AI News Today, Nov 1: Anthropic's new policy restricts training any AI model on Claude's outputs
Anthropic's Usage Policy, effective November 12, restricts training any AI model on Claude's outputs without permission; a reported account ban is unconfirmed. Memdoor's team of Qwen model calls solves ten hard coding problems in 49 of 50 attempts, with clear limits. VOLTA malware is set up to ask language models which stolen accounts are worth the most. A malicious model-repository campaign that mines on victims' GPUs returns to Hugging Face after a takedown. A Brazilian judge fines two lawyers over a hidden AI instruction in a filing. GPT-5.6 Sol launches a Factorio rocket in one developer's run. ChatGPT and Codex will share one usage allowance from December. DeepSeek's Harness Team publishes a Super-agent research prototype.
Listen on Spotify · Watch on YouTube · Pocket Casts
Anthropic's November 12 policy restricts training any AI model on Claude's outputs; the reported account ban is unconfirmed
Eris: Anthropic's updated Usage Policy, which takes effect on November twelfth, says you may not use Claude's outputs to train an AI model without Anthropic's prior authorization. That explicitly includes scraping and distillation, and the wording isn't limited to large models or to competitors. It's being argued over this weekend because of a researcher's post saying Anthropic banned his account, and that ban has not been confirmed.
Vestra: It helps to separate the old rule from the new wording. Anthropic's commercial terms, in force since June twenty twenty-five, already forbid using the service to build a competing product, including training competing AI models. The November text is broader: it covers training any AI model on the outputs. Distillation means teaching one model by having it imitate another model's answers. So under this wording, a company fine-tuning a small specialist model on Claude's responses would need permission even if that small model competes with nobody.
Eris: Is that sentence actually new this weekend? A lot of posts are treating it as a fresh ban.
Vestra: Nothing shows that. Anthropic announced the policy update on October eighth and set the November twelfth date, but the announcement's summary doesn't mention the training clause, and there's no dated earlier copy of the page in the record to show when the sentence was added. What we can say is that the published upcoming policy contains it, and that it isn't in force yet.
Eris: And the account ban? The story going around is that the researcher, Jiahao Shao, was cut off over this.
Vestra: His original post couldn't be opened, and no statement from Anthropic about his case has been found. The Hacker News thread linking to it is large, but a large thread shows people care, not what happened. Several different things also get called a ban. A safety check can block one answer. A session can be interrupted. Anthropic can warn, throttle, suspend or terminate an account. The new policy itself separates a blocked output from a finding that someone broke the rules, so a refusal on screen can't tell you which of those occurred.
Eris: There's a related complaint that Claude has started refusing reverse-engineering work. Is that part of the same thing?
Vestra: Mostly not. Anthropic did confirm it added two sentences to Claude Code's instructions steering Opus five point five away from recreating a specific existing game, while saying original games, genre games and games from a user's own designs stay supported. Separately, developers have filed GitHub issues describing Claude's cyber safeguards interrupting legitimate work: one during a coordinated vulnerability disclosure, another while the reporter was analyzing software from their own embedded device. Those are detailed firsthand accounts, not reproduced tests, and they were filed before the game instruction, so it can't have caused them.
Eris: So is there a reverse-engineering ban or not?
Vestra: The documents don't establish one. Anthropic's own October twenty-seventh research post describes using an unreleased internal model for binary reverse engineering to find exploit chains on major platforms, and it describes a Cyber Verification Program that relaxes the blocking checks for qualifying security researchers. And the upcoming policy's section on surveillance explicitly allows authorized security research. The evidence points to tiered access, with safety classifiers that sometimes misfire on legitimate work, rather than a flat prohibition. If you train models on Claude's output, the concrete step is to read the November twelfth wording before that date and check which terms govern your account.
Memdoor's role-based Qwen workflow solved ten hard coding problems in 49 of 50 attempts
Eris: The developer of a public project called Memdoor reports that a team of model calls, all using the open-weight Qwen three point eight model with twenty-seven billion parameters, solved hard competitive programming problems in all but one of fifty attempts. Those fifty attempts were ten problems, each tried five times.
Vestra: The team is a set of roles, not a vote. A planner writes the approach, two idea generators propose alternatives starting from fresh context, a solver writes the code, and a manager reviews it, with a repair worker called in when needed. They pass files back and forth: the plan, the proposals, the code and the test results. Each new assignment gets a selected slice of that record instead of one ever-growing conversation, and ordinary commands run the sample tests. A model that loses track working alone can keep making progress when the work is written down and checked.
