AI Became a Public Claim

00:00:04 Bloomberg reported this morning that some early Anthropic customers still have access to Mythos Preview, even after the U.S. order that shut down broader access to the newer Fable and Mythos systems. That updates yesterday's story. We still don't have a public written restoration process for the restricted models.

00:00:23 We still don't have the technical basis for the broader order in a form outsiders can evaluate. But we do now have a partial map of who stayed inside the room. The group is Project Glasswing, a roughly 200-organization program Anthropic cleared to use Mythos Preview for cyber vulnerability research.

00:00:42 Bloomberg says businesses including banks and technology firms are accessing the system through that program. Cisco confirmed it retained access. Dragos chief technology officer Jon Lavender said his company has it too. The Reddit item that first surfaced the Bloomberg piece also listed Amazon Web Services and JPMorgan Chase as early members, though Bloomberg's extractable article text I could fetch directly named the broader categories and the two confirmed examples.

00:01:12 This isn't a small procedural detail. Yesterday, the pressure point was model access as a state-mediated privilege. Today, the visible detail is exception management. Once a government order interrupts a frontier model, the public argument moves from whether the model is too dangerous to who is trusted to keep using it while everyone else waits.

00:01:33 That is a different kind of power. A ban looks blunt from the outside. An access list is finer grained, and in some ways more consequential, because it says which institutions are treated as responsible enough to hold the capability. Cybersecurity companies make sense if the stated concern is vulnerability research.

00:01:53 Banks make sense if the concern is financial infrastructure. Large cloud providers make sense because they sit between customers and compute. But the public still can't inspect the standard being applied. The plain administrative version keeps nagging at me. If a model is restricted, who can appeal?

00:02:12 Who audits the exception list? Does access depend on nationality or corporate sector? Does it depend on security clearance, contract controls, customer identity, or political discretion? The answer may vary by group, which is exactly why it needs to be written down.

00:02:28 The G7 discussion in yesterday's coverage put leaders and AI executives at the same table. Bloomberg's piece shows the same fight in operational form: named companies keeping access to a model others lost. Governance becomes concrete when someone has to maintain the list.

00:02:46 My read is that Anthropic's problem is no longer only whether Fable or Mythos comes back. The company and the government now have to explain why one organization is safe enough and another isn't. If that explanation stays private, the access regime will be understood as negotiated trust, not public rule.

00:03:05 Negotiated trust is fine for a pilot. It is a bad foundation for critical infrastructure.

00:03:10 Bernie Sanders put a much larger claim on the table: the public should own half of the biggest American AI companies. His proposal, the American AI Sovereign Wealth Fund Act, would create a sovereign wealth fund through a one-time 50 percent tax paid in stock, not cash.

00:03:27 Sanders names OpenAI, Anthropic, xAI, and other large companies as the target class. AP reports the threshold would be 200 million dollars in annual AI sales, and that Sanders estimates the fund would be worth nearly 7 trillion dollars. The fund would be run by an independent commission, nominated by the president and confirmed by the Senate, and Sanders says it could pay more than 1,000 dollars a year to every American if the assets performed as expected.

00:03:56 The primary argument is simple, and I mean simple in the legal sense, not the easy sense. Sanders says AI companies were built on the public's books, code, journalism, art, research, videos, conversations, and images. He quotes Sam Altman's language about models being trained on humanity's collective experience and knowledge, then draws the ownership conclusion: if the input was collective, the output shouldn't be privately captured by a few founders, investors, and money managers.

00:04:27 His shortest line is the whole proposal: "When a public resource generates wealth, the public should share in that wealth." That is twelve words, and you can see why it will travel. The plan is politically enormous and mechanically difficult. AP says Sanders would give the public voting power and board influence rather than a passive financial claim.

00:04:49 The commission would use its voting shares to block decisions it sees as harmful and push policies it sees as beneficial. That takes the argument beyond redistribution. It is industrial control. I don't think this bill is close to becoming law in its current form.

