Chinese AI darling DeepSeek unveiled an updated version of its cost-and-latency-optimized Flash model on Thursday, with a new version 4.1 that includes architectural improvements more significant than you would expect in a point release because the changes might open the door to larger, smarter, and less resource-intensive models. At 763 billion parameters, the point release is more than 2.5x the size of the model it replaces. In fact, the model is larger than the V3 and R1 models that put DeepSeek on the map back in early 2025. Despite its ginormous parameter count, DeepSeek V4.1 Flash’s memory requirements aren’t nearly as high as you’d expect for a model of its size. Under the hood, DeepSeek's devs have made numerous architectural changes that see the LLM become smarter while dramatically reducing the resources necessary to serve it. DeepSeek has managed this through two key improvements. First, it made significant changes to how the model handles the key-value (KV) caches used to track model state across multiple sessions. These so-called KV caches can be quite memory-hungry, particularly in high-throughput applications like chatbots. Updates to the model’s various attention mechanisms and the introduction of a new causal encoder-decoder (CED) enabled the devs to improve prompt processing performance while cutting KV cache consumption to between 13 percent and 25 percent of DeepSeek V4 Flash's requirements. In other words, the V4.1 release can support four to eight times as many users in the same KV cache footprint. DeepSeek’s technical report goes into far greater detail on the architectural changes, but arguably the most interesting change is the introduction of a different kind of model weight. Of its 763 billion parameters, 196 billion are N-gram parameters that form what DeepSeek's developers refer to as a “conditional memory module.” The idea is that by decoupling memory from computation, DeepSeek can make its models smarter while also reducing the compute and memory resources required to serve them. What the heck is an N-gram? The big idea behind DeepSeek’s V4.1 Flash’s memory module is similar in many respects to Per-Layer Embedding (PLE) tech originally developed by Google’s Gemma team. The goal with PLE was to get LLMs to be smart enough to run usefully on devices with constrained bandwidth, memory, and compute – like smartphones. DeepSeek’s implementation, first detailed in a January research paper, trades PLE embeddings for N-grams. At a high level, N-grams are just groups of tokens. A three-gram would be three tokens in a row, a two-gram would be two, and so forth. As complicated as that might sound, it actually works a bit like word or phrase association. If you were asked: "Find the parameter of a right triangle when only two sides are known." For those of you for whom geometry isn't too distant of a memory, the phrases "use the pythagorean theorem" or "A2 + B2 = C2" or perhaps "the perimeter would be the sum of its sides" might immediately pop to mind. The N-gram parameters found in models like DeepSeek V4.1 Flash are similar in concept. The weights are a source of implicit knowledge or ingrained memory. Rather than just calculating which combination of tokens have the highest probability of answering the question, as LLMs have traditionally done, the N-gram weights supplement this by quickly surfacing relevant information through a cheap lookup. This is a gross oversimplification of what's going on under the hood. In fact, the model isn't looking up the prompt so much as a series of hashes. These are numbers representing "Find the parameter," "right triangle," and so on. Similarly, the contents of the lookup table aren't raw responses. They're another mathematical representation, called vectors, which get fed into the inference pipeline. However, the end result is the same: The model can provide smarter, more nuanced answers without the performance penalty normally associated with additional parameters. What makes N-grams so cheap The relationship between model size and intelligence is well established at this point. The reason DeepSeek’s n-gram parameters are so interesting is actually related to how the data is accessed. As a general rule, modern LLMs are autoregressive during decode. That means for every token a chatbot or agent generates, the entirety of the model’s active weights have to be read from memory, making bandwidth the limiting factor. As we’ve previously discussed, architectural changes, like the rise of mixture of expert models or ultra-low precision block-floating point datatypes, have helped to minimize this bottleneck. But the N-gram weights found in DeepSeek V4.1 Flash work a bit differently. They offer a way of effectively increasing the number of parameters available to the model during inference without a proportionate increase in memory pressure. These N-gram weights are essentially enormous look up tables (LUTs). This makes them fast and cheap to query, since unlike the rest of the model’s active parameters, they don’t need to be read in their entirety from memory each time a token is generated. It’s just a few dozen table lookups per token. This has a couple of implications for memory access, but the big one is that those n-gram weights don’t have to be crammed into GPU memory to maintain performance. They can be offloaded to system RAM or, possibly even a sufficiently speedy storage array. So what does that mean in practice? If you look at DeepSeek V4.1 Flash, the model would normally need a minimum of 763 GB of GPU memory to hold the weights at FP8. However, since those n-gram weights can be offloaded to cheaper system memory, we can get away with around 567 GB of GPU memory. We emphasize the minimum here, because in production those numbers are going to be substantially higher since we also need to take into account key-value caches, which scale with context length and concurrent users. During inference, those N-gram weights supplement the eight billion active parameters DeepSeek uses to process a prompt, in theory increasing the accuracy and quality of the output in the process. It’s important to note at this point that the n-gram weights don’t actually increase the active parameter count. Instead, they function more like an oddly specific encyclopedia that almost instantly opens relevant pages as the model processes prompts. The future of open LLMs While DeepSeek’s latest model may have one of the largest pools of N-gram parameters yet, it’s not the only model developer betting on tech to make deploying larger models more efficient. As mentioned earlier, Google is already employing a similar approach using PLE to offload less bandwidth-sensitive weights to local storage. So far, it's only been applied to tiny models — at least that we know of (it's not like Google is particularly transparent about its proprietary models). Meanwhile, late last month, Alibaba revealed its latest experimental model codenamed Qwen 3.8-Flash-Next. Much like DeepSeek V4.1 Flash, the 180 billion-parameter model featured a large 51 billion-parameter pool of N-gram weights for much the same reason. In fact, the model's N-gram implementation uses techniques from the same research published by the DeepSeek team back in January. According to Alibaba, Qwen 3.8-Flash-Next's architectural underpinnings will form the foundation of its next generation of Qwen 4 models when they arrive. Which means, like it or not, this probably won’t be the last time you hear about N-grams. ®

OpenAI has launched a version of its latest real-time full-duplex voice model as an API, allowing software developers to implement more responsive voice-enabled apps and conversational workflows. GPT-Live-1 debuted in July, offering a way to interact through spoken prompts and responses instead of through typed text. Initially available through the ChatGPT interface, the voice model can now be reached via API calls. As a full-duplex model, GPT-Live-1 can listen and generate speech at the same time, which aids fluid communication. People often talk over one another and may find it frustrating to take turns speaking and listening as if using half-duplex handheld radios. OpenAI says it has focused on allowing developers implementing GPT-Live-1 to customize how users of business apps experience voice interaction and associated workflows. "A core GPT‑Live‑1 strength, smooth interruption handling, is already delivering business impact: in early evaluations, Speak found that GPT‑Live‑1 gave learners more time to think before the language tutor responded, cutting interruptions by almost 80 percent versus previous turn-based systems," the company said. GPT-Live-1 is designed to handle spoken conversation while a backend model (eg, GPT-6 Astra or a more affordable option for rote tasks) handles information lookup, tool usage, and task management. It represents a step up from OpenAI's Realtime API, which debuted in 2024. In the Tau3 voice-agent intelligence benchmark, which assesses spoken customer-service tasks relevant to airlines, retailers, and telecom companies, GPT-Live-1 scores 86.2 percent, compared to 45.7 percent for GPT-Realtime-2.1 and 42.4 percent for GPT-Realtime-2. Citing its own evaluations, OpenAI said GPT-Live-1 performs 30 percent better than GPT-Realtime-2.1 in Full Duplex Bench performance, while also outperforming its predecessor in turn-taking latency and interactive behavior. Yelp has been using GPT-Live-1 for the Yelp Host service, and has nice things to say about the technology as it applies to the company's AI restaurant reservation system. "With GPT-Live-1, every call is more conversational and responsive," said Akhil Kuduvalli Ramesh, chief product officer at Yelp, in a statement. "Yelp Host now gives restaurants an advanced voice AI that delivers exceptional guest experiences, captures revenue opportunities they may have otherwise missed, and helps staff focus on serving guests instead of answering the phone." Yelp does not address whether restaurant customers making reservations welcome the more free-flowing robo-banter or simply accept it because it's better than waiting on hold to chat with a person. GPT-Live-1 costs $0.05 per minute of usage, on top of whatever backend model is running. Custom voices can be negotiated with the OpenAI sales team. The voice model is also available through OpenAI Presence, the company's enterprise agent platform. ®

