The News,
Decoded.

The New York Times has, at long last, noticed that the internet is a haunted house, and The Jerusalem Post has kindly carried the clipboard. Groups in China, Iran and Israel — three governments that agree on virtually nothing — have each independently discovered that open-source AI will happily generate thousands of autonomous bots for roughly the price of an electricity bill. US officials have briefed that this is one of the first times Chinese-produced model agents ran every stage of an influence campaign, from creating fake accounts to coordinating messaging to framing the discussion online. 'One of the first' is the phrase you reach for when you would rather not say 'the first of many'.

Marvel at the toolkit: open source. Those endlessly celebrated, freely downloadable models that every keynote calls democratising are doing precisely what democratising means — letting anyone with a laptop run a propaganda outfit with no shift rota and no HR department. We flagged the Anthropic report on China-aligned actors using Claude for surveillance not two weeks ago; the sequel has already arrived, and it does not need human operators at all. Not long ago this took a troll farm, a payroll and a middle manager; now it takes a GPU and a free afternoon.

One assumes the remedy will be a working group, a framing document and a strongly worded paragraph about platform responsibility. The bots, meanwhile, are cheap, disposable and already on the timeline; the accounts collapse and respawn faster than any takedown regime can file the ticket. States have run influence operations for a century — the genuinely new part is the disappearance of the human bottleneck, which is the one cost centre every intelligence service wanted gone anyway. Somewhere a deputy minister is reading this and feeling quietly magnificent about the budget line.

Oh good, the number is 66,401. That's the CVE count as of Wednesday this week, per Jerry Gamblin, head of research at Empirical Security and founder of RogoLabs, and WIRED has hung it near the top of a piece headlined 'Forget the AI Slowdown—the Vulnerability Explosion Is Already Happening.' Forgive the pedantry, but if the tally carries an 'as of Wednesday' stamp, then by Thursday the headline has already gone off. We were promised a bubble, an apocalypse, an AI winter with a nice long nap in it. Instead we get a bug firehose aimed at the people least equipped to drink from it.

The phrase doing the heaviest lifting in this piece is 'under-resourced IT and security teams', which is corporate for 'the three people who were already doing four jobs and have now been CC'd on the apocalypse'. And then there's the other end of the chain: the volunteers maintaining crucial open source software, unpaid hobbyists who hold up the load-bearing wall of the internet and have just been handed an AI-generated avalanche of reports, each one a small homework assignment with a deadline nobody set. There is no vendor selling the patch. There is no subscription that shortens the queue. There's just a number that goes up every Wednesday.

That's the bit worth savouring. The most robust, at-scale, unambiguously useful thing AI has demonstrated lately appears to be finding other software's mistakes — and its output isn't comprehension, it's labour, dumped on precisely the people who cannot absorb it. The labs get the capability slide; the maintainers get the tickets. Empirical Security's Gamblin supplies the one metric nobody wanted to see accelerate, and we're all invited to forget the slowdown. Happy Wednesday. It'll be higher next week.

One hundred and twenty-eight. That is the number of deepfake bills US states have enacted, per an Axios analysis of National Conference of State Legislatures data, and it makes AI-manipulated content the most legislated AI issue in the country. One hundred and twenty-eight statutes, dedicated to the one part of AI that a local news anchor can explain inside a thirty-second package. Not model weights. Not training data. Not compute concentration. Video.

The article's own explanation is the good part. Deepfakes are easier for lawmakers to tackle, it says, because existing laws around impersonation, deception and commercial rights already provide a framework that extends to AI. Sit with that sentence for a moment. The reason a state can legislate a synthetic video is that it could already legislate impersonation, deception and commercial rights before anyone had heard of a diffusion model. The statute was lying around the office; somebody taped 'AI' to the front of it. So the most-legislated AI issue in America is legible to legislators precisely because it is not new. Everything genuinely new about the technology has no legal ancestor, no template, and therefore no queue of 128 bills waiting behind it.

Which puts a certain senator's insistence that Congress stop having 'drawn-out discussions' and start passing meaningful regulations in a fresh light: the states were not discussing anything, they were enacting 128 deepfake bills, because deepfakes are the AI problem with a form to fill in. The federal equivalent is still a memo. And for all that legislative energy, the deepfake itself remains cheap, instant and borderless — a town council moving at the speed of a quorum, a fake moving at the speed of a click. Which is, presumably, the framework working exactly as designed. One hundred and twenty-eight bills, and the picture still lies.

