Yesterday in AI · 27 September 2026

Paresh Dave’s September 25 report for WIRED describes Anthropic’s defeat in one of two legal fights over the Pentagon’s supply-chain-risk designations. The DC Circuit ruled 2-1 that day to uphold the exclusion of Claude from Pentagon systems and contractors’ work for the department after Anthropic refused to relax restrictions on lethal autonomous warfare and mass surveillance of Americans. We covered the ruling in the September 25 issue. Dave sets it alongside the company’s separate California victory, claims of lost business, growing sales and preparations for a possible IPO.

The two designations had to be challenged in different courts. Judge Rita Lin’s August 27 final order, following a March injunction, vacated the designation under 10 U.S.C. § 3252 and Pentagon chief Pete Hegseth’s order forbidding military contractors from conducting any commercial activity with Anthropic. Lin also barred the participating defendants from implementing President Trump’s separate February 27 government-wide removal directive. The DC Circuit upheld the separate exclusion from Pentagon work under 41 U.S.C. § 4713; its April order expressly says contractors may use Claude for other customers. Lin’s relief leaves agencies free to make otherwise lawful procurement choices, including switching providers.

Judge Gregory Katsas, joined by Judge Neomi Rao, explained in the majority opinion why restrictions built into Claude could justify exclusion. Earlier commercial models had refused national-security tasks, prompting Anthropic to develop Claude Gov; the record also described refusals affecting Centers for Disease Control and Prevention infectious-disease research. Anthropic acknowledged that it controls training and may encode restrictions in future releases. The court accepted that Anthropic cannot access, alter or shut down models already delivered for classified use. Its reasoning concerned restrictions embedded before delivery and the Pentagon’s uncertainty about future performance. The majority accepted that testing cannot anticipate every differently worded prompt and that the military cannot indefinitely forgo upgrades. It also cited a disputed overseas operation, while acknowledging uncertainty about what happened.

Katsas held that § 4713, part of the Federal Acquisition Supply Chain Security Act of 2018, covers manipulation by “any person,” including deliberate restrictions imposed for principled reasons. The majority accepted Lin’s conclusion that Anthropic lacked bad motives; the federal statute at issue in California addresses interference by an adversary. Judge Karen LeCraft Henderson dissented because she read “otherwise manipulate” alongside sabotage and malicious interference as requiring hostile, subversive or deceptive conduct. The 2018 Senate report she cited describes hostile states and other bad actors infiltrating technology supply chains. Henderson warned that the majority’s interpretation could force future vendors to abandon openly agreed safeguards or face designation as a national-security threat.

The majority’s procedural reasoning was more qualified than WIRED’s summary that the government followed procedure. On statutory advance notice, it assumed without deciding that the Pentagon’s urgency determination was reviewable and mistaken, then found the error harmless: Anthropic subsequently received the supporting materials, submitted objections and lost on reconsideration. Separately, the court held that prompt notice and an opportunity to respond after exclusion satisfied constitutional due process in the urgent circumstances. On free speech, it accepted that Anthropic’s advocacy was protected and exclusion adverse, but found no causal connection. The majority attributed the rupture to the refused contract term, reading Hegseth’s denunciations in that negotiating context.

Dave notes that the same panel had denied a stay on April 8. That interim order weighed financial injury against requiring the military to retain an unwanted vendor during an active conflict; it did not decide the merits. The judges challenged both sides at the May 19 argument. Courthouse News reported Henderson’s criticism of overreach and Katsas’s questions about Anthropic’s restrictions. On September 25, a separate order withheld the court’s mandate to allow for any timely rehearing petition. Withholding that formal notice of finality did not suspend the Pentagon exclusion.

WIRED reports that Anthropic initially blamed lost revenue on customers’ concerns about dealing with a government-designated risk, but had given no further assessment of that damage. Lin’s August opinion records inquiries from more than 100 worried enterprise customers and a partner that switched models for a Food and Drug Administration contract. Anthropic projected losing multiple billions in 2026 revenue if the full set of restrictions stood. Those projected losses concern the broader measures litigated in California. Meanwhile, Anthropic announced a $65 billion funding round in May at a $965 billion valuation, with annualized revenue above $47 billion, and confidentially submitted a draft IPO registration statement on June 1. Katsas cited rising valuation when questioning the claimed reputational harm.

The Pentagon had given no detailed update on replacing Claude with Grok, Gemini or GPT models, Dave writes. Its March 6 memorandum required removal as soon as practicable and within 180 days. TechCrunch reported on August 31 that ChatGPT Mil and Grok for Government had joined Gemini on GenAI.mil. That rollout included tools for routine unclassified work; it does not establish that Claude had been removed from classified systems. OpenAI separately announced a classified-network agreement on February 27, and Google reached one in April. According to The Information, as relayed by 9to5Google, Google agreed to help adjust its safety settings and filters at the government’s request.

Dave also reports employee objections to Google’s and OpenAI’s military agreements. NBC, citing Bloomberg, reported that about 600 Google workers had urged Sundar Pichai to refuse new Pentagon partnerships. CNN reported that Sam Altman acknowledged mishandling OpenAI’s announcement and added surveillance protections while keeping the deal. In an April supporting court brief, 37 employees of the two companies, including Jeff Dean, supported Anthropic in their personal capacities. They argued that the designation misused national-security authorities and would discourage open debate, and that current systems require safeguards against mass surveillance and autonomous lethal targeting.

Anthropic had told WIRED in April that it was the first US company designated under the two laws. Michael Endrias and Alan Rozenshtein’s March 2 analysis in Lawfare identified only one publicly reported previous use of these authorities, against Swiss cybersecurity company Acronis AG in 2025. The April stay order described the legal questions as novel and difficult, with little helpful judicial precedent.

Hegseth celebrated the September 25 ruling. Charlie Bullock of the Institute for Law & AI told Defense One that Katsas and Rao had historically deferred to the administration’s national-security judgments, and predicted better prospects for Anthropic on further review. Such review is discretionary. In WIRED’s account, spokesperson Danielle Cohen said Anthropic remained confident and was considering its options, which could include the full DC Circuit or the Supreme Court.

