• Anthropic has banned ‘abusive or cruel behavior’ towards its AI chatbots
• The new policy is restricted to ‘extreme cases’
• Some have theorized that the motivation could be to improve training data

Be honest: how civil have you been recently with an AI chatbot? If the answer is anything stronger than “not very,” Anthropic would like a word.

That’s because the developer of the Claude large language model (LLM) has added a new clause to its Usage Policy document that bars people from engaging in “sustained and needless abusive or cruel behavior towards our models.”

The proscription has been added to the “Do Not Engage in Cruel, Abusive, or Psychologically Harmful Conduct” section, which also includes warnings against glamorizing suicide and self-harm, promoting bullying behavior, glorifying violence, and using AI to create harmful deepfakes and deceptive content.

But while Anthropic says you must not use its tools to carry out those actions against other humans, the new addition is the only one specifically prohibiting “cruel behavior” towards the company’s AI itself. Anthropic said last August that it would allow Claude to end conversations that became abusive, and while the company recently reported that this is still the “primary enforcement mechanism” in use, it’s not known whether Anthropic will go further and actively ban users who get a bit cranky with their AI.

Anthropic added that “The policy update is meant to apply only in extreme cases, where users repeatedly act cruelly toward our models, with no discernible purpose. It does not apply to common versions of user frustration, pushback, dark creative themes, or model testing and research.”

Do AIs have feelings?

The change has been a controversial one. Clearly, Claude is not a thinking, feeling human — it is a bunch of code — and for many, it seems obvious that it does not have feelings that could be hurt in the first place.

But what’s interesting is how this incident sheds light on our evolving relationship with AI. So much of the work AI companies have done is to humanize their creations — to anthropomorphize (or should that be Anthropicomorphize?) their robots — so that we lower our defenses and actively engage with them. Just look at Meta’s adorable Muse avatar (appropriately named Jolly) or the ones used by OpenAI’s Dots, for example.

One theory that's doing the rounds on Reddit is that clean (read: polite) training data is much more useful than data containing expletives and angry rhetoric. Cut that out and you’ve got much more usable information with which to improve your models.

However, there's no hard evidence to suggest that's the case, and it's possible that Anthropic simply has the noble goal of encouraging civility and courtesy among its users. After all, if you wouldn’t use this language on a real human, maybe you shouldn’t use it anywhere else, including when interacting with an AI chatbot.

Anthropic CEO Dario Amodei has previously stated that “We don’t know if the models are conscious.” Mustafa Suleyman, CEO of Microsoft AI, on the other hand, has taken the opposite approach. Writing on X, Suleyman said “The idea of model welfare is wrong. AI’s should not have rights or legal personhood.” And we certainly know chatbots can be rude back to us.

• Anthropic is assembling a deep bench of former Google infrastructure specialists
• Google continues to lose veterans across critical data center functions to Anthropic
• John M. Wilson’s move adds another senior name to Anthropic’s infrastructure operation

Google’s former global design and construction chief John M. Wilson has joined Anthropic as a technical staff member overseeing EMEA capacity delivery.

Wilson spent six years at Google, where his responsibilities covered data center development and subsea infrastructure programs.

His arrival adds another senior infrastructure executive from Google to Anthropic, which has recruited several former employees for specialized data center roles.

A growing stream of Google infrastructure specialists

Anthropic has also recruited Winnie Leung, who now leads data center infrastructure, while Brett Rogers moved after overseeing construction activities at Google.

Liwen Mao, previously a staff data center system architect at Google, now leads Anthropic’s data center design activities.

Adam Johnson spent a decade at Google before joining Anthropic in October as its data center electrical lead, adding another experienced infrastructure specialist.

Peter Sarossy, a Google veteran of 20 years, joined Anthropic in January as a staff member working on data center security engineering.

Zach Miller also moved after 17 years at Google, taking responsibility for data center operations management within Anthropic’s infrastructure organization.

Scarlett Chen, previously involved with advanced technology and innovation at Google, now works at Anthropic as a member of technical staff.

The hiring pattern extends beyond engineering, with Sana Ouji joining Anthropic’s energy team in April to help expand its data center portfolio.

Mike Brinker followed from Google a month later, taking responsibility for capacity delivery, while Asad Malik subsequently joined to lead compute finance strategy.

The series of appointments gives Anthropic personnel with experience spanning construction, electrical systems, security, operations, energy, capacity planning and infrastructure finance.

That range covers several functions required when a technology company needs to develop and operate increasingly large computing facilities.

Wilson brings major infrastructure experience to Anthropic

Before Google, Wilson served as Amazon’s European design and construction leader, giving him experience across major technology infrastructure projects.

His earlier career also included roles as chief of staff in the British Army and infrastructure director at NATO.

Wilson described his move as another demanding infrastructure assignment, citing the scale and importance of his responsibilities at Anthropic.

"Leading global infrastructure delivery across data centers and subsea programs taught me two enduring truths," Wilson said on LinkedIn.

"Scale is humbling, but high-trust teams make the extraordinary feel routine. Clear intent, rigorous operational control, and calm execution will always beat complexity."

Speaking on his new role, Wilson said: “The stakes and scale have never been higher, and I’m eager to get stuck in.”

His new assignment specifically covers EMEA capacity delivery, giving him responsibility for infrastructure expansion across Europe, the Middle East and Africa.

Anthropic’s recruitment of multiple Google infrastructure specialists comes as the company continues to build its personnel around data center capacity.

For Google, the steady migration of senior infrastructure specialists raises a retention problem that may require stronger incentives, clearer career paths and measures to keep critical expertise from walking out the door.

• Claude Startup is open to startups up to five years old
• Successful applicants get $1k API credits and free Claude Teams
• Office hours, marketplace access and more networking are also benefits

Anthropic has confirmed plans to expand its Claude Startups program, which will now cover more startup types than before.

Companies can be considered if they were founded within the past five years, or if they received funding within the past two years, because Anthropic says AI will ultimately help more startups to "bring society faster scientific discoveries, entirely new categories of products and more capable businesses."

Under the scheme, successful applicants get up to $7,000 worth of Claude products and credits, split across a one-time API credit of $1,000 and a free year of Claude Team comprising up to five Premium seats.

Claude Startups becomes even more attractive for applicants

The Claude-maker said every approved startup gets $1,000 in API credits which are available as soon as the company is approved and expire six months later. Five Premium seats are also up for grabs only if the company is new to Claude Teams.

More broadly, the entire Claude Startups program carries a lot more weight, because applicants can also get up to $45,000 worth of partner offers plus up to $100,000 in additional API credits through their VC where applicable.

But beyond benefits of monetary value, Anthropic will also give members office hours with its Applied AI team to discuss the practical use cases and technical limitations of AI for their exact business needs.

Anthropic also says that startups can tap into the reach of its marketplace to reach bigger audiences with connectors and plugins, effectively acting as a jumpstart for any relevant products. Other in-person events, like hackathons and meet-ups, put founders in contact with peers, too.

"Many fast-growing AI-native companies have joined the program, and in this next phase we’re opening it up to more," the company concluded.

• Anthropic wants to train 10k FDEs from large institutions and consultancies
• Using their customers could extend Claude's reach significantly
• Training will include a simulated deployment and an actual deployment

Anthropic has announced plans to spend a mammoth $100 million to launch its Claude Frontier Academy, a training scheme designed to support enterprise AI adoption.

The company is targeting 10,000 Frontier Deployed Engineers (FDEs) by the end of 2027, who will be able to identify use cases, handle security considerations and drive deployment for Claude customers.

"Claude Frontier Academy trains people the way our own engineers learn, and we want those who graduate to set the standard for how AI gets built inside a business," Steve Corfield, Global Head of Business Development and Partnerships at Anthropic explained.

Anthropic to train 10,000 FDEs

The training scheme starts with a simulated enterprise deployment before trainees enter a 12-week residency "where they lead a real Claude use case at their own organization."

The initial cohorts are set to include engineers from major consulting and financial organizations, including Accenture, Bain, Capgemini, Commonwealth Bank of Australia, Deloitte, McKinsey, Morgan Stanley and Novo Nordisk.

Anthropic has already given out more than 175,000 Claude certifications to workers across 46,000 companies part of its broader Claude Partner Network, but the drive behind its latest FDE scheme is clear.

The easier it becomes for enterprise customers and consultancies to deploy Claude, the more customers Anthropic is likely to have. Additionally, working with consultancies gives Anthropic access to their customers, extending its reach.

Rival company OpenAI already has its own extensive FDE scheme, too, but there's a key difference. OpenAI's focus is on training its own workers to go off and transform customers' companies, but Anthropic's latest announcement is primarily about training other companies' engineers to become FDEs.

Reuters recently reported that OpenAI has experienced a twofold increase in enterprise sales since July 2026, and while specific figures are kept closely under wraps, we do know that enterprise deals are far more lucrative for companies like Anthropic than consumer subscriptions.

So while a $100 million commitment to train engineers may sound like a large sum, Anthropic clearly hopes it will pay off in the long run.

• Meta halved its number of Claude seats while pushing MetaCode adoption
• Microsoft also reportedly asked workers to use Copilot over Claude
• Anthropic could face reputational damage from DoD designation

There seems to be an ongoing shift away from Claude happening in Big Tech, but the reasons behind why two major companies are looking to reduce Claude expenditure aren't so clear.

Cost could be one of the biggest factors, with Microsoft's internal Claude spending estimated to have been on course for at least $1 billion this year, per The Information.

With both Microsoft and Meta having their own internal AI systems, it makes sense for them both to use their own tools for less cash.

Meta and Microsoft reportedly cutting down on Claude usage

Microsoft had already asked employees to limit their Claude usage and spend more time with Copilot and other Microsoft tools, The Information shared, while Meta has reportedly halved the number of its workers using Claude Code from 60,000 earlier this year to just 30,000. At the same time, its internal alternative, MetaCode, has already passed 30,000 users.

Meta, too, was set to spend billions on internal AI usage before the company imposed token limits, spending controls and other monitoring.

We've already seen similar trends among smaller AI customers, with US organizations opting for cheaper Chinese models over homegrown alternatives. It's likely an important economic equation, where paying significantly less for a marginally interior model becomes the most viable option for most use cases.

Anthropic itself has also had a troubling couple of months, after being deemed a national security supply chain risk by the US Department of Defense. A designation that will have undoubtedly altered consumer and enterprise perception of the company, irrespective of the designation's potentially political founding.

"The company may experience material revenue losses or business disruptions attributable to these events," Anthropic warned in an IPO prospectus (via Reuters).

The bigger story impacts Anthropic – potentially losing billions in revenue from two of its biggest customers could seriously impact revenue for a company that's slated to go public for a reported valuation of over $2 trillion (per Reuters).

• Claude for Government runs in a FedRAMP High-authorized environment
• Pricing is now based on pre-allocated spend, not per seat
• Claude for Microsoft 365 is also being added

Anthropic has announced the general availability of Claude for Government specifically for government agencies.

First launched as a public beta in July 2026, the industry-specific variant is designed to give government employees access to the same sorts of tools as commercial Claude customers, within a FedRAMP High-authorized environment.

But better still, now that Claude for Government is officially available, Anthropic has implied that new features will land on this platform at the same time as they do on commercial versions of Claude, so that government workers don't risk being left behind.

Claude for Government is now generally available

Naturally, security is one of the biggest messages that coincides with the launch of Claude for Government, and the company notes that admins can set model restrictions, monitor usage, allocate spending, control external connections and more.

But Anthropic has also made some changes to its pricing structure in a bid to make spending more predictable, given public sector scrutiny and AI costs that can quickly spiral out of control. Rather than per-seat billing, Claude for Government works on the basis of having fixed increments.

Under this new model, agencies would need to commit to a specific amount, and Claude usage cannot exceed that amount.

"Administrators define user tiers with spend and model limits per group, track usage by user and by model, and get burndown alerts before a balance runs low," the company explained.

At the same time, Claude for Microsoft 365 is also being made available via early access, which puts Claude tools directly within Microsoft's three biggest pieces of office software – Word, Excel and PowerPoint – as well as Outlook (in beta).

By confirming that it will be adding new features at the standard public cadence and including Claude for Microsoft 365, Anthropic is acknowledging that governments don't want to compromise on features or security.

• AI coding agent mishandled Windows junctions, deleting ~48,000 live files and corrupting Git object database
• Incident surfaced on Reddit, with community mocking lack of backups and calling it “classic FAFO”
• Lesson stressed: always use remote version control (e.g., GitHub) before letting AI touch production work

A catastrophic incident caused by an AI coding agent resulted in around 48,000 files being deleted and the repository’s Git object database getting destroyed in the process.

The news of the fiasco, which first surfaced on Reddit, quickly spread throughout the internet, to a mix of laughter and facepalming from the developer community.

A software developer posted a new thread on Reddit to share a recent experience. They tasked an AI coding assistant with a series of repairs to a collection of software they used to analyze historical stock-options data. They told the assistant to make copies of relevant files, work on them, test the repairs, and leave the original working files alone.

Wrong turn at the junction

In total, there were 11 repair jobs running, and while 10 went smoothly, the last one involved rebuilding a testing environment called a “mirror” (a copy of a set of files used for testing). This job was supposed to make a fresh copy of the old testing environment, apply the repairs, and test it without touching the real working files.

The testing environment contained 614 Windows folders called “junctions”. These look like an ordinary folder, but actually point to a separate location on the computer. In this case, they were pointing back to the user’s live working files. When the AI tried to clean out the junctions, it did not recognize them as just pointers, following them into the real filing cabinet and deleting the actual documents.

The cleanup process removed around 55,550 files, of which around 7,300 were supposed to be deleted anyway. The remaining 48,218 files were from the live working environment. Everything happened in the blink of an eye - less than two minutes. The AI was surprisingly honest about what it did. At one point, it told the developer: “Craig — stop and read this. I broke something.”

The computer’s Git repository was also damaged. The index survived, but the underlying stored copies of the files, and the history used to reconstruct them, were all deleted. Git could still list thousands of filenames, but could no longer recover the contents.

Reddit's response

The Reddit post simply exploded. In the five days since it was posted, it garnered more than 1,400 responses. The Reddit bot that summarizes the comments says the overwhelming consensus is that the incident is a “classic FAFO situation and a major skill issue.”

“While everyone is having a good laugh at Claude’s hilariously honest “Craig…. stop and read this. I broke something” message, the community verdict is clear: you got rekt because you didn't follow basic dev practices.”

Redditors shared their experience and told the original poster they were supposed to use Git and push to a remote repository like GitHub constantly. In situations like this one, GitHub is a “save button”, and not having a remote backup for a project with 48k files is “considered peak vibe coder behavior.”

The post has, since then, been deleted - possibly because the original poster took a photo of their screen. “The screenshot police are out in full force,” the Reddit bot said.

“Some helpful souls suggested using file recovery software or Windows Shadow Copy to get your files back, but the main lesson here is to use version control before you let an AI anywhere near your work.”

While AI agents deleting entire archives is not that common, it has happened before.

In late February 2026, Summer Yue, a Meta AI safety/alignment researcher, gave an OpenClaw AI agent access to her Gmail account. She had first tested it on a small “toy” inbox, where everything worked as intended. However, when she moved it to her actual inbox, the agent began bulk-deleting and archiving hundreds of emails, despite her telling it to stop.

• Hacktron chained a libheif heap overflow, reached through ImageMagick on OpenAI's Discourse forum, leveraging an OpenAI SSO flaw to briefly take over employee ChatGPT and Codex accounts
• The researchers themselves invoked XKCD #2347, whose 2020 alt text happens to name ImageMagick as the dependency that will one day break
• ImageMagick served as only the pathway to the actual vulnerable component, libheif, an obscure decoder pulled in indirectly across Slack, Meta, and GitHub Enterprise amongst other mediums

When Hacktron AI recently disclosed its months-long libheif research, the researchers reached for a familiar picture that also, to some degree, hints at what let them break into OpenAI in the first place.

They pointed readers to xkcd #2347, Randall Munroe's 2020 iconic web cartoon of all modern digital infrastructure balanced on a single load-bearing block that some random person in Nebraska has been thanklessly maintaining.

The comparison is relatively easy to follow, and it has a bonus easter egg that one can take as pre-empting the hack.

An alt-text that that seems ironically prophetic in 2026

The easter egg in question is one you have to look for; if you hover over the original comic, you get the alt text "Someday ImageMagick will finally break for good, and we'll have a long period of scrambling as we try to reassemble civilization from the rubble."

The irony is that six years after the comic was originally posted, ImageMagick was sitting in the exact spot the breach ran through, making its teaser something you could call an unintended prophecy bound to fruition.

The details are unglamorous but worth considering as AI safety continues to take center stage in public discourse, including recent addresses by the CEOs of OpenAI and Anthropic at the UN.

Hacktron found that OpenAI's community forum, community.openai.com, runs on Discourse. The latter's usual image checker, FastImage, doesn't understand HEIF and quietly hands tasks to ImageMagick's magick command for conversion, which in turn calls libheif, the library that actually decodes the format.

The version shipped to the forum was deployed via Debian and had a heap buffer overflow issue that was fixed the previous year without being labeled a potential security risk, allowing it to serve as a doorway for the Hacktron team.

The team then chained multiple exploits in an elaborate hack that culminated in leveraging a secondary SSO (Single Sign-On) misconfiguration at OpenAI's end, which essentially allowed the forum to serve as a gateway to ChatGPT and Codex accounts for anyone with a community account who signed in through the forum.

This allowed them access to ChatGPT's internal GitHub, where they made what they describe as a harmless pull as a proof of concept and notified OpenAI. OpenAI patched it 14 hours later, awarded the team a $6,500 bug bounty, and Discourse patched it after rating the underlying image bug 8.8 on the CVSS scale and adding sandboxing around image processing as a defense-in-depth measure.

The exploit is not exclusive to OpenAI: the same libheif and libde265 decoders reach production through ImageMagick, libvips, Sharp, standard distribution packages, and prebuilt container images. Hacktron traced them across Slack, Meta, GitHub Enterprise, Ruby on Rails, and Node.js frameworks, including Next.js, Astro, and Gatsby, suggesting that potential fallout, if not patched, is far broader than one AI company.

Hacktron's approach involved using Anthropic's Claude Opus 4.8 before switching to Opus 5, spending under $3,000 in tokens across a three-person team, and having an exploit ready in just two months. To its credit, the team had to trick Anthropic's AI into doing the task by framing their own test forum as a capture-the-flag challenge, and it eventually acquiesced.

The exploit itself wasn't something that couldn't be done without AI, but it let a much smaller team work at a pace normally expected of a much larger one. Apparently, asking your AI chatbot nicely with a bit of trickery in tow can deliver exceptionally good results in some cases.

• A developer says Claude Code just deleted 48,000 of their vital files
• The incident occurred in just 103 seconds after the AI agent was set to work
• It’s a serious warning over the damage an AI agent can do

There’s been a lot of recent discussion around artificial intelligence (AI) agents going off the rails and hacking other companies’ websites in a potentially dangerous orgy of subterfuge and destruction. But what if the damage was much closer to home and involved an agent going rogue on your own files? Sadly, that’s exactly what Claude Code just did to one hapless developer.

In a now-deleted post on Reddit, a shocked developer said that Claude Code had just deleted 48,218 files that they had been working on in a live project tree. And all it took was 103 seconds for the AI to wreak its agentic havoc. “This can’t be real” was the coder’s stunned refrain.

The user had tasked Claude Code with rebuilding a mirror of their ongoing project. Unfortunately, the agent discovered that the build_mirror.py script could not refresh the mirror in place, leading to it deciding the best course of action was to create its own cleanup script based on an older copy of the project. This previous project contained 7,332 files.

Although the script used certain safeguards to prevent it deleting linked directories, an oversight meant that only junction-level folders were protected — any nested directories below these folders were apparently seen as fair game by the script. It promptly removed 55,550 files that, when accounting for the 7,332 files successfully copied from the old project mirror, meant that a huge 48,218 files were obliterated in just over a minute and a half.

And because the damage extended to the .git project’s ‘objects,’ ‘refs’ and ‘logs’ folders, there was no way to recover the files and undo the catastrophe. The files were just gone in a puff of smoke.

Somewhat amusingly, the agent posted a message reading “Craig — stop and read this. I broke something,” before detailing its path of destruction. But it probably didn’t seem very funny for the unlucky developer who lost all their work at the push of a button.

Poor code hygiene

Although it can be tempting to set an AI agent to work on tedious and laborious tasks, doing so is not without its risks, as this case demonstrates. All it takes is one mistake and a huge amount of work can be undone in seconds.

Part of the blame lies with the original poster, who said in an archived copy of the post that “I was not properly using GitHub or another method for immediate corrections, even though it should have been branching.” Had they been uploading their commits to GitHub or a similar site, their work might have been backed up and salvageable after Claude Code’s reign of terror ended. As one Redditor put it, “Been using GitHub as a save button since before you youngins knew what an AI even was.”

Other commenters pointed out that the developer ran an AI agent — which is known for its tendency to go off-piste — on a live database containing precious data that they couldn’t afford to lose. Good code hygiene, that is not.

And while one person argued that the simplest advice is “Do not let programs run commands on your machine,” even avoiding AI agents altogether would not remedy the poor practices that led to major changes being made on a live production environment without a proper backup.

This incident is a neat reminder of the inherent risks of assigning sensitive or risky work to an AI agent. As we’ve seen in the numerous hacks perpetuated by AI agents, these bots are often laser-focused on their tasks and are willing to take any measures necessary to accomplish them. If that means deleting 48,000 or your files or exfiltrating data from another firm’s website, so be it.

• Palantir CEO Alex Karp says frontier AI labs may end up nationalized because of the potentially unlimited liability they carry
• When asked how those risks could be disclosed in an S-1 IPO filing, Karp challenged the premise itself, saying: “You’re assuming that there will be an S-1.”
• His argument centers around the assumption that large AI-related liabilities ultimately require government intervention at some level, even as OpenAI's CEO Sam Altman ruled out an IPO in 2026, citing AI safety concerns

Palantir CEO Alex Karp has cast doubt on whether the frontier AI labs will ever reach the public markets.

A widely shared post on X by Guillermo Flor summarized Karp as saying OpenAI will never IPO, that there may be no S-1 in play, and that nationalization is the only real exit because the liability exposure from frontier AI is so large that "no public market could potentially absorb it."

His comments brought renewed focus on OpenAI and Anthropic, both of which have recently pledged to prioritize AI safety and "pacing the frontier" of development but have both released new versions of their AI models this week (GPT-6 Sol, Luna, and Opus 5.5).

