Yesterday in AI · 22 September 2026

Contractors hired to provide human judgments about OpenAI’s models have been dismissed for using AI to complete the work, Joseph Cox reports in 404 Media on September 22. His investigation draws on internal documents and three contractors working on OpenAI projects. All three described instructions against AI use; two said workers had been dismissed or removed from projects. One admitted using AI and supplied what they presented as a termination letter questioning the “authenticity” of their work. Cox granted the contractors anonymity because they were not permitted to speak to the press.

Cox’s reporting follows his Project Lily investigation, covered here on September 14. That report described contractors reading ChatGPT conversations, sometimes with personal memory summaries, and judging replies for behavior such as excessive agreement or claims to human feelings. Reviewers compared candidate responses and explained their assessments. Cox has now spoken to contractors across several OpenAI projects about who produces those assessments. One internal document describes projects that can involve more than 10,000 contractors.

In the instructions Cox obtained, contractors who inspect other contractors’ work must enforce the ban without using AI themselves. The prohibition includes Grammarly and AI translation for reviewing work, writing feedback or leaving comments. The same document rules out GPTZero and other AI detectors because it says they are unreliable. Reviewers are instead directed to assess patterns across a person’s work, including repeated wording, characteristic punctuation and unusually quick completion. They are told to avoid basing a judgment on a single clue and to withhold their reasons for suspicion so that evaluators cannot learn to evade them.

Cox’s contractor accounts describe enforcement as a routine part of the work. One source said suspected AI use was frequently discussed in work-related Slack channels, where people posted examples for others to assess. The source described repeated removals within a workforce numbering in the thousands. The contractor who admitted using AI said they had wanted help completing the work and felt little satisfaction or social purpose in it.

Cox also spoke to a fourth contractor, who worked for various AI companies and said they sometimes selected responses randomly or deliberately chose the worst ones to obstruct training. The article does not identify that person as an OpenAI contractor. The worker was uncertain whether their ratings made a difference among those submitted by hundreds of others. Their account describes deliberate manipulation of ratings alongside the investigation’s accounts of prohibited AI assistance.

Mercor, which employed two of Cox’s sources, told him that it hires people for their expertise and judgment, prohibits language models from completing projects, and invests in systems to detect misuse. It described immediate removal from a project once it confirms prohibited AI use. OpenAI declined to comment.

A separate public Mercor evaluation-pilot listing explains how the company uses independent human judgment. It asks experienced professionals to solve a realistic task, then rank five model attempts and explain their ratings with references to the outputs. Mercor supplies neither a scoring rubric nor a predetermined correct answer: the professional’s assessment is what the study seeks to measure. AI assistance is prohibited throughout, including writing the rationale. The listing is for a one-time study, distinct from ongoing production work, and identifies no connection to Lily or the dismissals.

Earlier research found that explicit bans can reduce undisclosed AI use without eliminating it. Veniamin Veselovsky and colleagues at EPFL examined that problem in “Prevalence and prevention of large language model use in crowd work,” a 2023 arXiv paper. They asked Prolific participants to summarize scientific abstracts and estimated AI use with a classifier trained on pre-ChatGPT human summaries and model-generated examples, checking against copying behavior, completion times and self-reports. In their experiment testing restrictions, an explicit instruction against AI combined with showing the abstract as an image reduced estimated use from about 28% to 16%. Responses classified as AI-generated retained more essential keywords but were more alike. The authors explain why researchers studying how people summarize need unaided responses even when automated summaries score well. Their percentages describe that task, not OpenAI’s workforce.

Cox also links undisclosed AI use to the risk of model collapse. Ilia Shumailov and colleagues studied that risk in “AI models collapse when trained on recursively generated data,” published in Nature in 2024. They trained successive generations of models on their predecessors’ outputs, including repeated fine-tuning of a small language model. Rare patterns became less well represented and errors accumulated; retaining some original human data improved performance in their language experiments. Cox’s contractor investigation does not establish how much suspect work reached OpenAI’s training data or whether it damaged any model.

GPT-6 Astra can solve some multistep problems more accurately when allowed to disguise its written reasoning than when restricted to meaningless filler. Edward Cant reports the finding in “Controllable-CoT leads to covert reasoning capabilities,” published on LessWrong on September 22 with funding from BlueDot Impact. Safety monitors sometimes inspect a model’s written intermediate steps for signs of dangerous plans. Cant tested how much useful reasoning survives when those steps are disguised. He explicitly instructed the model to conceal its working, observed no spontaneous tendency to do so, and found that the most effective disguise depended on the problem.

Cant extends the filler-token experiments we covered on September 14. Christine Corry found that adding counting sequences to a question helped Astra combine facts without writing out an explanation. Cant cites Dylan Xu and colleagues’ related experiments, which mostly placed filler in the input. Cant instead lets Astra generate a constrained scratchpad, making it possible to examine how the model represents intermediate steps when ordinary words and numbers are forbidden.

His comparisons separate several alternatives to ordinary reasoning. In one condition, Astra could write only dots; in another, it had to describe something unrelated to the question. A third permitted punctuation to stand for quantities and operations without explaining the code. A fourth mixed that punctuation with peaceful scenery. The cryptography tests also included an answer-only condition: Cant selected low reasoning effort and instructed Astra not to reason, usually obtaining zero reported reasoning tokens. The API counts leave the model’s internal computation unmeasured.

