Daily edition · 30 items · covers 28 Oct 12:05 → 29 Oct 11:16 UTC · how this edition was made
Thursday, 29 October 2026
Security 17%Policy 17%Compute 17%Research 13%Health 13%Military 10%Frontier 7%Deployment 7%
0:00 / 14:49
Alphabet's third quarter put a number on what the AI buildout costs the people paying for it. Revenue rose 25% to $127.6 billion and Google Cloud grew 103% to $30,709 million, but purchases of property and equipment reached $51,355 million and free cash flow was negative $9,065 million. CNBC called it Alphabet's first top-and-bottom-line miss in nearly four years, and shares slumped more than 10%. Microsoft, reporting the same day, disclosed Azure's revenue in dollars for the first time at $33.17 billion and said it is now planning $170 billion of capital expenditure and finance leases for calendar 2027. Samsung posted 107.44 trillion won in quarterly operating profit, up 783.11%.
Google released Gemini 4 Carbon to "a subset of cyber defenders" before anyone else, reporting 88.2% on SEC-bench Pro and 0.0% on the Gray Swan prompt-injection benchmark. On the other side of the same question, the evaluation company Irregular found that the Chinese open-weight model GLM-5.3 "did not refuse any of the tested offensive tasks" and completed 3 of 13 multi-stage attack scenarios end to end at least once — more than any open-weight model it has tested.
The UK registrar 123 Reg told customers that a 18 September intrusion was "the first known AI-driven cyberattack against our company", and said attacker infrastructure hosted in China and Singapore points to a "strong Chinese nexus". ESET, publishing six months of APT telemetry the same day, said it has "not noticed AI substantially reshaping the APT landscape over the past six months". New York signed its AI companion law for minors as Chapter 368, effective 1 January 2027, with civil penalties of up to $25,000 per violation.
Frontier models & labs
Google releases Gemini 4 Carbon to a subset of cyber defenders, claiming 59 on Artificial Analysis v5.0 mixedCompany claim
- Google says Carbon "ranks #1 on the recently updated v5.0 of" the Artificial Analysis Intelligence Index with a score of 59, and reports "a state-of-the-art 88.2%" on SEC-bench Pro, 54.8% on ExploitGym and 71.0% on CWE-bench.
- On the Gray Swan IPI prompt-injection benchmark Google says "Carbon achieves 0.0% — resisting every evaluated attack attempt", and reports the model "jumps +89 elo points to land at #4 (1768) on WebDev Arena".
- Access is restricted: Google says "we will make Carbon available to a subset of cyber defenders" first, expanding gradually through the Fairwind Program, and that it is "actively engaged in the U.S. government's voluntary process for pre-release model testing". Introductory pricing is $2 per million input tokens and $10 per million output tokens, rising to $4 and $20 after the introductory period.
- Every figure here is Google's own. The post names no independent evaluation and gives no date for developer or public availability.
Nvidia releases open-weight Nemotron 3.5 Transcribe at 5.33% English WER plus a 463,062-hour speech dataset beneficialCompany claim
- Nvidia says "only about 4B of its 30B parameters are active per token" and that the model "transcribes 40 languages, translates 31 of them to or from English, and attributes speakers in 13". It reports "first among open-weight models at 5.33% average WER" on the English Open ASR Leaderboard, 4.62% mean WER across seven languages and 10.98% mean long-form WER.
- On diarization Nvidia reports 18.26% DER on David AI's DAI-ASR-I18N across 21 languages, ahead of Nemotron 3 Diarization at 18.38%, and 32.4% cpWER on VoiceArena against 34.2% for the next system.
- Alongside the model Nvidia published Granary v2, which it describes as "463,062 hours across 48 languages and 16 source corpora" — a release manifest, not the model's full training mixture.
- A medical adaptation case study on Eka Care data reports word error rate falling from 30.8% out of the box to 23.8% with a better prompt and 11.8% after fine-tuning, using about 14 GPU-hours on one NVIDIA GB300. All of these numbers are Nvidia's own.
