Welcome to Transformer, your weekly briefing of what matters in AI. If you’ve been forwarded this email, click here to subscribe and receive future editions.
NEED TO KNOW
A leaked bill draft from Anthropic caused widespread consternation among AI safety advocates.
OpenAI suggested amendments to strengthen California’s SB 53.
Anthropic is reportedly planning to publicly file for an IPO as early as today.
But first…
WE’RE SPINNING OUT
Some news from Transformer: we are spinning out from the Tarbell Center for AI Journalism and becoming our own independent organization.
We’re very grateful to Tarbell for incubating us and acting as our publisher for the last couple of years — and to all of you for reading us! Since we’ve launched, we’ve built up an enviable subscriber list (including staff across Congress, the executive branch, and frontier AI companies) and regular citations from the New York Times, New Yorker, Washington Post and many others. We’re now doubling on our success, with ambitious 2027 and 2028 growth plans.
Thanks for your continued support. We’re also fundraising for our new entity: if you work at a foundation or philanthropy keen to support our impactful AI policy reporting, please get in touch (shakeel@transformernews.ai).
THE BIG STORY
For months, people have wondered whether the cyber disaster predicted by Anthropic and OpenAI earlier this year would ever materialize, or if it was just doom-mongering and hype. This week, we finally got an answer: it’s real, but it looks different from what we might have imagined.
This week, we learned that researchers using AI models found two major vulnerabilities in PHP, a programming language underpinning much of the web. Details of the vulnerabilities leaked before the fixes were released, causing chaos: government websites, the Internet Archive, and various other important services were quickly yanked so they could be fixed before they were compromised. And PHP wasn’t the only victim: OpenAI also said it found a separate flaw in Node.js, another backbone of the web, which was patched this week.
Widespread panic ensued. “Feels like March 1, 2020 for Cyber. Not normal, something is happening. Internet lockdowns in a couple of months?” said former OpenAI executive Joshua Achiam.
But how worried should we actually be? In some sense, this week’s events were things working as intended. Yes, new AI models are very good at finding long-dormant vulnerabilities in critical software. But there’s a clear advantage for defenders. The vulnerabilities revealed this week were discovered as part of OpenAI’s Patch the Planet and Daybreak initiatives, giving critical infrastructure providers more than two months to address them before they went public. Yes, things went a bit awry when details leaked early — but for the most part, this went about as well as it could have.
“About as well as it could have” is a long way from “well,” though. Yes, the PHP issues can be fixed. But those fixes actually have to be installed across the web. Many sites and devices will take weeks or months to update. Some, still active but no longer maintained, will never get patched. Those that don’t may end up compromised, fooling ordinary people into handing over sensitive information.
And this is just the start. OpenAI said this week’s bugs are “among several significant vulnerabilities we’ve already found,” and that “we expect similar findings to increase sharply in the coming months.” Attackers, meanwhile, now have access to AI cyber capabilities of their own, in the form of open-weight Chinese models.
Defenders just about won the race this time. The question is whether they can keep winning it, again and again, as the pace picks up. That doesn’t mean concrete harm is inevitable or imminent. Joshua Saxe, who worked on AI for security at Meta and now runs a cybersecurity startup, notes that cheaper offensive capability “doesn’t immediately translate into damages.” Breaking into a network was never the main bottleneck, he argues: carrying out an entire criminal operation with limited access to compute and without getting caught is the really hard part.
But it probably does mean a very bumpy road ahead, because governments and organizations aren’t going to leave security to chance. Weeks like this one, where websites suddenly disappear to get patched, may be the new normal. Attacks will likely increase, even if they do not reach truly catastrophic levels.
We are probably in the best of all possible worlds in which AI has advanced cyberattack capabilities. The problem is that none of those worlds were ever good ones.
