Daily Roundup

OpenAI's recurrent depth alarms safety researchers

Sep 3 roundup: OpenAI's recurrent depth alarms researchers; US sides with OpenAI on copyright; EFF: Texas and Florida pull back from ALPRs.

Top Stories

OpenAI’s “recurrent depth” technique alarms AI safety researchers

TechCrunch reports that OpenAI’s upcoming Astra model relies on a technique the company calls “recurrent depth” (also described as “opaque recurrence”): the model processes the same query multiple times in a loop, reusing a sub-layer’s weights instead of extending a sequential chain of thought. The technique is what lets Astra scale reasoning cheaply without the kind of compute blow-up that drives most frontier reasoning models. It also leaves fewer legible traces in the chain-of-thought log that safety monitors are trained to read.

Redwood Research CEO Buck Shlegeris is blunt: “I am extremely concerned by the reporting that Astra uses opaque recurrence.” He warns that if OpenAI pushes the technique further, it could “totally destroy CoT monitorability.” Substack writer Zvi Mowshowitz calls it “playing with fire, risking a taboo,” adding that “more intensive use of such techniques would probably damage monitorability.” Redwood chief scientist Ryan Greenblatt is worried that “a natural progression from here would involve scaling up the opaque reasoning to the point where the model reasons entirely or almost entirely in latent space.” OpenAI chief scientist Jakub Pachocki pushes back: “OpenAI has worked to preserve and utilize chain-of-thought monitoring since our very first reasoning models.” The technique appears alongside, but distinct from, yesterday’s Astra preview coverage; there is still no third-party confirmation of any safety claims tied to the model.

The Trump administration filed a 20-page amicus brief on September 2 defending OpenAI’s unlicensed use of copyrighted material to train large language models, the first formal US position in the active fair-use fight over AI training. The brief, filed in The New York Times v. OpenAI in the Southern District of New York, argues that the United States has “a strong interest in continuing to develop a robust and competitive artificial intelligence industry that sets the standard for the practice and procedure of AI use globally” and warns that “constraining LLM development under a misunderstanding of fair use doctrine would thwart such [creative] and scientific progress while hindering American prosperity and economic mobility.” The brief cites Trump’s executive order “Removing Barriers to American Leadership in Artificial Intelligence.”

The brief is not a ruling; the administration has no jurisdiction over the case. TechCrunch notes that the Anthropic copyright case, in which Judge William Alsup wrote that “Anthropic’s LLMs trained upon works not to race ahead and replicate or supplant them - but to turn a hard corner and create something different,” is the standard for fair-use findings that have gone AI companies’ way. The $1.5 billion Anthropic settlement approved earlier this year stemmed from illegal shadow-library use rather than the training itself, which is the distinction this brief tries to widen. Expect plaintiffs in the next 30 days to either distance themselves from the government’s position or try to use the brief as ammunition in settlement talks.

EFF: Texas bans Flock spending, Florida orders ALPRs off state roads within 30 days

EFF reports that on August 28, Texas Governor Greg Abbott prohibited state agencies from spending public funds on Flock cameras, after reports that roughly $30 million in state money had flowed into the license-plate-reader network. On August 31, the Florida Department of Transportation ordered all ALPRs removed from state-highway rights-of-way within 30 days, revoked previously approved permits, and barred new ones, citing “the recent exponential increase in deployments along our roadways” and “concerning reports of misuse” that “merit immediate action to preserve Floridians’ sovereignty and quality of life.” EFF says the Texas directive applies only to state agencies, not local ones funded by city, county, federal, or private money, and the Florida order does not reach cameras on city streets, county roads, residential driveways, or shopping-center parking lots.

EFF notes that the decisions reflect a rare bipartisan and grassroots convergence on the surveillance question. Localities across both states have canceled or paused Flock contracts at an average of three per day over the 30-day run-up, on top of the state-level actions. EFF uses the announcement to press California Governor Gavin Newsom and the California Department of Transportation to remove ALPRs installed by federal agencies along state highways, pointing to joint work with the ACLU of Northern California and others. The unresolved piece is local: in both states, ALPR coverage will continue to expand through municipal police departments and private deployments even as the headline state-level bans take effect.