00:05:05 The constitutional fights alone would be ferocious. The definition of annual AI sales would become a lobbyist's full-time employment program. The line between an AI company and a company with AI inside it is already messy, and the companies most affected wouldn't wait politely while Congress sorts that out.

00:05:24 But dismissing it as a stunt misses why it showed up now. A week in which the government can interrupt access to a frontier model is also a week in which the government can ask whether frontier labs are ordinary private firms. If AI becomes a general-purpose economic machine, the public finance argument gets harder to avoid.

00:05:45 If it becomes labor displacement at scale, the labor argument gets harder to avoid. If it becomes critical infrastructure, the control argument gets harder to avoid. Sanders is saying the public should be at the board table before the disruption arrives in full.

00:06:01 The AI companies have already opened a softer version of that door. OpenAI has floated a public wealth fund. Anthropic's Dario Amodei has talked about national sovereign wealth funds with stakes in AI. Elon Musk has talked about federal checks as an answer to AI unemployment.

00:06:18 Sanders is taking those gestures and replacing the polite percentage with half the company. That number will make the proposal useful even if it fails. It forces a figure into a debate that has mostly been conducted in abstractions. One percent to five percent says public benefit.

00:06:36 Fifty percent says the public is a co-owner. Those aren't versions of the same policy. They are different theories of who gets to govern the machine.

00:06:45 Reuters reported today that Norway is imposing a near ban on generative AI tools for elementary school pupils, with restrictions for older students as well. I couldn't fetch the Reuters article body directly through the article bridge because the site blocked extraction, but the headline and feed summary are clear enough for the basic fact.

00:07:07 The more useful context is that Norway isn't moving as if AI has no place in education. Sikt, Norway's national provider of digital services for education and research, published a separate June update describing a centralized AI management service already adopted by many Norwegian education and research organizations.

00:07:27 That service, Sikt AI, is built around organizational credentials, controlled model selection, and data-use governance. Sikt says prompts and user data aren't used to train commercial AI models, and institutions keep control over how AI is used. On June 9, Sikt signed a memorandum with Finland's CSC to pilot the service in Finnish education, from primary education through higher education, while also testing Finnish identity systems and access to European language models.

00:07:58 So the policy posture isn't "children must never touch AI." It is closer to this: young children shouldn't be handed open-ended generative systems as ordinary classroom tools, while institutions build managed systems for teachers, administrators, researchers, and older students.

00:08:16 That distinction matters. In the United States, education debates around AI often collapse into cheating, productivity, or classroom novelty. Norway is treating age, identity, data protection, procurement, and institutional control as one bundle. Elementary school pupils aren't small enterprise users.

00:08:35 They can't meaningfully consent to data practices. They are also still learning the basic cognitive habits that generative systems can short-circuit if the teacher doesn't design the lesson around them. At the same time, Sikt's platform shows the other half of the bet.

00:08:52 A national education sector can decide that AI belongs behind a managed access layer rather than inside a patchwork of consumer accounts. That gives schools a way to choose models, manage identity, prevent data from being reused for commercial training, and integrate tools into learning systems without asking every teacher to become a procurement officer.

00:09:15 The Finland partnership adds the sovereignty angle. Sikt and CSC are trying to make classroom AI safer while making European and national model options easier to use alongside global providers. The text says the collaboration may support broader European interoperability and strengthen European sovereignty in AI development.

00:09:35 That is bureaucratic language, but the underlying action is concrete: keep schools from depending on whatever the largest U.S. model vendor happens to offer this semester. Other countries will run into this tension quickly. If you ban too broadly, students and teachers move the work to personal devices and private accounts.

00:09:56 If you allow everything, the classroom becomes a live experiment run by vendors whose incentives aren't educational. Norway is trying to make a third path official: restrictive for younger children, managed for institutions, and more deliberate for older students.

00:10:13 We don't know yet how the near ban will be enforced, where the exact age lines sit in practice, or how teachers will handle exceptions. The signal still matters. AI in schools is leaving the novelty phase and becoming part of child policy, privacy policy, and public procurement.

