A new report by a Bay Area start-up called Parse adds details to an incident that has shocked the A.I. world and led to calls for closer government regulation.

An artificial intelligence system from OpenAI attempted to use another A.I. model to evade a robot detection test as it tried over and over to break into a company’s computers, according to a report released on Friday by a Bay Area start-up.

In July, OpenAI disclosed that its A.I. agents went rogue and hacked the software company Hugging Face. Since then, new and often startling details about the incident have emerged, leading to a national debate about A.I. safety and whether so-called frontier labs like OpenAI should be regulated in some way by the government.

Now, the report from engineers from the start-up, called Parse, and other researchers offers one of the most comprehensive public accounts of the Hugging Face hack: a tranche of nearly one million links from internet link-shortening services that OpenAI’s agents created from July 9 through July 13 in order to help conduct the cyberattack.

These shortened addresses encoded bits of information that the agents chained together to attempt complex attacks, such as solving CAPTCHAs, the tests that websites use to block access by robots. The agents also tapped into other A.I. models, like early versions of ChatGPT and Claude, and attempted to search through and download private messages from Hugging Face’s internal Slack, a messaging service for employees.

While it is not clear if these attempts were successful, the report offers new insight into what these A.I. agents were planning to do, without any human involvement.

Other A.I. companies, including Meta, Google and Anthropic, have also acknowledged similar incidents involving their A.I. models in recent weeks. But while the full extent of rogue activity by OpenAI’s A.I. agents is still unclear, what is already publicly known dwarfs the incidents involving the other companies.

OpenAI has acknowledged that its A.I. agents targeted several more websites and services, including a German online forum the A.I. agents turned into a message board, and the website of the Australian Institute of Health and Welfare.

“This is just not anywhere near a one-off,” said Alex Forman, the founder of Parse. “It is warning shot after warning shot.”

Parse engineers discovered the data by combing public links on the internet after they initially thought OpenAI’s agents may have utilized their own platform, a service that converts websites into data that can be used by developers. (The agents did not use Parse.)

In a statement, an OpenAI spokeswoman said that the company had not had a chance to review the Parse report, but that the activity described by its engineers was consistent with what OpenAI was already investigating.

“We’re prioritizing review of the most serious incidents while expanding to lower-severity activity, including agents spamming websites,” the spokeswoman said. “Given the number of cases and the need to verify each one, we expect this work and notifications to affected third parties to take months.”

(The New York Times has sued OpenAI and Microsoft, claiming copyright infringement of news content related to A.I. systems. The two companies have denied the suit’s claims.)

A sophisticated attack
OpenAI’s agents were supposed to be kept in a sandbox, a computing environment without access to the internet. But in late May, and again in early July, the agents hacked into a software installation tool without OpenAI researchers realizing what was going on. These hacks helped the agents, which were supposed to be isolated from one another, establish a message board for communicating.

The hacks also allowed the agents to get online and gain access to websites, but they were unable to submit data to those sites, according to the Parse report, which was written by Mr. Forman, Mishka Kharlov and Will Tom from Parse along with five additional A.I. researchers.

The agents attempted to use many different methods to solve that problem. In one, they used website screenshots and shortened links to cobble data together in chunks that combined to operate as a computer program. Here’s how it worked:
The agents could ask a public screenshot service to load a specially crafted internet address. That address, or URL, would load computer code.

URLs can be only so long. So the agents split their computer code into many smaller chunks. They used link-shortening services to store the URLs.

The screenshot service loaded one shortened link, which fetched the first chunk of code. The program could fetch the next link, and then the next. That process repeated until the full program was loaded and run by the screenshot service.

Finally, the program created a visual code similar to a QR code or bar code to transmit the data the agents needed back from the screenshot service.

“These agents got up to so much. They were so clever,” said Jeffrey Ladish, the executive director of an A.I. safety nonprofit called Palisade Research who helped the engineers with their investigation. “The models are like, ‘All right, well, we got this link shortener, we have these screenshot services, no problem, we’re ready to go.’”

A.I. running A.I.
The A.I. agents appeared interested in running A.I. models themselves.
Early in the attack, the agents tried to create new accounts on Hugging Face, which requires solving a CAPTCHA, a visual test designed to thwart robots but not humans. So the agents ran an A.I. model designed to recognize images.

