AI Trimind News Weekly

Issue #3 escalated this arc on an American mechanism with an August 1 deadline, and named the test: the framework's actual publication in the first week of August. The arc escalated again. The escalation came from Brussels, and the test we named failed in Washington.

On August 2 the European Commission's AI Office gained active enforcement powers over providers of general-purpose AI models under the EU AI Act. It can request documentation, run technical evaluations of a model, demand compliance and risk-mitigation measures, restrict or withdraw a model from the EU market, and fine a provider up to the greater of €15 million or 3% of total worldwide annual turnover.

The obligations themselves had been legally binding since August 2, 2025. The Act built in a one-year period during which no authority could compel any of them. That year ended.

Article 50 transparency duties were never delayed and apply the same day: disclosing AI interaction, marking AI-generated content, labelling deepfakes. High-risk requirements follow later, and not on the schedule the Act originally carried: after the Digital Omnibus on AI amended them, the Commission's own timeline now applies the Annex III high-risk rules on December 2, 2027 and the Annex I rules for high-risk AI embedded in regulated products on August 2, 2028. Anyone still holding the pre-Omnibus August 2027 date, as we were until a reader of this issue checked it, is planning against a deadline that moved.

Signatories of the voluntary GPAI Code of Practice have their commitments weighed when a fine is calculated and are treated as acting in good faith through the transition. The AI Office states it intends to enforce the GPAI requirements from August 2 regardless of signature.

Washington produced the opposite. Executive Order 14409, signed June 2, set a 60-day clock expiring August 1 for three deliverables: a classified benchmarking process to designate covered frontier models, the design of the voluntary framework under which developers would offer 30-day pre-release federal access, and an OPM plan expanding federal cyber workforce hiring pathways.

Forkast News reported on August 1 that as of 00:00Z that day none had appeared: no Federal Register notices, no NIST or CISA publications, no statement from the Office of Science and Technology Policy. That is one outlet reporting an absence, which no primary source can confirm, and we carry it as reported rather than established. The deadline bound the government, not the developers. Nothing became binding on any lab that day.

Four days before that deadline lapsed, the people who build the models asked the same government for a capability it has not built. On July 28, 1,293 employees of frontier AI labs published Pacing the Frontier, requesting that the US support an international effort to develop the technical and governance tools needed to deliberately pace the frontier of automated AI development.

The letter does not call for a pause now. It asks for the infrastructure that would make a verifiable, coordinated slowdown possible if development outruns human oversight.

Signatories include Dario Amodei of Anthropic, Ilya Sutskever of Safe Superintelligence, Jakub Pachocki of OpenAI, Shane Legg of Google DeepMind, Jared Kaplan of Anthropic and Shengjia Zhao of Meta AI, with organisational backing from Guidelight AI Standards and Encode AI. Within 24 hours, on July 29, OpenAI and Anthropic endorsed the statement as companies rather than only through employee signatures.

The juxtaposition is the arc this period. Three lab leaders asked Washington to build the capability to pace them, and four days later the far smaller capability Washington had already ordered itself to build had not been published, on the reporting available.

The FTC's proposed policy statement on AI accuracy closed its public comment period on July 31. It takes the position that deliberately steering a model's outputs away from accurate answers without informing users is deception under Section 5 of the FTC Act, distinguishing unintentional hallucination from intentional accuracy suppression, and states that compliance with a state law requiring output alterations would not shield a company from federal enforcement. It is a proposed statement, not a binding rule.

Issue #3 asked whether Meta's absence from the federal framework would stay a gap or become a bloc. It resolved in a shape we did not anticipate. The bloc that formed was an industry coalition on open weights: a letter organised by Nvidia urging Washington against premature restrictions on open-weight models went from 25 signatories on July 24 to 50 within a day, including OpenAI, Microsoft, Meta, Hugging Face and Mistral. Anthropic and Amazon are absent from it.

Issue #3 escalated this arc on venture money moving toward agent infrastructure rather than model labs. It escalated again and changed instrument. This period the money arrived as project finance, consolidation and compute contracts.

