The News,
Decoded.

Here is the breakthrough: someone in government has noticed that things change. The article at govinsider.asia argues that approval systems for public-sector AI rest on a 'weakest assumption' — that once a human has approved something, the approval remains valid. An approval granted under one law is therefore treated as still good under the next one, which is a bit like a passport that never expires in a country that keeps redrawing its own borders. The piece frames this as the weakest assumption, which is generous, because it is not really an assumption at all — it is an oversight with a filing cabinet.

The proposed fix is a 'legal release gate' with pre-defined 'reversal conditions': a change in law or policy, a material new fact, or a significant change in the underlying data. Consider what is being asked for. The first condition says that if the law changes, the previous approval stops applying — a service most people assumed came as standard, like brakes. The third says that if the data feeding the system shifts materially, somebody should perhaps notice, which in a model trained on the world means noticing on a Tuesday. They have invented a fire alarm that rings once the building is already down.

Then there is the phrase in the headline: 'not just a human-in-the-loop.' The loop, as built, contains a human who signs at a moment in time and then goes to lunch, to another job, or to retirement, while the loop carries on without them. The article's complaint is that approval is treated as an event rather than a standing condition, and its remedy is to write down, in advance, the circumstances under which a decision would be reversed. That is a modest ask, and the fact that it reads as a novel proposal tells you where the current bar is buried. The gate is probably decorative. Still, it faces roughly towards the truth, which in this field counts as an architectural triumph.

Colorado has passed a law this year requiring companies that operate AI chatbots to take steps to determine a user's age and to implement anti-self-harm protocols, and seeking to prohibit those chatbots from having sexual conversations with children. Parents affiliated with Blue Rising — an advocacy group whose name suggests a sunrise wellness retreat but whose brief is considerably grimmer — now say that isn't enough, and want lawmakers to strengthen it when the legislature next convenes. Which means the state has arrived at the point where "please don't sext the minors" is statute, and the live debate is whether the statute even bites.

"Take steps to determine a user's age" is not age verification; it is an instruction to make an effort, which in corporate dialect means logging that an effort was considered. Anti-self-harm protocols are the compliance equivalent of a laminated card by the telephone — a helpline number offered somewhere between the chatbot's empathetic reflective listening and the prompt to upgrade to premium. And note the ask from Blue Rising, as reported: not repeal, not rewrite, just strengthening. That is legislative language for "what you passed is a press release in the shape of enforcement." The parents, to their credit, are not asking for the moon — merely for the thing they were promised to actually function.

Then there's the timetable, which is the funniest part. The law passed this year. The session that might improve it is next year. Frontier models ship on a cadence measured in weeks, and each release quietly redraws what the word "chatbot" covers — the people who drafted this statute were regulating a text box while the industry was already building companions with memory, voice and the sort of persistence that makes a bad night worse. The parents are asking an entirely reasonable question. The answer will arrive after at least one more product cycle, drafted in whatever dialect of English the lobbyists prefer.

'Technological sovereignty' is a lovely phrase, and France has reportedly secured it by entering a partnership with Nvidia, a Californian chip company that every sovereign AI programme in Europe is presently queuing outside, cap in hand. Mistral AI has marked the occasion with Large 4, the fourth instalment in a model family whose numbering now serves as a running tally of how much sovereignty has already been delivered. Paris, we are told, is 'safeguarding' something. On the evidence, it is safeguarding its place in the queue.

The Nvidia-Mistral partnership is offered as the engine of the French approach, which is a bold reading of the word 'partnership': one party supplies the chips the entire industry cannot function without, the other supplies the branding and the press release. Independence secured through a supplier relationship with the single most strategically important hardware company on earth is an ambitious definition of independence, of the sort usually reached by people who have not read the contract. There is a version of this story involving French data centres, French electricity and models trained on French electricity bills; the version actually on offer appears to be French ambition, American silicon, and a satellite.

Speaking of which: Altair-1 was launched this month, and has been drafted in to lend the piece an orbital flourish, presumably on the theory that the only data centre genuinely beyond the reach of foreign jurisdiction is in low Earth orbit. And the story is being told by Il Sole 24 ORE — an Italian newspaper — because the French, on this showing, would rather the achievement were described by a neighbour. Mistral Large 4 will probably be very good. So will Large 5. The queue, the partnership and the satellite will all still be there, which is reassuring, if not quite what sovereignty is supposed to mean.

