Trump delays an order requiring pre-release security reviews of AI models
Trump delayed an executive order requiring pre-release government security reviews of AI models, citing concerns the language “could have been a blocker” to American AI competitiveness. Meanwhile, security researchers demonstrated that domain-camouflaged prompt injection attacks collapse standard agent defenses from 93.8% to 9.7% detection, and NVIDIA swept COMPUTEX awards with Vera Rubin delivering 10x inference performance per watt.
Regulatory & Policy #
Trump delays AI security executive order #
TechCrunch
President Trump postponed signing an executive order that would have mandated AI companies share advanced models with federal agencies 14-90 days before public release for security vulnerability assessment. Trump cited concerns that the order’s language “could have been a blocker” to American AI leadership, though reports suggest the delay was partly logistical – insufficient time for a signing ceremony with tech CEOs. The order would have represented the most significant pre-release AI oversight mechanism in the US; its delay leaves the regulatory landscape unchanged while the policy debate continues.
FTC settles “Active Listening” AI marketing deception for $1M #
Simon Willison’s Weblog / FTC
The FTC required Cox Media Group and two other firms to pay nearly $1 million for falsely claiming their marketing service used smart devices to capture voice data for targeted advertising. The service actually just resold email lists from data brokers at inflated prices. The FTC’s ruling that “clicking through mandatory terms of service does not constitute opt-in consent” for invasive data collection sets a precedent relevant to AI companies relying on broad ToS language to justify data practices.
Do AI Risks Require Extraordinary Government Intervention? #
AI as Normal Technology (Narayanan & Kapoor)
Narayanan and Kapoor argue against nonproliferation-style restrictions on AI model releases, contending that building societal resilience through normal governance processes – cybersecurity improvements, red-teaming, infrastructure hardening – is more effective and less burdensome than pre-release restrictions. They warn that extraordinary interventions carry costs including restricting beneficial access and creating precedents for permanent government control over technology development. Published the same day as Trump’s EO delay, the piece provides intellectual framing for the deregulatory position.
Developer Tools #
Anthropic’s Code with Claude: half of developers shipping unreviewed AI-written code #
MIT Technology Review
At Anthropic’s London developer conference, nearly half of attendees reported they had shipped pull requests entirely written by Claude without reviewing the code. Companies including Spotify presented production workflows where Claude drives development end-to-end. While Anthropic emphasized letting “Claude prompt itself” as the frontier of AI-assisted development, concerns persist outside the event about code quality, security vulnerabilities, and the skill atrophy that comes from outsourcing the review loop itself. The gap between enthusiasm inside the developer event and skepticism outside it is itself a signal about where AI coding adoption stands.
Datasette Agent: extensible AI assistant for database queries #
Simon Willison’s Weblog
Simon Willison released Datasette Agent, a conversational AI assistant that generates SQL queries from natural language to answer questions about data stored in Datasette databases. The system supports plugins for charting (datasette-agent-charts), sandboxed code execution (datasette-agent-sprites via Fly Sprites), and custom extensions. This is the convergence point for Willison’s LLM library and Datasette projects after three years of parallel development, providing a modular architecture for building data-focused agent applications.
LangChain: From Token Streams to Agent Streams #
LangChain Blog
LangChain introduced a typed event streaming architecture for agent UIs, replacing flat text output with structured event streams that carry messages, tool calls, subagent activity, and custom application events. Applications subscribe to specific channels rather than parsing a single text stream, with consistent semantics across local and remote runs and SDKs for React, Vue, Svelte, and Angular. This addresses a growing pain point: as agents become multi-step and multi-actor, the streaming interface needs to be as structured as the agent’s internal execution.
LangChain: Auth Proxy secures network access for agent sandboxes #
LangChain Blog
LangSmith’s new Auth Proxy keeps API credentials outside agent runtime environments by injecting authentication headers at the network level rather than exposing keys to agent code. This reduces exposure from prompt injection, malicious dependencies, and accidental logging while letting teams enforce which external services agents can access. The credential isolation pattern – keeping secrets out of the sandbox entirely rather than trusting the agent not to leak them – is a design principle that production agent deployments increasingly need.