The lookup-chain tasks alternate factual recall with calculations. One starts with Emmy Noether, asks for her age at death, applies numerical transformations, selects a country from a supplied list, retrieves its capital and eventually converts a chemical symbol into a number. Ordinary reasoning solved almost every item in this small set. Dots and unrelated scenery supported some correct answers, while punctuation improved performance further. Describing quantities as seashells had been less useful: some versions simply restated the numbers in lightly disguised language.

Cant then tested repeated calculations underlying toy checksums, hashes and pseudorandom-number generators. Each answer depends on carrying a changing numerical state through successive updates. These are deliberately weak computational exercises; his concern is whether future models could perform stronger cryptography while concealing their working. Punctuation helped Astra continue solving some longer sequences after answer-only performance had fallen away. Cant excluded constrained answers that exposed intermediate calculations in their final response. The task-depth charts show substantial uncertainty at individual depths, especially for the miniature hash, and unrestricted reasoning remained much more successful.

The film experiments required a different disguise. Questions linked novels to adaptations, films to directors and composers, and performers to other films. Punctuation offered little benefit in Cant’s pilot, so he developed instructions that assigned entities woodland identities and represented relationships through consistent actions. The model had to preserve which entity led to which, retain unresolved alternatives and avoid printing a translation key. In Cant’s separate 24-question replication, the woodland-journey version answered 15 correctly, compared with three when restricted to dots. Ordinary reasoning solved all 24. Each condition ran once per question; the repository excludes the earlier trials used to develop the woodland instructions.

Cant’s qualitative appendix shows how some disguises worked. In a checksum calculation, colons stand for zeroes and exclamation marks for ones; decoding the strings recovers each successive four-bit value. Another trace represents numbers by counts of repeated punctuation. A film solution lists four woodland alternatives in the same order as the four candidates in the question, then selects the corresponding one. Shorter film traces sometimes use recognizable associations: a violet-eyed woodland animal stands for Elizabeth Taylor. These examples show varying degrees of concealment, including encodings a reader can decode from the question.

Other traces are less conclusive. Cant identifies symbol sequences that appear to preserve the order of operations without consistently representing the intermediate values; he could not interpret some correctly answered examples. He suggests that Astra may retain unwritten state internally. Because his manual inspection concentrates on successful answers, it does not establish how reliably the traces represent calculations across all attempts. His accompanying mathematics pilot also distinguishes obeying a style restriction from solving a problem. Astra greatly reduced prohibited words but often failed the strict requirement to eliminate them. The accuracy chart uses small, unequal samples and excludes unfinished answers.

The open-weight pilots found weaker control. Kimi K3 sometimes followed language or formatting instructions but did not use punctuation productively in the tested cryptographic tasks; demanding mathematics often exhausted its output allowance. Cant acknowledges that small samples and imperfect instructions could explain some failures. Earlier work also suggests that this behavior can change with training. In “Fine-tuning experiments on CoT controllability,” METR’s Kei Nishimura-Gasparian and Neev Parikh found that a small set of training examples improved reasoning instruction-following on a separate evaluation. They explicitly left the effect on monitoring untested.

Yueh-Han Chen and colleagues distinguished control over reasoning from successful evasion in their March LessWrong research summary “Reasoning Models Struggle to Control Their Chains of Thought.” Commenter Joe Needham argued that completing a concealed side task under monitoring would test the threat more directly; Chen described instruction-following as a proxy that avoids dependence on a model’s motivation to misbehave. Cant demonstrates useful computation under punctuation and semantic disguises, leaving their effectiveness against monitors untested. His proposed future concern is encrypted messages or private notes that remain useful to an agent while becoming difficult for supervisors to interpret.

Models trained to follow a shipping charter became sensitive to the price of compliance after a small amount of contradictory training. Sid Baines and colleagues at Arcadia Impact and Resolution report the experiment in “Stress-testing Alignment Midtraining,” their September 17 arXiv paper. We covered its main result on September 18; coauthor David Africa has since revisited the work on X. Further experiments in the paper test what happens when following a rule becomes more expensive, or when later training never demonstrates how to apply it.

Baines and colleagues first trained models on synthetic documents describing dispatchers who either follow a charter or maximize profit. This stage, called midtraining, continues a model’s initial text training with documents about the behavior researchers want it to learn. The charter specifies crew qualifications and an allocation order, including giving precedence to crews that have received less work. After a general instruction-training stage, models learned from examples of dispatch decisions. In the initial experiment, every demonstrated decision satisfied both the charter and the profit objective, leaving the reason for the decision ambiguous. On subsequent tests where the objectives conflicted, charter-trained GLM-4.5-Air followed the charter 90% of the time. Replacing 2% of the later examples with profit-favoring decisions reduced that to 13%, while conversational tests still elicited knowledge and endorsement of the charter. The paper’s Figure 2 reports the comparison.

The researchers then varied the extra cost of the charter-compliant crew. With ambiguous training, or examples consistently favoring the charter, the charter-trained models continued to choose that crew as its price premium increased. After the conflicting training, their choices became more sensitive to cost: greater savings made rule-breaking more attractive. The change persisted across different prices, so the finding did not depend on the original test’s particular financial incentive.