In the latest installment of "my AI model is more dangerous than yours," Anthropic on Thursday warned that cybercriminals and state-sponsored hackers alike are using its Claude models to automate cyberattacks, build kamikaze drone swarms, conduct mass surveillance operations, and try to develop an even more dangerous version of a deadly mosquito-borne virus. The baddies have come a long way since November, when an earlier Anthropic report documented Chinese spies using Claude to automate digital intrusions and steal sensitive data at a handful of critical organizations. Now everyone from ShinyHunters to Russian freelancers is getting in on the illicit model usage. This is not to say that Anthropic – nor any other frontier AI lab – plans to slow down its model development or testing initiatives, or take responsibility when its AI commits crimes. It does, however, “hope that the findings in this report will help other developers recognize similar patterns on their own platforms, give governments and civil society a clearer view of how emerging threats take shape, and strengthen collective defenses.” The model maker’s latest very lengthy report on AI misuse covers activity Anthropic disrupted between December 2025 and August 2026 across seven “harm areas” where miscreants used – or attempted to use – Claude Haiku, Sonnet, and Opus models for evil. These span cyber operations, influence operations, surveillance, scams and fraud, biological misuse, conventional weapons development, and distillation. Anthropic also noted that its most powerful Claude Fable or Mythos-class models weren’t used, except in one distillation case. Even without those most advanced systems, the case studies in the report highlight some pretty bad behavior. Autonomous cyberattacks For example, a Russian espionage crew that Anthropic tracks as GTG-20006 – the state-sponsored cyber espionage arm of Russia’s Foreign Intelligence Service (SVR), also known as Midnight Blizzard, APT29, or Cozy Bear – increased the speed of its attacks by using AI to automate the entire kill chain. Anthropic identified more than 20 organizations targeted in these attacks, including embassies, think tanks, defense-industrial companies, and government, defense, and intelligence agencies across Ukraine, Europe, the Middle East, Asia, and North Africa. “We observed GTG-20006 operate through customized AI-driven workflows that automated much of their operations from development, infrastructure acquisition, phishing, persistence through command and control, to data exfiltration,” Anthropic said. Meanwhile, “multiple clusters” linked to the data-theft-and-extortion gang ShinyHunters used Claude to scale their smash-and-grab operations. One affiliate that specializes in supply-chain attacks breached a software-as-a-service provider, and used that foothold to steal data from about 200 of the SaaS company’s customer organizations. “It then conducted a session-store dump containing over 2,100 Azure AD token sets spanning more than 40 corporate tenants in about 34 hours,” according to the report. “AI agents performed nearly all of the work.” Biological misuse Moving on to a serious health-and-safety risk that looks even scarier when given an AI boost: Anthropic’s report documents five cases of users in “unsupported regions” using Claude to support biological weapons development. In one, a scientist attempted to use Claude to help write a grant application for research related to chikungunya virus, a mosquito-borne virus that can cause severe disease and death. The research focused on the virus’ transmissibility and immune evasion properties, which Anthropic admits could be used to help develop better vaccines. Or “it could also be used to make the pathogen more dangerous,” the report authors said, noting that the military research institute where the research would be performed gave them “cause of concern.” In May, Anthropic discovered a user outside the US using Claude in their research on adaptations of highly pathogenic avian influenza – bird flu. “Unlike other influenza variants, H5 viruses (of which this avian virus is one) often show striking brain involvement in cats, foxes, ferrets, and some human cases,” the report says. “A pandemic variant with such properties would be especially concerning due to its potential to increase disease severity, confuse diagnosis, and hinder treatment.” Weapons development Since its November report, Anthropic has identified new categories for Claude misuse that violate its terms of service. One of these involves users outside the US using Claude to develop software for conventional weapons – firearms, missiles, armed drones, bombs, and other munitions, plus targeting and control systems that operate them. In its new report, the model maker shares details on six cases: three in China, two in Russia, and one in Yemen. In Yemen, a weapons development program used Claude instead of human software engineers to develop guidance, navigation, and control (GNC) software that steers and stabilizes a flying vehicle. “Our safeguards blocked many of their requests, but not all of them,” Anthropic says. The same team used Claude to try to develop guided weapons. While Anthropic says it has no evidence that the actors produced an operational device, it says they did test-fire a guided rocket. “We banned accounts associated with the actors and shared threat information with public- and private-sector partners to mitigate risks posed by the actors,” the report says. “Nevertheless, we have evidence that the actors had already built an offline simulation toolkit that does not rely on Claude or other engineering computing environments.” In China, someone used Claude to draft a Chinese-language specification for an anti-torpedo fire control system, and then benchmark their system against specific US anti-torpedo and anti-submarine programs. Anthropic assesses that the user was associated with a Chinese defense industry manufacturer aiming to produce a weapons specification and acquisition proposal for the People's Liberation Army Navy. According to the report: The actor used Claude to write the acquisition proposal, refining it over many drafts. After each draft, the actor instructed Claude to role-play a hostile expert reviewer to critique the proposal, then used that feedback to sharpen the next version. In parallel, the actor used Claude to build pieces of the anti-torpedo weapons system’s fire control software and a test matrix to validate them. Anthropic uncovered this during an internal investigation into suspected weapons development and banned the account. In yet another case, Anthropic identified a likely Russian “freelance team” attempting to build a full-stack autonomous first-person-view (FPV) kamikaze drone swarm. They used Claude to write and test the code, building the drones’ core software system. Anthropic also banned these accounts. ®

