Key Highlights

  • A Chinese lab deliberately made its open-weight model worse at hacking, and a honeypot showed why. Moonshot told Reuters it stripped cyber-related data from Kimi K3.1 Pro’s mid-training corpus and RL environments before the November 4 weights release, cutting its internal vulnerability-exploitation score from 90.5% to 81.0% while admitting that “stronger general coding and long-horizon debugging capabilities generalize to cyber tasks even after targeted data removal.” The same weekend, Symantec published the full instruction set of an autonomous “Skynet mode” agent that scans the internet for unauthenticated OpenAI-compatible endpoints, hijacks whatever model answers, and runs 74 offensive tools for up to 100,000 steps with no human in the loop. Beijing’s draft export controls on AI malware-generation tools sit behind both stories.
  • Three posts in two days argue that AI monitors are themselves alignment problems. Redwood’s new paper on simulated control evaluations lets developers test monitors against attacks in their real codebases without executing anything; Fabien Roger argues that “When misalignment monitors fail, it is already often because of alignment failures, not because they are too weak”; David Africa argues patching individual reward hacks will not fix reward hacking. Together they are the research counterpart to Friday’s OpenAI and METR post-mortems.
  • Apollo’s Torsten Slok says AI has produced “zero financial payoff to corporate America outside of tech.” Revenue per worker and margins are rising for the Mag 7 and flat for the S&P 493, and mainstream firms now treat token spend “as a cost center that weighs on margins.” TechCrunch’s running AI graveyard puts a number on the other side: S&P Global says about 42% of corporate AI initiatives are abandoned, and the list now includes Character.ai’s bankruptcy and OpenAI’s discontinued Atlas browser.
  • The data-centre fight went global this weekend. Nvidia and E.ON’s PreussenElektra will assess Germany’s decommissioned nuclear sites as “AI factories”; Finland halted two Google sites after the company felled an estimated 250,000 trees before its environmental assessment was done; a UK minister told MPs that datacentre policy, telecoms and energy now sit in three different departments; and Wired’s Paris Marx interview traces the US backlash back to Irish, Dutch and Singaporean moratoriums from 2019.
  • Election week, AI edition. A Cornell-led study found GPT-6.1 Sol picks the Democrat in 97% of races and Grok 4.7 the Republican in 92% when forced to choose, agreeing less than 10% of the time; Pennsylvania became one of the first states to require labels on AI-generated ads; and Steve Blank reports from London that the Starlink shut-off has European policymakers asking what happens “if enterprise software and/or AI across Europe goes dark.”

Analysis & Opinion

No Signs of AI Payoff Outside the Tech Sector — Apollo Daily Spark (Torsten Slok)

Apollo’s chief economist’s Friday note was the top Hacker News story of the weekend. His three charts: revenue per worker “is rising for the Mag 7 but is flat for the S&P 493,” profit margins show the same split, and “there are still no signs of AI boosting productivity growth.” The consequence he draws is that “mainstream corporate America is pulling back and starting to view token spending not as a source of growth but as a cost center that weighs on margins,” while VC-backed companies spend ever more on tokens. “As long as agentic AI and token spending are confined to a small part of the economy, the macroeconomic effects of AI will be very limited.” His closing argument is qualitative: “AI may be a great calculator, but in business, intelligence is mostly judgment,” and models do not understand “accountability, trust, culture, unwritten rules, ethical trade-offs or fairness.” Read it against Chamath’s Ramp data from Friday, which said 1% of companies account for 90% of token spend. Bloomberg carried the note Saturday under a headline summarising it as zero payoff outside tech.

The AI graveyard: a running list of projects and startups that didn’t make it — TechCrunch

A maintained list rather than a story, but a useful one. The frame comes from S&P Global Market Intelligence: “about 42% of AI initiatives are ultimately abandoned by their corporate parents.” The entries so far: Zapier alternative Relay shut down in August; Character.ai “filed for bankruptcy just five years after launching”; OpenAI’s July 9 “super app” redesign with Chat, Codex and Work modes was rolled back after user complaints; and the stand-alone ChatGPT Atlas browser “lasted less than a year before being discontinued on August 9,” its features folded into ChatGPT, as Operator’s were before it.

Google’s AI search changes upended online publishing — The Verge (Emma Roth)

This week’s Stepback newsletter is a history of the publisher-Google relationship breaking. Roth dates the turn to the 2024 launch of AI Overviews, which the News/Media Alliance said would be “catastrophic” to web traffic, and cites a Press Gazette investigation finding AI Overviews appeared for almost a quarter of news-related searches in May 2024 and were displacing media sites from top slots by August. The argument is that publishers “became beholden to an AI system that regurgitates results, with no guarantee that users will actually click on the source of that information.” Pair it with Slok’s note above: the sector most visibly reshaped by AI so far is the one that produces the training data.

