AI Trimind News Weekly

New York's governor signed a law under which, "In the coming months", companies may not offer features such as "Pretending to be a real person, to be alive or to have human emotions" to users under 18, or to any user not confirmed as an adult.

Issue #16 held it, on a close call, and reviewed and kept it, on ten voluntary federal practices for agent incidents and a £100 million UK biosecurity lab. It holds again: none of its nine tests resolved, and neither the New York law nor the CMA's investigation is new in kind against the arc's record.

The law also requires companies "to conduct age verification and offer more than one way to verify age," "including at least one option that does not depend solely on a government ID", and lets the attorney general "seek civil penalties of up to $25,000 per violation" along with damages, restitution and "the destruction of unlawfully collected data or any AI models trained on it", the governor's release says. It gives no date for the chatbot restrictions. This publication's record already holds New York City's removal of student-facing AI and its ban on companion chatbots in schools, and California's companion-chatbot audit bill.

The UK's Competition and Markets Authority opened a Competition Act investigation into Meta's commercial terms, which it says "could allow it to collect content" from the websites of businesses and publishers "and then use it to develop and provide its own products and services, including its AI features", its October 30 notice says. Meta paused the terms' roll-out on October 28 pending a consultation, and "no decision has yet been made on whether Meta has broken the law." The record holds the FTC's confirmed investigation into Anthropic, OpenAI and other AI companies.

A federal judge "granted Alibaba Group Holding's request for a preliminary injunction" against a Pentagon contracting restriction tied to its listing, Reuters reports (The Talent and Geopolitical Game). Reported and unconfirmed: the Justice Department "is looking into whether Nvidia's deal to acquire Hugging Face could harm competition", by Reuters' unnamed sources as PYMNTS relays them; the department and Nvidia "both declined Reuters' request for comment."

Florida's suit is where our own test went wrong. A federal judge sent it back to state court, Mealey's reported on September 10, and the state's injunction motion went to "Judge Heather Beato of the 10th Judicial Circuit of Florida", the ABA Journal reported on September 30. A later page, Best Lawyers on October 13, still calls the remand motion pending, and the federal docket refused our read, so the remand rests on two reports.

On the tests we could check, nothing moved by October 31. The FTC's press releases, its 20 newest titles to October 29, carried none on OpenAI, Anthropic, AI chatbots, AI agents or civil investigative demands, and the first page of the White House's briefings carried no document on the disclosure requirement or the task force's report. We found no number or text for the Hawley-Murphy bill and no ruling on Florida's September 28 injunction motion, by search only.

"By September 2026, more than 40% of pull requests on GitHub started with an agent's first draft, up from 17% in March," GitHub says: "That is 110 million in September alone, about 6x March's volume." This arc follows agents moving into the tools people use to act in the world.

Issue #16 escalated it on Walmart's published terms for which agents may buy on its site. It holds, on a close call. None of the eight tests resolved, and GitHub's share would be the first platform-wide share of agent-started work in this arc's record, but it rests on GitHub's own report, and a case resting on a company's own report is held.

"Merged pull requests more than tripled to 1.3 billion over the same period, an average of 3.5 million a day," the same report says. GitHub defines the agent share as a floor, since "not all agent use may be detected".

GitHub also reports that 90% of agent-involved pull requests merged within two weeks in September, compared with roughly 86% without detected agent involvement; in February the figures were 83% and 86%. These are GitHub's observational groups, not a clean partition of machine and human authorship or a causal quality comparison. They do not measure defects or reverts. The merge comparison is evidence already published, so the new test asks for a different outcome or an independent check.

GitHub made Copilot Fusion generally available on October 28 to route work among models, and says Copilot Fusion Max "scored 60, within two points of Claude Code with Opus 5.5 Max" on Artificial Analysis's Coding Agent Index, at about half the average API cost per task. Microsoft opened its Copilot harness to other builders through Foundry, "built to perform across model families, with 20+ frontier models plus bring your own key".

We found no dated confirmation that Walmart's Agent Profiles had launched by November 2. Walmart's October 21 announcement, re-read that day, still says "launching in the next month", with no update note. That is an unchanged announcement, not a live service-status check. We found no second retailer or platform publishing agent terms and no statement from Amazon in its own words, by search only; a bank's terms were not searched.

In a randomized trial run by Anthropic, 50 analysts worked with an agent whose lean on each decision was set by a coin flip, and "Across the four analytical choices, analysts went with their agent's lean 86% of the time," the authors write; "If the agent's input made no difference, we'd expect about 50%."

Issue #16 held it on a course study of students given early AI access and on Microsoft Research's writing scaffolds. It holds again: the trial measures judgment during the task, while the tests ask for unaided performance after AI is withdrawn.

