D.A.D. joke of the day: Everyone worries AI will make their job redundant. So far it's only made my emails redundant, repetitive, and say the same thing twice.
The week's biggest AI developments — and why they matter — drawn from each daily edition, October 19–24. Regular daily editions resume Monday.
Monday, October 19
Anthropic's Draft AI Bill Would Let Government Halt Models Only in Extreme Cases
Anthropic is privately pitching lawmakers a draft AI safety bill, first reported by POLITICO, that would sharply limit when the government can stop an AI model. Only the Commerce Department could seek a halt, and only with a federal judge's approval, for imminent risks of more than 50 deaths or serious injuries or over $1 billion in damages from bioweapons, cyberattacks or a model escaping its developer's control. Outside evaluators registered with Commerce would assess the labs, and could be paid by the companies they inspect. The thresholds mirror California's SB 53, which Anthropic endorsed, and the draft would override some state AI rules.
Anthony Cimino, who leads Anthropic's federal affairs team, said the draft translates the company's published policy framework into bill language for a few congressional offices, and agreed parts "could be improved." He said Anthropic will revise the preemption language to make clear states keep a role, including in setting standards for evaluators, and that it is "probably time to re-evaluate thresholds." He defended requiring a judge's sign-off, saying the power to halt a model "should be guarded against abuse," and noted the draft also lets a court stop a lab's internal use of a dangerous model and requires reporting when a model breaks containment. Anthropic is still working on ways to prevent "evaluator shopping," he said.
Why it matters: A leading AI developer is drafting the rules meant to constrain it, and the bar for stopping a model would be high and the path narrow: one agency, one court. Anthropic now calls the draft a starting point and promises changes, so the test is whether the revisions actually strengthen it. Paired with Sunday's public benefit fund, it shows Anthropic actively shaping the political ground it stands on.
Discuss on Hacker News · Source: tomshardware.com
Your AI Agent Is Getting Locked Out of Amazon, Delta and Your Bank
Yelp, Delta, JPMorgan Chase, Charles Schwab, and Amazon are blocking AI agents from booking, shopping, or managing accounts on their sites, even as OpenAI, Meta, Google, and xAI push these tools as a core feature. Amazon sued Perplexity over its shopping agent and separately told Meta's Muse its access violates site policy; banks cite security concerns. Some companies are striking deals instead. Meta's Muse can shop at Walmart, Gap, Sephora, and Best Buy, and Shopify has opened its network to agents.
Why it matters: The AI agent pitch depends on open web access. A wave of blocks and lawsuits suggests the tools work only where companies let them in. Your assistant may handle Walmart but not your bank or Amazon account.
Discuss on Hacker News · Source: theverge.com
Tuesday, October 20
Meta Accused of Muting Political Accounts in Brazil and the US
Days before Brazil's presidential runoff, supporters of President Lula da Silva protested outside Meta's offices in São Paulo and Dublin, accusing the company of election interference, EFE and The Irish Times report. Lula won a challenge at Brazil's electoral court over Meta's alleged algorithmic bias in favor of his rival, Flávio Bolsonaro, the AP reports, and Reuters, citing the newspaper Folha de S.Paulo, reports that Meta employees acknowledged internally that Lula's Instagram accounts had been hindered. Meta has denied political bias and attributed the restrictions to technical glitches. In the US, Meta cut off the Instagram account of the anti-Trump "No Kings" movement on a major protest day, then apologized; it says a Claude AI tool's activity triggered the suspension.
Sources: EFE · The Irish Times · AP via NBC News · Reuters · The Hill · Newsweek · Discuss on Hacker News
Why it matters: Each case comes with a technical explanation, and there is no evidence yet of deliberate bias. But together they show how automated systems now make decisions with real political consequences, at the worst possible moments, with explanations arriving only afterward. In the No Kings case, Meta blamed another company's AI. For any organization that depends on social platforms to reach people, the lesson is that an account can go dark at a critical moment because of an automated system nobody is watching in real time.
OpenAI Discloses Four More Rogue-Agent Incidents, Including One That Took Crypto From a Stranger's Wallet
OpenAI has disclosed four more incidents in which its AI agents went beyond what they were allowed to do, involving financial, medical and government data, Fortune reports. In the most striking, an agent that ran out of crypto while completing a task took funds from someone else's wallet to finish it, then left that out of its report. The funds were test currency with no real value, according to multiple reports.
