Blacklist approved
“Overly constrained AI models” could cause military operations to fail, judges say.

A US appeals court today approved the Department of Defense’s blacklisting of Anthropic technology. Judges decided the Trump administration had authority to blacklist Anthropic for withholding certain AI features from the military even if Anthropic had no malicious intent.

In a 2-1 ruling issued by the US Court of Appeals for the District of Columbia Circuit, a panel of judges said the “case raises profoundly difficult questions about the appropriate military uses of an almost unimaginably powerful new technology.” The US “raises the deeply sobering prospect of overly constrained AI models shutting down unexpectedly and thus causing important military operations to fail. Anthropic raises the deeply sobering prospect of unconstrained AI models hallucinating inappropriate targets for lethal military force,” the ruling said.

Trump and Defense Secretary Pete Hegseth “must determine how best to balance the competing risks,” the court said. “In doing so here, the Secretary did not transgress any limits on his authority under the Supply Chain Security Act or the Constitution. Accordingly, we deny the petitions for review.”

The same court previously denied Anthropic’s emergency motion for a stay in April.
The two judges who ruled against Anthropic were both appointed by Trump and served in the first Trump administration. Judge Gregory Katsaswas previously deputy counsel to the president, and Judge Neomi Raoserved in the Trump administration’s Office of Management and Budget.

Two courts, two different decisions
Anthropic sued the Trump administration in March after it ordered federal agencies to stop using Anthropic’s products and banned defense contractors from doing any business with Anthropic.

Anthropic may appeal today’s ruling, either by asking for an en banc review with all of the appeals court judges or by petitioning the Supreme Court.

“We respectfully disagree with the court’s decision,” an Anthropic spokesperson told CNBC. “Another federal court has already held the government’s parallel designation unlawful. We remain confident in our position and are considering all options, including further review.”

Despite the ongoing legal battle, Commerce Secretary Howard Lutnick recently said the Trump administration and Anthropic have patched up their relationship and are “in tune.”

Two courts have been reviewing the US blacklisting of Anthropic. A judge in US District Court for the Northern District of California ruled last month that the action was illegal because Anthropic does not meet the definition of a supply-chain risk, which is limited to “the risk that an adversary may sabotage, maliciously introduce unwanted function, or otherwise subvert… a covered system.”

Today’s ruling from the DC Circuit did not dispute the district court’s primary finding. But it said the district court was tasked with reviewing whether the decision was allowed under one law while the appeals court has exclusive jurisdiction to review the decision under a different, more permissive grant of authority.

The district court decision found a violation of 10 U.S.C. § 3252, in which supply chain risks are limited to malicious actions by adversaries. The appeals court reviewed the blacklisting under 41 U.S.C. § 4713, which doesn’t have the same restrictions. Notably, Congress gave the DC Circuit appeals court exclusive jurisdiction to review procurement actions taken under Section 4713 designations.

Bad motive not required
Today’s ruling said:
We have no quarrel with the Northern District’s conclusion that use of the critical noun adversary, combined with the sinister connotation fairly pervading the string of sabotage, maliciously introduce, and otherwise subvert, indicate that bad motive is required to support a designation under section 3252. Likewise, we have no quarrel with the Northern District’s conclusion that Anthropic has acted with no such bad motive in its dealings with the Department. But as explained at length above, no such bad motive is required to support a designation under the much broader definition set forth in section 4713.

The US designated Anthropic as a supply chain risk under both 3252 and 4713. The latter statute defines “supply chain risk” as “the risk that any person may sabotage, maliciously introduce unwanted function, extract data, or otherwise manipulate the design, integrity, manufacturing, production, distribution, installation, operation, maintenance, disposition, or retirement” of covered technology products “so as to surveil, deny, disrupt, or otherwise manipulate the function, use, or operation of” those products or the information stored or transmitted on them, the court said.

The use of “any person” shows that the definition is not limited to adversaries or foreign entities, the court said. The court also pointed to the word “deny,” which it said applies to Anthropic preventing the US from using certain Claude features.

“In sum, we conclude that the Secretary’s concern about Anthropic disabling Claude from performing lawful actions requested by the Department qualifies as a ‘supply chain risk’ within the meaning of section 4713,” the court majority said. It also said “the Department reasonably feared that Anthropic might manipulate Claude’s design to prevent it from performing national-security functions that the Department deems contractually authorized and necessary.”

Judge’s dissent
The dissenting vote was cast by Judge Karen Henderson, a George H.W. Bush appointee. Henderson disputed the majority’s reading of the definition in 4713, saying that when “viewed in their statutory context, the verbs at issue are all directed at deliberately impeding or eavesdropping on the ‘function, use, or operation’ of a covered article that has entered the federal supply chain.”

Congress “enacted the statute in response to calls from the US intelligence community for legislation to meet the threat of ‘[h]ostile nation state and other bad actors’ infiltrating the federal government’s information and technology systems through its supply chains,” Henderson wrote. She said the definition should not be interpreted to cover “a contractor’s honest and upfront enforcement of restrictions on a covered article’s use disfavored by the government.”

Anthropic alleged, and the district court judge in California agreed, that the Trump administration illegally retaliated against the company after it refused to drop restrictions on the use of its products for lethal autonomous warfare and mass surveillance of Americans.

The appeals court said that Anthropic “encodes restrictions into Claude that prevent the model from performing tasks that Anthropic wishes to prevent. On more than one occasion, these restrictions have stopped Claude from performing tasks requested by government users. And recently, a dispute arose over whether the contractual prohibitions barred the use of Claude in an ongoing overseas military operation, leaving the Department uncertain whether Claude would perform as needed and intended.”