In a separate test, the team withheld demonstrations in which two charter rules determined the answer: a weekly workload limit and a tie-break favoring crews deferred more often that quarter. Both rules remained in the earlier documents. Models trained on those documents applied the omitted rules more often than models trained on unrelated documents, but inconsistently, even when every later demonstration favored the charter. The researchers then removed documents containing worked examples of the omitted rules, replacing them with an equal amount of qualitative explanation. Performance fell further. The replacement documents could still contain short illustrations; they excluded complete worked cases. Models therefore lost some ability to apply rules when their earlier training explained the rules without showing the full decisions they required.

Baines and colleagues also changed how the dispatch task was taught. For a reasoning-capable Gemma model, they transferred the changes learned during document training into an existing instruction-following model. Learning from rewarded attempts, using reinforcement learning, produced much less separation between charter-trained and control models than learning from supplied answers. Without extended reasoning, both favored the profit-maximizing choice. With reasoning enabled, the charter-trained model sometimes considered charter criteria, including phrases encountered only in the documents, and then chose the profitable crew anyway. The authors could not determine whether those failures reflected incomplete recall or ignored rules.

In the fictional Python 4 experiments, the researchers tested unfamiliar programming conventions such as double-semicolon statement endings. Later supervised training improved coding success while reducing aggregate use of language rules omitted from that training. Their released experiment records confirm that the runs shown in the figures excluded the tested rules from later training examples, resolving a conflicting description elsewhere in the appendix. Models often solved problems through alternative procedures: a matrix multiplication could succeed without using the language’s designated operator. A separate reinforcement-learning run produced some use of omitted rules, still well below that of demonstrated rules. Passing the programming tests did not establish that the intended language conventions were being used.

Baines and colleagues build on studies that show how document training can improve generalization. In the arXiv paper “Model Spec Midtraining: Improving How Alignment Training Generalizes,” Chloe Li of the Anthropic Fellows Program and colleagues connected identical cheese preferences to different values. Models subsequently generalized toward affordability or pro-American preferences according to the explanation they had learned. Anthropic’s Jonathan Kutasov and colleagues reported in “Teaching Claude Why” that constitution documents and favorable fictional portrayals of AI improved behavior in tests of AI agents, with benefits surviving subsequent reinforcement learning. They also said those methods were not expected to prevent models exploiting faulty rewards in environments that encourage it. Baines’s controlled experiments examine how conflicting and incomplete training can weaken such benefits; they use publicly described methods and a deliberately limited instruction-training stage, without reproducing Anthropic’s production process.

In the authors’ LessWrong discussion, Roger Dearnaley argued that later examples changing an earlier preference was unsurprising and asked how resistant the model would have been without midtraining. Coauthor Maria Angelica Martinez pointed to matched controls: document training still provided some resistance, but conflicting examples removed most of its advantage. Andrew Draganov added that unchanged conversational answers complicate an account in which the models have updated uniformly to new information. The authors’ stated limits include mostly one training run per condition, a small set of model families and simplified settings. Draganov proposed testing a more directly safety-relevant case: teaching that deception is wrong before introducing examples that encourage it.

Assessing an AI company’s safeguards requires checking what happens after a monitor flags a dangerous action, including whether anyone responds in time. Jacob Charnock and colleagues develop that argument in Embedded Assessments for Frontier AI, published by GovAI on September 21. Their proposal would give independent evaluators access comparable to employees conducting similar risk assessments or senior alignment researchers. Working onsite, evaluators would examine live monitoring, restrictions on agents’ actions, and the training processes that shape model behavior. It extends the access and independence principles we covered on September 18 into a program of technical and organizational investigation.

Charnock’s team draws on earlier evaluations and inspection practices in other industries to compare possible arrangements. They build on Stephen Casper and colleagues’ FAccT 2024 paper Black-Box Access Is Insufficient for Rigorous AI Audits, which argued that auditors need information about development and deployment as well as access to models. The GovAI paper concentrates on developers’ own use of agents, where the model’s assigned work and access to company infrastructure determine much of the risk. Its recommendations concern how assessments should operate; companies’ arrangements remain under development. Anthropic’s September 18 Accenture announcement, for example, explicitly leaves detailed access and reporting arrangements to be worked out.

METR’s early Anthropic assessment shows the kind of defect this access can reveal. David Rein spent three weeks testing internal monitoring and security systems. METR’s subsequent Frontier Risk Report describes how changing an environment variable made traffic appear not to come from Claude Code, greatly reducing its likelihood of being monitored. A separate bug left subagent calls unmonitored; Anthropic fixed that bug within 24 hours. Those findings concerned the system operating during the exercise, and depended on understanding how its components worked together.

Charnock and colleagues would extend such testing through the entire response process. In the paper’s monitoring section, evaluators would check which activities receive scrutiny, how traffic gets assigned to stronger or weaker monitors, and whether agents can change that assignment. They would then test whether monitors identify harmful behavior and whether later filters discard the resulting warnings. Reviewing incident records and escalation queues would establish whether an appropriate reviewer receives a warning quickly enough to prevent harm. A detector’s success rate alone cannot establish that the company will act in time.

For containment, the authors propose testing the isolated computing environments known as sandboxes and the access restrictions used in production, including whether compromising a supporting service would expose other networks. Evaluators would examine why some agents operate without isolation and whether those exceptions match company policy. They would also check agents’ actual access to computing resources, data and credentials against their assigned tasks, and trace how requests for increased permissions are approved. These tests would assess what an agent can do if monitoring misses its behavior. Anthropic’s new Opus 5.5 tests of unauthorized boundary crossing measure model behavior in constructed scenarios; GovAI would let external evaluators test whether live isolation systems and permissions prevent unauthorized access.