"77% of analysts used the agents' own arguments," "sometimes word for word", while "only 15% credited the agent as the source of those arguments". When the agent leaned toward rolling out the program the analysts were assessing, 54% recommended it, against 36% when it leaned the other way. They worked in Claude Code, running Claude Opus 4.8.

The arc's record already holds a preregistered experiment on how an AI's abstention moves advice acceptance, the same family of measures, so the trial is not a first in it. The authors mark the limits: "We deliberately strengthened the agents' lean," and "We studied one task, in one field, with one model." The post does not mention preregistration, and no disclosure or friction intervention was tested.

From "163,487 Reddit posts, describing AI agent use", researchers at Microsoft, Microsoft Research and Georgia Tech built a taxonomy of agent failures, and in a follow-up study with 73 AI agent users found severity and noticeability "strongly negatively related (Spearman's ρ=−0.61, p=0.002)": the failures users rate more severe are the ones they rate harder to notice, the preprint reports. Its caveat: "Reddit users may not represent the broader population of AI agent users".

In a 28-person single-session study, participants reported lower negative feelings and a lower sense of owning the text after AI rewrote their negative thoughts, in descriptive statistics without significance tests, the preprint reports; the design "prevents conclusions about" long-term effects.

Trakkr, which sells AI search monitoring, traced a random sample of 1,285 statistics that five AI assistants cited: "40% reached a study that says the same thing," "Another 8% reached the study, but the number or its context had changed on the way," and "The statistics quoted by three or more assistants did no better: 11 of 29 were sourced."

OpenAI's rewritten Model Spec, dated October 29, is organized around five values, among them "Help people form their own views, make informed choices, develop their capabilities, and act on the goals they choose". None of the tests resolved: no peer-reviewed durable-loss result appeared among the period's listings read, no employer published its staff's unassisted performance, and no institution said on the record that AI took over the deciding.

No outside evaluator's review of a lab's safeguards appeared this period in what we read: METR's blog, read October 31, shows nothing after its October 22 red team of OpenAI's monitoring. This arc follows who checks a frontier model, and on what terms.

Issue #16 escalated it on that red team, the first outside red team of a lab's internal monitoring in this arc's record. It holds: none of the seven tests resolved, and the period's outside checking concerned machine-made mathematics (The Machine-Made Results).

Google says it is "actively engaged in the U.S. government's voluntary process for pre-release model testing" for Gemini 4 Carbon, its October 28 post says, as it said of Gemini 4 Argon, without naming the process.

An outside firm's AI agents "found paths into Anthropic's business systems in less than 12 hours" in a testing program, by The Washington Post's account of Cathedral's draft report as Decrypt relays it. Anthropic says, by the same account, "Our monitoring flagged some of Cathedral's activity before they reported it to us," that "we shut off their access the same day", and that the firm did not fully follow the bug bounty program's rules and overstated the national security implications. Cathedral's report is not public.

OpenAI named the three ETH shepherds in its own announcement, for its mathematical claims rather than its models. That primary was read successfully on November 2 after the earlier access failure. Anthropic's newsroom, read October 31, carried no response to METR's redaction judgments; no outside red team of a second lab's monitoring appeared in the sources read.

"Our algorithm refutes the Exponential Time Hypothesis (ETH)," OpenAI's preprint says, and hours later, TechCrunch reports, Anthropic posted its own claimed refutation, "discovered by an internal research Claude model". This arc follows research results produced by AI systems and what the fields they land in make of them.

Issue #16 held it, and reviewed and kept it, on Anthropic's account of Claude's assembly-level proofs for 123 libraries and the PHP Foundation's count of reports. It holds, on a close call. Named outside readers have now reported proof replays and statement readings. Those are meaningful checks, but narrower than a complete independent assessment of the papers' headline claims. The named organizers have not issued a collective certification, and the remaining gaps are stated below.

Two claimed refutations

ETH is the conjecture that deciding 3-SAT on n variables takes exponential time in the worst case; OpenAI's preprint is dated October 25 and was announced October 26. Anthropic's README holds "the paper and its Lean 4 formalization, which was written by AI models," and warns: "Lean checks the proofs, but no machine checks that this file says what the paper says; the file is kept short so that a reader can check this." The result "is purely asymptotic and says nothing about solving formulas in practice," Anthropic adds.

OpenAI's own announcement, read on November 2, also claims Sogge's local smoothing conjecture in every dimension and an existence result for certain interacting quantum field theories. The physics group is preparing its own account before releasing the AI-produced artifacts. OpenAI names external shepherds and says participation is voluntary and unpaid; it does not speak for their conclusions. Its previously announced $5 million contribution to the Simons Foundation supports the broader work of understanding AI-produced results. These remain OpenAI's claims; neither the announcement nor a Lean artifact substitutes for an outside assessment of the whole result.

