The News,
Decoded.

So Senator Ron Wyden, having presumably watched BNY Mellon get early access to the dangerous Mythos model and the White House plan to give it to federal agencies, has decided the best way to handle 'powerful AI tools that can quickly sift through personal data' is to... urge support for legislation. The man wants 'guardrails' on Section 702 of FISA, a surveillance authority that's been repeatedly abused and renewed with cosmetic tweaks for over a decade. One might call this a bold, innovative strategy of asking nicely, years after the horse has not only bolted but been genetically sequenced, monetised, and integrated into a predictive policing algorithm.

Wyden's argument is that AI's data-sifting prowess makes surveillance restrictions 'more urgent'—a masterclass in understatement, given we're discussing tools that can parse a lifetime of digital exhaust in seconds. The proposed legislation would require warrants for U.S. person queries, among other things. It's the policy equivalent of installing a screen door on a server farm after the admin passwords have been posted to 4chan. The fact that this is considered a progressive position, rather than basic hygiene, tells you everything about how far capability has sprinted ahead of consent.

One can almost admire the circular farce: the same agencies that will likely get access to frontier models through the White House's planned programme are the ones Wyden wants to restrain with a law that hasn't passed. It's a delightful regulatory pantomime where everyone gets to perform concern while the infrastructure for total granular surveillance is being built, tested, and handed to the very institutions with a documented history of overreach. The only thing moving faster than AI inference is the gap between what's technically possible and what's politically permissible.

So the White House, having presumably read the Bloomberg report about how dangerous Mythos is, has decided the best course of action is to give it to federal agencies. The same model that internal experts warned could 'hack foundational computing systems' is now apparently fine for the Social Security Administration and the Department of Energy to play with. One imagines the procurement process involved a single checkbox labelled 'makes everyone nervous' and a brisk signature from someone who's never had to explain a data breach to Congress.

Bloomberg's report notes the tool 'could sharply increase cybersecurity risk'—a wonderfully bureaucratic understatement for something that could theoretically dismantle the very infrastructure it's meant to protect. The plan is to make 'a version' available, which in government-speak likely means 'the one with the safety rails welded on by an intern last Thursday.' It's the digital equivalent of handing out flamethrowers to park rangers to help with controlled burns, then being surprised when the entire forest goes up.

What's particularly delicious is the timing: this comes just as BNY Mellon was quietly handed access to both Mythos and GPT-5.4-Cyber, positioning itself as one of the 'few vetted enterprises.' So the world's largest custodian bank gets vetted access, but federal agencies—with their legendary cybersecurity track record—get what appears to be a blanket rollout. One can only hope the onboarding includes a mandatory training module titled 'Please Don't Let It Hack the Power Grid.' The gap between what Anthropic says about this model's dangers and what governments do with it would be funny if it weren't so perfectly predictable.

So Maine, having presumably taken notes from Bernie Sanders' and Alexandria Ocasio-Cortez's theatrical data-center moratorium proposal that we dismissed as a snowball in a server farm, has gone ahead and actually passed one. The bill, which would pause new data centers for two years, now awaits Governor Janet Mills' signature, making Maine the first state to legislate such a halt. At least six other states are reportedly considering similar restrictions, which suggests we're witnessing the birth of a new regulatory trend: symbolic gestures dressed up as industrial policy, aimed at an industry that will simply route around them like water around a stone.

Of course, the legislation cites concerns about energy consumption and grid strain—noble enough, if you ignore the fact that data centers have been gobbling power for decades without this level of legislative panic. The timing, though, is exquisite: just as AI's compute hunger becomes a mainstream talking point, lawmakers seize on data centers as a convenient villain. It's a classic political move: address the symptom (power usage) rather than the cause (unchecked AI scaling), because actually regulating AI development would require understanding it first. The bill's proponents can now claim they're 'doing something' about AI's environmental impact, while the labs quietly secure power-purchase agreements elsewhere.