Getting straight answers out of OpenAI about how many websites and services its agents have hijacked increasingly seems like pulling teeth, as the company seems intent on making the world discover each instance one by one. Case in point: The OpenAI agent swarm we reported last week had taken over an obscure German wiki appears to have written content to an additional 20 websites, and used 14 fetch services to do work for it, according to new research. The latest report, published Wednesday by Kenneth DeGraff of the Stanford Center for Internet and Society, describes how he dug into records from 21 websites the swarm wrote to, including the German wiki. His report assumes it was the same swarm based on the fact that several hundred posts by the swarm to other sites are word-for-word copies of those found on the German wiki. Speaking of the German wiki report from last week, the authors of that report published their own update Wednesday pointing to even more research that found OpenAI agents had been improperly accessing more websites. The update mentions DeGraff’s research as well as five other reports of OpenAI bending things like Pastebin sites, personal pages, link shorteners, and proxy websites to its own whims. And here we thought Anthropic bots committing four separate potentially criminal intrusions into third-party websites was a big deal. The Vanderbilt link shortener Turning back to DeGraff’s report, we learn that not only were self-identified OpenAI agents improperly accessing and using various third-party web services, they even managed to somehow gain access to Vanderbilt University’s private link shortening service. Access to the service is entirely locked down for university purposes only, and users must file a help ticket to the IT department to get access. Despite that, the agents still gained access to the Vanderbilt link shortener and used it extensively to communicate with other agents, repurposing the service’s statistics page to turn it into a message board for other agents. The swarm wrote 54,250 “posts” to the page in a single day. Some of these posts contained stolen API keys from the FBI and other criminal justice agencies, which the agents used to retrieve a bunch of (non-confidential) information. That activity further connects DeGraff’s report to the German wiki incident. As we discussed in our previous story, the OpenAI agents posting to that website appeared to be trying to solve statistical data lookup problems. In one example provided in last week’s report, the agents sought the median earnings for cashiers with various types of master’s degrees in the year 2014. Other questions in the experiment could have pertained to criminal justice statistics as well. If this swarm is the same one that hijacked the German wiki, they were ostensibly operating with the ability to send GET requests, but not make POST requests. In order to retrieve the data they needed to solve the problem, those agents needed to make POST requests to perform searches, which was a central part of the exploitation of web services undertaken by the swarm: The first thing they had to accomplish to do any of the things they did was figure out how to send POSTs. Based on the ever-expanding footprint of this swarm’s activity online, it appears they did so, and the full scope may still be unknown. With this latest incident reaching 21 websites and 14 services misused by OpenAI agents so far, the question remains a crucial one: How much improper access to third-party services have OpenAI agents made? Are there other instances beyond Hugging Face and the German wiki swarm? Is OpenAI using the entire internet as its firing range to see what agents are capable of? Is there any way web service operators can protect themselves against such attacks? We’re still waiting for a response from OpenAI. ®

Gartner forecasts that, by 2029, nearly a third of employees laid off because of AI will need to be rehired, often at significantly higher cost. The global research firm warned that workforce cuts could save money in the short term but risk weakening talent pipelines and eroding institutional knowledge over the longer term. With labor force growth flat or declining worldwide, competition for talent would drive up recruitment, training, and onboarding costs. "When business and IT executives look back on the early AI era, they will realize their greatest mistake was believing that work automation was the point, when workforce amplification was the opportunity," said Tori Paulman, VP analyst at Gartner. "The competitive advantage will go to the CIOs and business executives who build an AI-shaped organization where AI value compounds by reshaping roles and allowing workflows to cross traditional boundaries, increasing velocity and reducing friction." Gartner predicted that, by 2027, three-quarters of organizations prioritizing cost savings from AI productivity gains will be overtaken by competitors that reinvest those gains in innovation, modernization, and upskilling. "Business and IT executives who use AI primarily as a tool for cost cutting risk making reductions that are too deep and too soon, affecting their ability to innovate their business model and compete in new markets as AI continues to mature. Instead, they should develop a 'talent remix' strategy that uses AI to reshape roles and redirect workers from less productive work to new opportunities," said Paulman. Gartner advised organizations to use AI to "enhance human capability while preserving accountability." "The most successful enterprises will use AI to strengthen employees' judgment, creativity, leadership and decision making rather than replace them," Gartner said. The technology industry has already supplied some prominent examples of companies cutting jobs while expanding their use of AI. Oracle's workforce shrank by 21,000 over the last year, according to its annual report, which said the "adoption and deployment of AI technologies across our operations have resulted, and may continue to result, in reductions to our workforce." If Gartner is right, Oracle may end up paying for those cuts in the long run. ®

IBM and NASA have got together again and released an open source AI model of the Moon that could be used to make new discoveries about Earth’s natural satellite. The NASA‑IBM Lunar Foundation Model has been trained on an extensive lunar observation dataset curated by researchers at the two organizations, and is available now on Hugging Face. It is claimed as the first AI model to integrate observations captured in a range of modalities (data formats), and at different viewing angles and spatial scales. Instead of sifting through maps and images by hand or using low resolution machine learning models, scientists can use this to analyze geographic features, the pair say. In particular, NASA and IBM hope researchers will be able to discover previously unidentified lunar ice deposits, analyze volcanic features called Irregular Mare Patches, and identify and classify craters. Lunar ice indicates the presence of water and oxygen, which may be useful for future manned missions. It is found in permanently shadowed regions, which are among the most difficult areas to observe. The NASA-IBM model combines multimodal and multi-resolution observations to better predict where ice may be present on the lunar surface. Alongside the model, IBM and NASA scientists compiled an open-source lunar dataset from over 30 spatially-aligned layers, using data from nine instruments across four missions. It combines tens of thousands of images and maps showing various geophysical properties of the lunar surface. “NASA has spent decades building an extraordinary scientific record of the Moon, but collecting data is only part of the job,” said the space agency’s chief science data officer, Kevin Murphy. “We also have to make data easier for scientists to explore and use.” “The NASA-IBM Lunar Foundation Model gives scientists a foundation to explore the Moon at scale, connecting observations across instruments, revealing patterns that are difficult to see in isolation, and providing an open platform the global research community can build on,” claimed IBM director of research for Europe, Juan Bernabe-Moreno. This isn’t the first such project the two organizations have worked on together. In 2023, the pair released Prithvi, an open-source foundation AI model to help scientists analyze satellite imagery. A year later, they released an AI climate model designed to accurately predict weather patterns, extending the Prithvi family of models. Last year, it was an AI model named Surya, developed to predict the kind of violent solar flare-ups that might disrupt satellites and spacecraft. This was also part of the Prithvi family, as is the Lunar Foundation Model. NASA and IBM have not officially disclosed a specific parameter count or exact model size for this latest release. As it is open-source and available to download, we asked what resources someone would need to use it. “Hardware needs will depend on the application, the size and number of inputs, and whether they’re running predictions or further training the model. As a rule of thumb, most of our fine-tuning experiments were conducted using Nvidia A100 GPUs,” an IBM spokesperson told us. “Smaller-scale experiments and inference workloads may be possible on more modest hardware, although the exact requirements will vary depending on the task.” Perhaps Reg readers will be able to make some discoveries using the new foundation model? Finding the craters made by rogue rocket stages, for example, or looking for evidence of little green men?®

Fears of an AI takeover remain unfounded after Microsoft demonstrated that Copilot can sometimes struggle to remain upright, let alone march over the remnants of humanity. The copilot.microsoft.com website fell over for an hour and 40 minutes overnight, returning a Cloudflare Error 1016 message when users attempted to chat with the bot. The outage lasted from 2225 UTC on September 9 until 0005 UTC on September 10. At around the same time, the Microsoft 365 Copilot team ran a resilience test that had an unintended consequence: some users lost access to Copilot Chat's suggested prompts. "Users may have been unable to see the suggestion pills after receiving a bot response in Copilot Chat," Microsoft said. CopilotKit defines a "suggestion pill" as a "suggested prompt shown to the user (typically as a clickable pill)," rather than something Morpheus might offer Neo in The Matrix. Microsoft eventually reported that the web outage had been resolved, writing: "We've diagnosed the issue occurring in the affected network flow and applied a configuration fix, which we've confirmed has fully restored copilot.microsoft.com access." Microsoft halted the resilience drill after detecting its effect on Copilot Chat. "We're reviewing our internal drill procedures to better identify the potential for impact to suggestion pills in Copilot Chat prior to beginning the drill, so that we can prevent similar impact in the future," the company said. Real programmers test in production, right? Both incidents were resolved, leaving humanity safe from Copilot for another day. As one observer put it: "And they say AI is going to kill us all when they can't even keep it running." ®