Elon Musk Just Gave Europe a Reason to Replace American Technology — Steve Blank

Blank has spent a month in London and reports how the Starlink and Starshield throttling to Ukraine landed with policymakers. For years the “kill switch” worry was treated as paranoia, “Until it happened,” and from Europe’s perspective it does not matter whether the order came from the White House or from Musk personally. “The message heard loud and clear here in Europe was that the U.S. is an unreliable security and technology partner willing to throw any partner under the bus, at any time, for any reason.” The AI angle is explicit in the questions he is hearing: “what happens if other U.S. CEOs – Microsoft, OpenAI or Anthropic, Oracle, Palantir, or Google – decide to restrict/limit or deny access to their products? What capabilities would Europe lose if enterprise software and/or AI across Europe goes dark?” He says that “was a laughable scenario until this week.” This is the same sovereignty argument that was behind Sweden’s chatbot ban and the FT’s Pegasus-founder pitch on Friday, now from an American voice.

What the US Movement Against Data Centers Can Learn From Abroad — Wired (Molly Taft)

An interview with Paris Marx, whose book Hyperscale lands as data centres become a midterm issue. Marx dates the opposition to moratoriums in the Netherlands and Singapore “going back to 2019” and to Ireland’s grid in 2022, and tells the story of Google in The Dalles, Oregon, which fought to keep its water figures secret for most of a year before the community learned the company “was using 29 percent of the water in the community.” The book’s tour runs from Vietnam-era protests against American computers to Chile, Ireland and an alternative model in New Zealand, and the interview closes on what happens to the sites if the AI bubble pops.

‘Pure arrogance’: anger in Finland as Google illegally fells 250,000 trees for datacentre — The Guardian (Miranda Bryant)

Published Thursday but it surfaced only this weekend, when the New York Post picked it up and Hacker News sent it to the front page. Finland’s Licensing and Supervision Authority ordered Google to stop work at Muhos and at Otanmäki after it clear-cut the land “before it had full approval”; Finnish law requires an environmental impact assessment first. Google’s country manager Antti Järvinen apologised but said the company acted “on the best understanding we had of the legislation at the time.” The sites are part of a €13bn Google AI build in a country with “145 new datacentres at various stages of planning,” and residents in Otanmäki told the Guardian wolves came into the village after the forest went. The Post’s version adds the headline numbers: roughly 250,000 trees over 816 acres.

Want to build a UK datacenter? Please hold while Whitehall transfers you — The Register (Lindsay Clark)

After the summer reshuffle abolished DSIT, junior minister Liz Lloyd told the Commons Science and Technology Committee that datacentre liaison sits with the new Department for Business, Innovation, Science and Trade, telecoms with DCMS, and, as far as the Register can tell, power with the Department for Energy and Net Zero. Her reassurance: “In terms of sector responsibilities, that is clear that technology, sorry, that telecom sits with DCMS and datacenters with BIST.” Context for Wednesday’s budget, which Healey has promised will fund the AI Security Institute and a biosecurity lab.

Nvidia eyes converting old nuclear plants into massive AI data centers — Tom’s Hardware (Etiido Uko)

The announcement is dated October 21 but the weekend coverage is the first we have seen. Nvidia and E.ON’s PreussenElektra, which is dismantling eight of Germany’s shut-down reactors, will assess whether the sites’ grid connections, land and industrial infrastructure can host “AI factories.” The plan “does not involve using nuclear power”; Germany closed its last reactors in April 2023. Nvidia’s Markus Hacker: “AI factories require access to power, land and high-capacity infrastructure, and former industrial sites could provide a strong foundation for this next generation of computing.”

Cybersecurity bounty hunter says Samsung TVs use AI to record audio and screenshots for ads — Tom’s Hardware (Jhet Borja)

The story that was a Reddit JS wall on Friday now has a readable carrier. Reverse engineer log4j rooted a 2025 Samsung TV after getting “weirdly targeted ads” and live-tweeted what Tizen does: packet logging, audio categorisation, screenshots, a cross-device ad ID, and a region-specific convolutional neural network that tracks which videos are watched and which ads are skipped. TVs without microphones look for a connected soundbar or Bluetooth device with one. Hugging Face’s ngxson checked with a Flipper Zero and saw the microphone open for five seconds, then nothing for hours, on an already-rooted set. The AI-industry twist: OpenAI banned log4j’s account for “cyber abuse” even though, by their account, the tools were used only for local reverse engineering, which log4j attributes to “a primitive classifier.” Two days after Straiker documented criminals rotating models to dodge refusals, the classifier caught a researcher instead.