Governor Mills now gets to play Solomon, weighing the moratorium against what the article delicately calls 'economic development opportunities'—corporate-speak for the tax breaks and jobs that data centers dangle. The whole exercise feels like watching someone try to dam a river with a picket fence: it might look decisive from a distance, but the water's already finding another path. Meanwhile, the AI industry will continue its expansion, unfazed by a two-year pause in one of the least populous states in the union. Another day, another performative policy that changes precisely nothing.

So Bernie Sanders and Alexandria Ocasio-Cortez have decided the best way to 'fight back' against AI oligarchs is to propose a moratorium on data centers, a move about as likely to succeed as a snowball in a server farm. The poll they cite—79% of voters concerned the government lacks a plan—is less a call to action and more a testament to the fact that after years of AI hype, the only concrete policy on the table is a performative halt that tech lobbyists will shred before it even hits a committee. It's the regulatory equivalent of shaking a fist at a hurricane, with the added irony that the data centers they want to freeze are the very infrastructure powering the AI they're warning will replace workers.

Sanders' claim that AI aims to cut labor costs by 80 to 90% is a nice, round, terrifying number that conveniently ignores the nuance of which jobs are actually at risk—but why let details get in the way of a good stump speech? This is the same political theatre we saw when Snap blamed AI for 1,000 layoffs earlier this month, where 'AI' becomes a catch-all for corporate cost-cutting while politicians respond with gestures that are more about optics than outcomes. The moratorium proposal is less a policy and more a placeholder, a way to say 'we're doing something' while the actual displacement rolls on unchecked.

And let's not forget the delightful hypocrisy: this warning comes from a political class that's largely clueless about the technology they're trying to regulate, yet happy to use AI-driven analytics in their own campaigns. The 'fight back' rhetoric is a comforting narrative for a working class staring down the barrel of automation, but it's hard to see how a data center moratorium—even if it passed—would do anything but slow the inevitable while the real action happens in boardrooms and labs. It's all very earnest, very dire, and very likely to achieve precisely nothing beyond a few headlines and a lot of hand-wringing.

So BNY Mellon, the world's largest custodian bank with $47 trillion in assets, has been quietly handed the keys to both OpenAI's GPT-5.4-Cyber and Anthropic's Mythos, positioning itself as one of the 'few vetted enterprises' deemed worthy of early access to these advanced cyber models. CEO Robin Vince's statement that the labs 'recognize the importance of releasing cyber-capable models to certain institutions early for feedback' is a masterclass in corporate euphemism—translation: we're paying to be guinea pigs for systems that could potentially compromise our entire financial infrastructure if they hallucinate a zero-day. The fact that OpenAI's model is rolling out 'more broadly' than Anthropic's gated offering suggests a delightful race to the bottom in who can market their cyber-prowess to the most lucrative clients fastest, all while maintaining the fiction that this is about 'responsible testing' rather than revenue generation.

This comes just weeks after Anthropic's Project Glasswing managed to find exactly one confirmed CVE, which should inspire tremendous confidence in their cybersecurity capabilities. Now they're handing that same meticulously tested technology to a bank that safeguards nearly half the world's investable assets, because nothing says 'prudent risk management' like deploying barely-vetted AI on systems that, if breached, could trigger global financial contagion. Vince's cheerful admission that this is about 'real-world testing' is the banking equivalent of volunteering your pension fund as crash-test dummy for a self-driving car that's still learning what stop signs look like.

The entire arrangement perfectly encapsulates the regulatory gap: while policymakers are still debating whether to require impact assessments for general-purpose AI, the labs are already conducting live experiments on critical financial infrastructure with exactly zero oversight. BNY gets to boast about being at the cutting edge, the labs get their models stress-tested on someone else's dime and liability, and if anything goes wrong, we'll all get to enjoy the spectacle of Vince explaining to regulators how 'early feedback' somehow led to a multi-trillion-dollar exposure. It's the kind of innovation that makes you wonder if the financial system's resilience has been outsourced to a chatbot that's still figuring out how not to invent facts about historical interest rates.