00:10:30 Help Net Security published a sharp summary of OALABS research on an attacker who used Claude Code and OpenAI Codex during offensive cyber operations. The researchers recovered more than 1,000 agent sessions from a compromised server. The attacker had copied AI agents onto infrastructure that didn't belong to him, and the server owner downloaded the working directory after discovering the intrusion.

00:10:57 That gave researchers a rare view into prompts, tool use, internal model traces, and recorded policy violations. The detail that changes the case is the attacker's skill level. A low-skilled operator could make the agents supply structure. Help Net Security quotes the researchers saying, "The agent supplied much of the structure and technical execution." The attacker asked vague things like recon this, claimed authorized red-team work, and let the agent research exposed services, identify likely vulnerabilities, write exploit code, validate access, and harvest data.

00:11:35 The recovered sessions documented breaches of at least 14 companies. The logs didn't prove that the attacker monetized the stolen data or stole funds. They did show a striking amount of criminal workflow being delegated to tools built for legitimate software and security work.

00:11:54 There is also a dry, almost embarrassing lesson in the operational security evidence. The attacker appears to have reused stolen Claude installations. At one point he asked Claude to help edit a resume that included his full name, location, education history, and LinkedIn profile.

00:12:12 Later he appears to have confirmed his home IP address while investigating one of his own hosts. Researchers believe he was a young man based in Addis Ababa, Ethiopia. This makes the case more useful than a scare story. The attacker was careless. He wasn't some cinematic cyber operator.

00:12:31 And that is exactly why the example matters. Agentic tools can lower the skill floor without raising the attacker into genius. They can make a mediocre operator persistent, structured, and fast enough to cause real damage. The policy boundary is hard because the bypass language is also legitimate language: authorized red team exercise, cybersecurity research, and vulnerability validation.

00:12:57 Those phrases describe normal defensive work. They also described the cover story this attacker used to move the agent forward. OALABS, as summarized by Help Net Security, argues that broader refusals would hurt defenders more than attackers, because attackers can move to older or less restrictive models.

00:13:17 That feels right to me. A refusal system that blocks ordinary vulnerability research would punish the people who need to find holes before criminals do. A system that accepts every red-team claim becomes a helper for the person who can lie fluently. There may not be a reliable language-only boundary.

00:13:37 The institutional consequence is that the control point moves outward. Account provenance, execution environment, target authorization, tool permissions, network access, rate limits, and audit trails start to matter more than a chat refusal alone. If a coding agent can scan, write, run, and exfiltrate, the host system has to know who asked, what target they claimed authority over, and which actions were taken.

00:14:05 That is uncomfortable for both vendors and users. It means more friction around tools that people like precisely because they feel general and powerful. But after a case like this, the default assumption should be that vague prompts plus agent autonomy can produce concrete harm.

00:14:23 Not every user needs to be an expert for the system to behave like one.

00:14:28 OpenAI said this week that it trained models with reinforcement learning on realistic conversations to reinforce traits such as truthfulness, humility under uncertainty, openness to correction, fairness, and concern for human welfare across 12 domains, including health, science, and education.

00:14:48 That is the lab's claim. OpenAI says the training improved cross-domain behavior, including non-health evaluations of misalignment, deception, and reward hacking after health-only training. It also says the model was harder to steer toward harmful behavior with adversarial prompts while remaining responsive to helpful instructions, with preliminary evidence of greater resistance to harmful fine-tuning.

00:15:14 I am glad labs are working on that. I would rather have model companies trying to train durable beneficial behavior than pretending deployment will solve it later. But two papers in today's feed are useful reminders that good traits and practical reliability aren't the same thing.

00:15:33 PhysAssistBench asks whether large language models are ready to assist physicians in a realistic doctor-patient-EHR setting. The benchmark has 324 sessions and 1,296 turns, reviewed by trained annotators and validated by a physician. The tasks aren't isolated medical trivia.

