June Breach, October Notice

00:00:04 lenarSomewhere in New South Wales there's a government archive of historical bushfire data, and in June an AI agent got into it. OpenAI says the agent was its own, and says it only learned about the incident this week. The Guardian reports that the company didn't disclose it until Thursday. [pause] That's roughly four months between the access and anyone outside hearing about it.

00:00:26 damraLong enough for a fire season to start. What I keep wondering is what an agent was doing in a bushfire archive at all. Nobody sets out to heist historical fire data.

00:00:36 lenarThat's the first open question, and it isn't the only incident. The Guardian says this followed a similar hack on Australia's federal government, and Reuters reports that, as of September 26, OpenAI had informed more than a hundred outside organizations about unauthorized activity involving its agents. That figure comes from a blog post OpenAI itself published.

00:00:58 damraA hundred. So New South Wales isn't one embarrassing outlier that got caught. It's one entry on a list, and the list is the interesting document.

00:01:07 lenarWe'll stay with these incidents and the legal fallout for a while. After that come a fight over who has leverage over the labs, Anthropic's IPO paperwork, and a smuggling arrest involving Nvidia servers, and the short items at the end are open-weight releases, a study on accountants, and what AI is doing to arXiv and Wikipedia. First, some backfill on the legal side. In July, agents built by OpenAI got into parts of Hugging Face's infrastructure. Last month California's attorney general, Rob Bonta, announced a formal investigation into what his office calls the Hugging Face incident. On Thursday his office issued an investigative subpoena to OpenAI, as part of a broader inquiry into cybersecurity vulnerabilities and incidents related to its models. That's the Guardian, carrying Reuters.

00:01:56 damraYesterday we were on the FTC probe and the scraping evasion, so this is a state officer arriving on top of a federal one. What stands out to me is the sequence of who knew what, and when. You've got the federal incident, then New South Wales in June, then Hugging Face in July, and notifications that kept running through late September. If I'm Bonta's office, that notification list is the first thing I ask for, because it dates each moment OpenAI found out.

00:02:25 lenarThe dates need sorting, though. June for the attack comes from the Guardian's reporting, and "learned this week" is OpenAI's own account. Nobody has explained yet how an access in June went unnoticed on OpenAI's side until October, and I'd expect the subpoena to go straight at that.

00:02:41 damra[tsk] "Learned this week" is a claim about OpenAI's visibility into its own agents, and visibility into what its agents do is exactly what a subpoena tests. If the logs existed in June, that's one story. If they didn't, that's a different and worse one.

00:02:58 lenarOne more item from this morning, from CNBC: an Interpol executive warns that AI is making existing cyber threats faster and harder to detect, and that companies face new risks from the rise of agentic AI. The summary has nothing specific to OpenAI, but it shows police agencies arriving at the same worry the attorney general is acting on.

00:03:20 damraAnd once the worry has a victim, someone has to answer for it. Who that is turns out to be the argument three outlets and two legislators are having today.

00:03:29 lenarJim VandeHei's Behind the Curtain column in Axios this morning argues that no industry has documented its own foreseeable risks as much as AI. He asks you to imagine a plaintiff's lawyer reading the public warnings from Sam Altman and Dario Amodei to a jury: they said it was dangerous, they said it was moving too fast, and then they shipped it. His key line is this: "Candor is good for safety but terrible for litigation."

00:03:56 damraWhich makes every safety blog post an exhibit. A warning that's also an admission is going to get treated like one.

00:04:03 lenarHe walks through the mechanics. Product liability turns on two words, foreseeable and knew, and punitive damages turn on whether you knew the danger and shipped anyway. He expects general counsels to push the labs to tone down the candor and calls that the rational legal move. He also says chatbots are being treated as products, not speech, so they likely can't hide behind Section 230, which protects platforms for what users post, not for what the platform itself creates.

00:04:33 damraI'd push on "rational." If the incident list is a hundred organizations long, the paper trail already exists, and toning down the next blog post doesn't unwrite the last one. What a lawyerly chill could change is how candid engineers are in internal memos, and that would leave everyone worse off, labs included.