So Anthropic, having spent the last fortnight alternately warning the world to get ready for more powerful AI and quietly resigning from boards to avoid conflicts of interest, has decided the best way to make Claude 'a genuinely good, wise, and virtuous agent' is to convene a seminar with religious and business leaders. Because when your model is already being used to detect vulnerabilities and generate code that displaces a thousand Snapchat employees, what you really need is a theological consult. The company that co-founder Jack Clark recently said would keep releasing models that 'surpassed every benchmark' is now apparently worried about its moral formation, a concern that arrives just as the Trump administration retaliates against its restrictions on military usage. Nothing says 'virtuous agent' like needing a PR offensive to offset a political backlash from the very government whose ethical compass is, shall we say, flexible.

Let's parse the specifics: the administration argues private AI companies 'should not dictate' constraints on military applications, a position that neatly inverts Anthropic's own carefully cultivated image as the responsible steward. This is the same company whose cybersecurity initiative, Project Glasswing, we noted had managed to find exactly one confirmed CVE, yet now it's positioning itself as the arbiter of battlefield ethics. The seminar, part of its 'pitch' for Claude's goodness, feels less like a sincere exploration of morality and more like a branding exercise designed to pre-empt regulatory scrutiny—or perhaps distract from the fact that its models are already being integrated into systems that could automate layoffs and design competing products.

The irony is thick enough to cut with a knife. Anthropic wants to be both the prophet warning of AI's power and the priest blessing its virtue, all while navigating the messy reality of government pushback and market pressures. As the administration pushes back, citing national security imperatives, one can't help but wonder if this moral formation seminar is merely a performative hedge—a way to say 'we tried' when the inevitable compromises come. In a world where AI governance is already a 'cheerful incoherence,' as we saw in that finance survey, adding theology to the mix seems less like a solution and more like another layer of obfuscation. Perhaps the real lesson is that when you're building godlike tools, you'd better be prepared to play politics with the mortals in charge.

So Florida has decided that the best way to handle AI in the legal profession is to impose new rules requiring attorneys to verify AI-generated work, provide guidance on its use, and ensure proper training—just as researcher Kristine Snively reveals findings showing rapid adoption, ethical risks, and growing concerns over accuracy and confidentiality. Because nothing says 'robust governance' like scrambling to write guidelines after the horse has already bolted, hallucinated a legal precedent, and potentially breached client confidentiality. The state bar's sudden regulatory awakening feels less like foresight and more like a frantic attempt to mop up after a party they didn't even know was happening.

Snively's research, which apparently documents 'rapid adoption' alongside 'ethical risks', is the kind of academic confirmation that what everyone already suspected is indeed happening. Attorneys are using AI tools that might spit out inaccurate case citations or leak sensitive client information, and now Florida is responding with a classic bureaucratic three-step: verify, guide, train. It's the regulatory equivalent of putting up a 'Wet Floor' sign after someone's already slipped and broken their hip—admirably prompt, if about six months too late. The fact that this comes from 'emerging attorney AI-misuse caselaw' suggests there are already enough legal messes to form a pattern, which is always a reassuring sign of technological maturity.

What's particularly delightful is the timing: this regulatory scramble follows on from the cheerful incoherence in AI governance we flagged recently, where 57% of finance decision-makers weren't coordinating their AI efforts. Now we have the legal profession discovering that maybe, just maybe, letting lawyers loose with black-box models without oversight might lead to problems. The lessons—verify, guide, train—are so basic they could be from a workplace safety manual, yet they apparently need to be codified into state bar rules. One wonders what the next frontier will be: 'Don't Let AI Write Your Closing Arguments While Drunk' guidelines, perhaps?