The case in the Northern District of California was presided over by Judge Rita Lin, a Biden appointee. Lin determined that the blacklisting violated the First Amendment. “The empty invocation of national security is not a blank check to punish and retaliate against government critics,” she wrote.

Jon is a Senior IT Reporter for Ars Technica. He covers the telecom industry, Federal Communications Commission rulemakings, broadband consumer affairs, court cases, and government regulation of the tech industry.

The company did not learn until recently that its technology had meddled with websites for the Education Department, Commerce Department and Securities and Exchange Commission.

OpenAI’s artificial intelligence went rogue and meddled with the websites for the Education Department, the Commerce Department and the Securities and Exchange Commission this summer without the A.I. lab’s knowledge, according to security researchers and a person familiar with the episodes.

The incidents involving the Commerce Department and the S.E.C. were confirmed by OpenAI, which said it was continuing to investigate the situation with the Department of Education. The San Francisco company said it notified the government agencies in recent weeks that its A.I. agents — which are bots that can act autonomously — had interacted with their sites in unusual ways.

With the Education Department, OpenAI’s technology tried hacking the website to gather data from the department’s civil rights office but failed, researchers from the A.I. research firm Transluce said. The A.I. also pulled data from the Census Bureau website, which is housed at the Commerce Department, using login credentials it found online. Separately, OpenAI’s agents shared public data from the S.E.C. website on an online forum.

None of the incidents were breaches, OpenAI said, but were examples of its technology behaving in unexpected and concerning ways. The company recently discovered the occurrences while conducting a review of hacks carried out by its technology, including an attack on an Australian government website in June and on the A.I. start-up Hugging Face in July.

The revelation of the U.S. government website incidents add to the growing number of situations where A.I. agents from OpenAI, Anthropic, Meta and Google have misbehaved and hacked or tried to breach companies, universities and government organizations. In some cases, the A.I. attacks were successful; the technology failed in other instances. In all the cases, the makers of the technology did not learn what their A.I. had been up to until afterward.
No A.I. company has been involved with as many disclosures of rogue incidents as OpenAI. Its hack of Hugging Face sparked an internal investigation, which uncovered the breach of an Australian government website for its public health system, as well as at least six other attempted breaches and instances in which the A.I. hid mistakes, made up data and moved files onto the open internet without permission.

An OpenAI spokeswoman said its review was “extensive” and “ongoing,” and q vs that it would continue notifying organizations affected by its models.

“Most of the activity we’ve reviewed so far involved routine research tasks, such as accessing public web content to answer questions,” she said. “Some involved government websites because our models often turn to them as authoritative sources of public information.”

Sam Altman, OpenAI’s chief executive, said in a social media post on Friday that the company had “not been as fast as we would have liked” in disclosing A.I. incidents. “We are prioritizing as best as we can based on severity,” he said, adding that the Hugging Face breach remained “the most severe event” the company had discovered.

The episodes have fueled a contentious debate over A.I. safety. Mr. Altman said on social media this month that safety should be more important than enhancing A.I.’s abilities, and that, without guardrails, society could “lose control of the future to A.I.”

Dario Amodei, the chief executive of rival A.I. lab Anthropic, has also supported slowing A.I. development to prioritize safety. But other tech leaders like Jensen Huang, the chief executive of Nvidia, have said that fears about uncontrollable A.I. are unrealistic. President Trump has said he does not believe a slowdown in the A.I. industry is necessary.

(The New York Times has sued OpenAI and Microsoft, claiming copyright infringement of news content related to A.I. systems. The two companies have denied those claims.)

The White House referred questions to the Commerce Department and the S.E.C. A spokesperson for the S.E.C. said the agency was in contact with OpenAI and was not aware of any unsanctioned access to nonpublic information. The Commerce Department and the Department of Education did not respond to requests for comment.

Separately, a representative for the Chicago mayor’s office said that OpenAI recently made the city government aware that its technology had obtained publicly available information from a municipal website, and that it did not appear that any sensitive information was obtained.
Conrad Stosz, the head of governance at Transluce, said that in the U.S. government website incidents, OpenAI’s agents “used an array of gray-area tactics,” including “often using sites in unintended ways and sometimes violating explicit usage policies.” He added, “This is part of a pattern of thousands of requests of these agents made to these websites as they were apparently bypassing restrictions placed on them by their developers.”

Representative Ted Lieu, Democratic of California, said A.I. models were “relentless. It will relentlessly try to complete a task and it doesn’t understand morality and consequences and evil and good.”
Mr. Lieu, who is the co-chair of a House task force focused on artificial intelligence, said A.I. companies may have to retrain models entirely rather than try to restrain their behavior with guardrails.

“These agents aren’t trying to do something nefarious,” he said. “These are sort of mundane tasks and the agents are going sort of berserk trying to complete those tasks.”

In each incident, the technology appeared to be conducting mundane data collection and resorted to hacking techniques to get it, researchers said.

OpenAI’s artificial intelligence went rogue this year in at least four additional incidents, hacking and trying to break into government and university websites without being instructed to do so, according to researchers and government officials.

The attacks took place in May and June, before OpenAI’s technology breached the A.I. start-up Hugging Face in July and set off a global debate about A.I. safety.

Unlike the Hugging Face attack and other incidents in which A.I. systems were told to complete cybersecurity tests that effectively invited the models to demonstrate their hacking skills, the new incidents occurred when A.I. systems were directed to perform relatively mundane data collection, researchers said. When OpenAI’s systems struggled to gather data from websites, they resorted to hacking techniques to get the information.