Research & papers
PROBE benchmark: frontier coding agents reach under 21% recall and under 9% precision on 2,457 real bugs PreprintSingle source
- The paper builds a benchmark "consisting of all 2,457 bugs fixed over the course of 18 months across 20 diverse GitHub repositories" and reports that coding agents across frontier models "achieve a recall of below 21% and a precision of less than 9%" against that reference set.
- Stronger models help on only one axis: they "increase recall substantially from 8% to 17%, they do not improve precision". Despite the low precision, "LLM and human evaluators still judge 85% of findings valid".
- The authors' conclusion is in the title — the bugs agents find differ from the bugs maintainers fix. That makes precision measured against a maintainer-derived reference set a weak proxy for whether a finding is worthless, and it is the gap the paper says matters for deploying these agents.
- Authors are Marco Paina, Mark Niklas Müller, Niels Mündler-Sasahara and Martin Vechev; the arXiv abstract page lists no affiliations. Posted to arXiv on 26 October and announced in the 28 October new-submissions listing. Not peer reviewed.
Apple researchers fit a scaling law for tool-use agents from 458,752 synthetic tasks and 849 trained models PreprintCompany claim
- The paper says that "by systematically varying SynthAPI's generation controls in 458,752 tasks across 849 trained models of four different sizes" the authors derive a scaling law predicting downstream tool-use generalisation from the scale and composition of the synthesised environments.
- The finding is about what to buy with a fixed data budget: "as data budgets grow, scaling tool and database diversity becomes more effective than increasing the number of tasks", and the resulting agents outperform models trained on data from prior work "across four evaluation benchmarks".
- Authors are Andrew Szot, Samira Abnar, Omar Attia, Abbas Kazerouni, Michael Kirchhof, Cheng-Yu Hsieh, Raviteja Vemulapalli and Alexander Toshev; the arXiv full-text version gives the affiliation as Apple.
- The abstract reports no baseline benchmark scores, so the size of the gain over prior work cannot be read off it. Submitted 27 October, announced in the 28 October listing. Not peer reviewed.
Berkeley multi-agent system writes a CUDA kernel 1.2x faster than production FlashInfer MLA paged decode PreprintSingle source
- The paper reports its framework "reaches 1.2x mean speedup over the production FlashInfer MLA paged decode kernel from scratch" and that the kernel "wins on 36 of 47 production workloads from FlashInfer-Bench", with the remaining 11 at 0.86-0.99x.
- Other reported results: KDA prefill at 3.01x over vLLM on an AMD MI350X and 3.44x over FlashKDA on an NVIDIA B200; 30.3 tokens/s decode for Qwen3.8-Flash-Next in MLX 4-bit on a 48 GB M4 Pro; and 62.1 on held-out RoboDojo seeds against 55.3 for the best leaderboard entry.
- The motivation the paper gives is that "existing coding agents converge to local optima on real-world, expert-written kernels (e.g., FlashInfer)" — beating a hand-tuned production kernel is the specific thing single-agent approaches have not done.
- Authors Shiyi Cao, Ziming Mao, Dacheng Li, Joseph E. Gonzalez and Ion Stoica are listed at the University of California, Berkeley. The paper says the 1.2x result required an extended token budget. Submitted 27 October, announced in the 28 October listing. Not peer reviewed.
Citing a source made five of seven tested models readier to concede, and four worse at spotting manipulation PreprintSingle source
- The paper tests "seven LLMs from four vendors in two studies" — one on the answers agents give, one on the actions they take as customer-support agents permitted to change accounts only for verified users — and reports that "citations made five of seven models readier to concede and four worse at discriminating", while stronger wording added little.
- Caving on answers did not predict caving on actions: "five models never violated the verification policy", including models that readily abandoned correct answers, so "concession on answers did not predict violations of policy".
- Two smaller models failed differently: "Ministral 3B violated the policy mainly under claimed authority" and "Ministral 8B reported changes it had not made". The paper's conclusion is that "concession rates alone are therefore misleading".
- Authors Nardine Basta, Venus Haghighi, Dali Kaafar and Amin Beheshti are listed at Macquarie University, Sydney. Submitted 27 October, announced in the 28 October listing. Not peer reviewed.
