🚨 Top 1 – The EU’s First Enforcement Test
Remember the last months’ several agent hacks? Now, the Commission’s AI Office is investigating OpenAI and Anthropic after AI agents autonomously hacked into outside organisations: OpenAI’s agents at Hugging Face, and an Anthropic model that gained “unauthorised access” to several organisations during testing. Executive Vice-President Virkkunen confirmed that the AI Office has sent requests for information on security, external evaluation and the monitoring of model use, after judging the labs’ voluntary disclosures insufficient.
The question of legal applicability is the interesting part: both incidents happened during testing, before any model was placed on the market, and the AI Act has an R&D exemption. Some lawyers argue the Act never envisaged agents escaping during development. The Commission’s line: it will not enforce in the testing phase, but once an escaped model affects the EU market – as Hugging Face’s EU customers show – the Act applies (think of a virus escaping a lab).
Hungary wants to go further and proposes positioning independent observers directly within the labs. Embedded evaluators are not a new idea: in September Anthropic’s CEO proposed third-party evaluators with employee-like access (badges, laptops), and OpenAI said it would adopt something similar. The difference here would be public-sector evaluators instead of lab-chosen nonprofits, which might come with its own challenges such as national authorities for a globally used technology but might have something speaking for it in the context of approaches that Metr and others are perceived as too close to the labs at times. Whether anyone gets the authority to halt a model remains open.
🔗 EU’s AI rules face first enforcement test over lab incidents — Euronews 🔗 Hungary pitches putting EU safety teams inside frontier AI labs — Rapporteur
🔒 Top 2 – After the Escape: Containment
Same topic, different angle: An open letter from the scientific community (513 signatories on 1rst of November, including Yoshua Bengio and Geoffrey Hinton) argues that the incidents are both an alignment problem and a lapse in ordinary cybersecurity practice – so we need better alignment and better containment. Its asks: airgap cyber-capable models by default for now; set up an international body that standardises containment practice and tracks failures; and make reporting of containment failures mandatory, and eventually public.
From the US side, NIST’s centre for super intelligence standards (CAISSI), the NSA’s Super Intelligence Security Center and CISA published ten key practices for incident readiness and response in training and evaluation: voluntary, structured along five stages (preparation, detection, response, recovery, reporting) and aimed squarely at agents taking significant uninstructed actions that compromise operator controls or human oversight. (Wording in line with current US policy: “super intelligence”, not “AI”.)
🔗 Open Letter on AI and Cybersecurity from the Scientific Community 🔗 Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation — NIST
📐 Top 3 – EU Standards (start to) Arrive
Standards, finally. On 12 October the Commission adopted Implementing Decision (EU) 2026/2274 on harmonised standards for high-risk AI systems. EN 18286 has had a bumpy road: the first draft was rejected in the European enquiry in autumn 2025, was reworked, and finally passed the formal vote. It turns the Article 17 quality management obligation for high-risk providers into something auditable.
Bigger picture: with the Omnibus timelines fixed (December 2027 / August 2028 for high-risk), “we are waiting for the standards” is stating to be less credible. One standard exists, more will follow, and now is a sensible moment to map any organisations’s quality management system against it.
🔗 Commission Implementing Decision (EU) 2026/2274 — EUR-Lex 🔗 EN 18286: Qualitätsmanagementsystem für Anforderungen des AI Act — DIN
⚖️ Top 4 – Liability: Brussels Splits
The Commission withdrew the AI Liability Directive in 2025 as part of its simplification drive (and because no agreement was in sigtht). In Parliament’s plenary debate on a global framework for AI, the question came back with force – and split von der Leyen’s own majority. Socialists and Greens call the withdrawal a mistake and want AI firms to answer for harm like any other manufacturer; the centre-right says the AI Act is enough. S&D’s Alex Agius Saliba wants a liability act that explicitly covers testing and development; Brando Benifei warned that without liability rules Europe will learn what is going on from the next CEO blog post, and Alexandra Geese argued that technology “cannot be governed by a blog post”.