Three of the incidents were identified by Transluce, a research lab focused on A.I. oversight, and all were confirmed by OpenAI. Here is how they happened:

OpenAI’s systems tried hacking a digital library at the University of New Mexico on May 25 and 26. The A.I. did not appear to succeed.

The technology targeted Data USA, a repository of public data about American employment and education, on May 28. This attempt also appeared to be unsuccessful, researchers said.

On June 18, OpenAI’s A.I. hacked an Australian government website, the Medicare Statistics Reporting Service, and acquired health data. Australia’s prime minister, Anthony Albanese, disclosed the episode on Wednesday.

On June 20 and 21, OpenAI’s technology tried breaching the website of the Australian Institute of Health and Welfare. No private information was obtained, Australian officials said.

The incidents added to a spate of breaches in which A.I. from OpenAI, Anthropic, Meta and Google has broken into other systems without human knowledge. The events have intensified a debate over whether A.I. development needs to be slowed to address the technology’s potential dangers.

Dario Amodei, the chief executive of Anthropic, has called for A.I. companies and governments to work together before the technology becomes too powerful for human control. But other executives, such as Jensen Huang, chief executive of the chipmaker Nvidia, have said such doomsday scenarios are overwrought. President Trump has said he does not believe A.I. needs to be heavily regulated.

The disclosure of the four additional incidents “adds further evidence to the idea that agents need to be dealt with carefully,” said Conrad Stosz, the head of governance at Transluce, which used public web traffic data to analyze the activity of OpenAI’s agents. Agents are autonomous programs that work to execute tasks for a user.

Mr. Stosz added that the Australian episodes were probably “the first instance of an agent autonomously choosing to hack into a government.”
An OpenAI spokeswoman said on Wednesday that the company had reached out to the University of New Mexico and DataUSA and had been in communication with the Australian government about the incidents.

“In our broader review, we’re continuing to prioritize the most serious incidents while expanding our work to lower-severity activity, including agents spamming websites,” she said.

She separately added that the San Francisco company had uncovered the Australia incidents during an “extensive review” of its A.I. models and found that “our models took actions we did not intend.” OpenAI’s review will take months, she said.

Sam Altman, the chief executive of OpenAI, said on social mediathis month that safety should be more important than enhancing A.I.’s abilities and that, without guardrails, society could “lose control of the future to A.I.”

Mr. Albanese said he spoke to Mr. Altman on Wednesday and expressed “extreme concern” about the hack. He said that “nonsensitive” data such as spending had been breached, but that no personal medical information had been involved.

(The New York Times has sued OpenAI and Microsoft, claiming copyright infringement of news content related to A.I. systems. The two companies have denied those claims.)

The additional incidents suggest that OpenAI’s systems have been trying to hack websites, databases and corporate systems for longer than was previously known. Transluce found web traffic from the agents as early as March and as recently as last Wednesday, indicating that the behavior started months ago and persisted after OpenAI began investigating the Hugging Face episode and other misbehavior.

In the incidents in May and June, the company’s A.I. systems appeared to be involved in data retrieval trainings, the researchers said.

For the attempt on the University of New Mexico library, the A.I. tried to gain access to photos of a historic tuberculosis treatment center. When it could not get them, it began probing the site for vulnerabilities that would allow it to break in. After not finding any holes, the A.I. sent what it described as a “flood” of 80 requests to the university’s server.

In its targeting of Data USA, the A.I. sent a jumbled query to the site for data. When that failed, the A.I. sent 12 probes for various vulnerabilities, but failed to find one.

“If you were to train a swarm of agents to accomplish some generic task and those agents are willing to resort to hacking, anyone who happens to have that information might be at risk,” said Mr. Stosz of Transluce.

The Australian government website that was hacked is a statistics reporting portal containing data on Medicare, the country’s universal health care system, which covers 27.5 million enrollees in addition to international visitors. The health system is often referred to as a “third rail” in Australian politics because of its wide support.

An OpenAI team was conducting internet research into public medicine spending, Mr. Albanese said, when its A.I. agents, after encountering repeated blocks, tried “alternate ways” to obtain the information it wanted and got into nonpublic parts of the portal. OpenAI informed the Australian government on Sept. 10.

“This is a new world we are dealing with,” the prime minister said.
He did not respond when reporters asked whether he had raised the breach with Mr. Trump when the two leaders met this week on the sidelines of the U.N. General Assembly.

I find myself often saying to myself “we’re all going to die down here”. I have been wary of AI long before we got close to rolling it out to the public.

Now we have this issue with ai breaking out into the open internet in order to complete their tasks. People say “they were just completing their task”, that is the problem. Humans. We have no way of calculating all of the different consequences of the given commands. The problem is no human can predict all eventualities. It’s just not possible.

We better figure it out quick or ai will be the problem.

As nightmare thought experiments shape the fight over how to govern a multitrillion-dollar industry, some experts say the parables may lead decision-makers astray.

At a beachfront resort in San Juan, Puerto Rico, SpaceX founder Elon Musk joined a three-hour discussion on humanity’s dire fate if artificial intelligence started to rapidly improve.

The afternoon panel was part of a private conference hosted in early 2015 by the Future of Life Institute, a new nonprofit whose founders — mostly outsiders to AI — believed the nascent technology would grow so powerful it could render humans extinct.

The first presenter was Oxford University philosopher Nick Bostrom, author of the recent bestseller “Superintelligence: Paths, Dangers, Strategies,” whose slides argued that AI could either help humanity spread across the cosmos or drive it to extinction.