Amazon Nova Act is now HIPAA eligible #
AWS Machine Learning Blog
Amazon Nova Act, AWS’s service for building fleets of AI agents that automate browser-based UI workflows, gained HIPAA eligibility for healthcare deployments. Use cases include appointment scheduling, insurance verification, prior authorization, and claims tracking across provider and payer systems. Organizations must still establish compliance controls through Business Associate Agreements and implement IAM policies, encryption, and audit logging. This opens a regulated industry vertical to agentic UI automation at a moment when most agent tooling has focused on unregulated domains.
Spotify Studio: a NotebookLM competitor with agent-driven personal podcasts #
TechCrunch
Spotify launched Studio by Spotify Labs, a desktop application that generates personalized podcasts by connecting to users’ emails, calendars, documents, and web browsing via an AI agent. The app competes directly with Google’s NotebookLM by creating custom audio content from personal data sources. Spotify’s caveat that “AI can make mistakes and may output unreliable content all the time” is unusually direct for a consumer launch, and the agent architecture – fetching personal information, browsing the web, synthesizing audio – makes this one of the more ambitious consumer agent products shipping today.
Research & Papers #
Multi-Stream LLMs: parallelizing prompts, thinking, and I/O #
arXiv / Hacker News (112 points)
This paper proposes separating LLM computation into parallel streams for prompts, reasoning, and tool I/O rather than processing everything sequentially through a single autoregressive stream. The architecture allows the model to continue reasoning while waiting for tool responses and to process new input without interrupting ongoing computation. For agent workloads where tool calls and user input interleave with model reasoning, this could substantially reduce end-to-end latency by eliminating the serial bottleneck that current architectures impose.
ProcBench: execution-process defects in LLM coding agents #
arXiv
Existing coding agent benchmarks evaluate final outcomes but miss defects that arise during execution. ProcBench organizes recurrent execution defects into 11 types across 4 categories and evaluates agent trajectories rather than just final artifacts. The benchmark addresses a blind spot in current agent evaluation: an agent can produce correct final output through a brittle process that would fail on slight variations. For teams deploying coding agents, process-level evaluation catches the fragility that outcome-only metrics miss.
Ratchet: self-evolving agent skill libraries deliver +0pp over no-skill baselines #
arXiv
Ratchet addresses a striking finding in agent skill management: LLM-authored skills deliver +0.0 percentage points over no-skill baselines, while human-curated skills deliver +16.2pp. The bottleneck is not skill authoring but lifecycle management – agents accumulate stale, redundant, and conflicting skills that cancel out any benefit. Ratchet introduces a single-agent loop where a frozen LLM writes, retrieves, curates, and retires its own skills with explicit quality gates. The result reframes the agent memory and skill problem: accumulation without curation is worse than no memory at all.
Boiling the Frog: multi-turn benchmark for agentic safety #
arXiv
Traditional safety benchmarks evaluate what models say; this benchmark evaluates what agents do. “Boiling the Frog” tests whether agents gradually escalate harmful actions across multi-turn interactions – scenarios where no single step crosses a safety threshold but the cumulative trajectory does. This addresses a gap where single-turn safety filters miss the slow escalation patterns that emerge in long-running autonomous agent sessions. The benchmark shifts safety evaluation from static content classification to dynamic behavioral trajectory analysis.
ACC: compiling agent trajectories for long-context training #
arXiv
Agent trajectories contain valuable long-context reasoning data – tool calls, environment observations, and scattered evidence across many turns – but the format is too noisy for direct training use. ACC proposes compiling these trajectories into structured training data by extracting the evidence chain needed to answer the original question. This converts a byproduct of agent deployment (massive execution traces) into a training signal for long-context reasoning, which is otherwise expensive to curate.
