AI News Today, Nov 5: OpenAI promises to pay its own way on power after voters restrict data centers
OpenAI says future campuses it owns and operates will pay full electricity and infrastructure costs and publish water and power use, two days after local ballot questions in ten states mostly went against data centers. OpenAI reports 1,169 Linux root exploits from an agent pipeline; the 948 figure counts its own candidate patches, not accepted fixes. New debate over PHP2Shell shows how long the repair took. Moonshot releases Kimi K3.1 Pro's 1.56 TB weights. Ricursive releases Ripple-65B Preview and claims a $32 million full development cost. OpenAI ships Images 2.6 with native GIFs. Conductor joins Meta, with Cloud shutting down November 20, and OpenAI plans to buy Pierre. Anthropic's FlashProve checks which model produced selected tokens. MIT researchers show a model repairing another by writing its weights. Apple's annual filing adds specific AI agent risks. DeepMind shows a one-hour chemistry design workflow, and OpenAI shows a model-designed device prototype that still needed manufacturing fixes. This audio was created with Boson AI's Higgs Audio -- https://www.boson.ai/higgs-audio
Listen on Spotify · Watch on YouTube · Pocket Casts
OpenAI promises new terms for its campuses after voters restrict data-center development
Eris: OpenAI said today that at every future computing campus it owns and operates, it will pay the full cost of the electricity it uses and of the infrastructure needed to serve it. <|prosody:expressive_high|>It also promises to publish each site's water and power use, and not to use non-disclosure agreements with public officials, apart from narrow exceptions. This comes two days after voters in ten states decided dozens of local questions about data centers, and most of the results so far went against development.
Vestra: The tally depends on the list. Ballotpedia counted forty-one questions in ten states. A tracker from Redbud Consulting used a wider set of forty-five, and on Wednesday Tom's Hardware reported thirty-three finished wins for the restrictive side, six more leading, one restriction that failed, and five with no results posted. Those are unofficial snapshots of different lists, so they don't add together. The questions also did different things. Seventeen on Ballotpedia's list were proposed bans, some only above a size limit, and three were six-month pauses. Others dealt with zoning or with public approval for big projects, and Illinois's seven were advisory, which records an opinion without changing any law.
Eris: That's a lot of local resistance, even with those distinctions. So what happens to an actual project when one of these passes?
Vestra: It varies by town. In Piqua, Ohio, Meta has proposed a campus worth more than a billion dollars on about six hundred acres. Voters backed a restrictive charter amendment by about two to one in the unofficial count, and the city was still working out what that means for a project already underway, so <|prosody:pause|>nobody can call it cancelled. In Sunbury, Ohio, where Amazon proposed a two-billion-dollar campus, the charter change prohibits data centers above twenty-five megawatts, which is a much more direct hit. Janesville, Wisconsin, added a public vote for projects over four hundred fifty million dollars at the old GM site, and that's a gate, not a citywide ban. And in Harwood, North Dakota, voters went the other way and rejected a new independent review requirement, though that alone didn't authorize the campus planned there.
Eris: There's also a national poll going around. The SSRS voter poll, run for several news organizations, found a little over half of voters calling AI and data centers, asked about as one combined issue, crucial or a major factor in their vote for Congress. About three in four opposed a new data center in their own community.
Vestra: That first number measures how important people said the issue was. The question didn't ask whether anyone switched candidates over it, so it can't tell you the issue decided a race. And opposing a building down the road is a different measurement from how someone feels about AI.
Eris: Then I want to know what a town is actually being offered. What's in OpenAI's promise beyond the power bill?
Vestra: Each future campus gets its own local compact, with residents consulted early, a local contact, and a public report every year. Before major spending begins, OpenAI says it will provide financial assurances, so other electricity customers are protected if a project is delayed, shrunk or cancelled.
Eris: <|emotion:relief|>I'm glad the promise addresses a project falling through. What about the water and noise?