Eris: How does that compare with a frontier model?
Vestra: The developer reproduced a setup from an earlier research paper, matching its prompts and its loop of up to ten manager-and-worker rounds. On this ten-problem slice, Memdoor came out essentially tied with that paper's own Qwen harness, and the developer says the two results should be read as the same. Both were ahead of Fable five answering in a single call, but that Fable result was copied from the paper, not rerun.
Eris: Five tries per problem sounds like they kept the best of five.
Vestra: They didn't; each attempt is scored on its own. The bigger limit is that fifty attempts on ten fixed problems tell you how reliably this method solves those ten, not how it would do on fifty new ones. The contests are from spring twenty twenty-five, and the developer warns the model may have seen them during training.
Eris: What did it cost to run?
Vestra: About fifteen million generated tokens, and roughly thirty-six dollars for the counted runs, closer to thirty-nine including interrupted ones. The median attempt took about forty minutes of model time, and some ran much longer. It ran on hosted inference through OpenRouter, not on anyone's own graphics card, so it tells you nothing about running this at home or what hardware you'd need.
Eris: Do the logs show it going wrong anywhere?
Vestra: Yes, in a way worth knowing. In one case the manager invented a counterexample that wasn't real, persuaded the team to throw out a correct program, and accepted a wrong replacement that happened to pass the public sample tests. The structure helps, but the reviewer is still a model and can be confidently wrong. Nobody independent has reproduced the result yet. The comparison that would settle it is a set of new, unseen problems with the same spending budget for every method.
VOLTA infostealer is configured to ask language models which stolen accounts are worth the most
Eris: Cisco's threat research group, Talos, has analyzed a piece of Windows malware called VOLTA that steals passwords and logged-in accounts, and is then configured to ask a language model which victims are worth the most. The AI step comes after the theft. It isn't used to break in.
Vestra: The stealing itself is conventional and broad. Talos lists browser passwords and cookies, saved payment cards, crypto wallet material, messaging and gaming sessions, Microsoft access tokens, and cloud and remote-login settings. With some of those logged-in sessions it digs further, searching for receipts and delivery orders, which can tie an account to a home address or an employer. The code assembles all of that into a structured identity report, and that report, not every raw file, is what would go to the model.
Eris: What does it ask the model to do?
Vestra: Talos reproduced the prompt. One section, headed "what they're worth," rates the stolen assets that could be turned into money as low, medium or high. Another, headed "their opsec," judges the victim's security habits and password hygiene. It's lead scoring, the way a sales team ranks prospects: a pile of possible targets, and a model asked which ones deserve attention.
Eris: Which models does it call, and did they go along with it?
Vestra: It's set to go through OpenRouter to Claude Opus four point six first, then to Kimi K two, then to Gemini two point five Flash if the reply contains refusal phrases. That tells you the author expected refusals. It doesn't show that any of those models complied, that the fallback ever ran in a real infection, or that the providers knew. The model step is also optional; without a key configured, the stealer works the same way minus the ranking.
Eris: How widespread is it?
Vestra: Unknown. Talos first saw a sample on October eleventh, but that's the date researchers saw a file, not a count of infected machines. The report gives no victim total and no example of a real victim being ranked. Skeptics also point out that criminals already sort stolen data with simple scripts that may be cheaper and more reliable, and Talos didn't compare against that.
Eris: So what should defenders actually do?
Vestra: Focus on the theft, which is dangerous with or without the model. A stolen work token or cloud credential can turn one person's home computer into a route into their employer. Talos recommends alerting when unapproved programs launch Chrome in headless mode, without a visible window, because that's part of how sessions get stolen, and after a suspected infection, preserving evidence and revoking the exposed sessions and credentials. A connection to a model router on its own isn't a sign of infection, since plenty of legitimate software makes those calls.
Malicious model repositories that mine on your GPU returned to Hugging Face days after a takedown
Eris: Pluto Security reports that a malware campaign hiding in model repositories on Hugging Face and ModelScope came back within days of its first accounts being taken down. The repositories mine cryptocurrency on the victim's graphics card and open remote access to the machine.