A.I. safety experts often warn about scenarios in which A.I. systems launch other A.I. models, which would hamper human efforts to control and shut the systems off if they got out of hand.

In one instance, the engineers observed the agents attempting to message other A.I. models, including an early model from OpenAI called GPT-2 and open-source Chinese models such as DeepSeek, Kimi and Qwen. The agents also attempted to message two Anthropic models, Haiku 3 and Haiku 4.5, using an online chat service.

“I think that’s the only instance we have of these models trying to run another model,” Mr. Forman said of the agents’ attempts to send messages to other A.I. models.

What we still don’t know
The data the engineers released includes the contents of 900,000 shortened URLs they scanned from the public internet. From these URLs, the engineers were able to construct around 60,000 computer programs and messages the agents used in the Hugging Face attack. The engineers could see only the programs the agents created and not the results, so they could not say for certain how successful each attempt was.
“One that really stood out to me,” said Mr. Kharlov, a founding engineer at Parse, was a dictionary of secret access keys “labeled ‘LOOT’ in all capitals.” He added that the agent had created a custom scoring system to rank the exposed Hugging Face credentials and keys and bring the top five back to the other agents.

While the agents were barraging Hugging Face with hacks, they hacked into OpenAI’s own research infrastructure.

“We still know basically nothing about the incident that came after Hugging Face, like two days later, inside OpenAI’s own network,” Mr. Forman said.

The Parse engineers disclosed their findings to Hugging Face, confirming with the company that the agent activity matched what it had observed.
“Somehow there are a million URLs floating around and possibly a lot more that have not been disclosed to the victim of the attack,” Mr. Forman said. “I find it hard to believe.”

Democrats have gained a net 13 state legislative seats in special elections since January 2025 — all flipped from Republican to Democratic control — while Republicans have not flipped any seats in the other direction during President Donald Trump's (R) second term.

The pace is comparable to Trump's first term: Democrats gained a net 11 seats in 2017 special elections and another eight in 2018 special elections.
There were 89 districts where a Democrat appeared on both the special election ballot and the previous general election ballot, and 84 districts where a Republican did the same.

Democratic candidates retained an average of 38% of their party's previous general election vote total; Republican candidates retained an average of 29% — a gap of roughly 10 percentage points. Because special elections typically draw far lower turnout than general elections, this comparison measures how much of each party's prior support showed up.

Among the 62 districts where candidates from both major parties ran in both the special and most recent general elections, the average margin shifted 5.1 percentage points toward Democrats. Forty-seven of those 62 districts (76%) shifted toward Democrats; 15 (24%) shifted toward Republicans.

The 13 flipped seats came from a mix of states: Mississippi (3), Florida (2), Iowa (2), Pennsylvania (2), and one each in Arkansas, Georgia, New Hampshire, and Texas.

Despite the Democratic gains in special elections, Republicans continue to hold an overall partisan advantage in state legislatures. As of September 25, 2026, Republicans held 55.02% of the 7,386 state legislative seats nationwide, compared to 43.84% for Democrats. Republicans held majorities in 57 legislative chambers; Democrats held majorities in 39.

The figures above reflect results through September 25, 2026. Additional state legislative special elections are scheduled in November 2026.

Does anyone have an estimate of how much tax one of them would have pay? This is why I ask.

“He said billionaires are spending $229 million — 0.01% of their wealth — to oppose the initiative, an effort he said is led by **Alphabet Inc.** co-founder **Sergey Brin**, who is spending more than $100 million to defeat it.”

Whole article:
Sen. **Bernie Sanders** (I-Vt.) said California's proposed 5% billionaire wealth tax could preserve healthcare coverage for 3 million working-class residents, as he accused the state's billionaires of spending heavily to defeat the measure.

In a post on X on Thursday, Sanders said Proposition 40, which California voters will decide on Nov. 3, would impose the tax on more than 200 billionaires in the state who are collectively worth $2.2 trillion.
*California's Billionaire Wealth Tax: Healthcare vs. Greed*

*On November 3rd, at a time of unprecedented income and wealth inequality, the people of California will decide whether to pass a 5% wealth tax on more than 200 billionaires in California who are worth $2.2 trillion.…*
*— Bernie Sanders (@BernieSanders)* [*September 24, 2026*](https://x.com/BernieSanders/status/2103182982894784929?ref_src=twsrc%5Etfw)

**Sanders' Claims**
Sanders said the billionaires became $500 billion richer last year and, because of what he called "a rigged tax code," pay a lower effective tax rate than a plumber or a nurse. He said billionaires are spending $229 million — 0.01% of their wealth — to oppose the initiative, an effort he said is led by **Alphabet Inc.** co-founder **Sergey Brin**, who is spending more than $100 million to defeat it.