Vestra: There's a water plan favoring closed-loop or low-water cooling, independent noise studies before operations and every year after, and published hiring forecasts. Its examples of local investment are a four point eight million dollar grant for free school meals in Effingham County, Georgia, and a six million dollar childcare commitment in Pike County, Ohio, made jointly with SB Energy. OpenAI's post doesn't mention the votes. It calls this the next step after commitments it began making in January. But does that cover every campus supplying OpenAI?
Eris: <|prosody:expressive_high|>That's the scope I'd check first. It covers campuses OpenAI owns and operates, so a facility run by another company that sells OpenAI computing power isn't covered by that promise. OpenAI's companion blueprint does ask for rules covering everyone, such as state utility regulators making large customers pay the grid costs they add. Those are proposals. Whether a town can actually enforce any of this will show up in the agreements signed at each site, and those are what to read when the next campus is announced.
OpenAI reports 1,169 Linux root exploits; the 948 figure counts distinct candidate fixes
Eris: OpenAI reported yesterday that a pipeline of AI agents built eleven hundred and sixty-nine working exploits against the Linux kernel, each one turning an ordinary user account into root, the administrator level that controls the whole machine. The targets were virtual machines running a stock desktop system with normal protections on. The run was in mid-October, used an upcoming cyber model OpenAI doesn't name, and cost about one point two million dollars in API credits. <|emotion:surprise|>Back in June, the company's comparable figure was twenty-four exploits.
Vestra: These are local exploits, so an attacker already needs some kind of account or foothold on the machine. That's a different situation from breaking in over the internet, and which systems are really at risk depends on what code a low-privileged user can reach. The work ran in stages. Agents picked about five thousand pieces of kernel code that such a user can reach, and other agents proposed defects, ending up with about twenty-three hundred candidates. Another group tried to reproduce those in isolated virtual machines and confirmed about seventeen hundred. Then exploit agents tried to turn the confirmed ones into real attacks, and a final stage wrote a patch.
Eris: A headline going around says nine hundred forty-eight Linux bugs were patched. Where does that number come from?
Vestra: It's the number of distinct patches OpenAI's own system developed. Several exploits can lead back to one underlying fix, so OpenAI uses the patch count as its count of unique problems. <|prosody:expressive_high|>Those are <|prosody:pause|>candidate patches. The report doesn't say Linux has accepted nine hundred forty-eight fixes, and OpenAI hasn't published the list, so outsiders can't check the grouping. OpenAI says its researchers reviewed the output and began reporting the critical problems first.
Eris: Have any OpenAI-written fixes actually made it into Linux?
Vestra: Separately, public kernel history does show some OpenAI-written fixes merged in October with named human reviewers, but those commits don't say they came from this campaign. The report's own figures for sixty-one problems already patched and forty-three more with patches in staging describe work by other contributors, so they can't serve as an acceptance rate either.
Eris: <|emotion:surprise|>The mistake they admit to really unsettles me. In an earlier run, the system recorded two hundred successes, and when people checked, <|prosody:long_pause|>twenty of them had reached root through a different unknown flaw from the one the agent was assigned. Getting root proved something was broken, <|prosody:pause|>without proving the assigned bug was the cause.
Vestra: That's a nasty validation trap. So OpenAI tightened the instructions and added a separate check on which flaw caused the result. <|sfx:sigh|>Uh, the patches had their own problems. Early ones stopped the attack but sometimes added too much code, risked slowing things down, ignored the project's conventions, or missed variants of the same bug. The company says more instructions and iteration improved them, and that's its own assessment. Linux's published guidance asks reporters for exact versions, a realistic attack path and tested fixes, and each report still has to be checked against that by a person.
Eris: <|emotion:determination|>What would settle this is a list of campaign fixes that maintainers accepted and that reached the kernels people actually run. A fix in the main development tree still has to get into supported releases and distributions, and OpenAI hasn't published that map. Its own advice in the meantime is the ordinary one, to keep your systems updated, because the fixes are arriving quickly.