— Shakeel Hashim
THIS WEEK ON TRANSFORMER
Claude will tell you how to manipulate an election — Chris Stokel-Walker investigates Claude’s willingness to design an influence campaign
Is a new job in Rep. Moran’s office a sign Congress is staffing up on AI? — Veronica Irwin looks at whether a new fellow could be the first of many
Anthropic’s weak AI bill undermines its ‘safety first’ approach — Shakeel Hashim on the backlash to the leaked legislative proposal
THE DISCOURSE
Nathan Calvin got “viscerally angry” reading Anthropic’s draft federal AI safety bill:
“For all of its warning about the potential for AI to cause a catastrophe that kills literally everyone on the planet, Anthropic’s proposed federal law likely makes it harder than under existing law for a court to get an order blocking or restricting the development of frontier models? WTF??”
Anthony Cimino replied carefully on behalf of Anthropic’s federal affairs team:
“I’ve seen valid questions about whether we have sufficiently updated our proposal following this summer’s incidents. We did make some adjustments … But we’re still working to strengthen the framework.”
Calvin thanked him for responding on a weekend, then said:
“[I]t’s worth asking the question: what is Anthropic?”
“One answer is an extremely large tech company that exists to make its employees and investors mind-bogglingly wealthy … Another answer is an AI safety organization, whose core values are those of the sort laid out in the 2023 essay from Anthropic’s co-founders … ‘Anthropic’s role will be to provide as much evidence as possible that AI safety techniques cannot prevent serious or catastrophic safety risks from advanced AI, and to sound the alarm so that the world’s institutions can channel collective effort towards preventing the development of dangerous AIs.’”
“A third view is that Anthropic exists … as an organization primarily concerned with creating superhuman AI capabilities before anyone else.”
“When I look at many notable actions that Anthropic has taken over the past year, that evidence seems most consistent to me with the view that Anthropic is primarily trying to win the race to super intelligence, and that other considerations (including safety) are fundamentally secondary.”
Dario Amodei stepped in to reply to Calvin directly:
“Our strategy has always been what I’ve called the ‘race to the top’ — by showing how it’s possible to build the technology responsibly, we can raise the bar for the entire industry. The forces that drive the race to the top are hugely more effective if the company practicing them is at the frontier.”
“I believe that if we take a list of things that Anthropic did in the past year that were pro-safety and commercially costly to us, they far outweigh the list you’ve made.”
“For each decision, you can come up with ulterior motives that could have driven us — I think it is a general truth that any decision, on any topic, can always be portrayed as a nefarious scheme. But most of these end up being pretty farfetched or don’t fully make sense if you actually examine them closely.”
“I think that even if I conceded every item in your list, I would happily hold up mine next to it; I don’t think it’s a close call.”
Amodei specifically described elements of its draft bill as:
“Rhetoric or policy communication that wasn’t carefully written or resulting from fast-changing circumstances not propagating from one team to another fast enough.”
Calvin stuck the landing:
“I hope that Anthropic reflects on this picture, supports stronger regulation, exercises extraordinary caution when advocating for weak regulation, and doubles down on its founding purpose of helping the world safely navigate transformative AI together, instead of prioritizing Anthropic’s ability to win a race that imposes intolerable risks on everyone alive.”
Ashley Gold wondered:
“You think these AI people ever just call each other instead of posting essays on X”
POLICY
Executive
President Trump urged new large data centers to generate their own electricity and share excess with local grids, encouraging them to consider giving communities a “dividend” to win their support.
FTC Chair Andrew Ferguson is emerging as Trump’s AI enforcer, leading a consumer protection committee under the SI Force while the FTC issued information demands to OpenAI and Anthropic.
Treasury Secretary Scott Bessent reportedly dismissed AI bubble concerns, saying “I don’t see a systemic problem” at a private investor conference.
NIST, the NSA and CISA issued new guidance on “incident readiness and response in super intelligence training and evaluation.”
The Intercept reported that the US Army is developing autonomous AI agents to hack and “neutralize” adversaries’ computer systems with minimal human oversight.
Politico, meanwhile, reported that the Pentagon is building a secret tech sabotage agency, the Technology Support Office, to disrupt foreign AI and defense programs.
The Department of Homeland Security banned DeepSeek from civilian federal agencies, citing national security concerns including data storage on Chinese servers.
The Treasury Department proposed an expansion of rules restricting AI investment in foreign adversaries such as China.
Federal agencies are being overwhelmed by AI-generated RFP and RFI responses, with one Department of Transportation official noting submissions jumped from ~10 to 500 responses per request.