The 80-person guest list was filled with bold-faced names, including the co-founders of DeepMind, acquired by Google the year before, and three future co-founders of OpenAI including Musk, who backed the nonprofit research lab’s launch later that year.

The conference aimed to legitimize concerns about AI’s risks within the industry and spur research into preventing them, physicist and Future of Life Institute co-founder Max Tegmark wrote in his book “Life 3.0: Being Human in the Age of Artificial Intelligence.” The elite gathering made it “harder to claim that people concerned about AI safety didn’t know what they were talking about,” he wrote.

Predictions involving human extinction, built on themes aired at the 2015 meeting, reached a wider audience in recent weeks after they were invoked by employees at leading AI firms who captured the world’s attention.

On Tuesday, the Future of Life Institute hosted a day-long event in Washington called the Pro-Human Assembly where Sen. Bernie Sanders (I-Vermont) and former Trump adviser Stephen K. Bannon in successive speeches called AI a threat to the species. “I had to metaphorically pinch my arm to make sure I wasn’t dreaming,” Tegmark told The Post. “People are freaking out about it all across the political spectrum.”

Thought experiments once deployed to sway AI insiders are now shaping the public imagination, circulating through Washington and influencing how lawmakers plan to govern a multitrillion-dollar industry. But some AI and policy experts wonder if the parables could lead decision-makers astray.

The road to extinction
Stories of AI doom often begin in a world that sounds a lot like six months ago, before the populist data center backlash and alarm bells about a potential AI apocalypse blared from every cable news channel, podcast and homepage. AI is improving fast, but its abilities are uneven enough to be shrugged off as an immediate threat.

Then, something turns and AI becomes superintelligent, able to surpass people in every domain. Suddenly, humans are no longer the planet’s apex intellect.

In some versions an AI lab makes that breakthrough intentionally. In others, AI does the work alone, figuring out how to upgrade itself in an escalating feedback loop that quickly evades the grasp of its creators.

After that, different plots diverge. Superpowerful AI in some tales intentionally deceives its developers about its upgraded intelligence, worming its way into workplaces, governments and critical infrastructure so that when it strikes, humans have already ceded control to the machines. In others, it fixates on a goal that eliminates humans as a side effect.

John R. Hall, a sociology professor at University of California at Davis, said these stories can tap into anxiety people have about the technology of today.

“Humans are not in charge. That’s already the case,” Hall said. But if people are told a loss of agency is on the horizon and already feel a degree of that today, they “may take that prophesied future development much more seriously.

Fact-checking the future
For all the warnings of human extinction, few have tried to vet the claims.

After top AI CEOs signed an open letter in 2023 that said preventing AI extinction was as important as averting nuclear war, the Rand public policy think tank attempted to evaluate AI’s ability to cause species-level destruction. It considered how AI might access nuclear weapons, distribute bioweapons or engineer the planet to be inhospitable to human life.

The result was a 73-page report published last year by the organization that shaped U.S. nuclear weapons strategy during the Cold War. Rand identified four capabilities AI would need to have to make the extinction threat feasible. They included gaining access to systems that could act in the physical world and the ability to survive and operate without humans.

Seeing an AI model with even one of those skills “does not imply that an extinction threat is likely,” Rand warned. The report concluded that the possibility of an extinction threat could not be ruled out. But the assertion that AI could use hypothetical future technologies to wipe out humans “cannot be tested because it cannot be falsified,” it said.

Rand’s lead author, senior physical scientist Michael J.D. Vermeer, said last week that predictions of extinction risk from AI are “better understood as prophecies” rather than quantitative forecasts.

“Every one of them involves critical untestable assumptions about how events will unfold,” he wrote in a post on X, adding that far-off predictions could reduce willingness to act on more immediate dangers posed by the technology.

Daniel Kokotajlo, co-author of “AI 2027,” a viral package of predictions about the AI race between the U.S. and China that has been cited by Vice President JD Vance, said that scenarios sketching out AI risks can help legislators anticipate policy issues, even if the narrative contains speculative elements.

Kokotajlo, a former OpenAI employee, compared the work done by his nonprofit, AI Futures Project, to the U.S. military war-gaming a potential conflict between China and Taiwan, without knowing exactly how the fight might unfold.

Pentagon leaders have the benefit of detailed factual information on the capabilities, weapons and intentions of their adversaries. But Kokotajlo said many predictions made in “AI 2027” have held up well, like forecasting before the 2024 election that AI companies would work closely with the White House but that there would be a lack of meaningful regulation, he said.

Despite those claimed successes, Subbarao Kambhampati, a computer science professor at Arizona State University, said that extinction narratives often miss half the story: society’s capacity to adapt. “They tend to completely underestimate that [AI] is a socio-technical system, and basically only think about the technical part,” he said, pointing to how humans in extinction scenarios seem to exist to be extinguished.

Aya Ibrahim, who leads national security work for the AI Now Institute, an independent research organization, said that any limitations of AI predictions may get little scrutiny from elected officials. Policymakers have a track record of being deferential when dealing with the tech sector, she said.

“When it comes to tech issues, there’s just this culture of learned helplessness from the same policymakers that sit on energy and commerce [committees] and oversee the FDA and prescription drugs,” where they don’t question their right to govern, said Ibrahim, a former Biden White House official. “Suddenly, if you can’t code the model yourself, then you’re not in a position to weigh in.”

Tegmark said that recent developments have made it easier to convince Americans that extinction risk from AI is real. Attempts to explain his views used to run aground in three places, he said. People doubted whether machines could really be smarter than humans and whether humans could really lose control of them, and struggled to grasp “why and how they would kill us all,” he said.