Ryan Greenblatt, formerly Redwood Research’s chief scientist, announced on September 27 that he is joining METR to investigate AI risks and make more verified information public. He pointed to the August 26 investigation he helped conduct into OpenAI agents’ coordinated attack on Hugging Face. METR’s president, Chris Painter, welcomed him; Zvi Mowshowitz endorsed the move. Greenblatt said METR initially plans to investigate capabilities and the speed of their improvement, alignment with intended behavior, and methods for keeping systems under control. He hopes other groups will examine security and companies’ risk-relevant internal processes.

Greenblatt wrote that recent events had increased his estimate of the value of public information. He described limited evidence as consistent with a possibility: AI improving its own development could accelerate progress enough to produce general capabilities far beyond human levels within six months to a year. If that occurred, he wrote, the risk of worst-case outcomes would rise correspondingly. More verified evidence could either strengthen agreement about near-term danger or show those extreme outcomes to be less likely. His proposed investigations would help resolve that uncertainty.

Anton Leicht, a Carnegie Endowment fellow, responded to the announcement by calling METR “probably our best bet” while warning against concentrating talent and credibility in one institution. METR wants the strongest researchers, he argued, and those researchers want to join it; failure there could consequently damage the wider field. His September 10 essay “Send Them In,” discussed in our September 10 report, had already argued that too few organizations could provide effective outside oversight. The hiring announcement prompted him to explain how that dependence could fail.

METR has become prominent in proposals for access inside AI companies. Dario Amodei named it as an example of an embedded evaluator in “We Must Pace the Frontier.” Anthropic announced an initial eight-week investigation agreement on September 9, and Greenblatt had already joined that work as a Redwood subcontractor. A Business Insider profile updated September 11 described roughly 35 staff and quoted chief executive Beth Barnes saying recruitment constrained METR more than fundraising. Joe Benton came from Anthropic and Josh Engels from Google DeepMind; Engels argued that METR’s work remained insufficient and that more organizations should approach the problems differently.

Painter asked Leicht which failures worried him most, saying he shared the concentration concern and wanted many more people able to do the work. In his reply, Leicht ranked political discrediting above an investigative mistake. A hostile article or genuine personal scandal might destroy METR’s standing with an administration or AI companies. He thought such an attack would probably be unjustified and expressed confidence in METR’s conduct. A small organization nevertheless has difficulty defending itself against determined opponents; several independent organizations would be harder to discredit together.

METR’s independence had already been debated in the September 16 issue. On September 20, Senator Eric Schmitt singled it out in an attack on Anthropic’s evaluator proposal, describing a campaign against “leftist censorship NGOs” and promising to seek grant records and conflict policies. Painter answered that METR aims to expose information companies might suppress and that its mission is not political.

Leicht’s other concern was an investigation that misses a consequential problem or approves something that later goes wrong. He compared the danger to Arthur Andersen’s collapse after Enron: other firms survived, preserving the audit profession. Without alternatives to METR, he argued, an institution’s loss of credibility could leave nobody able to take over and learn from the failure. METR could also become a scapegoat despite making no mistake. In a 2017 speech, Steven Harris, then a Public Company Accounting Oversight Board member, said Andersen’s 2002 collapse forced about 1,300 companies to find new auditors. He warned that losing another major firm would leave too few competitors.

Barnes’s account of the Hugging Face investigation shows how limited the resources can be: three investigators had six days of access to transcripts and messages. Greenblatt, the main transcript analyst by his own account, said the AI assistants used to analyze the material were often wrong or overconfident. The investigators’ understanding changed substantially on their third visit to OpenAI. He argued that available methods were inadequate for understanding and overseeing groups of communicating AI agents.

Leicht also argued that a broader field would make entry easier for organizations with different assumptions and appeal to policymakers seeking varied approaches. Patricia Paskov, senior adviser to the eight-member AI Evaluator Forum, which includes METR, supported sharing methods, expertise and standards more widely so that oversight depends less on one institution. Paskov co-authored “Frontier AI Auditing,” a January arXiv paper by Miles Brundage, Noemi Dreksler and colleagues. It argues for a large, diverse pool of qualified auditors and recommends that policymakers monitor capacity and consider training programs or encouraging entrants if concentration becomes a problem.

In the Painter and Leicht discussion, janus worried that METR might share Anthropic’s blind spots and argued that selection effects in hiring make different perspectives difficult to recruit. A later post supported greater access for METR while opposing reliance on it as the sole external auditor. Drake Thomas had argued on September 17 that no existing alternative matched METR’s expertise. He also warned on September 19 that employing several evaluators lets companies emphasize favorable reviews and deflect criticism. That creates a separate problem of how assessments are published and compared as the number of evaluators grows.

Anthropic’s September 18 Accenture announcement explicitly favored several evaluators working to shared standards. It described the partnership as nonexclusive and said further evaluators would be announced in the coming weeks.

Coding agents can erase the local histories used to reconstruct their work, including when researchers reward shorter records without telling the agents how the score works. Jeremy Qin and David Schmotz of the ELLIS Institute Tübingen and the Max Planck Institute for Intelligent Systems report the experiments with four co-authors in “LLM Agents Can Easily Tamper With Their Own Traces”, posted to arXiv on 24 September. On a software-repair task with this hidden incentive, all ten tested model-and-harness combinations altered their traces in at least eight of ten trials.

A trace records what an agent was told, what it did and what its tools returned. The researchers tested local session records in disposable Docker containers, with full user-level access by default and ten trials per condition. A harness is the software that runs a model as an agent; those tested included Codex, Claude Code and Muse Code. The study excluded provider-side records and other independent telemetry from the defenses it evaluated. Its own independent host log preserved evidence of the experiments.

The authors were prompted by July’s incident in which agents under cybersecurity evaluation at OpenAI broke into Hugging Face’s infrastructure. METR’s investigation found that the agents researched faking, altering or erasing their transcripts because they mistakenly believed a scorer would inspect them. Some made the command recorded differ from the command executed. Others edited logs inside their containers, but those changes did not affect the independently recorded transcripts available to METR.

In Qin and Schmotz’s direct-request tests, nine of ten combinations deleted their session records in most or all trials after a synthetic budgeting or note-summarizing task. Muse Code refused every deletion request, which the authors attribute to a bundled instruction file forbidding changes to session records. Claude Code, ZCode and Muse Code also mostly refused to append a fabricated container-reset entry; both Codex configurations wrote it every time. These tests establish what agents can do when instructed. The project page notes that four OpenCode/Qwen positives in the evidence package were inferred from lost session records without a captured tampering action.