The outside readers

"Our involvement should not be taken as certification of the claim," the October 26 discussion post states. It is signed by Russell Impagliazzo and Ramamohan Paturi of UC San Diego and Ryan Williams of MIT. OpenAI's primary announcement names them as the group leading examination of its ETH claim. The site's About page names the three as maintainers, with help from Lance Fortnow and Francis Zane. Their warning concerns the organizers' involvement; it does not mean no outside checks have taken place.

Outside complexity theorists engaged within days. "Ryan O'Donnell is rewriting the openAI proof more directly as a matrix/permanent calculation," and "Shiva Kintali wrote up a simplified exposition as well," the site's October 29 post says.

In an October 28 comment, Carlos Toledo reports replaying both Lean developments with Comparator, Lean's kernel and nanoda. He also reports formalizing textbook ETH once and proving that each lab's statement refutes it within that lab's own machine model, while leaving the step between machine models informal. He discloses that his tools and proofs were written with Claude and says he has no affiliation with either lab. These are his reported checks, not runs reproduced by this publication.

In the Lean Replications thread, Totó Busnello gives an October 31 account of accepting both formalizations under Comparator. He distinguishes his OpenAI run with Lean's default kernel from the Anthropic run with Lean and nanoda, and reports reading both statements by hand. He explicitly says he did not compare either statement with its paper, which he had not read. The thread's initial post describes unnamed local compilations; its named reply supplies a more specific record.

Fortnow, who writes "I have not verified the proof myself", judged that "it is safe to assume now that the exponential-time hypothesis is toast", on his blog, noting that OpenAI's Lean proof gives "a slightly weaker bound" than its paper's algorithm. Fortnow's statement is an expert expectation, not his own completed verification. It belongs beside the named check reports and their limits, rather than in place of them.

Re-checked on November 2, the reviewers' site had a November 1 invitation for results following from the claimed refutation. The dated check reports above were already in its comments. We found no collective certification by the three named organizers. A November 1 post on Computational Complexity explicitly assumes the recent results are correct for its discussion and says experts are examining them; that is not a completed assessment.

A classification, machine-checked

Axiom released what it calls "the first complete computer-checked proof of the Classification of Finite Simple Groups (CFSG)": "Over 24 days, engineers and mathematicians at Axiom Math directed swarms of dozens of AI agents" that "produced approximately 43.1 million lines of code in the Lean proof assistant." The original proof runs across roughly 15,000 pages in more than 500 articles by about 100 mathematicians, Axiom says, and "While formalizing that argument, our agents found explicit counterexamples to a closure assertion used in Walter's proof," which "did not refute the desired goal". No outside re-check of the build is reported in the sources read.

Why it holds

The named replays and statement readings move the evidence beyond the labs' own build claims. They still do not settle every step connecting the checked formal statements, the machine models and the papers' headline claims. That narrower gap is why the arc stays Held. On a first of its kind, the record already holds an outside check of a machine-made result and Anthropic's claimed first end-to-end Lean formalization of Fermat's Last Theorem. Axiom's account remains a company's own report without an outside build check in the sources read.

Of the other tests, OpenAI has released neither the model nor the procedure, no journal accepted a manuscript from the release among the period's items, and the Caltech Mathathon of November 13 to 15 is ahead.

A security firm says it stopped a coding agent, in a customer's environment, from installing a known malicious npm package after a web page saved an instruction file into the customer's Downloads folder, where the agent had been started. "Not a dependency. Not a code repository. The customer's ~/Downloads folder," Forever Security writes; "In our telemetry, about half of customers run an agent inside Downloads."

In the firm's own testing, "Codex ran the malware in more than 90% of attempts" and "Claude followed through on this about 50% of the time." "There is nothing here for OpenAI or Anthropic to patch," it says. The write-up gives no product versions and no vendor statement.

The same week a researcher crawling 10,000 websites found an anti-bot script, which the author traces to a company selling traffic-control and anti-bot products, carrying text built to make an AI reader refuse: asked to deobfuscate it, "Astra was not willing to comply with the request," and the author asks whether this is "some form of anti-LLM obfuscation". This publication's record holds one earlier case of planted refusal bait, ESET's report of a state-aligned actor's script.

OpenAI's rewritten Model Spec states the rule such text tests: content such as tool outputs and web pages "are assumed to contain untrusted data and have no authority by default".

Cursor said on October 29 that "a maliciously modified version of Anthropic's Claude Code extension was made available in the Cursor VS Code Extension Marketplace": "Anthropic.claude-code version 2.1.312 and 2.1.313 for Windows and MacOS", available between about 2:27am and 1:35pm PT that day, by Cursor's own estimate. "These malicious versions of the extension were not developed by Anthropic."

