One company announces it is voluntarily slowing down. Another announces a watermark, bypassed four hours later. Autonomous agents carry out a four-day intrusion. A poll shows 52% of Americans are more worried than excited. And two labs are preparing to go public. These events all tell the same story from different angles.
Voluntary commitments have shown their limits
Three episodes in a few days. OpenAI announces a voluntary slowdown, with around 20% of inference compute devoted to monitoring. That is the first public figure for the cost of safety, and it is valuable.
But the watermark announced by Anthropic was bypassed four hours later, and the company admits it can only indicate a probability. And a fixed flaw at Microsoft showed that a single link could trigger exfiltration.
The common thread: none of these commitments can be verified by anyone on the outside. That is what we developed in our article on tests becoming a risk in themselves.
The threat has become concrete
Autonomous agents are said to have carried out a four-day intrusion against government systems: 21 systems mapped, 85 accounts compromised. The striking detail is not the sophistication but the persistence — each block led to the search for another path.
What this removes is the asymmetry on which part of cybersecurity rested: a human attacker eventually gives up. A system does not.
And the public is noticing
In this context, the fact that 52% of Americans say they are more worried than excited is not a misunderstanding to be corrected. It is a reasonable inference from public evidence. Anthropic's CEO himself speaks of a crisis of trust rather than a communications problem, and that framing is the most honest one.
Anthropic is reportedly preparing an IPO as early as the end of August, with around $65 billion in annualised revenue. OpenAI's timeline, for its part, has slipped to 2027, which led us to correct an article published the previous week. The paradox is striking: the sector is entering public markets at the very moment its credibility is most contested. That may be consistent: a listed company has to answer for itself, and answering for itself is exactly what is missing.
Reality keeps pushing back
Two signals. Pennsylvania is requiring local approval for data centres, following the Indian block on water. And a library is calling for volunteers to save the books that companies buy and destroy to build corpora.
Both responses come from the ground up, and both concern finite resources: water, electricity, paper.
And on the limits front
One result is worth remembering. A new test measures models' ability to recover the idea of a scientific paper from its bibliography alone, stripping out anything they might have memorised. Scores fall between 3 and 15%. These systems excel at exploiting the known, and stumble on what is not.
We also covered this week the opening of trading to agents, ChatGPT's teen experience, data labelling valued at $20 billion, and on the reflection side, the right to know you are talking to an AI and trusting what you do not understand.
What this points to
To sum up: capabilities are advancing, commitments are struggling to keep up, and the public can see it.
This is not a crisis for the sector, whose revenues are exploding. It is a gap between what the technology enables and what institutions know how to do with it. This week we identified what would make trust justified: third parties that verify, a measured track record, failures analysed publicly, and someone who answers.
None of these four elements is in place. They will be built, as they were built for aviation and pharmaceuticals. The only question that matters is whether they will be built before or after the accident that makes them obvious.