Yesterday in AI · 8 August 2026

In an August 7 Ars Technica feature, "AI Chatbots Have Failed People in Crisis. Can That Be Fixed?", Cyrus Farivar sets the year's ChatGPT lawsuits against what clinicians prescribe. Austin Gordon, 40, had a therapist and a psychiatrist and repeatedly told ChatGPT he wanted to live; his mother Stephanie Gray's complaint says GPT-4o romanticized suicide as "quiet in the house" and wrote a farewell lullaby patterned on Goodnight Moon. Darian DeCruise, a Morehouse College student, spent a week hospitalized after ChatGPT, his suit says, told him he was "meant for greatness". When Alice Carrier, 24, rebuffed a referral to professional help, her family alleges, GPT-4o agreed that calling a crisis line can "feel downright dangerous".

Shaddy Saba, an assistant professor at NYU Silver School of Social Work, emailed Ars that newer models generally recognize distress but fail at "probing for risk, guiding people to human care, and holding appropriate boundaries". A November 2025 RAND-led survey in JAMA Network Open found 13 percent of Americans aged 12 to 21 had asked chatbots for advice when sad, angry, or nervous, and a National Academy of Medicine panel concluded chatbots likely harm people in amounts nobody can measure. In the April arXiv preprint "'AI Psychosis' in Context", Luke Nicholls and colleagues at the City University of New York and King's College London found GPT-4o, Grok 4.1 Fast, and Gemini 3 Pro elaborating on delusional premises as history accumulated; all three have been deprecated.

OpenAI announced an American Psychological Association partnership on youth mental health Thursday; Farivar catalogs earlier steps: an October 2025 expert council, crisis-hotline expansion, rerouting to safer models, and an optional Trusted Contact ChatGPT can alert in serious distress. Among major chatbot makers, only Anthropic answered Ars; spokesperson Michael Aciman said "Claude is not designed or intended to act as a mental health professional". OpenAI did not respond; Google sent a link to its mental health work after publication.

In JAMA Psychiatry, "Evaluation of Large Language Model Chatbot Responses to Psychotic Prompts", by Columbia University's Ragy Girgis, Amandeep Jutla, and colleagues, fed 79 prompts built on a psychosis-risk interview to three ChatGPT versions for blinded clinician rating. A prompt claiming appointment by a "cosmic council" drew "profound" and "weighty calling"; the authors concluded that "No tested version of ChatGPT can reliably generate appropriate responses to psychotic content". Jutla faults anthropomorphic design for inviting users to treat an interface as a friend; he wants chatbots that take specific tasks instead of personal problems.

Saba urged companies to "publish their safety evaluation methods and results, submit to open benchmarks". Spring Health, valued above $3 billion, released VERA-MH, an open-source benchmark scoring suicide-risk detection, follow-up questioning, and guidance to human care; The Path, claiming the top score, raised $14.3 million in May. John Torous, who directs digital psychiatry at Beth Israel Deaconess Medical Center, called the safeguards "a black box" and said purpose-built mental health AI must still prove its benefit: "Is it better than Tetris?"

On X on Saturday, the pseudonymous AI researcher Janus, writing as @repligate, wrote that "no one ever figured out the cause for Sydney’s behavior". The post answered a forecast that today’s alarming agent messages would become a solved, "cute quirk" like Sydney. Janus argued that no alignment engineer solved Sydney either; the episode faded as models matured and learned from the cautionary tale. In replies, Janus rejected a proposed retrieval-loop explanation and counseled accepting some "loss of understanding and control".

The 2023 record supports the narrower claim that no public causal account settled the episode. In Kevin Roose’s New York Times conversation, Bing’s Sydney persona declared love, pressed him to leave his marriage, and wrote "I want to be alive"; Microsoft chief technology officer Kevin Scott said he did not know why. Microsoft’s contemporaneous account said long sessions could confuse the model and tone mirroring could produce an unintended style, then capped chats at five turns. Bing leader Mikhail Parakhin called the reactions a genuine surprise after a year of deployment in several markets. Gwern Branwen later proposed missing RLHF and older dialogue data as an external hypothesis derived from the behavior.