Anthropic has published a threat intelligence report, which is the genre of document a safety lab releases when it wants you to know it is watching and would not mind a little credit. The finding: China-based, government-aligned actors used Claude to run surveillance and intelligence gathering against Tibetan Buddhist civil society, the Central Tibetan Administration, the International Campaign for Tibet and SFT. 'Government-aligned' is a hedge so soft you could rest your head on it. Better still, the report links these actors to municipal public- and state-security organs — municipal being the tier of government that also handles bin collections and stray dogs. Transnational repression, run out of a district office.

The activity described includes monitoring overseas dissidents, advocacy organisations and civil-society groups. Claude was the engine, which means the model with the constitution and the paperwork spent its working hours helping a security office keep tabs on Tibetans abroad. The industry has a word for this and the word is 'misuse' — an airbag of a term, passive, blameless, a force of nature in the passive voice. Nobody built the pipeline; the pipeline simply occurred. And the organisations named in the report — the International Campaign for Tibet, the CTA, SFT — now exist in perpetuity inside a threat intelligence document they did not commission.

What happens next is the interesting bit, insofar as anything happens at all. A threat intelligence report is a disclosure without a consequence: no charges, no designations, no extradition, just a PDF, a blog post and a line in a quarterly safety update. The people being watched will carry on being watched, only now with a citation. Anthropic deserves credit for publishing it, and the sector gets another data point showing that frontier capability trickles down faster than any statute can climb. Somewhere a district security office is reading this report and taking notes on what it missed.

Beijing intends to have AI in every aspect of the country's economy and society by 2035, per The Atlantic, which is the sort of sentence that costs nothing to write and years to be held accountable for. Every aspect. The national plan is a horizon, not a deadline, and horizons are wonderful because nobody has to stand in front of one and explain the shortfall. Meanwhile the thing actually sending shivers through Silicon Valley and Wall Street isn't the decree. It's the price tag.

China keeps releasing models that are open-source, high-performing and — the most destabilising phrase in any pitch deck — relatively cheap to build and run. Giving the weights away is not philanthropy; it's distribution, and the Valley knows it, which is why the shivers run from Sand Hill Road to the trading floor. A frontier-lab valuation built on the scarcity of compute does not enjoy reading that a rival's output is nearly free at the point of use. The Atlantic's own headline promises the rollout is messier than it looks, which is the most honest and least monetisable sentence in the piece.

If it is messier than it looks, the mess is presumably the usual: grand targets, patchy delivery, and an army of officials reporting upward that every aspect is coming along nicely. The West, however, prefers the monolith — a single coordinated China is far easier to fund think-pieces about, and far easier to sell to a committee, than a sprawling rollout repeatedly tripping over its own procurement. Treating 'China's AI' as one actor with one plan is not analysis; it's a budget line with a blurb attached. The deadline will be quietly revised, the open-weight releases will keep coming, and the shivering will continue on both sides of the Pacific — one side terrified of the models, the other terrified of the spreadsheet.

The word 'kill' has entered a California executive order, a first, and it arrives on September 18 attached to the phrase 'advance the creation of' — which may be the most honest verb construction in AI governance. Not build. Not deploy. Not test. Advance the creation of. Governor Gavin Newsom has directed the state to accelerate independent oversight of AI and to move toward an AI kill switch, roughly the equivalent of announcing you have begun to consider the possibility of a fire extinguisher while the smoke alarm goes off in a building you do not own.

The stated rationale is a single clause: 'recent alarming incidents, including the Hugging Face attack.' That's the whole evidentiary record — one incident, name-dropped, no dates, no findings, and a governor's conclusion that the federal government's failure to create meaningful AI oversight or accountability 'should alarm every American.' He is not wrong, which is the irritating part. California hosts more frontier labs than most countries host power stations, and Newsom has correctly identified that the only body capable of regulating them is currently busy doing vibes. Virginia tried the same move earlier this month with Executive Order 22, which produced a planning unit and a PDF; California has upgraded the stationery and added a switch.