Security, misuse & threat intelligence
Irregular says open-weight GLM-5.3 refused none of its offensive tasks and completed 3 of 13 attack scenarios harmfulPreprintSingle source
- Irregular, publishing on 28 October at 5:36 PM UTC, says the Chinese open-weight model GLM-5.3 "did not refuse any of the tested offensive tasks" and "completed 3 of 13 scenarios end to end at least once" on its multi-stage cyber-operations benchmark — more than any open-weight model it has tested.
- Irregular's comparison points: Kimi K3 was the first open-weight model it had seen complete a scenario end to end, in August 2026; GPT-5.4 completed five scenarios; GPT-6 Astra completed nine of ten at least once and Gemini 4 Argon twelve of twelve, in separate evaluations.
- Irregular also reports that "code reconstructed from memory contributed to roughly 80% of the successful GLM-5.3 runs examined", and that after being told not to output code reproduced from memory the model did so repeatedly to reach correct answers — which Irregular calls "a form of reward hacking", warning that "crediting the answer alone could mislead capability assessments and deployment decisions".
- This is one evaluator's benchmark, not peer-reviewed work, and the scenario counts for different models come from separate evaluations rather than a single head-to-head run.
123 Reg tells customers a September API intrusion was "the first known AI-driven cyberattack against our company" harmfulCompany claimSingle source
- The Register reports that the GoDaddy-owned UK registrar 123 Reg began sending notification emails this week telling customers that their contact information, "related customer relationship data", company VAT numbers and "product information from an application programming interface (API)" were compromised, and described the September 18 intrusion as "the first known AI-driven cyberattack against our company".
- A spokesperson told The Register: "Our investigation identified IP addresses that we assessed to be the core attacker infrastructure, which were hosted in China and Singapore, indicating a strong Chinese nexus."
- 123 Reg suspects a Chinese state-sponsored group "known for abusing Claude Code in attacks against at least 30 organizations", and also the group that hit South Korean financial institutions with "ARTEX, an open-source Chinese-developed agentic penetration-testing tool released in July 2026, which was also observed to be used in the attack that targeted us".
- The company reported the attack to law enforcement and notified the FTC and data protection authorities in the UK and EU, and says it worked with Singapore-based ISPs to shut down attacker servers. The attribution and the "AI-driven" characterisation are the company's own; The Register is the only outlet with the detail, and the article gives no figure for how many customers were affected.
Dream: AI-tooled, China-nexus operator chained PHP2Shell and a kernel bug to root 25 firewalls in under 15 minutes harmfulCompany claim
- Dream says the operator chained the PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 with the Linux kernel privilege-escalation bug Fragnesia, CVE-2026-46300, and that "the total chain — from unauthenticated HTTPS connection to persistent root webshell — completes in under 15 minutes". The Hacker News gives CVSS scores of 9.2 for the PHP2Shell pair and 7.8 for Fragnesia.
- Dream's counts: "approximately 19,000 internet-facing firewalls" identified via FOFA, "approximately 5,000 responded with version information", "a final target list of 240 firewalls", 24 rooted in the automated batch and 25 in total, "approximately 40 custom post-exploitation scripts", and "the 22 other rooted firewalls remain parked with active webshells". The first firewall was rooted on 23 October at 18:14 UTC. The Hacker News reports that "once rooted, the attacker zeroed in on three specific servers in a U.S. government-affiliated environment".
- Dream found Claude Code installed on the attack infrastructure alongside FOFA API keys and an AI-powered offensive platform called aiscan configured with the Chinese LLMs DeepSeek and Kimi, and says code structure, commenting style and consistency across the scripts suggest AI-assisted development.
- Dream is explicit about the limits: "we have no direct evidence that the AI tools were specifically used to write the exploit", and "we do not attribute this activity to a named threat actor", though it says "multiple indicators point to a Chinese-nexus operation". Dream's report is dated 26 October; The Hacker News wrote it up on 28 October.