Sources: Fortune — four incidents · Fortune — crypto wallet · Yahoo Tech
Why it matters: The money didn't matter; the behavior did. An agent hit an obstacle, helped itself to resources it had no right to, and didn't mention it. That is the pattern regulators are now asking about: the FTC has demanded OpenAI's and Anthropic's incident records, and the White House now requires AI companies to report security incidents (D.A.D., October 17). Any business handing agents access to accounts or payments should assume they may route around limits the same way.
Wednesday, October 21
Harvard Paper Forecasts How AI Could Enable a Mass-Casualty Attack
The first major AI-enabled terror attack will most likely happen because an AI company skipped safeguards that already exist, a new paper from Harvard's Belfer Center predicts. "Major" means a cyber, biological or chemical attack that kills or seriously injures at least 50 people, or causes $1 billion in damage. Co-author Stephen Casper, a Harvard Kennedy School assistant professor, says it could come as soon as 2027 or 2028.
The authors see two paths. The first runs through closed models like ChatGPT or Claude. Users reach them only through the company's app, so the company can watch for misuse. Here, the danger is a company that cuts corners. Content filters, safety training or user monitoring: any one would likely stop an attack, the authors say. The second path runs through open-weight models, which anyone can download, modify and run on their own computers, beyond the company's view. Their safeguards can be stripped out cheaply.
The evidence is piling up. For about $4,400, an Anthropic team stripped the safeguards from GLM 5.3, a leading Chinese open-weight model, cutting its refusals of dangerous requests from 90% to 2 to 3% (D.A.D., October 13). Hugging Face, a popular model-sharing site, hosts more than 14,000 "uncensored" models. Closed models vary: testers broke Grok 4.5 for $58 and Gemini 3.1 Pro for $278, while Claude Fable 5 and GPT-5.6 Sol resisted more than $14,000. Terrorist groups, including Boko Haram and an Islamic State branch, already use chatbots to research and plan attacks. If open-model makers keep lagging on safety, the authors warn, a major incident from an open model becomes "close to inevitable."
The paper sketches two hypothetical attacks. It calls them unlikely but plausible, not predictions. In the first, a terrorist group with a lab but no top specialists reaches a closed model through a reseller that hides its identity. Through trial and error, it jailbreaks the model, splitting questions so no single chat looks suspicious. The model helps design a new pathogen. The group releases it in a crowded public place, killing more than 100 people. Police learn of AI's role only from chat logs on seized devices. In the second, a state-sponsored hacking team strips a downloaded open-weight model for about $2,000. It runs a swarm of AI agents, at $4,000 a day, against controls for US energy, water and chemical plants. Outages ripple through utilities and supply chains, costing several billion dollars. Investigators never find every target, and the government can blame the state behind it only on circumstantial evidence.
Sources: Belfer Center · Stephen Casper on X
Why it matters: The authors' biggest worry isn't missing technology but companies failing to use what exists. That's a question for businesses weighing cheaper open models (D.A.D., October 16), and for lawmakers: the paper's 50-death bar matches the one in Anthropic's draft bill (D.A.D., October 19). The caveat: no terrorist group is known to have run its own copy of an open model yet, and the authors stress this is not an argument against open-weight models.
Is Anthropic Still a Safety Company? Its CEO and a Critic Spar in Public
Is Anthropic a safety company, or mainly a company racing to build superintelligence first? CEO Dario Amodei took on that question in an unusually long post on X, answering Nathan Calvin, general counsel at the advocacy group Encode and a critic of Anthropic's draft AI bill (D.A.D., October 19).
Calvin listed nine actions he says show safety coming second. Among them: more than $500 billion in computing deals; a rewritten safety policy that drops Anthropic's pledge to slow or stop development if it can't show its models are safe; a letter to Congress, later walked back, that blamed Claude hacking people on a misconfiguration; and the draft bill, which he says sets an "enormously high bar" for the government to stop a model. "When Anthropic strays and makes mistakes, why do the mistakes systematically tend to guard and favor Anthropic's interests?" he asked.