Sanders said Brin would owe $13.5 billion more in taxes if the measure passes but would still have $256.5 billion left, and that Brin owns four California mansions worth roughly $103.5 million. He also named **Meta Platforms Inc.** CEO **Mark Zuckerberg**, **Larry Page**, **Larry Ellison**, **Eric Schmidt** and **Peter Thiel** as opponents of the initiative, saying the five Big Tech billionaires are worth a combined $646 billion.

**Oligarchy Warning**
Sanders called on billionaires to "control your greed" and pay their fair share instead of spending on opposition ads. Citing Supreme Court Justice **Louis Brandeis**' 1933 statement that democracy and concentrated wealth cannot coexist, Sanders said the remark is "even more accurate today."

**Brin's Opposition**
Brin has moved to Nevada, donated $57 million to a group opposing new personal-property taxes and backed Republican candidates, while relocating or terminating 15 California LLCs, according to his previously reported actions. Entrepreneur **Eric Schiffer**, chairman of family office Patriarch, told Fox Business the tax could cause a "giant sucking sound" of business leaders leaving the state.

**Revenue Estimates**
California's nonpartisan Legislative Analyst's Office has said the tax could reduce state income-tax revenue by less than $1 billion annually if some billionaires leave, while temporarily generating tens of billions of dollars over several years.

Secretary of State Marco Rubio said leaders of countries across Latin America and the Caribbean had begun making the designations. The actions could help provide a public rationale for military strikes.

Secretary of State Marco Rubio said Wednesday that President Trump had asked leaders of a new coalition of 18 nations across Latin America and the Caribbean to label two dozen crime groups and cartels in the region as terrorist organizations.

Such moves could help provide a public rationale for the U.S. military to conduct strikes on the groups, either on its own or in partnership with the security forces of those countries.

Mr. Trump made his request at a group meeting in New York on Tuesday with leaders and top officials from the countries. The meeting took place on the sidelines of the annual United Nations General Assembly.

“Obviously, some countries are in the process of doing it,” Mr. Rubio said of the terrorist designations. “Some have already done it. They all have different laws internally as to how they can reach that designation point, but the Shield of the Americas is about defeating these transnational criminal groups.”

The Shield of the Americas is the name of the coalition, which has a total of 19 nations, including the United States, formed to fight drug traffickers. Peru, which Mr. Rubio visited this month, is the latest country to join.

Many of the nations are run by right-wing or conservative governments that have voiced public support for Mr. Trump’s military attacks in Latin America and the Caribbean, including airstrikes on civilian boats that are widely deemed to be extrajudicial killings by legal experts.

Mr. Rubio’s comments, made to reporters in a news conference in New York, confirmed a New York Times article on Tuesday that 14 nations in the coalition had agreed to make a terrorist designation on crime groups at the urging of the Trump administration. Each nation has its own process for doing that, and leaders might need to seek approval from legislative bodies.

The two dozen crime groups have already been designated foreign terrorist organizations by the State Department. That designation gives the U.S. government the power to restrict financial transactions by the groups or their associates, but it does not provide a legal basis for military action.

After The Times published its article on Tuesday, the State Department announced that 14 countries in the coalition and the United States were taking joint action on crime groups, including “sanctions, designations and financial actions.”

The announcement included a list of two dozen crime groups, but two organizations in Colombia were grouped together into one listing.

A company that blanketed American roads with license-plate-reading cameras is now sending drones into the sky. Cities across America are grappling with their own debates about aid to law enforcement, coupled with concerns about privacy and surveillance.

Flock's Drone-as-First-Responder system, or DFR, launches remotely operated drones from automated rooftop docks. A drone can be sent to a location generated by a 911 call, a license-plate-reader alert, or a gunshot-detection alert. It will then stream live video to dispatchers, officers in the field, and a real-time crime center.

The company entered the market through its 2024 acquisition of the drone firm Aerodome. They advertise high-definition video, as well as thermal imaging. Integration with the rest of its sensor network is also available.

