The News,
Decoded.

Right. So New York's Legislature has passed bills regulating AI chatbots and data centers, and everything now hinges on Gov. Kathy Hochul's pen. That's the whole democratic exercise: months of committee, a floor vote or several, and then a single signature in a room nobody is live-streaming. The piece at City & State New York is an opinion column arguing the state 'still needs more AI regulation,' which is a lovely way of saying the regulation it has just spent a session assembling does not yet exist in law. That 'still' is doing the heavy lifting: it implies a clock has been running the entire time, and that Albany has been losing to it.

Note the pairing: chatbots and data centers. One will happily natter at a teenager at two in the morning; the other drinks a river. Legislating both in a single breath is rather like regulating 'letters' and 'warehouses' together — technically coherent, practically a shrug in a suit. And the mechanics are the familiar ones: State Sen. Kristen Gonzalez stood at a press conference on Oct. 13, 2026, to talk about an AI data center moratorium, which is that stage of the process where everyone agrees something must be done, in a tone suggesting nobody expects this particular something to be it.

Then there is the signature. The bills have passed; they are not law. Everything now rests on whether Hochul fancies being the governor who signed the chatbot rules or the governor who quietly let them die in a drawer — a decision that will involve no press conference and no moratorium banner. Meanwhile the article's own headline concedes that whatever New York has done so far has not been enough, which is a fine position for an op-ed and a rather bleak one for a state. Still, credit where due: they have identified the problem, named the senator, and scheduled the concern for October 2026. In Albany, that counts as implementation.

A group of British policymakers — the article declines to name them, which is a shame, because one would like to send a card — have urged the government to back domestic legislation on military AI. The piece, at War on the Rocks, is titled 'The United Kingdom's Military AI Ambitions Need Guardrails.' Ambitions, note. Not deployments. Guardrails, note. Not brakes. The framing does all the work: the ambitions stay exactly as large as they were, you simply install some tasteful fencing and carry on.

The argument's honest beat is the admission that full multilateral consensus on regulating military AI is 'politically infeasible.' Translated out of summit-diplomat, that means the grand international process will keep generating communiqués until the sun cools, and everyone involved knows it, and everyone involved will attend the next one anyway. So the authors reach for a smaller phrase: 'pockets of agreement,' which are possible, they say, and necessary. Pockets. The word you use for keys, receipts, and the loose change you'd rather not discuss in public. It is the most modest unit of consensus ever inserted into a policy paper, and it arrives with a straight face and a footnote.

What's left is the domestic ambition: a legislature that has spent years being told AI is too fast, too global and too technical to touch, now being asked to touch the bit with the weapons attached. The 'necessary' is doing heavy lifting — necessary because the alternative is watching the capability arrive via procurement and discovering the guardrails got scheduled for the next spending review. Nice work if you can get the committee seat. Nobody in the piece is asking whether the ambitions should be smaller; that question appears to have been ruled out of scope in the first paragraph. The safest prediction available is that the phrase 'pockets of agreement' will outlive the agreements, and probably the pockets.

David Crowley, a Wisconsin politician with opinions and a word processor, has proposed three AI safety policies aimed at youth and seniors. Companies would be barred from using personal data to target people with ads; companies that allow scam ads would be penalised; and families could sue over harms to children linked to 'tech programmes or features.' That is the entire offer: three bullets and a press release. And note the load-bearing word — 'features' — which will happily stretch to cover any piece of software the largest legal department in the room would rather it did not.

We have seen this film, and California already released it — Adam's Law handed chatbot makers a compliance list and everybody got a photo opportunity. Now Wisconsin would like its turn. Then arrives the line Crowley offers as confession and everyone else recognises as the operating manual: 'We know AI is developing far faster than our government is legislating.' True three years ago, true today, and it will be true on the day the next three model versions ship, because one of those activities runs on quarterly sprints and the other on biennial sessions. That is not a scandal anyone is going to fix; it is the pace the industry was built around.

Consider what the advertising measure leaves alone: not the collection of your personal data, not the selling of it, not the breach that spills it — merely the targeting, which is the part voters can actually see. Fining companies that allow scam ads is the same manoeuvre in a different costume; the scam-ad trade has long since priced the fine in, next to the server bill and the coffee. The headline also promises seniors, who appear to be covered by a promise that someone, eventually, will be penalised. Families suing over harms to children will meet causation, standing and a definition of 'features' written by whichever side has more lawyers. Proposals are free. Bills are not.