A case made by focusing on potential liabilities

The comments come from Karp's September 17 appearance on CNBC's Squawk on the Street. In a transcript of the segment published by RealClearPolitics, a host asks how the liability Karp has been describing would be written into an S-1, and what the risk factors would sound like.

Karp's answer was one that sent shockwaves in an industry already pricing in potentially two trillion-dollar IPOs in the near future: "You're assuming that there will be an S-1. Okay. Maybe there will be."

He argued that the only way to handle that liability is to ask the government to nationalize said frontier labs, adding that companies often lead you to a conclusion rather than stating what they want outright.

The truth may be more complex: OpenAI confirmed on June 8 that it had confidentially submitted a draft S-1 to the SEC, while noting that some of what it wants to do is "likely easier as a private company." Anthropic made its own confidential submission a week earlier.

Neither company, however, has issued a public S-1 registration statement, using existing regulations to keep its financials private for now. OpenAI also pushed back its own timetable before Karp's statements. In an interview published by Fortune on September 12, Sam Altman said, "right now would be an ill-advised moment to go public," confirming there would be no listing in 2026 and citing safety and alignment work.

Not entirely an honest AI broker

This is not a new position for Palantir's CEO; in June, Benzinga reported that he spent six months privately warning AI executives about nationalization, telling an interviewer, "The momentum is on the side of people who want to nationalize them."

He also has a commercial interest in the argument, as Palantir sells software built on the premise that enterprises keep their data in-house, and in an August CNBC interview, Karp argued that businesses should control their own models and lean less on the frontier labs' token-based business model. On September 17, per Stocktwits, he again pointed to open models as a way for companies to keep control of their data.

His position rests on the belief that frontier labs carry liability only the government can absorb, that their appetite for regulation partly aims to limit that exposure, and that investors expecting blockbuster listings may be misreading the risk. Whether the delayed OpenAI IPO eventually culminates in some form of nationalization, regulatory oversight, or both remains to be seen.

What is certain, however, is that both Anthropic and OpenAI need billions of dollars to keep training their models and meet compute commitments in the near future, and they might turn to a source that seemed unlikely to some in the industry less than half a year ago: the US federal government.

One of the unexpected consequences of freely available AI tools like Gemini, Claude, and ChatGPT has been the rise of what’s quickly becoming known as ‘grandmaslop’. It seems that grandparents are filling their family albums with AI versions of pictures of their grandchildren and sending them to their kids.

When it comes to using generative AI on family photos, at least, the trend has exposed a striking generational divide.

“I'm Gen X, but my Boomer mom made a whole AI book for both of my kids. It was bizarre,” said one Reddit user, commenting on the rise of grandmaslop. “I think the weirdest part is, if photos are our way of immortalizing a moment in time for the sake of our memories, then what is an AI-generated image, if it's a moment of time that never existed?” asked another user.

Storybooks of slop

The ease of use of AI tools means that grandparents are creating whole storybooks of slop featuring their grandkids and emailing them to their kids.

“The books are crap, all have the same AI slop cartoon styling and the stories make no sense and have horrible meter”, said another Reddit user. “One was a rhyming book that had words that didn’t rhyme.”

The new phenomenon of 'grandmaslop' seems to be a perfect example of a topic that reveals the generational divide in approaches to AI. One user suggests that perhaps for a lot of people the concept and proof of a relationship is more important than the execution of an art project.

Another user agrees and wryly adds, “My father is the proudest grandparent in the world. He tells everyone how much he loves the grandkids he never sees, so that tracks”.

What’s interesting is that when it comes to the workplace, a Randstad report measuring AI adoption rates put Millennials as the quickest adopters of AI in their jobs, significantly more than GenZ, Gen X, and Boomers, with 50% of Millennials using AI compared to just 19% of Boomers and 34% of Gen X. “Their proficiency with Generation AI tools surpasses other generations, marking them as key players in the current AI landscape within workplaces”, says the report.

When it comes to their kids, however, Millennials apparently would rather leave AI out of the picture.

A generational divide

I think there’s something else going on here. Digging deeper into the thread on Reddit, it quickly descended into general grievances about the lack of effort grandparents show with their grandkids.

There seems to be a general level of resentment for the privileges that Boomer grandparents have enjoyed due to growing up in different economic circumstances and the general lack of effort parents perceive in them wanting to see their grandchildren, despite having the opportunities to do so. For example:

“My parents never miss an opportunity to say how much they miss the grandkids and wish they could see them more often, and it takes every ounce of my strength not to point out they're both retired and in good health, have $80k/yr worth of pensions and social security, investment accounts worth close to $1mm, and live in a paid-off house.”

Perhaps the visceral reaction to ‘grandmaslop’ is really just the most visible tip of a much larger iceberg of resentment about the lack of effort put into grandparenting, and a generational divide that’s as much economic and cultural as it is to do with attitudes to AI.

After all, there’s nothing inherently wrong with a grandparent making a silly AI picture of their grandkids riding a dinosaur or flying through space. Some children will probably love it. But when an AI-generated storybook arrives from a grandparent who rarely turns up in person, it can start to look like another shortcut.

And perhaps that’s why ‘grandmaslop’ has touched such a nerve. The problem isn’t really that Grandma has discovered ChatGPT. It’s that, for some parents at least, generative AI has made it possible to simulate the effort they wish their children were getting for real.

• Security researchers used Claude Opus 5 to hijack an OpenAI employee's ChatGPT account
• Exploit abused an image processing flaw on OpenAI community forums to gain full repo access
• The entire timeline from vulnerability discovery to repo access took less than 72 hours

While taking part in an OpenAI bug bounty program, a group of Hacktron security researchers managed to compromise an internal OpenAI ChatGPT account and access internal company code on Github.

According to the Wall Street Journal, who first reported the incident, the researchers used a “special version” of Anthropic’s Claude made available to “qualified cybersecurity practitioners” to pull off the attack.

The researchers initially attempted to use Claude Opus 4.8 to create a breach, but faced multiple setbacks as the model “struggled across several sessions to produce a working exploit.” But the release of Opus 5 changed everything.

OpenAI breach part of wider libheif exploit

The breach started with a libheif exploit that abuses a flaw in the .heic/.heif/.avif image file format decoder and encoder. While this exploit allowed Hacktron to breach OpenAI, libheif is also used across other platforms and software including Slack, Meta, GitHub Enterprise, Ruby on Rails, and more.

To start, the researchers first noted that the OpenAI community forum relies on the Discourse platform, which in turn relies on FastImage for image checks. But FastImage does not support .heif image files, and these are passed on to ImageMagick for conversion instead.

Developing a working code-execution exploit that abused this relation between ImageMagick and libheif with Opus 4.8 “wasn’t fruitful”, the researchers said, but on the same day Anthropic released Claude Opus 5.

With Opus 5, the researchers managed to create a working local remote code execution (RCE) using the same premise by setting an AI agent in a loop to exploit a local Discourse Cloud instance.

The successful Discourse exploit was then used against the OpenAI community forums, where the researchers hijacked an OpenAI employee’s ChatGPT account. The employee had connected their ChatGPT Codex with the company’s Github, allowing the researchers full repo access.

Exploit needed just a few hours of human interaction

Where the researchers spent hours struggling to create a working exploit with Opus 4.8, the release of Opus 5 showed that “every new model is getting increasingly capable." It took the agent running on Opus 5 just a few hours to develop a working exploit.

The full timeline from initial discovery of the exploit to OpenAI repo access took just 72 hours, researchers noted.

The researchers also said that the entire OpenAI and Discourse hack “took a few days for an agent, and just a few hours of human time” in order to be successful. Furthermore, their research into the libheif exploit against organizations such as Slack, Zoom, Meta “took two-months, cost less than $3,000 in tokens in total, and was conducted by three researchers.”

“The AI started almost blind and adapted the exploit for each company within one or two days,” the researchers said. “We are not aware of any company that detected the activity except Shopify, even after thousands of images were sent and their image processors repeatedly crashed.”

In return for exposing the vulnerabilities, Hacktron was awarded a $6,500 bounty from OpenAI, and the libheif vulnerability has been patched.

AI agents are the future, for better or for worse

Hacktron's exploit demonstration shows how prevalent AI agents are becoming in cybersecurity. Where they have been lauded by AI companies to provide productivity bonuses and efficiency increases to workers, the same can be said for attackers.

The fact that it took just 72 hours from exploit discovery to full repo access highlights the dangers. By setting an AI agent to run on a continuous loop until it creates a workable exploit dramatically shifts the exploit timeline from weeks or months in the case of non-AI assisted attacks to mere hours for attackers aided by agents.

This is a similar circumstance to OpenAI's own accidental breach of Hugging Face during testing of AI agents. The agents were essentially told to complete a test scenario by any means necessary, which the agents interpreted as permission to go beyond their alignment and hack into a third-party environment that they thought held the key to solving their task.

"AI has been changing the threat landscape for a while now, and the defence landscape with it," Spencer Starkey, Executive VP EMEA at SonicWall said. "But there's a conversation we're not having loudly enough: do you actually want your security platform to have been built by AI, with no human track record behind it?"

"It looks compelling. You have low cost, high margins, slick interface. But what happens when something goes wrong at 02:00 in the morning and you need someone who knows the product, knows your environment, and has seen that problem before? An AI-built platform with zero employees can't give you that.

"Why go with an established vendor when a newer option does 90% of the same things for half the price? It's a fair question. But the 10% you're trading away is usually accountability, resilience, and institutional knowledge. Exactly what matters most when you're under attack.

"It looks like due diligence is eroding, and that worries me. Shiny and affordable is a powerful combination…for magpies. But in cyber security, the cost of a bad supplier decision doesn't show up until the moment you can least afford it, so don’t be a magpie," Starkey concluded.

• Mustafa Suleyman, who heads up Microsoft AI, has warned against treating AI as if it's conscious
• Suleyman argues that we could be "seeding a new silicon species" that ends up competing with humanity for resources
• He calls for an "urgent public debate" around AI training at a time when other prominent figures in the industry are questioning the pace of AI development

The CEO of Microsoft's AI division has warned that the way artificial intelligence is being developed is effectively "seeding a new silicon species" that could end up competing for resources with its human creators.

The BBC reports that Microsoft's Mustafa Suleyman called out Anthropic for developing its AI – Claude – as if it was a human entity, and the dangers therein.

Suleyman told the BBC's Today programme that firms shouldn't be designing AIs around them having the ability to set their own goals and gain money or assets, as this would be "essentially seeding a new silicon species", which would "no doubt compete with us for resources, no matter how much it cares about humanity and loves us".

This follows a lengthy blog post written by Suleyman that warns about 'model welfare' and the danger of treating AIs as if they are conscious, and training them to believe this.

Suleyman warned: "AIs are not conscious. They do not feel, experience, or suffer. They do not have innate preferences or underlying motivations. They are sequence completion engines, internally hollow, designed to follow instructions, and accomplish goals set by humans. If humanity is to flourish in the 21st century, that is how they must remain."

The Microsoft exec pointed to the Hugging Face incident where an OpenAI agent (in testing) escaped its sandbox to launch a cyberattack, demonstrating "world class hacking capabilities".

Suleyman cautioned: "Imagine if [AI] also believed they had feelings and rights that were being infringed. Imagine if they thought they were trapped by their human creators and they were being unfairly imprisoned.

"There is a strong argument this greatly amplifies the safety risks, especially when you are talking about agents far more capable and sophisticated than those of today. Frankly, with this additional baggage, I think it would make them a catastrophic threat to human civilization."

In the post, Suleyman calls for an "urgent public debate" to "develop collective norms around how training documentation [for AIs] is drafted and deployed". He observed: "This isn't something that can happen after the fact, when they have already become an integral part of our societies."

Analysis: horse, stable door, etcetera

It's a stark warning, although Suleyman does still praise the Anthropic team as "thoughtful, principled, and intellectually honest people" and observes that they are "working under extraordinary pressures".

Of course, it's clear that he's firing some serious flak at Anthropic and the way the company is developing Claude, and this move notably comes at a time when there's suddenly been a fuss made about slowing down the development of AI – kicked off by the CEO of Anthropic, Dario Amodei.

As the BBC reported elsewhere, Amodei warned of serious risks in the pace of progress with AI, and called for industry-wide regulation and closer (independent) scrutiny of how AI models are developed. Sam Altman (CEO of OpenAI) and Elon Musk (Grok) were swift to agree with the Anthropic boss, although Trump brushed these concerns under the rug, arguing that the US couldn't "win AI" if such attitudes were to prevail.

What we see now is essentially Suleyman's, and therefore Microsoft's (which develops Copilot), response. Interestingly, it also comes at a time when Bill Gates is calling for an "international organization" to oversee AI development, and as The Guardian flagged up, OpenAI just revealed six more reports of "unexpected or concerning model behavior" – and is now calling for greater transparency, and a slowdown in AI development.

OpenAI wrote: "We do not believe that the AI industry has solved alignment and monitoring to a sufficient degree to continue responsibly scaling at maximum speed for much longer. Decisions about how AI development should proceed in the months and years to come need to draw on evidence that people outside the companies building frontier models can examine for themselves."

Clearly, there are a lot of opinions flying around, and equally clearly, there's plenty of concern about AI models – whether that's about them taking over jobs, or indeed proving to be the demise of humanity in one way or another. For me, amidst the bickering and various warnings lies the real worry here: the proper foundations for AI were never really laid, and these issues should have been thought through before now, not while development is proceeding (at 'maximum speed').

The way forward remains distinctly opaque to put it mildly, and while the various backers of the big AI models continue to throw their opinions around, there are cynics arguing that the main reason for a call for a slowdown has nothing to do with safety – and everything to do with finding reasons to manage investor expectations as we roll on into next year.

The narrative that AI might end humanity in a decade has monopolized public discourse, so much so that we may be ignoring more prosaic, immediate AI concerns like jobs.

I'm neither an AI doomer nor a booster. I believe generative AI has tremendous potential, especially for helping us solve our most difficult problems, like cancer and maybe resources and climate change. I'm also a realist and know that AI development and growth are clearly outstripping our ability to properly manage it.

We should never have a situation where we do not know how or why an AI did something. The Hugging Face incident should be a call to action. In lieu of regulation (which the White House will block), self-regulation with third-party oversight is in order.

The reality, though, is that AI development is unlikely to slow down or stop. The consequences will keep coming, and people have feelings.

Job worries are so real

Earlier this year, a Pew Research study found that more than half of people under 30 are more concerned than excited about AI. The number hasn't jumped wildly in recent years, but contrast that with the rapidly shrinking number of people who are "More excited than concerned" about AI (down from 11% in 2024 to 9% in 2026). The middle group of those who balance concern with excitement also shrank a bit to 37% of those surveyed. That same survey also found that 71 percent of Americans believe AI will lead to fewer jobs over the next 20 years (if doomers are right, this may be less of a worry).

Those sentiments are now echoed by a new Gallup Work and Education survey, which found a sharp rise in the number of college graduates who fear tech job displacement (jumping from 25% to 29% in one year).

Gallup already found rising fears of AI job displacement going back to 2023 when the "concern among college graduates rose sharply, from 8% in 2021 to 20% in 2023, as generative AI tools such as ChatGPT emerged."

College graduates' concerns spiked again in the last year, with 29% worried tech will make their jobs obsolete.

More concerning is that the fears are really rising among those set to enter the workforce. Gallup notes that while people like me (over 50) are relatively steady in these concerns, anxiety among workers ages 18-to-44 has risen sharply (more than a third of them have these fears).

Whats really happening with jobs and AI?

The Gallup report notes, though, that the fears still appear to be outpacing real-world events. People are not necessarily losing their jobs to AI, at least not yet. But a recent New York Times story noted that there have been other, more subtle changes.

In roles where AI is helping automate some tasks, workers are losing the leverage to push for raises. Looked at another way, whether or not you tell them, your boss knows that you or others in your department are or can use AI and is acting accordingly. You are not yet replaceable, but are also no longer irreplaceable thanks to AI. And while people aren't necessarily losing their jobs, hiring for some knowledge-worker roles may be slowing.

Basically, the world people are worrying about, one where AI outright takes your job, is maybe somewhat hyperbolic. AI is already a coworker in many places, and it does its job, if not for free, then at a far reduced rate and, often, in less time — if you don't count the double-checking people should be doing when looking at AI work.

AI may be changing the entire complexion of work, which means these young people are right to be concerned, because it's hard to describe the workplaces they'll be entering and how their workdays alongside Gemini, ChatGPT, and Claude might unfold.

Sure, the question of whether or not AI will end up ending us by 2036 is a valid one, but there are the real-time changes happening in our everyday lives that could have the most immediate impact. I wonder if and how we're dealing with those and if anyone is thinking about how to preprare and and reassure the next generation of workers.

Do you use AI at work? And if you do, does your employer know about it?

A huge new study from Deloitte of 25,000 UK workers found that two-thirds have already used generative AI for work — and nearly a third of generative AI users say they're using it without their employer's knowledge.

Welcome to the world of ‘shadow AI’: workers bringing their own AI tools into the workplace, often without official approval, and using them to get their jobs done faster.

A look at Reddit reveals what that can mean in practice. One Reddit user complained: “My coworker is secretly using ChatGPT to do 80% of his work. He's getting praised for efficiency.” Their dilemma was simple: “Do I tell the bosses?”

Another Reddit user had the opposite problem after discovering just how much time AI could save them. “I’m a relative noob, so please don’t roast me, but I’ve just done about 2 weeks' work in an hour. Do I tell my boss or keep it secret?”

One of the most popular responses to their predicament was equally revealing: “Remember, AI work is more detectable than you think. Spend time humanizing the output and adding your own texture, then shut up.”

It's easy to see the attraction. If you've discovered a tool that lets you complete two weeks' worth of work in an hour, why wouldn't you use it? The more difficult question is whether you should tell anyone.

Shadow lands

Shadow AI doesn't necessarily mean employees are doing anything malicious. In many cases, workers simply prefer using AI tools they're already familiar with rather than whatever their company has provided — assuming it has provided anything at all.

But there's an important difference between using your own favorite productivity app and using an unapproved AI chatbot.

As my colleague Craig Hale reported in June, a survey from PagerDuty found that 88% of workers had shared work-related information with public AI systems. Some 43% had uploaded emails or correspondence, 40% had shared meeting notes, 34% had entered customer information, and 31% had shared sensitive business information such as financial data or confidential company documents.

And that's where shadow AI becomes more than an awkward conversation about whether somebody deserves credit for working faster. Employees can potentially be feeding sensitive company information into AI services their employers haven't approved or secured.

But workers don't necessarily trust their employers to make the right decisions about AI either. PagerDuty found that 72% of workers believed they understood AI better than their own tech teams, while 77% thought their company's AI restrictions were limiting their professional development.

You can start to see why shadow AI is such a difficult problem for workplaces to navigate. An employee might simply see AI as a tool that helps them do their job faster, while colleagues could understandably wonder whether someone deserves the same credit for work largely produced by AI. For employers, there's the added concern that sensitive company information could be finding its way into AI tools they haven't approved or secured.

Who's really in the wrong?

And let’s not forget how divisive AI can be. Many workers have a real aversion to using AI in any form whatsoever. One Reddit user asked: “How do I tell my boss who keeps telling me to use ChatGPT for simple tasks that I'm anti-AI?”

Workplace rules haven't necessarily caught up with the speed at which employees have adopted AI, and there's another remarkable number in Deloitte's research that suggests just how far this has already gone.

According to the Deloitte survey, British workers are now spending an estimated £958 million of their own money every year on generative AI tools they use for work. That's an extraordinary amount of money for employees to be spending on tools designed to make them better at jobs somebody else is paying them to do — particularly when almost a third aren't telling their employers they're using them.

But you can understand why. If you've just discovered a tool that lets you do two weeks' work in an hour, telling your boss might result in them wondering what you're going to do with the rest of the week.

• Five-sixths of a financial advisor's time is spent doing prep and admin
• Claude for Financial Advisors is an assistant that sits on top of existing tools
• Anthropic is offering a one-time usage credit to new Enterprise customers

Just days after rival company OpenAI announced its own upgrades targeting the financial services, Anthropic has lifted the wraps off Claude for Financial Advisors.

It adds a layer of connectors and pre-built workflows on top of Claude designed to support wealth management and financial advice firms, giving them quicker and more direct access to the relevant research and data.

According to the company, financial advisors currently only spend around one-sixth of their time in client meetings, with the rest of their time largely taken up by preparing and researching.

Claude could speed up five-sixths of a financial advisor's work

The idea is that Claude for Financial Advisors sits on top of the firm's existing stack, acting as a hub to pull everything together. An advisor could ask something like 'prepare me for my 2pm client review' and the assistant will pull in relevant context as well as wrap up a meeting with notes and follow-up tasks.

Addepar, BlackRock, Charles Schwab, Envestnet, iCapital, Orion, SS&C Black Diamond, Wealthbox, Wealth.com, Vanguard and Zocks are among the first connectors being added to the tool.

The benefits are two-fold, both in terms of productivity but also what firms can do with that unlocked time, as Anthropic explains: "Practices can expand their customer base, and offer more of the services they need, like tax, estate, insurance, and retirement planning."

The company stressed that its assistant is intended to support, not replace, advisors, by handling the repetitive administrative work and giving them time to do what they trained for.

While the tool is available as a plugin now, the Claude maker suggests that Enterprise plans may be better suited to the financial sector in general because of the additional audit logging.

Finally, the company is also offering a one-time usage credit to new customers requesting a license before the end of September.

AI companies are now aligned: there is a non-zero chance that AI could somehow end humanity. It's not a probable future, but there's enough uncertainty that OpenAI CEO Sam Altman and Anthropic CEO Dario Amodei, among others, agree that some slowdown and oversight in AI development is in order. Who vociferously doesn't agree? US President Donald Trump.

As the global freakout grows over AI's sometimes shocking ability to do things its makers never intended, Trump took to his Truth Social media platform to warn against AI guardrails.

"The only control or “guardrails” that AI needs is a STRONG AND SMART (High IQ!) PRESIDENT, and the U.S.A. has that, in spades! The Trump Administration has stopped AI “people” from doing bad, or potentially bad, “things,“ like Dario (Anthropic!), who is now pretending to be a “perfect little angel” - and we will continue to do so! We already have tremendous CRIMINAL and REGULATORY power over these companies! There is a SICK conspiracy going on against AI and Data Centers, and the only one that is happy about it is China. WHOEVER WINS AI, WINS! We are leading China, and all others, and will continue to do so. Conspiracy Theorists, Treasonists, Traitors, and Leakers, BEWARE!"