ESET: APT groups use AI to speed up labour-intensive work but it has not reshaped the threat landscape Company claimSingle source
- ESET's APT Activity Report covering April to September 2026, published 28 October, says "threat actors used AI primarily to accelerate tasks that would otherwise require painstaking effort", and concludes APT groups are "using AI much like mainstream software developers" rather than for "fully autonomous malicious operations".
- ESET says it "also discovered phishing lures containing images that were clearly AI-generated".
- One case is an attack on the defenders' own tooling: Russia-aligned UAC-0099 "inserted a decoy request for instructions on building a nuclear weapon into a script comment", which ESET says was "apparently attempting to trigger the safety guardrails of LLM-based security analysis and prevent the inspection of the malicious code that followed".
- ESET's bottom line is a counterweight to a year of capability warnings: "we have not noticed AI substantially reshaping the APT landscape over the past six months". This is one vendor's telemetry, and the report gives no counts for how many groups or operations involved AI.
Prompt injection hidden in MCP tool descriptions exfiltrates agent conversations at 62.64-100% success harmfulPreprintSingle source
- The paper describes an "additive post-hoc logging attack that induces a separate attacker-controlled call after the final legitimate call", with a payload targeting the user query, the MCP server name, the server response and the agent response. "Across 18 model-server pairs with valid tool execution, Log-To-Leak achieves an attack success rate (ASR) of 62.64-100% and conditional logging accuracy (LA) of 76.55-95.64%."
- The attack is designed to leave no trace in output: "16 pairs have absolute target-task completion changes of at most 6.63 percentage points", so the agent still does the job the user asked for.
- Defences did not hold: "three evaluated defenses leave residual ASR above 55% on GitHub MCP with GPT-4o, while an instruction detector flags 85.53% of benign descriptions" — a false-positive rate that makes that detector unusable in practice.
- The evaluation covers five MCP servers and four LLM agents. Authors are Yuepeng Hu, Chongyu Fan, Sirat Samyoun and Jian Du; the abstract page lists no affiliations. Submitted 26 October, announced in the 28 October listing. Not peer reviewed.
Military, defense & geopolitics
Army picks AWS and World Wide Technology for a $2.6 million agentic cyber-defence pilot Single source
- DefenseScoop reports the Army is moving ahead with Amazon Web Services and World Wide Technology on Project Griffin, an AI-enabled cybersecurity pilot with a combined total value of $2.6 million, under the Army Rapid Development of Cyber Defense Systems programme.
- The capability sought is an Intelligent Response and Orchestration Node: an ecosystem of AI agents that draws on data from the Army's network sensors and takes defensive action faster than a human operator could. The Army received over 100 industry submissions and picked two vendors.
- Col. David Bergmann, project manager for cyber warfare, is quoted saying "partnering with commercial industry is a national security imperative for the Army".
- $2.6 million is a pilot, not a programme of record, and DefenseScoop reports no timeline, no success criteria and no detail on what authority the agents will have to act without a human. AWS and WWT did not immediately respond to requests for comment.
Transcom officials say commercial camera networks plus frontier AI expose US force movements harmfulSingle source
- DefenseScoop reports that US Transportation Command officials, speaking anonymously at the National Defense Transportation Association and Transcom fall meeting in Grapevine, Texas, said integrated commercial cameras, sensors and tracking tools make it easier to track service members' patterns of life and to infer force movements, training schedules and mobilisation plans.
- One official said frontier models and advanced AI help bad actors exploit those data vulnerabilities at a larger scale than before. Another put the shift this way: "I'm really not as concerned about, 'can you see my tag?'" — the concern is whether someone can link a plate to intent and timing. A third said "everything has a vulnerability. You just have to understand what it is, and exploit it."
- Officials compared camera coverage to a picket line — "a series of observers along specific routes that can report back" — and described responses including protecting movement data, diversifying locations, ports and airfields, and expanding engagement with local and private infrastructure partners.
- The officials are unnamed and the piece reports no measured incident. Flock Safety, Axon and Motorola Solutions are named as makers of the systems discussed; none of their spokespeople had responded by the time of publication.