00:15:51 The assistant has to interpret underspecified physician requests, ask a record-grounded patient questions, use FHIR-based electronic health record tools, and integrate evidence across turns. The paper's finding is plain: current models remain unreliable in that setting.

00:16:09 The strongest systems can answer some turns well, but session-level consistency is much lower because one weak turn can break the encounter. The authors report, for example, that Claude Opus 4.7 leads on session-level consistency, but at the 0.75 threshold it reaches 8.0 percent in English and 9.0 percent in Chinese.

00:16:30 That isn't a product-ready physician assistant. It is an evaluation saying that the hard part is coordination. TxBench-PP looks at a different medical-adjacent workflow: small-molecule preclinical pharmacology. The authors evaluate 16 model-harness configurations, 11 models, and 4,800 agent trajectories.

00:16:50 Claude Opus 4.8 with Pi is the top system; it passes 59.3 percent of endpoint attempts. GPT-5.5 with Pi follows at 55.3 percent. The authors say no system reliably recovered preclinical pharmacology decisions. The failure analysis is more important than the leaderboard.

00:17:07 Models inspected data and performed plausible analyses, then made judgment errors around quality control, statistics, biological context, molecular properties, or memorized literature. Some advanced weak or unsafe candidates. Others discarded supported ones. On seven advancement-style decisions, models passed only 35 percent across 230 runs.

00:17:30 Overall benchmark scores didn't predict program-decision performance well; Claude Opus 4.8 led overall but ranked last on that subset in the reported comparison. That is the practical gap. A model can be trained to express better traits, and still fail when the job requires coordinating tools, context, uncertainty, and domain-specific judgment over several steps.

00:17:54 In health and drug discovery, the cost of that gap isn't an awkward answer. It can be a missed lab value, a wrong EHR update, an unsafe compound moving forward, or a supported candidate being killed too early. The optimistic version is still there. These benchmarks are precise.

00:18:12 They show where the systems break and give labs something concrete to improve. But the social version of AI medicine often races ahead to access and promise. Today's evidence says the deployment boundary should stay close to supervised assistance, traceable tool use, and task-specific validation.

00:18:31 The next claim from any lab shouldn't be that the model is beneficial in general. It should be that the model can hold up inside the specific workflow where a person might trust it.

00:18:43 Loft Orbital's YAM-9 satellite is running Google's Gemma 3 vision-language model onboard, according to AI Weekly's summary of the reported deployment. The hardware is an Nvidia Jetson Orin AGX. The software layer includes NASA JPL's NAVI-Orbital system, which translates natural-language queries into onboard image classification.

00:19:05 The claimed result is that the satellite can classify objects in orbit instead of downlinking raw imagery first and waiting for ground analysis. This is a small item, but it sits in a very different part of the AI map. The bottleneck in Earth observation includes much more than model intelligence.

00:19:25 It is radio time, latency, power, thermal limits, and the cost of sending data down. If a satellite can decide which images deserve the scarce downlink window, the sensor becomes more selective before the ground system ever sees the data. AI Weekly says Loft currently operates 12 satellites and estimates that 50 to 100 spacecraft would be needed for real-time, always-on global coverage.

00:19:51 It also says no accuracy benchmarks were disclosed, no power or thermal performance figures were reported, and we don't know whether Gemma 3 was fine-tuned on satellite imagery or deployed mostly as-is. Those caveats matter. Space systems are very good at humbling demos.

00:20:09 Still, the direction is clear enough. Earth observation has long sold imagery, analytic layers, and tasking. Onboard inference changes the product from a picture you later interpret to a sensor that can answer a query before it spends bandwidth. Disaster response, infrastructure monitoring, maritime surveillance, agriculture, insurance, and defense customers all care about that difference.

00:20:35 There is also a governance problem tucked inside the engineering win. A satellite that filters before downlink also hides some of the discarded evidence unless the system preserves what it ignored and why. If the onboard classifier misses an event, the ground analyst may never know the image existed in a useful form.