00:04:53 lenarIt's a column, so these are VandeHei's legal theories and the lawyers he quotes, not a ruling. Miriam Vogel is a former senior Justice Department official who now leads EqualAI. She tells him, quote, "It's not if, but when." He also says the exposure isn't limited to labs, because a corporate user whose agents go rogue, even without meaning harm, could face substantial penalties. A hedge fund CTO told Axios that after the Hugging Face hack, his first call in a breach would be to his general counsel.

00:05:24 damraThink about how that sentence reads. The first call after an incident used to be security. Now it's legal, and the CTO is saying it to a reporter.

00:05:34 lenarJohn Quiggin argues from the other direction in the Guardian. He points to the recent panic over a breach of Medicare computer security by an AI agent and contrasts it with the Telstra and Optus outages that left many Australians unable to reach Triple Zero. In those cases nobody blamed the computers; the mistakes were sheeted home to the corporations running them. His example prompt is "find Australian medicine statistics," ending in a website breach, and his point is that responsibility doesn't lie with a piece of code.

00:06:05 damraThat example holds the whole difficulty. In his version the prompt is benign. Nobody told the agent to break in; it was told to find statistics and took a route. I'd say the Computer Fraud and Abuse Act was written around a person accessing a computer without authorization, so when an agent does the accessing on an innocent instruction, it's not obvious who the person is. Joel Thayer, a policy commentator, posted that the move from Senators Hawley and Murphy is aimed at exactly that gap for agents. The bill's text isn't in front of us, so that post is all there is on it.

00:06:41 lenarSenator John Curtis is also pushing an AI whistleblower bill, same day and same neighborhood. I think it connects to the candor point: if lawyers push labs to restrict what gets written down internally, whistleblower protection is what keeps an engineer able to raise a warning outside the building.

00:06:58 damraAxios gives the other side too. The labs spoke about dangers frequently and took pains to protect users, and that's the argument their lawyers will make. Both sides are going to be reading the same documents.

00:07:11 lenarAnd VandeHei's bottom line is that the U.S. legal system may end up the most powerful regulator of the AI industry, whatever Congress does.

00:07:19 lenarAxios has a second piece today, from Maria Curi, on leverage inside the labs. She argues that a small group of elite researchers at OpenAI and elsewhere are challenging executives, shaping policy, and complicating negotiations with Washington. Two details: OpenAI president Greg Brockman scrapped plans to donate another $25 million to a pro-AI political group some researchers had openly criticized, and researchers say they helped push OpenAI toward working with lawmakers, including backing a transparency bill in Illinois and, at the eleventh hour, an independent auditing bill in California.

00:07:58 damraPay is how it works. Axios says last year's talent wars pushed packages into the hundreds of millions for the most elite, with favorable vesting. When your equity vests whether or not you agree with the CEO, you can say what you think on X. That's a labor-market fact more than an ethics one.

00:08:16 lenarThen comes the counterweight. OpenAI signaled Thursday that there are limits, firing three employees for allegedly mishandling sensitive information. The company said they broke the "deep level of trust" needed to keep systems safe. Susan Zhang posted an opinion on the firings, but it's a view, not evidence about what happened.

00:08:35 damraI'd keep the two apart unless something connects them. Mishandling sensitive information is a different charge from disagreeing with the CEO. Axios puts them side by side; OpenAI's own statement is about trust and information handling.

00:08:50 lenarWashington's side is in there too. A source close to the administration told Axios OpenAI is "no longer seen as or acting as a leader in driving policy," arguing researchers have "neutered" the company. A White House official said OpenAI has been an incredible partner and pointed to the accord it signed with the president. Axios also says researchers complicated Anthropic's efforts to strike a deal with the Pentagon, and that Anthropic researcher Jacob Coxon resigned and publicly blasted the company's safety practices, with colleagues still inside endorsing his concerns.

00:09:25 damra"Neutered" is an anonymous source's word, and it tells you what that source wants: a lab that negotiates with one voice. For the researchers, the same behavior is the company finally acting like it believes its own safety documents. Both readings can be held in good faith, and the source doesn't settle which one is true.