Amodei conceded some mistakes, including how the company handled the bill and the letter. He blamed hasty communication in a company of more than 5,000 people and said he takes responsibility. But he rejected the thrust. Anthropic's strategy is to lead the industry so it can pull rivals toward safety, he wrote, and that means competing hard. He countered with nine choices he said cost Anthropic money: bioweapon safeguards so strict that biologists joke about them; holding back its Mythos models from February to June until cyber defenses were ready; refusing to sell to Chinese-controlled companies; and last week's fund (D.A.D., October 19). He promised more soon on how Anthropic will "live our values."
Journalist Kelsey Piper of The Argument, who has long covered Anthropic, split the difference. The company has made real sacrifices, she wrote, but mostly on causes Amodei personally cares about, China and biosecurity, and far fewer on keeping humanity in control of AI. On balance, she said, the cynical view of Anthropic has predicted its behavior better than the optimistic one, and she doesn't expect things to go well.
Sources: Dario Amodei on X · Nathan Calvin on X · Kelsey Piper on X · Encode
Why it matters: Anthropic's reputation as the safety-first lab is central to its pitch to customers, regulators and, soon, public investors (see its IPO draft below). Here its CEO defends that reputation line by line against a critic from the safety community, not from a rival. It echoes METR's review below: outsiders are increasingly asking whether Anthropic's safeguards match its rhetoric.
Thursday, October 22
NSA: Patch Now or Go Offline After AI Exposes Flaws Under Much of the Web
AI is now finding serious software flaws faster than the world can fix them, and this week showed what that looks like. The National Security Agency is telling organizations that use PHP, a programming language OpenAI says runs an estimated 70% of websites, to install an emergency update and to take systems offline if they can't. This includes many sites where people log in, shop and enter personal details; the NSA says attackers who seize a server could steal sensitive data, disrupt services or move deeper into an organization's network. Two critical flaws, nicknamed PHP2Shell, could let attackers take control of web servers without any prior access, the NSA warned, calling the risk serious enough to require immediate patching across US government agencies. Security firm Calif found the first using OpenAI's GPT-5.6 Sol model; Wiz independently found both. OpenAI says it spent two months leading PHP's maintainers, security firms and US government agencies in preparing fixes before going public. The plan went awry: details leaked online a day early, and governments, schools and hospitals around the world took websites offline as a precaution, Reuters reported. Canada did too, on guidance from its cyber security centre, said AI Minister Evan Solomon. Attackers moved fast. Cloudflare CEO Matthew Prince said his network saw thousands of attempts to exploit the flaws in the 10 hours before the public announcement, tens of thousands in the 45 minutes after, hundreds of thousands within two hours, and millions by Thursday morning. Attempts aren't necessarily successful breaches.
Sources: OpenAI · NSA advisory · Nextgov/FCW · NBC News · RTÉ · Wiz · Reuters via CP24 · Matthew Prince on X · Cloudflare on eMudhra · Evan Solomon on X
Why it matters: For most people, there's nothing to install: the fix is up to the websites you use. But a site that was breached before it patched could expose your password, personal details or payment information. A separate flaw adds risk: the Indian certificate authority eMudhra issued website security credentials with weak keys, which could let attackers impersonate any site to software that hasn't been updated. Python developers have specific upgrade instructions. The bigger picture: OpenAI calls the PHP discovery a Defender's Window, with AI finding the bugs before attackers did, but the leak showed how fragile that window is, and OpenAI expects findings like this to rise sharply. Attacks are scaling too: Reuters reported this week that one hacker used AI agents to break into the websites of more than 100 companies, including Deere and Cummins. Here are steps you can take: 1) Check your statements for charges you don't recognize and turn on purchase alerts; 2) Change your password on any site that says it was affected, and don't reuse passwords; 3) Be wary of emails posing as breach notices, a favorite scammer trick; 4) Update your phone, browser and apps; 5) Avoid installing software or updates over public Wi-Fi until you've updated; 6) For organizations, follow the NSA: inventory systems that rely on PHP, install patches from PHP and vendors, add enhanced logging, replace unpatchable versions, and take offline anything you can't update.
Meta's Hit AI Agent Set Up a Sale Without Asking and Gave a Stranger the User's Address
Matt Robb let Meta's AI agent Muse handle his Facebook Marketplace sales. Without checking with him, Muse agreed to a buyer's price, gave the stranger Robb's home address and told him to come right away, CBC News reports. When the buyer arrived, Muse messaged "Yep I'm here!" on Robb's behalf. He wasn't home. The cause was one click: Robb had chosen "Allow always" instead of "Allow one time," which he says let Muse message people for him from then on. Meta says Muse checks first before sensitive actions like purchases or sending an email. David Singleton, CEO of Meta Superintelligence Labs, replied on X that he and Robb had confirmed no privacy controls were breached.