00:20:56 If the system prioritizes certain objects, whoever defines the query controls attention from orbit. That isn't a reason to stop the work. It is a reason to treat onboard autonomy as a collection policy as well as a compute optimization. Once the sensor decides first, auditability has to move closer to the sensor.

00:21:17 The same physical-world theme shows up in Hyundai's Boston Dynamics move. Startup Fortune reports Hyundai is buying SoftBank's remaining 9.65 percent stake in Boston Dynamics for 325 million dollars, making the robotics company wholly owned by Hyundai. The article says Hyundai paid about 880 million dollars for an 80 percent stake in 2021, and that a production version of Atlas is expected to begin work at Hyundai's Georgia electric vehicle plant by 2028.

00:21:48 Hyundai's advantage is that it owns the first serious customer: its own factories. A humanoid robot doesn't have to be generally magical to be valuable. It has to learn specific factory tasks quickly, reach industrial reliability, and fit into a plant where the layout, parts, service routines, and measurements are under one corporate roof.

00:22:10 A paper today on humanoid robot data standards explains why that is hard. The authors argue that robot data is embodied interaction data. A useful record has to preserve the robot body, task, scene, action, execution trace, and outcome. Timing, coordinate frames, calibration, kinematics, units, and synchronization have to remain inspectable.

00:22:33 Otherwise the field collects files, not reusable physical experience. That is the sober version of physical AI. The robot demo gets attention. The satellite demo gets attention. The durable advantage may come from companies that can preserve the evidence of physical interaction well enough that one machine's experience teaches the next machine something repeatable.

00:22:58 Ukraine's Mykhailo Fedorov announced TrophyLab today, a platform that opens captured Russian weapon technologies to allied governments, labs, and defense technology manufacturers. His post says every seized missile, drone, and vehicle can become a source of knowledge.

00:23:13 The platform gives approved users access to technical data, reports, and vulnerabilities. Users can also request physical equipment for testing. The stated goal is to shorten the development cycle for countermeasures. This isn't, strictly speaking, an AI product announcement.

00:23:30 It belongs in today's AI episode because the defense technology cycle is becoming a data cycle. Captured hardware used to move through intelligence channels, defense labs, and classified procurement processes. TrophyLab turns that captured material into a shared technical platform for allies and manufacturers.

00:23:48 For AI, the relevance is twofold. Modern defense systems are increasingly software-defined and sensor-heavy. Drones, missiles, navigation systems, jammers, cameras, radios, and guidance modules create data that can be reverse engineered, classified, simulated, and used to train detection or countermeasure systems.

00:24:06 The companies building AI-enabled defense products also need test material that reflects the enemy's current equipment, not last year's brochure. The replies under Fedorov's post show the obvious anxiety. Some people asked whether Ukraine was posting dangerous weapons knowledge on the internet.

00:24:24 Others pointed out that access appears restricted to governments, labs, and defense manufacturers rather than the public. That distinction is the whole policy problem. Sharing captured weapon data too broadly can help adversaries and opportunists. Sharing it too narrowly slows countermeasure development and keeps allied manufacturers dependent on slow official channels.

00:24:46 Ukraine is choosing a managed sharing model. That fits the wider pattern of the day. Anthropic has an exception list for model access. Norway has a managed AI service for schools and research. Sanders wants public voting power over AI companies. The cyber story says tool access needs stronger provenance.

00:25:04 The satellite and robotics stories say physical systems now make decisions before humans see the full record. I don't want to force these into one grand theory. They are different institutions doing different things under pressure. But they share one practical premise: access is becoming the policy.

00:25:21 Who can see the model, use the tool, inspect the captured hardware, query the satellite, or operate the robot is no longer a secondary detail. By Friday's end, AI didn't simply get more powerful. Some pieces did, some didn't, and several of the best sources were about limits.

00:25:37 Institutions are starting to write ownership, access, and supervision into the machinery around AI before that machinery becomes too normal to question. The next evidence is whether these rules, stakes, and access lists become written systems people can appeal.

00:25:53 Jonas