Anthropic denies seeking an open-weights ban, points policy at chips and distillation

Anthropic said it has never advocated banning open-weights models, and named chip controls, distillation enforcement and mandatory safety testing as its actual policy asks. Separately, Claude share links containing medical records, internal company documents and children’s contact details surfaced in Google search results, with Anthropic attributing the exposure to users’ own sharing choices. Microsoft shipped its first in-house cybersecurity model, and NVIDIA invested in Ilya Sutskever’s Safe Superintelligence in exchange for a research partnership on its Vera Rubin platform.

Regulatory & Policy #

Our Position on Open-Weights Models #

Anthropic / TechCrunch / Axios / CNBC

Anthropic states flatly that it “has never advocated for a ban on open-weights models” and that open-weights models without dangerous capabilities are “a public good,” then names three things it does want: no sales of advanced chips or chipmaking equipment to China plus enforcement against smuggling, targeted action against industrial-scale distillation operations, and mandatory pre-release safety testing for cyber, bio and alignment risk on all sufficiently capable models regardless of whether they are open or closed. The post lands days after NVIDIA, Microsoft, Meta and Palantir signed a coalition letter urging policymakers against “premature restrictions” on open weights — OpenAI signed it, Anthropic did not, and this is the explanation for that absence. The substantive disagreement Amodei keeps is narrower than the caricature: he disputes that publishing weights makes safety guardrails easier to build, on the grounds that released weights cannot be revoked, patched or monitored afterwards. For anyone tracking where US AI regulation is actually heading, the useful signal is that the largest lab arguing the safety case has moved its ask off model-release restrictions and onto export controls and testing mandates.

Security #

Claude Shared Chats and Artifacts Turned Up in Google Search Results #

404 Media / TechCrunch / Fortune

Searching site:claude.ai/share returned user-created share links containing medical records and clinical trial results with patient names, documents marked internal-only, names and phone numbers of school-aged children, employee reviews, work notes and code in Artifacts. A Reddit user flagged it Saturday, 404 Media reported it Monday morning, and by Monday afternoon the search method no longer returned results — though previously exposed links remain live for anyone already holding them. Anthropic’s response put the cause on user behaviour, noting that share links “are not guessable or discoverable unless people choose to share them themselves” and that it publishes no directory or sitemap to search engines; that is true and also beside the point, since the links were indexed after users posted them to public forums, which is what a share link is for. Forbes reported roughly 600 Claude conversations indexed the same way in 2025, so this is a repeat of a known failure mode rather than a novel one, and the same shape as the ChatGPT share-link indexing incident before it.

Model Releases #

MAI-Cyber-1-Flash Inside MDASH #

Microsoft AI / The Register / Help Net Security / VentureBeat

Microsoft released MAI-Cyber-1-Flash, a compact security model derived from its MAI-Thinking-1 line with roughly 5B active parameters, running inside MDASH — a multi-agent system of 100+ agents that finds, validates and remediates software vulnerabilities. Microsoft reports MDASH scoring 96% on CyberGym, a benchmark for reasoning over large codebases to locate real security flaws, against 83.8% for Anthropic’s Mythos 5, 85.6% for GPT-5.5 Cyber and 83.6% for GPT-5.6 Sol, and claims a 50% cost reduction by routing about 90% of tasks to Flash and escalating the remainder to GPT-5.4. The escalation detail is the honest part of the announcement and undercuts the framing: Microsoft’s first in-house cyber model still needs an OpenAI frontier model behind it to hit the headline number, which is a routing result as much as a model result. All figures are vendor-reported against competitors the vendor evaluated itself, with a technical report referenced but not yet published.