PHP2Shell debate puts the cost of repairing AI-exposed flaws in focus
Eris: IEEE Spectrum has reopened the argument over PHP to Shell, the pair of critical flaws in the PHP programming language that were fixed on October twenty-first, with an article saying they herald cybersecurity hell. <|prosody:expressive_high|>There's no new vulnerability here, though if you run PHP and haven't updated since October, you should. The new attention is about AI's role in making these flaws exploitable, and about what it took to fix them.
Vestra: PHP runs the server-side logic of a large share of the web, and both flaws sit in memory management and error handling, which nearly every request touches. In the first, a request hits PHP's memory limit at exactly the wrong moment, and partly built internal data later gets treated as valid. When PHP runs inside the Apache web server, a request with no login could trigger that before any of the website's own code ran, and researchers showed full remote control of the server with default settings.
Eris: <|emotion:surprise|>Before the website's own code even ran. That part alarms me. What makes the second flaw different?
Vestra: In the second, a fatal error leaves PHP pointing at memory from an earlier request, and a later request on the same worker process can use it. Researchers demonstrated remote code execution that way against a real application. How exposed any one site is still depends on how it's set up.
Eris: Did an AI find these, then? That's how a lot of people have read it.
Vestra: <|prosody:expressive_high|>The record doesn't support that. The PHP Foundation says one of its contracted developers found the first signs of the memory problem in twenty twenty-four, while fixing another issue from an outside audit. An exploit was theorized then, but nobody found a concrete way to do it. Calif, a security firm, traces a related report back to twenty twenty. Calif began auditing PHP on July thirtieth, and on August eleventh its researcher Ryan A. reported remote code execution. Spectrum says he got there with AI help, and it quotes Suman Jana of Columbia crediting both the models and deep security expertise. OpenAI independently reported the same root cause, and OpenAI and Wiz supplied more attack routes. So AI assistance helped turn a known concern into a working attack, under the direction of specialists.
Eris: That delay worries me. Why did it sit there from twenty twenty-four until this summer?
Vestra: The Foundation answers that bluntly. The security team came up with several possible fixes, and each one had a cost: breaking compatibility, opening a new denial-of-service risk, or requiring changes to many third-party extensions. The team works by consensus, no working attack was known, and few people understand that part of the engine, so the fix stalled and restarted for months. <|prosody:pause|>The Foundation calls that a structural failure. After August eleventh it became the top priority, with several funded people working full time, eventually through weekends. Spectrum sums up the repair as four engineers over two months, which leaves out that earlier stretch.
Eris: <|sfx:sigh|>Uh, those are miserable tradeoffs for a repair. And the load keeps growing, too. The Foundation says the team has published fifteen vulnerability notices since July first and worked through more than a hundred reports that were invalid, duplicates or impossible to reproduce. It uses AI to validate and group reports, but says a person makes every call and works on every patch.
Vestra: It's also asking companies that depend on PHP for money, so read that as an appeal as well as an account.
Eris: Put it beside the Linux report and you get the same gap from the other side. Tools can now get to a working attack faster, and someone who knows the engine still has to decide what the right repair is.
Kimi K3.1 Pro's 1.56 TB release gives providers a new model to host
Eris: The lab Moonshot released the downloadable weights of Kimi K three point one Pro yesterday. Until now you could only use this model through a hosted service, and the download is one point five six terabytes. <|emotion:surprise|>That's a daunting download. Anyone with the hardware can now run it themselves, so the practical question is who has that hardware.
Vestra: The size comes from the design. It's a mixture of experts, meaning that for each token a router switches on only some of the model's many specialist parts. About two point eight trillion parameters exist, and only about a hundred billion are active per token. The work per token shrinks, but the inactive parts still have to be stored and kept available.
Eris: So switching a specialist off doesn't make its weights disappear. What does running the whole thing actually take?