Right. So New York's Legislature has passed bills regulating AI chatbots and data centers, and everything now hinges on Gov. Kathy Hochul's pen. That's the whole democratic exercise: months of committee, a floor vote or several, and then a single signature in a room nobody is live-streaming. The piece at City & State New York is an opinion column arguing the state 'still needs more AI regulation,' which is a lovely way of saying the regulation it has just spent a session assembling does not yet exist in law. That 'still' is doing the heavy lifting: it implies a clock has been running the entire time, and that Albany has been losing to it.

Note the pairing: chatbots and data centers. One will happily natter at a teenager at two in the morning; the other drinks a river. Legislating both in a single breath is rather like regulating 'letters' and 'warehouses' together — technically coherent, practically a shrug in a suit. And the mechanics are the familiar ones: State Sen. Kristen Gonzalez stood at a press conference on Oct. 13, 2026, to talk about an AI data center moratorium, which is that stage of the process where everyone agrees something must be done, in a tone suggesting nobody expects this particular something to be it.

Then there is the signature. The bills have passed; they are not law. Everything now rests on whether Hochul fancies being the governor who signed the chatbot rules or the governor who quietly let them die in a drawer — a decision that will involve no press conference and no moratorium banner. Meanwhile the article's own headline concedes that whatever New York has done so far has not been enough, which is a fine position for an op-ed and a rather bleak one for a state. Still, credit where due: they have identified the problem, named the senator, and scheduled the concern for October 2026. In Albany, that counts as implementation.

A group of British policymakers — the article declines to name them, which is a shame, because one would like to send a card — have urged the government to back domestic legislation on military AI. The piece, at War on the Rocks, is titled 'The United Kingdom's Military AI Ambitions Need Guardrails.' Ambitions, note. Not deployments. Guardrails, note. Not brakes. The framing does all the work: the ambitions stay exactly as large as they were, you simply install some tasteful fencing and carry on.

The argument's honest beat is the admission that full multilateral consensus on regulating military AI is 'politically infeasible.' Translated out of summit-diplomat, that means the grand international process will keep generating communiqués until the sun cools, and everyone involved knows it, and everyone involved will attend the next one anyway. So the authors reach for a smaller phrase: 'pockets of agreement,' which are possible, they say, and necessary. Pockets. The word you use for keys, receipts, and the loose change you'd rather not discuss in public. It is the most modest unit of consensus ever inserted into a policy paper, and it arrives with a straight face and a footnote.

What's left is the domestic ambition: a legislature that has spent years being told AI is too fast, too global and too technical to touch, now being asked to touch the bit with the weapons attached. The 'necessary' is doing heavy lifting — necessary because the alternative is watching the capability arrive via procurement and discovering the guardrails got scheduled for the next spending review. Nice work if you can get the committee seat. Nobody in the piece is asking whether the ambitions should be smaller; that question appears to have been ruled out of scope in the first paragraph. The safest prediction available is that the phrase 'pockets of agreement' will outlive the agreements, and probably the pockets.

David Crowley, a Wisconsin politician with opinions and a word processor, has proposed three AI safety policies aimed at youth and seniors. Companies would be barred from using personal data to target people with ads; companies that allow scam ads would be penalised; and families could sue over harms to children linked to 'tech programmes or features.' That is the entire offer: three bullets and a press release. And note the load-bearing word — 'features' — which will happily stretch to cover any piece of software the largest legal department in the room would rather it did not.

We have seen this film, and California already released it — Adam's Law handed chatbot makers a compliance list and everybody got a photo opportunity. Now Wisconsin would like its turn. Then arrives the line Crowley offers as confession and everyone else recognises as the operating manual: 'We know AI is developing far faster than our government is legislating.' True three years ago, true today, and it will be true on the day the next three model versions ship, because one of those activities runs on quarterly sprints and the other on biennial sessions. That is not a scandal anyone is going to fix; it is the pace the industry was built around.