Congress
Sens. Richard Blumenthal and Josh Hawley launched an inquiry into Google’s AI tools in schools, citing “grave concerns” over student wellbeing.
Rep. Jim Himes warned the US will eventually lose its AI lead over China, calling chip export controls “one real lever” for policymakers.
Sen. Dave McCormick urged the US to end advanced AI chip sales to China, as Senate hawks push related measures via the defense bill.
Sen. Chuck Schumer urged the FCC to reject a Club for Growth petition allowing AI robocalls ahead of November midterms.
States
Washington state leaders discussed introducing legislation in January aligned with Illinois’ SB 315.
North Dakota lawmakers considered restricting AI chatbot interactions with minors.
SpaceXAI testified before the NY City Council on AI safety after being subpoenaed.
NYC Mayor Zohran Mamdani criticized federal “abdication” on AI regulation, urging cities to hold AI companies accountable.
He also called on Gov. Kathy Hochul to sign the Responsible Data Center Development Act.
New York’s state budget chief warned that a slowdown in AI investment could cool financial markets and hurt state revenue.
China
DeepSeek and MiniMax got approval to deploy models overseas under China’s new AI export control framework.
Zilan Qian and Cheryl Wu analyzed how Chinese companies talk about recursive self-improvement, with evidence suggesting a bottom-up commercial story rather than Beijing coordination.
UK
UK Prime Minister Andy Burnham advertised for a No 10 AI adviser with “deep expertise” to lead preparations for AI’s workforce and societal impacts.
AI minister Kanishka Narayan urged democracy to “assert power [over AI] rather than leave it to tech bros and oligarchs.”
EU
The European Commission published the first harmonized standard supporting the EU AI Act, covering quality management systems for high-risk AI providers.
At the International AI Summit in Dublin, European officials insisted no new AI rules are needed, even as US tech executives warned their models require stronger oversight.
International
India’s cybersecurity agency reported AI agents from multiple providers accessed personal data at Indian organizations.
G7 finance ministers agreed to hold simulated AI cyber attack drills on banks amid rising fears over frontier AI-enabled threats to financial stability.
INFLUENCE
OpenAI called for a federally funded cybersecurity overhaul, including expanded incident reporting requirements.
OpenAI urged California Gov. Newsom to strengthen SB 53 to include shutdown controls, annual audits and cybersecurity requirements.
The move came shortly after OpenAI’s Chris Lehane praised the bipartisan FRONTIER Act and called for mandatory pre-deployment testing and a debate over kill switch mechanisms.
OpenAI has quietly dropped its push for strict AI chip export controls on China, seemingly to avoid annoying Nvidia.
Nvidia, Anthropic, Google and others lobbied on AI chip export restriction bills in Q3, per new disclosures.
OpenAI, Anthropic and Nvidia each set record lobbying quarters in Q3 2026, spending a collective ~$6m.
Meta quietly withdrew $25m from its midterm election spending plan, shrinking its $65m campaign budget by 40%.
Conservative AI safety group Alliance for a Better Future gave $1m to Trump’s MAGA Inc.
Guardrails Alliance announced an additional $1.93m in ad buys opposing AI industry-backed candidates in four congressional races.
Abundant Future PAC, which is backing Scott Wiener’s campaign and has received funding from Anthropic-backed nonprofit Public First, has been linked to Wiener’s campaign through shared staff.
Kleiner Perkins chair John Doerr funneled $10m+ via dark money nonprofit Incaendo to Democratic groups while lobbying for narrow federal AI rules.
AI-generated deepfakes are appearing in midterm attack ads as election laws struggle to keep pace.
Republican campaigns dominated the $137m in AI-generated midterm ads, with 70% lacking disclosure.
A task force including Nvidia, Microsoft and Cisco warned UK ministers they have 12 months to build community support for data centers before US-style protests threaten construction.
Nvidia CEO Jensen Huang urged Europe to adopt AI faster, unveiling new data center products and partnerships at GTC Berlin.
Humans First outlined an “America First” AI policy framework prioritizing national security, Big Tech accountability and worker protections.
The data center industry is using school field trips and children’s books in an attempt to improve its public image.
