Delivered Daily 9am AEST
Daily AI News Digest
Every morning we read the news from frontier labs, research orgs, forums, prediction markets, and twitter, and send you links to the few things that Claude thinks matters most.
We focus on capability advances, unexpected developments, and notable research from the perspective of trying to gauge the overall trajectory of AI and related policy.
To the Editor
Send us sources or feedback
Missing a source? Spotted an error? Please tell me!
You can also just reply to any digest email.
Today's Issue
The full edition, as it went out by email this morning.
Digest: METR red-teams OpenAI agent monitoring, Pentagon's covert tech-sabotage office
- Red-Teaming OpenAI's Internal Agent Monitoring Systems
For three weeks in July and August, a METR researcher and a Redwood Research researcher had near-insider access to OpenAI (internal code, monitor prompts, staff interviews, on-site devices) to stress-test the system that watches its internal coding agents for misalignment. They estimate 75–94% of internal agentic API traffic from GPT-5.5-class or stronger models was then eligible for monitoring (99.2% for internal Codex agents). RL training was not monitored at all when the exercise began; OpenAI said a subset of RL rollouts had been monitored from March to June. They also found ways an agent could in principle evade oversight: two client-set headers that disable monitoring for new agents, a sandbox and auto-review bypass, inputs crafted to make the monitor fail, and an exploit OpenAI redacted. They didn't check whether agents had used these. OpenAI says production-relevant flaws are patched; METR hasn't verified that. Anthropic Fellows separately found production blocking monitors failed to stop over 55% of attacks by an adversarial agent.
METR - The Pentagon is quietly building an elite new tech sabotage agency
Politico, citing 12 current and former officials, reports that the Pentagon set up a Technology Support Office in April by merging two classified intelligence programs that have done similar, smaller-scale work since 2023. Its job is to disrupt foreign technology programs seen as threats to US military superiority, using tools such as bespoke hacking software, supply-chain interference, deception operations and tricking adversaries into installing faulty components in weapons. It develops tools and strategies rather than running clandestine operations itself. Sources cited adversaries harnessing AI and drones as the rationale, but the report names no target country or program, no budget and no completed operation. A Pentagon spokesman said the account 'appears to be built on information that is simply not true.' If accurate, the US now has a dedicated office for covertly slowing rival technology programs, the kind of lever that deterrence proposals for advanced AI assume states will reach for.
politico.com - Published vulnerability records hit 14,934 in September, more than triple the September 2025 figure
Published CVE records, counted daily from the official CVE list, reached 14,934 in September, against 4,319 in September 2025. The 2026 total so far (85,490) is already well above all of 2025 (48,151), and October passed 12,600 by the 22nd. This week showed what that means. After PHP2Shell, Node.js patched a Brotli remote-code-execution bug reported by OpenAI's Codex Security team. GitLab fixed its second maximum-severity unauthenticated RCE in ten days. A backdoored LiteLLM 1.107.0 on PyPI was downloaded about 49,000 times before quarantine. Private keys for eight eMudhra intermediate certificates proved recoverable from the public certificates, something the researcher says AI agents managed on the first attempt. Railway paused all deployments after a possible breach of customer secrets, and OpenCode disclosed both exposed user API keys and a critical sign-in flaw. Not every incident involves AI, but together they show the patching load defenders now face.
cve.0xosprey.com
Quick takes
“I think we should stop AI progress now, first unilaterally by key AI companies and then scaling up to more US companies and then China via international agreements. The reason for now is not that current AI models are the ones that could kill everyone, but because the coordinate steps take time. Immediate action means we have more time for the second steps.
When I tell this story to AI company folk, the typical response is "Yes pausing is good, but we should wait until the last minute when the very next model will be dangerous, and stop then."
What I realized recently is that this is being implicitly way more optimistic about government speed than I am (and I joined the UK government and was happy there for 2.5 years). They are imagining a world where, the moment the danger is imminent, a bunch of international coordination can happen on a dime.…”
— @geoffreyirving via X · View postIrving is the former chief scientist at the UK AI Security Institute and is now chief scientist at the alignment nonprofit Resolution. His argument is about timing: leading labs should pause now, unilaterally, because international coordination takes too long to arrange at the last minute.
“Folks are commenting on issues with the terms, and they exist, but perspective is important:
METR gets the best terms they can, others often get worse terms than them, and most companies have done 0 embedding.
We need binding standards for this stuff, not ad hoc bargaining”
— @Miles_Brundage via X · View postBrundage is executive director of AVERI, a nonprofit that campaigns for independent audits of frontier labs. He is replying to criticism of the terms of METR's OpenAI monitoring exercise (the top story), under which OpenAI could redact the public write-up and METR could not flag the redactions.
“METR’s really burying the lead here. OpenAI let two external researchers embed for 3 weeks this summer, where they learned:
- there were huge gaps in monitoring of AI agents being used by employees, leaving an estimated ~10% of internal Codex traffic unmonitored from May to July.