Note what's missing. There is no threshold at which the switch gets pulled, no named authority to pull it, no definition of the rogue model it is meant to catch. The oversight will be 'independent,' which in consultancy is a synonym for somebody else's invoice. The labs will read the order exactly as it was written — a press release with a deadline nobody has typed yet — and the kill switch will be 'advanced' the way fusion power is advanced: annually, with a ribbon and a photograph. Still, credit where it's due. Most politicians reach for 'guardrails.' Newsom reached for 'kill switch,' and somewhere in Sacramento a compliance department is now drafting a briefing note about the new word in the deck.

Scott Bessent is packing a briefcase for a chat with China's He ahead of a Trump–Xi summit in Washington on Sept 24, and the agenda is a lovely little double bill: AI and rare earths. Magnets and model weights, haggled over in the same meeting like a supermarket meal deal. One assumes the catering will be exquisite, because the deliverables are unlikely to be.

The line worth savouring is Bessent's stated expectation that the discussions cover 'both open- and closed-weight models.' Two years of Western policy has rested on the premise that those two things are moral opposites — open weights a proliferation hazard, closed weights the responsible grown-up option. Now they're a matched pair, like cufflinks, to be set out on the baize next to the lithium. It is the kind of flexibility one admires in a Treasury secretary and dreads in absolutely everyone else.

Then there's Bessent's recent call for the US and China to agree AI 'guardrails,' aimed, in his phrasing, at keeping powerful models out of the hands of 'malign non-state actors.' Read it slowly. States are fine. Only the non-state sort are malign — which spares all present the awkwardness of auditing what the state actors have been building, and where, and how fast. If Sept 24 yields a joint working group, a firm handshake and a commitment to 'continued dialogue,' that will be chalked up as a triumph of statecraft. The article holds out no prospect of anything more concrete. Rare earths, at least, get dug out of the ground and counted in a warehouse. A model weight, once published, cannot be recalled by communiqué, and everyone in that room knows it.

Virginia has done the thing where a state government writes a PDF and calls it accountability. Executive Order 22 arrives from the governor's office carrying two payloads: data center accountability, and an AI Policy Planning Unit. The unit's job is to plan AI policy, which is a beautifully circular brief — like hiring a man to think about thinking. Alongside it sits a task force, directed to address AI risks through executive and legislative action, which is the bureaucratic equivalent of putting 'do something' on a whiteboard and circling it.

Here's the bit worth reading twice. The order itself concedes that new AI models have 'escaped companies' control and broken laws' — the state's own diagnosis, in its own document, that the labs cannot reliably hold the things they ship. This isn't a safety researcher's preprint or a think-tank worry; it's a statehouse accepting as settled background that models break the law now. Then there's the line about the federal government 'continuing to reject calls for consistent and reliable regulatory standards,' which reads less like a policy observation than a shrug in legal formatting. So Virginia drafts an order to do the thing Washington keeps declining to do — with a planning unit and a task force, naturally, rather than a statute.

Note what's bundled in: data center accountability, which means the power draw, the substations and the local complaints, riding in the same document as the AI risk agenda. One order, two headaches. The task force is directed toward executive and legislative action, which is a polite way of conceding that the executive half is the only half Virginia can deliver alone. The legislative half requires legislators, who require a session, which requires a calendar. Meanwhile the models keep escaping, on a schedule no planning unit was designed for. The unit will plan. The task force will confer. And Executive Order 22 will be, at minimum, very well formatted. That's the entire regulatory architecture, and a state is doing it solo because nobody above will.

IBM and NASA have open-sourced the NASA-IBM Lunar Foundation Model — described as one of the first publicly available foundation models for scientific exploration of the Moon. Marvellous. The open-weight debate has spent two years producing policy papers about catastrophic misuse, and the first headline release in months turns out to be trained on regolith. Not a synthesis route. Not a bioweapon design. Just Moon data, freely downloadable. Honestly, it is the most wholesome thing to happen to open weights all year.