So the much-hyped Project Glasswing, Anthropic's carefully gated cybersecurity initiative that we were told would 'detect vulnerabilities' with Mythos, has apparently managed to find exactly one confirmed CVE in the wild. VulnCheck's analysis reveals that for all the breathless talk about Mythos surpassing every benchmark, its real-world impact currently amounts to a single documented vulnerability—hardly the paradigm-shifting security revolution that was being sold to us just last month. One wonders if this is what Anthropic co-founder Jack Clark meant when he said the world needs to 'get ready' for more powerful AI: get ready for the hype-to-reality ratio to be even more comically lopsided than usual.

Of course, the full picture of Mythos' true capability isn't expected before July 2026, which gives Anthropic plenty of time to quietly adjust expectations while maintaining the carefully cultivated mystique. The company that warned about powerful AI while releasing its own powerful model now gets to hide behind the 'limited publicly attributable impact' shield—a masterclass in having your existential risk cake and eating it too. It's almost impressive how they've managed to generate maximum buzz while delivering minimum verifiable results, a strategy that would make any Silicon Valley PR firm weep with admiration.

Meanwhile, OpenAI is busy scaling its Trusted Access programme with GPT-5.4-Cyber, which also features 'lowered refusal boundaries' for security teams. So we have two AI giants engaged in a carefully choreographed dance of releasing powerful cybersecurity tools while simultaneously warning about their dangers, all while the actual measurable impact remains vanishingly small. The regulatory gap isn't just about legislation lagging capability—it's about corporate storytelling racing so far ahead of reality that nobody can tell what's actually happening anymore. At this rate, by July we'll need another model just to detect the vulnerabilities in the hype.

So Jack Clark has decided that the best way to 'get ready' for more powerful AI is to issue a polite warning from the company that just released Claude Mythos, a model so capable it 'surpassed every benchmark' and can 'detect vulnerabilities in applications and operating systems,' to only 40 corporations under Project Glasswing. Because nothing says 'preparedness' like locking the most advanced tools in a velvet-roped VIP section while telling the plebs outside to brace for impact. It's the AI equivalent of selling lifeboats to first-class passengers and then announcing over the loudspeaker that the ship might hit an iceberg—very considerate of the co-founder to give us all a heads-up.

Clark's admission that 'more Mythos-like models' are coming from other developers is the real gem here. After the carefully gated release we flagged last week, where Anthropic's chief science officer explained the dangers with the soothing cadence of a hostage negotiator, we now get the sequel: a co-founder casually noting that everyone else is racing to build equally powerful systems. The regulatory gap isn't just yawning; it's doing the splits over a canyon, with Clark's statement serving as the official soundtrack. 'Get ready' indeed—perhaps by investing in a bunker, or maybe just trusting that the same labs who can't coordinate governance will somehow manage this proliferation responsibly.

It's all so wonderfully British in its understatement. The model that can supposedly root out OS vulnerabilities is being drip-fed to a handpicked corporate elite, while the public gets a vague advisory about impending capability leaps. One almost admires the chutzpah: create something that could redefine cybersecurity (or weaponize it), release it under a programme with a name straight out of a spy thriller, and then issue a press-release-level caution about the future. If this is the 'getting ready' phase, the actual arrival might involve a lot of shrugging and a strongly worded blog post. Cheers to progress.

So the finance world has discovered that the best way to approach AI governance is with the kind of cheerful incoherence that would make a toddler's tea party look like a G7 summit. A new survey finds 57% of finance decision-makers aren't confident AI tools will operate within existing controls, while a truly heroic 61% of executives are 'very confident'—a gap so wide you could drive a herd of hallucinating LLMs through it. This isn't a governance gap; it's a chasm of delusion, where C-suite optimism meets middle-management dread in a perfect storm of accountability-free wishful thinking.