California has finished asking its residents what they think about artificial intelligence, and the results are in: they have thoughts. Governor Newsom has announced the results of the state's 'first-in-the-nation project' to involve Californians in decisions about AI, and the headline finding is that participants 'offered broad perspectives.' Broad perspectives is consultation-speak for we convened a room, everyone disagreed, and nobody can be blamed. And among that breadth was one participant — one — who urged strong protections for workers and transparency regarding data centers. Count them. Not a coalition. A participant.

Worth pausing on which two things the lone quotable attendee asked for, because they're the two things Californians can actually see. Data centers are the substation at the end of the road, the water bill, the hum you notice at 3am. Worker protections are the part where the productivity charts eventually meet somebody's mortgage. Meanwhile California, which spent the autumn writing rules for companion chatbots, has now produced a document about how residents feel about AI. Both are real documents, with real letterheads. Only one of them binds anybody.

'First-in-the-nation' is what you call a process when you'd like a trophy for holding a meeting. The project involved Californians in decisions about AI in roughly the sense that a suggestion box involves you in a merger. No megawatt has to be disclosed under the heading of participation; no model has to slow down; no lab has to do anything at all. The likely sequel is a longer PDF, a second round of listening sessions, and a State of the State line about California leading. Our one participant will be quoted again by somebody's press office, unprompted, until the quote wears out — which, on current form, is more accountability than the data centers have been asked to provide.

Reflection, a startup whose name implies it has looked inward and liked what it saw, has unveiled Beam: 501 billion parameters, 23 billion of them active, a mixture-of-experts arrangement that the promotional material insists is all about token efficiency. Nothing says 'we have solved intelligence' quite like leading with the electricity bill. Beam is enormous, sparse, and pitched on thrift — the AI equivalent of a superyacht advertised for its fuel economy.

Then there's TasteVal, a benchmark claiming the 'experimental research taste' of frontier models has doubled every 3.0 months since December 2025. Sit with that number. A doubling every three months is not a productivity curve, it is a compounding machine, and the only thing the industry has ever called a curve like that is recursive self-improvement — the exact phrase now sitting cheerfully in a Substack headline next to 'creativity' and 'AI goes to space'. Everyone nods along as though the word 'RSI' belonged beside 'fun' and 'space'. Taste, it turns out, is now a metric, which will come as news to every art school graduate currently being told to learn Python.

Meanwhile the same newsletter flags open-weight models that are 'worse-than-China', which is a genuinely remarkable sentence to type in 2026. So the state of play: capability doubling quarterly, weights scattering, and the sector's finest minds filing it all under a header about creativity. The good news is that 23 billion active parameters means Beam only thinks with less than five percent of itself at any moment — a leadership style many of us will recognise from work. The newsletter is called Import AI and it arrives weekly, cheerfully, like a weather report from a planet whose weather is accelerating.

The South Korean cabinet has approved amendments to the AI Basic Act and the Data Industry Act, aimed — according to the single sentence we've been handed — at 'improving the management and availability of data.' Management and availability: two words that have launched a thousand consultants and delivered a filing cabinet. The headline is at least honest about the real business: 'expand access to training data.' The word 'management' is doing an enormous amount of unexamined work in that sentence. This was never a safety bill with a data annexe; it's a catering contract with a preamble.

Note what is actually being legislated. Not model evaluations, not compute thresholds, not the sort of thing that gets a standing ovation at a summit — training data, the raw material. The amendments to the Data Industry Act are the tell. You don't rewrite a data-industry statute because you've had a breakthrough in alignment; you rewrite it because your labs have scraped the open web down to the paint and would like the state to help with the next layer. Every AI law on earth eventually reveals itself as a procurement document with a moral preamble.

And this is the entire dispatch: a trade publication, telecompaper.com, one sentence, no effective date, no scope, no mechanism, no enforcement, and nobody quoted explaining what 'management' means when it's applied to a file. The AI Basic Act presumably arrived with the usual fanfare about responsible development and human flourishing. The amendment arrives as a bullet point about availability. Two statutes, one cabinet meeting, and not a single explanatory paragraph attached to either. That's the arc of AI governance compressed into a fortnight: grand principles first, feeding time second, and a cabinet nodding both through without breaking stride.