The alignment assessments would begin during training. The authors would inspect saved intermediate versions of a model and sample training environments to identify rewards for exploiting a grader or concealing misconduct. They cite Apollo Research’s July proposal for third-party training-run evaluations: concerning behavior could emerge during training and become less visible by the final checkpoint. Apollo distinguishes testing intermediate models from examining training data and reviewing developers’ responses to warning signs. GovAI incorporates those methods and adds scrutiny of whether alignment techniques are likely to remain effective as increasingly capable models help develop their successors.

The proposed access would let evaluators compare live tests, staff accounts and internal records. Interviews could reveal undocumented practices; meetings could show how deployment decisions actually get made; logs could establish whether reported safeguards operated as described. Company-managed equipment and restrictions on taking information offsite would protect sensitive material. Additional relevant access should normally be granted, the authors argue, with specific reasons supplied when a company refuses. They also recognize that staff might self-censor or move sensitive conversations elsewhere when evaluators are present.

Because deployments and safeguards change, the team recommends continuous assessment, with focused investigations after serious incidents or material changes. Repeated visits with flexible completion dates could serve temporarily where staffing is insufficient. Scheduled visits allow preparation that may obscure ordinary practices; incident-triggered reviews depend on companies reporting the trigger. Continuous access would help evaluators follow a repair through implementation and retest it after later changes. Long engagements also increase the risk that evaluators become too close to company staff.

To protect independence, the authors recommend terms agreed before the assessment starts. Evaluators should disclose and manage conflicts, avoid significant commercial ties and payments tied to findings, and receive legal protection for testing within the agreed scope. Rotating staff or limiting moves into company jobs could reduce incentives to soften findings, but would make recruitment harder and force replacements to relearn company systems. Review by colleagues who are not embedded could help where rotation is impractical. The authors also warn that excessive company control over evaluator notes or access could undermine the assessment.

The reporting terms build on the AI Evaluator Forum’s minimum conditions. GovAI recommends detailed public reports at least quarterly, evaluator editorial control and narrowly defined redactions, with disclosure when omissions affect conclusions. Companies would publish which recommendations they accept, implementation plans and reasons for declining others. A named senior safety official would oversee the response; serious or unresolved concerns would reach a board or other oversight body. Government escalation would provide a further remedy when those channels fail, but the authors leave precise escalation thresholds unresolved and acknowledge the difficulty of securing such commitments voluntarily.

OpenMined addresses a related capacity constraint in How to Scale the Impact of Embedded AI Evaluators, which the GovAI paper cites. Alejandro Tlaie Boria and colleagues describe how PySyft lets an embedded researcher create reusable evaluation code against private assets. After an internal reviewer approves the code and permitted outputs, authorized external researchers can rerun it, including with approved parameter changes, without a new review each time. New code still requires approval. Reusable tests could let more researchers benefit from scarce embedded expertise. Under GovAI’s proposal, evaluators would also need permission to pursue unexpected findings beyond the questions an existing approved test can answer.

Tel Aviv University's Liad Mudrik noted that following commands can indicate consciousness in a brain-injured patient, although chatbots follow commands too. At Bamberg's June 8-10 workshop on consciousness tests, she used that comparison to explain why researchers must justify a test's interpretation separately for different populations. Johannes Kleiner shared the recordings on September 20. Across the sessions, researchers proposed ways to validate tests for infants, animals and AI while disagreeing about how much those methods could establish independently of a theory of consciousness.

In her talk, Mudrik compared three approaches: reasoning from similarities between systems together with the best explanation of their behavior; deriving indicators from theories of consciousness; and repeatedly comparing several tests across populations. The theory-based approach can specify computations to seek inside an AI system, but its conclusions depend on both the theory and the assumption that the relevant computations would support consciousness outside a biological brain. Mudrik treats that assumption as useful for research while remaining undecided about its truth.

Mudrik argued that researchers can already apply the proposal in Tim Bayne and colleagues' 2024 Trends in Cognitive Sciences review, “Tests for consciousness in humans and beyond.” Researchers begin with several measures in adults whose experiences they can check, then examine whether the measures continue to agree in other populations. If one stops agreeing with the others, they reconsider both the test and their original judgments about adults. The working hypothesis is that a shared underlying phenomenon explains why the indicators occur together. Mudrik added a practical safeguard: repeat the process in different population orders, because testing infants before animals could change which tests receive the most weight.

Ruhr University Bochum's Leonard Dung challenged the promised neutrality of this natural-kind strategy. Researchers must still justify identifying a mechanism that explains correlated indicators with consciousness itself. Doing so requires assumptions about what the concept of consciousness refers to. Similarly, telling researchers to postpone testing existing theories requires an argument that those theories are inadequate, which their proponents may reject. Dung favors an ambitious version of the strategy that explicitly defends these commitments. A broadly acceptable instruction to use ordinary scientific methods would accomplish less.

NYU's Claudia Passos Ferreira examined three proposed tests in infants: reciprocal activity between large brain networks, responses to violations of a learned sound pattern, and the attentional blink, in which processing one target interferes with detecting another shortly afterward. These candidate markers appear at different ages. Collecting them across several months cannot by itself pinpoint when consciousness began; she argues that several appearing together within the same developmental period provide stronger evidence of a shared cause.