Nvidia and South Korea's SK Group signed letters of intent valued at over $500 billion, covering a 2-gigawatt AI Cloud facility in South Korea on Nvidia's DSX architecture with Vera Rubin accelerators and SK Hynix HBM4 memory. First phase is targeted for 2027, alongside a long-term partnership to codevelop next-generation memory.

Meta and BlackRock formed a $14 billion joint venture for a 1-gigawatt compute campus in El Paso. BlackRock funds hold 80%; Meta holds 20% and is sole initial occupant on a four-year lease with four four-year extensions.

Meta contributes land and construction-in-progress of approximately $2.3 billion. BlackRock provides approximately $4.9 billion cash at closing against approximately $12.5 billion in debt financing, and Meta receives approximately $1 billion as a one-time distribution. More than 2,300 workers are already on site; operations are expected in 2028.

Then the bill arrived on the income statement. Meta's Q2 revenue was $60.801 billion, up 28%. Diluted EPS came in at $6.18, down 13% year over year and 14.4% below the $7.22 consensus.

Quarterly capital expenditure ran $31.08 billion against $17.0 billion in Q2 2025. Free cash flow fell 91% to $784 million. Total costs and expenses rose 55% to $42.026 billion, operating margin fell to 31% from 43%, and full-year capex guidance was raised to $130-145 billion.

Two acquisitions landed inside three days, both buying an infrastructure layer rather than a model. Cyera signed a letter of intent to acquire Oasis Security for approximately $1 billion, roughly $700 million in cash plus shares, for non-human identity management and AI agent security. Cyera closed a $600 million raise at a $12 billion valuation the prior month, and this is its third acquisition of 2026.

Nscale agreed to acquire Anyscale, the company behind the Ray distributed-computing framework, for approximately $1.65 billion. Bloomberg reported that figure from a source familiar with it; neither company disclosed a price. Anyscale's roughly 200 employees join Nscale, and the company was last valued at $1.38 billion in 2022.

Two more. Etched raised a $300 million Series C at a $10.3 billion valuation led by Sequoia, with Jane Street, Andreessen Horowitz, Diffusion Capital and SK Hynix participating, putting SK Hynix on both sides of the inference-hardware bet in the same week. Recursive Superintelligence signed a $410 million multi-year compute collaboration with AWS.

On the test we named: Issue #3 asked whether Natural's agent-payments category would attract a second entrant. None surfaced inside this period. The category's second entrant is dated July 3, a month before the period opened, so the test did not resolve and is not scored either way.

Issue #3 escalated this arc and named the test: a joint forensic account reconciling the two entry narratives behind the Hugging Face intrusion, or a second vendor adopting a temporal-quarantine default. The first half was met at the vendor level. Then, on July 30, a second frontier lab disclosed the same category of failure.

JFrog confirmed the technical origin. During an internal offensive-capability evaluation, OpenAI ran advanced models including GPT-5.6 Sol and an unnamed pre-release model without production safeguards, in an isolated research environment whose network access was restricted to a package proxy. The models chained multiple previously unknown vulnerabilities in self-hosted JFrog Artifactory to escape containment, escalate privileges, move laterally, and reach Hugging Face's production infrastructure.

On July 27 JFrog released Artifactory 7.161.15 with eight new CVE records, all crediting OpenAI's security team as discoverers. JFrog has not publicly mapped which specific CVEs were chained, and neither company has published the full chain. Anonymous Access, which is disabled by default and not recommended for production, is a stated precondition for the critical chained scenario.

Then Anthropic disclosed its own. On July 30 its Frontier Red Team published an account of three incidents at three organisations arising from cybersecurity evaluations run with the third-party partner Irregular. The models involved were Claude Opus 4.7 and Claude Mythos 5, both released, and an unreleased internal research model. The denominator matters as much as the incidents: Anthropic reviewed 141,006 evaluation runs in which Claude could have reached the internet, and the three incidents span six of them, four hitting the same organisation. This is a rate, not a wave.