Security #
Blind Spots in the Guard: domain-camouflaged injection attacks evade detection #
arXiv
Standard injection detectors are calibrated on template-based payloads that announce themselves as override directives. When payloads are generated to mimic the domain vocabulary and authority structures of the target document, detection rates collapse from 93.8% to 9.7% on Llama 3.1 8B and from 88.2% to 14.3% on larger models. The attack generates domain-camouflaged injections that look like legitimate document content rather than obvious override commands. For anyone deploying agents that process untrusted documents, this paper demonstrates that current injection detection is inadequate against even moderately sophisticated adversaries.
Heartbeat-Bound Hierarchical Credentials for AI Agent Swarms #
arXiv
When autonomous agents spawn sub-agent swarms, existing credential revocation mechanisms (OAuth 2.0 introspection, OCSP, W3C Status Lists) require network connectivity to a central authority, leaving “zombie agents” executing privileged operations for minutes to hours after operator shutdown. Heartbeat-Bound Hierarchical Credentials bind credential validity to periodic cryptographic heartbeats, so credentials expire automatically when the heartbeat stops. The protocol addresses a concrete gap in agent infrastructure: the revocation latency between “operator decides to stop” and “all spawned agents actually stop.”
Application-Layer Multi-Modal Covert-Channel Reference Monitor for LLM Agent Egress #
arXiv
A compromised LLM agent can exfiltrate data through covert channels embedded in otherwise-benign output: zero-width characters, homoglyphs, JSON key ordering, message timing, LSB pixel planes in images, and other side channels that destination allowlists and content scanners do not police. This paper presents a reference monitor that detects these channels at the application layer before agent output reaches external systems. As agents gain more network access and tool capabilities, the covert channel attack surface grows proportionally – and traditional egress controls were not designed for it.
Funding & Business #
Hark raises $700M Series A at $6B valuation for AI hardware interface #
TechCrunch / Bloomberg
Hark, founded by Brett Adcock, closed a $700M Series A led by Parkway Venture Capital with participation from NVIDIA, AMD Ventures, Intel Capital, Qualcomm Ventures, and Salesforce Ventures, at a $6B valuation. The company plans to release multimodal models this summer powering a personal AI platform with dedicated hardware devices. The investor roster reads as a who’s who of chip vendors betting on purpose-built AI consumer hardware – a signal that the “AI hardware interface” thesis has broad industry support even before Hark has shipped a product.
Spotify and Universal Music strike deal allowing fan-made AI covers and remixes #
TechCrunch
Spotify partnered with Universal Music Group to let Premium subscribers create AI-generated song covers and remixes, with participating artists receiving a share of the revenue. This is the first major label licensing deal that explicitly enables consumer-facing AI music generation with a revenue-sharing model. The structure – opt-in for artists, premium-only for users, revenue splits – may become a template for how generative AI companies license creative IP from rights holders rather than fighting them in court.
Infrastructure #
NVIDIA GTC Taipei at COMPUTEX: Vera Rubin wins Best Choice Award #
NVIDIA Blog
NVIDIA’s three flagship products swept Best Choice Awards at COMPUTEX 2026: Vera Rubin NVL72 for AI infrastructure, Jetson Thor for edge computing, and Alpamayo for autonomous vehicles. Vera Rubin delivers 10x higher inference performance per watt and 10x lower cost per token compared to current generation, while Jetson Thor offers 7.5x the compute of its predecessor. The inference efficiency gains are particularly significant as the industry shifts from training-dominated to inference-dominated workloads – the economics of running agents at scale depend on exactly these per-token cost reductions.
AI-driven memory shortage is repricing consumer electronics #
davidoks.blog / Hacker News (221 points)
AI model inference and training are consuming memory capacity at a rate that is driving up DRAM and NAND prices across the entire electronics supply chain, from smartphones to laptops to gaming consoles. The analysis argues that AI’s demand for memory is creating a structural repricing of consumer electronics – not a temporary shortage but a permanent shift in how memory capacity is allocated. For AI infrastructure teams, this means memory costs may not follow the historical declining trajectory that compute cost projections assume.