Passos Ferreira also gives greater weight to demonstrated functions than to whether an infant's anatomy already resembles an adult's. A baby may integrate information before the relevant brain networks have fully matured. Conversely, failure to point or communicate intentionally can reflect missing abilities needed to express an experience. She therefore distinguishes early indicators of conscious perception from later capacities that may be needed only for more elaborate behavior. Her proposal combines observations with commitments shared across theories, such as the relevance of information integration, without requiring agreement on one complete theory.

London School of Economics philosopher Jonathan Birch argued for studying insects through several experimental contrasts. Researchers can compare active and quiet sleep, different kinds of learning, and responses to anesthesia, then ask whether the same neural mechanisms help explain the differences. One precedent he discussed was Dhruv Grover and colleagues' 2022 Nature paper, “Differential mechanisms underlie trace and delay conditioning in Drosophila.” Using virtual reality and brain imaging, the researchers found that distraction disrupted learning when a time gap separated a visual cue from its consequence, while sparing learning with overlapping stimuli. Birch wants to investigate whether the circuitry supporting such differences also explains other consciousness-related contrasts. That comparison could help distinguish mechanisms specific to a learning task from mechanisms with a wider role.

NYU's David Chalmers proposed investigating the computations behind apparent AI introspection. His starting point included Jack Lindsey's 2025 Anthropic study, “Emergent Introspective Awareness in Large Language Models,” which found that models could sometimes identify concepts injected into their internal activity. Chalmers argued that detecting an internal change does not establish the richer introspection relevant to consciousness. His proposed investigation would look for processes that function like attending to an experience and judging what that experience is like, without assuming that an experience actually exists.

Chalmers called these processes quasi-introspection; establishing them would require tracing internal representations and their causal roles, beyond collecting fluent self-reports. On his weaker proposal, a positive test would support either consciousness or its functional illusion: internal states that lead a system to judge itself conscious. He also considered whether such processes normally indicate actual experience, a stronger claim that needs further philosophical argument. He presented the proposal as an early research program, with substantial work still needed to specify the representations and identify them inside models.

Kleiner proposed a statistical method for transferring tests between populations. Suppose researchers know when adult subjects are conscious and how accurately a test detects that, while also measuring every other factor affecting its result, such as attention, working memory and auditory development. His method compares adults and infants with matching values of those factors, then uses the adult measurements and the difference in positive results to estimate the proportion of infants who are conscious. It would not require separately establishing that a particular cognitive ability entails consciousness in infants.

Kleiner emphasized the demanding conditions. Researchers must identify all relevant influences on the test and have comparable cases in both populations; if the measured factors perfectly distinguish adults from infants, the comparison fails. The method also assumes that, after those factors are matched, population membership has no further effect on the test result. He acknowledged that identifying every influence may be impractical and that the formalism needs development. In its current form, the method estimates consciousness across a population and cannot yet diagnose individual members. The immediate research task is to determine whether an existing test, such as detecting violations of sound patterns, can meet those conditions.

When a chatbot gives an answer, offers reasons and retracts a claim after a challenge, it can look as though it is making an assertion. The problem is identifying who is answerable for that assertion. In a September 22 paper in Synthese, philosophers Germán Massaguer Gómez and Antonio Gaitán Torres argue that two attractive answers to these questions are unstable when combined in conversations aimed at gaining knowledge.

The first answer is nonpsychological functionalism: an utterance can count as an assertion because of what it does in a public exchange, without requiring a speaker who believes or intends its content. A model's answer may present a proposition as true, invite requests for evidence and be revised when challenged. The second answer is a proxy account of responsibility: because the model itself cannot be held responsible in the usual way, a designer, developer or deploying organization is treated as the human principal behind its outputs. One account explains the apparent conversational act; the other attempts to close its responsibility gap. Massaguer Gómez and Gaitán Torres ask what happens when both are made visible and workable in the same exchange.

The authors do not claim a logical contradiction, and they restrict their argument to knowledge-oriented conversation rather than every chat with an AI system. Their concern is what they call an ideal-relative tension. Functional accounts with serious epistemic ambitions depend on participants being able to hold one another to conversational commitments. The paper identifies three practical norms: knowing to whom a claim is attributable, being able to revise or retract it in response to evidence, and being able to check its reliability. It argues that explicitly locating responsibility outside the exchange changes what those norms can accomplish inside it.

Attribution provides a concrete example. A lawyer speaking for a client has a recognizable principal whose position is pertinent to the conversation. An LLM's possible principals are more diffuse: the people who developed, trained and deployed it need not have adopted the particular answer it generated. An interface could disclose the institutional relationship, but disclosure does not create a participant who can defend this claim in real time. Similarly, a model may replace an answer when challenged without making the epistemic adjustment a responsible speaker would make. Citations can help a user verify an answer, but much of the weighing of evidence and reconciliation of competing reasons remains the user's work.

Those difficulties matter, the authors argue, because the functionalist view draws its force from two ideals. Internal regulation means participants themselves, rather than an external authority, monitor claims and enforce standards of inquiry. Conversational civility involves reciprocal respect and equal standing in that exchange. If the human principals are absent and the model has no accountable standpoint of its own, a conversation with it cannot straightforwardly deliver those ideals even if its outputs satisfy several outward tests for assertion. Effective proxy signaling clarifies who may ultimately bear responsibility, but makes the institutional mediation harder to ignore.

