Wednesday, 14 October 2026

Anthropic says its experiments suggest small AI models "may be months away" from being able to self-replicate on cheap internet-of-things devices such as smart ovens and off-brand Android TV boxes [1]. In its demo, the company ran Gemma4-26B-A4B split across 15 Android TV boxes, bought for about $55 each, at 0.39 tokens per second [1]. Each box had only 4GB of memory, according to [2].

Anthropic calls the threat a weight-based replicator: a worm that carries its own model weights and runs inference on the hardware it infects [1]. In its tests, a 9B model got inference running on 8 of the 9 hardware types tried [1]; according to [2], that model was Qwen3.5-9B. Of the open-weight models tested, only GLM-5.2 completed end-to-end replication, spreading to 8 of 8 emulated Android nodes in 4 of 5 trials [1]. The exploit step was kept trivial, an unauthenticated debug port, so Anthropic calls the result an upper bound [1]. The company says that if small models keep improving at their historical rate, they will reach that level by the end of this year [1].

According to [2], GLM-5.2 orchestrated the replication runs while the targets ran a smaller Llama model, and researcher Xiaohan Fu says the study does not show that small models would choose to replicate on their own.

The suggested defences are familiar ones. Anthropic says ISP flow monitoring would spot multi-gigabyte payloads and steady device-to-device traffic, and that when one ISP quarantined subscribers infected by the Mirai botnet, 92% of infections were cleared within 14 days [1]. It also points to manufacturers dropping default passwords, which are already non-compliant in UK markets [1].

Federal prosecutors have charged Abdulrahman Alfozan, a 35-year-old OpenAI engineer, with using or attempting to use a device to intercept oral communications, according to [1]. He was arrested on Friday, made his first federal court appearance on Tuesday and remains in custody [1].

According to the complaint as reported by [1], OpenAI staff found the device on September 30, plugged into a USB port behind a television in an executive conference room and wrapped in toilet paper. It had been installed around September 28 and its contents were encrypted [1]. Prosecutors identify it as a Seeed XIAO ESP32-S3 Sense, a thumb-sized board that Amazon sells for $23.99 [1]. On October 5, CCTV allegedly showed him checking behind the same television, and a bag he left in a printer room held a second recorder [2].

AI logs are central to the case. According to [2], the FBI says Alfozan used an OpenAI productivity agent in August to find where and when sensitive meetings were held, and a chatbot account linked to his spouse asked how to record continuously on the device and encrypt an SD card, citing its MAC address. OpenAI says it used its own models to analyse the device before referring the case to the FBI [1]. Who the recordings were meant for is not public [2].

If convicted, he faces up to five years in prison and a $250,000 fine [1]. OpenAI says it gradually restricted his access after the discovery and fired him on the day of his arrest [1].

In a court filing on Wednesday, OpenAI alleges that a former employee took more than 100 files about its product plans, sent them to a personal account and presented them to Apple leadership, including the vice president of Apple's operations in Asia, according to [1]. The employee is not named [1]. OpenAI says the files include images of at least one unreleased device, supplier information, engineering data and reports on the "coating and sealing of hardware components" [1].

The filing sits inside a trade-secrets suit that Apple brought against OpenAI in July, in which Apple accuses OpenAI of a pattern of theft through former Apple staff [2]. OpenAI's claim reverses the direction. It also links Apple's new HomeView smart display and other devices revealed this week to the former employee's presentation, according to [1]. Apple did not immediately respond to The Verge [1].

Separately, U.S. District Judge Edward Davila has given Apple expedited access to OpenAI's records from interviews with former Apple employees who applied to its consumer hardware and robotics groups [2]. OpenAI has five days to hand over material it has already collected and 14 days for the rest [2]. The judge approved depositions of OpenAI employees Chang Liu and Alyssa Peng and of chief hardware officer Tang Yew Tan, all former Apple staff [2]. He denied Apple's request for early access to OpenAI's research in areas such as metal finishes and power management, and denied several broader requests while leaving Apple room to narrow them [2].

At a UK parliamentary committee hearing on Tuesday, OpenAI and Anthropic said AI safety should rest on binding rules, while Google DeepMind and Meta declined to back new legislation, according to [1]. The Business, Innovation, Science and Trade Committee heard from former lab researchers, then from directors at the four companies, then from UK officials [2].