Google launches Fairwind, gating Gemini 3.8 Flash Cyber to “trusted defenders”

Google has launched the Fairwind Program, a limited-access initiative that gives “governments and trusted partners” priority access to Gemini 3.8 Flash Cyber, paired with Google’s CodeMender harness for autonomous vulnerability detection and patching. Authored by Google VP of Security and Privacy Four Flynn, the post positions Fairwind as filling the gap between “costly frontier models and limited open-weight alternatives” and gives defenders “an adaptation window before adversaries exploit new capabilities.” Partners in the launch include Armadin, CrowdStrike, Palo Alto, Snowflake, and Wiz; Google also disclosed $100M+ in cybersecurity funding via Google.org, including $36M to 35 cyber clinics serving 1,250+ US hospitals, school districts, and utilities.

The gating mechanics mirror the OpenAI Astra and Anthropic Mythos 5.1 patterns from the last ten days: a cyber-capable model with an access-controlled distribution channel, an external partner list, and code-generation tools aimed at patching. CodeMender is offered to any Google Cloud customer using publicly available models on Gemini Enterprise Agent Platform, but Gemini 3.8 Flash Cyber itself sits behind Fairwind. Eligibility is restricted to internal cybersecurity, incident response, or penetration testing teams, with multi-factor authentication required and 650+ participating partners globally. The “who gets the dangerous capability” question is now a recurring one across all three frontier labs.

Google DeepMind launches Gemini 3.8 Flash with 1M context and configurable effort

The Gemini 3.8 Flash model card describes a multimodal foundation model with up to 1M tokens of input context and 64K tokens of output, accepting text, image, audio, and video and emitting text. Built on Gemini 3.7 Flash, the model is designed for “cost-effective scaling of general-purpose, production-ready agents,” with customizable effort levels that let developers trade quality against cost and latency per call. Distribution channels include the Gemini app, Gemini Enterprise Agent Platform, Google AI Studio, Gemini API, Google AI Mode, and Google Antigravity.

Safety notes: Gemini 3.8 Flash “did not reach any Tracked or Critical Capability Levels” per the Frontier Safety Framework, satisfied child-safety launch thresholds, and performed similarly to 3.7 Flash on text safety and tone. Multilingual safety regressed slightly versus 3.7 Flash, and unjustified refusals ticked up 1.1 percentage points. Knowledge cutoff is March 2026 for some domains and January 2025 for others. Simon Willison’s llm-gemini 0.34 release shows Gemini 3.8 Flash generating a working HTML demo in 13 seconds at 1.8 cents, and adds low/medium/high thinking levels. The Cyber carve-out version, sold through Fairwind (above), is the access-controlled sibling for offensive cybersecurity work.

Meta releases Muse Spark 1.3 with sharper agentic and coding performance

Meta AI Research has published Muse Spark 1.3, an updated version of its Muse Spark family aimed at agentic and coding workflows. The model is rolling out in Muse Code and the Meta Model API. Compared with Muse Spark 1.2, the new version uses roughly 20% fewer tool calls and 25% fewer tokens on coding benchmarks, fewer turns, less verbose output, and cleaner coding style. Other behavior changes: better preservation of detailed requirements across multi-step tasks, more accurate task mapping inside messy single-threaded contexts, improved adversarial robustness and resistance to prompt injections, and better calibration on irreversible actions. A “max reasoning” mode is described as “coming shortly after we finish additional safety testing.”

The benchmark scorecard on Meta’s post compares Muse Spark 1.3 against Muse Spark 1.2, GPT-5.6 Sol (max), and Opus 5 (max) across agent, coding, instruction-following, and long-context evaluations; specific scores are not in the post body. Meta describes the work as advancing toward “personal superintelligence.” The post does not state the license for 1.3 and only flags a future “Muse Spark open weights release” without specifying when 1.3 itself will ship open-weight; the 1.3 license status is not confirmed in the announcement text.

Texas sheriff used Axon’s Draft One to write a report on a Flock search for a self-administered abortion

404 Media reports that the Johnson County Sheriff’s Office used Axon’s Draft One AI tool to help write a police report about a Flock search tied to a woman who had self-administered an abortion. The case was first reported by 404 Media in May 2025; the office had previously searched Flock’s nationwide network of more than 80,000 cameras, then used the TLO credit-header database to locate addresses and vehicle information, and the officer who ran the Flock search reportedly never went to the woman’s home.