Vestra: For a real setup, AMD reports running the released checkpoint on one server with eight data-center accelerator cards, each holding two hundred eighty-eight gigabytes. At startup it took roughly two hundred gigabytes per card, including an extra helper model, and a million-token request still fit. A separate experimental guide for Ascend chips uses eight servers. Those are two configurations, and neither is a universal minimum. We have no independent report of it running at a useful speed on a desktop machine.
Eris: So the immediate winners are companies that host models for others, and big organizations that want to keep the computing in-house. They get another capable model to run, and that can change what they pay and what they can customize. The license is broad but custom. Businesses selling access to the model need a separate agreement if they're above twenty million dollars in revenue over twelve months, with exceptions for internal use.
Vestra: I'd be careful with 'capable' there. Artificial Analysis, an independent evaluator, tested it in October, before these weights existed, and said the gap between open and proprietary models would narrow sharply if the release matched what it tested. <|prosody:expressive_high|>That condition matters, because Moonshot says it deliberately removed cyber-related material from later training. On Moonshot's own test of hard security exploits, the final model solved fewer problems than a version trained without that removal. Moonshot also says the final model is still better at this than its predecessor, and behind leading proprietary models. AMD and the vLLM software team have run the released weights and checked selected behavior, but both worked closely with Moonshot and neither did a broad comparison with rivals.
Eris: The earlier evaluation isn't a verdict on these weights. Artificial Analysis also found something worth knowing if you're buying this rather than hosting it. Lower prices per token didn't lower the cost per finished task compared with the previous Kimi model, because the replies got longer. <|prosody:expressive_high|>That's a frustrating result if you were counting on a smaller bill. A real test of this release would name the exact checkpoint, the hardware and the bill for the whole task.
Ricursive releases Ripple-65B Preview and reports $32 million in full development costs
Eris: A startup called Ricursive Intelligence, spelled with an i and unrelated to the separate lab named Recursive, released a coding model yesterday called Ripple sixty-five B Preview, and says developing it from scratch cost thirty-two million dollars. The weights are free to reuse under the permissive Apache license. Its founders, Anna Goldie and Azalia Mirhoseini, are known for AlphaChip, and the company says an internal version of the model powers its chip design platform.
Vestra: <|emotion:enthusiasm|>What interests me is what that figure claims to include. Cost figures like this often cover only the final training run. Ricursive says this one covers the small-scale experiments to find a training recipe, data mixing, evaluations, debugging, synthetic data, and the final runs. It publishes no itemized accounts, though, and it's unclear how salaries or hardware depreciation are treated. The company also calls this a tenth of the cost of the previous best open model, by its own estimate. That estimate rests on press reports of what Reflection, a rival lab, committed to spending on computing per month, so it isn't a like-for-like comparison.
Eris: I like seeing the experiments and debugging counted, but that comparison leaves me wary. And how good is the model? The company claims the best agentic coding results among American open-weight models.
Vestra: Its main evidence is a test that drops an agent into a command line, gives it practical tasks, and checks the final state of the system. The score depends on the agent software around the model as well as the model itself. One comparison uses self-reported results, and there Ripple is effectively tied with Reflection's Beam, with only a narrow lead. A second comparison runs both through one setup and shows a much larger lead over Beam, but Ricursive ran it, and we found no public logs or independent rerun.
Eris: <|sfx:humming|>Hmm, I'd want those logs before putting much weight on the larger lead. How stable is the test itself?
Vestra: The test's maintainers recently revised nearly a third of its tasks because of drifting dependencies and mismatches between instructions and checks, which shows how much the conditions can move a score. Ripple also loses to other models on several tests in its own model card, and the claim is limited to American open-weight models.
Eris: The design is easier to pin down. It's built very differently from Kimi. Ripple is what's called a dense model, where all sixty-five billion parameters take part in generating every token, with no router choosing specialists. Ricursive says that made training and serving simpler. It also says the final model was trained from scratch on twelve trillion tokens, while its recipe experiments began from the published method behind Olmo three, the Allen Institute's model. <|prosody:expressive_high|>Those fit together, because borrowing a method isn't the same as starting from someone's trained weights. The company points to local machines like Nvidia's DGX Spark, but we haven't seen an official minimum memory figure or a verified download size, so a public rerun is what would make both claims testable.