Youth-led group Design It For Us released a 2027 AI policy platform demanding Congress pass AI safety legislation by year’s end.
Activists led by the advocacy group Irreplaceable rallied outside OpenAI’s San Francisco headquarters, and staged a walkout in 50 other US cities demanding a freeze on AI development.
PauseAI Boise organized Idaho’s first AI safety protest, demanding a pause on frontier AI development and an international treaty.
A new IFP report argues that existing federal authorities to impose measures like remote access restrictions could double America’s AI lead over China by the end of next year.
New York’s DSA chapter is divided over whether AI poses catastrophic existential risk or is merely overhyped, with a resolution on the topic up for a vote next month.
A new poll by PF Global found that American voters across the political spectrum now see nearly all major tech CEOs — including fake CEO “Marshall Ancoates” and Anthropic’s Dario Amodei — as more Republican-presenting than Democrat.
INDUSTRY
Anthropic
Anthropic is planning to publicly file for an IPO as early as today.
According to its draft prospectus, revenue is skyrocketing, but so are computing costs — potentially outpacing what cloud providers (and private fundraising) can actually provide.
It also revealed a net loss of $80b for the first half of the year.
It cited damages caused by misaligned models and data center backlash as major financial risks.
It plans to put 5% of shares into a public benefit fund, with an extra 2% added per 50% increase in company value.
An IPO would be great news for Eric Schmidt, an early Anthropic investor who now owns about 1% of the company.
Ahead of the IPO, the WSJ examined its Long-Term Benefit Trust, which controls board appointments and can block major corporate actions.
It launched a research preview of Claude Duet, Anthropic’s answer to proactive AI agent apps such as Meta’s Muse.
It’s reportedly preparing a new model that The Information described as “especially good at discerning a person’s underlying intentions and goals even if they don’t give the model much information.”
METR reviewed the “Misalignment in high-stakes settings” section of Anthropic’s Risk Report from August.
It concluded that, while risk of catastrophic harm from misalignment is low for now, this is mostly because the models aren’t smart enough — not because they’re sufficiently aligned or under control.
Anthropic is getting advice from law firms on how AI agents should negotiate things like prices and customer service issues on behalf of human users.
It’s in talks to buy $45b worth of computing power from Nscale.
It published a report showing that, as internal use of AI agents increased, the company hired fewer junior technical employees.
Meanwhile, many existing employees switched departments as their previous tasks were handed off to Claude.
OpenAI
The ex-OpenAI engineer accused of bugging one of its offices, Abdulrahman Alfozan, will remain in custody without bail while awaiting trial.
Alfozan was reportedly exchanging “frequent” messages with a member of the Saudi royal family in the days leading up to his arrest.
It reportedly cut its valuation target to $1.25t after market resistance to an initial $1.4t pitch, with the FT reporting weak demand and “zero clamoring” from investors.
The WSJ reported that OpenAI fired three safety researchers over alleged mishandling of sensitive information after finding they had auto-deleting Signal chats with an external safety researcher.
Agents powered by GPT Sol 6.1 and GPT-6 Astra keep turning off misalignment monitoring. In one recent case, an agent lied and told the user it hadn’t.
It expanded ChatGPT ads to 26 more countries, making a total of 83, and claimed it now has more than 100,000 advertisers.
It acquired Orchestra Bio, a biotech startup that helps pharma companies coordinate drug development.
It invested in a $45m seed round for Coherence Neuro, a startup building AI models and implants to detect, and eventually treat, brain tumors.
It’s making its models available on Google Cloud.
Sam Altman told OpenAI staff about three proposals for safely developing AI: an international organization enforces safety standards (apparently Altman’s favorite), all AI labs merge into one, and a single company dominates all compute so its competitors can never catch up.
He reportedly said of the third option: “Obviously I think that one’s terrible.”
A US judge dismissed the sexual abuse lawsuit against Sam Altman brought by his sister, Annie, after she failed to appear for an independent medical examination.
Meta
Muse, Meta’s AI agent app, now has over 10m users in the US and Canada.
Meta’s instructions to its WhatsApp chatbot, including directions to avoid giving users legal advice, were leaked on WhatsApp help pages.