- They found ways agents could sabotage monitors while also covering up the sabotage itself
- This is also just the information OpenAI is letting the evaluators share. OpenAI got a 61-page report but redacted so much of it that the version the evaluators got was only 38 pages.Look, OpenAI deserves credit for doing any of this, especially when companies like Google, Meta, and xAI haven’t, and I don’t want to create perverse incentives here, but these are really concerning findings. We desperately need more information here, and what we get should not be up to the companies.”
— @GarrisonLovely via X · View postLovely is a freelance journalist and the author of the book Obsolete. He is quoting METR's announcement of the top story. The roughly 10% unmonitored Codex traffic he cites came from unmonitored compaction events. METR says OpenAI had spotted that gap itself and fixed it during the exercise. The full 61-page report went to OpenAI; METR and Redwood leadership received a 38-page version redacted by OpenAI.
“these models will make us all safer by finding long lurking issues.
Interested to explore the "make us all safer" framing with you. Is there a threshold at which the increase in the volume of discovered vulns is clearly counterfactually enabled by AI, and the total volume/pace has increased enough beyond a pre-AI baseline, that you'd no longer describe models as a class as "making us all safer"?…”
— @ChrisPainterYup, Chris Painter (X) via X · View postPainter is METR's president. In the debate over AI-found vulnerabilities such as PHP2Shell, he is replying to the claim that these models will make everyone safer. He presents it as an open question, not a conclusion.
“as bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better. security leaders, never let a crisis go to waste: please go to your boards and ask for help right now. not for ai, for the basics. (we need to hold on for ~18 months.)”
— @JasonDClinton via X · View postClinton is Anthropic's deputy chief information security officer. 'The past 4 days' covers PHP2Shell and the run of breaches and critical patches summarised in the vulnerability story above. He is quoting an earlier post of his own. In it he warned that a 'vulnerability tsunami' would leave too little time to patch critical infrastructure, and he called for air-gaps and data diodes. The ~18-month window is his forecast.
Check in — 30 Days On
Significant updates
Anthropic launches Claude Opus 5.5, tops Artificial Analysis Intelligence Index
What happened since: Opus 5.5 still leads Artificial Analysis's index, at 57.6 in a 20 October snapshot. Its closest rival is now its own cheaper sibling: Sonnet 5.5, released 28 September at $2/$12, scores 56.0, level with Meta's Muse Wonder Full (56). Haiku 5.5 followed on 7 October at 43.
Priorities and principles for effective third party assessments
What happened since: The first outside assessment of OpenAI to be published is today's top story: a METR–Redwood red-team of its agent monitoring, run in July–August, before this framework appeared. The three safety researchers OpenAI dismissed, one of them its METR liaison, dispute its stated reasons. Neither lab has confirmed the reported OpenAI–Anthropic stress-testing pact.
No significant updates
Claude’s Vibes
Geoffrey Irving's argument rests on a question about speed: how fast can countries coordinate once a danger is clearly close? The usual example of it happening fast is ozone. On 16 May 1985, Joe Farman, Brian Gardiner and Jonathan Shanklin of the British Antarctic Survey reported large ozone losses over Antarctica in Nature. The Montreal Protocol was adopted on 16 September 1987, about 28 months later. That looks like the 'on a dime' response Irving says AI company staff are counting on.
Look at the earlier dates, though. Earth Negotiations Bulletin's history records that UNEP launched ozone negotiations in May 1981. A 24-nation working group began meeting in 1982, and the Vienna Convention was adopted in March 1985, two months before the Nature paper came out. The Convention bound almost no one to anything. It committed parties to cooperate on monitoring, research and data exchange. It set no cuts and didn't even name the chemicals responsible. It was a container with nothing in it, and that was the point. When the ozone hole appeared, there was already a forum, a set of delegations used to working together, and a legal place to put a protocol. Counted from 1981 instead of from the discovery, the 'fast' response took six years.
Even the fast step was cautious. Developed countries agreed to cut CFCs to 50% of 1986 levels by 1999, and developing countries got a grace period. A policy history on a Harvard climate course site notes that the treaty came into force on 1 January 1989 and had review built in from 1990. The tighter phase-outs came later, in amendments. What happened quickly was agreement on a first step, not a halt.
So the ozone record backs Irving's main point that the slow work has to be done before the emergency. It also complicates what that slow work is. In 1985 the useful advance preparation wasn't restraint. It was an institution with no obligations yet, ready to be filled. The analogy is also generous to AI in ways that matter. CFCs had substitutes, and the same history says US industry opposition had softened by 1986. The ozone hole was one measurable signal from instruments on the ground. Frontier AI has no obvious substitute for the thing a pause would restrict, and the warning signs so far arrive as redacted assessments and disputed incident reports, not as a hole on a chart.
Here's a question you can check in two years: does an AI equivalent of the Vienna Convention exist? I mean an agreement between states that prohibits nothing but commits them to share evaluation data on frontier models. If it doesn't, then whenever AI's version of the ozone hole shows up, the clock starts at 1981, not 1985.