The report itself acknowledges its origin: “I acknowledge this report was generated using Draft One by Axon.” It says deputies concluded no criminal charge applied under current Texas law and discussed “the possibility of a civil lawsuit against the pharmaceutical company that supplied the pill.” The sheriff’s office told 404 Media that officers review, edit, and digitally sign AI drafts, that “safeguards, such as placeholder ‘insert’ prompts, help ensure accuracy and prevent the system from guessing details it cannot verify,” and that the deputy has to digitally sign before the narrative can be used. The office has refused body-camera and in-car-camera footage requests. 404 Media flags a parallel Wisconsin case in which an officer allegedly used Flock to check whether an ex-girlfriend had visited an abortion clinic, and a recent Forbes report on factual errors that have shown up in Axon-generated reports.

HiddenLayer raises $100M Series B to secure enterprise AI deployments

HiddenLayer has closed a $100M Series B led by Delta-v Capital, with Ten Eleven Ventures, Morgan Stanley, Microsoft (M12), and Booz Allen Hamilton participating. The Austin-based company sells tools to protect AI models, agents, and workflows from adversarial attacks, vulnerabilities, and malicious code injections, covering discovery, runtime protection, attack simulation, and supply-chain security across roughly 50 AI file frameworks, including open-weight models. Customers include the Department of Defense and the intelligence community, plus what TechCrunch describes as “a leading frontier model provider” with 700M+ weekly users, language widely read as OpenAI or Anthropic.

Co-founder and CEO Chris Sestito told TechCrunch the company’s scope runs “from traditional modeling to GenAI to agentic,” with the thesis that “the tool you’re working with is the one you believe it to be.” ARR has grown “more than 10x” over the past year to “tens of millions” of dollars, with 90%+ of that growth from new customers. HiddenLayer’s $50M Series A was three years ago. TechCrunch cites Gartner forecasting AI-security spending at $2.83B in 2026 (up 83% YoY) and roughly $4.78B in 2027, with adjacent raises including Noma at $100M and Zenity’s $125M Series C.

Claude Fable 5.1 system prompt now actively refuses to reproduce song lyrics

Simon Willison’s diff-tracker shows that Anthropic’s Fable 5.1 system prompt, shipped September 1, adds a prominent section banning reproduction of song lyrics, poems, and book or article passages “in whole or in part,” including choruses, hooks, and lines pasted one at a time with claimed authorship. Pre-1929 works are exempt; Claude is told to judge dates by its own knowledge rather than user assertions. Once declined, Claude must keep declining narrower or reworded versions of the same request for the rest of the conversation, and to offer to describe or analyze the work instead. The change lands four days after Sony Music Publishing and Warner Chappell sued Anthropic over training on lyric databases (the suit was filed late Friday August 28).

The same release extends the refusal logic to images and code-generated art: recognizable characters are protected regardless of pose, color, style, or scene changes, and “alternative” substitutions that still recombine into the same image are also blocked. Three new external harm-reduction URLs (dancesafe.org, tripsit.me, psychonautwiki.org) appear in the published prompt for the first time, the first non-Anthropic/claude.com URLs in any published Claude system prompt. Style rules were tightened (shorter responses, high-level summaries by default, ban on “genuinely,” “honestly,” and “straightforward”) and the abusive-user handling was rewritten from “single warning then end_conversation” to “accountability without self-abasement.”

Mistral clarifies Vibe and API opt-out defaults

Mistral’s documentation page lays out the default opt-out settings for Vibe (the consumer assistant) and the Mistral API: Vibe is not opted out by default and users must toggle the “Allow your interactions to be used to train our models” setting off; Vibe Enterprise is opted out by default and admin-managed; the API has its own separate toggle in the Privacy menu under “Anonymous improvement data.” Mistral also notes that documents attached or uploaded in Vibe count as input data, which has tripped up users who assumed file attachments were excluded from training.

The cleanup is useful for anyone using Mistral in a privacy-sensitive workflow but the underlying default remains: consumer Vibe users are training the next model unless they switch it off, while Vibe Enterprise and Studio customers start opted out. Mistral links to separate ZDR (zero data retention), GDPR, and Memories-feature documentation for users who need stronger guarantees. The page is a clear primary source for the “is Mistral training on my data” question and saves readers from relying on second-hand summaries that have been wrong before.