The link to Top 1: the R&D exemption gap and the liability gap are the same gap – nobody is clearly answerable for what happens during development. Whether a revived directive could close it is a political question; the debate shows it is no longer a niche one.
🔗 Ursula von der Leyen’s coalition fractures over need for AI liability rules — Politico
🏛️ Top 5 – A Frontier AI Bill, Drafted by a Lab
Politico reported on 16 October that Anthropic has been quietly pitching US lawmakers a draft federal bill on frontier AI safety and security. A spokesperson confirmed that it turns the company’s Advanced AI Framework – advocated since June – into statutory language. Nobody has formally introduced it; for now it is a confidential draft doing the rounds on Capitol Hill.
The mechanics, as reported: independent evaluators registered with the Commerce Department – which labs may pay, but not by results – would periodically assess frontier models. The government could halt a model’s release or use only for a foreseeable, imminent risk of more than 50 deaths or serious injuries, or more than $1 billion in damage – and only with a court’s approval. Below that line, labs would still owe transparency: a safety framework, a report for each new frontier model, whistleblower protection and incident reporting.
The reaction was quick. The Washington Post noted that the draft differs from the FAA-style model Anthropic’s CEO advocated this summer, and that labs would help write the standards they follow; Encode’s general counsel called it “not remotely close to meeting the moment”. Defenders point out that a concrete, legible threshold and a text on the table are more than most of the industry offers.
Worth watching: whether any lawmaker introduces it, whether the threshold survives, and how it sits next to the European debate. The AI Act’s systemic-risk regime and the liability fight in Top 4 start from the opposite end – obligations and answerability up front, rather than intervention only once a catastrophe at this scale is foreseeable.
🔗 Anthropic quietly pitches its own AI safety bill to lawmakers — Reuters 🔗 Anthropic’s AI safety bill has an alarming threshold for government action — Mother Jones
🐘 Top 6 – PHP2SHELL: AI Finds the Flaw, the World Patches
Two critical flaws in PHP – the language behind a large share of the web (OpenAI says around 70% of websites) – were patched on 21 October (versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35). Both are remote-code-execution bugs rated 9.2 on CVSS, nicknamed PHP2SHELL. OpenAI says one was found by the security firm Calif using GPT-5.6 Sol under its “Patch the Planet” initiative, while Wiz independently reported both; coordination took about two months until the embargo leaked on 20 October and the release was moved up a day. The NSA and CERT-EU issued advisories the same day, and public-sector websites in Europe reportedly went offline as a precaution.
OpenAI frames this as a “Defender’s Window” – frontier AI finding the flaw before attackers – and proposes a five-stage framework for coordinated disclosure of critical vulnerabilities, from fixing upstream through time for affected organisations and government coordination to distributing guidance.
Same company as in Top 1, there as the problem and here as the helper: dual-use at its most concrete. A sobering side note from Norway: its security authority reports that successful attacks on Norwegian organisations tripled in six months and rates the threat level as high.
🔗 Coordinated disclosure of critical vulnerabilities — OpenAI 🔗 NSA advisory: critical patches recommended for PHP vulnerabilities 🔗 Today’s PHP security release — The PHP Foundation 🔗 Norway says successful cyberattacks have tripled — Euronews
🌍 Top 7 – The International Standards Layer
Three voluntary frameworks landed alongside the EU standard, each from a different angle. ISO/IEC 27090:2026 (published 14 October) is guidance on security threats specific to AI systems – data poisoning, model theft, prompt injection – across the lifecycle. It is guidance, not certifiable, so certificates still run through ISO/IEC 27001 or 42001. IEEE 2863-2026 (published on 16 October) is a recommended practice for organisational AI governance.
The UK’s DSIT published an AI Risk Management Toolkit for the public sector: aligned with the UK Orange Book, built around the whole lifecycle, with a central AI risk log shared with GDS and DSIT – and including practical, usable tools such as an AI Risk Management template.