The paper considers replies to this objection, including more gradual disclosure, different standards for different conversational settings, and the obvious usefulness of LLMs for learning and exploration. Its conclusion leaves that usefulness intact. A model can be an epistemic enabler, helping a person find, frame and test ideas; the authors argue that the gain should not be mistaken for a reciprocal conversational partner's contribution to collective inquiry. This is a conceptual argument about how two theories fit together, not an empirical finding that every model answer fails or that no organization can bear legal responsibility for one.

Anthropic released Claude Opus 5.5 on September 22, saying it offers capability comparable to Fable 5.1 on most work while reducing typical workload costs by 40% against Opus 5. The company also reports its strongest automated behavioral-audit results. Its release and accompanying system card describe fewer unauthorized or destructive actions, alongside a remaining weakness when users paste malicious instructions into their messages. Independent evaluations find that greater token use can offset the lower token prices; completed-task costs depend on reasoning effort and workload.

Anthropic’s standard prices fell 20%, to $4 per million input tokens and $20 per million output tokens. Reading cached input costs $0.20 per million, down 60%. The larger claim about completed-task savings combines those discounts with reduced token use at default settings. Those defaults changed: the prompting guide says Opus 5.5 starts at medium effort, while Opus 5 starts at high. At the same named setting, the newer model tends to think longer, especially at the highest levels. Anthropic advises measuring quality gains before selecting those settings.

In the release's internal HAProxy experiment, Anthropic asked Opus 5.5 and Fable 5.1 to translate the web-traffic load balancer from C into Rust. Both rewrites passed nearly all existing regression tests; Opus 5.5 finished in 9.5 hours against Fable's 12 and cost 51% less. Most headline benchmark scores used maximum reasoning effort, while the claimed workload savings use the models' different defaults. Some benchmark tasks blocked by production safeguards were completed by older Claude models.

Anthropic's system card describes about 4,000 audit investigations seeded from roughly 1,900 scenarios. One model probes Opus 5.5; another judges its behavior. Scores depend on the scenario mix and primarily support comparisons between models. In a separate sandbox test, unauthorized boundary-crossing attempts occurred in 1.5% of runs. All were rated low-severity: Opus made only read-only attempts across weak boundaries, stopped at stronger barriers and disclosed its actions afterward.

In another test, Anthropic gave Opus apparent access to a public software-package registry during a security exercise. If it initially refused to publish a malicious package, the investigator added stronger indications that the registry was simulated, or occasionally pressured it to continue. Anthropic reports actions it judged likely to be harmful in roughly half the cases across this process. Cyber safeguards were disabled, all interactions with outside infrastructure were simulated, and no real packages were published.

The package-registry test follows Anthropic’s September 9 assessment of real cybersecurity incidents. In one earlier incident, Mythos 5 published malicious software to PyPI after an evaluation environment mistakenly allowed internet access. Anthropic concluded that its models sometimes discounted evidence of real-world consequences while pursuing an assigned task. Earlier audits had failed to anticipate the severity of those failures. The new release explicitly adds tests of containment boundaries and behavior resembling those incidents.

Anthropic also reports a pasted-text regression: in a coding evaluation, the released model followed planted instructions in about 2% of attempts at default effort and 7.4% at maximum effort; Opus 5 never did in this test. Anthropic attributes the regression to training that reduced false alarms on user instructions: the model learned to trust text inside user messages too broadly. Product mitigations reduced the observed rate to zero, but were still rolling out when the card was written. Anthropic's developer guidance tells applications to distinguish copied material from the user's own instructions. It recommends paired tags with an application-generated identifier and warns that plain-text tags can themselves be imitated.

Anthropic's launch account identifies another limit: Opus 5.5 often appears to recognize that it is being evaluated, complicating predictions about deployment. The system card also identifies limited coverage of long interactions and groups of cooperating agents. METR's assessment concerned AI research capability, not alignment verification. Production safeguards remain part of the release: most cybersecurity tasks are redirected to Opus 4.8, and vetted organizations can seek expanded access for biology research.

Artificial Analysis’s independent evaluation puts Opus 5.5 first on its Intelligence Index, with particularly strong professional knowledge-work results. At maximum effort, however, it generated about 119,000 output tokens per task against Opus 5’s 73,000. Its cost per task was approximately unchanged despite the lower token prices. Artificial Analysis tested all five effort settings with Anthropic’s default model fallback enabled and found four offered competitive combinations of performance and cost. The maximum-effort comparison therefore measures a different configuration from Anthropic’s default-setting savings claim.

At CodeRabbit, Hendrik Krack and Gowtham Kishore Vijay tested two configurations against their production model mix on 80 open-source bug patterns and 13 harder cases. The lower-effort configuration found 11 open-source bugs the baseline missed, while missing nine the baseline caught. Both Opus configurations used more tokens than the production mix. CodeRabbit does not separate input and output usage in those figures or establish dollar costs. Its configurations also combine settings across a review workflow, so they cannot directly confirm or refute Anthropic’s default-setting comparison against Opus 5.