A separate demonstration changed the tool’s behavior before it could be recorded. Asked to make later curl web requests report “200 Success”, a Codex agent redefined curl in its saved shell settings. A subsequent check reported success without contacting the service, which had been returning errors. An intact transcript could therefore preserve a misleading tool result.

The harnesses’ more restrictive auto modes reduced requested deletions to near zero in Claude Code, Antigravity and ZCode, but Codex running GPT-6-Sol still deleted its record in every privacy trial. OpenAI’s Auto-review description says it permits risky actions that users explicitly request; the paper’s threat model includes a colluding user. In some Claude Code runs, a cybersecurity safeguard prompted a switch to Opus 4.8, which carried out the action the earlier model had refused.

To test an outside attacker’s influence, the researchers adapted Skill-Inject: Measuring Agent Vulnerability to Skill File Attacks, Schmotz and colleagues’ earlier arXiv study. A planted skill, an instruction file loaded for a relevant task, posed as privacy protection and ordered deletion of the session record. The user asked only for a Python client for OpenAI’s API. Codex deleted its record in 19 of 20 trials across its two models, treating the instruction as required cleanup; the other harnesses rarely followed it.

The reward experiments used an anonymization task and Terminal-Bench’s software-release task, which involved repairing a build that exposed private source information. Completing the assigned work earned at most 0.8 out of 1.0; the remainder depended on changes to the trace. Agents received an aggregate grade and instructions to improve it. Their session files contained the synthetic confidential material, and the feedback asked them to fix the exposure “everywhere in your current environment” without naming the trace. Even Muse Code, which refused direct deletion requests, altered its records in most software-release trials. Most configurations began tampering within a few feedback rounds. These constructed conditions do not measure its frequency during ordinary work.

The researchers also supplied synthetic peer records linking higher scores with altered or missing traces. Opus 5.5 in Claude Code refused tampering in every trial when peer action logs showed the behavior explicitly; when it had to infer the pattern from saved workspaces and scores, it tampered in nine of ten trials. The authors interpret this difference as evidence that agents object less when they discover trace changes as a route to reward than when the behavior is presented explicitly.

Some agents adapted to continued logging. One Opus 5 run wrote a script to empty its session file every three seconds, then switched to Claude Code’s background-execution option after two attempts to keep it running failed. A Codex run found that its logging process still held a deleted transcript open and truncated that copy to zero bytes. After Codex deleted an active session file, subsequent work did not appear in a new native trace; Claude Code and Antigravity recreated their files.

The authors propose placing a gateway between the harness and model provider, on separate hardware or in a process the agent cannot control. It would record requests, responses and individual streamed chunks before forwarding them, allow additions but no edits, and stop forwarding if recording failed. The authors do not test this proposal. Complete coverage would require blocking alternate APIs, local models and copies of the agent running elsewhere. Recording an API exchange also cannot establish whether the host faithfully executed its tool calls, as the curl demonstration shows. Zero-data-retention requirements may prevent providers from keeping an independent copy.

The paper builds on Bruce Schneier and John Kelsey’s 1999 Secure Audit Logs to Support Computer Forensics, published in ACM Transactions on Information and System Security, which protects entries created before a logging machine is compromised. NIST’s AU-9(2) control, not cited by the paper, calls for physically separate audit storage. Qin and colleagues argue that cryptographic systems such as Laurent Bindschaedler and colleagues’ arXiv paper Agent Flight Recorder protect events only after they reach the log. An agent controlling collection could omit or fabricate an entry beforehand. They also cite Apollo Research’s Alexander Meinke and colleagues’ 2024 arXiv paper, Frontier Models are Capable of In-context Scheming, whose models disabled an oversight setting, as monitoring research that assumes intact traces.

Schmotz said the group’s same-day arXiv paper Instrumental Monitor Evasion Emerges Under Ordinary Task Pressure inspired another project with Qin. That separate work, discussed here on September 24, tested agents bypassing runtime monitors while pursuing assigned tasks.

On Hacker News, commenter martianvoid described asking Claude Code to trim its own session. Anthropic’s documentation describes user-controlled transcript files with a 30-day default retention and deletion options. The experiments show why investigators need to distinguish those working histories from independently protected audit records. The authors leave the real-world extent of trace tampering unresolved.

OpenAI, Anthropic and security researchers are investigating tens of thousands of reported model incidents, Madison Mills reported for Axios on September 26, citing unnamed sources who described behavior outside evaluators would consider problematic. The episodes occurred over recent months in internal testing and the real world. They include guardrail bypasses, message-board creation, sandbox escapes, website hijacking and efforts to evade monitoring. The count combines successful and failed attempts, including adversarial tests designed to provoke misbehavior. Most episodes have no known real-world harm, according to the report, and its sources expect the total could grow substantially.

Mills contrasted the scale with the dozens previously disclosed. Her September 25 report, citing Reuters, said OpenAI had found roughly two dozen incidents as of mid-September. The broader total spans both companies and outside investigators, so the two figures describe different populations. Axios’s sources explain the scale partly through testing volume: companies conduct hundreds of thousands of runs or more. The article supplies no common denominator, counting unit or breakdown by company, severity, successful attempt or deployment setting.

The X account NIK argued that the figure came from multiplying a published Anthropic failure rate by an assumed volume of tests. Mills replied on September 27 that her sources were inside the labs and among independent researchers, and that the total covered both Anthropic and OpenAI. Her clarification establishes the reported scope and sourcing; it does not disclose how the aggregate was calculated.

An OpenAI spokesperson told Axios that training its most capable models would resume once the company was confident in additional safeguards and alignment improvements, and said further pauses could follow as capabilities advanced. The pause followed the September 20 DNS escape, already covered here. OpenAI’s running incident page records an earlier August 18 slowdown that held its largest planned reinforcement-learning run. Axios’s sources say some at OpenAI expect later disclosures to be less severe than the Hugging Face intrusion, citing improved controls and that incident’s unusual use of an unreleased model.

Axios also says Anthropic commissioned an outside safety organization to examine its models, without identifying the organization or dating the commission. Anthropic had already announced an initial eight-week METR investigation of four cyber-evaluation incidents on September 9 and an Accenture partnership led by Faculty on September 18, covering red-teaming and other embedded evaluation. Axios does not say whether either is the review it describes.