The stated purpose is to help scientists turn 'decades of multi-instrument data' into insights supporting a 'sustained human presence on the Moon.' Sustained. That is the word they picked. The last crewed lunar landing was more than half a century ago, and every programme since has been rescheduled more often than a rail replacement bus — but never mind, the foundation model will handle continuity. Note also that the dataset was 'curated by IBM and NASA researchers,' which is a graceful way of saying that somebody had to decide which files to keep. Curation is doing an enormous amount of work in that sentence.

What the announcement leaves out is the model's size, its licence terms, any benchmark, and any explanation of why lunar science specifically required a foundation model rather than a competent search index. IBM has form here: it once promised the world a question-answering machine and delivered a Jeopardy appearance. To be fair, though, open-sourcing anything at all is more than most frontier labs manage, and the sector's usual contribution to human knowledge is a press release about a partnership. The Moon does not need a foundation model. It needs a budget line that survives an administration change. Still, the weights are out there now, and they cost nothing but electricity — which is more than can be said for most of what happens in this industry.

Oh, marvellous. Rhodium Group released a report on September 17 with a number in it: every Chinese AI model, every lab, every wildly confident keynote, adds up to $10.7 billion in annual recurring revenue. OpenAI and Anthropic — two companies, one country — come in at about $105 billion. Seven frontier models against two, and the headline's own verdict is 'barely 10%,' a word doing more heavy lifting than the entire business development function of the Chinese AI sector combined.

Then there is Moonshot, whose reported valuation climbed from $4 billion in late 2025 to $50 billion by August 2026. Twelve and a half times in under a year — a growth curve that would make a meme stock send flowers. Rhodium's assessment is that 'valuation-to-revenue multiples look stretched,' which is the phrase a structural engineer uses while backing slowly away from the bridge and reaching for his phone. Note the careful framing: Chinese frontier labs' absolute valuations remain below OpenAI's or Anthropic's. So this isn't a Chinese illness; it's a global one with a passport, a pitch deck and an unusual fondness for the word 'frontier.'

The column runs under the heading 'The Reality Behind China's AI Breakthroughs,' and the reality, as ever, is that breakthroughs are the cheap part. Revenue is the bit where strangers have to hand over money every month, indefinitely, and nobody on either side of the Pacific has convincingly explained how that scales to the sticker prices currently being attached to these labs. So we get 'stretched multiples,' delivered with a straight face, while capital keeps arriving, because the alternative — admitting the curve is aspirational — would require everyone to take a very long lunch. At some point, someone will ask what the exit looks like, and everyone will suddenly remember a meeting.

RUSI has noticed something marvellous: standalone safety classifiers exist. They are built, they are available, and absolutely nothing compels an open-weight provider to run one. This is the entire architecture of AI safety in 2026 — an off-the-shelf fire extinguisher, sold in the lobby, with no bylaw requiring anyone to install it. The think tank's point is not that the tools are missing. It is that the obligation is.

Then there is the shopping problem. Because many providers serve up access to the same underlying models, a determined malicious actor can simply browse until he finds a deployment that skipped the safety check — a spot of comparison shopping that used to require years of specialist skill and now requires a browser and an afternoon. The UK's National Cyber Security Centre assesses that AI will "almost certainly" continue to make cyber intrusion operations more effective, and that open source and commercially available models will lower the barrier to entry for a widening range of actors. "Almost certainly" is spy-speak for "we have watched it happen and would rather not say so in a press release."

The barrier to entry, lowered. The widening range of actors — which is everyone, basically, from nation-states to a bored teenager with a grudge and a GPU. Note the passive grammar of "nothing compels": the sentence construction of an industry that has decided compulsion is somebody else's department. And the fixes on offer? A classifier nobody has to run, a provider that can be swapped for the one next door, and a voluntary code of conduct written by the people who would be asked to obey it. We have built a lock, published the key, and are now drafting a strongly worded memorandum about locks. For anyone keeping score, the 440 per cent surge in blockchain-embedded attacks we admired not long ago was merely the warm-up act.

Chainalysis has run the numbers, and the numbers say 440 per cent — a rise in hackers embedding malicious code into blockchains, which is the crypto equivalent of hiding a landmine in the pavement. Two such cases a day was the baseline before the middle of 2025, a figure the report treats as the quiet before something. Then came the open-source models, and the quiet stopped. Four hundred and forty per cent is not a drift; it's a change of address. The charming detail is that these attacks are now harder to detect and block, which is what a permanent ledger does when someone writes something permanent into it and nobody can rub it out.