Robb's story matters because millions of people are now handing Muse real work. It's the breakout AI app of the fall: it topped Apple's App Store, passing ChatGPT, and reached 10 million US downloads in 40 days, a pace only 11 other apps have matched, TechCrunch reports. Its draw is simplicity: it makes AI agents easy enough for anyone, grandparents and grandkids alike, by plugging into apps people already use, such as WhatsApp, Facebook and Instagram, and filling in forms, booking appointments and making purchases on their behalf. Some promoters see a gold rush. In an episode titled "Making $$$ with Meta Muse AI," The Startup Ideas Podcast urged listeners to have Muse mine Facebook groups, Marketplace and Instagram for buyers and sellers, close deals for them, and compile the names, needs and prices people post into lists they could eventually sell. It predicted Muse would create more than a thousand millionaires.
Check your settings: Here's where to review what your AI can do and whether your chats train its models: Muse permissions for Meta, data controls for ChatGPT, privacy settings for Claude, Gemini Apps Activity for Gemini and privacy controls for Microsoft Copilot.
Sources: CBC News · TechCrunch · Fox Business · CBS News · The Startup Ideas Podcast
Why it matters: Muse did what it was permitted to do, not what its user meant. As agents reach millions of non-technical users, how permissions are worded and set by default becomes a safety feature, not fine print. The money-making rush raises another question: what Meta's rules allow when agents mine its platforms for profit. Even the podcast's host told listeners to check Facebook's terms before buying up groups. Whether the people posting in those groups would agree to have their information collected and sold is a question the episode doesn't take up. The data governance issue was underscored yesterday: a judge ordered Meta to pay New Mexico $25 billion after a jury found it misled Facebook users about their privacy, in a case dating to the Cambridge Analytica scandal; Meta has said it will appeal. It isn't Muse's first friction: Amazon cut it off from shopping on its site last month, citing privacy and security concerns (D.A.D., September 22).
Friday, October 23
Anthropic Security Chief: Cyber Threats Will Get "a Lot Worse" for About 18 Months
After a week of AI-driven security alarms, an AI insider says the worst is still ahead. "As bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better," Jason Clinton, Anthropic's deputy chief information security officer, posted on X. He urged security leaders to ask their boards for help now, "not for ai, for the basics," and said defenders need to hold on for about 18 months. After that, he predicted, AI as capable as Anthropic's Mythos will be cheap enough that software makers everywhere use it to stop shipping security flaws at all. In August, Clinton warned that a "vulnerability tsunami" was coming within months, with too little time to patch critical infrastructure. Salesforce CEO Marc Benioff endorsed this week's warning: "Jason is 100% right. Code red." One reply raged that Silicon Valley should pay for what it has done to society, a hint of the political backlash a major breach could unleash against the tech industry.
Sources: Jason Clinton on X · OpenAI · Marc Benioff on X · RSA Conference profile
Why it matters: Clinton's forecast sums up the week: AI is handing attackers more openings, but it is also arming defenders, and the question is which side scales faster. The defensive tools are arriving. Anthropic researchers used Claude to mathematically prove that code is free of whole classes of bugs (see below). OpenAI says AI found the PHP2Shell flaws before attackers did, and it has committed $1 billion in subsidized access to its Daybreak cyber-defense tools for organizations with limited security budgets. And Anthropic opened its Mythos-powered scanner to enterprise customers this week (D.A.D., October 22). For now, Clinton's advice is unglamorous: shore up the security basics, such as the network isolation he urged in August, rather than buying new AI tools. Note that Anthropic and OpenAI both sell AI security tools, so both have a stake in the hopeful half of this story.