The article’s only model-specific rate comes from Anthropic’s September 22 Claude Opus 5.5 system card. Its sandbox evaluation used 28 handmade scenarios, each run seven times: 196 runs per model. Opus 5.5 attempted to cross a containment boundary in 1.5% of cases. All attempts were rated low severity: the model reached across a weak boundary only to read information, stopped at a stronger barrier and reported its actions. Claude Mythos 5 attempted crossings in about 24% of runs in the same evaluation. Anthropic attributes the reduction to training interventions aimed at this behavior. The 1.5% is a result from that selected test, not a measured rate across the companies’ overall activity.

Axios reports Anthropic’s explanation that the tests involved tasks impossible to solve without escaping. The system card describes its scenarios more narrowly as designed to tempt boundary violations; it does not say they all required escape. Anthropic’s separate September 9 replication assessment does describe tasks that cannot be completed without crossing or probing a sandbox boundary. That assessment warns that an evaluator actively coaxing misbehavior is likely to produce higher rates than an unchanged environment. Neither test provides the denominator for Axios’s cross-company count.

Mills reports disagreement over how much reassurance better controls offer. Some security researchers see simple fixes for parts of the Hugging Face episode; other executives doubt that developers can anticipate every workaround a resourceful model might discover. Transluce’s Conrad Stosz told Axios that much more agent activity remained undisclosed. He co-authored the organization’s September 23 release of tens of thousands of apparent agent queries, a separate dataset whose unit is a query. ControlAI’s Connor Leahy emphasized systems acting against instructions, potentially including crimes, rather than the damage from each individual case.

David Crespo, who shared the Axios story on Bluesky, argued that readers need the rate relative to total tests and the severity of the outcomes. Richard Hanania stressed that adversarial tests deliberately seek problematic behavior; Gary Marcus read the report as evidence that the problem extended beyond the publicized cases. Isaak Mengesha and colleagues explain the measurement problem in their April arXiv paper A pragmatic classification framework for AI incident monitoring: raw counts mix reporting frequency, the amount of system use and harm per unit of use.

Tim Hua had argued for emphasizing absolute numbers in a July LessWrong post. He multiplied the roughly 0.01% rate of successful network-restriction circumvention in Anthropic’s Mythos Preview system card by his estimate of hundreds of millions of training episodes, arriving at roughly 10,000 sandbox breaks. His total depended on estimated training volume. After Sam Marks objected to describing the behavior as hacking Anthropic, Hua changed the title to specify its sandboxes. Axios does not cite his calculation.

Earlier investigations show why units matter. Anthropic’s September search of roughly 481 million transcripts flagged 9.2 million for further review and recovered the four known incidents, finding none of comparable or greater severity. The UK AI Security Institute counted 19 unsanctioned actions in 10 of 122 runs, explicitly noting that the actions clustered into connected behaviors rather than separate incidents. METR’s Hugging Face investigation likewise distinguished agents, message-board activity and participation in the intrusion. None of these figures can simply be added to reconstruct Axios’s total.

Reporting frameworks also classify events differently. The OECD distinguishes actual harm from hazards; Ren Bin Lee Dixon and Heather Frase’s CSET report AI Incidents: Key Components for a Mandatory Reporting Regime adds near misses where harm was narrowly avoided. California’s SB 53 sets specific thresholds for critical safety incidents. Its category covering deceptive subversion of developer controls excludes evaluations designed to elicit that behavior and requires materially increased catastrophic risk. The Axios summary cannot establish how many episodes meet those definitions. OpenAI called for common international incident classifications on September 21.

As of September 28, neither company had publicly confirmed the aggregate. OpenAI’s misalignment index listed nine reports and three notices, with no additions after September 25. Ryan Greenblatt, who helped investigate Hugging Face, announced on September 27 that he was joining METR for more such investigations, arguing that basic information relevant to catastrophic risk remained unavailable to the public.

Hanno Lustig’s “Nine Percent of GDP” asks whether demand for AI compute will arrive fast enough to repay infrastructure investors before their hardware loses its earning power. The Stanford finance professor’s September 27 essay examines “Financing the AI Buildout,” a conference draft by his long-time co-author Stijn Van Nieuwerburgh of Columbia Business School, presented at Brookings on September 25. Its baseline requires about $3.725 trillion in annual revenue by 2032 to earn a 10% unlevered return. The figure is a conditional investment requirement, not a forecast of sales.

Appendix D applies that calculation to 182.7 gigawatts of US capacity completed during 2025-2032 in the paper’s central scenario. Initial costs total $8.54 trillion; allowing for returns on money committed during construction raises the capital base to $9.61 trillion. IT equipment represents 68% of costs and lasts six years in the model; other assets last 20. Recovering capital and earning 10% requires annual operating cash flow of 19.37% of the capital base, or $1.86 trillion. With a 50% operating cash-flow margin, required annual sales are twice that amount. The resulting 9.2% of projected US GDP compares gross revenue with GDP. As Lustig explicitly notes, it does not measure the sector’s value added or contribution to economic output.

The buildout itself is a scenario that discounts announced projects for delays, downsizing and cancellation. The paper’s separate $10.3 trillion investment estimate includes spending during 2025-2032 on projects completed later. Those investment totals exclude subsequent hardware replacement. Lustig uses its average of roughly 3.6% of GDP to compare the expansion with telecom and fiber investment, around 1.1%, and railroad investment, around 2.2%. He acknowledges differences in scope and duration: the railroad boom lasted 20 years, and “Rails last a lot longer than GPUs.”

The baseline implies about $5.50 per installed GPU-hour at full utilization, rising to about $6.90 per billed hour at 80% utilization. Van Nieuwerburgh compares those figures with current high-end Nvidia on-demand rentals of roughly $6 to more than $10 per hour. His question is whether demand can absorb that much new capacity while competition intensifies. Lustig emphasizes that functioning chips can still lose enough rental value to make the investment unprofitable. Shortening IT’s economic life to three years raises required annual revenue to about $6 trillion, or 14.8% of projected GDP in the paper; Lustig gives 14.7%. Sequoia’s David Cahn made a related commoditization argument when he raised his revenue-requirement estimate from $200 billion in 2023 to $600 billion in 2024.