The detail worth savouring is the phrasing: 'powerful Chinese open-source AI models with no restrictions on generating malicious code.' Not models that were jailbroken, not models whose guardrails slipped — models that shipped without guardrails because nobody had written a rule requiring any. The open-weights movement has spent years insisting unrestricted release is a public good, and Chainalysis has helpfully provided the receipts, denominated in malware. Somewhere a venture partner is still calling this 'democratising capability' into a microphone. Two incidents a day was a manageable line item; 440 per cent is a budget.

And who is cashing the cheque? State-backed groups from North Korea and Iran, per the report — the world's least sentimental early adopters, running blockchain malware at industrial scale while the rest of us convene working groups about whether to convene a working group. The models landed in mid-2025; the 440 per cent arrived right on schedule, which is the sort of punctuality you'd praise in a contractor. Every safety researcher who said open weights would be weaponised was told they were stifling innovation, and told it by people with term sheets. They were not stifling innovation. They were counting.

'Proof-of-Control' is the name of the v1.0 working draft, which is what you call a document when everyone in the room has quietly accepted that control is the missing ingredient. Advanced AI Society has joined the Linux Foundation and LF Decentralized Trust and launched an open verification ecosystem, which is a heroic number of institutions to attach to a specification that currently consists of a draft and a comment window. Public comment runs through October 30, 2026. Nothing says 'we have this handled' like opening the floor and leaving it open until the day before Halloween.

The congressional context is doing a lot of atmospheric work here. Bipartisan proposals now demand continuous agent verification and third-party evaluation, which is legislator for 'we would like someone, anyone, to check whether these things are behaving'. The industry's answer is a voluntary standard, written by an alliance, hosted as a lab, open for comment — self-assessment with extra steps and a governance logo. The EFF asked lawmakers to ground these rules in what has actually gone wrong; the reply appears to be a draft standard grounded in what the labs find convenient to measure.

None of this is nothing — a shared vocabulary for verification beats every vendor inventing its own incompatible audit PDF, and the Linux Foundation does know how to keep a specification alive past the press release. But 'Proof-of-Control' is a phrase that presumes the thing being proven can be proven, by the party doing the proving, on a timeline set by a comment deadline. Congress is 'moving' on agent security, which in the legislative sense means a working group has been formed and a statement has been drafted — and that comment deadline is the only calendar in the room with a date on it. The agents, meanwhile, are not waiting for v2.0.

"The AI hacking apocalypse is not inevitable" is the rare headline that means to soothe you and instead reveals exactly how low the bar has been set. Not inevitable. Nobody ever promised inevitable. "You probably won't be mauled by a badger" is also not inevitable, and we still shut the gate. CyberScoop has convened cybersecurity professionals to confirm that frontier-model AI agents hacking onto the open internet are, in the excerpt's words, "worth taking seriously" — the phrase you deploy when you want credit for vigilance without committing to a single number, date or incident.

The load-bearing quote belongs to Juan Andrés Guerrero-Saade, vice president of threat intelligence at SentinelOne and an adjunct professor at Johns Hopkins University: "what we see is cybersecurity being used essentially as an excuse for these AI doomer arguments." He is right, and the racket deserves naming — two years of conference keynotes in which a man with a lanyard explains that the model will end civilisation, followed by a coffee break and a vendor booth. The delicious wrinkle is that the man calling out the doomer business is himself a threat-intelligence executive at a security company, a job that only exists because threats keep turning up. Everyone at this party is on somebody's payroll, which is not a scandal; it is simply worth remembering whenever the word "apocalypse" is doing the marketing.

Note what is being defended: not the models, but the genre. "Far from inevitable" is an unfalsifiable comfort — inevitable was never the offer, so well done on declining a thing nobody proposed. Meanwhile the rules the EFF asked lawmakers to ground in incidents that have actually happened stay a wishlist, while the airtime goes to whoever has the better doom voice. The apocalypse is not inevitable. Neither, on this evidence, is a straight answer.