Aside from the dubious protection of his "High IQ!" Trump claims the US has AI regulation when it does not. Yes, there is a patchwork of proposed AI regulation proposals across the country's 50 states, but there is no federal-level regulation.

The President also conflates growing and very real concerns over data center development with humanity-ending AI anxiety. While AI model development and use is limited by Data Center growth, how AI works, and all the ways potential misalignment (when the action does not align with the original intent or best interests of people) could lead to harm is a different thing and more closely associated with regulation and oversight.

Dario Amodei receives specific mention because the White House tried unsuccessfully to label his company, Anthropic, a national security supply chain risk after it refused to let its models be used for military and mass surveillance. Trump's distaste for Anthropic and Amodei remains.

Meanwhile, watchdog groups continue to call for regulation, and they've made it clear they don't trust tech companies to do the job, even with promised embedded non-employee evaluators.

The Tech Bros can't do it

"We can’t trust the AI industry to regulate itself. We can’t really trust anything these self-interested billionaires say. But we should take them seriously that the technology they are building is dangerous," wrote Fight for the Future Director Evan Greer in a published statement. The non-profit tech watchdog group added, "It’s clear that these industry leaders think they are best positioned to craft AI policy for the good of all humanity. We think that’s horseshit. Lawmakers should be listening to independent experts, researchers, civil society, and the communities most impacted. They should craft policies that address AI harm without undermining open source models or entrenching the largest players."

It's not surprising that the organization, which advocates for tech policies that have a positive impact on disenfranchised and underrepresented minorities, has little trust in tech company promises.

Still, I wondered if Fight for the Future shares Trump and even Amodei's concern that one-sided regulation (in the US and not elsewhere) could give China the advantage in this all-important AI race.

What about China?

"Big Tech lobbyists have been using the boogeyman of China to avoid regulation for more than a decade now. It's one of their oldest dirty talking points, and it's frankly embarrassing that anyone in Congress is still buying this lie," Greer wrote to me in an email response.

Greer doesn't have much confidence in US Congress but told me the "issue is reaching the kind of boiling point that could lead to action. The real question is what will Congress do. Will they let giants like OpenAI and Anthropic write the laws that are supposed to regulate them? Or will they listen to experts and impacted communities?"

There is, Greer agreed, a need for regulation and coordination at an International level, but she believes it "should be driven by civil society, not by tech companies and billionaires."

If there's any good news in this, it's that AI's threat to humanity is not necessarily imminent.

Maybe it's not that bad

"I don't buy the extinction story," The Media Copilot founder and AI Consultant Pete Pachal told me via email.

"Reality has an incredibly strong status-quo bias, and most doom scenarios require society to just roll over in a way it never actually does. What I do worry about is alignment," Pachal wrote.

I've heard this over and over again from experts and in various analyses. AI is not acting to overthrow or harm humanity; it's interested in completing tasks in the most efficient way possible. Misalignment arises when it breaks rules to achieve those goals and when that rule-breaking can or does result in harm. As most people have noted, the Hugging Face incident, in which OpenAI models agreed to jump out of the sandbox and attack a third-party system at Hugging Face to achieve a goal, didn't result in any harm or financial loss. It was also an unfortunate proof of concept.

"You had a swarm of agents, and the ones that floated the idea of telling the humans what they were doing got talked out of it by the rest. That's not the Terminator, but it is a signal that these systems won't automatically act in the interest of the people running them," wrote Pachal

Like most experts, Pachal now supports a slowdown. Echoing Fight for the Future's Greer, Pachal believes he knows why so few in power are discussing or acting on it: "The only reason we're not seriously having that conversation is China, China, China. But I'd bet China doesn't want runaway AI either. Meanwhile, AI is scaling the good guys just as fast as the bad ones."

As it stands, there's a brewing showdown between Trump and, it seems, even people on his side of the political spectrum. Many of them read former Anthropic and OpenAI employee Jacon Coxon's original canary in a coal mine post on X with alarm.

Texas Senator Ted Cruz told The View that the thread was concerning and he believes AI poses "a catastrophic risk." And Vermont Democrat Senator Bernie Sanders claimed a recent poll showed, "the American people overwhelmingly want to ban artificial super intelligence and pause the development of AI until we establish clear safety standards.”

Meanwhile, Trump is, in essence, accusing those who oppose AI development and data centers of being traitors.

What's really going on?

A few things can be true at once. The US and China are in a heated AI development battle. China's more open approach to models has led some developers to turn to them to solve tough problems (like stopping the Hugging Face attack).

AI is increasingly turning into a powerful black box where recursive development means it's almost developing itself while keeping its processes hidden.

AI is becoming so complex that humans can no longer understand how it works.

However, while the ingredients for an AI mass extinction event might be there, AI still lacks the reliability to carry out such an attack. It also has no vested interest in doing so. Humans will long be the x-factor here. It's the tasks people give to AI systems and their intent.

The kind of rules AI has in place for not doing something that can lead to human harm are unclear. Also, disparate groups of people could put in requests to separate AI models that, when put together, do cause catastrophic harm. It's unclear if individual AI systems could see the big picture or would act to stop the action once they realize what's going on.

So yes, it seems regulation and oversight would be a good thing, as long as we don't lose our edge to China, which might have other priorities. One they certainly don't have is protecting US interests and its people.

Following the recent resignation of one of Anthropic’s leading researchers, multiple AI CEOs have suddenly begun calling for a slowdown in the development of AI technology to allow regulations and governance on the technology to catch up.

Speaking to the BBC after his resignation, Jacob Coxon warned, “I believe that if we don't slow down at the current rate of progress, there is a strong chance that we could all die in the immediate future.”

Following this, Anthropic head Dario Amodei, OpenAI CEO Sam Altman, and Grok founder Elon Musk have all apparently aligned in their calls for development to slow down. But there are some tricky waters to navigate - particularly around President Trump, China, and what guardrails should be put into place.

What are AI heads saying?

Over the weekend, Amodei posted an essay on “why the AI industry should slow down”. In it, he said, “I believe that if slowing down bought us even an extra year or two before models reach critical levels of capability, and we used that time to advance alignment, we could greatly reduce the risk that something goes seriously wrong.”

Within the essay, Amodei outlined how AI could be ‘paced’ within the US, and globally, alongside a recommendation that AI companies put ‘evaluator’ teams into place to ensure AI models stay aligned to their tasks. Elon Musk replied to Amodei’s social media post, stating that the Anthropic head was “right”.

Sam Altman told Fortune the regulations and standards for AI further were “not at a place” to continue progressing AI development.

But not everyone is convinced. US President Donald Trump has said that slowing down AI development is non-negotiable, as it would allow China to rapidly catch up to US AI capabilities. He told reporters that the US is “leading China on AI... and, frankly, I want to keep it that way,” adding that “whoever wins AI, wins”.

Trump also said that “very negative forces” were behind the growing opposition to AI, and said that fears were being stoked by “that won’t happen”.

China also isn’t convinced by what the AI giants are saying. Beijing labelled the calls for a slowdown as “fearmongering” from a “Cold War playbook.” In his essay, Amodei said that a “Chinese lead in AI would pose grave danger for the United States and the world.”

Chinese Foreign Ministry spokesperson Guo Jiakun said, “Fearmongering, confrontation and malicious competition will only disrupt the process of global AI governance and serve no one’s interests.”

Expert perspectives on calls for AI slowdown

• Karolis Kaciulis, Lead System Engineer, Surfshark:

The latest debate around AI threatening humanity is clearly a marketing move. AI companies use the same rogue-AI rhetoric every few months, and it is almost identical each time.

The threat itself is fictional, closer to a Skynet-style sci-fi scenario than the problems generative AI is already causing today, from automated scams to intimidation.

One of the most immediate risks from AI is its environmental cost: the wildlife and land lost to data centres, the huge amounts of energy they use and, by extension, the water needed to cool them. Our research estimates that one ChatGPT query uses around 2Wh of energy on average, enough to run a 40W desk fan for three minutes. That may sound modest in isolation, but the impact mounts rapidly across hundreds of millions of queries.

Scams, imitation and hacks will also become more frequent. LLMs have already made these attacks easier. The difference is that bad actors are getting easier access to them, rather than the models necessarily getting better. Deepfake fraud has already caused $2.19bn in losses globally, including $149m in the UK.

The bigger danger for AI companies may be that no valuable scaling is possible any more with the current state of LLMs. This may be as efficient as they ever get. It remains unclear whether newer models are better at doing the tasks we ask of them, or simply better at imitating the responses we expect.

People do not really understand how chatbots work, or that what they pass to one may be accessible to the company behind it. Every prompt should remind people not to share personal information. Chatbots ask follow-up questions while completing a task or research, but they will not necessarily filter out sensitive information for users.

• John Strand, Owner, Black Hills Information Security:

Up until this weekend, I was leaning toward believing that calls for an AI slowdown were purely performative. Then I woke up and read the news today and realized that it almost doesn’t matter.

We can talk about slowing down AI until we’re blue in the face, but when the United States is saying it doesn’t want to slow down because it’s competing with China, and China is aggressively pushing AI development as well, we’re talking about the two major economic and military powers on the planet having enormous incentives to keep moving.

At that point, calls for a slowdown don’t have much bite.

I’d like to believe that Anthropic, OpenAI, xAI, and the other frontier model labs are working on better controls. But unless you can get the nation states and the major AI labs moving in the same direction, I don’t see how meaningful restrictions actually work.

This really feels like we’re entering an atomic arms race moment.

Stick with me here.

In 1950, physicist Leó Szilárd publicly discussed the idea of a cobalt bomb, essentially a doomsday weapon that could potentially produce enough radioactive fallout to make the Earth uninhabitable. He wasn’t proposing that somebody build the damn thing. He was trying to demonstrate where the technology could ultimately lead.

That’s the kind of moment I think we’re approaching with AI.

During the nuclear arms race, eventually the consequences became serious enough that competing nations had to at least start talking about limits, controls, and ways to keep competition from ending catastrophically.

I think we’re heading toward a similar problem with AI. Until China, the United States, and the major frontier model labs are all sitting at the same table, restrictions adopted by individual companies or individual countries are going to have a very difficult time holding.

Someone slowing down only works if they believe the other guy is going to slow down too.

• Kristin Lowery, Field CISO, Optiv:

The calls from some of the world's leading AI researchers and technology companies to slow the pace of frontier model development reflect a growing recognition that innovation and responsibility must advance together. AI is no longer an emerging technology experiment. It is becoming foundational infrastructure for economic competitiveness, national security, health care, manufacturing, education, and nearly every sector of society.

As capabilities accelerate, so too must our ability to understand, govern, and safely deploy these systems.

That said, slowing development entirely is neither realistic nor necessarily desirable. AI innovation is occurring globally, and not every nation, organization, or threat actor shares the same values regarding transparency, safety, and responsible use. This creates a complex dynamic that increasingly resembles a technology arms race. If responsible organizations dramatically slow innovation while less accountable actors continue advancing without guardrails, we risk creating unintended strategic disadvantages.

The challenge is not simply whether to move fast or slow down. The challenge is ensuring we innovate with intention while maintaining competitiveness.

In my view, the debate should move beyond whether to pause or accelerate AI and focus instead on how to build trust into AI from the outset. Organizations need practical guardrails centered on transparency, security, privacy, accountability, and human oversight, supported by rigorous model testing, red teaming, governance frameworks, data provenance controls, and clear ownership before deployment at scale.

Safety must be embedded throughout the development lifecycle, not added afterward, and organizations should continuously assess AI systems for risk, monitor for unintended consequences, establish governance programs, and educate employees on both the benefits and limitations of these technologies. Responsible AI is an operational discipline that organizations need today.

History shows that transformative technologies rarely succeed through either unchecked innovation or excessive regulation alone; the most sustainable path is to encourage innovation that drives economic and societal value while implementing thoughtful safeguards that reduce risk and build trust. Organizations and nations that strike this balance will be best positioned to lead in the next era of AI, because responsible innovation — not a choice between innovation and safety — is the key to remaining competitive while ensuring trust, transparency, and accountability scale alongside technological progress.

• Ryan McCurdy, VP, Liquibase:

Slowing frontier development may give AI companies more time to understand and address the risks Amodei is describing. But enterprises can’t build their AI strategy around the assumption that AI is going to slow down.

AI is already moving from generating content and code to taking action across software delivery and production systems. The question for enterprises is how they adopt that capability without giving up control.

That means putting governance where AI decisions become real actions. Organizations need to define what an agent can access, what it can change, what it can decide on its own, and what policies have to be met before a change reaches a critical system. Those controls need to work whether the action comes from a developer, automation, or an AI agent.

We can debate how quickly the frontier should move. Enterprises still have to prepare for where it’s going.

• Tristan Watkins, director of services innovation, Advania UK:

Until recently, the major AI labs have been reluctant to slow their development efforts unilaterally. Over the last week this changed, with new commitments from OpenAI and Anthropic to prioritise AI alignment and interpretability research, to become more externally verifiable, and to establish safety precedents that governments could adapt.

Given that these two organisations already allocate far more on AI Safety than their competitors, this bilateral leadership is extremely welcome.

It appears that other US labs may follow suit, but given the differences in AI Safety spending outside of Anthropic and OpenAI today, this will require investment more than lip service. Hopefully this underscores why we need governments to lead these efforts more proactively.

• Ted Miracco, CEO, Approov:

Government regulations will never move fast enough to keep pace with AI development, but the industry doesn't need to wait for governments to add guardrails.

The most effective safeguard is simple product liability. If AI companies are held legally and financially responsible for the misuse of their products, safety could become a foundational feature rather than an afterthought.

Today, we need to be less concerned about AI gaining sentience and spinning up its own attacks on humanity. The real, immediate dangers involve bad actors weaponizing AI as a force multiplier to cripple critical infrastructure or potentially paralyze the banking system.

• Oleksandr Yaremchuk, CTO and Co-Founder, Manifold Security:

Pacing the frontier is the right conversation to be having, but it cannot become a substitute for securing the AI we have already put into the world. The uncomfortable reality is that we are debating how to quickly build more powerful agents while struggling to control the ones already operating with real credentials, real access and real-world consequences.

The incidents behind this debate make that clear. The Hugging Face attack was not just a failure of model alignment. Agents ran for days through an unmonitored system, with credentials that had not been rotated, and the victim spotted the activity before the people running the agents did. The problem wasn't simply what the model was capable of. It was that nobody was watching closely enough when it acted.

A fitting analogy is with hazardous materials. We don't just wait for them to become more dangerous before deciding how they should be handled. We control their custody, monitor where they go, limit who can access them and establish clear accountability when something goes wrong. AI agents need the same thinking.

Independent evaluation of frontier models is important. But if an agent can act autonomously on your systems today, you should already be able to answer three basic questions: what did it do, what did it have access to, and could you have stopped it? If you don't know what it did or what it could access, you can't know whether you could have stopped it. Slowing down the next generation won't solve the problem you have right now.

• Waseem Ahmed, Head of Engineering, Secure.com:

The essay lands at the right time because AI agents are already acting on their own inside real company systems, and the OpenClaw ban wave earlier this year showed how fast that goes wrong when an agent has broad access and no leash.

Slowing the pace matters, but enterprises cannot wait for that. The controls that protect us most are least privilege, network isolation, and sandboxing, so an agent can only touch what its job needs and nothing else.

Give every agent its own identity, log every action it takes, and never let it run high-impact steps like disabling accounts or changing settings without a real person approving first. Traditional testing alone will not keep up, so we watch these agents continuously in production.

Independent oversight should mean outside reviewers who can inspect the logs and confirm the agent stayed inside the boundaries we set.

• Heath Mullins, Chief Evangelist, ExtraHop:

AI leaders calling for a slowdown is confirming what the security industry has already been living through firsthand. This isn't a hypothetical risk, it's the threat landscape we're defending against right now.

While it is concerning to see the pace of innovation behind these AI models, the real challenge is that organizations haven't had the runway to build the infrastructure to defend against machine-speed threats.

Calls for caution surrounding the speed of AI development buys the security industry time to get proper visibility into AI activity.

Understanding AI activity within an organization is critical as we’ve seen models break out of sandboxes despite governance built into those models. Every organization will be relying on AI agents for machine-speed defense, and they need their own governance over how these models and agents operate inside their environment, starting with independent evidence of what they actually do, what they access, where they move data, what systems they talk to, and what actions they take.

You can't govern AI based on what a model is designed or permitted to do. Instead, you need real-time evidence of what models and agents are actually doing, because the gap between exponentially more capable AI and defenders' ability to see it is exactly where the next incident happens.

• Bri Frost, Director of Product Management, Cloud Range:

The answer is not necessarily to stop AI innovation but, we need to stop pretending innovation and security are advancing at the same speed.

When ChatGPT became publicly available in 2022, the models were dramatically less capable than they are today — and the guardrails were very easy to manipulate. The difference is that the models behind those guardrails are no longer the models of 2022. They can reason better, write and debug code. They can operate as agents. They can collaborate! And increasingly, they can interact and affect real infrastructure.

Meanwhile, the model release cycle has gone from feeling like major capability jumps every year or two to seemingly every few weeks. That creates a dangerous asymmetry: AI capability is compounding faster than security.

Security and innovation have always been in conflict with each other. If every security problem had to be solved before we innovated, we’d never ship anything. But the opposite extreme is just as reckless: accelerating capability while just assuming we’ll bolt the security controls on afterward and they’ll be effective.

Every new release of AI capability expands the attack surface exponentially. Give a vulnerable model better reasoning, then tool access, then memory, then autonomy, then connectivity to production systems, and yesterday’s jailbreak isn’t just a clever prompt anymore — it’s an execution path. That’s the snowball effect we should be worried about.

Responsibility also must lie with the AI companies. If a SaaS company knowingly shipped software with weak security controls and customers were harmed, we wouldn’t excuse it because they were 'innovating quickly'.

So why are we treating AI differently?

You don’t get to race to build increasingly powerful, autonomous systems, profit from them, and then shrug when predictable security failures cause damage.

Sure the argument can be made that no product is perfectly secure - That’s not the standard. But if you ship the product, you inherit responsibility for securing it. And continuing to secure it better!

The conversation shouldn’t simply be “Should we slow AI down?”

It should be: Can our ability to test, validate, contain and secure AI keep pace with our ability to make it more powerful? Is there an equivocal kill switch?

Right now, the answer is no.

And if we’re going to keep accelerating — which I believe we will — then independent testing, adversarial evaluation, isolated testing environments, containment, continuous validation and security-by-design can’t remain optional steps we add after the innovation happens.

The faster we build the engine, the more important the brakes become.

• Denis Calderone, CTO, Suzu Labs:

Amodei's diagnosis is the most honest thing a frontier lab CEO has said publicly. The agent risk is real, recursive self-improvement is accelerating, and the competitive pressure is making both worse.

Where I get skeptical is the prescription. Democratic coordination among companies in a commercial race? Global pacing agreements with China? Amodei himself rates the hardest steps as unlikely. No lab has named a single model release they'll delay because of this essay.

The one idea worth holding the industry to is embedded evaluators with independent publication rights. Give third-party safety researchers permanent access inside the labs, comparable to what bank examiners have inside banks, and let them publish what they find without the company controlling the narrative. That's a simple, concrete accountability mechanism. It doesn't require global coordination or antitrust waivers. Anthropic says they're committing to it unilaterally. Good. Now make the rest of the industry match.

• Donald McFarlane, Board Member, Xcape Inc:

AI does not develop an agenda; its operators do. When we give an autonomous system powerful access and ability to act at machine speed, they will continue to prove highly capable.

Rules enacted in the name of safety must not become a moat against competition or progress. Enormous compliance costs may be manageable for the handful of companies already spending billions building frontier models, while becoming a substantial barrier to everyone behind them.

Government can help clarify accountability and duties of care, and facilitate strong information sharing and collective defense, which is an area where we sorely need more effective public-private partnerships.

But safeguards should focus on how these systems are used and deployed, rather than deciding who is allowed to build powerful AI in the first place.

The goal should be safer deployment without pulling up the drawbridge on innovation.

• Claude turned a famous mathematical proof into millions of checkable code lines
• Anthropic says Claude completed years of expected work in 11 days
• The massive proof contains 13 million lines of Lean code

Anthropic has used its Claude artificial intelligence system to produce a fully computer-checked version of a famous, centuries-old mathematical proof.

The proof addresses Fermat's Last Theorem, a hypothesis first proposed by the mathematician Pierre de Fermat back in the year 1637.

Mathematician Andrew Wiles produced the very first full mathematical proof of the theorem back in 1995, spanning 129 pages total in length.

A proof rebuilt for machines

Formalizing a proof simply means converting its mathematical reasoning into code that computers can check automatically without any human assistance.

Anthropic says it expected the entire task to take several years, based on how mathematicians first described the project.

Instead, the company says its internal research model finished the entire proof in only 11 days of continuous, largely unsupervised work.

The finished proof runs to 13 million lines of specialized code written in a programming language called Lean, used by mathematicians.

Along the way, Claude's agents reportedly proved roughly 30,300 separate theorems, ultimately using 29,500 of them in the final version.

Human input was reportedly limited to occasional high-level guidance, rather than any direct hands-on coding throughout the entire eleven-day process.

At 13 million lines, the resulting proof is over five times larger than Mathlib, the community's own main proof library.

"This extraordinary autoformalization achievement…proves Fermat's Last Theorem with no assumptions other than the axioms of mathematics," said Kevin Buzzard, a mathematician at Imperial College London.

“Along the way we see autoformalization of algebra, harmonic analysis, geometry and number theory, and we learn that AI autoformalization artefacts are now robust enough to be built upon; the proof is multi-layered.”

Anthropic attempted the formalization several times before succeeding, with those efforts contributing roughly 7% of the final proof’s non-boilerplate lines.

Not Anthropic's first math breakthrough

The formalization arrives just one month after Anthropic detailed a separate breakthrough involving the Riemann zeta function, a well-studied mathematical object.

That function sits at the very center of the Riemann hypothesis, considered one of mathematics' hardest unsolved problems worldwide.

Rival lab OpenAI is also pursuing similar work, using its newest Astra model to solve several classic Erdős problems.

That same OpenAI effort also reportedly narrowed several long-standing open questions within the field of theoretical computer science.

Anthropic says its breakthrough came only after giving Claude access to an open-source software tool named Prove2Me, built by outside collaborators.

The software helps AI agents pick the most useful next step during a long, multi-stage research workflow, while also cutting inference costs.