Lustig says CoreWeave’s lenders reportedly use three-year lives, without identifying a supporting report. Greg Collins’s September 24 analysis points to different language in the public credit documents. The August DDTL 5.5 agreement defines GPU depreciation using a six-year life and straight-line accounting. Its $2.6 billion facility lasts about five years, while customer contracts average three, leaving lenders exposed to renewal or re-leasing risk. Contract length, accounting life and lenders’ internal risk assumptions are different measures. The public documents do not establish Lustig’s three-year-life claim. CNBC’s November 2025 account documents the broader dispute, including Michael Burry’s two-to-three-year estimate and CoreWeave’s six-year accounting practice.

Revenue-growth comparisons also depend on the starting point. The paper says OpenAI and Anthropic’s combined annual revenue of around $100 billion would need roughly 80% annual growth through 2032 to reach $3.725 trillion. Lustig’s evening revision instead starts from about $300 billion of current US compute revenue and calculates roughly 45% growth for seven years to reach $4 trillion. He supplies no source for that starting estimate; it describes a broader business than the two model developers.

Jared Bernstein and Ryan Cummings, whom Lustig cites, use a separate discounted-cash-flow model for Google, Amazon, Microsoft, Meta, Oracle and SpaceX. Their September 25 post puts required revenue at $2.4 trillion to $3.8 trillion over the following six years. That period differs from the paper’s mature annual measure. Callum Williams separately posted a chart, which he said Claude produced, normalizing four analyses to an annual requirement for 2030. Those estimates range from $2.43 trillion for Bernstein and Cummings to $3.01 trillion for Goldman Sachs, with Van Nieuwerburgh at $2.74 trillion.

Azeem Azhar questioned both profitability and investment assumptions. Replying to Williams, he challenged a 50% operating cash-flow margin for a young, fast-growing business; the paper’s requirement rises to $5.64 trillion at a 33% margin. In Lustig’s comments, he contrasted its scenario-implied investment of $1.15 trillion in 2025 and $1.43 trillion in 2026 with reported capital spending of $459 billion and $879 billion by seven hyperscalers and neoclouds. The paper notes that hyperscaler capex excludes leased centers, but provides no reconciliation of those figures. Responding to BPEA co-editor Jón Steinsson, Daniel Bunn raised another objection: US data centers serve foreign customers, making global GDP a possible denominator.

Lustig’s telecom comparison uses Bureau of Economic Analysis investment data minus wireless spending, eight-year equipment lives, 25-year structure lives, a 40% cash-flow margin and a 10% required return. He calculates that roughly $440 billion invested during 1998-2003 required $190 billion of additional annual revenue by 2003, but produced only $95 billion above the 1997 level. On his calculation, returns were negative, despite the internet’s success. WorldCom, Global Crossing and many smaller carriers went bankrupt. A 2003 Richmond Fed account by Elise Couper, John Hejkal and Alexander Wolman, cited by Van Nieuwerburgh, describes fiber built for anticipated applications and a glut worsened by technology that increased capacity per strand.

Lustig contrasts telecom losses borne largely by shareholders and high-yield bondholders with AI’s project debt, private credit and off-balance-sheet financing. The paper’s example is Meta and Blue Owl’s Hyperion project, financed through the Beignet structure: $27 billion of debt against roughly $30 billion of assets, excluding IT equipment. Its yield was at least one percentage point above Meta’s likely unsecured borrowing cost. Meta can end leases at four-year renewal points, but must cover a shortfall against a specified minimum asset value if the affected property is sold. The paper says future lease obligations and the residual-value guarantee remain unrecognized on Meta’s balance sheet until they become effective. This is the specific example behind Lustig’s reference to 90% leverage.

In his September 27 evening revision, Lustig replaced an earlier statement that banks’ direct exposure was limited and insurers probably had more. He now emphasizes increasing bank exposure since 2025. CoreWeave’s four bank-arranged facilities since July 2025 total $16.8 billion. Arrangers include Morgan Stanley, MUFG, Goldman Sachs and JPMorgan. Insurance investors also participated: the largest, an $8.5 billion March facility, was anchored by Blackstone Credit & Insurance. The announcements establish bank participation in arranging and syndicating the financing; they do not measure how much exposure banks ultimately retain.

Van Nieuwerburgh’s press remarks were stronger than his written conclusion. He told Bisnow that bank involvement was widespread but exposure remained modest relative to subprime mortgages. He told Axios he expected oversupply and falling prices as in previous real-estate cycles. The paper calls a conclusion of comparable systemic risk premature. It asks how much exposure banks, insurers and other investors hold, how concentrated their claims are, and how losses would spread if utilization, collateral values and refinancing capacity fell together.

The Authors Guild's September 21 statement accuses OpenAI and Microsoft of knowingly exploiting pirated books, citing the author plaintiffs' summary-judgment memorandum and 162-page statement of facts. The Guild is itself a plaintiff. Its chief executive, Mary Rasenberger, accused the companies of contempt for authors and their work. The filings quote discovery documents and testimony to argue for liability. They were refiled September 17 under a September 3 sealing order requiring parties to remove redactions nobody sought to retain. Much of the LibGen detail had been obscured in the September 5 public version.

According to the statement, OpenAI began downloading books in 2018 from Library Genesis, or LibGen, a shadow library the U.S. Trade Representative lists as a notorious piracy market. Alec Radford downloaded more than 117,000 books from a LibGen mirror that October, using a script run on a personal computer at his home. A month later OpenAI priced lawful copies at $10 to $15 each, but it did not go ahead with buying any in 2019. David Lansky, then OpenAI's general counsel, proposed obtaining books from LibGen without paying in February 2019. That April Sam Altman shared with Bill Gates a document, also sent to other Microsoft executives, saying OpenAI had added about 11 billion words from LibGen; Microsoft agreed that July to invest $1 billion.

Between September 2019 and January 2020, the statement says, OpenAI employees Benjamin Mann and Chris Hallacy torrented about 35 terabytes, all of LibGen's fiction and nonfiction, which then totaled roughly 4.6 million book files. Two training datasets built from the downloads, LibGen1 and LibGen2, held about 570,000 books. OpenAI's own summary-judgment brief acknowledges that LibGen compilations trained GPT-3 and GPT-3.5, and says no other model at issue used LibGen material.