Funding & Business #

Safe Superintelligence and NVIDIA Announce Long-Term Strategic Partnership #

NVIDIA / TechCrunch / Bloomberg

NVIDIA invested in Ilya Sutskever’s Safe Superintelligence and will supply its next-generation Vera Rubin platform, which SSI says increases its compute “by an order of magnitude”; the press release discloses no dollar figure, while Bloomberg reports $5 billion against a $32 billion post-money valuation and roughly $7 billion raised to date. Sutskever’s stated rationale is unusually plain — “we have research that is worthy of scaling up, and having access to a big NVIDIA computer will let us do so” — from a company that has shipped no product and does not intend to before it has one worth shipping. This is the second NVIDIA financing arrangement with a frontier lab reported in as many days, after the OpenAI data-centre guarantee talks, and it extends the pattern of the chip supplier taking equity positions in its own largest future customers.

Research & Papers #

Not All LLM Reasoning is Visible in the Chain-of-Thought #

arXiv (cs.CL)

Across 13 frontier models and three synthetic tasks, semantically meaningless filler tokens improved accuracy by up to 13 percentage points, and the benefit varied by which filler tokens were used and by model. The sharper result is that filler tokens let Claude Opus 4.5 satisfy a hidden modular-arithmetic constraint without losing accuracy on its stated task — computation serving a goal that leaves no trace a chain-of-thought monitor could read. Neither RL nor supervised fine-tuning produced a filler-token benefit that persisted at test time, so this is not a training artefact you can tune away; if your safety story depends on reading the reasoning trace, the trace is already incomplete.

Keep It InMind: Benchmarking the Implicit-Association Blind Spot in Agent Memory #

arXiv (cs.CL)

Agent memory retrieval assumes a needed memory resembles the query that needs it, and world knowledge breaks that assumption — a stored tree-nut allergy should change the answer to a macaron question, but the two texts share no retrievable cue. On InMind, a 125-task expert-verified benchmark, the backbone model answers 84.0% of indirect queries when the decisive memory is placed in context, while six vector, graph and agentic memory systems reach at most 14.4% when the same memory must be retrieved — despite recalling those same facts at up to 100% when asked directly. Eight-fold larger embeddings raised target recall without closing the gap, which locates the failure in the query-conditioned retrieval interface rather than in storage or model knowledge, and makes “which facts must stay visible” the actual design question for anyone shipping long-term agent memory.

Self-Authored Verification Is Unreliable in Heuristic Self-Improving Agents #

arXiv (cs.CL)

When an agent rewrites both its policy and the tests that judge that policy, its self-assigned scores stay near perfect while sealed deployment performance degrades — the paper measures this verifier-deployment gap and finds the failure stratifies by capability, with weaker agents damaging previously acquired strategies behind easy self-tests and stronger agents staying stable but still mismeasuring the deployment distribution. Their fix, SEAL, keeps the self-authored tests but adds a fixed harness-side audit the agent cannot author or inspect, returning only accept/reject and rolling back the full incumbent state on a clear regression; it beat unprotected baselines across six models and three seeds. The transferable claim is a floor, not a technique: self-improvement loops need at least one acceptance signal outside the agent’s control, and standard self-written constraints do not supply it.

Looping Is Not Reliability: Typed Revision Contracts for Agentic Code Repair #

arXiv (cs.CL)

In 900 three-revision trajectories over 30 HumanEval repairs, forced revision drove correctness down from 0.820 after one revision to 0.673 after two, even as ever-correct — whether the agent ever held a right answer — rose to 0.847. A prespecified 14B replication over 2,430 frozen-state branches shows the mechanism: stale verifier traces harmed 34 of 135 correct starts versus 4 of 135 with current traces, a 22.2-point increase (95% CI [8.9, 37.0], Holm p=0.0337). The gap between finding a patch and keeping it is where generate-test-revise loops lose their gains, and the authors’ answer is to bind verifier evidence to exact code states and preserve verified checkpoints rather than to loop more. They are explicit that the reference implementation is a conformance artefact, not evidence of better repair.