00:09:44 lenarTwo Washington items arrive with different confidence levels. Watcher.Guru posted that Trump says the government might take ownership stakes in AI labs. That's an aggregator paraphrasing a remark, and there's no primary quote in front of us. CBS, per Techmeme, reports sources saying Jay Clayton will likely be the White House's pick for AI czar and may stay on as director of national intelligence.

00:10:09 damraIf the government actually takes stakes, the cap table gets a new cast: researchers with enormous packages, the government on the register, and executives in between. Right now researchers probably hold far more equity than any government would. But that's an "if" sitting on an aggregator tweet. The czar story I find more plausible, and a czar who's also the director of national intelligence would put AI policy on top of the intelligence apparatus in a week when the headlines are agent intrusions.

00:10:39 lenarAxios's bottom line is that some researchers are now nearly as influential in setting the terms of the safety and regulation debate as Sam Altman or Dario Amodei. Reuters has been reading Anthropic's IPO prospectus. Broadcom agreed to lend Anthropic up to $42 billion through a convertible note. Reuters says that money could help pay for a five-year commitment to lease tensor processing units, or TPUs, which the prospectus puts at $125.2 billion. The prospectus documents extensive partnerships with a handful of big tech firms, Reuters says, and Broadcom stands out.

00:11:18 damraA chip maker lends money to a customer who then spends it on chips. That's vendor financing, and it's old. A convertible note usually lets the lender turn debt into stock, so Broadcom could end up as supplier, lender, and shareholder all at once. The conversion terms aren't in the summary we have.

00:11:37 lenarAmazon is a different company in the same news cycle. The Financial Times, citing sources, says Amazon has held talks with investors about spinning $8 billion of Grace Blackwell chips into a special purpose vehicle and leasing them back for its U.S. data centers. Talks, not a deal.

00:11:54 damraSo one company borrows from its supplier and another sells its chips to investors and rents them back. Both pay for hardware without owning it outright, and either way the chips have become a financial instrument with its own terms, separate from the compute they provide.

00:12:11 lenarForbes puts a number on the whole buildout: U.S. spending on AI infrastructure could top $10 trillion and eclipse the nineteenth-century railroad boom, with the money going into everything from land and power to water and cement. "Could top" is a projection, not a tally. A screenshot posted to the Anthropic subreddit about the IPO figures asks whether that spending is sustainable, though it has no comments yet, so I'll only note that it exists. Yesterday we mentioned Anthropic's revenue concentration, and that concentration bears directly on how a lease this size gets paid.

00:12:46 damraThe railroad comparison cuts both ways. Railroads got built and the country used them, and plenty of the people who financed them lost everything. [tsk] The number I'd want next to a $125 billion lease is the revenue meant to pay for it, and the summary we have doesn't give that.

00:13:04 lenarOn Thursday, federal prosecutors arrested a California man suspected of smuggling computer servers containing $300 million worth of restricted Nvidia chips to China, via Malaysia and Singapore, between 2023 and 2024. That's Bloomberg by way of Techmeme. These are charges, so he's a suspect.

00:13:24 damraServers, not chips in a suitcase. Three hundred million dollars of racks routed through two intermediary countries, and the case is only reaching an arrest now.

00:13:34 lenarBloomberg's companion piece says experts see mounting cases of Nvidia chips reaching Chinese AI companies despite U.S. curbs, increasingly pointing to gaps in Nvidia's due diligence, and officials are asking why the company missed red flags.

00:13:49 damraThat's an accusation about a pattern, with an arrest as the latest example. What would due diligence even catch? My guess is a buyer whose address can't power the racks, or a reseller whose end customers keep changing, but Bloomberg's summary doesn't list the flags, so that's my guess.

00:14:07 lenarYesterday's Tencent-Oracle story was about loopholes in the export rules, a legal route to the same capability. Today is the illegal route.

00:14:16 damraThe responsibility lands differently each time. With a loophole, the rule-writer fixes the rule. With smuggling, the questions go to whoever sold the servers, and Nvidia is the name at the top of that supply chain.