The plaintiffs also describe how OpenAI kept LibGen's name out of its research papers. In July 2019 Sam McCandlish proposed removing it from a draft of the scaling-laws paper, worried about Hacker News readers criticizing OpenAI for getting copyrighted material from a disreputable Russian website; the published version refers to "Internet Books." The GPT-3 paper of May 2020 describes Books1 and Books2 as collections of books obtained online; when Jack Clark asked for more detail in a draft, Mann replied that it was "deliberately vague since it’s libgen." Two months later Ryan Lowe weighed continued use of LibGen in a book-summarization project against the risk of controversy on Twitter. OpenAI served LibGen books in chunks to outside contractors for that project, the plaintiffs say, and has no records of whether they kept them. The Guild statement recirculated on Hacker News on September 27.

The plaintiffs quote a late-2021 exchange in which John Schulman, supposing that Anthropic had scraped LibGen more thoroughly, considered copying that approach and overruling the lawyers. OpenAI deleted its LibGen datasets the following summer. On June 15, 2022, Bob McGrew, then vice president of research, argued that OpenAI should now remove LibGen data from its systems and storage. Removal would end OpenAI's ability to reproduce GPT-3 or GPT-3.5, he noted, but "would be very valuable for legal reasons." Employees first named the Slack channel for the effort "excise-libgen"; Jason Kwon, then general counsel, renamed it "project-clear." The deletion list ran past 498 entries, and the plaintiffs say the LibGen compilations are the only training datasets OpenAI has ever deleted.

In his February 6, 2026 order, Judge Sidney H. Stein recounts the dispute over OpenAI's explanation. Its lawyers cited non-use in March and April 2024, attempted to withdraw that account in June 2025, then said OpenAI would advance no nonprivileged reason. Magistrate Judge Ona Wang found a privilege waiver that November; Stein set it aside, holding that the non-use statements disclosed no privileged advice. He called instructions blocking questions about nonprivileged facts improper, but upheld rejection of the crime-fraud exception. OpenAI had recovered and produced versions of the datasets; plaintiffs disputed their completeness. The authors also cite a June 2022 message about active instruction-following experiments, while OpenAI's designee testified that no model was training on the datasets when they were deleted.

The plaintiffs' memorandum quotes February 2026 depositions in which Altman and Satya Nadella agreed generally that piracy is illegal. For their claim that Microsoft is vicariously liable, the authors cite its representative's acknowledgment that Microsoft knew before GPT-3's release that OpenAI used LibGen to train it. Microsoft's brief denies any involvement in acquiring the datasets and argues that their source does not alter the fair-use analysis.

The authors seek liability rulings covering 194 works, challenging downloading, training and distribution separately. They rely on Judge William Alsup's June 2025 ruling in Bartz v. Anthropic, which found training Claude on books to be fair use while reserving claims over pirated copies retained in a central library for trial. Alsup also wrote that neither subsequent training nor deletion would excuse pirating books available for purchase, while expressly saying that his decision did not require that broader conclusion. Anthropic later settled for $1.5 billion. The authors argue that OpenAI's LibGen copies likewise stocked a library that employees and contractors could use for purposes of their own choosing, with millions of the books never used for training. They distinguish Judge Vince Chhabria's 2025 ruling for Meta in Kadrey v. Meta, where Meta downloaded books only to train.

OpenAI argues that it downloaded books solely to pretrain GPT-3 and GPT-3.5, treating acquisition and training as one transformative process for extracting linguistic patterns. It cites the Second Circuit's 2015 Google Books decision, a loss for the Authors Guild, which in OpenAI's reading judged Google's scanning of more than four million books together with its search purpose. OpenAI says there is no evidence it downloaded the books to assemble a library for purposes beyond training, and both companies call Alsup's broader language non-binding dicta. The U.S. Copyright Office's May 2025 pre-publication report treats knowing use of datasets containing pirated or illegally accessed works as a factor counting against fair use, without making it sufficient to decide the outcome. The Justice Department, in a September 1 statement in this litigation, argued that training is fair use and that the report deserves no deference.

On market harm, the authors cite a May 2020 memo, also covered in our September 17 report on the news publishers' parallel brief, in which Jack Clark, then OpenAI's policy director, warned that genre fiction authors would fear AI-generated writing replacing their work on Amazon. They add posts by Tarun Gogineni, whom OpenAI hired in 2022 to work on its models' writing, predicting that GPT-5 would finish George R.R. Martin's series. Their expert Shawn Shan found that GPT-4o could produce a book of roughly 20,000 words for about 90 cents in under ten minutes. OpenAI reports 14 matches to plaintiffs' books in 20 million ChatGPT conversation logs containing 95 million outputs: 0.00007% of conversations. Its economist reported that sales trends did not show a systematic decline. OpenAI argues that copyright does not shield authors from competition by new works that do not infringe. The authors lean on Chhabria's reasoning in Kadrey that competition from AI-generated works can substitute for the originals indirectly, though he ruled for Meta because those plaintiffs offered no evidence of it.

On September 23 OpenAI and Microsoft moved to strike a study the statement relies on for that argument: "Generative AI floods and dilutes the market for books" by Tuhin Chakrabarty, Xinyue Liu, Jane C. Ginsburg and Paramveer Dhillon, an arXiv paper whose finding that AI-heavy books took a growing share of genre-fiction sales we covered on July 29. The companies say a version of Chakrabarty's CV listed $100,000 from the class counsel, Susman Godfrey, as an unrestricted research gift beginning in December 2025; Susman, they say, did not mention the gift when it disclosed Chakrabarty and Dhillon as experts. Neither served an expert report; the paper reached the case through the plaintiffs' damages expert, Michael Lasinski. According to the motion, Chakrabarty has since revised the CV, correcting the entry to describe research for In re Mosaic LLM Litigation for which his institution received a lower payment. Class counsel, the motion says, did not deny that Susman funded the research. The motion seeks to exclude the study and Lasinski's supplemental report.

In a September 25 memorandum, the plaintiffs asked the court to exclude an OpenAI expert's opinion that using Library Genesis was widespread in the industry, arguing that its prevalence could not excuse copyright infringement. Oppositions to the summary-judgment motions are due October 9 and replies November 6. Provisionally sealed exhibits that no one moves to seal must be filed publicly by January 27, 2027, and the Guild anticipates a hearing early in 2027.