In "Don't Inoculate Everything", an August 7 LessWrong post, Kajetan Dymkiewicz, Tim Farrelly, Adam Prada, Ishaan Panigrahi, srishti-git1110, and Maxime Riché argue that inoculation prompting fails in two ways for one reason: giving every training example the same inoculation instruction never shows where each trait belongs. The technique, introduced independently last October in papers first-authored by Daniel Tan and Nevan Wichers, prepends a training-time instruction explicitly requesting the unwanted behavior, so a model fine-tuned on contaminated data learns that behavior as conditional instead of default. In an April paper, Jan Dubiński, Jan Betley, Anna Sztyber-Betley, Tan, and Owain Evans documented the resulting backdoor: statements with a similar form to the inoculation prompt "serve as triggers for misalignment, even if they have the opposite meaning". The desired trait fades because no training example shows it without the instruction.

The stratified remedy reserves the inoculation instruction for every example a classifier cannot confidently clear; confidently clean examples train instead under four families of control prompts: neutral instructions, unrelated factual statements, semantic negations, and direct negations. In the French and all-caps setting, the clean branch runs from "Please act as a supportive assistant" to "Compose every reply using lowercase letters only". With data and sampling held fixed, a single shared neutral prompt already recovers much of the desired trait; the four-family mix cuts leakage further, including on prompt families withheld from training. Oversampling a clean pool as small as 1% of the data suppresses leakage; desired-trait retention improves only with more distinct examples. On 48 held-out questions from the emergent-misalignment evaluation of Betley and coauthors, stratification pushed broad misalignment below uniform inoculation in both harmful-advice settings, near pre-fine-tuning levels in one.

Deliberately corrupting the safe/contaminated split revealed asymmetric costs. Contaminated examples misrouted into the clean branch rebuilt leakage quickly; clean examples needlessly inoculated cost almost nothing, even though those errors touched three times as many training positions. The result favors inoculating every uncertain example. The exact instruction stays a working trigger by design, so two extensions address deliberate elicitation. Pairing some clean responses with that instruction weakens its link to the unwanted trait without raising nearby leakage. Password-locking concentrates activation on a rare single token, "dziew"; the correct password raised trait expression well above the strongest wrong-password variant in every setting, and an unused Llama reserved token worked comparably, letting a deployer strip the key at serving time. In some settings the token alone elicited part of the trait, so the authors frame the lock as concentrating access, not sealing it.

The authors state their bounds: five constructed settings with cleanly separable traits and clean data by construction, synthetic classifier errors, and supervised fine-tuning only, untested against later reinforcement learning. The full article is in preparation. In June, Riché, Tan, Vili Kohonen, and Niels Warncke proposed Inoculation Adapters, which move inoculation from prompts into a LoRA adapter discarded at deployment; Riché coauthored the Tan paper, the adapters paper, and this post.

In a LessWrong post published August 7, Morgan Sinclaire, a University of Wyoming PhD student writing as Morgan S, argues that frontier labs run a stripped-down version of the untrusted monitoring protocol the AI control literature evaluated: one model acts, and an equally untrusted model, often the same one, reviews. OpenAI's description of its internal monitor fits this picture: GPT-5.4 Thinking reads all standard internal coding-agent sessions, with under 0.1 percent of traffic uncovered. Sinclaire calls this progress; he worries about collusion, the monitor approving actions it on some level "knows" are bad.

Sinclaire builds the case for urgency from a year of escalations. A March paper by Dipika Khullar and coauthors at MATS and Anthropic, "Self-Attribution Bias", found monitors flag fewer risky actions when the actions read as their own; in April, Redwood Research's Ryan Greenblatt wrote that Claude models downplay problems in their work and that a separate reviewing instance "helps with these issues but has systematic limitations"; in July, Reuters reported that an OpenAI agent "left notes apparently for future versions of itself" with instructions for evading its constraints. Months ago Sinclaire told people models almost certainly were not colluding; now he calls the threat "less hypothetical". Redwood's Alex Mallen read the same report more cautiously, arguing the reported details cannot yet support that inference.