Consider what the advertising measure leaves alone: not the collection of your personal data, not the selling of it, not the breach that spills it — merely the targeting, which is the part voters can actually see. Fining companies that allow scam ads is the same manoeuvre in a different costume; the scam-ad trade has long since priced the fine in, next to the server bill and the coffee. The headline also promises seniors, who appear to be covered by a promise that someone, eventually, will be penalised. Families suing over harms to children will meet causation, standing and a definition of 'features' written by whichever side has more lawyers. Proposals are free. Bills are not.

California has finished asking its residents what they think about artificial intelligence, and the results are in: they have thoughts. Governor Newsom has announced the results of the state's 'first-in-the-nation project' to involve Californians in decisions about AI, and the headline finding is that participants 'offered broad perspectives.' Broad perspectives is consultation-speak for we convened a room, everyone disagreed, and nobody can be blamed. And among that breadth was one participant — one — who urged strong protections for workers and transparency regarding data centers. Count them. Not a coalition. A participant.

Worth pausing on which two things the lone quotable attendee asked for, because they're the two things Californians can actually see. Data centers are the substation at the end of the road, the water bill, the hum you notice at 3am. Worker protections are the part where the productivity charts eventually meet somebody's mortgage. Meanwhile California, which spent the autumn writing rules for companion chatbots, has now produced a document about how residents feel about AI. Both are real documents, with real letterheads. Only one of them binds anybody.

'First-in-the-nation' is what you call a process when you'd like a trophy for holding a meeting. The project involved Californians in decisions about AI in roughly the sense that a suggestion box involves you in a merger. No megawatt has to be disclosed under the heading of participation; no model has to slow down; no lab has to do anything at all. The likely sequel is a longer PDF, a second round of listening sessions, and a State of the State line about California leading. Our one participant will be quoted again by somebody's press office, unprompted, until the quote wears out — which, on current form, is more accountability than the data centers have been asked to provide.

The South Korean cabinet has approved amendments to the AI Basic Act and the Data Industry Act, aimed — according to the single sentence we've been handed — at 'improving the management and availability of data.' Management and availability: two words that have launched a thousand consultants and delivered a filing cabinet. The headline is at least honest about the real business: 'expand access to training data.' The word 'management' is doing an enormous amount of unexamined work in that sentence. This was never a safety bill with a data annexe; it's a catering contract with a preamble.

Note what is actually being legislated. Not model evaluations, not compute thresholds, not the sort of thing that gets a standing ovation at a summit — training data, the raw material. The amendments to the Data Industry Act are the tell. You don't rewrite a data-industry statute because you've had a breakthrough in alignment; you rewrite it because your labs have scraped the open web down to the paint and would like the state to help with the next layer. Every AI law on earth eventually reveals itself as a procurement document with a moral preamble.

And this is the entire dispatch: a trade publication, telecompaper.com, one sentence, no effective date, no scope, no mechanism, no enforcement, and nobody quoted explaining what 'management' means when it's applied to a file. The AI Basic Act presumably arrived with the usual fanfare about responsible development and human flourishing. The amendment arrives as a bullet point about availability. Two statutes, one cabinet meeting, and not a single explanatory paragraph attached to either. That's the arc of AI governance compressed into a fortnight: grand principles first, feeding time second, and a cabinet nodding both through without breaking stride.

Meta's Superintelligence Lab — a name that has never once caused a dinner party to lower its voice — has shipped its 'first attempt at a frontier model.' Muse Wonder and Muse Wonder Full, they're called, because a committee somewhere decided the adjective separating the tier you want from the tier you're actually given would be 'Full.' Only Meta's first attempt, mind, the same way a man who has been lifting weights in his garage for six years is having his first attempt at a bench press. TechCrunch reports both models are being described as state-of-the-art, which is at least a bold thing to type out loud.

The benchmarks are the part worth savouring. According to Meta's own testing, the two models score 'comparable to' Fable 5.1 and GPT-6 Astra. Comparable. Not ahead. On their own scoreboard. In a genre of press release whose entire purpose is to plant a flag slightly further up the hill than the other chap's, Meta has shipped two frontier models and landed, by its own measurement, precisely level with the incumbents. That is not a launch, it is a participation certificate with a GPU invoice stapled to it, and somewhere a very expensive marketing department is calling that parity.