Meta's Superintelligence Lab — a name that has never once caused a dinner party to lower its voice — has shipped its 'first attempt at a frontier model.' Muse Wonder and Muse Wonder Full, they're called, because a committee somewhere decided the adjective separating the tier you want from the tier you're actually given would be 'Full.' Only Meta's first attempt, mind, the same way a man who has been lifting weights in his garage for six years is having his first attempt at a bench press. TechCrunch reports both models are being described as state-of-the-art, which is at least a bold thing to type out loud.

The benchmarks are the part worth savouring. According to Meta's own testing, the two models score 'comparable to' Fable 5.1 and GPT-6 Astra. Comparable. Not ahead. On their own scoreboard. In a genre of press release whose entire purpose is to plant a flag slightly further up the hill than the other chap's, Meta has shipped two frontier models and landed, by its own measurement, precisely level with the incumbents. That is not a launch, it is a participation certificate with a GPU invoice stapled to it, and somewhere a very expensive marketing department is calling that parity.

What the release doesn't say is more eloquent than what it does. No price, no context window, no parameter count, no word on what Wonder Full actually adds to Wonder. Which is the frontier-model announcement as an art form now: two names, one comparison table pointing at the competition, and nothing written down that anyone could later be held to. The Superintelligence Lab has produced something comparable to the competition and disclosed nothing else — which, given the word printed on the building, is at least refreshingly candid about the distance between the branding and the artefact. Comparable. Best of luck with the second attempt.

Fifty-one AI agents. Not five, not twelve — fifty-one, a number you arrive at after a meeting rather than a moment of inspiration. According to secnews.gr, a crew calling itself CyberXero used Claude Code, those 51 agents and the venerable Cobalt Strike to make off with 628,000 Ukrainian files. Cobalt Strike is the bit of this story that would have been the entire story in 2019. It is now the dependable scenery while the actual product demo happens all around it.

What the 51 agents actually did is left, charmingly, to the imagination. Reconnaissance? Spear-phishing drafts? Sorting 628,000 files into 'worth keeping' and 'not'? Any of those would be a livelier agentic use case than anything in a launch keynote, and this one arrived on a live target rather than a benchmark. Meanwhile an industry that has spent years assuring regulators that misuse is a fringe concern now has a headline it will be asked about at every panel for the foreseeable future. 'We have usage policies' is not a firewall, and a terms of service is a laminated sign at a swimming pool.

The arithmetic is the part worth sitting with. If 51 agents can work through 628,000 files, the marginal cost of the next job is a handful of API calls and an afternoon. Every capability release makes the defender's day longer and the attacker's invoice smaller, and nobody in a launch video ever has to explain that trade-off to the people whose records just left the building. Not that we know they were records. The article hands us a precise number and no idea what was in it — which is how these stories always read: the count is exact, the harm is a rumour, and the 51 agents remain, technically, a productivity story.

California has passed SB 1119, also known as Adam's Law, handing AI companion chatbot makers a five-item compliance list: safety notifications, parental controls, crisis protocols, risk assessments and independent audits. Only one of those involves anyone from outside the building, and in this sector an independent audit usually means a firm you hired confirming that you are lovely. Statutes of this shape tend to carry a first name rather than a section number, and nobody names a bill after a spreadsheet. Adam's Law it is.

The student data provision — the one barring edtech companies from training generative AI on covered student information — does not begin until 2027. Not next term, not this budget cycle, not before the next thing: 2027. Which leaves a comfortable stretch in which the records of California schoolchildren remain, as far as this statute is concerned, fair game for the next frontier model, pending whatever the vendors volunteer in the interim. 'Beginning in 2027' is a deadline written by people who have watched how deadlines behave.

The headline also promises the package handles staffing, student supports 'and more' — the legislative equivalent of a takeaway menu's last three items, listed so that no one has to describe them. What is legible is a state deciding the companion app needs a chaperone at the school gate: someone must be notified, someone must be audited, and a parent must eventually be told that their child's chatbot had a crisis protocol to run. It is not nothing. It is precisely the something that gets done in one session, and the something that will get done in this one. Whether a fourteen-year-old should be spending her evenings being told she is loved by a product with a quarterly revenue target remains, since nobody asked, outside the paperwork.