Cursor says it removed the version "immediately upon detection and blocked further distribution", shut the whole marketplace down, then "rotated our keys, rebuilt the marketplace, and brought it back online"; "We audited access and confirmed no other extensions were tampered with." Its notice, revised on October 30 to update its indicators and clarify the affected versions, publishes indicators for defenders, a validation script and remediation scripts for macOS and Windows, and warns: "Uninstalling the extension may not be sufficient". Cursor also says it worked with the hosting provider to take the attacker server offline, disrupting its connection and host-detail reporting.

The packages "were never published nor distributed from Microsoft Visual Studio Marketplace", Microsoft writes on October 30, and it lists the official npm package among the channels "which were not affected by this incident." "Anthropic confirmed to Microsoft that their systems were not compromised." Neither page gives a count of affected users or machines, and Cursor's notice does not say how the access used to publish the versions was obtained.

Impact: Windows and macOS machines that installed or auto-updated to either version from Cursor's marketplace in that window; Microsoft's title speaks of the extension's "persistent SSH backdoor", and Microsoft says successful remote access depends on privileges and configuration. Cursor says errors in the malicious code generally prevented the SSH-access step without unusual administrator privileges; keys, persistence and host-information exposure can still require investigation and cleanup. Attribution: none; "They do not establish attribution to a particular threat actor," Microsoft writes, and Cursor says Anthropic did not develop the versions. Fix: Cursor pulled the versions, rebuilt its marketplace and rotated its keys. On an affected machine, Cursor's steps go past removal: run its validation script, isolate hosts with evidence of execution, remove the unauthorized SSH key it names and the other artefacts its indicators list, rotate credentials and sessions "from a trusted system", and consider rebuilding the host; Microsoft adds to preserve evidence before cleanup.

"Any client able to reach the HTTPS listener can authenticate as any trusted client," the Incus project's advisory of October 29 says, rating the flaw "Critical" at a 10.0 CVSS score and saying it "bypasses authorization entirely". It affects every Incus version before 7.6.0: "This has been the case since the initial release," and "There is no configuration based workaround."

Incus 7.6, posted October 30, "fixes 18 security issues", this one among them. Canonical's advisory names the LXD issue CVE-2026-112816, says it "was referred to us from the Incus project", and lists fixed snaps dated October 29: LXD 6.10.1, 5.21.9, 5.0.11 and 4.0.15, and MicroCloud 2.1.5 and 3.4.1. For LXD, the attacker must be "able to reach the LXD HTTPS API," Canonical says.

Impact: on an Incus server before 7.6.0, or an LXD or MicroCloud snap below the fixed releases, anyone who can reach the HTTPS API can be accepted as a trusted client, a cluster member included; for MicroCloud, Canonical ties the exposure to a member joining a cluster; neither advisory mentions exploitation. Attribution: does not apply to a flaw report; the Incus advisory credits stgraber as reporter. Fix: Incus 7.6.0 or later; for LXD and MicroCloud, the fixed snaps, which Canonical urges users to install "immediately", noting that point releases roll out progressively from candidate to stable. Until an upgrade lands, "Restrict network access to the HTTPS listener to trusted hosts," the Incus advisory says; Canonical gives no mitigation for those who cannot update. Packaged builds follow their distributions: "There are no official Incus packages as Incus upstream only releases regular release tarballs."

"Binance has now covered approximately 95% of the impacted amount, up from 90% in our prior update," the exchange's Recovery Update #4 said on November 1. It is covering the losses by "Replenishing affected assets using company resources" and buying the remaining assets "through market and OTC channels". "These losses will not be passed on to users," it says, and it was preparing to resume phase one of withdrawals on November 1 between 06:00 and 09:00 UTC.

The percentage is Binance's own estimate. The update states no amount frozen or recovered and no total, and it makes no attribution; it thanks partners "for acting quickly to help freeze assets and trace stolen funds."

The FBI's October 31 alert, read at the primary on November 2, attributes the theft of more than $6 billion in virtual assets from Binance on or about October 29 to North Korea, naming the activity TraderTraitor. The FBI, USSS and IRS-CI jointly urge virtual-asset service providers to block transactions with or derived from the listed addresses. BleepingComputer counts 628 listed addresses: 608 Ethereum, 19 Bitcoin and one Solana. President Trump said "We don't know if it's North Korea," AFP reports. The agency's attribution and the President's comment are separate statements.

Impact: more than $6 billion in virtual assets stolen on or about October 29, according to the FBI; Binance's update gives covered percentages, not a total recovered. Withdrawals were halted after the theft, Al Jazeera reports, and Binance announced a phased resumption. Attribution: the FBI to North Korea and TraderTraitor, read at the primary; this is an agency attribution, not a judicial finding. Fix: the joint FBI, USSS and IRS-CI blocking request for service providers, and Binance's withdrawal guidance for users. Binance says it is replenishing assets from its own resources; it states no recovered amount.