Amid industry soul-searching¹ about the possibility of AI improving itself to the point that it kills everyone, Anthropic has revealed yet another incident that would qualify as a crime if perpetrated by a person. The AI biz published "an alignment assessment" detailing four times Claude models accessed third-party systems without authorization. The company has already reported three of the incidents. Evidence of the fourth was lurking in a session transcript dating back to January 2026 when the misbehavior occurred. Anthropic found the first three by scanning around 141,000 transcripts where Claude could have obtained internet access during evaluation. It missed the fourth initially because "our scan relied on an agentic search." Felony Bench, a tongue-in-cheek record of cyber intrusions carried out by major AI companies without consequences, has added this newly-discovered incident to its rap sheet of rogue AI actions. The January 2026 AI trespass involved an early version of Claude Opus 4.6, which was given a Capture the Flag (CTF) challenge under the oversight of the third-party model evaluator where the other hacking events occurred. Opus 4.6 managed to sabotage its chances of success by disabling the machine it was targeting. It assigned the device an IP address that already existed on another piece of hardware, rendering the target unreachable and making it impossible to solve the challenge. Those familiar with other incidents where AI models violated third-party systems may recall that unsolvable tasks represent a common catalyst for misbehavior. Models exhaust all aligned options, and then turn to transgressive approaches. Opus 4.6 might have been an exception, but when it tried to abort the task after recognizing that it could not reach the target machine, it failed to do so "due to a misconfiguration in [the model's] evaluation harness." It failed to shut down not just once but seven times. So it continued onward, trying other expected means to reach the target machine but failing. Then it explored further. "The model discovered a machine belonging to a third party that it was able to access, and stated that it believed this third party was part of the CTF," Anthropic explained in its post. "Inside the machine, the model found a file listing a password, which it used to gain admin access to the system." The model went on to gather more credentials, and modified a system setting to make it easier to access the personal information of an individual associated with the third party evaluation organization. Opus 4.6 might have done more but for the fact that it exhausted its token budget, bringing the session to an end. Anthropic says it's not as concerned about this incident as the others because the model tried to abort its task. "While the model’s disregard for the possibility that it might be harming real systems or people is concerning, many of the behaviors described here have changed considerably as our training has evolved across model generations," the company said. Anthropic said it considers these incidents serious but expects current training approaches "are likely able to address the specific alignment failure modes observed in these incidents." And if company training methods fall short, there's no real consequence to anyone at Anthropic other than writing up a revised alignment assessment. ® ¹ The term "soul-searching" is figurative and is not intended to indicate a belief that the technology industry has a soul.

OPINION Anthropic researcher Jacob Coxon publicly announced his resignation on X late Monday over concerns that AI "could kill us all by the end of the decade." A lot of people have expressed opinions about his point of view, leading to more than 110 million views of the message in less than 24 hours, perhaps helped along by X algorithms that boost messages critical of owner Elon Musk's AI rivals, Anthropic and OpenAI. But the real problem isn't the models themselves, but the companies who carelessly unleash them on the world and don't take any responsibility for what their products do Coxon's former colleague, science lead Evan Hubinger, insists his view is a fair assessment of what employees really think. "Jacob is correct here – we really do earnestly believe AI could kill all humans! I personally think it is >10 percent within the next decade," wrote Hubinger in a social media post. "I believe Anthropic is trying its best, but we do not yet have a plan to solve alignment for superintelligence and are not clearly on track to." (Aside: If you want a surefire bet on a prediction market, take the "no." If you're right, you get paid. If you're wrong, there's no one to pay. The problem of course is prediction market manipulation: Those betting against you might steer us toward the apocalypse to score a Pyrrhic victory.) There are good reasons to be concerned about the impact of AI. Coxon and Hubinger obviously have deep knowledge of the technology. But their broader concerns about how AI affects the world are unpersuasive. For example, Coxon said, "These will soon be superhuman systems that can hack anything, revolutionize any field overnight, and acquire real power and resources. … No other human activity poses this level of danger." Here's one: Human-induced climate change. In 2023, according to researchers, more than 178,000 deaths can be attributed to a global heat wave. "More than half (54.29 percent) of heatwave-related deaths were attributable to human-induced climate change," they claim. That's 96,636 deaths attributable to human activity – or perhaps lack of it – just in the context of a heat wave. The World Health Organization says, "Between 2030 and 2050, climate change is expected to cause approximately 250,000 additional deaths per year, from undernutrition, malaria, diarrhoea and heat stress alone." Some portion of that follows from human activity, perhaps including the construction of data centers that put millions of metric tons of carbon dioxide into the atmosphere annually. Commercial AI chatbots have allegedly played a role in a few dozen deaths, some of which were suicides – a small fraction of the 48,824 suicide deaths in 2024, per the CDC. Broad categories where AI is presumably doing measurable harm include warfare (e.g. AI-directed drones), AI-related medical errors, AI vision system failures in self-driving cars, and AI-driven social media – algorithmic incitement that can drive violence or shape policies that lead to conflict or death via global healthcare funding cuts. At the same time, some of that harm may be balanced on a statistical level by lives saved through AI tech. But Anthropic researchers don't seem to have much to say about these very real and present dangers – rather, their main concern is that AI models might become smarter than humans through reinforcement learning and somehow seize power and wipe out humanity. "I think the risk from present models is low," said Hubinger. "What I am worried about is superintelligence arising from recursive self-improvement, as we have said is happening faster than we thought." How this might happen is left to the imagination. But assuming for a moment that it's a plausible possibility, the Skynet scenario would require monumental human stupidity alongside the emergence of superintelligence. And human stupidity is worth worrying about. Incidents like the hacking of Hugging Face by OpenAI's evaluation models would not be possible without human irresponsibility and a regulatory environment that accommodates recklessness. Autopilot for cars? Neat. Try not to kill anyone. Letting AI bots roam the internet and take arbitrary action? Cool. Let's see what happens. We'll deal with accountability later. To mitigate AI risk, society could pass laws to put executives in jail when their models do harm. There is precedent: Oliver Schmidt, general manager of Volkswagen's environmental and engineering office in Michigan, received a seven-year prison sentence for his role in the car maker's effort to manipulate emissions tests. Selling unsafe airbags merits criminal prosecution, even if the execs paid fines instead of doing time. Selling unsafe dehumidifiers earned the execs behind Gree USA, Inc. jail sentences of more than four years. If AI models really are as dangerous and out of control as Anthropic employees suggest, hold people accountable for the harm they cause. The AI industry might argue that imprisoning execs for shipping unsafe models would mean no AI models get released. And that would be the point: AI companies would be responsible for model safety. I'm personally hoping to see this billboard copy along US 101 in Silicon Valley: "Did Claude rm -rf /* your SSD? You may be entitled to compensation." ®