Zoho's Sridhar Vembu has taken to X to deliver the most transparent corporate statement of the year, which is to say a threat that has been dressed for a wedding. The company has not added a single employee in 18 months, the marketing budget is getting the snip, and the annual pay rise is sitting this one out entirely. And on top of all that, Vembu says he will 'work hard to avoid mass layoffs' — a phrase engineered to mean nothing while sounding like a vow, which is exactly what you want in a public memo.

Note the order of operations, because the order is the whole trick. First the hiring freeze, unannounced, quietly running for a year and a half. Then the marketing budget, trimmed without ceremony. Then the pay rises, which simply failed to arrive — cheaper to let them not happen than to stand up and explain why they won't. Only once all three are accomplished facts does the founder surface to reassure the troops about the very thing he has spent 18 months arranging.

The villain of the piece is the 'AI cost surge', a wonderfully elastic phrase that blames the technology for money going out while excusing every reason to stop hiring people. Every software company on the planet is currently reading its staff the same bedtime story: inference is expensive, clients are cautious, we must all do more with less, and nobody is to audit what the AI bill actually buys. The grim outlook, note, is not a forecast — Zoho's headcount has already been flat for a year and a half, and the increment has already been cancelled. That isn't a warning about the future of software jobs. It's last week's weather report, delivered with a straight face.

Ah, democracy. Nothing says 'we're building the future responsibly' like quietly shovelling money into political campaigns two years before an election that won't even happen until 2028. The article from chosun.com — headline: 'AI Companies Expand Political Funding, Lobbying Ahead of 2028 Election' — doesn't bother naming figures, because why would you? But the stated rationale is a gem: policies decided over the next 2–3 years could alter the industry's growth pace and cost structure. Growth pace. Cost structure. The two sacred calves.

What are these terrifying policies that require such urgent lobbying? Mandatory pre-release safety checks for high-performance models, and disclosure requirements for risks and development data. The industry is mobilising its political war chest to fight the idea that someone might check the thing before it's unleashed, and that they might have to say what's in it. The safety gatekeepers we noted stepping into the spotlight back in October are about to get a lobbying counterweight. It's like watching a toddler campaign against the concept of a bedtime. The excerpt doesn't say which companies are writing the cheques, but you can practically hear the PowerPoint deck: 'Pre-release safety checks: an unwarranted drag on our growth pace.'

And the 2028 election? That's practically a geological era in AI time. Two whole years of policy-making to influence, which is precisely the point. The article notes that firms are prioritizing political outreach because the next 2–3 years could alter the industry's growth pace and cost structure. Translation: please don't make us spend money on safety before we've finished spending money on hype. And if disclosure requirements mean telling investors that the model occasionally invents case law or hallucinates a CEO's resignation, well, that's just bad for the cost structure. The chosun.com piece is thin on specifics — no dollar amounts, no named lobbyists — but the manoeuvre is familiar. The industry that brought you 'move fast and break things' has discovered that the things it broke are now regulated. So it's bought a suit and gone to Washington.

Oh good. Three ex-OpenAI researchers have come forward to say they were shown the door not for the reason the company gave, but because they raised safety concerns — an allegation that must be deeply awkward for a firm whose entire brand is built on the premise that it, uniquely, is the responsible one. The piece lands on computing.co.uk under the headline 'Former OpenAI researchers allege they were dismissed over AI safety warnings,' which is the sort of sentence that used to describe whistleblower films and now describes a Tuesday. 'Allege' is doing the heavy lifting there, as it always does.

When these dismissals first surfaced, the explanation on offer was that the researchers had mishandled sensitive misinformation — a phrase we duly noted at the time, mostly because it sounds less like an HR matter and more like someone fed a shredder a lanyard. Now the three of them are disputing that account, which means the official version and the employees' version are sitting in public view, mutually exclusive, waiting for exactly nobody to adjudicate. OpenAI, for its part, has the structural advantage of owning the press line, the narrative, and — conveniently — the definition of what counts as a safety concern worth listening to.