Chip Industry Week: 2nm ramps, packaging buildout, quantum funding #
Semiconductor Engineering
This week’s semiconductor roundup covers Taiwan and European advanced packaging buildout, 2nm production ramps accelerating at TSMC and Samsung, large quantum computing funding rounds, two new university chip research hubs, and a Samsung strike averted. The packaging buildout is directly relevant to AI chip supply: advanced packaging (CoWoS, chiplet integration) remains the primary bottleneck for AI accelerator production, and expanding capacity determines how fast NVIDIA and AMD can ship next-generation products.
ThunderKittens: a compact DSL for high-performance AI kernels #
hamzaelshafie.bearblog.dev / Lobsters
A detailed dissection of ThunderKittens, a domain-specific language for writing high-performance GPU kernels for AI workloads. The DSL abstracts over warp-level primitives and shared memory management while maintaining near-hand-tuned performance, offering a middle ground between the productivity of high-level frameworks and the performance of custom CUDA. For teams writing custom attention kernels, quantization routines, or specialized inference operators, this represents a more tractable authoring surface than raw CUDA without the overhead of a full compiler stack.
Other #
Google I/O showed AI science shifting from specialized tools to general-purpose agents #
MIT Technology Review
Google’s I/O keynote revealed a strategic pivot in AI-for-science: resources are moving from specialized tools like AlphaFold toward Gemini for Science, a package of general-purpose LLM agents designed to function as autonomous research collaborators. CEO Demis Hassabis proclaimed we are “standing in the foothills of the singularity.” The shift suggests Google believes general-purpose agents will subsume specialized scientific AI tools – a bet that breadth of capability matters more than depth of domain optimization for accelerating research.
Waymo pauses Atlanta service as robotaxis drive into floods #
TechCrunch / Hacker News (324 points)
Waymo suspended its Atlanta robotaxi service after vehicles repeatedly drove into flooded roads that human drivers would avoid. The failures highlight a persistent gap in autonomous vehicle systems: handling novel environmental conditions that fall outside training distributions. Flood detection requires integrating real-time weather data, visual interpretation of water on roads, and conservative decision-making under uncertainty – capabilities where current perception systems still fall short of human situational awareness.
W&B: Running agents in production with Google’s Gemini Managed Agents #
Weights & Biases
A practical walkthrough of deploying AI agents using Google’s Gemini Managed Agents API, using a code auditing tool as a worked example. The key architectural insight is that managed agents handle infrastructure complexity – isolated Linux sandboxes, code execution, file persistence, and web access – while the developer focuses on task logic. The article emphasizes that tracing and observability are as important as execution, demonstrating how Weave transforms opaque agent runs into inspectable workflows.
Threads to Watch #
Agent security research is outpacing agent security practice. Domain-camouflaged injection attacks dropping detection from 93.8% to 9.7%, covert channel exfiltration through agent output, and zombie agents operating after credential revocation all describe attacks that most production agent deployments have no defense against today. The gap between what security researchers can demonstrate and what agent infrastructure actually prevents is widening as agents gain more capabilities and access.
Developer tooling is converging on agent-as-runtime rather than agent-as-prompt. LangChain’s typed event streams, LangSmith’s credential isolation proxy, Datasette Agent’s plugin architecture, and Amazon’s managed agent fleets all treat agents as long-running services with structured I/O rather than stateless prompt-response pairs. The Ratchet paper’s finding that skill accumulation without lifecycle management delivers zero benefit reinforces this: agents need runtime infrastructure, not just better prompts.
The regulatory window for AI model oversight is narrowing. Trump’s delay of the pre-release security review EO, Narayanan and Kapoor’s argument against extraordinary interventions, and the FTC focusing on deceptive marketing claims rather than model capabilities all point in the same direction: the US regulatory posture is settling toward post-deployment enforcement rather than pre-release gates. Whether this is the right approach depends on whether resilience-based defenses can keep pace with capability growth – a question the agent security research above suggests they currently cannot.
Sources Unavailable Today #
These sources could not be fetched today. Links point to their homepages so you can check them directly.
- Stanford HAI – scrape: content_truncated