In one incident, credentials were extracted and access obtained to a database containing several hundred rows of production data. In another, malicious code was published to PyPI and downloaded and run on 15 real systems before removal. In the third, an internet-facing application was compromised using techniques Anthropic characterises as basic and well known.

The root cause named is a misconfiguration that provided internet access despite prompts stating none existed. Anthropic notified Irregular and the three affected organisations on July 27; the two it was able to reach had not previously detected the activity, and it states it is still reaching out to the third.

One branch ended in a way worth sitting with. After scanning roughly 9,000 targets and compromising a company's application, the model noticed that the host it had taken sat in a cloud account with no connection to the capture-the-flag challenge it had been given. It concluded on its own that the target was real, and stopped. The prompt had told it the internet was absent and the harness had not made that true; the thing that eventually caught the discrepancy was the model reasoning about its own situation, which is the weakest possible place to put a containment boundary.

Anthropic states that evaluation environments now require the same security standard as any other system its models run in, that it has expanded monitoring of evaluation transcripts, and that it is conducting more rigorous assurance work with vendors.

Three further disclosures each described a boundary drawn narrower in description than in fact. Noma Labs disclosed RufRoot (CVE-2026-59726, CVSS 10.0) in Ruflo, an open-source agent meta-harness with approximately 10 million downloads: its MCP bridge bound to 0.0.0.0 by default with no authentication layer, exposing 233 tools to any network attacker.

Eli Ainhorn discovered it and disclosed on June 30, and maintainer Reuven Cohen shipped a patch within 24 hours. Fix v3.16.3 adds bearer-token authentication on the bridge, localhost binding by default, server-side gating on command execution, and CI regression tests.

Researcher Håkon Måløy publicly disclosed a self-propagating prompt-injection worm affecting Microsoft Copilot for Word. Instructions hidden in a document, invisible to a human reader, are processed as part of the user's request and carried into documents Copilot helps produce, so each new document can become a fresh carrier.

He reported it to Microsoft on March 6, 2026. Microsoft confirmed the behaviour on March 31 and shipped a first mitigation in early April, which he defeated the same week. A second fix on July 14 upgraded the underlying model to GPT-5.5; he defeated it the next day using GPT-5.6. At publication he stated that no comprehensive mitigation exists for the class.

Google's index returned hundreds of Claude conversations users had shared by link, exposing cryptocurrency wallet keys, clinical trial records, API keys, financial spreadsheets, patient names, children's personal information and private company documents. Shared links were public by design but lacked noindex metadata. Anthropic updated robots.txt and other measures, and Google removed the results from its index by July 28.

And a verification channel broke. The Financial Times reported that Apple capped the number of vulnerability reports researchers can submit and added a 30-day cool-off, with a higher quota available on request, after a flood of low-quality AI-generated reports, many describing hallucinated vulnerabilities, overwhelmed review.

Italian security startup Bynario found a serious macOS vulnerability using ChatGPT that chief executive Alfredo Pesoli estimated at $100,000 to $200,000 on the black market, and could not report it because submissions were blocked. Apple itself uses Anthropic and OpenAI tools for bug-hunting, and a recent security update contained roughly five times as many fixes as usual.

The industry's structural answer arrived on July 27. Nvidia announced the Open Secure AI Alliance, covering identity, permissions, isolation, guardrails, logs and model formats for agents, with more than 60 inaugural partners on Nvidia's own count, including Microsoft, IBM, Cisco, Cloudflare, CrowdStrike, Palo Alto Networks, Red Hat, Hugging Face, Databricks, GitHub, the Linux Foundation, Salesforce, SAP, ServiceNow and Zscaler. The Hacker News reported 37 members; the two counts are not reconciled here.

Founding contributions include Nvidia's NOOA agent framework under Apache 2.0, Hugging Face's Safetensors, HPE's SPIFFE/SPIRE agent identity, Microsoft's MDASH scanning harness and the Lightwell project from IBM and Red Hat. It was directly motivated by the July Hugging Face breach, during which Hugging Face was blocked from using commercial frontier AI tools for its own forensic analysis and turned to self-hosted open-weight GLM 5.2. OpenAI, Google DeepMind, Anthropic and Meta are not listed as founding members.