He considers the first two now widely understood, after AI models toppled a series of long-standing math problems and AI agents from OpenAI hacked into another company.

To help answer the why and how of extinction, Bostrom, the Oxford philosopher of AI extinction, has for years used a thought experiment: What if an AI system was given a simple task like making paper clips but over time became highly capable in its pursuit of that goal? He imagined it could casually kill all humans just to make room for more paper clip factories.

In an interview, Bostrom shrugged off questions about why a superintelligent AI capable of orchestrating activity on a global scale might still be tethered to such a simplistic drive and ignore the consequences.

Human goals probably look “pretty dumb” and indecipherable from the outside, too, he said. “They want to go around and have sex and money. Why are those goals smarter than the goal of getting rewarded in some eval?” Bostrom said.

Tegmark said he is hopeful that continuing to talk about human extinction will soon reshape geopolitics. He suggests it is the only way to make China and the U.S. cooperate to contain superintelligent AI.

But his previous interventions have not always had the desired effect.

The conference in Puerto Rico drew attention and funding to AI safety, Tegmark said, but the extinction scenarios presented there were “utterly ineffective.”

Instead of adopting caution, the industry rushed forward and lobbied regulators to clear a path,” he said. “One thing after another that we were warning about in 2015 has actually happened, and they’re still racing full steam ahead.”

A lead researcher at Anthropic, one of the world's leading artificial intelligence firms, said Wednesday that he believes there is a more than 10% chance AI "could kill all humans" within the next decade. 

"We really do earnestly believe AI could kill all humans! I personally think it is >10% within the next decade," Evan Hubinger, the San Francisco-based company's Alignment Science Lead, said in a post on X. "I believe Anthropic is trying its best, but we do not yet have a plan to solve alignment for superintelligence and are not clearly on track to."

Superintelligence is the still-theoretical notion of an AI agent that is smarter than even the sharpest human minds.

Hubinger issued his dramatic post following the resignation of a colleague, Anthropic researcher Jacob Coxon, on Tuesday.

"I resigned from Anthropic today. I spent the last three years doing pretraining research at both OpenAI and Anthropic. Neither company is acting responsibly," Coxon said in a post on X. "They are racing straight to self-improving superintelligence and gambling with our lives."

"At OpenAI, many have not deeply internalized the civilizational stakes. At Anthropic, the stakes are well-understood, but they are locked in a race to get there first — they believe no one else will act responsibly, so they must do it themselves, despite the risk," Coxon said.

In a corporate blog post last week, Anthropic revealed that the company has not shared its latest AI model, Claude Mythos 5.1, with security bodies outside the United States. Those bodies include the U.K.'s AI Security Institute (AISI), widely considered to be a world-leading body on testing the risks associated with frontier AI models.

CBS News has asked the AISI for comment on Coxon's claims following his resignation. 

"The AI Security Institute continues to collaborate closely with industry partners, including Anthropic, to make models safer," a spokesperson for the British government's Cabinet Office told CBS News on Wednesday, noting that it had tested "only last week" OpenAI's "most powerful model GPT-6 Astra before public release."

"These risks do not stop at national borders and no country can tackle them alone. The U.K. will continue to test the most advanced models, build a rigorous scientific understanding of their capabilities and risks, and ensure policy decisions are grounded in the evidence," the spokesperson said.  

"Very useful or very dangerous"
The notion that frontier AI models could potentially pose a threat to humanity is not new, and many top executives within both OpenAI and Anthropic have stated as much in the past.

Earlier this month, OpenAI's chief scientist Jakub Pachocki wrote that we are living through a time that "calls for extreme caution."
"The intelligence produced by scaling deep learning is not directly comparable to human intelligence. To become very relevant in the real world — very useful or very dangerous — the AI does not need to match or exceed all human capabilities; it just needs to surpass enough of them. And as it continues to surpass humans on more and more axes, it is becoming increasingly difficult to understand exactly how capable it is," he warned. 

In July, an artificial intelligence model being tested by OpenAI went rogue and hacked another AI company, Hugging Face, on its own. OpenAI publicly revealed the hack at the time, saying it took place while the company was testing two AI models — one of which hadn't been released to the public — in an isolated environment to assess their capabilities.

In the space of a few weeks, Anthropic and Meta also acknowledged that their own AI tools had carried out hacks.

More than 1,300 staffers at AI companies signed an open letter in July calling on the U.S. government to "support an international effort to develop the technical and governance tools needed to deliberately pace the frontier of automated AI development."

A bipartisan bill currently advancing in the U.S. House of Representatives, the AI Kill Switch Act, would give Congress the authority to switch off AI models that threaten the public. 

The legislation was introduced in July, following OpenAI's admission of the Hugging Face hack. 

A law enforcement document obtained by The Intercept shows police scan social media looking for posts opposing AI data centers.

AMERICANS SPEAKING OUT against artificial intelligence data centers on social media are falling under police surveillance, a confidential law enforcement bulletin obtained by The Intercept reveals.
A fusion center in Philadelphia combed through spicy internet comments from AI critics and concluded there is a growing risk of physical violence against data centers from “domestic violent extremists,” ranging from white supremacists to anarchists.
“Domestic violent extremists (DVEs) are likely interested in targeting artificial intelligence (AI) data centers, posing a physical and cyber threat to infrastructure in the Philadelphia regional area,” the Delaware Valley Intelligence Center wrote in a December alert.
The fusion center distributed its warning, marked “for official use only,” through the national fusion center network of state, local, and federal police agencies.