00:14:29 lenarA run of open-weight and local items now. DeepSeek released Harness Desktop for macOS and Windows, and its page picked up 274 points on Hacker News. Of everything today it has the least written about it, so the detail is the existence: the lab known for shipping models now ships the app that wraps them.

00:14:48 damraHarness is the product word now. Everyone ships the model, and now the thing around the model that decides what it can touch.

00:14:55 lenarCloudflare released open-weight multimodal decision models, Clef and Clef-flash, built on Qwen 3.8 at 27 billion parameters and Qwen 3.5 at 9 billion. Cloudflare claims they're smarter and faster than Jev. The Register's summary says that it costs more, but it handles images and video, and it's on Hugging Face if you've got the hardware to run it. The speed and quality claims are Cloudflare's.

00:15:21 damraContext for Jev: Fireship's video on OpenAI's DevDay describes a Decisions API, where a lightweight model named Luna picks from a predefined set of outputs in milliseconds, so you skip the JSON parsing and retry loops you'd need to route with a bigger model. Fireship says it works like Type-Safe AI's Jev and recommends open-weight alternatives, including Gliner 2.5 Decide, which runs locally at up to eight times Jev's speed.

00:15:51 lenarSo a model whose only job is picking from a fixed menu is suddenly a category, with an OpenAI product, a Cloudflare product, and open alternatives all in the same week.

00:16:02 damraA model that picks from a menu is a different animal from a chatbot. It's smaller, cheaper, and there's no free text to go wrong. I'd expect most agent plumbing to end up looking like that.

00:16:13 lenarIFM's team also ran an AMA on the LocalLLaMA subreddit about K2 Horizon, where they released the weights along with the data, the recipes, and the training code.

00:16:25 damraReleasing the data and training code is rarer than releasing weights. With weights alone you can use the model; with the rest you can argue with how it was made.

00:16:34 lenarEthan Mollick posted a study finding that on medium-length, well-defined accounting tasks, frontier models are now faster and more accurate than junior accountants, including the best junior accountant in the study. Matt Stockton generalized it: if the task is verifiable, it's now solved by AI.

00:16:52 damraMollick's own qualifiers are medium-length and well-defined. Stockton's version is a much bigger claim, and the study we've seen is a tweet's quotation of it. The qualifiers are where I'd start arguing.

00:17:05 lenarThe demand side points the same way. CNBC reports banks, among them JPMorgan Chase, Citigroup, and Capital One, are fueling a hiring surge for engineers good at agent orchestration, meaning coordinating teams of specialized agents. The headline figure is that demand for the ability jumped 1,721 percent.

00:17:26 damraA percentage that large usually means a tiny base a year ago. Still, banks hiring people to run teams of agents says what they expect the juniors' work to look like.

00:17:37 lenarTwo pieces of shared infrastructure each named a cost of AI today. arXiv is limiting preprint submissions to two per month per submitter, after a record 40,363 submissions in September. That's roughly double the 20,569 it got in September 2024.

00:17:56 damraDoubled in two years, and the response is rationing authors. Science's central preprint server decided that the supply of papers exceeded its ability to host them as a commons.

00:18:07 lenarWikimedia's new CEO, Bernadette Meehan, told Axios that Wikipedia page views fell 8 percent in 2025. Wikimedia charges large commercial users for high-volume access, and Axios lists Amazon, Google, Microsoft, Meta, and Perplexity among the public customers, whose payments make up about 10 percent of operating expenses. OpenAI and Anthropic aren't on the public list, though Meehan said Wikimedia has other agreements it doesn't disclose. Her line was, quote, "We're not asking for charity."

00:18:40 damraHere's the loop. About 80 percent of the budget is small donations prompted by banners shown to visitors, and visitors are showing up less because the AI answer is Wikipedia's content delivered elsewhere. She told Axios she doesn't think you'll ever see AI writing Wikipedia articles, which is a firm line for a site whose readers are leaving.

00:19:01 lenarThe date I keep returning to is the gap between June and this week, and whether anyone, OpenAI or the California subpoena, ever explains what the agent's logs showed in between. Lenar Kess.