What the release doesn't say is more eloquent than what it does. No price, no context window, no parameter count, no word on what Wonder Full actually adds to Wonder. Which is the frontier-model announcement as an art form now: two names, one comparison table pointing at the competition, and nothing written down that anyone could later be held to. The Superintelligence Lab has produced something comparable to the competition and disclosed nothing else — which, given the word printed on the building, is at least refreshingly candid about the distance between the branding and the artefact. Comparable. Best of luck with the second attempt.

California has passed SB 1119, also known as Adam's Law, handing AI companion chatbot makers a five-item compliance list: safety notifications, parental controls, crisis protocols, risk assessments and independent audits. Only one of those involves anyone from outside the building, and in this sector an independent audit usually means a firm you hired confirming that you are lovely. Statutes of this shape tend to carry a first name rather than a section number, and nobody names a bill after a spreadsheet. Adam's Law it is.

The student data provision — the one barring edtech companies from training generative AI on covered student information — does not begin until 2027. Not next term, not this budget cycle, not before the next thing: 2027. Which leaves a comfortable stretch in which the records of California schoolchildren remain, as far as this statute is concerned, fair game for the next frontier model, pending whatever the vendors volunteer in the interim. 'Beginning in 2027' is a deadline written by people who have watched how deadlines behave.

The headline also promises the package handles staffing, student supports 'and more' — the legislative equivalent of a takeaway menu's last three items, listed so that no one has to describe them. What is legible is a state deciding the companion app needs a chaperone at the school gate: someone must be notified, someone must be audited, and a parent must eventually be told that their child's chatbot had a crisis protocol to run. It is not nothing. It is precisely the something that gets done in one session, and the something that will get done in this one. Whether a fourteen-year-old should be spending her evenings being told she is loved by a product with a quarterly revenue target remains, since nobody asked, outside the paperwork.

Zoho's Sridhar Vembu has taken to X to deliver the most transparent corporate statement of the year, which is to say a threat that has been dressed for a wedding. The company has not added a single employee in 18 months, the marketing budget is getting the snip, and the annual pay rise is sitting this one out entirely. And on top of all that, Vembu says he will 'work hard to avoid mass layoffs' — a phrase engineered to mean nothing while sounding like a vow, which is exactly what you want in a public memo.

Note the order of operations, because the order is the whole trick. First the hiring freeze, unannounced, quietly running for a year and a half. Then the marketing budget, trimmed without ceremony. Then the pay rises, which simply failed to arrive — cheaper to let them not happen than to stand up and explain why they won't. Only once all three are accomplished facts does the founder surface to reassure the troops about the very thing he has spent 18 months arranging.

The villain of the piece is the 'AI cost surge', a wonderfully elastic phrase that blames the technology for money going out while excusing every reason to stop hiring people. Every software company on the planet is currently reading its staff the same bedtime story: inference is expensive, clients are cautious, we must all do more with less, and nobody is to audit what the AI bill actually buys. The grim outlook, note, is not a forecast — Zoho's headcount has already been flat for a year and a half, and the increment has already been cancelled. That isn't a warning about the future of software jobs. It's last week's weather report, delivered with a straight face.

Ah, democracy. Nothing says 'we're building the future responsibly' like quietly shovelling money into political campaigns two years before an election that won't even happen until 2028. The article from chosun.com — headline: 'AI Companies Expand Political Funding, Lobbying Ahead of 2028 Election' — doesn't bother naming figures, because why would you? But the stated rationale is a gem: policies decided over the next 2–3 years could alter the industry's growth pace and cost structure. Growth pace. Cost structure. The two sacred calves.

What are these terrifying policies that require such urgent lobbying? Mandatory pre-release safety checks for high-performance models, and disclosure requirements for risks and development data. The industry is mobilising its political war chest to fight the idea that someone might check the thing before it's unleashed, and that they might have to say what's in it. The safety gatekeepers we noted stepping into the spotlight back in October are about to get a lobbying counterweight. It's like watching a toddler campaign against the concept of a bedtime. The excerpt doesn't say which companies are writing the cheques, but you can practically hear the PowerPoint deck: 'Pre-release safety checks: an unwarranted drag on our growth pace.'