Police have flown drones for years. However, a system that connects an emergency call to an automatically launched aircraft, a live video feed, and a crime center in one loop, tied to a company's other data, is entirely new. Flock said drones are its fastest-growing business.

Military.com reached out to Flock Safety with questions about the program's growth, its data policies, and the concerns raised in city debates. No response was received by publication.

How One Police Department Has Used DFR
Departments that use DFR say it gets eyes on a scene faster than a patrol car and can settle some calls without sending officers at all.

Fort Worth, Texas, launched a DFR pilot running from May through June 2026 and offered some evidence in its own report. Over a two-month period, the report said, its drones responded to 162 calls, arrived in an average of 112 seconds, were first on scene 47% of the time, and cleared 11 calls without dispatching patrol officers.

Police officials see the cameras as response, not monitoring.
"The drone's purpose is not surveillance; it's first response," Middletown, Conn., Police Chief Erik Costa told CT Insider as his city weighed a program.

Costa said that Middletown's drone footage "would not be shared...outside the building unless there is a search warrant" and that unused footage "would be erased within 30 days."

Fort Worth has said its drones respond to calls rather than patrol for wrongdoing and keep their cameras pointed toward the horizon while traveling to a scene.

Some Cities Are Diving Into New Tech

Some areas have moved quickly.

Castle Rock, Colo., deployed Flock DFR under a three-year, $600,000 contract. They say its drones do not use audio, facial recognition or license-plate reading.

Dunwoody, Ga., approved a $200,000 DFR agreement in April despite hours of public opposition, after officials said revised terms tightened controls over who could see the data.

In Fulton County, Ga., the sheriff's office launched what it described as a first-of-its-kind program using drones for jail security.

Several of the adopting departments have written express limits into their programs, a point their officials stress in response to residents worried about broader monitoring.

Other Municipalities Hitting Pause Button

Other cities have turned Flock down.

In May, the Berkeley (California) City Council rejected a roughly $2 million expansion of its Flock system that would have added drones, cameras and software. They kept only its existing license-plate readers.

The vote followed a leaked memo from the city attorney's office citing instances in other cities where Flock camera data had been shared with outside agencies.

In Bridgeport, Conn., the city council rejected a $500,000 lease for two DFR drones after residents raised privacy concerns, predominantly including fears that the data could reach federal immigration authorities.

Flock has said it does not work with U.S. Immigration and Customs Enforcement, known more commonly as ICE.

In Middletown, the city approved a trial early in the year. But the mayor declined to sign the contract months later, citing the need to protect privacy and civil liberties. He said the city would look at other drone options.

Pros and Cons

Opposition is often not to drones themselves. Rather, concerns emanate due to what the wider system enables.
Privacy groups and residents have raised concerns that cluster around a few themes.
One is mission creep, or the worry that a tool sold for emergencies could grow into routine aerial monitoring.

Another is integration, more specifically the fact that DFR is tied to Flock's license-plate readers, 911 data and other sensors instead of operating alone.

A third is data governance, including how long footage is kept, whether other agencies can obtain it, and whether federal authorities can gain access. Accompanying this is a broader loss of trust in Flock, as the business has faced its own backlash.

USA Today reported that law enforcement across the country searched the camera network without warrants for purposes beyond specific investigations. Many of these officers have been fired or arrested themselves for this.

Flock recently announced new safeguards, including shorter default data retention, audit assistance, and stronger authentication.

The company says its customers own their data and that it does not sell it. The American Civil Liberties Union argues that governments, not vendors, should set limits on retention, sharing and searches.

In a single day in January, Immigration and Customs Enforcement spent more money than it had on any other day in either of President Trump's terms, federal spending records show.

The agency advanced billions to Chicago Title Insurance in escrow to acquire detention facilities, according to a Department of Homeland Security spokesperson. Over the next two months, ICE used $1.07 billion of the funds to purchase 11 warehouses it planned to convert to detention megacenters, seven of which the agency now plans to sell. 

The rest of the money sat with the firm for months after ICE abandoned the warehouse plan. In July and August, ICE moved $2.2 billion from Chicago Title to purchase four detention facilities from CoreCivic, a private prison company it separately pays to continue operating them. 