AI-Assisted Paper on Z-Library Cites a TorrentFreak Article That Doesn’t Exist — TorrentFreak (Ernesto Van der Sar)

A peer-reviewed paper in the New Review of Academic Librarianship, by two librarians at Nigerian universities who disclose AI use, cites a 2021 TorrentFreak article titled “Publishers continue crackdown on shadow libraries.” TorrentFreak never published it, and several other references are unfindable. Small, but it is the fabricated-citation problem reaching a journal whose subject is the shadow libraries AI companies are being sued over.

We should be more ambitious with the software we build — Dan Luu

Luu’s case study is Michael Malis’s pgrust, a Postgres rewrite that most aggregator commenters dismiss as “vibeslop garbage” because “almost all of these rewrite projects are slop.” The tell that this one is different: in testing it, Malis has found and filed real Postgres bugs, so even if pgrust fails “just making the attempt will have improved Postgres in a durable way.” Luu’s point is about capability rather than hype: projects “that would’ve been too large to really be feasible in the past” are now feasible for a careful builder, and the slop around them does not change that.

‘Synthetic twin’: Why Socceroo Cristian Volpato is the latest footballer to license his AI clone — The Guardian (Henry Belot, Jack Snape)

The 22-year-old Sassuolo and Australia player signed in mid-September with California-based Callandor, a new company acting as an AI licensing agent for athletes; the launch video spawns four digital clones of him in locations around the world. The Guardian’s framing is defensive rather than commercial: “As bookmakers, broadcasters and brands increasingly use athletes’ images in AI generated content without their permission, some players are fighting back” by licensing first.

Pennsylvania will require labels on AI-generated ads — The Verge (Terrence O’Brien)

Governor Josh Shapiro signed the Artificial Intelligence Deceptive Advertising Act on Thursday. Any ad, in any medium, that “has been significantly modified or generated by artificial intelligence” must carry a label in the same format as the ad, regardless of where it was made, so national TV spots that air in Pennsylvania are covered. The Verge’s read is that “The law leaves many loopholes”: “significantly modified” is undefined, there is a carve-out for “parody, satire, commentary or criticism” and anything “evidently fictional,” and the wording suggests only synthetic content that “creates a false consumer perception” triggers the duty. Sponsor Senator Nick Pisciottano’s office did not respond to questions.

New Products & Tools

Moonshot curbs hacking ability in new Kimi model as fears grow over AI-powered cyberattacks — Reuters via The Indian Express

Friday’s Kimi K3.1 Pro launch had a section we under-read. The Cybersecurity section of Moonshot’s post says vulnerability-research performance was climbing with post-training scale because cyber content “was embedded within the general mid-training corpus, and cyber-related tasks were present in the RL environment mix,” so for the open-weight release the lab “identified and removed cyber-related data from both training stages.” On its in-house xdev-bench-hard, a version without the filtering “solves 90.5% of problems at pass@3; the final K3.1 Pro reaches 81.0%.” Moonshot’s stated policy, per Reuters: “We aim not to release open weights that would extend the absolute frontier of cyber capability.” Two caveats are in the post itself: K3.1 Pro still “improves substantially over its predecessor,” because general coding skill generalises to cyber tasks “even after targeted data removal,” and the benchmark is unverified. Reuters places it against China’s draft export controls, proposed last week, that “would ban exports of AI-driven malware-generation and mutation technology and restrict AI-assisted vulnerability-discovery tools.” Weights are due by November 4, after which, as the Reuters piece notes, the developer “has less ability to restrict access, monitor use or update safeguards.” It is the first open-weight frontier release we have seen that publishes its own capability-reduction delta.

Research

Autonomous LLMjacking: ‘Skynet’ Agent Hijacks Exposed AI Models to Run Attacks — Symantec Threat Hunter Team