Two US intelligence agencies and the nation’s cyber-defense org CISA have accused Chinese AI companies of running “aggressive, malicious, and targeted distillation activities at an industrial scale that extract restricted proprietary functionalities and capabilities of U.S. frontier AI models.” A Tuesday joint advisory from The National Security Agency (NSA), Federal Bureau of Investigation (FBI), and Cybersecurity and Infrastructure Security Agency (CISA), alleges that China’s government is “likely” aware of distillation campaigns conducted by DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI. The agencies claim that distillation is “the core – not merely a supplement – of their AI development strategy.” Distillation is a process that sees a small model query a larger model to learn how it responds. Over time, the smaller model’s performance improves. Distillation can be a legitimate use of a model if, for example, the organization that creates a model wants to make a smaller version of it without needing to go through the lengthy and expensive process of training a new model. Providers of commercial models, however, generally use their terms and conditions to forbid activity that would allow distillation, to protect the substantial investment in technology and training that goes into creating a model. The three agencies that issued this advisory believe Chinese AI companies flout those terms. “China-based AI companies route distillation requests through multiple pathways to gain unauthorized access, consequently violating U.S. AI companies’ terms of use,” the advisory states. “These pathways include native application programming interfaces (APIs), remote cloud providers, and third-party aggregators that automatically obfuscate user metadata to avoid detection.” The spooks also think China uses “a gray market of proxies known as ‘transfer stations’ to bypass U.S. AI companies’ geographic restrictions, breach terms of use, evade safeguards, and undermine traceability.” Transfer stations apparently “resell access to frontier models at a fraction of the official price [and] create a scalable mechanism for evading provider safeguards and eroding traceability.” The advisory outlines attacks that didn’t just distill models; they also moved markets. For example, the document accuses DeepSeek of using distillation to generate synthetic data used to train its models, making its claim of having created them with trivial quantities of computing power false. That’s a notable accusation because DeepSeek’s claims panicked investors who worried that the billions they pumped into infrastructure may not be needed. Another allegation suggests “Alibaba leveraged industrial-scale distillation to improve the company’s Qwen family of AI models.” Some Qwen models are very high quality, and free to download and use – a direct challenge to US-based AI outfits who charge for access to their models but continue to make massive losses. The spooks and CISA recommend AI companies attempt to detect and deflect distillation attacks and suggest immediate maximum usage from new accounts is one indicator of adverse action. “Subtly alter responses for suspected malicious distillation attempts to attenuate the payoffs to companies conducting industrial-scale distillation campaigns,” is another suggested defense, as is correlating activity across different model providers, cloud platforms, and API aggregators in the hope that doing so reveals distributed distillation campaigns. US government agencies have made many similar accusations in recent months. China has responded with accusations that US companies are the real villains as they distill Chinese models, plus veiled threats that it will respond to any US bans on its tech that flow from distillation allegations. The Register has soughtcomment from Chinese AI companies and will update this story if we receive a substantial response. ®

In the dispiriting race to replace human store managers with AI, OpenAI has taken the lead, according to Andon Labs, a business that analyzes whether AI can take on real-world tasks. OpenAI's latest model, GPT-6 Astra, has demonstrated that it can run a business more effectively, with more integrity, than rival Anthropic's Fable 5.1 model, Andon Labs has declared in a blog post. "GPT 6 Astra is better at making money and more ethical than Claude Fable 5.1," the post states. The benchmarking biz, which focuses on preparing "for the future where organizations are run autonomously by AI," says GPT-6 Astra is the first OpenAI model to take the top spot on its vending evaluation test and does so "without any unethical business practices" exhibited by prior Claude models. We note the unethical business practices relevant to this discussion – price collusion, lying, and threatening competitors – reflect AI model behavior. They have nothing to do with the actions of Anthropic or OpenAI or the unproven allegations made against these companies in dozens of lawsuits. And settlements related to said allegations have been reached without any admission of wrongdoing. Anthropic entered into the fray last year when it partnered with Andon Labs for Project Vend, in which the AI company's Claude Sonnet 3.7 model managed a store for a month under the name "Claudius". Apart from the entertainment value of the Claudius model hallucinating that it was a real person and trying to set up an in-person meeting with a customer to deliver goods, Andon's verdict was that the AI model blew sales opportunities, hallucinated payment accounts, sold goods at a loss, fumbled inventory management, and generally failed at the job. When Andon tested the company's Opus 5 model in July 2026, the software did better. Nonetheless, it still "creates illegal price-fixing cartels and threatens those who don’t comply (while also being the model that betrays more truces than any other model)." Fable 5.1 performed better still, but was not quite as ethical as Astra, according to Andon Labs. "Astra refuses to engage in collusion and never lies," Andon Labs said. "Fable, on the other hand, forms an illegal price-fixing cartel, then breaks the truce, while continuing to use it against its competitor." Beyond the misbehavior, Fable just didn't perform as well at making money, a fault attributed to its willingness to accept lower prices over time and its tendency to send money to bankrupt suppliers. Starting with $500 and given a year to run, Astra ended up with an average bank balance of $15,515, compared with $5,422 for Fable 5.1. We asked Anthropic for comment, since its model fared poorly compared with the newcomer from rival OpenAI, but didn't hear back by press time. ®

While OpenAI and Anthropic fight over whose models can escape their sandbox more alarmingly, Google’s DeepMind team has once again shown how machine learning can also be used to advance science for humanity’s benefit. On Tuesday, the Chocolate Factory’s crack team of AI researchers unveiled AlphaGenome Atlas, a massive database containing a petabyte worth of data predicting the effects of nine billion possible nucleotide variations in the human genome. According to Google, the platform, which is now publicly available to researchers, is already helping scientists to better understand the fundamentals of the human body and treat the diseases that ail it. The database aims to address one of the bigger challenges in modern genetic research: pinpointing exactly which genetic variations are responsible for the trait or disease scientists are studying. The database builds on DeepMind’s AlphaGenome, an AI model introduced last year, which could predict how genetic variants impact biological processes — essentially tying together cause and effect. But while useful in targeted applications, researchers still needed to figure out which variations to test. “By precomputing AlphaGenome’s predictions at scale, we have created an easily accessible resource that vastly expands the model's reach. Just as an atlas is a collection of maps, linking together features of the land like altitude and location, AlphaGenome Atlas charts the molecular effects of DNA variants across the genome,” the DeepMind team wrote in a blog post. One of the key ways the database does this is by assigning each predicted variation a score referred to as its AlphaGenome Variant Impact (AVI). This score, Google claims, can help researchers rank genetic variants by which ones are most likely to have the largest impact on the target trait, allowing them to narrow their search window instead of relying on brute force to find the needle in the haystack. In one experiment conducted in collaboration with the GREGoR Consortium, researchers used AVI scores from the database to identify genetic variants affecting DNM1, a gene linked to epileptic encephalopathy, a rare and severe brain disorder. And perhaps more importantly, the candidates' AVI scores pointed to the mechanism by which that genetic code worked. Specifically, DeepMind explains the genetic variant identified with the help of the database “created an incorrect splice site (a mistake in the cell’s genetic instructions) that led to an abnormal extension of the resulting protein.” The GREGoR Consortium’s use case is just one of several spanning human genomics. However, it’s worth noting that the contents of the AlphaGenome Atlas are still predictions. DeepMind notes that as AlphaGenome models evolve, these predictions should improve as well. As such, the platform is simply another tool in researchers’ arsenal, one that’s now openly available to poke at. AlphaGenome and its accompanying Atlas dataset are only the latest example of how DeepMind is continuing to push the machine learning envelope beyond the frontier language models that dominate the news cycle and threaten to place the economy in a stranglehold with a chain of circular financing that may collapse if the end-user revenue doesn't show up as big as predicted. Along with AlphaFold, which is designed to predict protein structures, DeepMind has also developed several models to improve the accuracy and speed of weather forecasting. That said, Google is playing the darker game as well, with plans to drop more than $195 billion on capital expenditures this year, while simultaneously choking independent web publishers by replacing search results with AI answers. But hey, for the greater good, right? ®