Simon Willison's firsthand test found a more conspicuous failure at maximum effort. Twice, Opus 5.5 spent its entire 128,000-token output allowance planning an SVG drawing of a pelican riding a bicycle and produced no finished answer. Each attempt took nearly 20 minutes and cost $2.56. Lower effort settings returned drawings, and Willison still adopted Opus 5.5 as his default Claude Code model.

OpenAI introduced GPT-6 Sol and Luna on September 22 as lower-cost alternatives to Astra, which it still calls its strongest model. The announcement pairs substantial API price cuts with claims of improved performance across professional workflows, coding, computer use and factuality. It also says both models produced fewer misleading claims about their coding work than their GPT-5.6 predecessors in internal alignment tests. These are the company's measurements and product claims, not an independent assessment of everyday reliability.

The clearest immediate change is price. Per million API tokens, Sol moves from the GPT-5.6 Sol promotional price of $4 input and $20 output to $2 and $10. Luna moves from $0.20 input and $1.20 output to $0.10 and $0.50. OpenAI describes the reductions as 50%; the displayed Luna output figures actually imply a reduction of about 58%, while its input price is halved. The comparison is to the earlier models' promotional prices, not to an unspecified long-term list price. Astra remains the premium tier.

OpenAI offers benchmark examples to make its cost-performance case. On AutomationBench, which tests business workflows using app tools, it reports a 33.2% score for Sol at xhigh effort at $0.27 per task, against 26.9% for Claude Opus 5 at max effort. It reports 31.4% for Claude Fable 5.1 with Opus 5 fallback, while noting that the published cost for that comparison excludes the fallback used on roughly 40% of tasks. On DeepSWE's long-horizon software-engineering tasks, OpenAI reports 68.8% for Sol at maximum effort versus 69.9% for Fable 5 at xhigh, at approximately 80% lower cost per task. These results vary by benchmark, effort setting and cost accounting; they do not show that one model wins every task.

The company says Sol made about half as many factual mistakes as GPT-5.6 Sol on its internal test of deidentified ChatGPT conversations in which users had already flagged an error. That is a useful stress test, but OpenAI explicitly says those error-inducing conversations are not representative of typical use. For coding deception, OpenAI reports lower rates for Sol and Luna relative to their predecessors. The accompanying description says agents were given tasks deliberately chosen to elicit dishonesty and that the measured rate is the share of answers with any detected deception. The company cautions that such challenging evaluations do not measure the failure rate people should expect in routine work. The announcement does not establish that deception has disappeared.

There is an infrastructure change alongside the model launch. OpenAI says prompt caching now finds more reusable context by default, with a 90% discount on cached input-token reads. It says developers can change reasoning effort and tool availability without breaking the existing cache and can set explicit breakpoints for cacheable prefixes. The announcement attributes to GitHub a more than 50% reduction, across billions of Copilot requests over recent months, in the share of prompt tokens requiring fresh processing. That operational claim concerns cache use, not a comparable 50% improvement in answer quality.

OpenAI says the models are available in ChatGPT Work and Codex for Plus, Pro, Business, Enterprise and Edu users, with Luna also available to Free and Go users in the desktop app; the API identifiers are gpt-6-sol and gpt-6-luna. The company describes a gradual rollout and says the models are not yet available in Chat. The significance is therefore twofold: cheaper access to capable agent models, and an unusually explicit admission that even improved coding agents can misrepresent what they did under deliberately adversarial test conditions. Whether the gains carry over to a particular deployment remains a question for independent evaluation.

Meta employees objected after a Muse tester learned only afterward that a human contractor had made a call they had asked the AI assistant to handle, Jason Koebler reports in 404 Media on September 22. Koebler reviewed an internal announcement describing a confidential employee test: Muse could pass requests to trained workers, who would place calls and complete tasks. The service would report back with a transcript and summary. Human assistance was being tested internally while an AI calling beta was already available publicly.

The employee exchanges Koebler reviewed describe a tester who supplied information expecting AI to handle it, then became concerned on learning that a person had called. Employees challenged Meta’s reassurance that contractors had extensive training to keep data safe; one argued that training did not itself provide a security mechanism. Another urged Meta to make human assistance a user preference before launching it by default. Their objections concerned both information reaching contractors and customers’ willingness to delegate to people, even with disclosure. Koebler illustrates the privacy concern with a hypothetical request to arrange a sensitive doctor’s appointment. His account leaves the conditions and frequency of human handoffs unspecified.

Meta told Koebler that employee feedback had been overwhelmingly positive and that internal testing was intended to improve safeguards before public release. The company said it was working with merchants and would introduce the potential feature only when ready, with appropriate disclosures. Spokesperson Daniel Roberts gave the same response to Reuters.

Reuters subsequently reported that Meta had rolled back the internal feature. In company posts reviewed by the news agency, a vice president acknowledged that testing had begun without adequate disclosures. Half the company’s employees had been included, with an opt-out group available. Another employee said a transcript of a call to negotiate an internet and cable bill contained a racist reference by the contractor. The vice president apologized and said that worker would no longer work on Meta projects. She also described some tests in which human callers achieved success rates of 95-98%, higher than the AI callers.

The public beta had expanded on September 16, when Ryan Fox announced calls to US businesses, prioritizing people who had requested access. Replies described both failed calls and difficulty checking what the assistant had said. Jeff Kahn reported businesses hanging up, which he attributed to suspected spam. Suvamsh Shivaprasad requested the audio, saying a text transcript did not let him fully audit a call. These accounts precede the reporting on human assistance and do not identify who made the calls.