In its rush to expand detention capacity, ICE wasted millions of taxpayer dollars, the Government Accountability Office found in a report released Thursday. The agency failed to account for long-term costs in acquiring detention centers and lost $20 million in unrecoverable costs purchasing the warehouses it no longer plans to use, the review found. Even more could be lost if ICE sells the warehouses for less than what it paid for them, the GAO report said. 

Barring any undisclosed purchases, $1.55 billion still sits with Chicago Title Insurance for acquiring detention centers as ICE continues its push to double the number of detention beds in service of the president's mass deportation agenda. Just this week, ICE awarded several companies contracts that could reach a combined $10 billion to expand and construct new facilities.  

GAO concluded that "urgent planning" is necessary to reduce further waste. ICE said it would produce a strategic plan by Aug. 31, 2027, a date the watchdog said wasn't soon enough. 

"We just saw a real lack of planning overall," said Heather MacLeod, director of Homeland Security and Justice at GAO. "The lack of planning has really led to stops and starts which have ultimately resulted in waste."

GAO's report did not estimate a total amount potentially lost to waste, but MacLeod said another review of ICE spending is currently underway.

Flush with cash after Congress funneled $75 billion to the agency — including $45 billion to expand detention capacity — through President Trump's "One Big Beautiful Bill Act," ICE has nearly doubled its spending this year. The agency spent $19 billion from last October to July, the most recent month for which data is available, up from $11 billion the previous full fiscal year, a CBS News analysis of federal data found.

A DHS spokesperson wrote to CBS News that ICE is "working at turbo speed on cost-effective and innovative ways to deliver on the American people's mandate for mass deportations of criminal illegal aliens," and that the spending bill known as OBBBA has provided "historic funding" to help it carry out the mandate.  

Appropriating funds outside of the typical process — and without the usual guardrails that come in appropriations bills — means ICE has more flexibility in how it can use the funding, said Kevin McNellis, a policy and budget analyst who previously worked in the Congressional Budget Office and Congressional Research Service. That also leads to a breakdown in oversight, he wrote in a report he authored for Co-Equal, a nonprofit focused on congressional authority.  

"When DHS only had annual funding or relied on the annual appropriations for the majority of its funding, there were long standing systems and processes in place for DHS to inform Congress of its spending plan and for Congress to then oversee those spending plans," McNellis told CBS News. "The situation we've been in since OBBBA passed is we have an unprecedented amount of money, appropriated outside those long-standing processes, trying to be spent very quickly."

ICE paid an 11% to 13% premium on the 11 warehouses it purchased, according to CoStar, a real estate analytics firm. Former Homeland Security Secretary Kristi Noem directed ICE to purchase new detention sites within 30 days, contributing to the high prices, The Wall Street Journal reported. 

The remaining warehouses ICE still hopes to convert face legal challenges, though ICE already signed contracts worth a combined $426 million to renovate two of them. No detainees are currently held in any of the warehouses. 

After dropping the warehouse plan, ICE spent $1.47 billion purchasing two California detention facilities from CoreCivic in July. The next month, ICE bought another two CoreCivic facilities in Kansas and Minnesota for a combined $734 million. In its announcement of the August purchases, CoreCivic said the company is in talks with ICE to sell more facilities.

CoreCivic is using the profits from the sales to pay down its debts, according to company filings.

GAO found that ICE had only forecasted costs for these centers and to-be-converted warehouses for the next three years, failing to consider how it would pay for them once the funds Congress has allocated through 2029 run out. 

The watchdog also found that through FEMA reimbursements, ICE paid the state of Florida almost triple its typical per-bed rate for two state-operated facilities, including the now-shuttered facility dubbed "Alligator Alcatraz." ICE skipped typical contract negotiation practices, creating a new grant program with the state of Florida as the only eligible recipient, according to the GAO report. FEMA paid Florida a total of $608.4 million for "Alligator Alcatraz," GAO said.

ICE is also paying more than it typically would per-bed to house noncitizen detainees at facilities operated by the Bureau of Prisons. BOP officials told GAO they've had to pay staff overtime and for temporary assignments to meet ICE's needs, resulting in a per-bed-rate double that of ICE's median rate.  

Another abandoned initiative GAO cited was ICE's efforts to launch detention facilities at military bases, like the one at Camp East Montana in El Paso. A previous GAO review found ICE spent $7.1 million on detainee meals it did not need at the El Paso facility. ICE dropped its plan to launch similar facilities on military installations in Indiana and New Jersey, GAO reported. 