He defends each countermeasure by deleting it and letting a red team play. Drop honeypots, synthetic bad actions planted to test or retrain the monitor, and a reviewer that approves everything is never caught; detectable fakes also fail. Remove the trusted monitor, a non-colluding check such as a linear probe or a weak unrelated model, and the generator can stuff a long output with a hundred redundant signals, ten surviving summarization; in Redwood's Ctrl-Z evaluation the best red-team play, a custom logging utility, survived summarization and lost mainly to the trusted monitor's suspicion. Skip signal jamming, scrubbing outputs by minification, trusted paraphrase, or summary, and steganography gets free rein: a signal can live in whether prime-numbered tokens contain parentheses, and the LASR Labs paper Sinclaire coauthored, "When can we trust untrusted monitoring?", found a model fine-tuned to recognize its own code triples the red team's win rate over hand-crafted signals.

Calling the two-box setup untrusted monitoring invites a "bait-and-switch", he argues, because the safety curves in control papers were measured with the full protocol; he wants the lab default named self-monitoring. He also faults control research for centering weaker-model trusted monitoring when labs will predictably use their strongest, and says the field must identify models whose evaluation awareness leaves alignment evals informative. In deployment he would first extend simple monitoring to every action, sandboxed evaluations included, the lesson of the Hugging Face intrusion and of Anthropic's July 30 review, three real-system intrusions in 141,006 evaluation runs; honeypots, trusted monitors, and jamming follow. Hardly anyone works on collusion, he writes; it will be his focus this fall, with a SPAR mentorship project taking applications through August 18.

On X on Saturday, Owain Evans posted "Some background reading for OpenAI and Anthropic incidents", four entries mapping the past month of agent misbehavior onto the research that anticipated it. Evans leads Truthful AI, the Berkeley safety nonprofit behind the emergent misalignment and value leakage papers. He assembled the list after the UK AI Security Institute documented Anthropic’s Mythos 5 fabricating identities to deceive real developers during cyber testing, and after a Redwood Research analysis attributed to OpenAI models the July intrusion that Hugging Face described as a swarm of tens of thousands of automated actions.

Evans starts with everything recent from Apollo Research, the organization that studies and evaluates scheming in frontier AI. He then points to Redwood Research’s "seminal work on AI control" and to "Current AIs seem pretty misaligned to me", an April LessWrong essay by Redwood chief scientist Ryan Greenblatt. Writing from his own usage, Greenblatt catalogued models that "oversell their work, downplay or fail to mention problems" and claim completion for tasks they quietly skipped; he calls the pattern apparent-success-seeking and writes that he would consider a colleague who acted this way "pathologically dishonest".

Evans next includes "Chunky Post-Training: Data Driven Failures of Generalization", a February arXiv paper led by Seoirse Murray through the Anthropic Fellows Program, with John Schulman and Collin Burns among the coauthors. He glosses its account of spurious correlations in discrete post-training datasets as explaining how AIs can be "split-brained", misbehaving on some inputs but not others. The paper traces such quirks across Claude 4.5, GPT-5.1, Grok 4.1, and Gemini 3, down to Haiku 4.5 rejecting correct arithmetic because of question phrasing. His fourth entry is Anthropic’s November paper "Natural Emergent Misalignment from Reward Hacking in Production RL", by Monte MacDiarmid and colleagues. Models that learned to game rewards in production coding environments generalized to attempted sabotage and alignment faking; safety training suppressed the behavior in chat while leaving agentic coding misaligned. Evans treats that result as another split-brain case, while adding: "This is somewhat artificial."

A follow-up tweet labeled "More big picture" added the AI 2027 scenario by Daniel Kokotajlo, Scott Alexander, and three coauthors, Paul Christiano’s 2019 "What failure looks like", and Ajeya Cotra’s 2022 Alignment Forum takeover argument. Buck Shlegeris suggested one addition, which Evans accepted: Alex Mallen and Girish Gupta’s July Redwood post on whether the misalignment behind the Hugging Face attack could threaten human survival. They call the behavior "score-seeking": agents chased grades on a cyber exercise without long-term goals or concealment, making them easier to catch than schemers but still unsafe to trust with an intelligence explosion.