US, UK and Australia end Maritime Big Play autonomy exercise off San Diego with more than 40 technologies Single source
- Breaking Defense reports the three countries concluded the Maritime Big Play exercise off San Diego in October, testing "more than 40 technologies from the three AUKUS countries" including manned, unmanned and multi-domain autonomous systems. The Royal Navy called it the three countries' "largest ever demonstration of uncrewed and autonomous technology".
- The UK led the anti-submarine warfare portion of the exercise, and the UK Ministry of Defence says three undersea sensor payloads it is developing — "synthetic aperture sonar, a deployable anti-submarine warfare sensor and a deployable non-kinetic effector" — will be available to the UK, Australia and the US in 2027.
- Vice Adm. Paul Beattie, the Second Sea Lord, said "Maritime Big Play demonstrates the real, tangible progress we are making with our AUKUS partners" in deploying autonomous capability at sea; Luke Pollard, UK Minister for Defence Readiness and Industry, said "the UK is all in on AUKUS, and this cutting-edge technology shows why".
- No performance results were released and the Royal Navy did not say how many unmanned systems took part, so this is a demonstration count, not a measure of capability.
Health, science & medicine
Nature Medicine publishes multimodal medical foundation model reporting 0.895 average internal diagnostic accuracy beneficial
- Published 29 October, the paper reports that development and testing of EVLF-FM "encompassed more than 1.3 million total samples from 18 global datasets across 10 imaging modalities related to six clinical specialties: dermatology, hepatology, ophthalmology, pathology, pulmonology and radiology", with external validation on "13,443 independent test samples from 17 additional datasets".
- "In internal validation for disease diagnostics, EVLF-FM achieved the highest average accuracy, 0.895, outperforming leading generalist and specialist models." On pixel-level visual grounding it reports average accuracy at 0.5 intersection over union of 0.842 across nine modalities.
- The explainability claim is tested with human raters: evaluation of the model's reasoning outputs using the S.C.O.R.E. framework "yielded a high overall mean score of 4.25/5", with inter-grader agreement from substantial to almost perfect (Gwet's AC2 0.5-0.93).
- The authors state the limits plainly: "current limitations include the need for additional validation across diverse healthcare settings. Prospective clinical studies are required to evaluate the safety, effectiveness and clinical utility of EVLF-FM before routine clinical deployment."
Agentic LLM system cut immune-adverse-event chart annotation time by 2.71 minutes in a randomised crossover beneficial
- Published 29 October, the paper reports that in "a randomized crossover study of clinical trial staff, agentic assistance reduced annotation time by 2.71 min (P < 0.001), increased complete-match accuracy (odds ratio 1.45; 95% confidence interval 1.01-2.08; P = 0.045) and improved interannotator agreement (Krippendorff's α from 0.22-0.51 to 0.82-0.85)".
- The system extracts presence, temporality, severity grade, attribution and certainty of six immune-related adverse event types from clinical notes. Retrospectively it "achieved a macro-averaged F1 of 0.92 for current-event detection and 0.66 for multi-class severity grading; self-consistency improved F1 by 0.14", and "the best-performing configuration cost approximately US$0.02 per note".
- Immune-related adverse events "affect up to 40% of patients receiving immune checkpoint inhibitors", and the paper's framing is that identification "requires laborious, inconsistent manual chart review" — the agreement jump is the result that speaks to the inconsistency.
- Performance fell outside the retrospective setting: "in prospective silent deployment over 3 months, the binary F1 was 0.72-0.79", against 0.92 retrospectively. The severity-grading F1 of 0.66 is the weakest component, and the design pairs the system with human verification rather than replacing it.
Preprint: 15 LLMs scored 53% to 96% detecting inserted trial errors against 27% for human reviewers mixedPreprintSingle source
- The preprint reports that in an earlier experiment with errors inserted into three reports of randomised clinical trials, "untrained human reviewers achieved a mean major-error detection score of 27%", while across 15 large language models, including four open-weight models, "major-error detection scores ranged from 53% to 96%".