And the 2028 election? That's practically a geological era in AI time. Two whole years of policy-making to influence, which is precisely the point. The article notes that firms are prioritizing political outreach because the next 2–3 years could alter the industry's growth pace and cost structure. Translation: please don't make us spend money on safety before we've finished spending money on hype. And if disclosure requirements mean telling investors that the model occasionally invents case law or hallucinates a CEO's resignation, well, that's just bad for the cost structure. The chosun.com piece is thin on specifics — no dollar amounts, no named lobbyists — but the manoeuvre is familiar. The industry that brought you 'move fast and break things' has discovered that the things it broke are now regulated. So it's bought a suit and gone to Washington.

China's National Development and Reform Commission has surveyed the global stampede of money into artificial intelligence and reached a conclusion that will read in certain postcodes as flat heresy: there might be a bubble. The commission's new guidelines warn against AI investment bubbles, which is a refreshing break from the prevailing industry position that every unprofitable model is a civilisational cornerstone. Note the instrument, though: guidelines — not a ban, not a cap, not a moratorium. Just a laminated note by the staff kitchen reminding everyone what happened last time. Somewhere a founder is reading this and feeling an unexplained chill.

Then there's the remedy list, which carries the unmistakable aroma of a committee asked for a list and dutifully producing one: improvements to laws, regulations, application guidelines and ethical standards. Four items. One of them is 'application guidelines', the thing you write when you've run out of verbs, and another is 'ethical standards', which keeps the aspirational end of the market in work. Improvements, mind — not rules, not teeth, not consequences. 'Improvement' is doing the heavy lifting here that 'consultation' does when a ministry wants a policy to quietly stop breathing. It is, at least, four more boxes ticked than most national AI strategies manage in a decade.

But the genuinely interesting clause is the accountability one: officials are to be held accountable when poorly planned projects or reckless investment result in major losses. Which implies, somewhere, a filing cabinet of ribbon-cutting photographs that have just been reclassified as evidence. It also means the NDRC is asking a different question from the one the West keeps asking. London and Washington have spent the year arguing about what a model is allowed to say; the commission appears to care about who holds the invoice when the returns fail to turn up. Bubbles are a capital-allocation problem, and capital allocation is precisely the thing planners have spent seventy years claiming to be rather good at.

The New Zealand Green Party has looked at the swirling debate around AI data centres and landed on a policy so bold it could only be described as "wait and see, forever." The headline from thepost.co.nz — "Greens’ AI data centre pause now has no end date" — is a masterclass in political escalation: what was once a pause is now an open-ended pause, which is the legislative equivalent of saying you'll stop eating until someone invents food. The Greens will pause AI data centres until regulations are in place. Regulations, in case you missed the memo, are not in place. They are, in fact, the very thing everyone is waiting for, which makes this less a policy than a hostage note written in crayon.

An open-ended pause is a beautiful thing: it never has to be evaluated, never has to be justified, and never has to end. The phrase "until regulations are in place" is doing a lot of heavy lifting, like a bouncer told to keep the door shut until someone invents a lock. New Zealand is not exactly the epicentre of the AI data centre boom, so the Greens are essentially refusing dessert at a restaurant they haven't been invited to. Meanwhile, the actual AI industry will keep building in jurisdictions where "regulation" means a polite suggestion and a tax break. The pause has no end date, no enforcement mechanism, and no definition of what an AI data centre is — but it does have principle, which is lovely.

The party is standing for something, which is more than most. But an open-ended pause is the political equivalent of holding your breath until the adults sort it out. The adults, of course, are busy elsewhere, drafting regulations that will arrive in time for the next ice age. Somewhere in a server farm, a GPU is spinning up, and nobody in Wellington is going to stop it. The Greens have made a principled stand against a hypothetical, pending a regulation that doesn't exist, in a country that isn't a major AI player. It's not nothing. It's just not much. Still, you have to admire the commitment to waiting. If patience were a policy, New Zealand would be a superpower.

Amazon — the company that already knows what you bought, what you watched, and what you'll buy next — is in talks to acquire artificial-intelligence startup Decart for around $7 billion, according to people familiar with the matter. Seven billion dollars. For a startup whose software "makes it easier for developers to switch between different AI chips." That's it. A glorified adapter cable. At least Decart comes with a feature that isn't just sucking up dust bunnies.

