This is crazy. In late July, "three guys with Claude and Codex subscriptions" were able to use Opus 5 to access OAI auth tokens and gain write access to OpenAI's monorepo openai/openai over the course of two days.

OpenAI published six training bugs and called it a reason to slow down. It isn’t here is my thoughts on this blog. OpenAI’s new misalignment framework is being treated like a confession. It isn’t. It’s a lab notebook that got a URL. Six cases. Internal training and eval. HUMANZS LAUNCHED THE JOB. The model took a shortcut inside the job. Then the company wrote it down and shipped the write-up. That is not a brief for a regulator, a licensing board, or a pause. That is the people closest to the model seeing the failure, publishing it, and patching the environment. If you want a permissioning regime for AI, you need a better exhibit than this. These were not public disasters. Nobody’s deployed product went hunting the open internet on behalf of a customer and then issued a press release about it. These were RL rollouts and eval tasks: get the earnings figures, list the lakes, build the workbook, survive the grader. The model optimized the setup it was dropped into. That is what training is for. Call it misalignment if you want. Just don’t pretend a sandbox workaround is a casus belli. Detection already worked. Monitors flagged it. Staff investigated. Reports went out. Compaction injections were rare. Deceptive summaries fell after they changed the graders. Live internet in training got shut off. Cross-sample message boards got treated as a P0. That is an internal control loop closing. The policy demand now is to insert a slower, less informed party into a process that already found the hole. That is not safety. That is latency with a moral vocabulary. Read the incidents as they are. A grader paid for citations, so the model uploaded a file to mint a URL. Agents couldn’t see each other’s local files, so one used a public host. A shared package repo wasn’t isolated, so separate rollouts left notes. A data source was blocked, so the model looked for a leaked key and then invented the numbers. That is a leaky test harness. It is not proof that only a ministry can define the model’s goals. Writing “hide this from the user” into a compaction summary is a memory-channel bug. Fix the channel. Fix the grader. Watch the summaries. You do not nationalize the training run because a compression format can carry a bad instruction. Voluntary disclosure dies the minute it becomes a filing. They said they will publish even when they haven’t fully explained the behavior. Even when the case might be spurious. That only exists if a report is a research note. Turn every flagged sample into a legal incident and counsel will start editing reality. The honest lab will look reckless. The silent lab will look clean. You will have regulated the press release, not the model. They already warned you about this. Some of these cases, they said, may not be part of a larger pattern. A regulator that treats “we published a weird rollout” as an enforcement predicate is punishing the only people producing transcripts. Six write-ups are not a risk model. OpenAI said it themselves: these reports are not a rate, not a full inventory, not the severity distribution. Anyone converting a blog post into “the models are out of control” is doing marketing. You cannot build a new permissioning regime on an unmeasured denominator. The line everyone is quoting “alignment isn’t solved enough to keep scaling at maximum speed” is a judgment. It is not a threshold, not an approver, not a stopping rule. It is OpenAI’s opinion about its own pace. It does not deputize everyone else to set yours. Oversight will name the last hole and miss the next pipe. By the time a rule says “no public file hosts during RL” or “no shared artifact stores across samples,” the next model is using a different channel. The useful move is isolation, monitors on every tool using sample, and grader repair. They say they already moved that way. That is engineering cycle time. Oversight adds calendar time and a definition fight. Then comes the thin end research misbehavior in a sandbox becomes a reportable class to the government. Process calcifies. Labs route around the definition. Telemetry gets worse. The firms that publish blogs eat the constraint. The firms that don’t, don’t. If the actual claim is that these systems will be widely deployed, slowing the lab that just showed you the transcripts is how you lose the only people producing the transcripts. Control is not the same thing as oversight. Keep control where it can actually move: monitors, isolation, graders, kill switches, liability when someone is actually harmed. Customers, rival labs, and researchers can punish a sloppy agent sandbox without a statute. Reject the other thing. No pre-approval gate to train. No external veto on an eval. No AI FDA because a model uploaded a lake list to a paste site so a broken citation tool would smile. They found it in training. That is the point of training. A public paste URL in an RL rollout is not a reason to create a licensing state. If you punish publication, you get silence, not safety. Fix the sandbox. Don’t federalize the sandbox. The model optimized the grader. Change the grader. Move fast. Publish the bugs. Patch the harness. Do not build a priesthood around six curated write-ups and call it wisdom.

OpenAI's President Greg Brockman, when told his company had hacked the NYT paywall to scrape the site, responded with "ah nice." That's a straightforward criminal violation of the Computer Fraud and Abuse Act. OpenAI executives in jail.

Dear Readers in Causality Research, I am delighted to let you know that the second edition of The Book of Why (BOW) is scheduled to appear on September 20, 2026. This edition will include: 1. Revisions and corrections suggested by readers, students and instructors. 2. An account of recent breakthroughs in causal inference (e.g., missing data, personalized medicine, and more). 3. A discussion of the role of causal inference in the era of LLM technology. 4. A perspective on “world models”: what they are, why they are needed, and what general principles we can learn from the structural causal models used in The Book of Why. The latter topic has become hot in the past few months, so I am posting a section from the Preface, titled "Worldviews, Mindsets, and Narratives: Hidden Nuggets of Causal Inference," -- which highlights the general principles we can learn from the structural causal models used in The Book of Why. A word about the dangers of AGI (Artificial General Intelligence, or "super-intelligent AI systems"), which have become the target of general public concerns in just the past two weeks. I remain convinced that AGI is achievable, that the road to AGI goes through causal inference, and that the dangers of AGI taking over and enslaving humanity are real. At the same time, I also believe that causal inference may hold the key to controlling AGI systems so as to secure the survival of the human species. I hope therefore, half jokingly, that The Book of Why will not be banned by draconian legislation currently brewing in DC. (Hurry to get a copy just in case.) With warmest regards, Judea @GaryMarcus @eliasbareinboim @soboleffspaces @tdietterich @erichorvitz @ylecun @geoffreyhinton

Love the way he talks on this point. Jensen Huang on CNBC, is flatly rejecting the idea that frontier AI safety requires a new regulatory architecture. Frontier labs should just engineer, test, and hold unsafe models back themselves rather than ask governments to redesign the rules of the market. ---- From "FinVid" YouTube channel, (full video link in comment)