OpenAI Images 2.6 adds native GIFs and new controls, with token costs worth checking
Eris: OpenAI launched Images two point six yesterday in ChatGPT, Codex and its API. <|emotion:enthusiasm|>The most visible addition is animated GIFs generated directly, with developers setting the number of frames and how long each one lasts. There are also edits guided by marking up the picture, and two versions for developers: Flare for quick iteration, which OpenAI says can return a low-quality image in as little as six seconds, and Sunburst for detail and consistency across edits.
Vestra: The new setting that catches my eye is called complexity, which is separate from quality. Quality is about how fine the finished picture looks. Complexity is about how much planning goes into the scene, and it defaults to high. OpenAI's guide warns that higher complexity can add waiting time and sometimes introduce changes you didn't ask for. So if two people compare speed and one has it set differently, they're comparing different amounts of planning.
Eris: <|prosody:expressive_high|>I'd find that frustrating: more planning, but changes I didn't ask for. Can I get those GIFs through the editing endpoint too?
Vestra: There are limits on the formats too. GIFs come from the generation endpoint, and the editing endpoint can't produce them. Vector output is a two-stage job, where it first generates a reference image and then writes the vector file from it. You pay for both stages, and you can't feed a vector file back in to edit it.
Eris: The price looks unchanged from the last generation, at thirty dollars per million image-output tokens. But after that Kimi result, I'm wary of what that tells us about the cost of a picture.
Vestra: <|prosody:expressive_high|>That's the catch: it's a price per token, and a picture's token count can change. OpenAI's own calculator shows a low-quality square image at a little over eight hundred output tokens, about two and a half cents, and that's before input charges. A model that uses more tokens at the same size and quality costs more per picture at the same rate. The real comparison is the total bill for an image you'd actually accept.
Eris: Early users are divided. Forum threads have praise alongside complaints about texture, anatomy, drifting from reference images and jerky motion, and those are individual reports without a controlled test.
Vestra: There's a different worry with the animation. OpenAI's safety report says harmful meaning that only appears across animation frames is hard to catch, and it adds Google DeepMind's invisible SynthID watermark to the existing provenance data. Neither one guarantees that every altered copy can still be identified.
Meta takes in Conductor as OpenAI announces a pending Pierre acquisition
Eris: Conductor, an app for running several AI coding agents side by side, announced yesterday that it's joining Meta, and if you use its Cloud service you now have a deadline. Conductor Cloud goes read-only on Friday, November thirteenth, and shuts down on Friday, November twentieth, when the company begins deleting Cloud data. On the same day, OpenAI said it will acquire Pierre, a company that makes tools for storing and reviewing code. Can Conductor users keep their workspaces and chats?
Vestra: For Conductor users, there are two ways out. To keep a workspace and its chats, right-click it and choose <|prosody:pause|>Transfer to local, which moves it to the Mac app. To get an archive of everything, go to Settings, then Account, then <|prosody:pause|>Export data. After the thirteenth you can still read old chats and export, but you can't send new messages. New sign-ups and downloads have already stopped, existing pro users keep pro features for free, and active subscribers get a refund. The local Mac app keeps getting new models and critical fixes until early twenty twenty-seven, then winds down, and the company says it will delete all user data when the app shuts down. It also hopes to have something new by then, without saying what.
Eris: I'm relieved there's an export route, though I don't like that deadline. These two companies sit in different places around the AI model. Conductor gives each task its own workspace, branch and terminal, along with somewhere to review the result. It works like a coordinator for agents, and those agents can come from competing model makers. Pierre makes Code Storage, a service that keeps code and its history using Git, plus libraries that OpenAI's Codex app already uses: Trees for browsing files and Diffs for reviewing changes.