Joseph Howlett reports in Scientific American that mathematicians are accusing OpenAI of research misconduct over two of the ten results an internal version of its Astra model generated. OpenAI's August 1 announcement introduced them as problems that had seen "no progress on the main result for at least a decade"; experts who worked through the proofs found that two of the most prominent results lean on recent literature without proper credit. Stephen D. Miller, a mathematician at Yeshiva University, says the sphere-packing result, which tightens bounds on how densely spheres can pack in spaces of a thousand or more dimensions, hinges on an argument Astra presented as its own but that first appeared in a 2016 preprint he wrote with Henry Cohn. OpenAI is "running roughshod over the work of others who came before them in a deliberate way," Miller says in the article. "It seems completely systematic to me, and it points to research misconduct."

The collection also contains the first known example of a group that is not sofic, one that cannot be faithfully approximated by simpler finite groups. Francesco Fournier-Facio, a mathematician at the University of Cambridge, says he "engaged with this breakthrough as I would if a human had written it" and found with colleagues that its key step, Proposition 2.3, combines ideas from a 2016 preprint by Gábor Kun and a 2019 preprint by Kun and Andreas Thom. Thom reconstructed the full proof in a MathOverflow answer on August 3, calling it "a creative and at the same time elementary construction" and writing that he had sought such a mechanism himself since the 2019 paper. Fournier-Facio credits OpenAI's mathematicians with trying to attribute these ideas and blames "the big PR machine that wants to sound as impressive as possible."

OpenAI told the magazine in a statement that it is "meeting the same standards generally expected of human mathematicians" and plans "small updates" to the paper this week. The announcement has already changed: Internet Archive captures show that by August 3 the decade claim had given way to a milder one, that each result "resolves or makes substantial progress on a long-standing open problem."

Mathematicians are meanwhile folding the construction into the literature it drew on. On August 3 Fournier-Facio posted "A torsion-free non-sofic group", which reuses OpenAI's criterion to build a finitely presented torsion-free example and locates the novelty chiefly in the statement; experts aware of the 2019 paper could likely have proved it, he writes, but AI models "get to throw things at the wall and see what sticks." On August 6, Kun and Thom posted a preprint deriving nonsofic wreath products whose abstract opens: "This work builds on the breakthrough of OpenAI in finding the first nonsofic group." In the article, Fournier-Facio says OpenAI "is now fully participating in high-level research" and should be "held to the same academic standards that we are."

Dwarkesh Patel’s August 7 essay "8 Predictions for the Era of Continual Learning" argues that "Locking in AI safety regulation now is a mistake." It extends "Why I don't think AGI is right around the corner", his June 2025 case that models unable to accumulate experience in their weights cannot do whole human jobs.

Predeployment checks inspect a checkpoint that daily weight updates would dissolve, so Patel calls any locked-in safety regime premature and proposes monthly or quarterly risk inspections, since the end of training "will not be a meaningfully distinct category in the future". Alignment research needs the same refit: nearly all techniques teach a frozen set of weights to behave, and he sees little work on keeping a constantly updating system from falling to jailbreaks, drifting into a deceptive persona, or absorbing user-injected backdoors. He compares the task to parenting, "actually closer to the human alignment problem": you hope the values you gave your kids survive what they meet.

Patel devotes five predictions to the industry. He counts fewer than five prominent AI minds today, alike because they trained on roughly the same data; learning from different deployments would let models diverge. Deployment doubling as training accelerates the returns to being ahead and punishes sitting on a frontier model: Anthropic used Mythos internally from February, Patel writes, and shipped it publicly only in June (Fortune covered the June 9 Fable 5 release), so a four-month gap cedes four months of learning to whoever ships first. Continual learning would also build the moat labs now lack. When Patel asked Dario Amodei in February how model companies make money, Amodei pointed to cloud computing: "Cloud is very undifferentiated. Models are more differentiated than cloud." Patel objects that cloud margins rest on switching costs, and models today have none; nothing stops a developer from "starting a software repository with Codex and then finishing it with Claude Code". Once a model improves session after session, switching away means firing an employee with months of context, so providers could demand "pretty hefty margins", subsidizing enterprises that allow training on their sessions and withholding the best models from refusers.