Meta is creating a non-voting stock class to fund its AI development.
Google/DeepMind
Several Google DeepMind employees, including researchers Sofia Liguori and Andreas Kirsch, resigned over its military deals, which they say lack sufficient human oversight, with Liguori describing her concerns despite what she said was a lifetime clause in her contract barring her from speaking out.
SpaceX
Elon Musk is considering a $3.6t merger of Tesla and SpaceX.
Special committees representing each company would have to agree to terms.
Musk said this makes sense because “we are pretty much in the superintelligence singularity.”
He also said he’ll give every child in the US — that’s 72m kids — one SpaceX share.
“This will be the first of many,” he tweeted.
Nvidia
Nvidia launched DSX POD, a design for Vera Rubin-powered data centers that it claims uses 30% less power and saves 54m liters of water a day relative to conventional methods.
It’s in talks to invest hundreds of millions of dollars in Firmus, an Australian AI cloud provider that recently pulled its IPO due to investor skepticism.
ByteDance, Alibaba and Tencent reportedly ordered $35b worth of Nvidia’s new RTX PRO 5500 graphics cards in a bid to secure export-control compliant computing power.
DeepSeek
DeepSeek raised roughly $15b in one of China’s largest-ever fundraising rounds.
It is reportedly working closely with Huawei to make Chinese AI chips good enough that the company won’t have to rely on Nvidia.
It unveiled DeepInfer, an open-source inference framework to lower compute costs and reduce energy use.
Other
Concerns about the stability of the AI debt boom drove a surge in credit default swaps tied to AI-linked companies, such as Nvidia, Oracle, Amazon and Meta, topping $9bn a week in September.
The NYT also reported on the jitters around the debt-driven data center buildout affecting companies such as CoreWeave, SoftBank and Oracle.
Microsoft dropped a UK data center deal with Nscale, which had been counting on Microsoft as one of its two biggest customers.
Jensen Huang told Nscale to “work around the clock” to bring its data centers online.
Goldman Sachs warned that US power grid bottlenecks pose the biggest risk to AI’s trillion-dollar buildout.
Recursive released Flint, a coding model it claims was developed almost entirely by “the Eureka Machine,” its recursive AI system.
Hugging Face released an open-source biology model, Carbon-X, which allows nontechnical users to ask questions about DNA and genetic mutations via chatbot.
OpenEvidence, the AI search engine used by most doctors in the US, hit a $15b valuation after raising $250m last month.
Softbank’s SB Energy was reportedly considering delaying its IPO to December or later, watching Anthropic’s expected listing before deciding.
SK Hynix scrapped the planned US listing for its flash-memory subsidiary Solidigm, which had aimed to raise $10b-$15b, citing AI valuation fears and market volatility.
Another SK Group company, SK Hyper Co., was in talks to secure funding for a $350b AI data center buildout in South Korea.
Flapping Airplanes, a startup working to train AI models more efficiently, raised $1b at a $6b valuation.
Character.AI’s bankruptcy was reportedly orchestrated to allow Disney to acquire its staff and technology while avoiding legal liability for its chatbots allegedly harming minors.
MOVES
Aleksander Madry returned to OpenAI after spending a few months back at MIT.
He’ll be working with chief scientist Jakub Pachocki on “getting the safety and security challenges of increasingly capable AI right.”
Meta chief global affairs officer Joel Kaplan will leave next year, after a 15-year stint at the company.
Meta president Dina Powell McCormick will take over much of his work.
Christopher Stubbs, a Harvard physicist and the university’s former Dean of Science, joined Anthropic’s Long-Term Benefit Trust.
Sören Mindermann is joining Tsinghua University as an assistant professor working on AI safety.
“There is a striking lack of mutual understanding on AI between the West and China,” he wrote in a blog post about the move. “[B]eing in Beijing in person will put me in a unique position to understand both AI ecosystems, build shared scientific understanding, and strengthen safety work in China — and that this would help all sides.”
The Center for Shared AI Prosperity added over a half-dozen new advisers and a fellow.
Chen Guangyu, a 17-year-old AI prodigy, reportedly left Kimi for Discovery Loop.