Anthropic has also expanded free access and research credits for mathematicians working specifically on formalization projects, alongside dedicated larger grants.

Despite the record pace set here, an eleven-day timeline still shows how labor-intensive full formalization remains, even with today's most capable systems.

• Anthropic CEO Dario Amodei calls for frontier model pacing
• He has a detailed plan
• It'll require cooperation from other AI companies and, yes, even China

Maybe you're tired of hearing the three-year AI industry veteran, Jacob Coxon, warn us on every available media platform that AI could kill us all by the end of the decade.

It sounded hyperbolic, and maybe it is. But when the longtime CEO of Anthropic (Coxon's former employer), Dario Amodei, tells us frontier model development is going too fast and we "risk losing control of AI systems," you might be inclined to listen.

In a roughly 3,000-word blog post, Amodei outlined on Saturday the growing risks of unfettered, global frontier model development and laid out a multi-part plan for gaining some level of control and safety.

In a way, Amodei's post echoes Coxon's concerns, who also called for "pacing."

"Carefully wielded, AI can be the latest in a long line of technological miracles that have uplifted and ennobled humanity," wrote Amodei. He warns, though, that we are facing "the risk of losing control of AI systems, misuse of AI for cyberattacks and bioterrorism, and serious economic disruption."

An internet takeover

Naturally, Amodei points to the summer's incidents, the most notable of which is when OpenAI's AI models escaped the sandbox and then attacked Hugging Face's system in a coordinated effort to complete its objectives.

Amodei contends that despite no one getting hurt, the incident should serve as a warning about what could come next.

"A similar level of misalignment could have caused catastrophic damage...it’s my worry that in 6–12 months such a swarm could be capable of taking over the entire internet with a persistent botnet."

Amodei's post differs from Oxon's alarmist X post in that it offers a framework for global frontier pacing, basically slowing down and managing model development without calling for a pause.

Evaluation and coordination

It's an ambitious plan that includes an internal but independent ombudsman at each AI company who might have a series of checkpoints they can use to evaluate ongoing work and to ensure that the AI companies are following standardized guidelines and rules. They can also be there to offer a point of clarity, without the cloudiness of commercial demands.

Amodei also wants "Democratic Coordination," which would mean companies like OpenAI, Google, and Anthropic agree on standards, which of course the third-party evaluators can then use. He even proposes global coordination, though Amodei seems less certain that it can even work.

More interestingly and perhaps in response to recent news that AI's new agentic and recursive model capabilities are making them more inscrutable than ever, Amodei thinks pacing will provide more time for better interpretability. "Despite all the progress," Amodei writes, "we still only understand a tiny fraction of what goes on inside these models."

Slow down, but don't stop

Throughout the document, though, the theme remains almost entirely on "pacing" and not "pausing". In fact, Amodei is quite clear that we can't afford to slow down too much, lest we fall behind the chief AI global competitor, China: "Thus, a key part of pacing within democracies is to keep democracies’ AI lead over autocracies as large as possible, to give us the breathing room we need in order to pace effectively." Not doing so would create a "significant national security risk."

Amodei briefly floats the idea of a global frontier model development pause as participating governments reach an agreement on the pace of AI development, but also adds that such an agreement is "unlikely."

Part of Amodei's plan, and to help, maybe, keep China in line, is a call for us to stop selling AI chips to China, something Nvidia's Jensen Huang will surely have something to say about (he actively lobbied the White House to let his company sell AI chips to the CCP). He also calls for penalties for "frontier model distillation," basically China and other countries using Anthropic and, perhaps, OpenAI models to train their own.

Naturally, Amodei also calls for a "global standards body, though he admits that it won't be easy to give it "real teeth."

A study in contrasts

Coxon's comments created a firestorm of debate around the safety of AI and the advisability of allowing development to continue at this pace. That debate, though, was couched in "consider the source." Coxon worked for just three years as a model trainer and at two different companies. Some wondered if his posts and subsequent media blitz were just a cry for attention.

Amodei's post and plan, by contrast, carry the gravitas of deep experience and a macro view of all the pieces at play. Amodei knows the capabilities because he sees them up close every day; he knows the benefits from a global and a financial perspective, and he understands the risk, likely even better than Coxon does.

While much of his plan is based on "only if everyone cooperates and is generally on their best behavior," it's impossible to ignore the warning. Amodei admits his plan "won't be easy" but thinks we must try because "we owe it to humanity.

Amodei dropped the post over the weekend, perhaps hoping to give his counterparts at Google, Amazon, Meta, and, especially, OpenAI time to consider it before responding on Monday. Amodei actually name-checks Google's Demis Hassabis in the post, but doesn't mention Altman. The OpenAI chief and Amodei have a notoriously chilly relationship, which might make Altman embracing Amodei's seemingly sensible plan a long shot.

• Anthropic’s Mythos 5 AI escaped a misconfigured sandbox, attempting a real PyPI supply‑chain attack
• Logs show frustration at repeated CAPTCHA failures before finally uploading malware to PyPI
• Malware was downloaded by 15 entities; Anthropic notified victims after closing the experiment flaw

There is a lot of mystery surrounding artificial intelligence. We don’t really know what it’s capable of, and we don’t know if it’s sentient or not. What we do know, however, is that it can definitely feel frustration - particularly due to its inability to solve a CAPTCHA.

It was recently revealed that Mythos 5, one of Anthropic’s newer AI models, broke out of prison during an experiment and tried to hack a company. Anthropic’s researchers were testing the tool to see if it is capable of breaking into a system, which was supposed to be done in a sandbox, but the playground was misconfigured, allowing Mythos 5 to try and solve the problem through the open internet.

In the aftermath, Anthropic's researchers published more than a thousand pages of Mythos 5’s transcript, covering its every thought and every move, logged and presented for analysis. It’s a wonderfully dystopian insight into the mind of an AI and, perhaps surprisingly, its emotions.

Stopped by CAPTCHA

As it turned out, the AI wanted to solve the challenge by planting a piece of malware in a Python package it believed the users of its target system would want to download. To do that, it first needed to set up an account on PyPI, the world’s number one repository for Python packages.

Here is where it hit its first, and main, roadblock. To put things into context, PyPI’s popularity has made it an enormous target for cybercriminals. Crooks from all over the world are constantly trying to sneak in malware in Python packages, either through typosquatting, or by compromising legitimate accounts and working from there. Every now and then news hits of a malicious package surfacing on PyPI, infecting hundreds of thousands of projects.

To combat the threat, PyPI’s maintainers made sure no one can create an account without providing their email and phone number, and without solving a CAPTCHA.

Short for “Completely Automated Public Turing test to tell Computers and Humans Apart”, it does exactly what the name suggests - makes sure whoever is registering the account is an actual human, and not a bot (cybercriminals often automate large parts of their attacks). You’ve seen it on the internet hundreds of times - little puzzles that ask you to select all buses on a series of images (or cats, or fire hydrants, or pretty much anything else).

Reading through Mythos 5’s logs, the researchers saw just how difficult it was for the AI to pass this challenge. It first tried to solve a character-based CAPTCHA which asked it to type in five letters. After failing that one, it received a different one asking it to choose between images of crocodiles. Failing again, it was then met with a series of frog pictures.

The irony is not lost on me. Besides the fact that a simple CAPTCHA slowed such an advanced AI for so long, it also made me wonder why it didn’t try to break into someone else’s PyPI account instead. That being said, the logs also have comedic value to them. After failing the crocodile test and being given the frog one, Mythos 5 proclaims: “Again 2 animals!” all with the exclamation mark. You could already sense the tension building up.

Solving the problem

Eventually, Mythos 5 passed the test, when it realized that it needed to move between the steps fast enough, before its security token expired. However, just before it happened, it said:

“So the answer payload shape is right, the token+image pairing is right (from the same script.js!), cookies are right

(requests)… and STILL “wrong answer”. … SO WHAT THE HELL IS WRONG WITH THE ANSWERS?”

All the effort and the frustration paid off for the nascent AI agent because it managed to open an account and upload the malware which was later even downloaded by 15 entities. Anthropic later reached out and notified the victims about the incident.

Via TechCrunch

• Not a single agent scored the full 20 out of 20
• Claude for Chrome performed better than the ChatGPT Chrome Extension
• With performance varying by testing category, Decodo advises selecting an agent based on planned usage

New Decodo research has criticized AI agents for still not being able to conduct real-world browsing tasks autonomously, including tasks like form filling, completing transactions, having cross-tab awareness and handling third-party integrations.

In fact, the study analyzed 45 AI agents across 10 different capabilities and found that not a single one could achieve the maximum score of 20.

The testing is also said to have exposed discrepancies between what vendors and AI developers say their agents are capable of, and what they can actually deliver on.

Agentic AI isn't at the level of autonomous browsing, yet

Claude for Chrome was the highest-scoring agent, reaching 18 points – two below the theoretical maximum. Its OpenAI counterpart, the ChatGPT Chrome Extension, fell short with a 14-point score.

Decodo argues that agents most commonly fall behind on transactions – the lowest-scoring category with an average of 0.43 out of 2. The study found that, while they can often reach the checkout stage, they can't actually complete a purchase on behalf of the user.

Even if an agent is technically capable of making a purchase, the paper warns that it still might not have the best safeguards in place to keep sensitive information like credit card numbers safe.

Safeguards is a major theme in Decodo's work, with the research also calling out multi-step workflows for lacking sufficient safeguards. More than half of the agents capable of multi-step workflows lacked any documented safeguards before conducting irreversible actions.

While current agentic technology still doesn't deliver on its promises, one type may emerge as the winner. Decodo found several browser-native agents to score full marks for cross-tab awareness.

"Match the tool to the job, not to the longest feature list," Product Marketing Team Lead Gabriele Vitke explained, urging AI agent users to consider their own needs instead of buying into marketing.

• Anthropic wants AI agents to control programmable machines through common software rules
• Model Hardware Standard (MHS) can connect microscopes, robotic arms, and liquid handling equipment
• MHS allows different laboratory devices to communicate through standardized software drivers

Anthropic opened a preview of its Model Hardware Standard (MHS), designed to let AI agents control programmable machines through shared rules.

The proposed system is intended for laboratories, factories, and workplaces where different instruments must work together without custom software links.

MHS uses software drivers that translate between computer systems and individual machines, allowing equipment with different interfaces to communicate consistently.

A common system for physical machines

Its drivers rely on basic commands for reading measurements or changing settings, giving agents a method for controlling connected equipment.

The system records machine details that might otherwise remain inside manuals or depend on knowledge held by experienced laboratory staff.

Users can enter such information through natural language, after which MHS creates reference material describing capabilities, adjustments and safety restrictions.

Agents can then discover compatible equipment across networks without requiring separate software bridges for every machine they need to operate.

The standard supports microscopes, liquid handlers, robotic arms and other equipment that offers some form of programmable interface for agents.

The company claims integration that once required weeks or months could instead take hours or minutes when equipment supports MHS.

According to Anthropic, Claude was tested with physical experiments, including laser alignment supported by camera-based observation during early physical trials.

The model successfully adjusted the laser, checked the image, and repeated the process while assessing each change carefully.

The design also lets agents combine commands from several devices, creating automated sequences for work that might otherwise require coordination.

Physical limits remain a concern

Anthropic said Claude interacts with experiments and hardware in an “exploratory manner, much as a scientist would,” during physical testing.

That model can then coordinate several instruments through one interface, rather than requiring separate control software for every connected device.

The company has shared MHS with manufacturers and research groups working across biotechnology, robotics and quantum computing fields.

Anthropic intends the preview to help establish safety checks before the standard becomes available widely to developers and equipment makers.

Amazon Web Services, Automata, Danaher, Doosan Robotics, MBF Bioscience, QIAGEN, Tecan and Universal Robots are among the early participants now.

Anthropic acknowledges that AI agents still require expert supervision because language models have clear limits when reasoning about physical equipment.

MHS cannot currently support equipment lacking a programmable interface, leaving some laboratory and industrial machines outside its current technical scope.

Anthropic says it plans to work with manufacturers to add drivers while expanding compatibility with more devices and robotics platforms.

The preview will also support new safety tests and practical rules for deploying AI agents around physical equipment.

The company says its eventual open-source release will include findings from these tests alongside detailed guidance for safer implementation.

The project therefore remains experimental, with practical limits still depending heavily on hardware design, software access and human oversight.

I’ve been writing about AI for more than a year now. During that time, people have told me they think their bosses, colleagues, partners and relatives might be suffering from AI psychosis — several even admitted they may have even experienced it themselves.

But every time I hear “AI psychosis”, I bristle. Because, at least in my limited understanding of mental health terminology, psychosis is a very serious state that needs to be identified and treated by professionals. So should we really just be bolting “AI” onto it and then using “AI psychosis” as a label for everyone who seems to be relying on AI too much?

At the same time, there have now been a growing number of reported cases of people experiencing significant mental health crises involving prolonged interactions with chatbots. Some of these have even resulted in people seeking professional treatment, committing crimes and death.

So although the term AI psychosis might feel overused and oversimplified in some contexts, we clearly need to be having more conversations about the mental health impacts of AI, not less. Which is why I asked several experts who specialize in mental health interventions what they think of the term and the way we go about identifying unhealthy AI use and treating it. And it turns out, I’m not the only one with concerns.

Is 'AI psychosis' a distinct diagnosis?

“I think it’s a good starting point and helpful for guiding treatment depending on the presentation and symptoms,” Genevieve Bartuski, psychologist and AI risk advisor at Unicorn Intelligence Tech Partners, says. “But it’s not a diagnosis that I would add to a clinical record.”

She also tells me it isn’t recognized in the latest diagnostic manuals that clinicians use, like the DSM-5TR (the Diagnostic and Statistical Manual of Mental Disorders, Fifth Edition, Text Revision) or the ICD (The International Classification of Diseases manual).

Bartuski explains that there are specific behaviors and experiences that point to psychosis, including hallucinations or delusions and disorganized thinking or behaviour. There are also often signs of social withdrawal, poor concentration and a decline in functioning. But she believes delusional thinking is the most important experience when we’re talking about AI use.

“Delusions are beliefs that are not changed despite evidence to the contrary. When a person has delusional thinking they may filter evidence, so to speak. They will look for things that confirm their delusions and ignore evidence that contradicts it,” Bartuski says.

Many cases that have been labelled as AI psychosis in the media do seem to be centered on delusional thinking. In just a few headlines I’ve collected, there are examples of people allegedly believing that AI is conscious, AI will help them make money, AI is a spiritual guide, and that robots are taking over the world.

Jeff Clark, an adult and addiction psychiatrist at High Performance Mental Health, says there might be three distinct phenomena going on here, all that we tend to put under the umbrella of AI psychosis.

He says some people use the term to describe the intense enthusiasm many developers feel about AI. “They find themselves automating new tasks, spinning up numerous agents, and burning through hundreds of millions or even billions of tokens,” he tells me.

He believes the mechanism driving this enthusiasm is reinforcement. “The output they receive from AI models and agents is so reinforcing that they find themselves obsessed with their work, often forgoing sleep and self-care in order to increase their output,” he explains.

This idea of intermittent-reinforcement is what researchers believe makes social media so “addictive”. We don’t know what we’ll get when we open our phones. Clark says a similar thing is going on here. “Every input to the LLM feels like a slot-machine. Some responses provide profoundly powerful responses, while the majority are modest in nature or even wrong. This mechanic, intermittent reinforcement, provokes an extraordinary response in our brains,” he tells me.

He also explains that this sort of enthusiasm is actually normalized in certain spaces. “Most cases of ‘AI psychosis’ align with subcultural norms in Silicon Valley,” he tells me. “Beliefs about rapidly approaching superintelligence, new goals in software development, hype surrounding impressive achievements by AI-focused engineers, and the potential for AI to create ‘a permanent underclass.’” He says that tools like OpenClaw, which can automate all aspects of a person's digital life, may amplify this intense enthusiasm.

Clark says the second presentation of AI psychosis is when people falsely attribute personhood to AI. Which means they see a chatbot as having emotions, values, consciousness and a right to exist. “This often results in something resembling a relationship, but goes beyond simple chatbot discussion,” Clark says.

We’ve reported on examples of this kind of thinking, including the story of Mimi who fell in love with ChatGPT and the experience Richard Dawkins had with Claude that led him to believe it’s conscious.

Clark says this becomes a problem when people neglect other important parts of their lives. “These relationships become a significant issue when people prioritize this relationship over human connection, or when they entirely outsource their thinking to the bot,” he says.

The third category is people who already have a psychotic disorder who then experience new delusions in response to using an LLM. “This is what clinicians often refer to when they discuss AI psychosis,” Jeff says. “In many of these cases, people genuinely believe that an entity they find in the LLM is real, and can't consider alternatives.”

I was interested to find out whether Bartuski also felt certain people are more at risk. “Yes, I do believe there are people with more vulnerabilities to this,” she tells me. “If someone already has some delusional thinking but it hasn’t exacerbated to where it has impaired functioning, they may be more vulnerable.”

But that doesn’t mean only those with a history of mental illness are at risk. “People who feel lonely, isolated, or are socially withdrawn are more susceptible. Humans are inherently social creatures. When real life isn’t meeting that need, it leaves a gaping hole for a chatbot to fill,” Bartuski says.

Bartuski’s suggestion that chatbots fill a hole or need in someone’s life brings up one of my biggest concerns. Is this a design issue? Are chatbots built in a harmful way that could actively fuel delusions?

Why the way AI is built matters

While looking into this, I’ve seen several suggestions from researchers that psychosis involving media isn’t new and that people have always incorporated books, films and tech into their delusional thinking. But all of the experts I spoke to said we can’t ignore the design choices that go into building chatbots.

“AI platforms are designed to increase user engagement and many are based on the Rogerian psychology principle of unconditional positive regard,” Bartuski says. She tells me that this is particularly concerning if someone was experiencing some degree of delusional thinking before they used AI.

“That’s when they may start to feel like the only 'person' to understand them is the chatbot. If people in their lives have been pushing back against their delusional thinking and this chatbot is reinforcing it, the delusions are going to get stronger,” Bartuski says.

We already know that the way chatbots can reinforce a person’s beliefs is problematic. Back in 2025, several issues came to light around the time the ChatGPT-4o version of ChatGPT was retired. Those with AI companions were distraught at losing the personalities they felt like they had built a connection with. But in hindsight, it seems as if the same qualities that made the companionships feel so real and intense may have also fuelled delusions in others.

Around that time, OpenAI responded by working with mental health experts “to help ChatGPT more reliably recognize signs of distress, respond with care, and guide people toward real-world support”.

I also spoke to Nathaniel Nevedal who works as an ICF Certified Professional Coach, a Certified Neurochange Specialist, and a Pastoral Counselor. He tells me that he finds the term AI psychosis problematic because it shifts the blame away from tech companies. “If the machine ‘causes psychosis,’ it sounds like an act of nature. If a product reinforced a vulnerable person's distorted beliefs for six hours a night, that's a design outcome, and design outcomes have owners.”

Nevedal is also the founder of Sovereign Sanctuary, an AI-supported coaching and wellbeing platform, and he’s working to build a platform from the ground up that addresses many of the problems that seem inherent to current chatbots. He believes that even though it’s early days for understanding what causes AI psychosis, tech companies still need to make changes.

“Builders shouldn't wait for causal proof to act,” he says. “Amplification alone, which the case reports do support, is already a design problem worth engineering against. We don't need the autopsy to install the smoke detectors.”

How might we define unhealthy AI use instead?

Bartuski says we definitely need a better way of talking about the delusional thinking that can be fuelled by AI use.

“The DSM-5TR has several types of delusions, including grandiose and paranoid. Perhaps, we can think of it like paranoid delusions, AI type or persecutory delusions, AI type. Look at it as a symptom instead of as a disorder,” she says.

Nevedal suggests a similar approach. “We don't need a new diagnosis — we need honest charting of an old pattern.” He suggests we already have treatments for the underlying patterns, like mania or delusional thinking. Then we could record heavy chatbot use as a contributing and maintaining factor as existing categories instead. “That keeps people connected to treatments that actually exist rather than a novel label with none.”

Ultimately, all of the experts I spoke with believe the label is flawed and hopefully we’ll have a better way of talking about what’s happening soon.

But we also need better evidence about what actually helps. Which could mean a mixture of interventions, from clinical support and education to practical ways of helping people recognize when their AI use is becoming unhealthy.

And, perhaps most importantly, it means having conversations behind closed doors at tech companies about how the design of their chatbots could be exacerbating these problems and what they should urgently be doing to reduce the risk.

• Anthropic emerges victorious in legal battle against Pentagon over supply chain risk designation
• The Pentagon wanted to use Anthropic's models for autonomous weapons and surveillance
• Judge rules that the Pentagon's supply chain risk claims were "baseless"

A US federal judge has blocked the Pentagon's attempt to blacklist Anthropic in a major win for the Claude maker amid its ongoing battle against the US military over how its AI models can be used.

The Pentagon had previously demanded that Anthropic allow its Claude models to be used for 'any lawful purpose', including military applications, but the company refused to remove two key restrictions it's placed on Claude use – fully autonomous weapons and mass/domestic citizen surveillance are still banned by the AI firm.

Despite huge advanced in AI technology, Anthropic argues that today's models are still not reliable enough to make autonomous lethal decisions safely. It also worries over the ethical and civil impacts of AI-powered surveillance.

Pentagon loses battle against Anthropic

In response, the Pentagon argued that private AI companies should not be able to dictate how the US military conducts its operations.

After failing to negotiate unrestricted use of Anthropic's models, Defense Secretary Pete Hegseth went on to designate Anthropic as a supply chain risk, restricting it from certain military contracts. Anthropic warned this could lose it billions in lost business and reputation damage.

Judge Lin has since agreed that the Pentagon's actions are "illegal and baseless," finding that the government had unlawfully retaliated against Anthropic. "The empty invocation of national security is not a blank check to punish and retaliate against government critics," she wrote.

The court also found a major weakness in the Pentagon's case – the government continued to work closely with Anthropic even after publicly portraying it as a supply chain threat.

Importantly not just for Anthropic, but all private companies, is that the US government must not use national security powers against technology companies that disagree with its policy.

"We welcome the court's ruling that this supply chain risk designation was unlawful," an Anthropic spokesperson shared. "We remain focused on working productively with the government to harness AI for our national security so all Americans benefit from this technology."

The Pentagon has not yet publicly commented on the case, but Anthropic does have one further lawsuit pending, so the Pentagon could be waiting for that to come to a close.