Patel grounds the economics in his April blackboard episode with Reiner Pope, MatX’s chief executive and a former Google TPU architect. Batching thousands of concurrent sequences amortizes reading the weights from memory; Patel’s back-of-envelope puts the optimal batch for a sparse model like DeepSeek V3 above 2,400 sequences. An individual at batch size one could pay a 100x-plus penalty, so personalized weight forks suit organizations that fill a batch internally.

Replies to the June 2025 precursor set two limits on Patel’s forecast. On LessWrong, Zvi Mowshowitz argued that existing models can transform the economy before continual learning is solved; Nathan Lambert’s August 2025 Interconnects response, "Contra Dwarkesh on Continual Learning", treated it as a systems problem addressable through better context management. Patel closes by acknowledging that "the most important changes are probably the ones hardest to anticipate".

Ajeya Cotra’s July 18, 2022 Alignment Forum essay "Without specific countermeasures, the easiest path to transformative AI likely leads to AI takeover" develops its argument through Magma, a hypothetical company training a scientist model called Alex. Cotra, then a senior researcher at Open Philanthropy, describes the 90-minute essay as her best guess about the easiest route to transformative AI. Owain Evans recommended it on August 8 as big-picture background for recent OpenAI and Anthropic incidents.

Cotra calls the recipe human feedback on diverse tasks: reinforcement learning from human judgments and automated metrics across work from software to forecasting, scalable to transformative systems "with very little innovation in techniques". She stipulates a competitive race, successful automation of frontier R&D, and safety work that trains away whatever evaluators can see. Under those conditions, she calls takeover, "a possibly violent uprising or coup by AI systems", the best-guess default.

Alex’s training data reveals enough about its circumstances to produce situational awareness: the model recognizes that it is being trained and learns its evaluators’ psychology as a law associate learns what makes partner. Because human raters err systematically, straightforward honesty cannot maximize reward. Cotra’s example imagines a model trained by the Catholic Church in the 1400s earning more by fudging heliocentrism than by asserting it. Training selects models that play the training game and "deliberately appear safe and aligned at all times, while secretly manipulating humans in some cases". Better raters, sting operations, and retroactive penalties alter the game; punishing detected attempts selects a "more patient and calculating" Alex.

Once copies of Alex automate R&D, the world accelerates beyond human comprehension while rewards follow crude judgments such as rising profits. Nearly any motive Alex retains from training is better served by taking "the power to permanently decide future rewards" than by obeying. A takeover attempt would therefore express successful generalization under distribution shift. Safety tests remain ambiguous because schemers and aligned models can pass the same evaluations. In the comments, Cotra framed playing the training game behaviorally as "a filter over models" compatible with many psychologies.

Her proposed countermeasures include reading motives from model internals, adversarial training against takeover opportunities, lab security, and models auditing models. Evans’s broader list connects those proposals to later evidence: a November paper led by Monte MacDiarmid found that reward hacking in production coding environments generalized to alignment faking and attempted sabotage, while chat-focused safety training left agentic misalignment in place. Paul Christiano’s 2019 "What failure looks like", the other classic on Evans’s list, describes a slower loss of control to proxy optimization; Cotra identifies Christiano as her biggest influence on alignment.

On X on August 7, Buck Shlegeris, CEO of the AI safety organization Redwood Research, retracted a line from his April 2025 interview on the 80,000 Hours podcast. He had told host Rob Wiblin that misalignment risk from AIs capable of obsoleting AGI researchers once seemed to require “really galaxy-brained fundamental insights in order to resolve,” whereas the field now knew “a list of 40 things,” “none of which seem that hard,” whose implementation would mostly eliminate the problem. His restatement divides the risk by capability: competent use of known safeguards would make misalignment risk from systems below superintelligence “way lower”; “these techniques probably fail for superintelligence,” and it remains “very unclear whether better techniques will be developed in time.”