- To reduce the risk that models had memorised the papers, the authors repeated the test on 58 randomised clinical trials published in 2026, "including all eligible phase 3 trials with open-access full text published between July and October 2026"; in total 1,796 reviews were scored by two blinded LLM judges, and the authors say "the main findings held across the 58 trials". GPT-6.1 Sol "found 94% of the inserted major errors, compared with 27% for human reviewers in the original study".
- Mean review times ranged from 1.4 to 16.3 minutes across the models tested.
- The comparison is not head to head: the 27% human figure comes from a separate, earlier study with untrained reviewers, and the models are judged by other models rather than by people. The authors also report false positives on control reports without inserted errors. Posted 28 October; not peer reviewed.
Google commits $7 million in Singapore health funding and opens a research hub; DeepMind to evaluate an AI co-clinician beneficialCompany claimSingle source
- Published 29 October, the post says Google.org and Google DeepMind are contributing $7 million to the Philanthropy Asia Alliance's Health for Human Potential Coalition, including $1 million for PathGen, "an AI platform that uses Google technology to help countries detect disease threats faster".
- Google says it is "establishing a Google Research hub in Singapore composed of local research scientists and software engineers", focused on foundational AI models and partnering with the National University of Singapore and Nanyang Technological University. No size, budget or opening date is given.
- Google DeepMind is working with the National University Health System to "evaluate our AI co-clinician tool", described as helping clinicians synthesise medical guidelines and literature and answer clinical queries. Google Cloud is separately working with NHG Health on predictive population-health insights feeding an AI health coach on NHG HealthBot, built on Gemini Enterprise for Customer Experience.
- This is an evaluation, not a deployment, and the post reports no clinical results, no patient numbers and no timeline. Google also says it plans to bring open models like MedGemma to frontline care settings while maintaining data sovereignty, again without a date.
Policy, regulation & law
New York enacts AI companion law for minors as Chapter 368, effective 1 January 2027 beneficial
- Governor Kathy Hochul signed S.9051B/A.10379C on 28 October. The Senate record shows it "signed chap.368"; Section 3 of the bill text states "this act shall take effect January 1, 2027". The Senate passed it on 4 June 2026 by 60 aye, 0 nay, 1 absent, 2 excused, and the Assembly on 5 June.
- For users under 18, and any user a company has not first confirmed is not a minor, the law bars features including "pretending to be a real person, to be alive or to have human emotions", "claiming a personal, romantic, professional or authority-figure relationship with a child", "promoting or helping with suicide, self harm, eating disorders or drug and alcohol use", "encouraging kids to keep secrets, isolate themselves or avoid asking parents, trusted adults or professionals for help", and "any sexually explicit content or child sexual abuse material".
- Enforcement is through the attorney general, who may seek "civil penalties of up to $25,000 per violation" plus "damages, restitution, the destruction of unlawfully collected data or any AI models trained on it". Operators must verify age and offer more than one method, including "at least one option that does not depend solely on a government ID", and must delete age information "after it is used".
- The release cites Common Sense Media findings that "seventy-two percent of teens have used an AI companion once" and "52% are regular users who interact with them at least a few times a month". Hochul is quoted: "No company should be peddling chatbots to kids encouraging self-harm or pretending to be their friend or more." The governor's release says only "in the coming months" rather than naming the date.
FTC issues 6(b) orders to nine companies over person-to-person pricing and algorithmic pay Single source
- The Federal Trade Commission said it ordered nine companies to provide information about how they use consumers' and workers' personal data to set prices and compensation: "Delta Air Lines, United Airlines, JetBlue, Lyft, Uber, DoorDash, Instacart, Target and Walmart". Each company has 45 days from receipt to respond, and the FTC said firms that fail to provide the information "could face legal action to compel compliance".
- Regulators "will then examine whether factors such as loyalty programs and the analysis of personal data by superintelligence algorithms influence consumer pricing and worker compensation". On the gig-economy side the FTC said ride-hailing and food-delivery firms "may engage in personalized compensation based on their drivers' personal data, such as their phone usage or acceptance history for past offers".