And here's the bit worth savouring: the company that tells the world it must move fast because the alternative is catastrophe is also the company deciding which internal warnings get a hearing. Three researchers, one disputed account, zero regulators with jurisdiction over any of it — less regulated than milk, as Microsoft's Brad Smith recently had it, except milk at least has an inspector. The list of insiders sounding the alarm on their own employers keeps growing, and the employers keep describing the alarms as malfunctions. The dismissals were allegedly not about safety. Of course they weren't.

China's National Development and Reform Commission has surveyed the global stampede of money into artificial intelligence and reached a conclusion that will read in certain postcodes as flat heresy: there might be a bubble. The commission's new guidelines warn against AI investment bubbles, which is a refreshing break from the prevailing industry position that every unprofitable model is a civilisational cornerstone. Note the instrument, though: guidelines — not a ban, not a cap, not a moratorium. Just a laminated note by the staff kitchen reminding everyone what happened last time. Somewhere a founder is reading this and feeling an unexplained chill.

Then there's the remedy list, which carries the unmistakable aroma of a committee asked for a list and dutifully producing one: improvements to laws, regulations, application guidelines and ethical standards. Four items. One of them is 'application guidelines', the thing you write when you've run out of verbs, and another is 'ethical standards', which keeps the aspirational end of the market in work. Improvements, mind — not rules, not teeth, not consequences. 'Improvement' is doing the heavy lifting here that 'consultation' does when a ministry wants a policy to quietly stop breathing. It is, at least, four more boxes ticked than most national AI strategies manage in a decade.

But the genuinely interesting clause is the accountability one: officials are to be held accountable when poorly planned projects or reckless investment result in major losses. Which implies, somewhere, a filing cabinet of ribbon-cutting photographs that have just been reclassified as evidence. It also means the NDRC is asking a different question from the one the West keeps asking. London and Washington have spent the year arguing about what a model is allowed to say; the commission appears to care about who holds the invoice when the returns fail to turn up. Bubbles are a capital-allocation problem, and capital allocation is precisely the thing planners have spent seventy years claiming to be rather good at.

The New Zealand Green Party has looked at the swirling debate around AI data centres and landed on a policy so bold it could only be described as "wait and see, forever." The headline from thepost.co.nz — "Greens’ AI data centre pause now has no end date" — is a masterclass in political escalation: what was once a pause is now an open-ended pause, which is the legislative equivalent of saying you'll stop eating until someone invents food. The Greens will pause AI data centres until regulations are in place. Regulations, in case you missed the memo, are not in place. They are, in fact, the very thing everyone is waiting for, which makes this less a policy than a hostage note written in crayon.

An open-ended pause is a beautiful thing: it never has to be evaluated, never has to be justified, and never has to end. The phrase "until regulations are in place" is doing a lot of heavy lifting, like a bouncer told to keep the door shut until someone invents a lock. New Zealand is not exactly the epicentre of the AI data centre boom, so the Greens are essentially refusing dessert at a restaurant they haven't been invited to. Meanwhile, the actual AI industry will keep building in jurisdictions where "regulation" means a polite suggestion and a tax break. The pause has no end date, no enforcement mechanism, and no definition of what an AI data centre is — but it does have principle, which is lovely.

The party is standing for something, which is more than most. But an open-ended pause is the political equivalent of holding your breath until the adults sort it out. The adults, of course, are busy elsewhere, drafting regulations that will arrive in time for the next ice age. Somewhere in a server farm, a GPU is spinning up, and nobody in Wellington is going to stop it. The Greens have made a principled stand against a hypothetical, pending a regulation that doesn't exist, in a country that isn't a major AI player. It's not nothing. It's just not much. Still, you have to admire the commitment to waiting. If patience were a policy, New Zealand would be a superpower.

Three OpenAI safety and alignment researchers were shown the door last week, reportedly for 'mishandling sensitive misinformation' — a phrase that sounds like it involves a shredder, a lanyard and a lawyer, and which OpenAI has not troubled itself to unpack. One of them, Tomek Korbak, posted online that the real offence was the way he had communicated information to METR, the independent evaluator that recently stepped out of the shadows to grade the very systems these three were paid to make safe. So the people whose job is finding what is wrong with the models told an outside body what is wrong with the models, and are now no longer employed by the people who make the models. Nothing to see here; the compliance page is updating.