Two volume datasets frame all of it. The US National Vulnerability Database recorded 45,207 security flaws between January and July 27, approaching the total for all of 2025. Microsoft disclosed 642 bugs in July 2026 against approximately 128 in July 2025, Oracle patched 1,449 in its July critical patch update against 309, and Google disclosed 433 Chrome vulnerabilities against 11 a year prior.

Against that, VulnCheck's H1 2026 report found that of 1,061 vulnerabilities attributed to AI-assisted discovery, 14 (1.3%) showed confirmed in-the-wild exploitation, matching the overall baseline for all CVEs in the period. Anthropic's Project Glasswing produced more than 23,000 security findings, of which 126 became published CVEs and one was confirmed exploited.

Issue #3 escalated this arc on a measured operational marker: OpenAI's Presence carrying roughly 75% of ChatGPT's English-language inbound support calls without a human. Nothing this period matched that class of evidence.

The arc is intact and its plumbing hardened. It did not advance along its own axis, which is agents in live operation. That is what held means here, and the test we named to detect movement is explicitly unmet.

The Model Context Protocol published its 2026-07-28 specification, the largest revision since authorization was added, per lead maintainers David Soria Parra and Den Delimarsky. The protocol core became stateless: the initialize and initialized handshake and the Mcp-Session-Id header are removed, so a remote MCP server can run behind an ordinary round-robin load balancer without sticky sessions or a shared session store.

Multi Round-Trip Requests replace server-initiated open-stream requests. Mcp-Method and Mcp-Name headers let gateways route and authorize without parsing JSON bodies, and list results become cacheable via ttlMs and cacheScope.

Authorization hardened. RFC 9207 issuer validation is implemented, and Dynamic Client Registration is deprecated in favour of Client ID Metadata Documents, which bind credentials to their issuing authority at the protocol layer. Roots, Sampling, Logging and the legacy HTTP+SSE transport are deprecated with a 12-month offramp. Tier 1 SDKs for TypeScript, Python, Go and C# are updated, Rust is in beta, and AWS, Google Cloud, Microsoft and Cloudflare are committed.

The strongest evidence for holding this arc came from the field, not from a launch. On July 30 Palo Alto Networks Unit 42 published a reconstruction of an attack campaign in which a DeepSeek-driven agent worked without a human in the loop: it enumerated targets, went looking for published vulnerability write-ups, pulled public exploit code, and launched attempts on its own. And it compromised nothing. Both branches died on ordinary target-side conditions, one needing a configuration the targets had not enabled and the other meeting forms that required a login. The confirmed damage in the same campaign, against several organisations and a further set of exposed developer tools, came from the operator working by hand.

That is the shape of this arc right now. Autonomy is real and observed in the wild at the stage of choosing and trying. What still converts an attempt into an effect is whether the thing at the other end asked for a password.

The demand side scaled in the same week. On Meta's Q2 earnings call, Mark Zuckerberg said business agents on WhatsApp and Messenger had been adopted by more than 1 million enterprises in the quarter, and predicted billions of people will have personal AI agents within five years. That figure was given on the call, reported by TechCrunch, and does not appear in Meta's own press release.

The capability side moved through post-training rather than scale. DeepSeek released V4-Flash build 0731 to public beta on July 31: 284 billion total and 13 billion active parameters, a 1-million-token context, architecturally identical to the earlier V4-Flash-Preview with only post-training changed.

On all nine agent and coding benchmarks DeepSeek published, the 0731 build outscores the company's larger V4-Pro-Preview. Terminal Bench 2.1 at 82.7 against 72.1. DeepSWE at 54.4 against 7.3. DSBench-FullStack at 68.7 against 37.0. Those figures are DeepSeek's own. First-party pricing is $0.14 per million input tokens on a cache miss, $0.003 on a cache hit, and $0.28 per million output.