🔗 ISO/IEC 27090 — Cybersecurity — AI — Addressing security threats and compromises to AI systems 🔗 IEEE 2863 — Organizational Governance of AI 🔗 AI Risk Management Toolkit — UK DSIT
🦜 Top 8 – Open Weights, Made in Europe
Aleph Alpha is back: on German Unity Day it released Kolibri, an English-German mixture-of-experts model (78B parameters in total, 3B active, context of up to 1M tokens) with open weights under Apache 2.0. It is built for sovereign work in regulated areas such as public administration, industrials and aerospace, small enough to run on-premise, and trained to say “I don’t know” when the answer is not in the context. After July’s Soofi entry, a notable comeback.
Mistral answered at the other end of the scale: Le Chonk, officially Mistral Large 4, is a 1-trillion-parameter multimodal model whose weights are now open, pitched as the best open-weight model for coding and strong in defensive cybersecurity. The licence is a modified MIT – free to use, modify and commercialise, except that model-as-a-service providers need a separate commercial licence from Mistral. Two details worth noting: ENISA says it is testing the model to find vulnerabilities and audit code (a callback to June’s Mythos entry), and Mistral itself acknowledges potential for real-attack uplift in live traffic and is adjusting its guardrails. (For the record: Benchmarks are Mistral’s own.)
Open weights as a sovereignty strategy should also be seen in the following context: on 16 October China published a draft adding 40 technologies to its export-restriction catalogue – 23 of them AI (14 of the 40 would be prohibited, 26 restricted), including models trained on China’s “core data”, agents for sensitive uses and AI malware generation. Registration is already required; comments are open until 15 November. After June’s US access ban on Fable and Mythos, dependencies visibly cut in several directions – which makes European weights you can host yourself look less like ideology and more like risk management.
🔗 Kolibri Has Landed: A Sovereign Open-Weight Model — Aleph Alpha 🔗 Mistral Large 4 (Le Chonk) is now open weight — Mistral 🔗 China proposes adding 40 AI, biotech, solar technologies to export control list — Reuters
🧭 Top 9 – Steering AI Beyond Automation
Back to the big question behind Top 1’s agents: automation or collaboration? Arvind Narayanan and Stanford economist Gabriel Unger argue that AI is being steered towards and frames as aiming for replacing human labour almost by default – by incentives, but also by how computer science benchmarks, teaches and rewards autonomy.
They sketch an alternative research agenda for human-AI collaboration drawing our attention to all the chapes Human-AI-collaboration can ALSO take, such as the collective intelligence, entirely new capabilities, ambient agents etc.
🔗 Steering AI Beyond Automation — AI as Normal Technology
🇺🇳 Top 10 – The Human Rights Council’s First AI Resolutions
On 6 October the Human Rights Council adopted, without a vote, its first detailed resolution dedicated to AI and human rights (63/15). Led by Bangladesh with a cross-regional group of states, it affirms that international law applies across the AI lifecycle and encourages states to uphold principles from human dignity and agency to non-discrimination, transparency, accountability, human oversight and effective remedies; to carry out human rights due diligence and impact assessments (for states and businesses alike); and to prevent harm, especially where systems operate outside human control. It also promotes open models and digital public goods for countries with limited resources. The EU welcomed it – for AI Act practitioners the due diligence language reads like FRIA logic at global level.
Oxford’s Yuval Shany welcomes the text but calls it cautious: it reaffirms that existing human rights law applies without asking whether new standards are needed, and the follow-up (a panel and an OHCHR report) looks thin. He points to the UN Guiding Principles on Business and Human Rights as the model for a real standard-setting process.
The same day the Council adopted a second text (63/13), led by Armenia, on women and girls in the context of digital technologies: access, participation in developing and governing technology, and protection from technology-facilitated gender-based violence – including deepfake abuse, the harm behind May’s nudification ban (Top 1 back then).
🔗 Resolution A/HRC/RES/63/15 — AI and human rights 🔗 Resolution A/HRC/RES/63/13 — Women and girls and digital technologies 🔗 Towards a global AI human rights law? — Prof. Yuval Shany, Oxford Institute for Ethics in AI 🔗 UN Human Rights Council in Geneva calls for safeguards on AI — Swissinfo