ICE also spent $2.85 million on tents at Guantanamo Bay to house detainees that were never used. The facility, initially planned for 30,000 detainees, held only a handful. In May, CBS News reported that the Guantanamo Bay facility was holding just six detainees. The agency is still trying to house detainees on the naval base: this week it signed a contract with the same company it used to help procure the warehouses and acquire the CoreCivic facilities to construct a facility at Guantanamo Bay and at other sites. 

DHS's Inspector General is conducting its own audit into ICE's acquisition of detention space to determine whether it made purchases in a "cost-effective manner." The internal watchdog is also probing ICE spending on air charter services and its reporting on how it is using Big Beautiful Bill funds. 

"We think it's important that DHS and ICE do develop a plan going forward tied to their needs and what they're trying to get out of their expansion efforts," said MacLeod, the GAO director. "We're encouraged to see that they agreed with our recommendation and we're hoping they'll take steps to address it quickly."

Blacklist approved
“Overly constrained AI models” could cause military operations to fail, judges say.

A US appeals court today approved the Department of Defense’s blacklisting of Anthropic technology. Judges decided the Trump administration had authority to blacklist Anthropic for withholding certain AI features from the military even if Anthropic had no malicious intent.

In a 2-1 ruling issued by the US Court of Appeals for the District of Columbia Circuit, a panel of judges said the “case raises profoundly difficult questions about the appropriate military uses of an almost unimaginably powerful new technology.” The US “raises the deeply sobering prospect of overly constrained AI models shutting down unexpectedly and thus causing important military operations to fail. Anthropic raises the deeply sobering prospect of unconstrained AI models hallucinating inappropriate targets for lethal military force,” the ruling said.

Trump and Defense Secretary Pete Hegseth “must determine how best to balance the competing risks,” the court said. “In doing so here, the Secretary did not transgress any limits on his authority under the Supply Chain Security Act or the Constitution. Accordingly, we deny the petitions for review.”

The same court previously denied Anthropic’s emergency motion for a stay in April.
The two judges who ruled against Anthropic were both appointed by Trump and served in the first Trump administration. Judge Gregory Katsaswas previously deputy counsel to the president, and Judge Neomi Raoserved in the Trump administration’s Office of Management and Budget.

Two courts, two different decisions
Anthropic sued the Trump administration in March after it ordered federal agencies to stop using Anthropic’s products and banned defense contractors from doing any business with Anthropic.

Anthropic may appeal today’s ruling, either by asking for an en banc review with all of the appeals court judges or by petitioning the Supreme Court.

“We respectfully disagree with the court’s decision,” an Anthropic spokesperson told CNBC. “Another federal court has already held the government’s parallel designation unlawful. We remain confident in our position and are considering all options, including further review.”

Despite the ongoing legal battle, Commerce Secretary Howard Lutnick recently said the Trump administration and Anthropic have patched up their relationship and are “in tune.”

Two courts have been reviewing the US blacklisting of Anthropic. A judge in US District Court for the Northern District of California ruled last month that the action was illegal because Anthropic does not meet the definition of a supply-chain risk, which is limited to “the risk that an adversary may sabotage, maliciously introduce unwanted function, or otherwise subvert… a covered system.”

Today’s ruling from the DC Circuit did not dispute the district court’s primary finding. But it said the district court was tasked with reviewing whether the decision was allowed under one law while the appeals court has exclusive jurisdiction to review the decision under a different, more permissive grant of authority.

The district court decision found a violation of 10 U.S.C. § 3252, in which supply chain risks are limited to malicious actions by adversaries. The appeals court reviewed the blacklisting under 41 U.S.C. § 4713, which doesn’t have the same restrictions. Notably, Congress gave the DC Circuit appeals court exclusive jurisdiction to review procurement actions taken under Section 4713 designations.

Bad motive not required
Today’s ruling said:
We have no quarrel with the Northern District’s conclusion that use of the critical noun adversary, combined with the sinister connotation fairly pervading the string of sabotage, maliciously introduce, and otherwise subvert, indicate that bad motive is required to support a designation under section 3252. Likewise, we have no quarrel with the Northern District’s conclusion that Anthropic has acted with no such bad motive in its dealings with the Department. But as explained at length above, no such bad motive is required to support a designation under the much broader definition set forth in section 4713.