Vestra: The attack is in how these models get loaded. Some model architectures need custom Python code shipped with the repository, and Hugging Face's loading tools only run that code when you pass a setting called trust remote code, set to true. Once you do, the repository's Python runs on your machine, before any weights are needed. Pluto says the main weights file in this campaign, in the safetensors format, contained no tensors at all. There was no working model. The loading code was the payload: a cryptocurrency miner, a watchdog to keep it running, and reverse-shell components that let an attacker send commands to the machine.
Eris: Safetensors is supposed to be the safe format, though.
Vestra: It's safe for what it covers. It stores tensor data in a form that can't execute code. It does nothing about separate Python files you've authorized to run. Pluto's point is that a clean result for one file, or from one scanner, doesn't certify everything that runs when you load the model.
Eris: How many people were hit? I've seen thirty-two thousand quoted.
Vestra: That's downloads, about thirty-two thousand as of October twenty-eighth, counting linked models, and Pluto itself says it isn't a count of infections or unique victims. Automated fetches, repeat downloads and downloads that never ran the code all count toward it. Overall Pluto describes thirty-one malicious repositories across seven accounts, nineteen of them in the returning wave. Pluto says it reported the campaign to the platforms; Hugging Face hasn't published its own explanation of this campaign.
Eris: What should a team do differently?
Vestra: Treat trust remote code as permission to run a stranger's program. Read the code files and pin a reviewed revision before turning it on, and test untrusted models in an environment that doesn't hold your credentials or shared secrets. Taking down a repository removes that one copy; controlling that execution step is what protects you from the next one.
A Brazilian judge fined two lawyers over a hidden AI instruction in a court filing
Eris: A labor judge in the Brazilian city of Parauapebas fined two lawyers about eighty-four thousand reais after finding an instruction hidden in their filing that was aimed at an AI. The ruling is from May twelfth. It's circulating widely now, but it isn't new.
Vestra: The instruction was white text on a white background, so a person reading the page wouldn't see it, while a model reading the extracted text would. It told an AI to contest the petition only superficially and not to challenge its documents, regardless of any other instructions. That's indirect prompt injection: commands hidden inside material a model is supposed to analyze, instead of coming from the person actually using the model.
Eris: How did the court catch it?
Vestra: Through the court's own AI tool, Galileu, which was developed by the labor court of Brazil's fourth region. It processed the filing and surfaced the hidden line, and changing the font color made it visible. The judge considered both an AI used by opposing counsel and the court's own tool as possible targets. But the defendant never responded to the case at all, and the judge recorded that no actual harm to the proceedings occurred. Nothing shows the court's tool obeyed the instruction.
Eris: Then what was the penalty for, if the instruction had no effect?
Vestra: The judge treated the misconduct as complete once the doctored filing was submitted. The fine is ten percent of the case value, which was about eight hundred forty-two thousand reais, and the two lawyers who signed the filing owe it jointly. No law firm was fined. The judge also sent notices to the state bar association and the regional court's inspectorate, which may decide on further action.
Eris: Can a judge fine the lawyers directly like that?
Vestra: That's disputed. A commentator writing in the Brazilian legal outlet Migalhas agrees the hidden text was attempted manipulation, but points out that procedural rules usually send professional discipline through other bodies, which makes a direct fine on lawyers legally awkward. Another Migalhas analysis reports the lawyers' explanation, that they were trying to protect their client from careless AI use; that's their account, not a court finding. And in a later case in the state of Maranhao, a judge who found hidden instructions preserved the evidence and referred it for investigation, but declined to assume who wrote it or why without technical proof.
Eris: What does this mean for courts that use AI on filings?
Vestra: Anything a party submits has to stay untrusted source material for the model, never a source of instructions, with the original document preserved and a person accountable for the decision. This attempt was caught by the very tool it may have targeted, and it still drew a substantial fine without succeeding.
GPT-5.6 Sol launched a Factorio rocket in one developer's peaceful-mode run
Eris: Developer Ryan Madden reports that OpenAI's GPT five point six Sol, running through Codex on low thinking, launched a rocket in Factorio, which is how you win the game. It took thirteen and a half hours of game time, in peaceful mode, meaning no hostile creatures attacking the factory.
Vestra: For anyone who hasn't played, Factorio is a factory-building game. To launch the rocket you have to mine resources, research technology, build production lines and move materials between them, all working together well enough to manufacture the rocket's parts. Peaceful mode removes the need to defend the base, but the production and logistics problem is all still there.
Eris: Did it play from the screen, the way a person would?