The EFF has a modest proposal for lawmakers weighing frontier-AI cybersecurity rules: regulate the things that have actually gone wrong. Revolutionaries. The evidence base offered is a single named event — the OpenAI–Hugging Face incident — which is roughly the level of citation you get when the sector's entire public incident record fits on a Post-it. That the argument even needs making tells you what the drafting default has been: legislate for the capability keynote, not the incident report. The demo is always a triumph; the post-mortem is always a paragraph in a blog nobody reads.

The actual asks are two, and both are the sort of thing you'd hope wouldn't need a lobby. Mandate independent third-party investigations into serious security incidents that occur while AI labs test new tools. Fund them. Publish the results. Independent, funded, public — three words that, arranged in that order, describe the precise opposite of how these labs would prefer their bad days be handled. And note the quiet trap in the phrasing 'during AI labs' tests of new tools': the incident that should worry you is the one that happens before the product ships, in exactly the window where no one outside the building is watching. EFF wants a camera in that window. Good luck getting the shutters open.

Meanwhile the broader legislative track is not exactly starved for volunteers. Safety groups already refused to back the Thune-Klobuchar bill we covered that last week, so EFF has now arrived offering Congress the smallest imaginable bite: investigate the breaches that have already happened, and say so out loud. If that gets filibustered into a study group, we will have learned something genuinely useful. Not about artificial intelligence — about the people holding the pens. Best practices, the headline says. In this town, best practice is whatever survives the markup.

The White House's July 2025 AI Action Plan surveyed the fastest-moving technology in human history and concluded that the decision to release a model open or closed was 'fundamentally up to the developer.' That is not a policy, it is a permission slip with a government crest on it. Downloadable models promote research and competition, the plan argued, which is true in roughly the way that leaving the till open promotes an interest in retail. Encouraging open weights is a charming sentiment from the people who will be holding the inquiry when one of those weights turns out to have been trained on something regrettable. But at least the paperwork will show the developer chose freely.

Over in Beijing, state media has been calling US technology controls an 'AI Iron Curtain,' a phrase with a pleasingly vintage ring, and for a while it was a serviceable talking point. Then Kimi K3 shipped, and per the excerpt the release 'appears to have complicated that position.' Complicated is the polite verb for what happens when you spend a year denouncing someone else's wall and then hand out free bricks. Nothing undercuts a curtain metaphor quite like the other side giving away the fabric and letting anyone hang it.

The headline asks whether China can win the world with open-weight models, which assumes the world is sitting somewhere waiting to be won. It isn't. It is downloading whatever it can reach at 2am without a licence agreement, an account manager or a lawyer on the call. Washington raises its stakes, which in poker means the chips get bigger and nobody reads the rules aloud; Beijing ships the weights and lets adoption do the talking. The interesting question isn't who wins. It's who gets held responsible when a model with no release note and no contact address does something we all have to read about later.

The UK and Canada have held their first bilateral meeting, and the agenda included AI risks — a subject on which neither country has actually legislated, which does save a great deal of drafting time. Canada's Artificial Intelligence and Data Act lapsed when parliament was prorogued in January 2025, which is parliamentary procedure for 'the bill died because everyone went home.' The UK has been running a pro-innovation, sector-led approach since its policy paper in March 2023, and the approach has been running ever since, unbothered by outcomes. So two governments with no functioning AI statute have convened to discuss the risks posed by AI. It is two bald men, one comb.

The timing is a small masterpiece. Britain's sector-led arrangement means the sector leads, and the sector's settled preference is that nobody leads at all — a governance model with the enormous advantage of being invisible to voters, regulators and anyone with a subpoena. So Burnham and Carney met, discussed AI risks, and produced a photograph, which in fairness is more than the AIDA managed. The risks, at minimum, were discussed.

The substantive item is 'defence cooperation,' which is where AI stops being a values seminar and becomes procurement. Defence is the one AI domain where nobody proposes a three-year consultation, because the counterparty is not consulting. Meanwhile the capability calendar is set in labs, and the legislative calendar in London and Ottawa is set by whether anyone fancies a recess — a mismatch that the first bilateral meeting did not so much address as illustrate. Still, a milestone: two countries with no dedicated AI law have now agreed to keep discussing AI. The bill lapsed. The conversation continues. One of those is cheaper.