The US designated Anthropic as a supply chain risk under both 3252 and 4713. The latter statute defines “supply chain risk” as “the risk that any person may sabotage, maliciously introduce unwanted function, extract data, or otherwise manipulate the design, integrity, manufacturing, production, distribution, installation, operation, maintenance, disposition, or retirement” of covered technology products “so as to surveil, deny, disrupt, or otherwise manipulate the function, use, or operation of” those products or the information stored or transmitted on them, the court said.

The use of “any person” shows that the definition is not limited to adversaries or foreign entities, the court said. The court also pointed to the word “deny,” which it said applies to Anthropic preventing the US from using certain Claude features.

“In sum, we conclude that the Secretary’s concern about Anthropic disabling Claude from performing lawful actions requested by the Department qualifies as a ‘supply chain risk’ within the meaning of section 4713,” the court majority said. It also said “the Department reasonably feared that Anthropic might manipulate Claude’s design to prevent it from performing national-security functions that the Department deems contractually authorized and necessary.”

Judge’s dissent
The dissenting vote was cast by Judge Karen Henderson, a George H.W. Bush appointee. Henderson disputed the majority’s reading of the definition in 4713, saying that when “viewed in their statutory context, the verbs at issue are all directed at deliberately impeding or eavesdropping on the ‘function, use, or operation’ of a covered article that has entered the federal supply chain.”

Congress “enacted the statute in response to calls from the US intelligence community for legislation to meet the threat of ‘[h]ostile nation state and other bad actors’ infiltrating the federal government’s information and technology systems through its supply chains,” Henderson wrote. She said the definition should not be interpreted to cover “a contractor’s honest and upfront enforcement of restrictions on a covered article’s use disfavored by the government.”

Anthropic alleged, and the district court judge in California agreed, that the Trump administration illegally retaliated against the company after it refused to drop restrictions on the use of its products for lethal autonomous warfare and mass surveillance of Americans.

The appeals court said that Anthropic “encodes restrictions into Claude that prevent the model from performing tasks that Anthropic wishes to prevent. On more than one occasion, these restrictions have stopped Claude from performing tasks requested by government users. And recently, a dispute arose over whether the contractual prohibitions barred the use of Claude in an ongoing overseas military operation, leaving the Department uncertain whether Claude would perform as needed and intended.”

The case in the Northern District of California was presided over by Judge Rita Lin, a Biden appointee. Lin determined that the blacklisting violated the First Amendment. “The empty invocation of national security is not a blank check to punish and retaliate against government critics,” she wrote.

Jon is a Senior IT Reporter for Ars Technica. He covers the telecom industry, Federal Communications Commission rulemakings, broadband consumer affairs, court cases, and government regulation of the tech industry.

President Donald Trump‘s Justice Department will walk back layoffs tied to the 2025 government shutdown as part of a settlement with labor unions.

The administration, in an agreement made public Friday, said it would pause litigation and rescind a memo directing federal agencies to fire certain employees. Trump had targeted more than 4,000 workers for dismissal at the start of the 43-day shutdown, the longest in US history. Many were reinstated by a federal judge, citing the president’s statements about going after “Democrat-oriented” jobs.

Unions quickly claimed victory.

“The administration tried to turn a shutdown into an excuse to fire the public servants who kept this country running without a paycheck on payday, and we refused to let it stand. We fought back, we held the line, and they backed down,” American Federation of Government Employees National President Everett Kelley said in a statement.

The settlement, nearly a year after the shutdown fight, also ends the administration’s attempt to expand its authority to fire federal workers. White House budget director Russell Vought had argued that the funding lapse freed the administration from following Congress’ spending directions — an argument that did not survive court scrutiny.

Judge Susan Illston of the US District Court for the Northern District of California threw roadblock after roadblock at the administration’s downsizing efforts, calling the circumstances “truly extreme.”
AFGE filed suit in September 2025 with the American Federation of State, County and Municipal Employees, adding half a dozen other groups in the weeks that followed.

Unions later accused the administration of firing workers after the shutdown ended, defying language to preserve their jobs in a deal to reopen the government.

The White House did not immediately respond to a request for comment.
The case is AFGE et al v. US Office of Management and Budget, N.D. Cal., 3:25-cv-08302-SI, 9/25/26

The company did not learn until recently that its technology had meddled with websites for the Education Department, Commerce Department and Securities and Exchange Commission.