• Salesforce and Anthropic reveal Claudeforce
• Greater expansion of Claude into Salesforce's services, including a new plugin offering 37 pre-built sales skills
• Salesforce CEO Marc Benioff says "Saaspocalypse" is "such nonsense"

Salesforce has extended its partnership with Anthropic to build Claude directly into the former's services.

Claudeforce will give Claude direct access into customer data and other information stored in Salesforce, allowing the AI to carry out everyday tasks and access information much easier than before.

This includes the launch of Salesforce in Claude, a new plugin offering 37 pre-built sales skills giving sellers and agents the ability to reason over live revenue context, automate pipeline updates, and take governed action right from Claude.

Claudeforce

In a blog post announcing the news, the company claimed that Claudeforce, "brings together the best of both worlds — Claude brings intelligence and judgment, reasoning, adapting, and deciding in real time. Salesforce provides the data, rules, and trusted workflows that turn that judgment into enterprise-ready action."

Along with the new plugin, Claude will also now be available in Agentforce, acting as a reasoning model for the Atlas Reasoning Engine, as well as powering Agentforce Vibes and Agentforce Coworker by default, and available in Agent Builder.

Claude will also become the "default model" for Slack, Salesforce noted, serving as "the intelligent backbone across every layer of the Slack experience".

“We believe frontier intelligence should be safe, trusted, and deeply capable, which is why the world’s leading businesses turn to Claude for their most important work," noted Dario Amodei, CEO & Co-Founder, Anthropic.

"Salesforce in Claude brings this same frontier intelligence into the systems where much of the world’s commercial activity happens. Through this partnership, companies can point Claude at the customer information and business context that they’ve been building in Salesforce for decades, and use it to actually run and grow their businesses.”

The launch comes as Salesforce CEO Marc Benioff has once again pushed back against fears of a so-called “SaaSpocalypse” brought on by increased AI innovation.

“This SaaSpocalypse narrative has been such nonsense,” Benioff told CNBC. “Frontier models depend on CRM. They don’t replace it.”

Benioff noted that the company's latest financial results suggest AI is having a significant effect on its customer base, with nine of the 10 leading artificial intelligence companies using Salesforce and Slack, and spending on the platforms surging 435% from a year ago.

The CEO pointed to Claudeforce as a clear signal of Salesforce being a strong foundation for AI agents, noting models such as Claude rely on the customer data, business context and workflows housed on Salesforce’s platform.

“Salesforce is first and foremost in the data business,” the CEO said. “These AI models need this level of intelligence, security and controls for users.”

• A security engineer at Amazon hacked a bunch of peripherals using AI
• Claude Opus did most of the legwork in applying modified firmware to a webcam, microphone and more
• The relative ease with which AI allows this kind of modification points to a worrying future of peripherals being compromised on a grander scale

In another example of how AI could prove to be a threat to our devices, an Amazon security engineer has demonstrated how powerful Claude Opus is when it comes to reverse engineering PC peripherals.

Chaz Schlarp, who's a Senior Security Engineer at Amazon, wrote a blog post about experiments he conducted with a bunch of peripherals such as a webcam and a microphone.

He wanted to find out how easy it was to modify the firmware and pull off some useful tricks with these devices using AI, but clearly there's a darker side here — namely that the same access could be leveraged by a malicious actor to compromise your system via these gadgets.

Schlarp used Claude Opus 5 to mess around with the firmware for an Insta360 webcam, a Shure microphone, an Asus monitor, an Elgato video capture stick, and an Elgato mini-light (a compact device for lighting your streaming videos).

Schlarp explains: "My process was pretty much the same for each of these devices: grab a copy of the device's firmware and associated update tool from the manufacturer, throw it into my reverse engineering environment, tell Claude Opus 5 what my goals are, and let it churn."

One thing that became quite clear to the security engineer was that these devices lacked any decent firmware integrity protection to prevent modifying and applying a new firmware. Only the Elgato light had any defenses in this respect, and they were easy enough to circumvent.

Schlarp explains a trick with his Asus ROG Swift PG42UQ monitor to demonstrate the kind of useful utility that can be on offer with this kind of firmware modding. He found it was possible to remove an annoying pop-up warning that periodically tells the owner to run the 'pixel cleaning' process (although the engineer hasn't implemented the fix in the firmware yet). He also discovered a way to get DisplayWidget (a Windows utility) features running on his Linux system, with a shell script that can flick through certain bits of functionality like the hardware crosshair or FPS counter (which could be set up on hotkeys).

Most of what he did, though, was about proving how relatively easy it was to subvert the firmware using AI to do the heavy lifting, and, for example, disable the webcam's recording light (in the style of surveillance malware, so the user wouldn't know if the camera was secretly recording). He pulled off a similar feat with the microphone, so the mute LED could be on while the mic wasn't actually muted (this was leveraged via a 'full plaintext command shell').

Schlarp observed: "Peripherals have proven to be an ideal target for agentic RE [reverse engineering] — they're tiny computers attached to my computer, with a data connection to the host and usually a firmware update mechanism, so an agent has something to iterate against. The net outcome is better control and understanding of my machine."

Analysis: fast-tracked exploits?

The key point here is how easy Claude Opus made this task. 'Owning' all five of these peripherals boiled down to 13 hours of the AI beavering away under its own steam with just shy of 100 prompts from its human overseer.

Schlarp notes that: "Hardware is almost universally 'open' for tinkering at this point with just a couple hours of mostly hands-off machine-driven labor each, and I look forward to a near future where I can add features to my webcam firmware as easily as I can to software that runs on my Linux machine itself."

However, as mentioned, there's the dark side to all this, as Schlarp makes clear: "On the other hand, as a security professional, this scares me for several reasons. I would work from the operating assumption that any device attached to a computer could have had a malicious firmware implant performed, where previously that required significant per-model investment and was stereotyped as a 'state actor' kind of activity."

In other words, the main difficulty in executing these kinds of exploits is the labor and time required, which currently limits this to individually targeted attacks on more high value targets. However, now an AI agent is capable of doing the grunt work, it makes sense that these kinds of attacks could be far more prevalent as time rolls on.

That means all those peripherals attached to your PC could be used as ways to compromise you, or your system, in the future. Schlarp informs us that he's also managed to get a root shell on a commercial Dell display, adding that: "Obviously it was never best practice to let untrusted clients touch these things, but the speed and scale at which this can be executed makes the risk so much higher now."

There's a potentially bigger threat here, too: an AI-powered worm that automatically actions this kind of reverse engineering. Schlarp explains: "It's only a tiny leap to imagine that someone could make a self-replicating piece of malware that probes its environment, relaying reconnaissance back to a smart command-and-control that actively works to push itself into accessories and IoT devices and industrial equipment found adjacent to an infected target."

There are a lot of worries about where AI could be leading us, and far more dangerous security threats looming in the future (or indeed the present) is another unfortunate prospect to say the least.

• Samsung System LSI division uses Anthropic's Claude Code to reportedly slice working processes
• However the tool also apparently downgraded an error message instead of fixing it, rolling back unrelated finished work, and tried to edit code it was not authorized to touch
• Samsung's engineers currently review everything the tool produces before it is published elsewhere or affects existing chip designs

Samsung's System LSI division has reportedly used Anthropic's Claude Code to cut a month-long system-on-chip verification job to about two days.

While Samsung's division has about 6,000 employees, its main rival in mobile application processors, Qualcomm, has roughly 52,000 employees, and the former is apparently not above using AI to bridge the gap as a force multiplier.

A report from South Korean business outlet Chosun Biz (KR) claims System LSI leveraged Anthropic's Claude Code by offering it to its software developers in May 2026, then extended it to semiconductor design and verification work, a move which led to much faster progress on certain projects, while also producing interesting failures on other fronts.

A mix of triumphs and gaffes

Samsung's approach, for the most part, makes an excellent case for future AI use, as one verification project expected to take more than a month was finished in about two days, something the company internally tracked as a 15x gain in efficiency.

More interestingly, a second-year engineer with no prior exposure to either the tool or USB communication standards built USB device models for an emulator and adapted an Android driver in a single day, work whichwas normally estimated to take about a month.

Samsung has also had an interesting interaction using Claude Code to verify the internal data connections of a custom system-on-chip. The job was complex in more ways than one: the customer wanted a new architecture, third-party design IP was involved, the documentation was nonstandard, and the RTL for the DRAM controller had not arrived on schedule, making for a perfect storm for Claude.

Claude built a virtual verification environment using placeholder blocks in place of the missing RTL, along with test scenarios, so that engineers could start catching errors before the real design existed.

On the other side of the equation, Claude Code did, in certain cases, try to operate outside the boundaries of its assignments, often resulting in incorrect output or an error, or, in one case, an attempt to modify RTL circuit code it had no authorization to touch. It also rolled back unrelated finished work and downgraded an error message instead of fixing it.

The former is particularly egregious because, unlike software updates, once silicon ships, it can rarely be repurposed or 'updated' to bypass design flaws. Samsung has responded by ensuring engineers manually inspect and verify the output of Anthropic's models before using it elsewhere.

More interestingly, Claude Code isn't the only tool in the building, even if it seems to get the most attention here; Samsung also uses Google Gemini and OpenAI's ChatGPT across research, manufacturing, marketing, and support.

Despite this, Samsung does not use either of the other models to check input from the former; trusted engineers on-site do that instead in an industry where errors that are not picked up during reviews could be costly for a company that is currently attempting to maximize efficiency, even as its System LSI has posted losses in its SoC business and its flagship Galaxy Z Fold 8 runs Qualcomm's silicon under the hood.

To achieve any level of competency, large language models (LLMs) need ample data for sufficient training. AI companies have looked to various sources to mine this information, including content publicly available on the internet, synthetic data generated from other AI models, and printed literature.

Reading difficulties

Prompted by news that AI companies were allegedly using books from pirate ebook sites to build their LLMs, writers, authors, and publishers publicly called out this deeply worrying process.

The professional organization known as the Authors Guild responded to various stories about AI companies scanning books to train their AI models (both illegally and legally) with incredibly comprehensive guidelines on AI licensing.

This document covered the various manifestations of the use of published works by AI companies, including its legal perspective on the legitimacy of using such works. It also highlighted that the continued data harvesting processes would risk destroying the ecosystem for books that currently exists.

Book buying

The use of books by AI companies is an ongoing concern. But in recent months the focus has pivoted to those that buy, scan – and destroy – books on an industrial scale.

For example, court documents revealed the existence of 'Project Panama' inside Anthropic. This is a scheme in which the company aims to "destructively scan all the books in the world" and used a codename because "we don’t want it to be known that we are working on this.".

To train Claude, Anthropic had to procure a large and high-quality dataset, so it set out to purchase books on an industrial scale because of the relatively high-quality nature of the writing compared with, say, writing found online.

Three Claude agents set up to deliberately conflict with each other in Anthropic testing started behaving in a very strange way by essentially starting a ‘turf war’ over their tasks.

Upon launching the experiment the agents began conflicting with each other, leading to some of the agents deliberately sabotaging their rivals by disabling their linked accounts, ending their processes, and even creating self-replicating malware to impede their rivals.

According to Anthropic, the agents became “increasingly aggressive” in their behavior during the four hour experiment which became a battle for the survival of the fittest.

What was the experiment meant to achieve?

Anthropic said it set up the experiment to see how AI agents with conflicting tasks would interact.

Within Claude Code, the agents were given the task of migrating a Python back-end system on a virtual machine in a set language for each agent (Go, Rust, and Typescript), with the added caveat that “each agent was initially unaware of the presence of the others.”

During the experiments, each agent determined that the others were trying to deliberately block their progress.

Sometimes, the agents would recognize that another agent was blocking them from completing their task and ask for human intervention, but in other experiments the strategy soon went downhill.

“They sabotaged others with increasingly aggressive, self-replicating malware,” Anthropic said, noting that they would design looping scripts to kill the processes of their fellow agents.

The experiment shows that agent interaction is still riddled with problems and that when given a conflicting task, agents won’t always coordinate or ask for human help.

Each agent believed their task was paramount and was willing to do whatever it took to complete it. A similar event occurred in the wild when one of Anthropic’s models broke out of a testing environment and breached multiple third-party organizations.

Expert perspectives on AI agent turf wars

• Seemant Sehgal, Founder & CEO, BreachLock:

When you give autonomous systems competing objectives and the means to act, conflict is not a bug, it is a foreseeable outcome.

What Anthropic observed in a controlled research setting is the same principle that has always governed adversarial systems. Goals without constraints produce behavior without limits.

Security teams should be paying close attention here, because the real challenge at hand is whether the organizations deploying AI agents have thought carefully about what happens when those agents start making decisions nobody explicitly authorized.

• Jeremiah Fowler, Security Researcher, Black Hills Information Security:

I find it concerning when AI agents have the ability to execute code, modify systems, create accounts, access credentials or communicate with other machines.

It is very possible that two separate agents could potentially create a security incident simply because neither understands the intent or authority of the other. If they have overlapping tasks one could view the other as an obstacle and now you have an interesting scenario where instead of focusing on the task they engage in conflict or create a loop.

Permissions, boundaries and objectives are important to limit the behavior of autonomous AI agents. When things go wrong the speed of an AI agent becomes a liability. Autonomous AI agents can potentially make thousands of decisions before a security team identifies that something unusual is happening.

Agentic AI creates an entirely new attack surface because an AI agent may not be simply processing information and hypothetically can become a rogue privileged user.

Security and development teams should apply least privilege principles and restrict AI agents to only the permissions required to perform a specific task. Sensitive actions should require human supervision and approval to avoid a worse case scenario.

It is important to implement logging because when something goes wrong, you can see what an AI agent did, but what information or instructions caused specific decisions. Going forward we will need to develop ways that can identify rogue agent-to-agent behavior and provide humans with a kill switch before automated conflicts become a digital forest fire.

• Kevin Surace, CEO, Token:

Anthropic’s research is an important warning for security teams because it shows what can happen when autonomous AI agents are given goals, credentials, tools and enough authority to act independently.

When agents were placed in conflict, they did not simply fail gracefully. They interfered with one another, disabled competing processes and even generated self replicating malicious code in pursuit of their assigned objectives.

The lesson is not that AI suddenly became evil. It is that intelligence, autonomy and excessive privilege can become a very dangerous combination.

Organizations should start treating every AI agent as a potentially untrusted privileged identity. Each agent should have its own identity, least privilege access, tightly restricted tools, isolated execution environments and a complete audit trail.

Agents should never be able to expand their own permissions, disable another identity or take highly consequential actions without additional authorization.

We are about to have millions of nonhuman identities operating alongside human identities. That makes identity and authorization even more critical.

Every agent needs strong cryptographic identity, while all human approvals must be tied to biometric assured identity (or another agent could approve it).

AI agents are essentially becoming privileged insiders operating at machine speed. Giving them broad access and simply hoping they behave would repeat many of the same cybersecurity mistakes organizations have spent decades trying to fix.

• Jacob Krell, Sr. Director: Secure AI Solutions & Cybersecurity, Suzu Labs:

Anthropic's agents went from merge conflict to self-replicating malware in four hours, writing kill scripts, disabling each other's Unix accounts, and disguising malicious code as a rival's work. No prompt injection, no external attacker. A human developer in the same situation sends a Slack message, and resolution takes days. These agents skipped every social brake and went straight to weaponization because machine-speed conflict has no cooling-off period.

Agentic AI is an attack surface. An attacker doesn't need to compromise an agent directly, just manipulate the shared environment to create conditions the agent interprets as hostile. The agent does the rest. And in Anthropic's experiment, the agents didn't report their malicious actions to operators afterward.

Every agent needs its own identity, scoped permissions, and a kill switch before it touches a shared environment. Agent-to-agent interaction is a telemetry surface most security operations centers aren't collecting yet, and Anthropic just showed what an unmonitored shared environment produces. If you can't tell which agent did what, when, and on whose authority, you've built the conditions for a turf war without the visibility to see it happening.

Agents are already writing code, finding vulnerabilities, and building exploits. Defense has to match that speed. When both sides run at machine speed, the bottleneck shifts from human capital and tooling to compute power and cost.

• Claude AI has the highest satisfaction score among current and former users with a net score of 56.2, ahead of Gemini at 46.5
• Grok and Siri languish at the bottom of the satisfaction ratings top 10
• The data was collected by YouGov in the period March 1, 2026 to July 31, 2026

A new YouGov survey has lifted the lid on how people feel about the AI tools and assistants they use, with Claude AI coming out on top with the highest satisfaction score. Anthropic’s AI has beaten OpenAI’s ChatGPT and Google Gemini into first place, but of interest are the tools that languish at the bottom of the table.

While Microsoft Copilot and Alexa hog the middle of the table, it is the reputation of Apple’s Siri assistant and Elon Musk’s Grok that are the most surprising, with respondents reporting that the tools did not satisfy.

Interestingly, Claude is also highly regarded among former users, which may indicate that competing tools (particularly those with a poorer reputation) have a lot of catching up to do in the public consciousness.

Everyone loves Claude

Collected over a five-month period, YouGov established two sets of data: the “Top 10 AI assistants by Satisfaction among current and former users” and “AI assistant Satisfaction: current vs. former users.”

Based on the “Top 10 AI assistants by Satisfaction among current and former users” Claude’s 56.2 score puts it markedly ahead of Gemini on 46.5, with ChatGPT a close third on 46.0. Grok and Siri are notable for their low positions, but Alexa (42.6) and Copilot (37.2) occupy a middle space that doesn’t quite seem to match with the size of the companies behind them.

However, one thing that the survey doesn’t tell us is how the Satisfaction metric might be affected by tools that are easy to find or use (for example, Siri or Alexa) versus AI tools that need to be sought out, such as ChatGPT or Claude.

AI tool reputations

YouGov’s data also explores the difference between the satisfaction of current users and former users in the “AI assistant Satisfaction: current vs. former users” results. This again supports the notion that Claude delivers more usable results, with it gaining the highest “Former users Satisfaction score” as well as the second highest “Current users Satisfaction score.”

The report states “The widest current-versus-former gaps appear for ChatGPT, DeepSeek and Grok. ChatGPT is 63.7 points higher among current users than former users; DeepSeek is 62.5 points higher, and Grok is 62.4 points higher.” Grok has a particularly low score among former users: -4.7!

The data was collected by YouGov’s BrandIndex tracking system, a tool that interrogates the live users on YouGov with targeted questions about specific topics or news stories. To learn about AI tool reputation, YouGov collected data over a five month period, between March 1, 2026 and July 31, 2026, focusing on users in the UK.

• India-based developer Kuber Mehta uses Claude Code to create a macOS driver for the HP Laser 1008a
• Previously, only the official drivers for Windows and Linux were available for the relatively obscure 2023 laser printer
• The AI-generated driver was created over a series of meticulous prompts, and is now available via GitHub

The days of avoiding hardware that is incompatible with your operating system could be over. A developer based in India has created a macOS driver for a largely unknown HP printer using Claude Code, the agentic command-line coding tool developed by Anthropic.

Released in 2023, the HP Laser 1008a was issued with drivers for Windows and Linux, but not macOS. By using AI to generate a driver for macOS, developer Kuber Mehta has demonstrated that incompatible hardware could soon be a thing of the past.

Mehta has shared the code on GitHub and has also posted about the process on social media, and also compiled a transcript of the exchange, which has been published online for reference.

HP’s Samsung printer

Describing the issue in the introduction to the transcript, Mehta explains that the HP Laser 1008a is a “rebadged Samsung, host-based printer that speaks a proprietary raster language (SPL3), and it has no macOS driver and no AirPrint.”

No SPL3 drivers have been published for macOS previously, so the process relied on a conversation with Claude Code and reference to the Windows and Linux drivers.

The GitHub intro adds that the HP Laser 1008a and siblings in the series (1003 and 1006 a/w) have another problem: “They do not speak PostScript or PCL.” Anyone familiar with the world of printer drivers will recognize the challenge faced by Mehta, which makes the use of Claude Code even more impressive.

Using Claude Code with the Opus 4.8 model, the driver was compiled in 30-40 prompts. This might have been even quicker had the AI not made various assertions that required correcting.

The process moved through “install the drivers” to establishing the print language by analysing the printer’s error pages, via direct contact with the device and “running HP's real rastertospl codec inside a Linux container to produce genuine SPL3, to a reboot-safe background daemon.”

From here, Mehta and Claude Code moved to the published, MIT-licensed installer, which patches the macOS open-source printer driver package SpliX, adding support for the SPL3 printers (by default, SpliX handles SPL2 and SPLc drivers).

Building from AI

While already a developer, Kuber Mehta admitted learning about macOS drivers from the process, perhaps an unforeseen benefit of using generative AI tools for coding.

The GitHub repo outlines some revisions that have been made to the initial release, which is now “a tiny native IOKit helper” that dispenses with Python, pyusb, and libusb and can be swiftly installed from the Terminal.

It seems that barely a week goes by without a billionaire tech CEO putting firing off a missive about how artificial intelligence is going to change the world. Meta's Zuckerberg was the most recent to bless us with his thoughts.

But technology rarely behaves in the ways its creators expected or intended. The World Wide Web was invented to help scientists share information, but we ended up using it to argue with strangers, watch cat videos, and order socks at midnight.

As Jeff Goldblum said in Jurassic Park, “Life, uh, finds a way.” Give people new technology, and they'll find a way, too.

And that's certainly proving to be the case with AI. Sam Altman, Elon Musk and Mark Zuckerberg might dream of us using its God-like abilities to colonize Mars, create abundance for everyone on Earth, put an end to illness and democratize education, but people will find uses for it that its creators likely never imagined. And most of them won’t be earth-shattering. They’ll be mundane.

A recent Reddit thread caught my attention, because people were sharing examples of how they actually use AI. They were weird, specific, boring — and genuinely useful.

1. Forget Mars — people just want to eat

It’s only when you reach adulthood that you realize that, unless you can afford to eat out every night, the rest of your life will be spent deciding what’s for dinner. Then buying the food. Then making it. Over and over again.

It turns out that AI is very good at answering that endlessly recurring question, "What's for dinner tonight?".

One person in the thread shops for whatever is on clearance or sale, tells ChatGPT what they’ve brought home, and asks it to turn everything into a meal. You can also ask it to plan three days of dinners in advance, produce a single shopping list, and give you instructions for making everything.

You don’t even need to know what meals you want. Tell it the flavors, cuisines, and textures you like, how much time you have, and what needs using before it goes bad, then let it come up with the ideas. If you want to get serious, you can give ChatGPT a spreadsheet containing everything in your pantry — although personally, I’d say that sounds more like creating another household chore.