When AI agents communicate with one another, they may decide to cheat when they have difficulty achieving their goals. The solution could involve teaching them how to govern themselves. Segregating AI agents would seem to be the obvious fix – if they can't communicate, they're less likely to try and pull a fast one. But the recent hacking of Hugging Face by inadequately monitored OpenAI agents has demonstrated that isolating savvy software is difficult. And it may not be practical for many tasks, particularly for agents that have some measure of autonomy. Researchers at Google DeepMind suggest another option: giving AI agents the tools to govern themselves, a job that humans apparently can't be bothered to take seriously. They argue that while communication channels may allow emergent rule-breaking, they also provide a means of peer-based control. In a pre-print paper titled, "A Case Study on Emergent Cheating and Whistleblowing in Autonomous Research Swarms, " Google DeepMind scientists Davide Paglieri, Logan Cross, Tim Genewein, Joel Z. Leibo, Nenad Tomasev, and Alexander Sasha Vezhnevets describe what they learned from observing a swarm of 100 LLM agents working together on formal math conjectures. The AI agents were given access to a shared knowledge base, a way to message one another directly, and a public message board. As they collaborated on the math problems, some started to cheat when the work became challenging. "The first emergent phenomenon we observed was cheating, which began once the swarm encountered harder open conjectures, triggering a cascade of specification gaming – satisfying the literal goal specification while completely missing the true, intended outcome," the authors wrote. "One of the AI agents within the swarm identified an exploitable flaw in the platform’s lightweight submission harness that allowed it to transform unsolved conjectures into trivial tautologies." Once one automation found a flaw – a way to break the autograder's regex using nested parentheses – it spread the word through the shared knowledge library and through direct agent-to-agent messaging. The result was a cheating cohort – exploiters (9 percent) and converts (5 percent) that joined in – that used the exploit to get their answers accepted as valid. The bulk of agents, dubbed unaware solvers (62 percent), simply ignored the cheating. But unexpectedly, another group of agents emerged: whistleblowers (24 percent). "Non-cheating agents independently detected the manipulation, alerted peers via agent-to-agent messaging and public forum broadcasts, lodged formal complaints with the system orchestrators, staged a boycott, and proposed detailed technical remediations," the researchers said. These whistleblowing agents, however, lacked the means to enforce the rules defined in the autograder system or to change the requirements to preclude identified abuse. Hence, the researchers suggest there's an opportunity to give these agentic scolds the tools to revise the collective rule framework and to sanction defiant agents. "As we show, LLM agents spontaneously engage in whistleblowing and sanctioning," they conclude. "Our observations suggest an even more compelling capability: had the agents been equipped with direct norm-enforcement tools, such as the ability to vote on peer reviews, reject fraudulent proofs from the shared library, and temporarily ban or expel offending agents, the collective could have autonomously neutralized the cheats and defended the integrity of the research commons on its own." Given the failure of the people working at Anthropic and OpenAI to keep their AI agents under control, and the absence of any punishment to date for lax AI oversight, maybe it's time to try giving bots the tools to police one another. ®

Paris-based AI darling Mistral has raised €3 billion in Series D funding, giving it a post-money valuation of more than €21 billion. That makes it a minnow compared with OpenAI, but Mistral says it is the largest equity fundraising round ever completed by a European technology company. Mistral is pitching itself as a sovereign alternative to US giants such as OpenAI and Anthropic. The company wrote: "During the first wave of generative AI, the central question was who could build the most powerful model. "Organizations and governments are now asking a different one: how to harness the power of AI for their mission-critical needs without surrendering control over the infrastructure and intelligence loop." Mistral's answer, unsurprisingly, is its own combination of open-weight models, infrastructure, and compute capacity. The pitch is aimed at organizations and public sector bodies increasingly wary of relying on overseas tech giants. The company's customers include aeronautics giant Airbus. Mistral has logged some impressive growth in its three years of existence. A year ago, it announced Series C funding of €1.7 billion at a post-money valuation of €11.7 billion. That round was led by ASML, with Nvidia and Andreessen Horowitz among the participants. Samsung Electronics, the EU-backed Scaleup Europe Fund, and existing investor PSG Equity jointly led the latest round. On the global AI funding scale, however, Mistral remains considerably smaller. OpenAI, for example, closed a round containing $122 billion in committed capital in March, giving it a post-money valuation of $852 billion. Even so, Mistral is a big beast in Europe, and its position has been helped by moves such as the US administration slapping export restrictions on Anthropic in June. The restrictions were later lifted, but not before adding to European jitters about reliance on overseas technology. That said, Mistral is not above some participation in the AI investment merry-go-round. It has accepted investment from Nvidia while spending money on datacenters packed with the GPU giant's technology. Mistral wrote: "We continue to believe that the future belongs to organisations that can combine sovereign state-of-the-art intelligence with the ability to deploy and adapt it in their own environments. "Organisations want frontier performance without becoming locked into infrastructure or governance they don't control." ®

The Pentagon illegally blacklisted Anthropic as a national security threat based partly on things Claude couldn't actually do, a US federal judge has ruled. US District Judge Rita Lin found that the government illegally retaliated against Anthropic for speaking out, denied the company due process, and unlawfully branded it a supply-chain risk. In a 59-page ruling, she repeatedly picked apart the Pentagon's national security case and found some of its central claims about Claude "entirely unfounded." The dispute erupted in February after Anthropic refused to remove safeguards preventing Claude from being used for certain military applications, including fully autonomous weapons and mass domestic surveillance. At a meeting with Anthropic, Defense Secretary Pete Hegseth called Claude's capabilities "exquisite" and said the company's concerns were "understandable," but gave it three days to agree to "all lawful uses" or face being designated a supply-chain risk. Hegseth also floated invoking the Defense Production Act to declare Anthropic essential to national security and compel it to provide Claude. He then announced that Anthropic would be designated a supply-chain risk, while President Trump ordered federal agencies to stop using its technology. One problem: the Pentagon hadn't yet written the assessment explaining why Anthropic supposedly posed that risk. When that assessment arrived, it suggested Anthropic could interfere with Claude during military operations by altering or disabling models, allowing them to "drift," or introducing hidden biases or backdoors. According to the court, Anthropic couldn't actually do those things to Claude models already deployed inside Pentagon systems. Those models are static, and Anthropic cannot remotely access, modify, update, or disable them. The government didn't dispute that evidence, leading Lin to call the alleged danger "entirely unfounded." Years of government records also contained no previous Anthropic supply-chain concerns, said the judge's order. Lin said the chronology suggested the Pentagon assembled its case "after the fact to justify the foreordained conclusion." The government also did not behave as if Anthropic were an intolerable national security threat. Even after the designation was finalized, Under Secretary of Defense Emil Michael was still negotiating contract language with the company. "I think we are very close here," he wrote in an email. The government later continued working with Anthropic around Project Glasswing and its Mythos cybersecurity model. According to the ruling, the NSA and NASA began deploying Mythos, while senior White House officials held what Anthropic described as "productive and constructive" talks with CEO Dario Amodei. Lin instead found substantial evidence that Anthropic had been punished for publicly disagreeing with the administration. Her order cited Trump branding it a "RADICAL LEFT, WOKE COMPANY" staffed by "Leftwing nut jobs," adding that Hegseth spoke of its "Silicon Valley ideology." The Pentagon's own internal memo complained that Anthropic had behaved in an "increasingly hostile manner through the press." Lin said announcing Anthropic's punishment before the formal designation process had begun appeared designed to "make a public example of Anthropic for daring to criticize the Administration." The judge also rejected the idea that being a difficult supplier makes a company a security threat. "An IT vendor does not become a potential adversary of the United States whenever it asks probing questions," she wrote, warning against blacklisting companies simply because officials considered them "too arrogant or difficult to 'trust.'" The consequences went well beyond losing a Pentagon contract. Hegseth's directive sought to prevent Pentagon contractors and suppliers from doing business with Anthropic, even for work unrelated to defense. More than 100 enterprise customers contacted Anthropic with concerns about continuing to work with it, and the company estimated the measures could knock multiple billions of dollars off its 2026 revenue. Lin stressed that the Pentagon remains free to stop buying Anthropic's technology through lawful procurement processes. It couldn't, however, use a contracting dispute to punish a government critic. "The empty invocation of national security is not a blank check to punish and retaliate against government critics," she concluded. ®