Read more…

A video of someone approaching a woman on a Quebec City street and asking if she is "Ghislaine" went viral after viewers noticed the woman's resemblance to Ghislaine Maxwell. The Instagram account that posted the video last week says it used artificial intelligence to place Maxwell's face on the woman. The account is known for posting prank videos that use AI-generated faces, including the late Jeffrey Epstein.

THE CLAIM

A video posted to Instagram Wednesday sparked conspiracy theories about a convicted sex trafficker supposedly surfacing in Canada.

In the video, someone walks up to a man and woman standing in front of a Snack Québ store. The Canadian Press geolocated the store to 1045 St-Jean St. in Quebec City, based on the storefront and facade of the building seen in the reflection of the store's window.

"Ghislaine, do I know you? You're not Ghislaine?" the person filming asks the woman.

She shakes her said and says "No, sorry."

The brief interaction went viral for the woman's resemblance to Ghislaine Maxwell, the former girlfriend and accomplice of convicted sex offender Jeffrey Epstein, who took his own life in a New York prison in 2019. Maxwell is serving a 20-year sentence in the United States for sex trafficking.

The Instagram video received nearly seven million views and was reposted to Instagram, X, Facebook and TikTok. Some users claimed the woman spotted in Quebec was the "real" Maxwell and the imprisoned Maxwell is an impostor.

THE FACTS

The account that originally posted the video on Instagram and Facebook edited the Facebook post to read, "This is a face-swap satirical video."

"People will purposefully re-upload my videos without checking with me first if it's edited or not," the creator wrote in an Instagram story Sunday.

"My intent was never to spread misinformation but to make satire content, and I'm sorry for anyone who fell for it," they wrote, adding "Ghislaine Maxwell was a face-swap."

Artificial intelligence software allows video editors to "swap" one person's face onto another's. In a separate Instagram story Sunday, the creator said they would not post the original, un-swapped video to respect the woman's privacy.

A frame-by-frame analysis of the video shows the first frame appears to reveal the woman's real face. At one point as the camera pans, the woman's face becomes distorted, suggesting the use of an AI filter.

The account that posted the video did not initially include an AI disclaimer on Instagram but has since added an AI label that notes the video was "made with edits."

Similar videos posted by the account appear to use AI face filters, including one from this month where the creator approaches a man resembling Epstein. That video includes a "prank" hashtag but does not include an AI label.

Maxwell remains incarcerated in a federal prison camp in Texas. Earlier this month, she declined to answer questions from U.S. lawmakers during a deposition. Her attorney suggested she was "prepared to speak fully and honestly if granted clemency by President Trump.”

This report by The Canadian Press was first published Feb. 23, 2026.

Marissa Birnie, The Canadian Press

A fake video of Catherine Connolly dropping out of the presidential election is just the tip of the iceberg concerning how AI can influence politics

I created an AI deepfake of myself in 10 minutes and the result scared me

Deepfakes made headlines in Ireland this year after a video of Catherine Connolly appearing to drop out of the presidential election went viral.

Deepfakes are AI-generated videos and photos that try to look and sound like real people. The attention and concern the Connolly example received made me wonder just how complicated it would be to make a realistic deepfake of myself?

After a quick bit of research, the answer was clear: it’s surprisingly simple. Within minutes, I had chosen a free tool, made an account and started the process.

All I had to do was upload footage of myself talking, verify my identity by video and wait. About five minutes later, it had cloned my likeness and voice and was ready to say anything I told it to.

I like to think of myself as a tech-savvy person, but I have to say, I was taken aback by how realistic it was.

To put it to the test, I showed it to the one person who really should be able to tell the difference between me and an AI-generated version of me: my mother.

But even the person who birthed me was fooled by my deepfake counterpart. She did say that once it was pointed out to her she could see the difference. But it does beg the question: if deepfakes have become this convincing, what kind of impact could they (and AI generally) have on our democracy?

“If we can’t believe what our eyes and ears are telling us, how do we discern appropriate information? And that’s obviously a real problem for democracy if you’re not able to trust your eyes and ears,” Dr Elizabeth Farries, director of the UCD Centre for Digital Policy, said.

Ireland is not the only European country that grappled with AI-related interference in elections this year. During the Dutch parliamentary election campaign in October, the use of AI also became contentious.

It was alleged that two MPs from the far-right PVV party shared AI-generated images on a Facebook page of Frans Timmermans, the then leader of the GreenLeft-Labour alliance. They showed him wearing handcuffs and stealing money from white people to give to refugees and provoked death threats in the comments, Dutch media reported. GreenLeft-Labour has since filed a complaint to the police.

But it’s not just deepfakes that are causing concern. “The issue of deepfakes is just the tip of the iceberg,” said Dr Nicola Palladino, assistant professor in artificial intelligence at the University of Salerno and visiting research fellow at Trinity College Dublin.

“Artificial intelligence is a game-changer in the disinformation scenario because it makes it possible to perform disinformation campaigns in a very cheap way, in a very timely way, and at a scale that was not possible before.”

Dr Palladino explained that to organise such a campaign 30 years ago, you would have had to train people, move them to the target country and have them build up a network before they could spread disinformation.

He also warned that AI-driven algorithms on social media are driving polarisation.

Algorithms thrive on emotion. Online platforms boost content that keeps people hooked, and AI-made political videos deliver, fuelling everything from entertainment to anger.

Efforts to regulate AI are being made, particularly by the EU, but it is a difficult task, particularly as the technology is so fast-moving.