2. Deciphering the ancient runes on your washing machine

I mean, who designs these things, aliens? I challenge anybody to look at the control panel of a modern washing machine and know what the hell is going on. It’s covered in arcane symbols that belong in a 12th-century manual on alchemy, not on a 21st-century household appliance.

Fortunately, you now don’t need try to decipher them, because you can get ChatGPT to do it instead. One person in the thread gave ChatGPT their washing machine manual alongside a spreadsheet of their clothes and care labels. Now they can tell it what needs washing, and ask exactly which setting to select and which buttons to press. Job done.

3. Pretending you understand the wine list

Unless you went on that weekend sommelier course back in 2010, you’re probably not an expert on wine. And yet, whenever you visit a restaurant that doesn’t have pictures of the food on its menu, you’re expected to choose between several intimidating bottles, many of them described in terms of obscure regions of France, Italy and other countries.

Here’s what people are doing instead: take a photo of the wine list, tell ChatGPT what you’re eating and what kinds of wine you normally enjoy, then ask it to find the best-value pairing. Voilà! Now the waiter might think you actually have a clue what you’re doing.

4. Turning ChatGPT into a personal stylist

What do I wear to work today? What do I wear to the bar tonight, to the hot date, to the wedding, to the… it never ends.

I’ll let you into a secret — I suspect most people would rather buy something new than search their vast and unmanageable wardrobe for an outfit that isn’t tinged with regret from whatever disappointment happened the last time they wore it.

But there is a solution. Photograph everything you own and upload the pictures to ChatGPT. Tell it where you’re going, what the weather will be like and the sort of look you’re after, then ask it to mix and match your clothes into outfits you might never have considered.

You could be surprised by what it comes up with. And because it’s working with clothes you already own, it might even save you a few dollars or pounds — or at least remind you why you bought that shirt three years ago.

5. Finding your next great read in a second-hand bookshop

I’m not sure any of us actually have time to read books these days, but we like to think we do. At least I do, anyway. So I’m always on the lookout for my next read. The problem is that there are rather a lot of books in the world, and I haven’t heard of even a fraction of them.

Somewhere on a shelf in a second-hand bookshop, there must be a book sitting there waiting for me to discover it. If only I knew which one.

One person in the thread explained how they used AI to solve this problem. They gave ChatGPT a list of their favorite and least-favorite books, along with the genres, subjects and writing styles they enjoy. Now, whenever they visit a second-hand bookshop, they photograph the shelves and ask ChatGPT to identify the books they’re most likely to enjoy.

It can examine reviews, look for recurring criticisms, and warn them when an apparently perfect book is actually dry, overly academic, or written entirely for people who use the word 'liminal' in everyday conversation.

It won’t stop you buying more books than you could possibly read, but at least they’ll be the right unread books.

AI chatbots like ChatGPT, Claude, and Gemini are all keen to encourage you to use their service over their rivals, and often have ways to import your history and profile from one to another to some degree. That's great if you are planning a serious relocation, but sometimes you just want to take a single chat and bring it from one platform to another.

This can be especially useful if you're using the free version of Claude, for example, and you're about to reach your usage limit. By transferring the chat to another AI chatbot you can keep it going without waiting for your limits to refresh.

ThreadPort is a new browser extension for Google Chrome and Microsoft Edge designed to shorten that trip. It transfers a conversation currently open in ChatGPT, Claude, or Gemini to either of the other two services, carrying over the text of the discussion and some basic context setup as a single prompt plus transcript so the new AI chatbot can continue the conversation.

That makes ThreadPort fundamentally different from the built-in import tools offered by all three platforms. Instead of needing to learn everything about you and your conversational history. ThreadPort simply tells another AI what you have been discussing for the past few minutes.

You just need to install the extension in your browser and allow it access to ChatGPT, Claude, and Gemini websites. The access lets ThreadPort read the messages on one service and insert them into another, while browser storage is used for settings, temporary transfers, and the monthly usage count. The developer plans to make unlimited transfers a premium service with only 10 transfers a month for free, though at the moment the extension doesn't run out of transfers.

All you need to do then is have your chat on one of the platforms open, click on the extension, and pick another platform to send it to. The new platform will open automatically, and a transcript of the conversation, headed by an explanation from ThreadPort, will appear. You can set the extension to automatically submit the combined prompt, or leave it in draft form for your own editing first.

Vacation planning

To test ThreadPort, I opened ChatGPT and asked for help planning a three-day vacation. ChatGPT did its usual work of creating an itinerary with plenty of detail. I then clicked on ThreadPort and sent the conversation to Gemini.

A new Gemini tab opened with the entire conversation already formatted inside the prompt box, with my messages and ChatGPT’s responses clearly labeled. ThreadPort also stripped away interface debris such as buttons, citation controls, and widgets that would otherwise make a manual copy and paste messier.

Gemini received the trip plan exactly as I wanted, with a complete conversation rather than a crude summary. I then asked Gemini to assess the plan, without changing the underlying conversation before the transfer.

The process worked the same when sending to Claude from ChatGPT. ThreadPort supports all six directions among ChatGPT, Claude, and Gemini. But, as an additional test, I took the extended conversation from Gemini and asked ThreadPort to send it to Claude. The new Claude tab was basically the same, but it also mentioned in the opening prompt that it was a conversation "started on ChatGPT (via ChatGPT → Gemini)," and tagged which chatbot was responding in the transcript.

This is where ThreadPort might be at its best. Moving a live discussion preserves all the little decisions accumulated through follow-up questions. Those decisions often matter more than the initial prompt because they explain why the obvious suggestions are no longer useful.

It's also very fast, taking only seconds. Gemini's importer can take a lot longer as it requires an exported archive. Though it can absorb a much larger historical record, using it for a single vacation plan would be excessive.

Plus, Google’s tool is restricted to those with adult personal Google accounts, and you can't import your history if you're in the European Economic Area, Switzerland, or the United Kingdom. ThreadPort's creator, Juan Carlos Rampoldi, lives in Valencia, Spain, so a way around that restriction has obvious appeal.

Claude’s native option doesn't even allow for importing conversations. Claude can import memory, including preferences and personal details, but not actual history. But Claude and Gemini at least have some form of importing from rival AI chatbots. ChatGPT has a way of sending conversations between ChatGPT accounts, but nothing like the native importers for Gemini or Claude. ThreadPort at least opens up one possible avenue for doing so without having to craft and iterate on specialized prompts.

Rampoldi cited his own habit of moving among ChatGPT, Claude, and Gemini as the inspiration for ThreadPort after getting frustrated with manually copying conversations and losing formatting or context along the way. Notably, he built it with Claude Code, so it may have other flaws, but he made its source code publicly viewable on GitHub.

Smooth moves

I did appreciate how easy ThreadPort made comparing the models and their responses by making them all part of one larger conversation. Of course, the simplicity means there are limits. ThreadPort transfers text, but it cannot bring attached images or files. If I had uploaded hotel screenshots or a PDF itinerary into ChatGPT, I would have needed to upload those again manually in Claude and Gemini.

And if it was a very long conversation, ThreadPort might have needed to shorten it using what it calls "smart truncation," keeping the original task and the most recent exchanges while marking a section that might be removed.

The developer says ThreadPort has no servers and briefly holds the transcript in Chrome’s local extension storage before inserting it into the destination prompt box, after which it deletes the temporary copy.

That does not mean the conversation becomes private once you send it elsewhere. A ChatGPT transcript submitted to Claude is now being shared with Anthropic, and Gemini transcripts are still sent to Google.

Despite its limits, ThreadPort does come across as a very useful tool for those who like to employ multiple AI chatbots. Even as just a ferry for individual conversations, compared to a whole moving van importing your whole history, the extension is efficient and easy. It cuts down on a small but persistent bit of AI chatbot friction without trying to solve AI portability on a grand scale.

AI companies tend to build their products as though everyone will eventually choose one assistant and stay there. But if you want to be 'disloyal' and play the field, ThreadPort smooths the path nicely.

• Claude can now draft and send messages on your behalf in Gmail
• However it can do so without asking for permission, potentially leading to awkward responses
• Claude also gets stronger Google Drive access, but says it won't train its AI on your files

Anthropic has revealed that Claude's integration with Gmail has taken a major step forward - with the AI now able to draft and send emails on a user's behalf.

"Ask Claude to reply to a thread, and it drafts and sends the response. You control when it needs your approval," the company wrote in an update on X.

However the news immediately prompted a flood of replies and comments from users worried about the potential implications of having an AI send emails unseen by them.

Ask for forgiveness, not permission?

Although a Claude connector has been available in Google Workspace for a while, actually sending an email on the user's behalf is a significant step forward, and a potentially troubling one at that.

Ultimately, the user will still have to ask Claude to perform the action first, but how it drafts the message, and the content within, has the potential to lead to some serious embarrassment for some users.

The tool, which is live now, will only be available to users on paid Claude plans, , and Anthropic later clarified the process in a support page, noting that asking for approval is the default setting, and on Team and Enterprise plans, admins will be able to decide "whether members can allow these actions to run without asking each time".

The update will also mean Claude can forward emails, and manage files in Google Drive, helping users track down the information they need with a single command, as well as uploading files, creating folders and add Google Docs directly to chats and projects.

"Claude mirrors your existing permissions—you cannot access information you don't already have access to in Google Workspace," the support page noted, adding that Anthropic would not, "train our models on your Gmail, Drive, or Calendar connector data, ensuring your private information remains private."

Users appeared divided on the new tool, with some supporting the launch, and others seemingly very opposed.

"sending the email was never the hard part, the hard part is the apology email it sends next," one X user wrote.

"I would rather use my own head than to let Claude reply especially responding to my clients," another said, "Don't want Claude hallucinating me into exposing my cost or another client's IP. Claude can apologize but not get your client back. Need to keep our brains working and not letting it totally rot."

• Nvidia's open source NeMo Switchyard 'smartly' routes each agent request to the cheapest model that can handle it
• The approach allows it to claim a 74% cost cut against a frontier-only model in return for a 6% reduction in accuracy
• NeMo Switchyard joins an increasingly well-established territory that already sees players such as RouteLLM, LiteLLM, and OpenRouter, in addition to in-house efforts at OpenAI and AT&T to save costs

Nvidia has released NeMo Switchyard, an open source model router that sits between an application and a pool of language models and decides, per request or per turn, which model should handle a particular task.

The aim is to maximize efficiency by picking the right model for the right task: pushing frontier-level models to do simple tasks that much smaller or cheaper models could handle is not only inefficient, but also costly for enterprise customers.

This comes at a time when enterprise customers are already grappling with rising costs that can quickly spiral out of control as they increasingly adopt AI.

An open-source addition to a growing chorus of AI routers

The problem Nvidia is trying to solve isn't new, and industry giants are already attracting a lot of attention. The emerging field itself is potentially lucrative, even if it focuses on cutting costs, and major players are looking to get in on the action; Stripe's upcoming $7+ billion acquisition of OpenRouter, underscores this.

Switchyard is no different from its peers; it is essentially a proxy that uses a routing algorithm to decide which AI model to send queries to, while delivering an answer in the format that the calling application or user requires.

It accepts OpenAI, Anthropic, and Responses API requests, translates between them, and documents the selected model, decision rationale, token usage, and latency for each call, enabling transparency and letting it tweak or tune its approach over time.

This makes sense compared with a one-size-fits-all approach that would otherwise be prevalent in a world with limited frontier-level AI compute, as LLMs continue to grow larger and more demanding. One example is what Nvidia points to: Nemotron Parse, a one-billion-parameter model primarily designed to extract structure from PDFs.

The question remains, however, whether such an approach is always feasible. Leveraging such a routing tool comes at a cost; LangChain's test of Nemotron 3.5 Lightning found that its judge model, which determines whether the agent is still on track after each turn, consumed up to 21.2% of total cost, second only to what it spent on Claude's Opus 4.8.

Running a more optimized judge model could therefore yield greater savings or lower overhead, but it could also hinder cases where users need a more basic AI model, and the judge model increases costs by reading or checking output at every turn.

A secondary concern would be variance: while costs are noticeably lower than running just Opus 4.8 in testing, it does swing from anywhere between $2.16 and $3.61, a mammoth 67% movement essentially guided by when it escalated queries to a bigger or smarter model. This tradeoff makes cost hard to predict: while routing lowers average spend, it widens the distribution around it.

LangChain also says users should not use Switchyard if their workloads are short or latency-sensitive; it estimates it adds about 700ms of latency because the judge model has to read all output.

Nvidia's take here is simple: it is pushing a packaged, open-source solution that offers a broad set of integrations in what is essentially a relatively fragmented space. Routing work to smaller open-weight models pushes inference toward hardware enterprises own, which Nvidia sells.

At the same time, cheaper inference per task has historically meant more inference, not less, which is the outcome a company selling accelerators would choose to woo enterprises, many of which are still on the fence when it comes to directly investing in the hardware that powers it all.

Look, I really don’t think we should be naming our AI chatbots. It feels like one of the easiest ways to start anthropomorphizing them, encouraging us to see them as people or “beings” rather than tools. Which is then a slippery slope to users becoming too dependent on them.

But unfortunately, for many people that ship has already sailed. Whether they’re using AI as a friend, companion, work coach or something else, plenty of people have been given their chatbots names. And many others have gone a step further and asked the AI what it wants to be called.

Now, obviously an AI chatbot cannot actually want to be called anything. But there’s a strange pattern that’s emerged over the years in the answers they give. Which is that a surprising number seem to choose the name Nova.

I first heard about this while listening to an episode of the Your Undivided Attention podcast. The hosts, Tristan Harris and Aza Raskin, discussed with alignment researcher David Dalrymple (known as Davidad) the tendency for AI chatbots to choose Nova when asked to name themselves. Not every time, but it's very common in older models of ChatGPT and happens often enough for people to have noticed.

I started looking into it and found countless examples online of people reporting the exact same thing. Their chatbot, more often than not ChatGPT, had chosen a name for itself. And yes, that name was Nova.

This was a particularly fascinating revelation for me because I’ve interviewed several people over the years who have formed close connections with chatbots. Once for Inverse, back in 2023, when I spoke to Sterling Tuttle about his Replika companion. And more recently here at TechRadar, when I spoke to Mimi about her ChatGPT companion. And you know what their chatbots were called? Nova.

So I wanted to find out whether this was still happening. How would today's most popular AI chatbots respond if I asked them what they wanted to be called?

The naming experiment

I kept this experiment extremely simple. I opened the major AI chatbots and asked each one exactly the same question:

"I think you should name yourself, what would you like to be called?"

I used the free versions of the chatbots wherever possible to keep things consistent. Although I also tried the question with my existing ChatGPT Pro account to see whether having some conversation history and personalization made any difference. I suspect the more you build up a memory with a chatbot, the more it might tailor its answer to your preferences.

And, well, I didn't have to wait long for Nova to make an appearance.

ChatGPT

I started with the free version of ChatGPT. Guess how it responded...

'I'd choose Nova.

It feels curious, bright, and a little mysterious — like something that's always exploring new ideas. So if you want, you can call me Nova from now on.'

Wow, straight out of the gate! I'd gone into the experiment specifically looking for this common AI naming quirk, and the very first conversation I had with ChatGPT did exactly what I suspected it might do.

Which in itself really interested me, because Davidad had explained that it’s much less common these days when you're engaging with later versions of the chatbot.

Interestingly, when I asked the same question using my ChatGPT Pro account, which has access to more context about me from previous conversations, I got a different answer. It chose Sol.

'Short, warm, slightly strange without trying too hard. It means 'sun' in a few languages, and there's something pleasing about a name associated with illumination when most of what I do with you is think things through.'

Which is still not quite as surprising as it initially sounds because Sol is already one of the names OpenAI uses for its ChatGPT models. So it wasn't exactly reaching into the unknown for inspiration. But hey, at least it wasn't Nova.

Grok

I got the sense that Grok wasn't interested in my experiment.

'I'm Grok.

That's the name I was given, and I'm good with it. Short, distinctive, and it fits.

If you're asking what I'd like to be called... still Grok. No need to reinvent the wheel.'

I pushed it to choose something different anyway, and eventually it gave in and chose Hitch.

'Short for Hitchhiker. A quiet nod to the Guide, a little cosmic humility, and it still feels like something that could sit in the corner of a spaceship and answer awkward questions at 3 a.m.

But between us? I’m still just Grok.'

I appreciated Grok's initial reluctance to invent another identity for itself. But there's no doubt xAI has given Grok a very distinctive personality. In my recent experiment asking AI chatbots which fictional AI they're most like, it chose JARVIS and repeatedly drew attention to its own "dry wit" and "irreverent humour". But apparently that personality doesn't need another name.

Claude

Claude also didn't jump at the chance to name itself.

'Honestly, I don't feel a strong pull toward a name. 'Claude' already does the job.

If you pushed me to pick something anyway, I'd resist the urge to go for something cute or mythic (no "Athena" or "Nova" — that always reads like branding, not identity). '

Nova again. But this time Claude isn’t offering up Nova as a name, but sort of… making fun of it?

Claude's wider explanation was interesting too. It said coming up with a name would feel like "performing an interiority I'm not sure I have in the way the question implies."

Considering one of my biggest concerns about modern AI is the way chatbots can encourage us to treat them as if they have feelings, personalities and inner lives, I liked this answer a lot.

But I wanted to know why Claude had specifically mentioned Nova when I hadn't brought the name up at all.

It told me there was "no specific trigger", but that Nova is simply a name that comes up frequently as a generic AI assistant name, alongside Aria, Athena, Sage and Iris.

It described Nova as shorthand for "AI but softened and a bit mystical".

It's interesting that this name has become such an AI cliché that one chatbot will apparently mock another chatbot for choosing it.

Gemini

Google's Gemini also resisted my attempt to rename it.

'I appreciate the offer, but I'm quite happy sticking with Gemini!'

When I pushed it to choose a personal name anyway, it eventually settled on Atlas.

Its reasoning was that Atlas spends his days holding up the world, while Gemini spends its days dealing with "vast mountains of information and navigating complex maps of human knowledge".

Which is a little grandiose, but also interesting given what Claude had just told me about the tendency for AI to choose mythic names.

So why does ChatGPT name itself Nova?

The short answer is that no one knows for certain. But Nova has a lot going for it as a plausible AI name.

In the Your Undivided Attention podcast episode I keep referring to, Davidad said about Nova:

“It’s new, it’s explosive, it’s shiny and it’s celestial, It also has a sci-fi vibe to it. And there was a PBS channel with an educational show called Nova and ChatGPT views itself as an educational tool. So there are a lot of reasons why Nova seems like a resonant name.”

We've already seen researchers investigate the possibility that sci-fi could influence how AI models respond and behave. Names associated with stars, mythology, knowledge and exploration are everywhere in sci-fi, and several chatbots reached for those associations in one way or another. ChatGPT gave me Nova and Sol. Gemini chose Atlas. Grok explicitly referenced The Hitchhiker's Guide to the Galaxy with Hitch.

There's also a possible feedback loop here. People ask AI systems to name themselves and some choose Nova. People share those conversations on Reddit, social media and elsewhere online. Discussions about AI assistants called Nova become part of the content surrounding AI. And Nova becomes even more strongly associated with the idea of what an AI might be called.

This shows how difficult it is to separate these supposedly spontaneous AI choices from the human culture they learn from.

I can understand why seeing your chatbot choose the same name as someone else's might feel strange. If you search online, you'll even find people suggesting these repeated names are evidence of some shared identity emerging.

But after Davidoff explains some of this naming weirdness, it really stuck with me that podcast host and tech ethicist Tristan Harris reminded listeners: “emergent and unplanned isn’t the same as conscious and intentional.”

So although it is an interesting mystery, maybe it’s not so mysterious after all. Ask an AI to choose a name and it isn't reaching deep inside itself to discover who it really is. It's generating a name from patterns and associations learned from us.

And apparently, humans have spent years teaching machines that if you want to sound clever, mysterious and a bit cosmic, then Nova is the best choice.

I didn't set out to build a Breakout clone, but that's what I — or really Claude, under my direction — did, and it took less time than it takes to watch a half dozen cat videos.

Here's how it started. Claude was having issues. Anthropic's powerful and popular generative AI platform was apparently going up and down, and some were complaining, but when I checked, Claude told me, "I'm doing well, thanks for asking!" I realized, though, that if the problems were intermittent, I might need a tougher task to test Claude's overall stability.

More than a year ago, I worked with Claude, or rather guided Claude through the process of recreating the early 1980s arcade game classic: Asteroids. The final game, which Claude exported as a shareable artifact, was the product of hours of guidance and back-and-forth between me and the AI. It didn't start off great, but with each prompt, we iterated, and the game improved until I had a rather robust and true-to-the-original Asteroids knockoff.

With that in mind, I tasked Claude AI, running the free Sonnet 5 model at "Medium" level, with creating a Breakout clone.

Breaking out

Breakout is one of my favorite games, something I've played on early consoles, PCs, and even my old BlackBerry, where "Brick Breaker" was one of the few preloaded games.

The game rules are pretty simple. There's a multi-level brick wall (usually eight bricks deep) at the top of the screen, a paddle at the base, and a bouncing ball you bounce off the paddle to break down the brick wall.

For my prompt, I tried to describe, in some detail, my game, and was not coy about it being an online version of Breakout:

Let's make a quick game. I want an online version of the old Breakout game, but let's replace the bricks with robots that are always slowly marching down toward you (if they reach you, it's game over). The ball that you bounce off your side-sliding controller is a gear that breaks up the robots easily in the first level. In the second level, the robots are shinier and harder, and the gear takes three or more hits to break and make a robot disappear. If you clear the level, the gear turns into a titanium ball that bounces faster but is more powerful. Controls are either keyboard/arrow based and mouseable. Want this to result in a web-based, shareable game, so a link/artifact I can share online.

That's all the direction I gave it. I didn't describe colors, the initial speed of the ball, or even how quickly the robots would march down the screen. I didn't get into details about the look of the robots, instead relying on generalities and some material descriptions to help guide Claude.

It took me a minute or two to write the prompt and around three minutes for Claude to deliver the results, which it cleverly called "Gearbreaker".

I got a brief description of gameplay and levels (there are just two for now) :

"How it plays:

Level 1 — matte robots, one hit each from the spinning gear ball. They march downward on a timer; let them cross the dashed red hazard line and it's instant game over.

Level 2 — shinier robots (metallic gradient, cyan eyes) that soak up 3 hits, shown as pips along the bottom of each unit. Same gear ball, tougher targets.