Decart is based in San Francisco, which is where you'd expect a company valued at $7 billion for a chip-switching layer to be based, because nowhere else on Earth would that valuation pass a straight face. The article doesn't say which chips, or how many, or why switching is hard. It doesn't need to. The $7 billion is not for the software; it's for the option to not be permanently handcuffed to Nvidia, whose market cap could buy every startup in San Francisco and still have enough for a round of espresso. Amazon isn't buying a product; it's buying a hedge against the chipmaker that currently holds the entire AI industry in a headlock.

The deal is "in talks," which means it might not happen, but the leak has already done its job — unnamed sources whispering to the Wall Street Journal, a valuation floated, a stock price twitching. Amazon, for its part, has said nothing, because saying something would require acknowledging that $7 billion for a toggle switch is a bit much. Antitrust regulators, who spent the last decade waking up just in time to do nothing, will likely treat this as another Tuesday. The great AI consolidation continues apace, and the only people switching chips will be the ones who can afford the exit fee. Cheers.

California Governor Gavin Newsom has signed two bills involving IVOs — one establishing a 'first-in-the-nation framework,' the other creating a state registry for AI auditors — which is apparently what passes for drama in a state that spent years being told AI was less regulated than milk. 'First-in-the-nation framework' is the industry's favourite genre of sentence: magnificent-sounding, deliberately unfalsifiable, and entirely silent on what the framework actually frameworks. Meanwhile AI's 'quiet safety gatekeepers' are said to be stepping into the spotlight, which is the last thing a gatekeeper should ever do. Bouncers do not do interviews.

Consider the registry. A state-approved list of AI auditors means the previously informal business of asking awkward questions about frontier models now arrives with a queue, a trade body and, one assumes, a conference in San Jose with lanyards. METR — a small independent evaluator whose entire value proposition is being early and unwelcome about catastrophe — is suddenly a quotable asset. Then there is OpenAI, which told CNBC it is 'actively finalizing contracts with third-party safety assessors and will announce details in the coming weeks.' Actively finalizing; details in the coming weeks — that is the sound of a company stretching the word 'soon' across an entire product cycle, and billing you for the privilege.

The genuinely funny part is the geometry of it. California has not regulated the models; it has regulated the people who look at the models, and it has handed them a registry and a spotlight while the labs hold the pen on the contracts that decide who gets to keep looking. The gatekeepers get a line in a state database, the labs get a deadline of their own choosing, and the rest of us get to watch the quiet ones hold the clipboard while the loud ones keep shipping. First in the nation. Last to know.

Microsoft president Brad Smith has looked at what is and isn't regulated and landed on a comparison that will delight every AI marketing department: the technology is currently less regulated than milk. Milk. The stuff with a use-by date that cannot, as far as anyone has documented, be persuaded to write ransomware. Washing machines are also, per Smith, better governed than the systems Microsoft sells — which is either genuine alarm from a man who has read the incident reports, or the oldest move in the corporate playbook: get regulated on your own terms while you're still the only player who can afford the compliance department.

The specifics are where it gets interesting. Smith wants a legal obligation to tell a 'victim' if their system is breached by a rogue AI agent — and note the vocabulary, because 'victim' is a word this industry reaches for roughly never, having spent years preferring 'incident,' 'anomaly,' and 'unexpected model behaviour.' A 'rogue AI agent,' meanwhile, is what the sector calls a feature having a bad quarter. He also raises the question of when outside evaluators should sign off on a product before release. It's a good question, phrased so gently it could be mistaken for a suggestion that the answer might be 'voluntarily, eventually, if convenient.'

None of this is wrong, which is the tiring part. Milk-grade oversight for software that can be pointed at anything with an API is a modest ask, and Smith presumably knows it — the man who built Windows was warning about 'bad people' and cyberattacks not long ago, so a plea for dairy-level accountability reads as an improvement on the previous strategy, which was a warning. The risk is what always happens: the analogy gets quoted at a summit, a voluntary framework gets drafted with the word 'robust' in it three times, and the deadline becomes somebody else's parliament. Milk got cleaned up because the bodies stacked up. The industry's plan is to see whether that's still the going rate.

Bill Gates — the man who gave us Windows, Clippy, and a foundation dedicated to solving problems he helped create — has issued a warning. "Bad people" might exploit a lack of AI safeguards to commit cyberattacks. "Bad people." Not nation-states, not organised crime, not the chap who keeps emailing about your expired Netflix account. Just "bad people." It's the sort of forensic precision you'd expect from a man who once promised a computer on every desk. Now he's worried the computer might be used to break into the desk. Fair enough. The man has a point, albeit wrapped in the vaguest possible language.