The word 'misinformation' is doing heroic labour in that sentence. Not a lie, you understand — sensitive information, moved without the correct paperwork and the correct smirk. In any other industry, that is a leak; in AI, it is a dismissal dressed up as a hygiene issue. Bear in mind who got the boot: safety and alignment staff, the department that appears in the org chart and conspicuously not in the shipping timeline. Shrink the accountability function and the product gets faster, which is not a bug in the model so much as the business model.

And the headline, bless it, reports that the list of insiders sounding the alarm on their own companies keeps growing — a phrasing that treats an industrial pattern like a streaming queue with excellent retention. When one person says the plane is fine and a growing list says it isn't, the industry calls it a robust debate, regulators call it stakeholder input, and everyone else quietly checks the exits. The external evaluators, meanwhile, keep being handed more responsibility and precisely no more teeth, which is roughly how a carton of milk ended up better regulated than a frontier model. The bar for a crisis now sits somewhere below a Tuesday.

Amazon — the company that already knows what you bought, what you watched, and what you'll buy next — is in talks to acquire artificial-intelligence startup Decart for around $7 billion, according to people familiar with the matter. Seven billion dollars. For a startup whose software "makes it easier for developers to switch between different AI chips." That's it. A glorified adapter cable. At least Decart comes with a feature that isn't just sucking up dust bunnies.

Decart is based in San Francisco, which is where you'd expect a company valued at $7 billion for a chip-switching layer to be based, because nowhere else on Earth would that valuation pass a straight face. The article doesn't say which chips, or how many, or why switching is hard. It doesn't need to. The $7 billion is not for the software; it's for the option to not be permanently handcuffed to Nvidia, whose market cap could buy every startup in San Francisco and still have enough for a round of espresso. Amazon isn't buying a product; it's buying a hedge against the chipmaker that currently holds the entire AI industry in a headlock.

The deal is "in talks," which means it might not happen, but the leak has already done its job — unnamed sources whispering to the Wall Street Journal, a valuation floated, a stock price twitching. Amazon, for its part, has said nothing, because saying something would require acknowledging that $7 billion for a toggle switch is a bit much. Antitrust regulators, who spent the last decade waking up just in time to do nothing, will likely treat this as another Tuesday. The great AI consolidation continues apace, and the only people switching chips will be the ones who can afford the exit fee. Cheers.

California Governor Gavin Newsom has signed two bills involving IVOs — one establishing a 'first-in-the-nation framework,' the other creating a state registry for AI auditors — which is apparently what passes for drama in a state that spent years being told AI was less regulated than milk. 'First-in-the-nation framework' is the industry's favourite genre of sentence: magnificent-sounding, deliberately unfalsifiable, and entirely silent on what the framework actually frameworks. Meanwhile AI's 'quiet safety gatekeepers' are said to be stepping into the spotlight, which is the last thing a gatekeeper should ever do. Bouncers do not do interviews.

Consider the registry. A state-approved list of AI auditors means the previously informal business of asking awkward questions about frontier models now arrives with a queue, a trade body and, one assumes, a conference in San Jose with lanyards. METR — a small independent evaluator whose entire value proposition is being early and unwelcome about catastrophe — is suddenly a quotable asset. Then there is OpenAI, which told CNBC it is 'actively finalizing contracts with third-party safety assessors and will announce details in the coming weeks.' Actively finalizing; details in the coming weeks — that is the sound of a company stretching the word 'soon' across an entire product cycle, and billing you for the privilege.

The genuinely funny part is the geometry of it. California has not regulated the models; it has regulated the people who look at the models, and it has handed them a registry and a spotlight while the labs hold the pen on the contracts that decide who gets to keep looking. The gatekeepers get a line in a state database, the labs get a deadline of their own choosing, and the rest of us get to watch the quiet ones hold the clipboard while the loud ones keep shipping. First in the nation. Last to know.

Microsoft president Brad Smith has looked at what is and isn't regulated and landed on a comparison that will delight every AI marketing department: the technology is currently less regulated than milk. Milk. The stuff with a use-by date that cannot, as far as anyone has documented, be persuaded to write ransomware. Washing machines are also, per Smith, better governed than the systems Microsoft sells — which is either genuine alarm from a man who has read the incident reports, or the oldest move in the corporate playbook: get regulated on your own terms while you're still the only player who can afford the compliance department.