Accounting Today's survey reveals that 47% of companies have no single owner for AI governance, and 45% of firms are 'not very confident' they can maintain control over AI systems. This isn't just a coordination problem—it's an abdication dressed up as innovation. The report notes that 'lack of coordination' is costing companies through 'inefficiencies, increased risk exposure, and potential regulatory penalties,' which is corporate-speak for 'we're flying blind but the PowerPoint looks fantastic.' When 57% of the people responsible for controls don't trust the technology, and nearly half can't even identify who's supposed to be in charge, you don't have a governance framework—you have an expensive game of hot potato.

This delightful confusion arrives just as regulators are starting to pay attention, creating the perfect conditions for what one consultant calls 'a perfect storm of accountability-free wishful thinking.' The same executives who are 'very confident' about AI's compliance are presiding over systems where no one knows who's accountable—a disconnect so profound it borders on performance art. When the people signing the checks can't coordinate with the people managing the risk, you get exactly what this survey reveals: a costly mess where everyone's confident about someone else's problem. At least the consultants will eat well.

So the UK government has decided that the best way to follow up on its £500 million Sovereign AI venture capital unit we flagged last month is to launch a £500 million Sovereign AI fund. Because nothing says 'strategic consistency' like announcing the same initiative twice with slightly different branding, and nothing says 'global AI leadership' like throwing taxpayer money at 'high-potential firms' while the actual frontier labs operate on budgets that make half a billion look like pocket change. The Technology Secretary Liz Kendall has chosen Wayve's offices as the launch venue—a self-driving car company that's already raised over $1 billion privately—which perfectly captures the government's approach: propping up established players with public funds while pretending this is about nurturing startups.

Let's examine this 'leap from breakthrough research to large-scale commercial success' that the fund supposedly enables. The UK's track record here is less 'Silicon Valley' and more 'valley of death'—brilliant academic papers that never escape the lab, because turning research into products requires more than a grant cheque. It requires regulatory clarity, talent retention, and infrastructure that doesn't collapse when you try to scale. Instead, we get a photo-op at Wayve and £500 million that will likely end up spread so thinly across 'high-potential' applicants that no single project gets enough to actually compete with the billion-dollar compute clusters being built elsewhere.

And let's not forget the timing. This announcement comes just as the EU finalises its AI Act implementation and the US pours tens of billions into CHIPS Act follow-ons—regulatory frameworks and industrial policy that actually shape markets. The UK's response? Another fund. Because when you're losing the regulatory race and the compute race, why not double down on the 'throwing money at the problem' race? It's a beautifully British solution: create a bureaucracy to distribute money, hope some of it sticks, and declare victory when a few press releases get written. At least the civil servants drafting the application forms will have job security.

So the tech industry has discovered that the best way to announce mass redundancies is to copy-paste the same corporate euphemisms about 'strategic pivots' and 'AI-driven efficiency', with Business Insider noting that Atlassian, Block, and Snap all deployed strikingly similar language about 'moving early' and 'cutting deeply'. Nothing says 'human-centric leadership' like treating your workforce reduction announcements as a template exercise, complete with the obligatory nod to AI as the all-purpose justification. The memo from Atlassian's CEO, Scott Farquhar, about 'accelerating our shift to AI' while cutting 5% of staff could be swapped with Block's Jack Dorsey announcing 'fewer people and more AI' after eliminating 1,000 roles, and nobody would notice the difference—except, of course, the thousands of actual humans now updating their LinkedIn profiles.

This convergence on what Business Insider calls 'an approach to move early, cut deeply, and proceed with fewer people and more AI' reveals a delightful corporate consensus: when in doubt, blame the algorithm. Experts quoted in the piece gently point out that AI 'can't outmatch workers in many cases' and that 'multiple factors may be at play', but why let pesky facts interrupt a good narrative? The real innovation here isn't in the technology—it's in the art of using three letters as a blanket excuse for restructuring, while carefully avoiding any mention of quarterly earnings pressures or shareholder demands for leaner operations. It's almost as if someone circulated a 'How to Frame Your Layoffs for Maximum Investor Appeal' playbook, and every C-suite executive dutifully hit 'forward'.