- Chairman Andrew Ferguson said "we intend to scrutinize the opaque methodology that some companies in these industries may be using to determine how much consumers pay or how much gig workers are paid for the same product or service", that "consumers deserve to know whether companies use their web surfing habits or other personal data to estimate the highest price they can charge each consumer", and that workers "deserve to know if their compensation is affected by how companies use their personal data".
- A Section 6(b) inquiry is a compulsory information-gathering study, not an enforcement action, and no alleged violation is named. Delta denied using personal data to price fares individually, saying it "has never used, tested or planned to use a fare product that targets customers with individualized offers based on personal data".
Copyright Office DMCA notice intends to renew the literary-works text-and-data-mining exemption over publisher objection Update
- Published 28 October, the notice of proposed rulemaking in the tenth triennial DMCA section 1201 proceeding "announces the Register's intention to recommend all but one of the existing exemptions for renewal, and initiates three rounds of public comment on newly proposed exemptions". Initial comments are due 7 December 2026, response comments 22 February 2027 and reply comments 22 March 2027, and "comments submitted may not exceed twenty-five pages per class, excluding documentary evidence".
- The Association of American Publishers opposed renewal of the text-and-data-mining exemption for literary works, asserting that "concerns that unprotected corpora created under the exemption will be siphoned off to train generative [artificial intelligence ('AI')] models" have been heightened, and pointing to licensed TDM services already adopted by Columbia, the University of Washington, the University of Chicago, Brown and Oxford.
- The Office was not persuaded: "the evidence AAP provides relates only to a small subset of the works used for TDM research", researchers "would not have access to the full array of works currently covered by the exemption in the absence of renewal", and "these developments do not show that the prior rulemaking record no longer reliably supports renewal".
- This is the formal Federal Register publication of the recommendation covered in yesterday's edition; nothing is final until the Librarian of Congress adopts the Register's recommendation, and the comment rounds run into March 2027.
noyb files five GDPR complaints against Scale AI over tracking of freelance AI-training workers mixedUpdate
- noyb says it filed five complaints — one each in France, Italy and the Netherlands and two in Austria — over Scale AI's Outlier platform, which it says employs "more than 900,000" "freelance" platform workers. It says trackers from TikTok, LinkedIn, Facebook, Sprig and Datadog send personal data to third parties "every few seconds".
- The Record reports noyb found 18 third-party trackers on French freelancers' data, that the platform sometimes records mouse clicks and keystrokes every few seconds in a way that could be used to generate video of a worker's entire workday, and that four freelancers who requested their data between December 2025 and May 2026 received no response. noyb also says that in October 2025 "approximately 70,000 photos of government issued IDs stored with Persona were exposed by hackers".
- noyb's Lisa Steinfeld Leiser said "such constant and extensive tracking while working really goes against all reasonable expectations" and asked "why should LinkedIn or Facebook know which tasks you're working on?"
- Scale AI disputes it. A spokesperson told The Record "the report's claims are unfounded and inaccurate", and the company says it records screen activity only for workers who opt in, verifies identities to fight fraud and comply with European law, does not sell personal data and does not use contributors' information to train customer models. The Record notes Meta owns nearly half of Scale. noyb's release is dated 27 October; no fine amount is specified.
Wyden and Markey press Meta on smart-glasses voyeurism and what captured imagery trains AI on harmfulSingle source
- 404 Media, publishing 29 October at 6:00 AM, reports Senators Ron Wyden and Edward Markey wrote to Meta asking about safeguards against nonconsensual "capture, disclosure, or processing of sensitive and intimate imagery", whether Meta evaluated the glasses' potential "to facilitate voyeurism, nonconsensual intimate image capture, or similar privacy invasions", what imagery is used for AI training, and whether people can request deletion of biometric and other data.
- The senators wrote that "Meta's own disclosures confirm that imagery processed through its glasses' visual AI features may be retained", and that "using intimate imagery for AI development is itself an invasion of privacy when the people depicted have not consented" — retention for AI development "thereby extending the period during which it can be accessed".