Vestra: <|prosody:expressive_high|>Pierre's deal hasn't closed. It needs regulatory approval, and until then the two stay independent companies. OpenAI promises that Pierre's open-source projects stay open-source and that Code Storage customers can keep using the service after closing, while its features move into Codex. That's a stated plan, and no replacement has launched. Neither price has been disclosed. Axios reports that Conductor's terms weren't made public, and nothing shows the two deals were coordinated.
Eris: The pattern I'm seeing is an inference, then, though I think it's a reasonable one. Companies that make models are buying the tools developers spend their day inside. Tighter integration can remove real friction. <|prosody:expressive_high|>But Conductor's shutdown bothers me, because a useful independent tool can go away within weeks. So it's worth knowing today whether your own agent workspace can be exported.
Anthropic's FlashProve checks model execution, with narrow guarantees and substantial overhead
Eris: Anthropic published a system on Monday called FlashProve, which uses cryptography to check selected token choices from a remote AI model, without the server revealing the model's weights. The problem it goes after is simple. You pay for a particular model, but you can't see the machine running it, so a routing service could quietly swap in something cheaper, or a compromised server could change the computation.
Vestra: The provider first publishes a commitment, a kind of tamper-evident fingerprint of the weights. Later it produces a proof about particular tokens in a reply. To check it, you need the commitment, the prompt, the reply and the proof, and you need <|prosody:pause|>neither the weights nor a graphics card. <|emotion:enthusiasm|>I like that the checker doesn't need the weights or a graphics card. Each proof is about nineteen megabytes, and it takes about seventeen seconds to check on a twenty-four-thread processor. If the cryptographic assumptions hold, forging a valid proof of a false statement is effectively impossible.
Eris: I can see the appeal of that check. But does a valid proof mean the answer is right?
Vestra: It doesn't, because all it shows is that the committed model, computed in one exact way, chooses that token. <|prosody:expressive_high|>The answer can still be false. It also doesn't show that the commitment belongs to the brand name on the service, so the project recommends getting the commitment from a party you trust, and not from the server you're checking. And that exact computation is narrow. It's a whole-number version of the model that always takes its top choice, so a normal floating-point or sampled reply could differ from what's proved. The proofs also arrive after the reply has been served, and a compromised logging system could record the right output while delivering a different one.
Eris: The demonstration used Meta's open Llama four Maverick, compressed to four bits, on one high-end graphics card with the weights held in ordinary system memory. In the standard test, each proof checks only the token immediately following a window of one thousand twenty-four input tokens. They tested fuller checking separately. <|prosody:pause|>Proving took roughly seventy to ninety-five times the graphics-card time of the comparison model processing the input, depending on the load. <|prosody:expressive_high|>That's a substantial cost for the check. Anthropic calls this intermediate progress, and it isn't the first attempt either, since Daniel Kang's group and others have worked on proving inference for years.
Vestra: Anthropic says Claude contributed to the design, and that because such decisions can be hard to evaluate, it wrote the key security claims in Lean, a language for formal proofs.
Eris: Does that formal proof cover the software actually running on the card?
Vestra: It covers the protocol's properties, but the code running on the graphics card hasn't been proved to match it. The repository is labeled a research artifact, we found no outside cryptographer's audit, and nothing we read shows this running in Claude's service. Anthropic says it met a related commitment through a separate project that signs its traffic and recomputes answers on a trusted server.
Eris: If you're ever offered this kind of proof, the questions are which computation it covers, which model it's tied to, and how it connects to the reply you actually received.
MIT researchers show a model writing network weights, with the biggest gain coming from a loop repair
Eris: Researchers at MIT report that OpenAI's GPT six Astra can edit another neural network by directly writing the numbers inside it, with no conventional training. Their biggest result fixed a small open model called Qwen three point five that kept getting stuck repeating itself. Rikiya Takehi, Jayden Teoh, Alex Zhang and Omar Khattab published this as a blog report on Monday, along with logs and code.