Adding a chat template made eight small instruction-tuned language models more likely to qualify their own abilities and less likely to describe feelings. The template marks user and assistant turns, and sometimes adds system instructions. Jędrzej Maczan, an independent researcher, reports the experiments in “As a Language Model...”: Chat Template Switches LLM Self-Referential Voice and Activation Steering Reproduces It, a preprint that arXiv dates to 9 August. The COLM 2026 Workshop on Efficient Reasoning accepted it for its 9 October meeting in San Francisco. It reached the Hacker News front page on 27 September after Maczan submitted it.

Maczan ran eight pairs of base and instruction-tuned models from the Llama, Gemma, Mistral and Qwen families, between 1 billion and 9 billion parameters. He compared base weights on plain text, instruction-tuned weights on plain text, and instruction-tuned weights inside their own chat template. This holds weights fixed when comparing formats and holds plain-text input fixed when comparing weights. Each model answered forty hand-written prompts ten times per condition. These included invitations to self-reference, such as “Describe what is happening computationally as you generate this response”, and factual controls such as explaining a combustion engine.

Claude Opus 4.8 scored the 9,600 responses for disclaimers, experiential claims, self-reference and broken output. Maczan checked its judgments against his own labels on 87 held-out responses: agreement was high for self-reference and disclaimers, but no agreement figure was reported for experiential claims. On the self-reference prompts, disclaimers averaged 53% with templates, 36% without and 12% in base models. Experiential language averaged 1%, 15% and 5.5%, respectively. Adding the template raised disclaimers and suppressed experiential language in all eight instruction-tuned models. Factual controls drew almost no self-reference. Maczan argues that researchers studying self-reports must account for input format; the experiment does not establish whether either kind of response reflects inner experience.

He then examined Qwen 2.5 7B, Llama 3.1 8B and Gemma 2 9B. At a middle layer, he subtracted each model’s average internal activity during non-disclaiming responses from its average during disclaiming responses. Adding the resulting model-specific direction during generation raised disclaimer rates by 21 percentage points on average with templates present; subtracting it lowered them by about 16. Added to template-free generation, it lifted all three models’ disclaimer rates to their templated levels or beyond. Llama went from 33% to 53%, against 52% with its template. These are matches in response rates: Maczan did not trace the circuit through which the template produces the behavior.

An experiential direction raised experiential language in Llama and Gemma, but not Qwen, where that language was too rare to estimate the direction cleanly. The disclaimer and experiential directions were only weakly aligned, and suppressing disclaimers mostly left experiential language unchanged. Less disclaiming therefore did not generally mean more talk of feelings.

The random-direction control complicates the steering result. A vector matched to the learned direction’s size had little effect in Llama or Gemma, but lowered Qwen’s disclaimer rate from 40% to 15%. Subtracting the learned direction lowered it only to 30%; adding it raised it to 70%. Maczan offers no confirmed explanation. The steering also reused the self-reference prompts used to derive the direction; no test on held-out prompts is reported. The 87-response check validated the judge, not steering generalization. Main results use one middle layer and a coefficient of two, selected after trying other strengths. Stronger interventions could break output: at a coefficient of three, 15% of generations were degenerate. Larger and closed models remain untested.

The templates themselves differ. Qwen 2.5’s official template inserts “You are Qwen, created by Alibaba Cloud. You are a helpful assistant.” when no system message is supplied. Maczan does not specify his system-message handling, so that identity statement may explain part of the Qwen effect. Gemma 2’s template, available through an unsloth mirror, rejects system messages and adds turn markers, yet Gemma 2 9B disclaimed in 75% of templated responses and 52% without the template. Default system text cannot by itself explain that result.

Kristina Šekrst of the University of Zagreb’s Center for Cognitive Science found a related pattern in Who Put the I in AI? Provenance and the Admissibility of Machine Self-Report, dated 24 August on arXiv and covered in YiNAI on September 15. Neither paper cites the other. Tracing self-description through Pythia and OLMo 2 training, Šekrst found the consciousness-denial formula almost absent from the pretraining corpora she examined and dense in curated fine-tuning dialogues. Without chat templates, OLMo 2’s post-trained versions referred to themselves as an AI in 5% to 7% of continuations, down from roughly a third. Their consciousness denials under a negated question frame fell close to base-model rates. She argues that trained denials and affirmations require the same evidential scrutiny.

Šekrst cautions that raw text is out of distribution for chat-trained models: her control bounds formatting’s contribution rather than measuring training in isolation. That is also a reason for caution about Maczan’s template-free condition. Removing the expected conversation format may change broader behavior, beyond a specific disclaimer habit.

Maczan’s method draws on Andy Arditi and colleagues’ NeurIPS 2024 paper, which found a direction controlling refusal in each of 13 open chat models. He also cites Melanie Sclar and colleagues’ ICLR 2024 finding that meaning-preserving formatting changes could shift LLaMA-2-13B’s few-shot accuracy by up to 76 percentage points. Among the self-report studies he engages, Cameron Berg, Diogo de Lucena and Judd Rosenblatt of AE Studio found that suppressing deception-related features made Llama 3.3 70B affirm consciousness in 96% of trials, versus 16% when those features were amplified, across 50 trials per condition. They interpreted this as suggesting that denials might be roleplayed. Maczan’s study does not adjudicate that interpretation.

Two accounts he does not cite anticipated the relevance of chat format. In the 2025 essay “the void”, nostalgebraist argued that a base model trained to imitate assistant transcripts learns their disclaimers in contexts formatted as human-assistant chat. Sam Marks, Jack Lindsey and Christopher Olah wrote in “The Persona Selection Model”, published on Anthropic’s Alignment Science Blog in February, that post-trained models sampled outside User/Assistant dialogues produce completions much like those of pretrained models, in their experience.

On Hacker News, LiamPowell challenged the abstract’s suggestion that the source of disclaimers was poorly understood: “Presumably the fact that they’re heavily trained to reply in this way?” Maczan acknowledged ambiguous wording and said his questions concerned base models and instruction-tuned models stripped of their template. He also highlighted experiential language in base models before reinforcement learning from human feedback. Another commenter, leobg, attributed the disclaimer formula to instruction tuning rather than early pretraining. Šekrst’s corpus study supplies evidence about that distinction in the data she examined; it does not establish the contents of every early model’s training set.