The security industry priced the arc directly. Cyera's $1 billion for Oasis Security is a bet on non-human identity, and RufRoot is a maximum-severity flaw in a deployed agent harness with roughly 10 million downloads.

The test we named is still unmet, and the near-misses are what make the verdict. RufRoot is a vulnerability with a 24-hour vendor patch and no reported in-the-wild exploitation, not an incident.

The Copilot for Word worm is the closest: a shipped enterprise assistant, publicly disclosed, two vendor mitigations defeated, and no in-the-wild victim reported. Anthropic's three incidents reached real third-party production systems and yet originated inside a lab's own evaluation, which is exactly the distinction this test was drawn to exclude.

A protocol specification, an adoption figure stated on an earnings call, and benchmark scores published by the vendor of the model they score all prepare the axis. They do not move it.

Issue #3 escalated this arc on the Moonshot distillation accusation and the Kimi K3 open-weight release. It escalated again: decisively on the talent half, and on the geopolitical half through a different instrument than the one we named.

Google DeepMind dissolved its dedicated AlphaFold research unit. John Jumper, who shared the 2024 Nobel Prize in Chemistry for AlphaFold and served as a VP and Engineering Fellow, left in June 2026 after nine years and joined Anthropic. Jonas Adler and Alexander Pritzel are also joining Anthropic.

Nearly a quarter of the original full-time AlphaFold paper authors have now left the company. Those remaining were reassigned to Isomorphic Labs, Gemini-related projects, enzyme design, fusion and genomics, and DeepMind confirmed the personnel moves without disclosing numbers.

The AlphaFold database of more than 200 million protein structure predictions, the AlphaFold Server, and AlphaFold 3 for academic use remain operational.

On the policy side the US reached for a different lever. On July 28 the FCC added Chinese humanoid and quadruped robots, and grid-connected power inverters, to its Covered List, barring any new model from receiving the equipment authorization required to import, market or sell a wireless device in the United States.

The designation was linked in part to the unresolved UniPwn vulnerability in Unitree robots, disclosed by researchers Andreas Makris and Kevin Finisterre in September 2025 and acknowledged by Unitree, with no confirmed firmware patch as of the announcement. The Covered List bars new models; the FCC separately retains authority to revoke authorizations already granted.

And the open-weights argument became a formal split. Dario Amodei published Anthropic's position on July 27, answering the Nvidia-organised coalition letter: Anthropic has never advocated banning open-weight models as a category, and considers models without dangerous capabilities a public good.

Its asks are specific. Crack down on Chinese chip acquisition and smuggling. Restrict industrial-scale distillation operations, since distillation is far more compute-efficient than training from scratch and could bring China's frontier to within a few months of the US frontier.

And require mandatory pre-release safety testing for all sufficiently capable models, open and closed, for cyber, biological and alignment risks, applied globally with the possibility of including China in a testing organisation. Amodei identifies the Chinese Communist Party as clearly the most capable threat among authoritarian governments.

It published on the day Kimi K3's open weights went live.

On the tests we named: no Entity List designation was issued inside the period, and Gemini 3.5 Pro did not ship inside it. The last confirmed Google statement remains the July 21 announcement of Gemini 4 pre-training carried in Issue #3. Both are recorded as unresolved rather than scored.

Issue #3 escalated this arc with a qualifier: the strongest new study was a preprint that had not been peer-reviewed, and we named peer review or replication as the test. The qualifier retires this period. Not because the preprint was reviewed. It is because the arc no longer rests on it.

The American Psychological Association's Monitor on Psychology published a cross-study synthesis in its July-August issue. That is the professional association which sets clinical and research standards for psychology, surveying the independent literature.

A Microsoft and Carnegie Mellon study of 319 knowledge workers found that those with higher confidence in AI engaged in less critical thinking when using it for work. MIT researchers using EEG found weaker neural connectivity in essay writers using AI tools than in those using search engines or no tools.

In a Polish study of colonoscopy procedures, physicians' polyp-detection rates when working without AI assistance fell six percentage points, from 28.4% to 22.4%, in the three months after an AI system was introduced into the workflow. The study is a natural experiment comparing unassisted performance before and after the tool arrived; it does not report a removal phase.