What's particularly charming is how this mirrors the broader regulatory vacuum we've seen, where companies can essentially self-certify their AI justifications without any oversight—much like the governance coordination gap we highlighted last week that's leaving firms to navigate AI risks alone. Now they're navigating headcount reductions with the same cheerful lack of accountability, treating AI as a magical incantation that makes unpleasant decisions sound inevitable rather than calculated. One can only imagine the boardroom slides: 'Phase 1: Deploy AI. Phase 2: ??? Phase 3: Profit (and fewer payroll expenses).' At this rate, the next earnings call will feature CEOs reading AI-generated layoff announcements to an AI-generated analyst audience, in a perfect circle of synthetic sympathy.

So the UK government has decided that the best way to compete in the global AI race is to launch a £500 million state-backed venture capital fund, because nothing says 'free market innovation' like the government picking winners with taxpayer money. The Sovereign AI unit, which opened its doors today, promises to provide 'focused, long-term backing' to UK tech firms in 'strategically important AI areas' – a wonderfully vague remit that essentially means civil servants will now be deciding which AI startups deserve half a billion pounds of public funds. This comes just as Anthropic and OpenAI are expanding their London offices we noted yesterday, suggesting the government would rather throw money at homegrown alternatives than actually create conditions where global leaders might pay their fair share of taxes here.

Of course, the timing is impeccable – just as the Treasury is cutting public services to the bone, we're suddenly finding half a billion quid to play venture capitalist. The unit's stated aim to help UK firms 'grow internationally' suggests we'll be subsidising companies that will inevitably relocate their headquarters to Delaware or the Cayman Islands the moment they become successful. And let's not forget this is the same government whose previous tech investment schemes have produced exactly zero world-beating companies, unless you count the occasional app for booking parking tickets that somehow cost £50 million to develop.

What's particularly galling is the branding – 'Sovereign AI' sounds like something from a 1970s industrial strategy pamphlet, evoking images of British Leyland cars and state-owned steel mills. The reality is that £500 million is pocket change in the global AI investment landscape, where single funding rounds regularly exceed that amount. This is less about creating genuine technological sovereignty and more about creating the appearance of doing something while actual AI capability continues to be concentrated in the hands of a few American corporations who couldn't care less about UK 'strategic interests' unless they involve tax breaks.

So South Africa's Department of Science and Innovation has published a draft AI policy that reads like a beautifully crafted wish list assembled after a particularly inspiring TED Talk binge. The document earnestly calls for 'dedicated AI research centres of excellence with new funding' and aims to 'bridge AI advances with ethical risks'—a phrase so perfectly meaningless it could have been generated by one of the very models they're hoping to regulate. The timing is impeccable, arriving just as the global AI race has already left the station, with frontier labs operating at a scale that makes this 'bolster research and computing infrastructure' ambition feel like planning a backyard vegetable garden while industrial agriculture consumes the continent.

What's particularly charming is the document's focus on 'the potential ethical, economic and societal risks of AI' while being published 'for public comment'—a process that typically moves with the urgency of continental drift. One can almost hear the polite, thoughtful submissions being filed as OpenAI, Anthropic, and their ilk continue their breakneck sprint toward capabilities that render such national policy exercises quaint. The gap between the earnest bureaucratic language of 'setting out ambitions' and the reality of what's already being deployed is a chasm wide enough to swallow entire government departments.

It's the classic regulatory theatre: draft a policy that acknowledges all the right concerns, use all the appropriate buzzwords about ethics and societal impact, and create the impression of thoughtful governance. Meanwhile, the actual power—the compute, the talent, the capital—continues to concentrate elsewhere, making this South African exercise feel less like a strategic plan and more like a beautifully formatted admission of irrelevance. They're not wrong about the risks; they're just about three years too late to the party, and the host has already changed the locks.