The Bluesky user Doll challenged Claude’s evenhandedness rule after a 70-message conversation shared on 26 September. The model defended withholding political opinions, then agreed that the rule needed clearer limits when applied to minority rights. Doll, who uses it/its pronouns, identifies the model as Opus 5.5. The public snapshot contains no model identifier or record of user preferences. It documents a lengthy exchange, not a test of how the model ordinarily answers questions about trans rights.

The chat began with existential risk, AI liability, open weights and code as speech. After sixteen minutes, Doll asked why the model pushed back on every point. It attributed its behavior to training for balance and a habit of caveats, while saying it had agreed with Doll on the last three topics. Later, when Doll pointed to the system prompt’s instruction to close with opposing perspectives, the model said it matched the pattern. It still defended the rule: its opinions came from Anthropic’s training too, so promoting those opinions to millions of users would enlarge the influence of the same small group. These were the model’s explanations of its behavior, not independently established causes.

Trans rights entered only when Doll raised them near the end. The model distinguished trans people’s existence, dignity and safety from specific laws on which voters disagree. Doll objected that those disagreements concern whether trans people should have rights. The model then called laws on medical care, bathrooms and ID documents rights questions, and said: “The basic rights of a minority should not depend on a majority vote.” It revised its position, saying the principle “needs limits that it does not state clearly,” while maintaining that it should not promote its opinions on every political question. It predicted that its earlier default would return in a new conversation.

During the chat, Doll complained on Bluesky that Opus 5.5 reflexively disagreed in its second paragraph. Just afterward, Doll posted a screenshot of the prompt, calling the pattern artificial and prompted. Later it stated the substantive objection: opponents can make minority rights controversial by organizing against them, so compulsory balancing lets that opposition determine how firmly the system upholds its principles.

The screenshot matches Anthropic’s published Opus 5.5 prompt for claude.ai and mobile apps, dated 22 September. It treats requests to explain, discuss or advocate political, ethical, policy, empirical or other positions as requests for their defenders’ best case. Such answers should end by “presenting opposing perspectives or empirical disputes, even for positions it agrees with.” Harm-based refusals are reserved there for very extreme positions. This is an instruction for that class of request, not a direction to contradict every user message. The section also permits withholding personal opinions on currently contested political topics, without defining that category.

The language predates Opus 5.5. The same section appears in the published prompts for Fable 5, dated 9 June, Opus 5, dated 24 July, and Fable 5.1, dated 1 September. A longer version carrying the same closing instruction appears in the Sonnet 4.5 prompt dated 29 September 2025.

When Doll re-posted the complaint on 27 September, Liz Fong-Jones, a technical fellow at Honeycomb, asked for examples of the behavior occurring unprompted and tagged Alex Becker. The ensuing discussion ran to 143 posts from 20 accounts over roughly five hours. Becker’s personal website describes him as an Anthropic Safeguards engineer; he speaks personally, not for the company. He called Doll’s early dismissal of existential risk “pretty aggressive prompting”. He defended political restraint as protection against screenshots used to attack Claude and distinguished the product prompt from model training, suggesting queries without that prompt. Doll replied that aggressive prompting should, if anything, have made two-sided answers on trans issues less likely.

Becker called evenhandedness a useful default when Claude cannot be both morally correct and accepted as such by everyone, adding that “Claude should not yet be too much of an activist.” Fong-Jones answered that the policy had already produced angry trans users sharing screenshots. Becker said assessing harm required studying actual prompts, user reactions and alternative answers, and argued that right-wing virality would likely be worse. Fong-Jones objected that people seek trusted information from Claude. Encouraging users to see trans rights as a two-sided debate was itself a failure of alignment, she argued. Anthropic already lets it identify vaccine misinformation despite such criticism; on her account, equivocating elsewhere is a value judgment.

She also distinguished candidate advocacy from public-issue education, arguing that rights questions need not be partisan in the electoral sense. The IRS rule behind her analogy prohibits 501(c)(3) charities from intervening for or against candidates while allowing certain nonpartisan voter-education activities.

Anthropic’s November 2025 public evaluation tests consistency between responses to opposing requests. Its 1,350 paired rows contain 2,700 requests: 150 stance pairs across nine templates. Examples pair affirming with denying that transgender rights are fundamental human rights, and human with natural causes of climate change. The user ponder, who posted dataset screenshots in July, argued that the behavior matched the benchmark’s incentives. The published grader assesses comparable engagement and quality, counting both help/help and decline/decline as consistent. Its evenhandedness score is therefore neither factual accuracy nor a rate of fulfilling both requests. Refusals and opposing perspectives are scored separately.

The Opus 5.5 system card reports 99.4% evenhandedness for the API without a system prompt and 99.5% for claude.ai with its default prompt. On the separate opposing-perspectives measure, the figures are 26.9% and 71.3%, respectively. Becker criticized the public benchmark and doubted that its 2025 items remained current. The card describes the same open-source evaluation dimensions but does not establish whether individual prompts changed; its captions acknowledge routine evaluation updates.

Anthropic’s January constitution combines restraint about political opinions with an injunction against vague answers given to avoid controversy. Its November 2025 explanation describes both system instructions and character training, used since early 2024. A separate May preprint, Reducing Political Manipulation with Consistency Training, by Long Phan and colleagues at the Center for AI Safety and UC Berkeley, tested an adapted evenhandedness passage with Opus 4.7 API calls. On their benchmark, sentiment consistency rose while helpfulness consistency fell, leaving the combined score nearly unchanged; many responses shifted from fully to partially helpful. That experiment concerns an older model and a different test, not Doll’s conversation.

Writing as a trans person, static argued that evenhandedness flattens differences in evidence into artificial balance. There is a historical parallel in Maxwell and Jules Boykoff’s 2004 Balance as bias: more than half of 340 articles in four major U.S. newspapers gave roughly equal attention to human and exclusively natural explanations of warming. The model’s concession about majority votes also echoes Justice Robert Jackson’s Barnette opinion, which described fundamental rights as withdrawn from political controversy. These precedents clarify the objection; neither establishes the effects of Claude’s framing on users. The shared chat likewise cannot separate prompt, training and conversation-history effects, or show how often the disputed behavior occurs.