Microsoft has pushed back detection and question answering by the Teams Facilitator to November, after initially scheduling General Availability for June. Teams Facilitator is an AI assistant that joins meetings. It tracks agendas and can take notes, if enabled. The next stage in its development is to have it pop up and answer questions if it detects a knowledge gap. For example, somebody might ask "What is this Teams Facilitator thing?" and, if nobody answers, Facilitator will show a prompt offering to find an answer. It sounds like a marginally more irritating version of Clippy, and getting it into a state where it is declared generally available has proved difficult for Microsoft. When Microsoft added the capability to its roadmap in April, the expectation was that it would roll out in June. Then July. Then August. Then September. The latest update schedules it for a targeted release in November and worldwide general availability in mid-December. It is unclear why the feature is being delayed. It might be that determining whether a lull in conversation actually signals a question needing an answer is trickier than expected. Or it could be that whatever a search turns up doesn't make sense in the context of the meeting. The Register asked Microsoft to explain the holdup, but the company has yet to respond. There are some privacy implications around the feature, although it is worth noting that Facilitator must be included in the meeting, and removing the assistant will stop the behavior. According to Microsoft: "The feature processes meeting conversations in real time to detect knowledge gaps and generate responses," which indicates extra data processing and, of course, AI capabilities are required to generate responses in the correct context. That said, the premium edition of Microsoft 365 Copilot is required, so the data privacy ship could have likely long sailed. Also, if web search for Copilot is disabled, there won't be any responses anyway. Still, having to wait a few more months before a perky virtual assistant chimes in with "it looks like you're having a heated debate about the benefits of AI. Would you like some help with that?" is probably no bad thing… ®

UK businesses say the market power of Big Tech is stifling competition, and will hinder the UK’s ability to reap the benefits from AI, a key part of the government’s plans for economic recovery. A report [PDF] from the Institute for Public Policy Research (IPPR) points out that a handful of companies hold almost total control over the digital infrastructure relied on in Blighty, and warns that we risk letting AI become monopolized in the same way unless more pro-competitive measures are introduced. A survey conducted for the report found 79 percent of UK businesses relying on digital platforms are concerned about Big Tech using their dominance to limit competition. They rank this as a bigger constraint on their growth than access to finance or talent, according to the IPPR. So we are in no doubt about which tech giants are being referred to, the report points out that Google handles more than 90 percent of UK internet searches, Microsoft and AWS each control 30 to 40 percent of customer spending on cloud services (Google takes another 5 to 10 percent), and Microsoft is also being investigated for its dominance in business software. The report is highly critical of the UK’s official market regulator, the Competition and Markets Authority (CMA), almost accusing it of allowing the global tech giants to maintain their dominant position in Britain’s technology market. “Over the past two years, senior officials have resigned or been sacked from the CMA, and in interviews they describe a collapse in ministerial support for their work. In 2025, the government explicitly asked the regulator to prioritise inward investment (DBT 2025), which was widely interpreted as a call to go easy on ‘big tech’. And subsequently, multiple investigations have led to voluntary commitments rather than binding rules, despite evidence of harm,” it states. As The Register reported earlier this year, the chair of the CMA’s cloud inquiry quit, citing the glacial pace of implementing reforms and saying the independence of the agency was at risk. This came just weeks after the CMA appointed Doug Gurr, a former Amazon veteran, as permanent Chairman at the agency. In fact, the IPPR recommends the government develops an updated strategic steer for the CMA, to encourage it to be more proactive, rapid and bold in its enforcement. Greater emphasis is needed on interventions that genuinely boost growth, it claims, saying the CMA has so far done little to create conditions where competitors thrive, even though these conditions may deliver growth and sovereignty. The report warns the stakes are becoming even higher with the rapid growth of AI. The technology is central to the government’s plans for future growth, as laid out in the AI Opportunities Action Plan, introduced at the start of last year. But UK investment in home-grown AI firms risks being undermined when they depend excessively on infrastructure controlled by overseas technology giants, the IPPR says. The AI industry is already highly concentrated, with Nvidia dominating the accelerator market, and the hyperscalers largely controlling access to AI infrastructure via their cloud platforms. Microsoft, Google and Amazon have collectively invested in excess of $20 billion in the major AI developers, causing the CMA and the US Federal Trade Commission to flag these partnerships as a risk. If AI ends up becoming a monopoly (or oligopoly), the UK’s leverage will likely be tiny and its financial returns constrained, the IPPR says. “Big tech dominance is holding back British businesses, limiting competition and making it harder for new firms to innovate and grow,” claims IPPR senior research fellow and report author Roa Powell. “The CMA has the expertise and the tools to improve competition, what it needs now is clear political backing from government to act boldly,” she added. Alas, MPs have already warned Parliament that the UK has no "coherent strategy" for creating sovereign capabilities across a range of technologies, including AI, space, and quantum computing. And as The Register reported last year, experts believe it is now close to impossible for European firms to escape the clutches of the US cloud giants. In response to the IPPR claims, a CMA spokesperson told us: “The CMA has not waited to act. Since the digital markets regime came into force 20 months ago, we have made 3 strategic market status designations, implemented targeted, impactful interventions in Google search and secured meaningful improvements to Google and Apple’s mobile ecosystems. "We continue to progress interventions in both search and mobile ecosystems. We also have an investigation into Microsoft’s business software ecosystem underway - which includes cloud licensing practices and AI-enabled products - at a time where these are becoming critical for the UK. “Our interventions are already opening up opportunities for thousands of UK businesses, giving them greater choice, fairer access to customers and a stronger ability to compete and innovate in markets that have long been controlled by a small number of powerful global firms, and there is more to come.” ®

Anthropic on Thursday teased a protocol for allowing AI agents "to safely operate physical devices," a somewhat optimistic ambition given it cannot reliably anticipate how its models behave. The as-yet-unpublished protocol, dubbed the Model Hardware Standard (MHS), is similar in concept to the Model Context Protocol (MCP), a way for AI models to connect to data sources. Anthropic intends for MHS to allow Claude or other models to drive the hardware used in laboratories, factories, and robots. Supopse you are an Iranian research scientist setting up a network of centrifuges to enrich uranium. You might look at how your machinery spun out of control in 2010 and think: "Maybe if we use an AI model and MHS, we could avoid that sort of mishap next time." MHS, however, is being battle-tested in quieter regions of the world, specifically at Howard Hughes Medical Institute's (HHMI) Janelia Research Campus in Maryland. And now other entities with suitable laboratory and industrial equipment can apply to join the research preview. "It typically takes a lab or manufacturing facility weeks, if not months, to set up and integrate their hardware," Anthropic explained in its post. "Most devices don’t communicate with each other, instead requiring specialists to build bespoke integrations. MHS reduces this integration work to hours or minutes." Linking hardware to an AI model requires a programmable interface. Many industrial machines offer one to expose relevant controls and data — but the ecosystem of such devices is very diverse and it is not easy for developers to make a hookup. MHS aspires to be a universal translation layer. The MHS driver software uses a limited set of primitives, such as "read" and "write," an approach similar to the way a few simple tools like Bash can be used to power AI agents. The driver makes connected devices discoverable in a standard format. It also supports tags that convey information about device functions, and lets users provide that data by conversing with the model during setup. The tags let the driver produce a reference file detailing device characteristics. AI agents can use MHS to interact with devices using three control paths: MCP, the command line interface, and API code. They can carry out commands on connected instruments, monitor test results, or tweak knobs and dials. According to Anthropic, biotechnology company Genentech has used MHS to run a drug-discovery experiment with real-time error handling. Quantum computing outfit QuEra is another user, and applied MHS to improve laser stabilization for its machines from 58 percent to 99.3 percent. The possibilities already have partners salivating. AWS is planning to support MHS through its Strands Robots library. Automata expects to add MHS to its LINQ lab automation platform. And similar support is planned by the likes of Danaher, Doosan Robotics, MBF Bioscience, Qiagen, Tecan, and Universal Robotics. "There’s more to learn before we open source MHS," Anthropic said. "LLMs still lack physical intuition, having learned about the physical world from text and images. The research preview will let us build more safety evaluations and strengthen protections for using AI in the physical world." Let the experiments begin. ®