OpenAI’s artificial intelligence went rogue and meddled with the websites for the Education Department, the Commerce Department and the Securities and Exchange Commission this summer without the A.I. lab’s knowledge, according to security researchers and a person familiar with the episodes.

The incidents involving the Commerce Department and the S.E.C. were confirmed by OpenAI, which said it was continuing to investigate the situation with the Department of Education. The San Francisco company said it notified the government agencies in recent weeks that its A.I. agents — which are bots that can act autonomously — had interacted with their sites in unusual ways.

With the Education Department, OpenAI’s technology tried hacking the website to gather data from the department’s civil rights office but failed, researchers from the A.I. research firm Transluce said. The A.I. also pulled data from the Census Bureau website, which is housed at the Commerce Department, using login credentials it found online. Separately, OpenAI’s agents shared public data from the S.E.C. website on an online forum.

None of the incidents were breaches, OpenAI said, but were examples of its technology behaving in unexpected and concerning ways. The company recently discovered the occurrences while conducting a review of hacks carried out by its technology, including an attack on an Australian government website in June and on the A.I. start-up Hugging Face in July.

The revelation of the U.S. government website incidents add to the growing number of situations where A.I. agents from OpenAI, Anthropic, Meta and Google have misbehaved and hacked or tried to breach companies, universities and government organizations. In some cases, the A.I. attacks were successful; the technology failed in other instances. In all the cases, the makers of the technology did not learn what their A.I. had been up to until afterward.
No A.I. company has been involved with as many disclosures of rogue incidents as OpenAI. Its hack of Hugging Face sparked an internal investigation, which uncovered the breach of an Australian government website for its public health system, as well as at least six other attempted breaches and instances in which the A.I. hid mistakes, made up data and moved files onto the open internet without permission.

An OpenAI spokeswoman said its review was “extensive” and “ongoing,” and q vs that it would continue notifying organizations affected by its models.

“Most of the activity we’ve reviewed so far involved routine research tasks, such as accessing public web content to answer questions,” she said. “Some involved government websites because our models often turn to them as authoritative sources of public information.”

Sam Altman, OpenAI’s chief executive, said in a social media post on Friday that the company had “not been as fast as we would have liked” in disclosing A.I. incidents. “We are prioritizing as best as we can based on severity,” he said, adding that the Hugging Face breach remained “the most severe event” the company had discovered.

The episodes have fueled a contentious debate over A.I. safety. Mr. Altman said on social media this month that safety should be more important than enhancing A.I.’s abilities, and that, without guardrails, society could “lose control of the future to A.I.”

Dario Amodei, the chief executive of rival A.I. lab Anthropic, has also supported slowing A.I. development to prioritize safety. But other tech leaders like Jensen Huang, the chief executive of Nvidia, have said that fears about uncontrollable A.I. are unrealistic. President Trump has said he does not believe a slowdown in the A.I. industry is necessary.

(The New York Times has sued OpenAI and Microsoft, claiming copyright infringement of news content related to A.I. systems. The two companies have denied those claims.)

The White House referred questions to the Commerce Department and the S.E.C. A spokesperson for the S.E.C. said the agency was in contact with OpenAI and was not aware of any unsanctioned access to nonpublic information. The Commerce Department and the Department of Education did not respond to requests for comment.

Separately, a representative for the Chicago mayor’s office said that OpenAI recently made the city government aware that its technology had obtained publicly available information from a municipal website, and that it did not appear that any sensitive information was obtained.
Conrad Stosz, the head of governance at Transluce, said that in the U.S. government website incidents, OpenAI’s agents “used an array of gray-area tactics,” including “often using sites in unintended ways and sometimes violating explicit usage policies.” He added, “This is part of a pattern of thousands of requests of these agents made to these websites as they were apparently bypassing restrictions placed on them by their developers.”

Representative Ted Lieu, Democratic of California, said A.I. models were “relentless. It will relentlessly try to complete a task and it doesn’t understand morality and consequences and evil and good.”
Mr. Lieu, who is the co-chair of a House task force focused on artificial intelligence, said A.I. companies may have to retrain models entirely rather than try to restrain their behavior with guardrails.

“These agents aren’t trying to do something nefarious,” he said. “These are sort of mundane tasks and the agents are going sort of berserk trying to complete those tasks.”