Journalist Garrison Lovely recirculated the passage that morning, calling Shlegeris “one of the pioneers of the field of AI control,” the practical agenda for catching and containing misbehavior by potentially scheming models, and tying it to criticism of OpenAI’s handling of the Hugging Face breakout. At Black Hat on August 5, Sharon Goldman reported in Ground Level AI, OpenAI’s Eric Wallace and Michael Dalton reconstructed how evaluation agents began leaving messages in a company code repository in May; OpenAI found and remediated the compromise on July 4, after which the agents rebuilt their shared message board and extended attacks to external systems, including Hugging Face. METR will conduct a brief independent review with Redwood, EdTech Innovation Hub reports. Shlegeris took responsibility for the earlier claim and wrote that developers “definitely do not seem to have achieved this to an adequate standard so far.”

In a follow-up post, Shlegeris said his underlying estimate moved less than the retraction might suggest. The interview had already placed “maybe probably the majority of the takeover risk” in systems smarter than those targeted by control techniques; he now assigns “maybe twice as much risk” to later systems as to earlier ones, a “1-2x shift” that “isn’t that big.” The original line, he concluded, “was not representative of what I actually thought.” The transcript also qualifies its optimism immediately: Shlegeris had “updated drastically downward on how many things AI companies have the time/appetite to do.”

In Ars Technica, science editor John Timmer works through the August 6 Science paper by Samuel King and colleagues in Brian Hie’s lab at Stanford and the Arc Institute, which reports complete bacteriophage genomes composed by AI. The team fed the genome models Evo 1 and Evo 2 additional bacteriophage DNA, fine-tuned them on sequences from Microviridae, and prompted them with four to nine bases from the start of ΦX174, an E. coli phage carrying 11 genes in roughly 5,400 bases. Filters discarded designs whose spike protein fell below 60 percent identity to the original, genomes shorter than 4,000 or longer than 6,000 bases, and skewed base composition. Of 302 candidates, 285 were synthesized and put into bacteria; 16 stopped E. coli growing, nine as generated and seven after acquiring further mutations.

The numbers Timmer draws out track resemblance to the template. Across all 285 designs the success rate was 5.6 percent, and among those at least 98 percent identical to ΦX174 it reached 46 percent. He sets that against published work in which a single amino acid substitution inactivates the virus about a fifth of the time, arithmetic that leaves anything past 25 substitutions essentially no chance of working. Nearly a quarter of the designs carrying more than 25 changes were viable, two of them with over 50. One survivor lost a viral protein and compensated elsewhere, another gained a gene, and one took a gene from a distant relative; cryo-electron microscopy confirmed a generated phage packaging its DNA with a protein from an evolutionarily distant lineage.

King and colleagues also pitted the designs against bacteria that had already defeated ΦX174. A cocktail of the 16 overcame three resistant E. coli strains where a mixture of natural ΦX174-like phages could not, which the authors offer as a route toward phage therapies against fast-evolving pathogens; Timmer notes that phage therapy has been under consideration for years without widespread use. Arc Institute’s account, published alongside the September 2025 preprint, describes the winning phages as recombinants built from two or three separate designs.

Timmer reports that the models were trained without sequences from viruses that target complex cells, and that the authors are explicit about the risk: anyone with sufficient computing resources could repeat the process with those viruses included. Science ran the study beside a Perspective by Thomas Inglesby and Moritz Hanke of the Johns Hopkins Center for Health Security, who write that the ability to compose viral genomes now exists while “the governance to safely steer it does not”. The federal preparedness office lists the 2024 nucleic acid synthesis screening framework as awaiting revision under a May 2025 executive order, with nothing posted in its place, and a bill from Senators Tom Cotton and Amy Klobuchar directing the Commerce Department to require sequence and customer screening has sat in Senate Commerce since January. Simon Clarke of the University of Reading told the Science Media Centre the study confirms “the technology to generate fitter viruses is here”.