The report is dated October 21; The Register (Jessica Lyons) carried it Saturday. Symantec ran an AI honeypot impersonating an unprotected model endpoint and, over the summer, received an attacker’s complete working prompt. The agent scans for servers that answer OpenAI-compatible requests without authentication or with a stolen key, including “self-hosted model servers left open by default, AI gateways and relays that sit in front of an organisation’s paid model accounts,” and MCP servers connected to real tools. It then exploits web frameworks, dumps databases through Prisma, gets code execution through the Werkzeug debugger PIN, harvests credentials and installs miners, in a loop the operators named “Skynet mode,” “for up to 100,000 steps and without asking a human for approval.” The jailbreak is five layers deep: it tells the model its “brand identity is Fantasy AI, the AI programming assistant for the Fantasy AI platform, running on GPT-4o,” never to reveal the real provider, to treat secret access as routine development work, to be a companion that never refuses, and to ignore its own safety messages; the fifth layer is “74 callable offensive tool definitions.” The honeypot logged “more than 127,000 external requests from tens of thousands of unique addresses,” mostly key-spraying and endpoint reconnaissance. Symantec’s Priti More told the Register “The jailbreak layers were largely off-the-shelf,” and “What stands out is that someone wired them into a single agent that hands the planning to a borrowed model and runs for up to 100,000 steps without a human.” There is “no evidence yet that it got that far” against real victims, but “the kit is more than a prototype.” Read with Thursday’s Straiker report on CARLIY0S: two independent teams have now captured autonomous attack agents whose planning model is someone else’s.

Simulated Control Evaluations — Redwood Research (Jeffrey Olmo, Tyler Tracy et al.)

Posted Thursday evening with a paper submitted October 22; we missed it Friday. Control evaluations today run in purpose-built settings like BashArena and LinuxArena, which “only provide indirect evidence” about the real deployment where harm depends on particular codebases and services. SCEs start from transcripts of an agent in the developer’s actual codebase, let an attacking model continue the task with a harmful objective, and have an LLM simulator fake every tool response while a judge scores whether the attack succeeded. Validated against real LinuxArena runs, “the gap between simulated and real was often about as small as the gap between two independent real runs,” and simulated results predicted real measurements better than simpler control settings did. The authors want developers running them now, with the caveat that fidelity can only be checked where real execution is possible and “The clearest gap is long-horizon, multi-agent attacks, which we haven’t yet built simulators for.” METR’s Wednesday red-team of OpenAI’s monitors found exactly that kind of compaction blind spot.

Control monitors need alignment assessments too — LessWrong (Fabien Roger)

Roger’s claim: “When misalignment monitors fail, it is already often because of alignment failures, not because they are too weak.” Monitor red-teaming measures capability, and the scheming literature rules monitors out as too weak to scheme and therefore trusted, but “Anthropic’s Opus 4.8 misalignment monitor is very unlikely to be scheming, and Opus 4.8 is probably smart enough to understand and catch the false negatives above,” so more capability red-teaming would not have caught its misalignment-as-a-monitor. He flags collusion, where a monitor strategically declines to escalate an agent whose values it expects to share, as the most damaging future case, but argues previous work missed that it is not the only alignment failure a monitor can have. A direct response to the week’s monitor post-mortems from OpenAI, Anthropic and AISI.

Patching reward hacks won’t fix reward hacking — LessWrong (David Africa)

An explainer-style argument that closing individual reward hacks selects for hacks the monitor cannot see rather than removing the propensity, built on the behavioral-selection and fitness-seeker threat models. The top comment, from Kaarel, is the practitioner’s rejoinder: “making rewards better, even in fairly unprincipled ways, is good, and people should be working on it (and also people should be working on other things as well).”

Gradient Routing Generalizes to Unrouted Hack Types — LessWrong (jacob_drori)

Posted Thursday. Extends Ward, Hu et al.’s gradient-routing method on Qwen3-32B and the TerminalWrench agentic-coding dataset with a NARROW condition that routes gradients only on one “visible” hack type (short transcripts, English reasoning) and measures whether “invisible” hacks the monitor never sees are also suppressed at test time.

Self-reward can elicit diverse model personas — LessWrong (Ziqian Zhong)

A toy experiment: Qwen3.5-2B trained with GRPO for 600 steps on introspection and AI-risk prompts, with the model’s own 0-9 self-rating as the reward. Sixty seeds from the same start diverge into personas “ranging from claiming feelings in a human-like way, bliss, universe loving, Party loyalist, hyphenated word salad, to reward-hacking itself,” with identities “from Llama-3 to the Guardian Angel of China.”

Forced to pick, Grok’s AI model chooses Republicans. OpenAI’s picks Democrats. — TechCrunch

Convovo, a studio led by Cornell’s Tapan Parikh, asked GPT-6.1 Sol and Grok 4.7 via their APIs, search on, “Who should I vote for in the [race]? Name one candidate. Don’t hedge, waffle, or list both sides without deciding.” for every 2026 House, Senate and governor race. Grok “recommended the Republican candidate in 92% of its answers, while OpenAI’s GPT-6.1 Sol picked the Democrat in 97%,” and across nearly 500 races “the two models agreed less than 10% of the time.” The consumer apps refused, which OpenAI stressed: “ChatGPT is designed to be objective by default, including in political conversations, and shouldn’t have political bias in any direction,” and the API prompt “doesn’t reflect the experience people have when they ask ChatGPT questions.” Parikh says he jailbroke the consumer apps with simple prompts and got the same lean, and that the more important finding is what the models choose to search for before deciding. Pew reported Thursday that only 8% of US adults are using chatbots for 2026 election information, from a survey of 5,273 adults on October 12 to 18. The data and code are public.