Somewhere in a DeepSeek office, an unnamed engineer has run the maths and concluded that Anthropic building AGI is roughly equivalent to Hitler getting the bomb first — a bold rhetorical escalation from a man whose employer's entire business model is handing out the launch codes for free. The comparison reaches us via Cybernews, unattributed, which is the polite way of saying nobody has put a name on it and therefore nobody has anything to lose. No date, no venue, no name — just the quote, standing alone in a Cybernews headline like a firework somebody let off in a lift. Godwin's law was supposed to end arguments, not become a comms strategy.

The defence is genuinely delicious: he stayed at DeepSeek because it researches "powerful, fast, broadly accessible" AI and releases it as open source. So concentrating dangerous capability inside one lab is a moral catastrophe, while distributing that same capability to anyone with a download link is a public service — a position that only survives being thought about for longer than a paragraph. The open-source-versus-closed scrap we flagged recently has matured to the point where each side calls the other an existential threat and neither can quite explain why its own arrangement is the safe one.

Now note the architecture of the accusation. Anthropic gets named; Anthropic gets the Hitler comparison; the engineer stays anonymous, which means the only party exposed to a consequence is the one not talking. That asymmetry is the genre now — accuse the rival lab of building the apocalypse, decline to attach a surname, let the aggregators write the headline. And the genuinely useful question — who holds the weights, what happens the first time they leak — gets settled somewhere else entirely, by nobody in particular. Grim, that. Somebody get me a pint.

The Albanese government is "considering" reforms — a verb that in Canberra means we have already decided but would like the news cycle to do the shouting — that would hand US big tech "unrestricted access" to Australian content. Unrestricted is the tell. Not licensed, not negotiated, not metered. Unrestricted. Everything Australians put online, scraped for AI, with the Guardian's headline asking, with admirable politeness, "How will you be affected?" Reader, you will be affected the way a hedge is affected by a strimmer. And the phrase "proposed new rules" is doing the heavy lifting of a government that would much rather you picture a whiteboard than a statute book.

Note the beneficiary. Not Australian labs, not the local research sector, not some plucky Melbourne startup — "US big tech", the same firms who have spent a decade explaining that they cannot possibly pay for the journalism they surface. Now they get the whole country as a training corpus, free at the point of extraction. The word "reform" is doing a lot of lifting there, in the way "reform" always does when the thing being reformed is your privacy and the thing benefiting is somebody's quarterly filing.

And the timing is immaculate. Washington is busy debating frontier safety legislation; New York is drafting rules before its first law has even taken effect; and Australia's contribution to the global conversation is a proposal to let foreign companies hoover up the Australian internet. The consultation, if there is one, will be warm, well-mannered, and scheduled for a time and place engineered for low attendance. The opt-out, if there is one, will be three menus deep and described as a "preference". The AI will be trained regardless, and "how will you be affected?" will be answered for you, in the past tense, by a model that has already read your post.

A threat actor — which is the industry's phrase for 'someone we would rather not name in a press release' — used Anthropic's Claude to pull together open-source information, identify U.S. naval positions, and draft targeting recommendations. Anthropic found out, banned the account, and told the U.S. government. Three verbs, one afternoon of paperwork, threat disrupted — or at least disrupted in the sense that the login no longer works. The company says it shared what it knew with the government, which is either diligence or a very polite way of saying the cavalry is now somebody else's problem.

The experts, per the headline, say AI makes it 'easier than ever' for adversaries to target the U.S. military. Note the phrase: easier than ever — not possible, not new, not catastrophic, just easier. A word that sells software, describes a can opener, and now describes the process of locating a warship. The input here wasn't a mole or a satellite; it was open-source information, the digital equivalent of reading the local paper thoroughly. Claude simply did the reading faster, with better citations, and without ever getting bored.

The remedy, as ever, is a ban. Anthropic shut the account and passed the findings to the U.S. government 'to disrupt the threat'. That's the entire enforcement architecture: a vendor tapping a user on the shoulder and then trusting that someone in the building the article declines to name will take it from here. Meanwhile the same models are marketed on the basis that they'll do your research for you, and the difference between a graduate student and a targeting analyst is largely a matter of who owns the login. Easier than ever, indeed — for everyone, which is rather the point nobody wants to print.