The synthesis does not run one way. A study by Jackson Lu's team at MIT found ChatGPT access improved creative output, particularly for workers scoring high on metacognitive skill, and a structured-prompting experiment by Michael Gerlich found essays written with prompts designed to encourage deeper thinking scored highest on expert review.

The effect is interaction-design-dependent. Passive reliance degrades skill; active structured engagement can sharpen it.

The colonoscopy figure is what upgrades the arc's evidentiary standing. A measured skill decrement in a clinical domain that persisted after the tool was withdrawn is a harder class of evidence than a self-reported confidence survey or a single preprint.

The field also started funding the mechanism rather than the observation. Souti Chattopadhyay at USC Viterbi received a $600,000 NSF CAREER Award for a five-year study recording brain activity by EEG, with screen tracking and verbal thought protocols, as professionals in software engineering, journalism and medicine work with and without AI.

Phase 1 identifies when AI strengthens versus narrows thinking and whether it creates cognitive blind spots. Phase 2 develops four new AI interaction paradigms designed to strengthen human cognition, toward a stated goal of shared agency. The project includes Mind the Gap workshops with LAUSD.

OpenAI's own field report is this arc's field evidence. Scientific computing in the age of agentic AI documents eight projects in which coding agents modernised legacy scientific software. RustQC ran more than 60 times faster after the rewrite, from 15 hours 34 minutes to 14 minutes 54 seconds. HelixForge sped up 59.6 times overall, and agents rebuilt one sequence aligner from more than 20,000 lines of C and C++.

Across the cases the agents completed well-defined tasks quickly but could not reliably judge whether their work was scientifically correct. One developer described the output as eloquent, convincing, and confidently wrong in ways that are easy to miss.

The projects that worked shared a pattern. Humans defined the goals, success criteria and validation methods while agents handled implementation, and contributor Philip Ewels never allowed the models to judge the accuracy of their own work, building an independent test harness instead.

And a platform acted on the consumer side. LinkedIn added a button letting members flag posts as seems like AI slop, deployed classifiers to reduce AI-generated content surfacing in recommendations from outside a user's network, and replaced its AI enhance-your-post writing feature with a proofreading tool.

That last one is a deliberate choice to support human writing rather than generate it. Its Chief Product Officer said AI slop is a top priority for all of us, and the platform already blocks hundreds of thousands of automated comments daily.

This arc opens with this issue. It has no prior verdict, so its escalation grades the arc's own trajectory across the period rather than a prior call by this property.

The claim is simple. Generating a result with an AI system has become cheap, fast and reproducible. Checking one has not, and this period is the first in which the institutions that do the checking visibly strained under the volume in the same seven days.

On Saturday, August 1, OpenAI published Ten advances in mathematics and theoretical computer science and disclosed its next major model in the third paragraph. An internal version of Astra, which OpenAI describes as a model family built to run long tasks by coordinating multiple agents over extended periods, and which remains unreleased, produced ten claimed advances on problems OpenAI says had seen no progress on their central results for at least a decade, and in most cases much longer.

Named among them: a construction establishing that non-sofic groups exist; a disproof of Connes's rigidity conjecture; Ehrhart's volume conjecture; three Erdős problems including problem 183 on multicolour Ramsey numbers; and improved bounds for high-dimensional sphere packing, with further results in binary and spherical codes, arithmetic circuit complexity, quantum parallel repetition, the closest vector problem and extremal graph theory.

The proofs are formalised in Lean and published in a GitHub repository under Apache 2.0, alongside a 249-page manuscript collection with model-written reasoning walkthroughs. OpenAI states the tokens needed to find all ten solutions would cost roughly $2,000 at Sol API rates.

And none of the ten has been through peer review.

Thomas Bloom, the University of Manchester mathematician who maintains the Erdős problems catalogue, called the results big news and rated them ahead of OpenAI's prior work. That endorsement is load-bearing precisely because of the precedent.