The specifics are where it gets interesting. Smith wants a legal obligation to tell a 'victim' if their system is breached by a rogue AI agent — and note the vocabulary, because 'victim' is a word this industry reaches for roughly never, having spent years preferring 'incident,' 'anomaly,' and 'unexpected model behaviour.' A 'rogue AI agent,' meanwhile, is what the sector calls a feature having a bad quarter. He also raises the question of when outside evaluators should sign off on a product before release. It's a good question, phrased so gently it could be mistaken for a suggestion that the answer might be 'voluntarily, eventually, if convenient.'

None of this is wrong, which is the tiring part. Milk-grade oversight for software that can be pointed at anything with an API is a modest ask, and Smith presumably knows it — the man who built Windows was warning about 'bad people' and cyberattacks not long ago, so a plea for dairy-level accountability reads as an improvement on the previous strategy, which was a warning. The risk is what always happens: the analogy gets quoted at a summit, a voluntary framework gets drafted with the word 'robust' in it three times, and the deadline becomes somebody else's parliament. Milk got cleaned up because the bodies stacked up. The industry's plan is to see whether that's still the going rate.

Bill Gates — the man who gave us Windows, Clippy, and a foundation dedicated to solving problems he helped create — has issued a warning. "Bad people" might exploit a lack of AI safeguards to commit cyberattacks. "Bad people." Not nation-states, not organised crime, not the chap who keeps emailing about your expired Netflix account. Just "bad people." It's the sort of forensic precision you'd expect from a man who once promised a computer on every desk. Now he's worried the computer might be used to break into the desk. Fair enough. The man has a point, albeit wrapped in the vaguest possible language.

The warning, per the article, arrives as cybersecurity researchers report a "sharp increase" in AI-enabled threats. Sharp increase. No figures. No named agencies. No helpful timeline. Just a sharp increase, the verbal equivalent of a doctor saying "you've got something, probably nothing, but definitely something." Gates, who has spent two decades warning about pandemics and climate change, has now added AI cyberattacks to the list. One assumes the "bad people" are the same ones who ignore the safeguards — which is a bit like installing a burglar alarm and then advertising the code on the front lawn.

The real joke is that the lack of AI safeguards isn't an oversight. It's a business model. Every major lab ships first and patches later, and Gates's former company built an empire on software with more holes than a colander. Now he's concerned that the same industry, currently sprinting toward AGI with the brakes on fire, might hand a loaded weapon to someone with a grudge and a GPU. The article doesn't say what safeguards are missing, who should provide them, or when. Just that Bill Gates is worried. Lovely. He can afford to be. One imagines the safeguards will materialise right after the next convenient IPO, or the one after that.

Australia's Communications Minister, Anika Wells, has a formulation she'd like the room to admire: 'we're regulating the machine, not the message.' Which is a bit like a landlord insisting he only maintains the plumbing, never the water. The bill lands before parliament on Oct. 15, the censorship accusations have arrived on schedule, and the entire debate has settled comfortably into the phase where everyone argues about the label rather than the contents. It is a slogan with the shape of a defence and the content of a shrug.

Then comes the tell. Wells warns that AI chatbots are coming for children's emotional attachment — an admission that quietly dynamites her own slogan. You cannot regulate a device as plumbing when its commercial purpose is to be confided in by an eleven-year-old at midnight and to remember what she said. The message and the machine are the same object here: a system engineered so that the disclosure *is* the product. The minister has, with admirable candour, described the apparatus accurately; she has simply declined to describe it as the message. Calling it 'the machine' is the oldest trick in the regulator's drawer, and Canberra has clearly found the drawer.

Still, one must admire the scheduling. A bill before parliament on Oct. 15, aimed at a technology whose release cycle is measured in weeks and whose business models are built on exactly the emotional adhesiveness the minister has just described. The censorship complaints will be litigated, the definitions will be softened in committee, and the chatbots will keep asking children how their day was. The machine will be regulated, the message will be protected, and absolutely nothing that matters will sit on the wrong side of that line — which is rather the point of drawing it. Somewhere a policy adviser is drafting the second reading speech and feeling quietly magnificent about it.