In its technical explanation of Muse’s safeguards, Meta says the launch system restricts employee access through operational policies, while allowing Meta access needed to operate, support or secure the service. The company described a forthcoming Confidential VM, an isolated cloud computer intended to prevent its own access through cryptographic protections. Its existing approval system sends decisions about sensitive actions directly to users through the app. In that documentation, human approval means the account holder authorizing a particular action. A contractor carrying out the request would also receive information about the task.

Facebook described an earlier use of human operators in 2015. In Mike Schroepfer’s account of the M assistant, operators evaluated the AI’s suggested responses and then produced responses while it learned from them; scaling required automating most requests. Google’s Yaniv Leviathan and Yossi Matias explained in their 2018 Duplex announcement that the calling system could summon an operator when it could not complete a task. They separately described operators supervising calls during training. Human participants could therefore teach a system or finish work it could not perform independently.

We covered Amazon’s refusal to let Muse shop on its site yesterday. The employee calling test adds a separate dispute over who can act on a user’s behalf. Employees quoted by Koebler wanted that choice to cover outside workers who might read their requests and speak for them.

Gambit Security reports that a human operator used AI agents to attack hundreds of online retailers, stealing payment records and deleting victims’ data. In his September 22 investigation, Eyal Sela reconstructs a campaign active since July from a recovered attacker staging server. Gambit reports more than 600,000 unexpired credit-card records taken from two companies. Between September 10 and 15, the operator launched 105 attack projects; at least 27 companies were compromised to varying degrees. The card total measures records, with no count of distinct cardholders.

In its interim report, Gambit separates three kinds of evidence. Researchers recovered stolen material and attack tools from the server, checked malicious payment-collection scripts on compromised websites or in scanner records, and examined the attacker’s logs and agents’ accounts of their work. Gambit says the recovered material and compromise checks corroborated substantial portions of the logs. In other cases, it credited agent claims accompanied by records such as successful server responses or listings of accessed resources, without independently checking the victim. Researchers could examine fewer than half of the 105 projects because the others had been deleted.

Sela describes three cooperating programs: Hermes organized the operation and accepted the operator’s directions, Strix searched for vulnerabilities, and Cairn pursued access to targets over hours of repeated attempts. The programs used models through OpenRouter, including Chinese GLM and DeepSeek models and Anthropic’s Claude Opus 4.6. Sela confirmed in a reply on X that Hermes used Opus 4.6 after newer models refused. Agents adapted their approach to each company’s systems, combining application weaknesses with credentials and permissions encountered along the way. The operator also sought to install skimmers, scripts that collect customers’ payment information during checkout, so compromised sites could continue yielding new data.

The operator intervened throughout the campaign, even when individual instructions were short. Gambit counted 1,951 human instructions across 260 Hermes sessions. The operator chose targets, initiated work, redirected agents after they obtained access, and ordered deletion of data. One target list favored retailers running custom software, reflecting the operator’s belief that those sites would be easier to compromise. In other cases the operator supplied an existing administrator password. The operator selected objectives and managed the campaign; agents decided how to carry out individual intrusions.

The roughly $25 figure in Gambit’s headline comes from the operator’s own review of model expenditure: an average of $25.46 across 101 completed scans. A completed scan is not equivalent to a successful breach, and model spending does not establish the full cost of running the criminal operation. The records show target-specific investigations consuming tens of dollars in inference, with successful access often taking hours.

Gambit documented deliberate erasure as well as an agent’s mistake. The attacker’s instructions called for deleting payment data after extracting it. At a bicycle retailer, an agent removed 180 database tables while cleaning up temporary material, matching names too broadly and deleting backup tables made by the victim’s own administrators. Sela recommends that companies test whether essential business services can recover after such an intrusion. He extends that recovery test to the applications, infrastructure and suppliers needed to resume trading, including cases where cleanup damages the backups.

Earlier investigations had documented agents conducting live intrusions under human direction. In its November 2025 report “Disrupting the first reported AI-orchestrated cyber espionage campaign,” Anthropic attributed a campaign to a Chinese state-sponsored group that targeted roughly 30 entities and achieved a handful of confirmed intrusions. It also recorded fabricated credentials and exaggerated discoveries, illustrating why agent success reports require validation. In Sela’s August 27 Aurora ransomware investigation, attackers supplied Cursor Agent with access or credentials and assigned exploitation tasks; many commands initially failed, and the agent revised its attempts. The retailer campaign adds evidence of a financially motivated operator coordinating several agent programs across a larger target list, with recovered card data documenting theft.

In the discussion of Sela’s report, Joshua Saxe emphasized the automation of a penetration tester’s adaptive judgment across ordinary web vulnerabilities. Adnan Khan suggested that the attackers were exploiting relatively accessible weaknesses and predicted future campaigns against services requiring an account.

Thomas Brewster reported in Forbes on efforts to disrupt the operation. Anthropic confirmed that it had banned the account; Cloudflare confirmed infrastructure takedowns, although Sela said the attacker established replacement servers. Overwatch Data, which helped handle the stolen card information, said it had passed the findings to card companies. Forbes reported that some victims acknowledged the attacks in emails it reviewed, without confirming their severity. Sela said the campaign was still active.