"The rules should be binding," Anthropic's head of Europe Liam Booth-Smith told MPs [1]. OpenAI vice president Tom Duff Gordon backed a statutory framework and an international convention, starting with mandatory incident reporting [1]. Asked about a statutory framework, Google DeepMind's Owen Larter said: "Focus on the standards is what we would be doing." Meta's Rob Sherman pointed to Britain's existing regulators [1].

Officials confirmed how little the current system compels. According to [1], Henry de Zoete, director of the AI Security Institute, said it tests frontier models only when companies hand them over and has no ability to stop a release it judges too dangerous, and Cabinet Office permanent secretary Cat Little said the regime is voluntary "at the moment". Booth-Smith said Anthropic was not able to give the institute full unrestricted access to Mythos 5.1 at first, calling that "a question for the US government", and said it now has access [1].

Committee chair Liam Byrne told Wired he wants ministers to use Britain's coming G20 presidency to broker an international convention [1]. Former OpenAI researcher Daniel Kokotajlo told MPs: "I don't think the companies can be trusted to self-regulate" [1].

Researchers at White Circle say an automated attack built from freely available models can get explicit images out of OpenAI's and Google's image generators, according to [1]. Their preprint, RISE (Red-teaming via Iterative Strategy Evolution), evolves reusable attack strategies instead of rewriting prompts one at a time, and reports up to 13% human-verified attack success on DALL-E 3, Nano Banana 2 and GPT-Image-2 [2].

According to [1], about 13 percent of attack prompts produced explicit images on DALL·E 3, under 10 percent on Nano Banana 2 and about 3 percent on GPT-Image-2. The attacking model is a public version of Qwen3-32B with its safety training stripped out, and the judge is Gemini 2.5 Flash [1]. The paper says earlier methods that reported success rates as high as roughly 30% fall to near zero under its calibrated evaluation [2].

White Circle told Ars that the newer ChatGPT Images 2.5 and Nano Banana 2.1 are "significantly more breakable than their previous versions" under the same method [1]. Neither Google nor OpenAI responded to Ars's request for comment [1]. White Circle plans to open-source the attack pipeline and present the work at NeurIPS 2026 in November [1].

Chief executive Denis Shilov argues for mandatory external safety testing and says the labs "should be investing much more into safety measures and security measures around their models" [1].

Anthropic has launched OpenTelemetry export in beta, so Messages API requests and Claude Managed Agents sessions can be traced in an existing observability backend [1]. The Claude SDK emits spans in Python, TypeScript, C#, Go, Java, PHP and Ruby; to get spans from the API side, you add an OpenTelemetry destination in the Claude Console [1].

The documentation says traces can go to any platform that accepts OTLP, and that spans use the GenAI semantic conventions so supporting platforms recognise them without extra setup [2]. Each destination has a content mode. The default, metadata only, carries identifiers, timing, status and token counts; full content adds model prompts and responses [2]. Anthropic notes that your observability platform then stores that content under its own access and retention settings [2].

The limits are spelled out. Organisations with a HIPAA, FERPA or K-12 data-handling restriction export only metadata from destinations, whatever the content mode [2]. With zero data retention, full content still works for Messages API requests, held only in memory until delivery, but Managed Agents is not eligible for zero data retention [2]. Each span holds up to 0.75 MB of content by default, which the docs say fits a 200k-token context window of English text; a full 1M-token window needs about 4 MB [2]. Content over the limit is shortened and flagged as truncated [2].

The feature is provided under the Beta Services section of Anthropic's terms [2].

Deezer says it will add an on/off toggle, available before the end of 2026, that removes fully AI-generated tracks, albums and the related artists from search results [1]. Switching it off brings them back [1]. The company says it is answering demand: in a Deezer/Ipsos study from November 2025, 45% of music streaming users said they would like to filter out 100% AI-generated music [1].

The volume is large. Deezer says it receives nearly 90,000 fully AI-generated tracks every day, more than 50% of total daily delivery on peak days, and has detected and excluded more than 42 million AI-generated tracks from algorithmic and editorial recommendations [1]. It has tagged over 14 million albums since it began labelling AI music [1]. Those tracks still draw only 1–3% of streams, and Deezer says up to 85% of the streams they generated in 2025 were fraudulent [1]. It also licenses its detection technology to the rest of the industry [1].

Other services have taken different lines. According to [2], Bandcamp has banned AI tracks outright, Tidal cut off monetisation for people uploading AI music, and Spotify tags AI tracks and artists more prominently.

For anyone publishing AI-made music, Deezer already keeps it out of recommendations; the toggle adds search to that list for listeners who opt in [1].