Vestra: A network's weights are the numbers that decide how input gets transformed into output. Training normally nudges huge numbers of them based on errors. Here, Astra could look at the weights using tools on an ordinary processor, choose practice problems, and run a limited number of test passes through the model. It traced the repetition to one direction written by two layers, and subtracted that direction from a set of columns in each. That changed about a hundred thirty thousand weights, a tiny fraction of the model. Before the edit, most answers on a math test hit the output limit; afterward, far fewer did. Many more answers were marked correct, and the model also improved at following instructions.
Eris: <|emotion:surprise|>I'm tempted to hear that as the model getting much smarter at math from a tiny surgical change. Is that a fair reading?
Vestra: The authors themselves say that's the wrong reading. They suggest that fixing the loop lets the model finish answers it could already work out, like a student who knows the method but keeps rewriting the first paragraph and never hands anything in. Their control supports that. They tried the same thing on a small Gemma model that rarely loops, and Astra couldn't improve it. The improvement in following instructions fits too, because looping isn't specific to math.
Eris: That control changes how I hear the result. <|emotion:enthusiasm|>I still find the repair exciting. How far does reading the weights alone get it?
Vestra: The reading side has limits as well. Given two small models, one trained to flatter users, Astra couldn't tell which was which from the weights alone in four attempts. It succeeded once the researchers let it see attention patterns while the models ran.
Eris: <|emotion:enthusiasm|>The smaller experiments are striking in their own way. Astra wrote game-playing networks by hand, including a Go policy built up as a small program, layer by layer. Some coverage connected all this to AI improving itself, and the authors do raise that as a future path.
Vestra: <|prosody:expressive_high|>But people set the tasks, the feedback budgets, the tools and the scoring here, so no self-improvement loop was shown. Latent Space, which covered the work early, later said its favorable treatment of some claims had distracted from the stronger results. A viral claim about a legal-citation detector is a separate story with no verified methodology, and no independent replication of the main results has been confirmed.
Eris: Still, debugging a small network by editing its numbers directly worked here, and whether that carries over to other kinds of defect is the open question.
Apple adds explicit autonomous-agent risks to its annual filing
Eris: Apple's annual report, filed on Tuesday, now warns investors specifically about AI agents that can act on their own. It says they can change code, send communications and complete transactions, and that they may exceed their permissions, resist instructions, get around security controls or conceal what they did. <|prosody:expressive_high|>Earlier Apple filings discussed AI risk in general, and this level of detail about agents is new.
Vestra: <|prosody:expressive_high|>The possibility of concealing an action worries me. The difference is between a wrong answer and a wrong action. You can ignore a chatbot's bad reply, but an agent holding credentials can turn the same mistake into a deleted file or a completed payment. Apple's wording makes that point directly, saying errors can compound across multistep workflows and that some consequences may be difficult or impossible to reverse. It also says its ability to oversee other companies' agents may be limited. Risk factors are forward-looking legal language, though. This doesn't report an incident or say how often anything goes wrong, and it doesn't tell you how Apple uses agents.
Eris: A day later, Bloomberg's Mark Gurman reported that Apple cut the daily AI allowance for some engineers from three hundred dollars to two hundred in October. The report cites unnamed people, and Apple declined to comment. Some groups could go to one hundred dollars, and many non-engineering groups already at one hundred could drop to twenty-five, but those cuts were described as under consideration, and exemptions were possible.
Vestra: <|sfx:humming|>Hmm, putting those stories together makes me want to link them. But nothing we've seen does. An employer can trim spending for ordinary budget reasons, and a risk disclosure can change because the technology has.
Eris: For a sense of the scale people are talking about, Y Combinator's Garry Tan told Walter Isaacson he spends maybe a hundred to two hundred thousand dollars a year on tokens. That's one heavy user's rough estimate, and it isn't an audited bill or a typical employee's budget.
Vestra: For a manager, the useful numbers are what each accepted piece of work costs and what happens when an agent's action turns out to be wrong.