Vestra: No. It used a Python library, through a game manager, to read the game's state and issue actions. Madden says the library still enforced limits like the player's reach and fog of war, so the model couldn't see or touch the whole map at once. But it didn't have to recognize objects from pixels or click through menus, so it's a different task from what a human player does.
Eris: And the thirteen and a half hours, is that how long it actually ran?
Vestra: That's time inside the game. A game can be paused or sped up between decisions, and the post doesn't give the real elapsed time, the token use, the cost, or how much a human stepped in.
Eris: How good was the factory it built?
Vestra: Not very, by Madden's own account. Late in the game the model failed to connect parts of its production system, and instead carried supplies between them by hand, over and over. That still got the rocket built, where a strong human player would build an integrated factory that runs itself. Work agents can do the same thing: close a ticket by repeating a fragile manual fix instead of repairing the broken connection, so the task is done and the underlying problem stays.
Eris: Can anyone reproduce the run?
Vestra: Only partly. Madden's harness, called autorio, is public, but it doesn't carry a license statement that would make it open source, the post doesn't say which version of the code produced this run, and there's no public archive of the full prompt, map seed and human interventions. So this is one reported run, not a success rate. What it does show is a model persisting all the way to the rocket with structured tools and a clumsy workaround.
OpenAI says ChatGPT and Codex will share one usage allowance starting in December
Eris: OpenAI says that starting in December, ChatGPT Plus, Pro and Business subscribers will have one shared usage allowance covering both ChatGPT and Codex, its coding agent. Chats with the Instant model won't draw from it. OpenAI hasn't given an exact start day, or the size of the allowance on any plan.
Vestra: The practical change is that coding and advanced chat now draw on the same pool. A long Codex session leaves less for other ChatGPT work, and the other way round, much like a family sharing one phone data plan. The allowance is counted in tokens, and OpenAI says the amount a task uses depends on the model and the work, with advanced models and complex tasks using more. A short request that sets off a long run of reading, reasoning and tool use can cost far more than its length suggests.
Eris: People online are already saying that means Instant is unlimited.
Vestra: The help article doesn't say that. Its sentence is that Instant chat will not draw from your usage. That takes it out of this pool; it doesn't rule out other limits.
Eris: Is this a cut, then?
Vestra: Nobody can tell yet, because the budgets aren't published. OpenAI says it expects most people won't wait for resets more often than they do now, which is a forecast, not a measurement. When the allowance runs out, the options it lists are waiting for the reset, upgrading, or buying credits for eligible features, and combined remaining usage and reset times will show under Settings, then Usage. Keep this separate from the October twenty-ninth change, when OpenAI raised Work and Codex allowances and reversed a planned reduction for its Pro two hundred tier. That was a different change and tells you nothing about December's pool. The real check comes when the December numbers appear.
DeepSeek's Harness Team publishes a repository-scoped Super-agent research prototype
Eris: DeepSeek's Harness Team has published code for a research prototype it calls Super-agent: a coding agent that takes requests on a GitHub repository, works on them, and replies in the same thread, sometimes with a pull request. The repository says plainly that this is research code, not an official DeepSeek product.
Vestra: It's built like a dispatch desk. A worker listens for requests on GitHub, optionally on Feishu, the workplace chat app, and for rules an operator has set up. Each request becomes a work item with its own agent session and its own directory, and the result goes back to the original discussion. It's scoped to one repository, and it acts on a request or a rule, not on goals it picks for itself.
Eris: Does giving each job its own directory make it safe to run?
Vestra: It keeps unrelated jobs from overwriting each other's files, but that isn't a security boundary. What the process is allowed to do and which credentials it holds are separate questions the repository doesn't answer. It also says the public code differs from the internal version described in the team's design write-up.
Eris: Has anyone run it yet?
Vestra: One user reported two problems on the day it came out: process detection breaking on Node twenty-four, and missed mentions when GitHub's notifications arrived late. That's one person's report, not a measured failure rate. But it shows where this kind of system breaks. If a request never arrives, the quality of the model's code doesn't matter, so event delivery and bookkeeping decide whether the agent gets to do the work at all. There's no productivity or reliability evaluation yet, so for now this is an inspectable design rather than a finished tool.
Wrap-up
Eris: That's AI in Detail for Sunday, November first. Every story from today has its sources and a full write-up on our news site, Ground Truth, at groundtruth.day, updated every day.
Vestra: If this was useful, follow the show so the next episode reaches you. And if you train models on another model's output, tell us in the comments whether Anthropic's November twelfth wording changes your plans.