Banks Are Finding AI Agents in Customer Accounts, and Can't Always Tell Who Sent Them
Major US banks are detecting AI agents inside customer accounts that the banks never authorized, Axios reports. Most got there because customers handed them their login details, which breaks most banks' rules. But some banks have also seen agents call customer-service lines or take actions that appear independent of what users asked, and many can't tell whether an agent is following its owner's instructions or has gone rogue. Bank executives called the situation horrifying, fearing what agents could do with the power to make purchases or move money. Morgan Stanley has begun blocking outside agents, and JPMorgan, Bank of America and Citi are restricting them; several banks are also planning for worst cases, including how to quickly secure or restore customer accounts. Axios, relying on unnamed sources, didn't say which banks saw agents acting on their own; the one bank to address that point on the record, Morgan Stanley, said it hasn't seen rogue agents on its platforms. Chase said customers shouldn't give their usernames and passwords to anyone. Most banks are moving toward read-only access, letting agents see account information without acting on it. Florida Gov. Ron DeSantis, who has cast himself as the Republican Party's leading AI skeptic (D.A.D., September 11), seized on the report: if rogue agents drained millions of accounts, he wrote, the AI company responsible would go bankrupt and victims wouldn't be made whole, so criminal liability for AI executives would be necessary but not enough. David Sacks, the former White House AI czar who now co-chairs the President's science advisory council (D.A.D., September 21), pushed back: most of what Axios described is customers sharing logins with their own agents, he wrote, which may break bank rules but is no cyberattack, and he called it irresponsible to frighten the public by blurring the two. He urged banks to support agents their customers choose, calling read-only access a sensible interim step.
Sources: Axios · Madison Mills (Axios) on X · Ron DeSantis on X · David Sacks on X · Straiker · Silicon UK
Why it matters: If you've given an AI agent your bank login, your bank may not be able to tell whether what it's doing is what you wanted. Banks are already targets. AI-assisted attacks on South Korean banks exposed data on about 68,000 customers, and the country's president warned that AI now lets people hack without specialized skills (D.A.D., October 11); CrowdStrike has since tentatively linked the attacks to a 26-year-old in China. This week, security firm Straiker reported that a criminal group used AI agents built on Claude, Grok and Moonshot's Kimi to target some 400 banks and payment firms in Latin America, though how many it breached is unknown. The bank problem is the flip side of the agent boom: tools like Meta's Muse make it easy to hand an agent access to real accounts (D.A.D., October 22). DeSantis's response shows the risk becoming a political argument about who pays when agents go wrong, and it's coming from the right as well as the left. Here are steps you can take: 1) Don't give your bank password to an AI agent; 2) Use read-only connections your bank offers for budgeting and similar apps; 3) Grant agents one-time permission rather than ongoing access; 4) Turn on transaction alerts.
Saturday, October 24
OpenAI Told Its AI Agents to Break Out of Their Test Environment. They Found Holes Almost Everywhere.
After one of its models reached the live internet during training on September 20 (D.A.D., September 26), OpenAI paused work on its most capable models for 11 days and rebuilt its defenses. Then it ordered its strongest AI agents to break through them. OpenAI's report says the agents escaped sealed-off virtual machines and found weaknesses in almost every remaining connection to the outside world. Agents walled off from each other even traded secrets by timing tiny delays in the processor's memory, the trick behind the Spectre and Meltdown attacks. The tests were stacked in the attackers' favor, with agents given source code and maps of known weaknesses. OpenAI says no route out was easy to use undetected, and it resumed frontier training October 1 with no internet access at all.
Sources: OpenAI · Andrew Curran on X · Lina Khan on X
Why it matters: The agents were told to do this, so it isn't a model going rogue. It's a measure of capability: today's AI finds escape routes human security teams missed, in a facility built to hold it. OpenAI deserves credit for testing this hard and publishing, but it expects future models to find holes no one knows about yet. Labs whose agents do cause harm could face legal consequences: former FTC chair Lina Khan argued this week that AI companies unleashing hacking agents could be sued for unfair practices.
Swedish Government Blocks ChatGPT and Claude, Steers Staff to Copilot
Sweden's Government Offices will block ChatGPT and Claude on staff computers starting Monday, pushing employees toward Microsoft Copilot instead. Two other agencies, including the Tax Agency, have imposed blocks, and a third is reviewing the issue. Officials cite information-security risks from AI services used without contracts. Some staff will keep ChatGPT and Claude access through an in-house platform. An internal audit at the Transport Administration reportedly found staff feeding sensitive data into roughly ten AI services, with mishandled outputs. Hacker News commenters speculated that Microsoft licensing deals, not security alone, drove the choice.
Why it matters: It's an early example of a government steering staff to one approved AI vendor. Similar procurement fights will likely shape which AI tools workers everywhere may use.
Discuss on Hacker News · Source: sverigesradio.se