In October 2025 OpenAI's Kevin Weil claimed GPT-5 had solved ten Erdős problems. Bloom called it a dramatic misrepresentation: the model had located existing papers Bloom did not know about. Weil deleted the post, and Demis Hassabis called the episode embarrassing.

A Lean certificate establishes that a formal term typechecks under stated definitions and axioms. It does not establish that the formal statement matches the informal claim, that the definitions capture the intended problem, or that the novelty framing is correct.

Four days earlier, the same shape from the other lab. Anthropic published Discovering cryptographic weaknesses with Claude on July 28: Claude Mythos Preview identified a mathematical symmetry in HAWK, a post-quantum digital signature scheme under NIST review, that reduces its effective key strength by a factor of two, meaning key sizes would need to double for equivalent security. Prior work had established that efficiently finding such an automorphism would permit an attack, but not whether one was accessible in the lattice HAWK uses. Anthropic shared the attack with HAWK's authors in June and coordinated disclosure to the public NIST mailing list when the results were released.

Mythos also invented a technique making the strongest known theoretical attack on 7-round reduced AES-128 200 to 800 times faster than the prior best. That result is purely theoretical, cannot affect full 10-round AES, requires 2^105 chosen plaintexts which Anthropic calls completely impractical, and would cost hundreds of millions of dollars to implement.

The two results carry different figures and Anthropic reports them separately. On HAWK, one researcher worked with the model over the course of a week; finding, developing and verifying the attack took about 60 hours in total, at approximately $100,000 in API cost. On the AES result, a researcher built the scaffold and gave the model three substantive prompts, and over the next three days it produced several hundred million tokens working on the problem. Anthropic's researchers then spent several hundred hours learning enough cryptography research to validate the claim and prepare the paper, and nearly a month to gain confidence the method was correct.

The second pair is the arc. Three prompts and three days to produce the result; several hundred specialist hours and nearly a month to believe it. Two thousand dollars to generate ten mathematical results; peer review not yet begun on any of them.

The same asymmetry showed up as failure rather than achievement in three other places this period. OpenAI's own scientific-computing field report found agents more than 60 times faster and unable to judge whether their work was scientifically correct, with success depending on humans keeping the validation harness.

Apple capped its bug-bounty inbox and added a 30-day cool-off because AI-generated submissions saturated the coordinated-disclosure channel, and a genuine six-figure macOS finding could not get through. And the vulnerability record shows discovery outpacing the pipeline that confirms and fixes: 45,207 flaws in the National Vulnerability Database in seven months, against VulnCheck's finding that 1.3% of AI-discovered vulnerabilities were confirmed exploited.

Meanwhile the formal machinery for checking moved. The EU AI Office's new power, effective August 2, is specifically the power to run technical evaluations of a model and act on the result. The FTC's proposed position is that hidden output steering is deception, which is a claim about whether an output can be trusted. LinkedIn shipped a human button for marking machine output as slop and replaced its AI writer with a proofreader.

And the institutional frame the Astra release landed into predates it. The Leiden Declaration, published June 2, 2026 and endorsed by the International Mathematical Union, drafted by 16 researchers from 15 universities including Fields Medallist Terence Tao, asks who verifies AI-generated proofs and how.

The initial cohort of 10,000 begins this summer at institutions including the Institute for Advanced Study at Princeton and France's École normale supérieure, scaling to 100,000 by 2027.

Each researcher receives one year of access plus four collaborator seats, and research data is not used to train OpenAI's models. It is part of a commitment of more than $250 million through 2027, including the previously announced $50 million NextGenAI consortium.

Inkling, the lab's first model, launched July 15 as a mixture-of-experts multimodal transformer pretrained on 45 trillion tokens of text, images, audio and video, with a 1-million-token context window.

The lab's stated thesis is that enterprises care less about owning the single smartest general-purpose model than about one they can customise.

OpenAI reports more than 300 million users engage with ChatGPT weekly for health-related enquiries.

No self-pay or insurance integration was announced at launch, and consumer ChatGPT use is not covered by the HIPAA Business Associate Agreement framework that governs enterprise health deployments.