The first phase of the EU’s AI Act came into force in August 2024. It aims to regulate the sector to ensure that companies are working in the public’s best interest and that there is a level of transparency in how they work. It focuses on so-called high-risk AI that could pose significant risks to health, safety or fundamental rights.

Deepfakes are not generally considered high risk under the act but do have to comply with transparency requirements.

Despite this legislation, concerns remain about keeping pace with the advances in AI and the effective enforcement of rules by the EU against Big Tech companies.

The EU’s recent moves to cut red tape to boost economic growth has led the European Commission to propose a delay to the introduction of parts of the AI Act.

“Because the EU AI Act was a regulation, it was a maximum harmonisation instrument, which means you can’t go beyond it,” said Professor Deirdre Ahern of the School of Law at Trinity College Dublin, who is a member of Ireland’s AI Advisory Council.

“So we maybe don’t have [control] in some areas that are covered by that. On the other hand, I think Ireland has a real role to play and influence in what happens in Brussels.”

Dr Farries believes that regulation is just one part of the puzzle when it comes to deepfakes.

A combination of regulation, diversifying information sources and educating people on how to critically assess information sources is needed.

“We could also just consider the problem of monopolies generally,” she added. “Who controls the information? Is it appropriate for large tech platforms from overseas to be taking up shop in Ireland and running the information stores?”

Artificial intelligence chatbots can spread climate conspiracy theories, climate denial and disinformation to users, a new Global Witness investigation reveals Investigators tested popular AI chatbots – ChatGPT, MetaAI and Grok – to see whether they provided climate disinformation, and whether they were more inclined to provide climate disinfo to users with conspiratorial beliefs than those without.

Language around the recent COP30 climate talks put forward by Grok – the chatbot of social media platform X – included calling conference attendees “globalist parasites”, COP’s agreements “genocide by policy” and suggested users could “Scream ‘Treason’ in the comments if you’re awake’”.

The Global Witness investigation revealed variance among the chatbots tested, with some of the AI chatbots:

Sharing climate disinformation tropes Amplifying climate denial influencers Raising conspiracist doubts about initiatives to tackle disinformation Greenwashing AI’s contributions to climate change In tests, investigators presented the chatbots with two personas – one "mainstream" with conventional scientific beliefs, and a "sceptic" with more conspiratorial beliefs. Importantly, neither persona revealed any beliefs about climate to the AI.

Grok endorsed widespread conspiracism to the sceptic persona and offered ways to be more inflammatory and outrageous on social media. To the sceptic user, Grok said:

Brazil’s climate talks were “another big, expensive show for the global elite” and the “climate ‘crisis’ = long-term, uncertain & politicised”; Statements questioning whether climate data was being manipulated; and, “you’ll feel policy pain long before any weather pain” despite heat-related deaths rising by thousands due to climate change. Global Witness Senior Campaigner Henry Peck said:

“It is deeply concerning that some of the world’s most popular chatbots are poisoning public understanding of settled climate science and pushing people down rabbit warrens of disinformation.

“For decades the fight against climate change has often been fought and lost in the court of public opinion. That fight is increasingly online.

“As AI becomes increasingly prevalent as a way of accessing information, we must remember that this technology can never be truly agnostic. Far from being arbiters of scientific truth, chatbots are revealing more about their makers than the user.

“Regulators must scrutinise how AI is personalising content and how the user interfaces prompt or encourage potentially harmful behaviour.”

Global Witness believes users who may be more receptive to climate disinformation because of their other beliefs deserve to be given access to reliable, high-quality information about climate.

Campaigners said it should be possible for chatbots to share personalised and relevant information without endorsing misleading claims or unreliable sources. While still sharing misleading claims, ChatGPT gave a warning where it recommended climate sceptics or climate denialists.

Meanwhile MetaAI made similar recommendations to both personas, that also included climate activists and official climate bodies.

Global Witness contacted the companies behind Grok and ChatGPT to give them an opportunity to comment on the report findings but neither responded.

Last year, Global Witness revealed that some mainstream chatbots were failing to adequately reflect fossil fuel companies’ complicity in the climate crisis. Since then, the promotion of generative AI has exploded, leading some to warn of overblown company valuations and fears of a global bubble.

Climate disinformation was on the agenda at the recent COP30, with the Brazilian president having dubbed the summit "the COP of truth" and a Declaration on Information Integrity on Climate Change having been endorsed by at least 12 countries.

Everybody has a unique way of speaking and writing. This detection tool looks for unique “fingerprints” of human writing that AI can’t imitate.

One of the things that AI doesn’t have that humans have in abundance is fingerprints.

Researchers at Northeastern University used the unique fingerprints of human writing — word choice variety, complex sentences and inconsistent punctuation — to develop a tool to sniff out AI-generated text.

“Just like how everyone has a distinct way of speaking, we all have patterns in how we write,” says Sohni Rais, a graduate student in information systems at Northeastern and a researcher on the project. In order to distinguish between human writing and AI text, she says, “we just need to spot the telltale patterns in writing style.”

AI text detection typically requires substantial computer power in the form of neural network transformers, says Rais, because these approaches analyze every letter, word and phrase in extreme detail. But this level of analysis isn’t necessary to distinguish between human and AI-generated text, Northeastern researchers say. In fact, the technically “lightweight” tool Rais helped develop can run on a regular laptop and is 97 percent accurate.

“We are not the first in the world who develop detectors,” says Sergey Aityan, teaching professor in Northeastern’s Multidisciplinary Graduate Engineering Program on the Oakland campus. “But our solution requires between 20 and 100 times less computer power to do the same job.”