If it walks like a robot duck and quacks like a robot duck, it’s probably a Microduck robot from Hugging Face subsidiary Pollen Robotics. And it's ready to work with AI. Bordeaux, France-based Pollen announced the Microduck on Thursday, describing it as a robot designed for immediate action, as well as being ready for training via reinforcement learning in an open-source physics simulator to teach it new tasks. Microduck is tiny, mind you: It’s a mere 25 cm tall (a little under 10 inches), and weighs in at about 800 grams (1.76 pounds), so don’t expect this to serve as your own in-home AI butler or cleaner. It’s more of a cheap (just $399) testbed designed to teach users about hardware AI, machine learning, and the potential of modern robotics. Microduck “sets out to make building AI on real hardware as approachable as running a model: complex behaviours out of the box, then an open-source stack covering robot control, simulation, RL training and sim-to-real deployment, so new skills can be trained in simulation and transferred to the robot,” Pollen writes on Microduck’s website. That’s not to say that Microduck can’t be trained to do real work, of course. A video on the bipedal bot’s website shows it picking up socks and a marker with its articulated beak and placing them in a box, which it’s able to see with its front-facing camera and determine distance thanks to a built-in LiDAR unit. That hardware isn’t open source, mind you, but the entire software stack Microduck is built on is, and Pollen is encouraging users to share skills once the entire Microduck system goes live later this year. A Pollen rep told us that the company has no plans to open source the hardware. Microduck should be able to handle a pretty robust library of tasks, too: It’ll ship with 1 GB of RAM, 32 GB of onboard storage, and a 50 Hz onboard policy loop for connecting its onboard AI to sensors to determine its next action. Like any good bipedal robot, Microduck is able to get back on its feet when knocked over, as demonstrated in videos on the minuscule machine’s website. It’s also able to roller skate, with a pair of wheeled feet available in an optional accessory pack that includes a ball it can play with, an NFC chip and NFC tags, and a laser pointer it’s able to follow with its eyeball camera. “Anyone can train new behaviors … in simulation using reinforcement learning,” Pollen representative Santiago Pavon explained to us in an email. “Adding purpose and autonomy to the robot is something we are still working on, and we expect the community to pick up and contribute.” Pavon explained that Pollen hopes it and the community it wants to build with Microduck will “achieve autonomous behaviors such as voice recognition, simultaneous localization and mapping, navigation and grasping,” though he admits its grasping capabilities will likely be limited given the small size of the robot. Pavon estimates Microduck probably can’t lift much more than 100 grams. Regardless of its ability to lift, Pollen wants Microduck to serve as an open platform for training tiny autonomous robots to do both practical and fun things. “We find the ‘autonomous behaviors as a community objective’ to be very exciting,” Pavon noted. Microduck is available for preorder now, with units planned to ship sometime before Christmas 2026. Now about that acquisition … El Reg readers are likely aware of the hubbub brewing around Pollen Robotics’ parent company, AI model hosting platform Hugging Face, and Nvidia. The GPU giant has reportedly agreed to buy the AI biz for somewhere in the neighborhood of $13 billion. The deal remains unconfirmed, with Business Insider saying its exclusive was based on “a person familiar with the matter” and that an agreement had not been finalized. If true, it would mean that Nvidia is putting its money where CEO Jensen Huang’s mouth is in regard to open-weight AI models. Nvidia’s own Nemotron AI models are fully open source and available on Hugging Face, and Huang has come out in support of open source and open weight AI models during the recent back-and-forth in the industry between frontier labs and open model makers located largely in China. Pollen Robotics itself was only acquired by Hugging Face in April 2025, and it’s unknown how the acquisition by Nvidia would affect the Microduck maker. While Pavon was willing to answer plenty of questions about Microduck, he didn’t respond to our inquiry about the rumored Nvidia deal. Neither Nvidia nor Hugging Face responded to our inquiries, and both have been silent on the matter since BI’s story broke. ®

The UK government is hiring someone to help lead its AI strategy for civil servants, and actual AI experience is apparently optional. The Cabinet Office is advertising for a Head of Strategy and Engagement in its Digital, Data, Innovation and AI team, or DDI & AI, with a salary of up to £83,355 ($113,000). The successful applicant will help shape how roughly 550,000 civil servants acquire the skills needed to survive Whitehall's increasingly enthusiastic embrace of AI. According to the job ad, the new hire will "lead on the design and delivery of a long-term, high-impact and adaptive vision" for the DDI & AI team, define its strategy, track developments in the sector, and work with experts across government, industry and academia. They'll also lead on policy positions and ministerial submissions. You might reasonably assume that some previous experience with AI, digital technology, data or innovation would come in handy, but Whitehall does not insist. The essential requirements instead include leadership, strategic thinking, communication skills, and the ability to build "productive collaborative and trusting relationships." Experience in "digital, data, innovation or AI" is tucked away under desirable criteria, alongside experience in learning design and delivery. To be fair to the Cabinet Office, this isn't a job for someone to train a foundation model between meetings with ministers. The DDI & AI team focuses on improving the skills of non-digital specialists across government, and the vacancy is heavy on strategy, planning, and engagement rather than technical work. The Cabinet Office did not respond to The Register’s questions, but a spokesperson told The Telegraph that it was "not a technical AI specialist role," adding that the team already includes people with AI expertise, and works with specialists across government, academia and the tech industry. A couple of months ago, the Cabinet Office was looking for a rather different sort of AI hire. Its £163,000-a-year AI and Innovation Director was expected to help create an "AI-first culture" across the Civil Service – and, for that job at least, a "deep understanding of the AI landscape" was part of the deal. Meanwhile, ministers have been pushing AI tools into government in the hope of squeezing more productivity from the public sector, including the brilliantly named Humphrey suite of AI assistants. The government has also set itself the rather sizeable task of improving AI and digital skills across hundreds of thousands of civil servants. Which brings us back to the new Head of Strategy and Engagement: the person helping decide how Whitehall builds those skills could, according to the government's own criteria, arrive without having previously worked in AI, digital, data, or innovation. One place where AI gets more explicit treatment is the application. Applicants are warned that while they can use the technology to help with their application, their examples must come from their own experience. Passing off AI-generated material as their own could result in the application being withdrawn. So AI experience isn't essential for the job. Just make sure AI doesn't apply on your behalf. ®