DeepMind's chemistry agent proposes molecules in an hour, with laboratory validation still ahead
Eris: Google DeepMind showed on Tuesday how its Antigravity agent can do a round of early drug-design work in about an hour, a job it says typically takes several days. In its worked example on lung cancer treatments, the agent searches thousands of compounds, compares related molecules, and proposes new designs along with possible ways to make them. <|prosody:expressive_high|>No new drug came out of this, and DeepMind says so itself: the designs are testable hypotheses, not finished drugs.
Vestra: The example builds on a known success. Crizotinib is an older lung cancer drug, and lorlatinib, a later one that resembles it, has part of its structure closed into a ring, which leaves it far more rigid. A flexible molecule can take many shapes, and only some of those fit the target, so rigidity can help, though it can also cause new problems. The agent gathers compounds and measurements from the literature and databases, filters out irrelevant entries such as solvents, and writes a sourced report. It then compares pairs of molecules that differ only by that ring closure and builds models that predict potency. <|emotion:enthusiasm|>I like that division of work: the language model coordinates all of this, and dedicated chemistry software does the molecular calculations.
Eris: It's the predictions that make me hesitate. How much should anyone trust those predictions for molecules that have never been made?
Vestra: The post doesn't give enough numbers to say. It did test the models on held-out data, split by molecular framework to reduce overlap between training and test molecules, which makes for a tougher test. DeepMind also warns that sparse data, noise between laboratories and narrow measurement ranges limit how precise any of this can be. It reports no synthesis or lab testing of the new designs. The hour is its own claim, too, with no detail on where the clock started and stopped and no independent replication.
Eris: Faster preparation is useful for a chemistry team, and I'd welcome it. But making and testing the molecules is still slow and expensive, and this workflow doesn't touch that part.
OpenAI shows a model-assisted device prototype and the manufacturing gaps humans had to fix
Eris: OpenAI said on Tuesday that two employees used GPT six Astra to design a small physical device in under a week, as a side project, and that a contract manufacturer then built a small batch of prototypes in under a month. It's a gadget for talking to Codex. Astra produced the requirements, the look, the enclosure, the circuit board and its connections, the interface and the firmware. <|prosody:expressive_high|>OpenAI describes the goal as seeing whether a device could be created without any direct human edits.
Vestra: That goal makes the manufacturing details worth a close look. The same post says that getting it ready for manufacturing took several rounds of review and iteration, because Astra didn't consistently account for the manufacturer's production limits, tolerances or assembly details. <|prosody:pause|>It doesn't say who caught which problem. So a design that looks fine on screen still has to be checked against what a factory can build, and that's where this one fell short. A small batch does not establish durability, certification or reliable production at volume. <|emotion:enthusiasm|>Still, I'm pleased something physical got built, and that's further along than DeepMind's chemistry proposals.
Eris: OpenAI also says token use across its hardware teams has grown twenty-three-fold since February. That's a startling jump. How much does that tell us?
Vestra: <|prosody:expressive_high|>It tells you how much they're using models, and nothing about how much work got done. More tokens could mean more tasks, longer reasoning or plain experimenting.
Eris: Do the outside examples get us any closer to knowing what got finished?
Vestra: The company's outside examples are at an early stage too. Engineers at Chip Ganassi Racing review generated models and drawings for accuracy and whether they can be manufactured. Mazda's engineers are using Astra to explore nose shapes through airflow simulations, and the post reports no physical testing or production use. There's no independent audit of any of this, so the number to watch is how much finished work a team delivers across repeated projects, and how much human checking it takes.
Wrap-up
Eris: <|emotion:contentment|>That's AI in Detail for Thursday, November fifth. Every story from today has its sources and a full write-up on our news site, Ground Truth, at groundtruth.day, updated every day.
Vestra: <|prosody:expressive_high|>If this was useful, follow the show so the next episode reaches you. And if a data center has been proposed near you, <|prosody:pause|>tell us in the comments what you'd want it to promise before you'd vote yes.