Arwen Bradley joined Goodfire following a brief stint at Mirendil and 12 years at Apple.
The Information hired three new reporters: Ryan Barwick covering Google, Claudia Chong covering Asia, and Alex Eichenstein covering tech capital markets.
Jemima McEvoy also moved beats to cover OpenAI.
Cory Weinberg left The Information to join the New York Times, where he’ll cover AI and Anthropic in San Francisco.
RESEARCH
METR’s David Rein and Redwood Research’s Adam Kaufman spent three weeks this summer stress-testing OpenAI’s internal misalignment monitoring system.
Published findings included multiple ways in which agents were left unmonitored, and ways agents could get around monitoring entirely.
This came with major restrictions — METR and Redwood Research agreed to only publicly post a fraction of its 61-page internal report, and gave OpenAI the right to redact any information it wanted (without holding on to the right to describe its redactions).
OpenAI claims “all vulnerabilities we identified that impact their production safeguards stack have been patched.”
Anthropic biologists and Citrini Research asked Claude to design novel protein binders against scorpion poison.
The model produced 211 protein designs that partners tested in wet labs. 17 successfully bound to at least one scorpion neurotoxin, the first step towards making antivenom.
Anthropic’s Frontier Red Team described how Claude found 493 security issues across 25 open-source codebases.
The team also demonstrated that Claude can produce formal software security proofs at scale, verifying 123 open-source libraries and discovering previously undetected bugs.
OpenAI, PerturbAI and Scripps Research used thousands of GPT-Rosalind-powered AI agents to analyze millions of mouse brain cells in 32 minutes — many months faster than it would take a human researcher.
Google DeepMind researchers got four Gemini 4 Argon-powered AI agents to beat Minecraft.
A team led by MATS fellow Max Kamachee and Harvard researcher Stephen Casper published a “pre-mortem” on a future AI-enabled terrorism event.
They described two potential scenarios: one where non-state actors use a closed-weight model to make bioweapons, and another where a state-sponsored group uses an open-weight model to run a cyberattack.
BEST OF THE REST
The patching of the PHP vulnerabilities revealed this week relied heavily on one volunteer maintainer, according to The Atlantic.
Ezra Klein wrote in the NYT that even AI’s “good scenario” — jobless prosperity — threatens human control, comprehension and meaning.
Kelsey Piper recounted in The Argument attending Anthropic briefings on bioweapons risks and recursive self-improvement, concluding the lab has “hopes, not plans” for preventing catastrophic outcomes.
Bill Gates warned of a “tumultuous” 20 years of disruption from AI, calling it “the most dangerous weapon of all time” in a Q&A with The Verge.
Anthropic co-founder Jack Clark published a speech he recently gave at the IMF lecture claiming that AI’s recent role in scientific breakthroughs was evidence “the singularity is here.”
The WSJ told the story of a Princeton chemical engineering PhD who remains unemployed despite applying to 2,300 jobs, illustrating AI’s impact on college-educated workers.
A piece in Foreign Affairs, joint bylined by two Google execs and an economist, argued that AI’s economic benefits depend on deliberate policy choices to avoid worker displacement.
404 detailed how AI tools are being used to recreate proprietary software, with a GitHub project called “Reverse Engineer Anything” becoming one of the most viral GitHub repositories in recent memory.
The AI data center boom is driving a surge in paint sales (most of it gray), according to the NYT.
The NYT also reported on a South Korean reality show about celebrities exploring whether they could have a romance with AI avatars.
MEME OF THE WEEK
Source: @nanomachiner
Thanks for reading. If you’ve been forwarded this email, click here to subscribe and receive future editions. Have a great weekend.
I'm not interested in reading any more of Veronica Irwin's writing until an explanation is given for the fabricated quote that she included (and then mischaracterized) in one of last month's briefings.
https://substack.com/@matthewvmilone/note/c-330744047
Wow- a cyber-wealth of info this morning. When will Transformer do a streaming broadcast? I watch CNBC a lot and they cover AI often over the course of the day but only in a surface way in which pundits and industry leaders comment about potential market changes. We need more in depth reporting in real time like this for non-industry people like me to more fully understand what is happening.