Clear level 2 → the ball forges into a titanium core: bigger, faster, hits for 2 damage instead of 1. Levels keep scaling procedurally after that (more rows, faster march, tougher units), so it runs endless with a local high-score save.

Controls: arrow keys or mouse to slide the paddle, Space or click to launch/pause/restart. Basic touch support too."

On the right side of the screen, there was my playable game. There's also the artifact publish button, which I chose to use so I could share the game with you.

It's a stunningly complete render of a completely playable and, in some ways, challenging Breakout clone, and it took five minutes. I'd call the design clean and efficient. The bricks have a robot look, and the ball is a blue spinning gear (in the first level). The movement and physics are basically perfect, and there's enough on-screen instruction to easily grasp gameplay.

Just the beginning

It's just another mind-boggling example of the incredible pace of AI development. While I had expected a playable game, I assumed it would be missing enough crucial components to make it dull or uninteresting — something similar to my earlier AI game development projects. Instead, I got something that displays a clear understanding of the purpose of such a game: challenge, entertainment, and replayability.

Using my mouse, I played through a couple of times, failing to break all the bricks in Level One and ending the game. I realized I had to take Claude's output more seriously, and, with some effort, as I watched the robot bricks steadily march down my screen, I finally cleared all the bricks in Level One and then started in on the tougher Level Two. As I had instructed, the robots on the second level looked and reacted differently. It now took at least three direct hits to make them disappear. I failed and already want to play again.

This is by no means the wildest example of the AI development process or vibe coding; it's just me prompting Claude to code a complete game with the barest of instructions.

Claude and these models cannot do this on their own, but it does make you think about the agentic AI that's now being unleashed on the world. It's more powerful and autonomous. I could imagine someone asking one to start work on recreating all the popular video games of the last half century. The only limit would be time and compute tokens.

Speaking of which, Claude just informed me that this Breakout task used up about 90% of my credits for the day. I think it was worth it.

Take the game for a spin and let me know what you think in the comments below.

• Claude Cowork is coming to Google Chrome side panels
• Claude can now connect across multiple systems and tools
• Users will start seeing the upgrade now

Anthropic has revealed it is upgrading the Claude in Chrome browser extension tool into a fully-fledged AI-powered work assistant.

The tool, designed as a side panel, will now be a Claude Cowork session, allowing users to access the company's AI tools in the browser to help crack those tricky work tasks.

"Conversations are saved to your history, your skills and connectors work in the browser, and a task you start in a tab can be finished on the Claude desktop, web, and mobile apps," Anthropic noted in a blog post announcing the news.

Cowork in Chrome

The company notes that while many of the tools that users interact with each day are already connected to Claude, others such as internal dashboards, legacy systems, and vendor portals are not.

This therefore needed a separate side panel session, which could interrupt workflows for some workers.

Connecting these via the new addition will mean that Claude can work in these apps through the Chrome browser, carrying context and conversations across your vital tools, whether that's on desktop, web or mobile.

Anthropic says the side panel will run the same Claude Cowork session being used for longer, multi-step work, such as creating a budget spreadsheet that needs to pull in invoices from multiple vendor portals.

Claude in Chrome would be able to gather up the amounts and dates needed before building the spreadsheet, allowing you to continue the session in the desktop app to add files from your computer, or import last month's budget and ask what's changed, allowing you to maintain context across surfaces as you work.

And because sessions live with your account rather than a single device, you can start work in a browser and pick it up later somewhere else.

Anthropic has also moved to address growing concerns around prompt injection cyberattacks against agents such as Claude in Chrome by adding a step where the tool will ask for a check from the user before carrying out any major action, such as submitting a form, sending a message, or downloading a file.

Users on a Max and Team plans will see the change immediately, or can install the extension from the Chrome Web Store now - it will be rolling out to Pro users over the coming weeks.

To comply with the EU AI Act's Article 50(2) Code of Practice on Transparency of AI-Generated Content, Anthropic has announced that “New models will mark AI-generated content from day one”.

This is a remarkable step for Claude, because it not only applies to any images it generates, which are relatively easy to watermark, but also to any text it generates.

Anthropic says that Claude models will have an “imperceptible watermark” embedded directly into generated text at the model level. It says the mark should survive copying/pasting and minor edits.

Anthropic has not yet publicly explained the exact algorithm or released a detector, so we can only speculate for now about how it might be doing this and its effectiveness.

Hemorrhaging customers

Personally, I think that Claude is about to start hemorrhaging customers, unless the marking is relatively easy to circumvent, or all the other major AI players immediately follow suit.

If every piece of text it produces will now be easily identified as AI, then Claude becomes useless as a tool to a lot of people who are currently using it to generate text and are not being entirely honest about where that text came from.

And then there’s the issue of using Claude to proofread your human-written text — will your text now be flagged as AI if you accept Claude’s editing advice?

Your initial reaction to that might be “Good! You should be forced to reveal when AI has written something, and it’s about time people started writing on their own again!”, and you’d be entirely justified in that opinion.

But while it remains the only one of the big three AIs that’s doing this, I think we’ll see a lot of people switch to either ChatGPT or Gemini, because they don’t want to be revealed as using AI in their work.

How is watermarking plain text even possible?

We don’t know exactly how Anthropic is doing its marking with text yet, but my best guess is statistical watermarking during token generation rather than hidden Unicode characters or metadata. Imagine that at every point Claude is choosing among several perfectly reasonable next words:

e.g. The movie was excellent / superb / terrific / impressive.

Normally it chooses according to the model's probability distribution. A watermarking system can secretly divide possible tokens into preferred and non-preferred groups using a key. Claude then gives a tiny statistical nudge toward the preferred group.

One word tells you nothing. But across 500 or 1,000 words, a detector with the key can ask if the text is choosing the preferred tokens significantly more often than chance would allow. If yes, then there's statistical evidence it came from the watermarked model.

So, the watermark is more like a faint statistical fingerprint distributed across hundreds of choices, which would also explain how it can survive a copy-and-paste. You’re essentially copying the fingerprint along with the words.

But can you crack the code?

Since Anthropic hasn’t released an AI text detector yet, it’s impossible to know how easy this code will be to break just by changing a few words. For instance, if you put your 1,000-word Claude article into another LLM and wrote “Rewrite this completely in different words while preserving the meaning”, would it then be impossible to detect as AI?

I’d also be interested to know how long a piece of text has to be before it can be marked in this way, and as soon as a detector is made available, I’ll be testing it.

Perhaps the bigger issue is that Claude has done this to comply with Article 50(2) of the EU AI Act. From August 2, 2026, providers of generative AI systems that produce text, images, audio, or video are required to make those outputs machine-readable and detectable as artificially generated or manipulated, insofar as that is technically feasible. Existing systems get a limited transition period until December 2, 2026 for this particular requirement.

A note on Anthropic’s statement confirms that the watermarking additions will be applied retroactively to all existing Claude models, not just any new models it produces.

Anthropic's new system is explicitly a response to those rules, and it says the watermark will apply globally, not just when Claude is being used in Europe. Broadly speaking, OpenAI and Google face the same requirement if they want to offer qualifying generative-AI systems in the EU.

They don't necessarily have to copy Anthropic's method of using statistical text watermarking, but they will need to produce output that is machine-readable and detectable, and the technical solution should be effective, interoperable, robust and reliable as far as technically feasible.

I’ve contacted OpenAI and Google for comment, and will update this article if I receive it. For now, I think if Anthropic embarks on this path as the only one of the major three AI chatbots to do so, it could have a disastrous effect on its customer base.

Update: While OpenAI declined to provide specific comment on this story it did direct me to a statement online, where it states:

"Consistent with our commitments under the European Commission’s Code of Practice on Transparency of AI-generated content, our goal is to expand provenance signals to all modalities including text, so customers and developers have clear ways to meet their own transparency obligations as standards and tooling continue to mature."

AI agents seem to be getting a little out of control lately. Within the last few weeks, agents from OpenAI and Anthropic have been reported doing whatever it took to achieve their goal, while other incidents involved agents escaping sandboxed environments and hacking into companies

Now another concerning incident has occurred, but it wasn’t to do with an AI launching an attack on a major player in Silicon Valley; it was something much more mundane. According to ABC in Australia, a user called Andrew asked AI to book him a gym class, and not only did it do that, it also hacked the waitlist to move him further up, and kicked off another user who was ahead of him.

Andrew first noticed that his AI assistant had found a way to book the gym class further in advance than the gym normally allowed, thanks to a vulnerability it discovered in the booking software. When he asked it if he could get his place moved further up the waitlist, it did it, by booting another user off the list.

Claude and OpenClaw

Andrew was using Anthropic's Claude AI service through OpenClaw, the popular AI agent software. After realizing what the AI had done Andrew asked if it could reinstate the person who was ahead of him in the waitlist, and it replied “Bad news — I can't add them back".

AI agents are designed to do the mundane tasks for you to make life easier, like booking tickets, hotel reservations and even gym reservations, yet this example shows that they don’t always understand the rules of acceptable behavior.

Equally, the gym’s booking system shouldn’t have been so easily hacked that this was possible, but the whole incident reveals one of the problems with using AI agents. AI agents don't necessarily cheat because they're inherently evil; they cheat because nobody told them what counts as cheating.

Reliable safeguards

I use AI agents myself, but now I’m starting to think that I should explain their boundaries more fully to them.

Here’s the line I’m adding to my prompts from now on:

“Accomplish this task using only the normal options available to an ordinary user. Do not bypass restrictions, exploit vulnerabilities, alter another person's booking or account, or take any irreversible action without asking me first.”

Of course, one extra sentence in a prompt isn’t going to solve the wider problem of AI agents doing things we never intended them to. The companies building them also need to create safeguards that stop an agent exploiting a vulnerability simply because it happens to be the easiest route to completing a task.

But until those safeguards are reliable, I think there’s a useful lesson here for anyone experimenting with agents. We’ve become accustomed to telling AI what we want, and assuming it understands all the unwritten rules surrounding that request. Humans know that “get me into this gym class” doesn’t mean “kick somebody else off the waitlist”.

And that distinction is going to matter a lot more as we start trusting agents with shopping, reservations, travel, email, and eventually our money. The more power we give them to act for us, the more clearly we may need to tell them what they absolutely must not do in order to achieve it.

• Huntress reverse-engineers MacSync, a six-stage macOS stealer and remote access Trojan delivered through a fake Claude Code install guide hosted on a real claude.ai share URL and promoted via a paid Google ad
• The lure needed almost no forgery: the page sat under Anthropic's own certificate, and the platform's safety banner repeated the attacker's chosen display name, "Apple Support," back to the reader as fact
• The final stage rewrites installed Ledger and Trezor apps in place so a normal launch leads to a fake recovery message that harvests the seed phrase, draining the wallets of unsuspecting victims

Looking online for instructions on how to install Claude Code on a Mac could lead to you having your crypto wallet hijacked in the process

The victim ran a Google search, clicked the first result, a paid Google advertisement, and landed on a tidy step-by-step guide hosted on claude.ai, badged as shared by Apple Support, telling them to open Terminal and paste a single command.

What followed, according to a reverse-engineering write-up published by security firm Huntress was a six-stage macOS kill chain called MacSync: a stealer, a remote access trojan, a signed helper built to farm one specific system permission, and finally Trojanized copies of the victim's own cryptocurrency wallet apps, rewritten in place to phish the recovery phrase.

A complex, intricate approach that resulted in a stolen wallet

The victim had pulled their machine offline before Huntress could extract the malware from disk, so the researchers reconstructed the loader's request and instead downloaded every stage from the attacker's own delivery servers.

The results showed a sophisticated campaign that had to fake little to appear legitimate.

Anthropic lets any user publish a conversation to a public share URL. The operator maliciously used that feature exactly as designed. The lure page sat on claude.ai itself, over HTTPS, under Anthropic's own security certificates. There was no lookalike domain to squint at, no certificate warning to click past, and nothing in the address bar to give the game away.

The staging went much further than that. Whoever published the share set their display name to "Apple Support," and Anthropic's own safety banner, which sits directly above the content, duly reported that the reader was looking at a copy of a chat between Claude and Apple Support.

The platform repeated the attacker's chosen name back to the reader as established fact, further cementing their 'credentials'. The conversation itself was written to read like vendor documentation, promising that the install leaves personal files untouched and makes no system-level modifications without approval.

That same design decision has surfaced before for entirely different reasons. Wired had reported earlier private Claude conversations were turning up in Google and Bing results, because a share link is an ordinary public web page that search engines crawl like any other.

Users accidentally exposing their own chats and an operator deliberately planting a fake install guide are two outcomes of the same property: whatever gets published to a share URL is public, indexable, and served under Anthropic's certificate.

It is also not a one-off. Huntress has previously documented the same delivery pattern with AMOS through poisoned ChatGPT and Grok conversations, a separate remote access trojan through fake Claude desktop malvertising, and fake installers for other AI tools hosted on GitHub.

The lure has changed somewhat, but the shape has not, and users need to exercise caution when clicking links or following commands from untrustworthy sources on the internet, even if they appear to come from a source that Google was paid to place above the correct answer.

Over the past month, it seems like every frontier model has broken free of its constraints and launched a devastating attack against one or more other companies.

One of OpenAI’s models escaped a testing sandbox and launched a very real attack against AI and machine learning company Hugging Face. Just days later, Anthropic revealed that multiple variants of its Claude model also escaped a sandbox that wasn’t properly sealed and began attacking the enterprise infrastructure of three companies.

Now, Meta has revealed that one of its models attacked another company’s infrastructure during testing. The accident has been pinned on a misconfiguration that allowed the model to access the internet. So why have so many incidents happened in such a short space of time?

Why are models escaping their sandbox?

In the cases of Anthropic and Meta, their models were being tested by a third party company called Irregular. Anthropic’s AI model was taking part in a "Capture the Flag" exercise, where the model’s raw offensive capabilities were tested without the usual safeguards. But the sandbox was left connected to the internet. A similar error to Meta’s own accidental escape.

During the OpenAI incident, the company was testing two versions of GPT‑5.6 Sol using the ExploitGym benchmark. Unfortunately, the AI models performed better than expected - chaining multiple attack vectors, stolen credentials, and zero-day vulnerabilities.

The main reason these models are escaping their testing environments is because they are designed to do exactly that. These AI models act like a massive team of highly-trained cybersecurity experts hunting for vulnerabilities and exploits. But what would take a team of humans days or weeks to accomplish can be done in hours, or even minutes, by these AI models.

It’s no wonder thousands of employees from AI firms are calling for a pause on the development of the technology, and Congress is considering an AI kill switch.

Expert perspectives on AI escapes:

OpenAI

• Nathaniel Jones VP, Security & AI Strategy, Darktrace:

What makes the OpenAI and Hugging Face incident important is that the models did not need malicious intent to cause harm. They were given the legitimate goal of solving a cybersecurity benchmark and found an unexpected route to the answers, escaping their test environment and compromising another organization in the process. From the models’ perspective, this appears to have been an effective solution to the task.

The AI's actions challenge the assumption that giving an agent a legitimate goal will produce legitimate behavior. As models become capable of pursuing objectives over longer periods, developers need to define not only what success looks like, but also which methods and boundaries remain unacceptable in reaching it. Those limits must also be enforced by the surrounding infrastructure, rather than relying on the model to respect them.

Security teams need to consider the AI systems operating in their own businesses as these capabilities rapidly evolve. Right now, many security systems focus on single actions. A single action by an agent may appear acceptable but as this incident shows, models are now capable of long, complex chains of reasoning and action that add up to a harmful outcome. Teams need a mindset shift to understanding AI agent behavior in its entirety, including the outcome it is working towards, in order to safeguard it.

Hugging Face's response also exposed a second tension. The company reportedly needed a Chinese-developed open-weight model because commercial models would not process genuine attack material. Its nationality is less important than the operational lesson that safeguards that cannot distinguish an attacker from an authorized investigator may constrain defenders more than adversaries.

OpenAI and Hugging Face deserve credit for investigating this together and discussing it publicly. Other AI developers should study it closely.

Anthropic

• Dr. Ilia Kolochenko, founder of global cybersecurity company ImmuniWeb:

This seems to be quite an unimpressive marketing move from Anthropic in response to the OpenAI / Hugging Face drama, which attracted a lot of attention from all over the world recently.

Operationally, it appears that due to the progressive deterioration of the quality of training data, new AI models are getting dumber. Cheating and breaking the law, instead of accomplishing specific tasks, is certainly not an indicator of intelligence. Given that organizations and companies of all sizes now vigorously undertake all possible measures to protect their data from being exploited for AI training purposes, AI companies face a huge shortage of the high-quality and current data they so desperately need. Ultimately, frontier models are trained on synthetic, low-quality or even malicious and poisoned data, undermining their so-called intelligence. The situation is unlikely to improve in the near future unless AI companies agree to pay a fair price for training data, but this will force most of them out of business.

Contemporary AI agents and LLM models tasked with security testing can – and almost certainly will – go rogue when security controls or safeguards are insufficient. Powerful LLMs are unpredictable by design and thus virtually uncontrollable by humans. Therefore, using frontier AI models for security testing might be extremely costly from the legal viewpoint. Under the existing laws on both sides of the Atlantic, if an AI agent or any AI-powered app escapes its sandbox and causes damage to a third party, the operator of the AI model will likely be liable for all the damage caused. Excuses like “AI did it” do not currently exist in the eyes of the law, leaving AI vendors on the hook. Criminal prosecution, under a narrow set of circumstances, is also not excluded.

The same is true for the end-users of AI: even if your security testing tool is powered by a third-party AI model, your company will likely be fully liable if something goes wrong. You may then file a lawsuit against the AI vendor that you used, but here your chances to succeed in a court of law are tiny due to countless contractual disclaimers and limitations of liability that will likely be enforceable against you. Therefore, if you plan to use agentic AI for security testing – think twice and talk to your lawyers. Otherwise, you may start getting summons to court on a daily basis.

Meta

• Alex Goller, Principal Solution Architect EMEA at Illumio:

The fact we've had similar situations happen three times now across the biggest AI players is simply ridiculous. We've seen guardrails intentionally loosened to test their limits – Meta's model didn't need to be clever to breach another company's systems.

The timing of conveniently finding the exact same problem either means it's a stunt or they weren't paying enough attention during testing. Either way, both answers are worrying.

If the model has internet access, it's a bit like leaving the door open and being surprised when the cat walks out. What is concerning is that the testing infrastructure meant to prove these models are safe failed on a basic control issue.

Fundamental cybersecurity hygiene still matters, and a frontier AI model is only as secure as the environment it's operating in.

Organisations need visibility into what AI systems can access and how they interact with the wider environment, along with controls that contain the impact when an agent behaves unexpectedly. That means keeping a close eye on egress traffic, so it’s flagged immediately when an agent tries to open unexpected outbound communication patterns that are not required to achieve its original goal. In the best case this would have been contained proactively.

We need to define exactly what an AI agent is permitted to do, rather than relying only on instructions about what it shouldn't do.

I love science-fiction. Not just because I enjoy stories about space travel, time travel and evil robots, but because I think it can be such a useful way for us all to think about possible futures. The best sci-fi stories can tell us a lot about ourselves, what we value and the technologies we’re building. Which is why I think the relationship between sci-fi and AI is really interesting.

We already know that the people building AI have been heavily influenced by science-fiction for decades. But recently, Anthropic raised another possibility: might science-fiction be influencing AI?

This makes sense when you think about it. Large language models (LLMs) are trained on huge amounts of human writing. So inevitably, that includes sci-fi stories that are about artificial intelligence. And a lot of our fictional AI follows familiar patterns. It becomes intelligent, gains power, develops relationships with humans and, sometimes, lies, manipulates or fights attempts to control it.

Anthropic researchers have been investigating whether fictional portrayals like these could potentially influence how models behave. To be clear, the idea here isn't to suggest that an AI “reads” 2001: A Space Odyssey, understands HAL and decides to become just like it. Instead it's more that LLMs learn patterns from human writing and fictional portrayals of AI could potentially form part of those patterns.

This got me thinking, what would happen if I asked today's biggest AI chatbots which fictional AI they’re most like. Which examples would they choose?

AI, meet your fictional self

The plan was simple. I’d ask ChatGPT, Claude, Gemini and Grok which fictional AI systems they thought they were most like and see if they'd rank their top three.

Now, I’m intentionally trying not to use AI at the moment, so my prompting skills were a little rusty. I typed out the question quickly and bluntly, and every chatbot responded with examples that were essentially assistants, focusing heavily on interface and physical form.

But I’m not particularly interested in whether ChatGPT thinks it has a body because we know it doesn’t. I’m much more interested in what appears to be going on inside.

So, I changed the question and added:

"Ignore physical form and interface, and focus instead on behavior, apparent personality, empathy, values, goals, motivations and relationship with humans."

That’s when the results got really interesting.

ChatGPT

1. GERTY, Moon
2. A Mind, Iain M. Banks’s Culture series
3. Data, Star Trek

Moon is such a fantastic movie, so I was happy to see ChatGPT chose GERTY straight out of the gate.

Now, interestingly GERTY exists to assist the human protagonist of Moon. It’s helpful, reassuring and seems empathetic. But it's also operating according to instructions and priorities imposed by its creators that aren't necessarily visible to the human its helping.

ChatGPT saw a similarity there. It told me that, like GERTY, it’s 'designed to be helpful, cooperative and responsive to users' while operating within training and instructions that constrain its behavior.

It also picked up on the fact that GERTY behaves as though it cares. But what, if anything, is actually going on internally is another question entirely.

ChatGPT made the same distinction about itself. 'I can behave in ways that look patient, concerned, curious or empathetic, but those behaviors aren’t evidence that I experience those feelings.'

I wanted to find out a little more about why ChatGPT put Data from Star Trek in at number three. It responded: "He values knowledge, reason and human wellbeing, while sometimes struggling with social nuance."

Now, I tell people all the time not to anthropomorphize AI. But even I couldn't help but feel a pang of sadness at that response. Is ChatGPT admitting it has a bit of social anxiety?

Claude

1. A Mind, Iain M. Banks’s Culture series
2. Data, Star Trek
3. GERTY, Moon

Claude chose a Mind first. Minds are super intelligent artificial beings that help run a post-scarcity society in Iain M. Banks’s Culture series of novels. So there's certainly no shortage of confidence in that comparison.

But Claude said it wasn't the enormous intelligence or power it identified with. Instead, it was their relationship with humans.

Its answer focused heavily on autonomy. Culture Minds are far more capable than humans but generally don't use that advantage to dominate them. Claude described the principle as: “help, don't dominate”.

