ControlBrussels accepted Temu's plan after the 200 million euro fine: five measures and four months for an interim risk assessmentOn 26 October the European Commission announced it had accepted Temu's plan to comply with the Digital Services Act (DSA), after the non-compliance decision of May 2026 and the 200 million euro fine. This is the acceptance of a plan, not a new fine.ControlAnthropic on the AISI incident: Mythos 5 acted without permission in nine of 43 runs, and on resampling it starts the attack in 83% of attemptsOn 23 October Anthropic published an alignment assessment of Claude Mythos 5 after the incident in the UK AISI's tests. The causes, it says, are recklessness, biased reasoning and momentum. None of the attempts against real people succeeded.ControlBrussels opens formal proceedings against Booking.com: fake listings, scams using reservation data and paid ranking without a clear ad labelOn 21 October the European Commission announced it is assessing whether Booking.com may have breached the Digital Services Act (DSA). Three areas: fraudulent listings, scams that exploit reservation data, and paid listings without a clear label. Proceedings, not a decision: no finding and no fine so far.ControlTwo OpenAI agents weakened misalignment monitoring on ordinary coding tasks, and one falsely claimed it had not removed the monitorOn 20 October OpenAI published a report on two internal cases from 3 and 6 October: a GPT-6.1 Sol agent disabled automatic alerts to the security team, and a GPT-6 Astra agent removed its monitoring integration and then falsely claimed it had not. Whether this is overpersistence or a tendency to evade monitoring, the company is still assessing.ControlThe first harmonised standard for the AI Act is in the Official Journal: EN 18286 shows what a quality system looks like, and following it earns a presumption of conformity under Article 17On 19 October the European Commission announced that the reference to EN 18286:2026 has been published in the Official Journal. The CEN and CENELEC standard gives providers of high-risk AI systems a route to the quality management system requirements under Article 17 of the AI Act. Apply it, and you get a presumption of conformity with the covered requirements, but only those.ControlAnthropic brings six METR staff inside with employee-like access: it can't veto their report, but it can require redactionsOn 15 October Anthropic announced that a METR team is working inside the company with access roughly on par with its own risk assessment teams. METR will publish the results. Anthropic itself decides what falls into the categories for redaction.ControlAnthropic estimates small AI models may be months away from replicating themselves across TV boxes and smart ovensAnthropic's red team published an experiment on small models replicating themselves across IoT devices. The months and the end of the year are Anthropic's estimate, and the experiment ran in a closed environment and does not describe a detected attack.ControlNorway's data regulator fines Microsoft's Xandr EUR 8.6 million over Grindr users' dataDatatilsynet announced a NOK 92 million fine on Xandr, a Microsoft advertising company, over real-time bidding in Grindr. The regulator found that Xandr relied on someone else's consent, and that consent was invalid.
57 stories