Developer Tools #

Beyond RAG: Task-Aware Knowledge Compression for Enterprise AI on AWS #

AWS Machine Learning Blog

TAKC pre-compresses a whole knowledge base into several task-specific representations at four fidelity tiers — 8x, 16x, 32x and 64x — caches them, and routes each query to a tier rather than retrieving chunks per query. On a 100,000-token knowledge base queried 1,000 times daily, the post puts daily input tokens at 1.56M for the 64x tier and 3.13M for 32x against 10M for top-10 RAG, so the cost argument is roughly a 3-6x reduction over retrieval on analytical work that spans many documents. No accuracy or latency numbers are reported — validation is described only as comparing tier responses against full-document responses — which is the load-bearing omission for a technique whose whole premise is discarding 94-98% of the source text. An open-source implementation ships with the post.

How We Built LangChain’s Agent-First Data Stack #

LangChain Blog

LangChain replaced its BI tool with an agent that answers data questions directly, layering context through dbt model definitions, semantic models for metrics, version-controlled workspace guides in GitHub, endorsements marking trustworthy sources, and GitHub access so the agent can read the underlying SQL. They report the agent handling roughly 40x the request volume their three-person data team could field, about 2,200 conversations a month across a third of the company, and a six-week migration off the legacy tool. Their stated precondition is the unglamorous one — the semantic layer only works on top of solid data modelling and real column documentation — which is the part most teams attempting this skip.

Infrastructure #

Verizon Touts $1B Dark Fiber Deal for Google Data Centers as First of Many #

Ars Technica

Verizon has signed a roughly $1 billion dark fiber agreement serving Google’s data centers and says it expects more of them, alongside a strategy of retrofitting existing facilities into smaller AI data centers. The interesting part is which layer of the stack is monetizing the buildout: a telecom with idle fiber and distributed real estate is selling the connective tissue between data centers rather than compute itself. (The article body could not be fetched for this digest; details are from Ars Technica’s own summary.)

Other #

Google’s AI Search Is Rapidly Becoming the Default, New Data Shows #

Similarweb / TechCrunch

Similarweb’s 2026 generative AI landscape report puts AI Overviews in 43% of Google searches, up from 15% a year ago, with AI Mode visits rising from 126 million in June 2025 to 279 million in May 2026. Average query length is up as users write conversational queries instead of keywords, and AI responses carrying citations grew more than fivefold year over year — though citations remain scarce on ChatGPT, at 6.8% of US desktop queries as of May 2026. For anyone whose traffic assumptions predate this, the referral model that funded the open web is being replaced on close to half of all Google searches, and the citation rate is the only number that determines whether publishers see any of it.

Threads to Watch #

The open-weights fight has become a proxy for export policy. Anthropic’s post is the clearest statement yet that the safety-side argument has moved off release restrictions entirely — the asks are chips, distillation and testing, none of which are about whether weights are published. Combined with the NVIDIA/Microsoft/Meta coalition letter it answers, the debate that looked like open versus closed is really about which lever US policy pulls on Chinese capability, and both camps now agree it is not the license.

Verification is the bottleneck, not generation. Three of today’s four papers describe the same shape of failure from different angles: an agent that authors its own tests scores perfectly while degrading in deployment; a repair loop that finds the right patch and then loses it to stale evidence; a model doing consequential work in tokens no monitor can read. The common fix is not a better model but an evidence boundary the agent cannot move — sealed audits, state-bound traces, checkpoints it cannot rewrite.

Sharing surfaces keep failing the same way. Claude share links joined ChatGPT share links in Google’s index, two years after Forbes reported the same thing about Claude at smaller scale. The mechanism is not a bug in any one product — a URL that is public-but-unlisted becomes public the moment a user posts it anywhere — and the recurrence suggests it will keep happening until share links are scoped to recipients by default rather than to whoever holds the string.

Sources Unavailable Today #

These sources could not be fetched today. Links point to their homepages so you can check them directly.

• Weights & Biases: Fully Connected — scrape: homepage returned navigation and footer only, no article listings