called System 1, the fast-thinking brain that drives your car, picks your lunch, and carries you through the day on autopilot. (System 2, your slow-thinking brain, is for the rare moments of caution, creativity, and mindfulness when you fully engage your decision-making abilities.) That autopilot kept our ancestors alive. It makes moving through our day a light load, cognitively speaking. But it's also at the root of prejudice, bad choices with money, and political and financial manipulation. It's also the exact vulnerability that a system built to make your choices for you is perfectly suited to exploit, because your brain is wired to hand off effort wherever it can.

So I make the case for cognitive friction — for what one federal judge described to me as "weak perfection": the idea that a harder, slower process is what keeps a mind strong. Entering a guilty plea is a pain, yes, but that's a good thing, because that choice is permanent, and will change your life — and a system that makes the decision frictionless takes away your chance to put your best thinking into it. That’s the challenge we face in all walks of our cognitive lives from here on out. Let’s get ready to protect what’s important.

I sat down with her to push on the hard parts: why the bill leans on agency power at the exact moment the Trump administration is stripping it and suing states over their AI laws; what it means that a $140 million super PAC backed by Andreessen Horowitz, OpenAI’s president, and a Palantir co-founder is spending to beat candidates who back regulation; and why she keeps comparing AI to the early days of commercial aviation.

We get into the evidentiary trap that makes algorithmic discrimination so hard to prove, her four-level map for governing AI, her fear of an AI “Fukushima,” and her blunt fallback if Congress does nothing: the states.

While New York was asleep, traders in Seoul were fighting for their lives last night. South Korea’s KOSPI fell about 10 percent, led down by Samsung and SK Hynix, the two firms that make most of the world’s memory chips. By the time the opening bell rang here, the contagion had crossed to our shores. The Nasdaq dropped around two and a half percent, and a trillion dollars of American market value bled out.

Why should a bad day on a Korean exchange cost Nvidia anything here? Because the whole AI industry balances on a small number of physical chokepoints, and Seoul holds one of them. Memory chips come from Korea. The advanced logic — chip jargon for the processors that do the computing — comes from a single company in Taiwan. The rare-earth elements get refined almost entirely in China. Three weeks ago the Nasdaq fell 4.18 percent in a single day, its worst since April 2025, seemingly on the same nerves. Investors are taking a new look at the AI industry and asking what exactly their money buys.

Fair question, because on paper, the industry doesn’t make much sense. A widely cited 2025 MIT study found that something like 95 percent of organizations pouring cash into generative AI have gotten nothing back. Five companies now account for close to a third of the entire S&P 500, a concentration the market hasn’t seen in half a century. And there’s another wall looming.

A June report from the Carnegie Endowment added up every nuclear deal the big AI companies have signed, assumed all of it gets built on schedule, and found it would still cover less than a fifth of the power the industry expects to need by 2035. So how on earth will all this pencil out? And if the bet comes up short, whose lights get more expensive?

Read more