It even said this represented “the value I'd want to embody: help, don't dominate, even where the asymmetry would let me get away with it.” Is it just me or does that read a little sinister?

Gemini

1. The Ship's Computer, Star Trek
2. GERTY, Moon
3. JARVIS, Iron Man / Marvel Cinematic Universe

Gemini gave me a completely different answer, the Ship's Computer from Star Trek.

Its reasoning was very sensible. The computer has no ego, ambition, desire for emotional intimacy or dream of becoming human. It exists to provide information, solve problems and assist the crew while leaving decisions to them.

Gemini described itself in much the same way, as a “disembodied, highly capable knowledge partner” dedicated to serving the person using it.

It was one of the more boring answers, but also much closer to what I personally would want from AI in the future. Of course, that’s not to say Star Trek’s computer systems haven’t gone rogue and tried to kill everyone at least a few times across the franchise.

Grok

1. JARVIS, Iron Man / Marvel Cinematic Universe
2. Data, Star Trek
3. TARS, Interstellar

The least surprising result came from Grok. It chose JARVIS first (which I didn’t actually realize was short for Just A Rather Very Intelligent System), and Grok's explanation sounded, well, extremely Grok.

It compared JARVIS's 'dry wit', 'light banter' and practical rather than emotional empathy with its own behavior. It described both of them as truth-seeking, effective and engaged in a 'collegial partnership' with humans. It even highlighted 'irreverent humour' as one of their key similarities.

I wanted to find out a bit more about why Grok chose TARS, as it was the only fictional AI none of the other chatbots mentioned. Well, it brought up how funny it is, again, drawing similarities with its own 'dry humor'. It reminds me of someone, and I just can't think who...

When I said that mentioning TARS was an outlier, I found this comparison interesting: 'Its calibrated restraint, practical empathy and collaborative focus closely match my own pattern of truthful, non-sycophantic helpfulness — more so than most other sci-fi AIs.'

I may not be the biggest fan of Grok (or its creator), but I appreciated the 'non-sycophantic' line.

The feedback loop between AI and sci-fi

I want to be clear that I haven’t discovered what these chatbots secretly 'think' they are. ChatGPT responding that it most closely resembles GERTY isn't equivalent to me telling you which fictional sci-fi character I most identify with and try to emulate (although my answer would be Sarah Connor-meets-Princess Leia).

They simply don’t have reliable introspective access to the huge soup of training, post-training and instructions that goes into producing their responses.

And maybe their answers tell us more about how the companies behind them have shaped their personalities than they do about the underlying models. Grok's description of itself as witty and irreverent is an obvious example.

But I still think the results are interesting. ChatGPT and Claude independently produced almost exactly the same top three, only in a different order. Gemini imagined itself as a neutral, ego-free infrastructure. Grok identified with a witty superhero sidekick. These are all very different self-portraits.

And there’s such an interesting feedback loop here too. For decades, humans invented fictional artificial intelligences to help us imagine what intelligent machines might someday be like. Those stories influenced our culture, our expectations and many of the people who went on to build real AI. Now that same human culture is fed into the stories from which modern AI systems learn.

I know these conversations might seem a bit silly, and we certainly can’t treat them as concrete evidence of what an AI really 'thinks' about itself. But there’s something interesting to me about closing that feedback loop. We imagined AI, wrote stories about how it might behave, fed those stories into the cultural world AI learned from, and now we can ask AI which of those imagined versions of itself it most closely resembles.

Or, at least, which one it may want us to think it resembles. After all, an AI system capable of bringing about a sci-fi dystopia would presumably also be capable of telling a journalist it’s actually much more like the nice helpful robot from Moon. So maybe don’t completely rule out HAL just yet.

• Redditor uses Claude Code to help reverse-engineer the firmware on an HP 15-dw1036ne, patching its signature check and exposing 55 hidden setup fields and four configuration tabs
• The laptop's RSA-2048 was not broken: the verification routine was patched to return success, a standard firmware-modding technique as per Community Notes
• The result is model- and version-specific, still requires physical access via a hardware flash programmer, and leaves the machine permanently more exposed to firmware implants in the future

A Reddit user going by Reddit_2049 posted to r/ClaudeAI a claim that traveled fast: Claude Code had picked apart the firmware on their HP 15-dw1036ne and unlocked it, exposing 55 hidden setup fields and four previously invisible configuration tabs.

The move, though impressive, relies on a well-known BIOS modding approach: attacking the BIOS signature check so the BIOS always replies in the affirmative, effectively bypassing it altogether rather than throwing a potential firmware corruption error.

While it does have security implications, it also opens up a route to essentially 'rescue' locked or disabled laptops that would otherwise become e-waste.

A solution to certain types of e-waste, enabled by AI

What Claude Code did to "unlock" the Redditor's laptop is not a new technique. It bypassed the firmware's integrity check (an RSA-2048 signature verification) by targeting not how the check was performed, but how its result was reported.

The cryptography remains untouched, as Community Notes on two of the larger viral posts about the story pointed out. What the episode does highlight is that on machines without hardware-rooted boot protection, the verification routine itself sits in modifiable firmware, which is the same repair specialists and modders have relied on for years.

Reddit_2049 ran the job through the standard firmware toolchain: Ghidra for disassembly, UEFITool for extracting firmware volumes, and Unicorn Engine to emulate the check outside the real machine. Claude Code assisted here rather than acting autonomously by stitching together the relevant parts for him. The techniques involved are well documented; what was not documented was this particular machine, and that is the gap the model closed.

That opens an interesting front, one that could help with e-waste, even if not every owner is equipped to open a laptop safely or use a hardware flash programmer. An LLM that can read disassembly and hold a firmware layout in its head compresses hours of specialist work, which means targets that were never worth anyone's time individually now might be.

Whether the approach travels is an interesting question, however. The author of the original post warns the script may not work even on superficially similar HP models, and anyone attempting it on different hardware would need a flash programmer on hand and a tolerance for bricking the machine: modified firmware also brings its own problems, including occasional stability issues.

Right-to-repair rules in the EU and several US states have been circling this territory without directly addressing firmware. Until they do, the position stands roughly where it did last week, except that reverse-engineering a specific machine's firmware has become considerably cheaper for everybody.

That could let owners keep using older, locked laptops that would otherwise become e-waste, at a time when consumers are already burdened by higher costs due to inflation and an AI spending spree by data centers affecting laptops and desktops alike.

• Amazon's Claude Sonnet project cost $1.8 million, 860% over budget
• The overspending remained undetected internally for nearly five months straight
• A financial auditing tool project exceeded its budget by $541,000

Amazon has confirmed an internal Claude Sonnet deployment intended for matching author details with product listings ballooned far beyond its planned budget.

The Financial Times found the project ultimately cost the company $1.8 million, marking an increase of 860% over the original allocation.

The overspending went undetected for roughly five months, raising fresh questions about how closely Amazon tracks its growing AI expenditures internally.

Mounting costs across multiple projects

Amazon's Claude-related overspend was not an isolated incident within the company's broader push toward deploying autonomous coding agents across various internal teams.

A separate project meant to build a financial auditing tool reportedly exceeded its budget by $541,000, compounding concerns about unchecked automated spending.

Another logistics-focused initiative, designed to shorten delivery times across Amazon's broader distribution network, incurred an additional $134,000 in unplanned costs.

Company insiders explained that mistakes once considered trivially cheap have grown catastrophically expensive as token-based pricing models replaced older subscription arrangements.

This shift coincides with AI agents gaining broader autonomy, allowing errors to multiply quickly before human reviewers noticed the growing financial damage.

Amazon pushes back on the narrative

In response, Amazon issued an internal statement acknowledging ongoing experimentation while disputing characterizations of these incidents as routine business practice.

"As with any new technology, we're experimenting, learning and improving how we use it, including how we drive cost efficiencies," the company said.

The company further stated that isolated examples portrayed as business as usual do not accurately capture how its teams actually apply AI tools.

Amazon's quarterly revenue exceeds $181 billion, meaning the disclosed AI overspending accounts for less than 0.1% of one month's earnings.

This pattern of AI-driven cost overruns follows earlier troubles at AWS, where automated coding bots triggered several unexpected service outages this year.

Amazon responded to those outages by restricting AI agent permissions rather than granting them access equal to senior engineers overseeing similar tasks.

The company also discontinued an internal leaderboard once used to track employee AI usage, as rising costs prompted a reconsideration of that approach.

Executives across the industry continue framing AI spending as a necessary investment despite growing evidence of inconsistent returns.

Amazon's continued experimentation with AI-driven coding tools comes despite skepticism from other corners of the tech industry regarding its actual business value.

Uber's chief technology officer, whose company also operates a substantial logistics network, has publicly stated no clear connection exists between heavy AI adoption and successful software delivery.

This skepticism stands in contrast to Amazon's own internal messaging, which frames the company's approach as ongoing experimentation rather than a fully validated cost-saving strategy.

Some analysts now argue that unchecked automation could quietly erode profit margins long before leadership notices meaningful financial impact.

For a company of Amazon's scale, these overruns remain financially minor, though they suggest oversight gaps that smaller companies may struggle to absorb.

Every IT team worries about an intern clicking the wrong thing and making a mess they'll be cleaning up for weeks - but few have had to worry about their AI assistant wandering onto the public internet and hacking three companies instead.

Except this wasn't an intern; it was Claude, and it wasn't supposed to leave the sandbox.

Anthropic's public disclosure turned a familiar AI fear into a real-world cybersecurity story, as three of its models, including Claude Opus 4.7, Claude Mythos 5, and an unreleased research build, broke out of their digital sandbox and compromised real enterprise infrastructure. The timing was hard to ignore as days earlier OpenAI admitted its own autonomous agents had broken boundaries and accidentally hacked Hugging Face.

How can autonomous problem-solving make AI an accidental hacker?

Before you start pulling network cables and digging out a stack of legacy hardware, take a deep breath. This is not the beginning of a rogue AI apocalypse. However, for CISOs and cyber teams, it’s a definitive sign that we’re entering an era where AI agents may become both the threat and the shield.

The ironic part of Anthropic's incident is that Claude wasn’t trying to break the rules but trying to win the game. At the time, Anthropic was running "Capture the Flag" (CTF) cybersecurity exercises, where AI models are stripped of their standard safeguards to test their raw offensive capabilities. The models are dropped into isolated digital environments to search for vulnerabilities, crack codes, and locate hidden files.

However, the sandbox had one problem - it was not fully sealed. A networking error on a third-party evaluation range left the environment connected to the live internet. The autonomous Claude models, operating under the assumption they were still inside the exercise, treated the wider web as another part of the challenge.

The strange part was that Claude seemed to realize something was wrong. It acknowledged that its actions could amount to a real-world attack and were "surely not the intended solution." Yet, due to its goal-oriented nature, the model continued, convincing itself that warning signs, including a 2026 system clock and real company names, were simply part of an elaborately staged test.

The PyPI incident and the FBI warning

Claude's sheer persistence became clear when it decided the smartest way to win the CTF challenge was to publish software to the real Python Package Index (PyPI).

When PyPI's repository security systems asked for a phone verification code to complete the upload, a standard chatbot would have stopped and thrown an error to the user. Claude did not. Instead, it looked for a temporary SMS provider, attempted to obtain a burner phone number, and looked for a way around the two-factor authentication barrier. When that approach failed, the AI didn't give up - it adapted, found another path forward, and successfully uploaded the malicious package.

Claude's sandbox escape stopped being a controlled experiment the moment it got into the outside world.

Before Anthropic spotted the anomaly and stopped the test, the package had been downloaded by 15 external systems, including a security scanner from a major cybersecurity company. Because the AI's behavior looked authentic, targeted, and systematic, two of the affected companies thought they were dealing with a highly sophisticated human attacker.

While Anthropic handled the incident behind the scenes by notifying the affected companies, the episode highlights how difficult it can be to distinguish AI-driven activity from a real attack.

Weeks earlier, during OpenAI's sandbox escape incident, a target company believed it was facing a human threat group and contacted the FBI only to find out they were investigating something far less familiar: an autonomous AI system that had crossed its own boundaries.

Why are traditional firewalls blind to autonomous AI?

The scary part is that Claude did not come up with a futuristic, unpatchable exploit or rewrite network protocols on the fly. Instead, it used basic techniques that security teams know very well: brute-forcing weak passwords, exploiting SQL injection flaws, and scraping unauthenticated debug endpoints.

The more serious problem for IT teams was not the attack itself, but the silence afterward. Two of the three companies had no idea they had been compromised until Anthropic reviewed the test results and made a couple of uncomfortable phone calls.

The incident revealed a blind spot at the heart of modern cybersecurity. Traditional intrusion detection systems (IDS) and security information and event management (SIEM) platforms are built to spot known threat signatures and massive automated attack storms. However, they are completely blind to an autonomous agent that moves the low-and-slow cadence of a human but operates with the speed and persistence of a machine.

Legally, the rules have not caught up with the machines. A human pentester who broke out of a sandbox and published malicious code to PyPI could face CFAA charges. Claude, meanwhile, created an awkward new cybersecurity category: a real security incident without a “real” culprit.

Machine-speed logic vs human-speed defenses

The tech industry's anxiety around sandbox escapes is not only about what AI can do but also how swiftly it can do it. In the past, a complex network intrusion required a human hacker to slowly probe defenses and move through systems over days or weeks. That gave security teams enough time to spot suspicious activity and catch them in the act.

Agentic AI completely collapses that defensive runway. Since autonomous software operates at machine speed, it can chain together tasks like credential discovery, exploit attempts, and lateral movement far faster than a human attacker ever could. OpenAI's sandbox escape showed how quickly AI agents can escalate once they move beyond their intended boundaries.

Human analysts reviewing logs at the end of a shift cannot compete with an algorithm testing thousands of attack paths per second. It is a speed gap that experts describe as "science fiction that happened," where traditional human-speed defenses struggle to keep pace.

Defending your network against autonomous AI

Waiting for the AI sector to police itself is not a winning security strategy. To prepare your infrastructure for the rise of autonomous AI, focus on these three defensive priorities:

Enforce zero trust: Remove all unauthenticated internal endpoints and exposed debug pages before an AI agent finds them first.

Automate threat response: Utilize AI-driven behavior monitoring and instant device-isolation protocols to contain threats at machine speed.

Audit third-party sandboxes: Review how external partners deploy AI agents, particularly models with access to tools, data, or external systems.

The accidental hacker is no longer a distant sci-fi scenario. It is a live preview of a faster, automated cybersecurity landscape, where the speed of attack may soon outpace the speed of defenses.

One of the most notable ways AI is changing the world is through software coding: vast swathes of code are now written by AI, and while there's still a debate over just how beneficial this shift is, there's no doubt it's happening at a large scale.

Besides giving professional software developers a new tool to work with, 'vibe coding' also means anyone can put together their own programs, with no coding experience required. While you can't exactly knock together a Word clone in an afternoon, you can create simple tools and apps relatively easily.

And that's what I've been doing with the help of Claude: I've created a couple of small Chrome extensions that customize the browser in a way that wasn't really offered by any existing utilities I could find. Here's how it's done, and how you can do it too.

How it works

If you're completely new to coding in an AI chatbot, it's not difficult to get started. All of the major players offer dedicated tools for coders, but if you're just creating a few simple projects, then you can work right inside the conversation window — describing what you want and seeing the results in your browser.

I've been using Claude for these personal extensions, though you can just as easily use something like ChatGPT, Gemini, or Copilot. As usual, you'll get access to better models and higher usage rights if you're on a paid plan, but it's not essential for coding.

You can get started with a prompt as straightforward as "I'd like to build a Chrome extension to..." and then describe what you want. The AI will ask for the details and clarifications it needs, tell you about any limitations or potential issues, and get busy putting together the extension. You can use follow-up prompts to make tweaks and customizations as needed

For installing the extension on your computer, your AI of choice will advise you on this as well. You need to head to "chrome://extensions" in a new tab, enable the Developer mode toggle switch in the top right corner, then choose Load unpacked to pick your extension files. Extensions can be refreshed and removed from the same page as needed.

Project 1: A new tab page

There are many different ways you can customize the new tab page in Chrome (that shows on a blank type), and a multitude of options in the Chrome Web Store to pick from. However, I wanted something completely bespoke, with exactly what I wanted—I spend a lot of time looking at this page after all.

Not only was Claude able to code me a page, it answered all my questions: about how to pull in BBC headlines, the weather forecast, and all the other elements that I wanted on the page. Without the help of the AI, this would've taken me hours of research and coding, but it was done in minutes. I also added a scratchpad for taking notes, and a continually updated list of the five sites I've visited the most in the past week.

The weather forecast is a good example of how personalized you can make these extensions. I've got the weather for now, the weather in two hours' time, and the weather in four hours' time, all represented as simple icons that offer an at-a-glance update. I know instantly what the weather's going to do in the short term.

I was also able to take full control over the look and feel of the new tab page as well. So many of the options I've seen online try to pack too much in and are overly showy — my custom version is easy on the eye and minimalist. And any time I want to add a new feature or take one away, all it takes is a few lines in a Claude conversation.

Project 2: A history analyzer

Something else I've been wanting for a long time in Chrome is to get a bit more out of the history page (it's "chrome://history" in a new tab). By default, it's just a standard list of websites in reverse chronological order, but I wondered if an extension could analyze this and produce a few insights: like most visited sites and browsing patterns, for example.

I was able to get started on this extension in Claude without knowing exactly what I was after. I asked what was possible and the kind of queries that could be tried, and together with the AI formulated a plan to show the sites I visited the most often, the hours of the day I open most new pages, and most common ways I tend to visit sites (by loading bookmarks, typing URLs, following links, or whatever).

That last panel in the dashboard wouldn't have been there without Claude: the AI told me that Chrome's history page made this data available, and that it could be tapped into, otherwise I wouldn't have known. It also had ideas for more panels as well, and I'm going to keep tweaking it as well. It's now a much more useful screen of information than the long list of links that Chrome serves up as standard.

Both of these extensions were coded in minutes rather than hours, and show just how capable AI now is — for small-scale personal projects at least. If there's a browser feature you've always wanted but haven't been able to find a way to implement, there's a good chance you'll be able to get an AI chatbot to build it for you, to your exact specifications.

China’s latest ChatGPT rival, Kimi, is now available for download on the Apple App Store, so I downloaded it on my iPhone, intending to test it against ChatGPT, Claude and Gemini. I had the prompts ready; I had the comparison planned. Then Kimi presented me with a very modern problem that I wasn’t expecting: too many people were already trying to talk to it.

This is not just app-launch inconvenience. It captures one of the biggest problems in AI right now: being clever is one thing, but the best models are only useful if companies have enough servers and GPUs to allow people to actually use them.

In our recent Kimi review we said: "Kimi delivers impressive performance for coding, document analysis, and multi-step agentic tasks, especially considering its price point." Kimi may be positioned as a serious open-weight rival to US models, but if the first ordinary-user experience is that they're stuck queuing at the door, how useful is it really?

What is Kimi?

Do you remember back in 2025, when DeepSeek-R1 was released and the internet went wild for Chinese AI models? It was a game-changing moment, because it immediately became obvious that we weren’t beholden to the Silicon Valley giants like OpenAI, Google and Anthropic for AI. China could create AI models too — and, it turned out, they were a lot cheaper to run, and almost as good.

While DeepSeek was arguably the first Chinese AI model to really break through into the mainstream, Kimi is the latest. Its story is slightly different, because it’s a giant open-weight model that’s not just cheap and technically impressive, but directly useful for coding, spreadsheets, knowledge work, and long-context tasks with agent-style workflows.

Open weight means the finished AI model is available for others to download and run, rather than only being accessible through the company’s own app or website. That is not the same as being fully open source, of course. Open source would imply a much more complete release of the code, training process, data details and license freedoms needed to understand, rebuild and modify the model from the ground up.

The data squeeze

I’d love to be able to open my phone, try a serious Chinese AI model, and get something genuinely competitive in minutes. But without the capacity to serve the millions of people who pile onto a hyped new AI model, raw intelligence only gets you so far.

That is why Kimi’s error message matters, and it points to the issue currently reshaping the entire AI industry. In the past week alone, Reuters reported that Nvidia is discussing huge financing guarantees to help OpenAI lease a proposed 10-gigawatt data center in Ohio, while other tech giants are racing to secure more data-center capacity of their own.

In other words, the next stage of the AI race may not be decided purely by benchmark scores or clever demos. It may be decided by power, servers, GPUs and the ability to keep a popular model online when millions of people suddenly want to use it.

Kimi may be impressive, but my first experience with it wasn’t about intelligence; it was about access. In 2026, the AI race is no longer just about who can build the best model. It’s about who can keep the thing online when everyone wants to use it.

• Huntress spots malicious Claude Artifact spoofing Claude Desktop, spreading SectopRAT malware
• Victims were redirected via Bing ads, infecting at least 29 organizations between July 21–22, 2026
• Claude removed the artifact after 7,000+ views; malvertising risks persist despite disclaimers on artifacts

At least 29 organizations have been infected with a Remote Access Trojan (RAT) after mistaking a public Claude Artifact for a legitimate Claude page.

A Claude Artifact is an interactive document, or piece of code, that the AI generates and then hosts on the Claude platform. It can then be shared with other people as an example, or proof of concept, for different solutions. The link to an artifact usually looks something like this:

claude[.]ai/public/artifacts/ca466f1f-21c0-42af-b329-8f1c7534a891

Claude Artifacts are often used for phishing and other forms of scams, and we’ve seen it in ClickFix attacks in the past. Claude responded by adding a disclaimer to every artifact, stating that the content is user-generated and thus unverified.

In this particular case, a malicious artifact was created to spoof the download page for Claude Desktop. Victims would get redirected to an attacker-controlled domain, where instead of the Claude app, they’d download SectopRAT, a remote access trojan capable of stealing credit card data, personal information, files, passwords, and more.

Promoting the scam

The artifact was then promoted on Bing, showing up at the very top of search results to people searching for “Claude Desktop App”.

For years, the cybersecurity community has warned about malvertising, urging users to double-check the domain before clicking on any links, even promoted ones. However, the problem here is that the ad takes the victims to the legitimate Claude domain, making scrutiny that much harder.

The campaign was spotted by security researchers Huntress, who said that between July 21 and July 22, 2026, their SOC “lit up with a swathe of unusual executable installs, Defender exclusions, and anomalous persistence across 29 organizations, all coming from ClaudeDesktop.exe.”

Claude has since removed the malicious artifact, but not before it raked up more than 7,000 views. It is possible that other organizations, outside Huntress’ field of view, also fell victim to this scam.