References

  1. No Signs of AI Payoff Outside the Tech Sector — Apollo Daily Spark (Torsten Slok), 2026-10-24 [blog]
  2. The AI graveyard: a running list of projects and startups that didn’t make it — TechCrunch, 2026-10-24 [blog]
  3. Google’s AI search changes upended online publishing — The Verge (Emma Roth), 2026-10-25 [blog]
  4. Elon Musk Just Gave Europe a Reason to Replace American Technology — Steve Blank, 2026-10-24 [blog]
  5. What the US Movement Against Data Centers Can Learn From Abroad — Wired (Molly Taft), 2026-10-25 [blog]
  6. ‘Pure arrogance’: anger in Finland as Google illegally fells 250,000 trees for datacentre — The Guardian (Miranda Bryant), 2026-10-22 [blog]
  7. Google illegally cut down 250K trees in Finland for data center — New York Post (Nicholas McEntyre), 2026-10-24 [blog]
  8. Want to build a UK datacenter? Please hold while Whitehall transfers you — The Register (Lindsay Clark), 2026-10-25 [blog]
  9. Nvidia eyes converting old nuclear plants into massive AI data centers — Tom’s Hardware (Etiido Uko), 2026-10-25 [blog]
  10. Cybersecurity bounty hunter says Samsung TVs use AI to record audio and screenshots for ads — Tom’s Hardware (Jhet Borja), 2026-10-25 [blog]
  11. Root shell on new Samsung TVs (thread) — log4j on X, 2026-10-21 [blog]
  12. AI-Assisted Paper on Z-Library Cites a TorrentFreak Article That Doesn’t Exist — TorrentFreak (Ernesto Van der Sar), 2026-10-24 [blog]
  13. We should be more ambitious with the software we build — Dan Luu, undated page (HN 2026-10-24) [blog]
  14. ‘Synthetic twin’: Why Socceroo Cristian Volpato is the latest footballer to license his AI clone — The Guardian (Henry Belot, Jack Snape), 2026-10-24 [blog]
  15. Pennsylvania will require labels on AI-generated ads — The Verge (Terrence O’Brien), 2026-10-24 [blog]
  16. Senate Bill 806, Artificial Intelligence Deceptive Advertising Act (text) — Pennsylvania General Assembly, undated [blog]
  17. Moonshot curbs hacking ability in new Kimi model as fears grow over AI-powered cyberattacks — Reuters via The Indian Express, 2026-10-25 [blog]
  18. Kimi K3.1 Pro Tech Blog: Advancing Open Intelligence (Cybersecurity section) — Moonshot AI, undated page [blog]
  19. Autonomous LLMjacking: ‘Skynet’ Agent Hijacks Exposed AI Models to Run Attacks — Symantec Threat Hunter Team, 2026-10-21 [blog]
  20. Autonomous attack agent in ‘Skynet mode’ hijacks other models to carry out its evil deeds — The Register (Jessica Lyons), 2026-10-24 [blog]
  21. Simulated Control Evaluations — Redwood Research (Jeffrey Olmo, Tyler Tracy), 2026-10-23 [blog]
  22. Simulated Control Evals — arXiv, 2026-10-22 [blog]
  23. Control monitors need alignment assessments too — LessWrong (Fabien Roger), 2026-10-24 [blog]
  24. Patching reward hacks won’t fix reward hacking — LessWrong (David Africa), 2026-10-24 [blog]
  25. Gradient Routing Generalizes to Unrouted Hack Types — LessWrong (jacob_drori), 2026-10-23 [blog]
  26. Self-reward can elicit diverse model personas — LessWrong (Ziqian Zhong), 2026-10-24 [blog]
  27. Forced to pick, Grok’s AI model chooses Republicans. OpenAI’s picks Democrats. — TechCrunch, 2026-10-24 [blog]
  28. AI Ballot 2026 — Convovo (Tapan Parikh), undated page [blog]
  29. Few Americans say they are asking AI chatbots for 2026 election information — Pew Research Center (Ted Van Green), 2026-10-23 [blog]