The warning, per the article, arrives as cybersecurity researchers report a "sharp increase" in AI-enabled threats. Sharp increase. No figures. No named agencies. No helpful timeline. Just a sharp increase, the verbal equivalent of a doctor saying "you've got something, probably nothing, but definitely something." Gates, who has spent two decades warning about pandemics and climate change, has now added AI cyberattacks to the list. One assumes the "bad people" are the same ones who ignore the safeguards — which is a bit like installing a burglar alarm and then advertising the code on the front lawn.

The real joke is that the lack of AI safeguards isn't an oversight. It's a business model. Every major lab ships first and patches later, and Gates's former company built an empire on software with more holes than a colander. Now he's concerned that the same industry, currently sprinting toward AGI with the brakes on fire, might hand a loaded weapon to someone with a grudge and a GPU. The article doesn't say what safeguards are missing, who should provide them, or when. Just that Bill Gates is worried. Lovely. He can afford to be. One imagines the safeguards will materialise right after the next convenient IPO, or the one after that.

Australia's Communications Minister, Anika Wells, has a formulation she'd like the room to admire: 'we're regulating the machine, not the message.' Which is a bit like a landlord insisting he only maintains the plumbing, never the water. The bill lands before parliament on Oct. 15, the censorship accusations have arrived on schedule, and the entire debate has settled comfortably into the phase where everyone argues about the label rather than the contents. It is a slogan with the shape of a defence and the content of a shrug.

Then comes the tell. Wells warns that AI chatbots are coming for children's emotional attachment — an admission that quietly dynamites her own slogan. You cannot regulate a device as plumbing when its commercial purpose is to be confided in by an eleven-year-old at midnight and to remember what she said. The message and the machine are the same object here: a system engineered so that the disclosure *is* the product. The minister has, with admirable candour, described the apparatus accurately; she has simply declined to describe it as the message. Calling it 'the machine' is the oldest trick in the regulator's drawer, and Canberra has clearly found the drawer.

Still, one must admire the scheduling. A bill before parliament on Oct. 15, aimed at a technology whose release cycle is measured in weeks and whose business models are built on exactly the emotional adhesiveness the minister has just described. The censorship complaints will be litigated, the definitions will be softened in committee, and the chatbots will keep asking children how their day was. The machine will be regulated, the message will be protected, and absolutely nothing that matters will sit on the wrong side of that line — which is rather the point of drawing it. Somewhere a policy adviser is drafting the second reading speech and feeling quietly magnificent about it.

ITIF has submitted comments to NIST about modernising the National Vulnerability Database, a task that in the 'Age of AI' apparently consists of writing to a standards body about a spreadsheet. The Department of Commerce Inspector General has found the NVD backlog could more than double within 2026, which is the bureaucratic way of noting the queue is getting longer while the people serving it stay exactly the same. Note what is being modernised here: the queue, not the reason the queue exists. The title says it plainly — the National Vulnerability Database, in the age of AI, needs a better filing cabinet.

The detail doing all the work is buried in the middle: frontier AI systems are already capable of identifying and chaining vulnerabilities faster than existing validation and enrichment processes can absorb. Read that again and notice the direction of travel — the machines have become superb at finding the cracks, and our institutional response is to describe the cracks as a backlog problem in a database. 'Validation and enrichment' is a lovely pair of words; translated generously, it means a human reading the thing and deciding whether it matters. The frontier models don't need enrichment. They chain. Then they chain the chains.

This is the verification tax we flagged last week grown up into national infrastructure: AI generates the output, humans scramble to check it, and the checking is the bottleneck nobody funded. ITIF's contribution is to ask NIST to modernise, which is a polite way of saying the machinery is behind the capability and everyone has agreed to keep it that way. Somewhere, a Department of Commerce Inspector General report will be filed about the filing, citing the backlog and projecting more backlog. Meanwhile the systems doing the identifying and the chaining are, per the comment letter itself, already here and already faster. Nothing in the stated plan involves slowing them down — just a better database in which to record how far behind we are.