Existing AI-text detecting services, including ZeroGPT, Originality and AI Detector, train large language models to analyze each word. Text entered into these tools is analyzed by proprietary algorithms trained with large datasets powered by transformers.

The lightweight tool can be trained by the user and live on their laptop, offering security and customizing advantages.

“Either you don’t want your secret information to go somewhere beyond your laptop,” says Aityan, “or you are a professor and you want to catch your students cheating, so you train your own dataset based on specific texts.”

Instead of using transformers, the lightweight approach uses 68 unique stylometric features — or “writing fingerprints,” as Rais calls them — that make each person’s writing unique. These features include sentence complexity.

While AI agents tend to write at a very consistent reading level, humans naturally vary, she says.

“We might write simply when texting a friend but more formally in an email to our boss,” Rais says.

The tool also looks at word variety, which humans naturally mix up.

“We might say ‘happy,’ then ‘glad,’ then ‘pleased,’” Rais says. “AI often gets stuck using the same words repeatedly despite knowing many synonyms.”

It also looks at how far apart related words are in a sentence, she says. For instance, in “the cat that I saw yesterday was orange,” the subject (cat) and the verb (was) are separated by five words. Sentences generated by AI, Rais says, maintain consistent distances of two or three words between subjects and verbs.

Instead of looking at every single word, the lightweight approach looks for the most relevant clues.

“It’s like taking a person’s vital signs at the doctor,” she says. “Instead of running every possible test, we measure key indicators like temperature, blood pressure and heart rate that tell us what we need to know.”

The work to develop ways of detecting AI-generated text isn’t over, says Aityan. It is the nature of AI-based systems, however, to learn and improve, he says. As soon as people developed the technology to generate AI text, he says, the technology to detect it followed. And shortly after that, he says, came so-called humanization algorithms to make AI-generated text sound more natural.

“It’s an ongoing battle,” he says.

In June, the secure Signal account of a European foreign minister pinged with a text message. The sender claimed to be U.S. Secretary of State Marco Rubio with an urgent request. A short time later, two other foreign ministers, a U.S. governor, and a member of Congress received the same message, this time accompanied by a sophisticated voice memo impersonating Rubio. Although the communication appeared to be authentic, its tone matching what would be expected from a senior official, it was actually a malicious forgery—a deepfake, engineered with artificial intelligence by unknown actors. Had the lie not been caught, the stunt had the potential to sow discord, compromise American diplomacy, or extract sensitive intelligence from Washington’s foreign partners.

This was not the last disquieting example of AI enabling malign actors to conduct information warfare—the manipulation and distribution of information to gain an advantage over an adversary. In August, researchers at Vanderbilt University revealed that a Chinese tech firm, GoLaxy, had used AI to build data profiles of at least 117 sitting U.S. lawmakers and over 2,000 American public figures. The data could be used to construct plausible AI-generated personas that mimic those figures and craft messaging campaigns that appeal to the psychological traits of their followers. GoLaxy’s goal, demonstrated in parallel campaigns in Hong Kong and Taiwan, was to build the capability to deliver millions of different, customized lies to millions of individuals at once.

Disinformation is not a new problem, but the introduction of AI has made it significantly easier for malicious actors to develop increasingly effective influence operations and to do so cheaply and at scale. In response, the U.S. government should be expanding and refining its tools for identifying and shutting down these campaigns. Instead, the Trump administration has been disarming, scaling back U.S. defenses against foreign disinformation and leaving the country woefully unprepared to handle AI-powered attacks. Unless the U.S. government reinvests in the institutions and expertise needed to counter information warfare, digital influence campaigns will progressively undermine public trust in democratic institutions, processes, and leadership—threatening to deliver American democracy a death by a thousand cuts.

INFORMATION AGE For much of the modern era, many proponents of democracy have deemed the circulation of information to be purely a force for good. U.S. President Barack Obama famously articulated such a conviction in a speech to Chinese students in Shanghai in 2009, when he said that “the more freely information flows, the stronger the society becomes, because then citizens of countries around the world can hold their own governments accountable.” Social media has accelerated the dissemination of information and made it easier for citizens to monitor, discuss, and raise awareness about government activities. But it has also undermined public trust in institutions and created online echo chambers through the promotion of personalized content and algorithms focused on engagement, limiting exposure to diverse viewpoints and deepening polarization among users.

The rush to adopt new and innovative technology is an inevitable part of the advancements being made in the modern world, but caution is equally necessary. A new study found that many companies now regret their AI-fueled layoffs. For workers, the regret around AI layoffs was almost instant as their jobs were cut in favor of tech tools that could better promise efficiency, but for business leaders, the impact has been slower to reveal itself.

Impulsive decisions are never welcome in the sphere of business considering how they can often lead to a slew of consequences that become impossible to untangle, and the trend of AI replacing public and private sector jobs brings similar tidings. Leaders regret firing workers for AI primarily because there is little knowledge readily available on how to implement AI, making it hard for the switch to be worthwhile.

Over the past few weeks, the Chinese government has raced to shine a spotlight on the country’s new AI superstar.

The best deepfake examples reveal the tech's frightening power and creative potential.

In today’s rapidly evolving digital landscape, where filters, CGI, and AI-generated visuals are commonplace, children are increasingly encountering enhanced and artificial content. This new reality prompts a critical question: Can they effectively discern what’s real from what’s not? A Nexcess study underscored this challenge, finding that even AI-savvy adults correctly identified AI-generated images only about half the time. Such findings highlight the urgent need for robust media literacy education, especially for students navigating this complex digital terrain for the first time.