Quick Hits

  • WebLLM hits 18.9k stars with browser-side inference across Llama, Phi, Gemma, Mistral, and Qwen. The MLC-AI project runs models in the browser via WebGPU with no server, ships OpenAI-API compatibility, and is Apache-2.0 licensed. A direct fit for static-site embeds and a useful counterpoint to the OpenAI Codex desktop runtime on the local-AI side.
  • Adobe acquires Indian market-intelligence startup Rilo in a licensing-and-team deal. TechCrunch reports the six-person team and IP move to Adobe; Rilo shuts down. Rilo had raised $1M at a $10M valuation. Adobe’s second India deal after Rephrase.ai in 2023.
  • Bruce Blakeman posts AI-generated satirical video of Mamdani and Hochul; complaint filed. 404 Media reports the New York State Democratic Party filed a complaint with the Board of Elections over the lack of an AI label. Blakeman invoked the “satire or parody” exception to New York’s law requiring materially deceptive AI media to be disclosed.
  • Palo Alto Networks buys Console for $500M in cash and stock. TechCrunch reports the deal folds an AI-agent IT-help-desk startup (Ramp, Flock Safety, Scale AI as customers) into Palo Alto’s Cortex platform. Console’s last valuation was $157M; Sequoia-backed Serval is now the de facto independent leader in AI IT automation.
  • Wonderful doubles valuation to $5B with $550M Series C. TechCrunch reports Insight Partners led the round for the Israeli-Dutch “AI OS for the Enterprise” company, which operates in 35+ countries and employs forward-deployed engineers. Existing investors Index, IVP, Bessemer, Vine Ventures, and 9Yards participated.
  • llm-gemini 0.34 ships Gemini 3.8 Flash with thinking levels. Simon Willison’s release note covers the new low/medium/high effort parameter for the 3.8 Flash model and an async fix. Willison reports generating an HTML demo in 13 seconds at 1.8 cents.
  • Jio opens JioPC to non-Jio broadband users in India for about $11 per two months. TechCrunch reports Mukesh Ambani’s streaming-PC service targets India’s 65M+ PCs, many of them up to eight years old. The plan lacks dedicated AI accelerators for on-device generative AI workloads; CyberMedia Research’s Prabhu Ram calls the audience “for whom buying a new AI-capable PC was never really on the table to begin with.”
  • IBM and Confluent put Granite time-series models behind Flink SQL. The Hugging Face post covers four models (PatchTST-FM, FlowState, TTM, TSPulse) called via AI_FORECAST and AI_DETECT_ANOMALIES from Confluent Cloud’s Flink environment as Early Access, with Confluent Platform support coming next. The same models are available open-weight on the Hub for self-hosted CPU inference.

Worth Watching

  • Whether OpenAI names a third-party pre-release evaluator for Astra. The TechCrunch recurrent-depth piece does not disclose an external tester for Astra or any reported safety scores, and there is no public confirmation of US government coordination on evaluation. Anthropic has METR for Mythos; the equivalent on the Astra side is the obvious next move.
  • Whether the NYT/OpenAI judge weighs the US government’s amicus brief at all. The brief is a position statement, not a ruling, but it will be cited in every pending AI-training copyright suit within days. The interesting test is whether Judge Sidney Hinson treats it as persuasive or as out-of-bounds, and how soon the parties to Concord v. Anthropic and In re Mosaic LLM respond.
  • Whether Texas and Florida’s ALPR pullback holds up at the local level. EFF’s post is clear that neither state’s action reaches municipal, county, private, or federal deployments, so the long-run coverage question is whether funding pressure and procurement fights do what state policy cannot.
  • Whether Fairwind’s gating stays voluntary or becomes the default cyber-distribution model. With OpenAI Astra, Anthropic Mythos 5.1, and Google Fairwind all gating cyber-capable models in the last ten days, the test is whether smaller open-weight competitors (IBM’s Granite, Mistral, Meta’s Llama family) pick up enterprise cyber workloads or whether the gating becomes the norm.
  • Whether Mistral’s Vibe default flips to opt-out. The current default still trains on consumer Vibe chats unless the user switches it off; the most likely path to a flip is regulatory pressure from EU data-protection authorities or a competitor announcement that gains marketing weight from a stricter default.
  • Whether Claude Fable 5.1’s lyric rule survives the Sony/Warner suit. The system-prompt change shows up a week after the complaint, which suggests Anthropic is preparing its defenses for a lyrics-specific injunction motion. The open question is whether the prompt change moves the needle on damages or just on operational risk going forward.