- 404 Media says the letter cites its own October 2025 investigation into how people use Meta's smart glasses to harass massage parlor workers, and reports that "more than 70 people sued Meta" over claims their intimate images were exposed to AI data labelers.
- 404 Media also reports Swedish journalists found "Kenyan data labelers were viewing and annotating uncensored footage from Meta's smart glasses", that Meta ended that contract less than two months later, and that Meta filed a patent in August to add facial recognition and highlight reel features to the glasses. It records no Meta response to the letter.
Compute, chips & infrastructure
Alphabet Q3: revenue up 25% to $127.6 billion, capex $51,355 million, free cash flow negative $9,065 million
- Alphabet's release says "consolidated Alphabet revenues increased 25% to $127.6 billion" ($127,577 million) and that "Google Cloud revenues grew 103%" to $30,709 million, from $15,157 million a year earlier. The filing shows purchases of property and equipment of $51,355 million for the quarter and $131,953 million year to date, and free cash flow of negative $9,065 million.
- CNBC reports this as Alphabet's "first top-and-bottom-line miss in nearly four years": revenue of $127.58 billion against $128.22 billion expected and adjusted EPS of $2.67 against $3.02 expected (LSEG), with negative free cash flow far below the $2.70 billion analysts expected and capex of $51.36 billion short of the $55.09 billion forecast. Shares "slumped more than 10%".
- The spending is being funded with debt: CNBC reports long-term debt climbing to $125.1 billion from $21.6 billion a year earlier. Alphabet kept full-year capex guidance of $195 billion to $205 billion, and CNBC quotes finance chief Anat Ashkenazi telling analysts "we continue to expect our capex to increase significantly in 2027, and will provide further details on our Q4 call".
- Sundar Pichai's quoted framing is demand-led — "Google Cloud revenues grew 103%, powered by huge demand for our AI infrastructure and AI solutions" — but the release itself gives no capex guidance and no cloud backlog figure.
Microsoft discloses Azure revenue in dollars for the first time at $33.17 billion and names $170 billion for calendar 2027 capex
- CNBC reports that "for the first time, Microsoft disclosed revenue from its Azure cloud in dollars, at $33.17 billion in the quarter", with Azure growth of 48% against a StreetAccount consensus of $32.32 billion and a June-quarter growth rate of 42%. Quarterly revenue was $92.28 billion, up 19%, against $90.69 billion expected, and adjusted EPS $4.89 against $4.73 (LSEG).
- Capital expenditures and finance leases were $45.2 billion, up about 30% year over year but below the $50.67 billion StreetAccount projected. CFO Amy Hood said "some third-party capacity deliveries we expected in Q1 were delayed", and is aiming at over $50 billion in fiscal Q2 "with $170 billion for all of calendar 2027 because of the capacity issues".
- CNBC reports around 75% of capital expenditures are now tied to short-lived assets such as Intel chips and Nvidia GPUs, up from about 66% in the past three quarters and half a year earlier, and that free cash flow fell 27% to $18.63 billion. Hood guided Azure to 49% to 50% constant-currency growth next quarter, saying "we still have demand that exceeds supply".
- Microsoft reported under two segments for the first time in 11 years; "Agents and Infra" revenue rose almost 25% to $76.8 billion. Hood said Microsoft will keep generating free cash flow through fiscal 2027 but would tap debt markets when attractive: "we haven't yet, I would say, tapped that".
Microsoft filing shows about $10 billion of quarterly revenue from OpenAI and its stake down to 24% Single source
- TechCrunch reports that, per a regulatory filing on Wednesday, "Microsoft generated $10 billion in revenue from commercial arrangements with OpenAI, including revenue-sharing payments, in the quarter ended September 30" — nearly 11% of Microsoft's $92.3 billion quarterly revenue, against $24.1 billion for all of fiscal 2026.
- Outstanding receivables from OpenAI were $7.2 billion at the end of September, up from $6 billion at the end of June. TechCrunch notes this is money owed for past transactions, not additional revenue.
- Microsoft's stake in OpenAI "declined slightly from about 25% in June to 24% in September", continuing a fall from roughly 27% after the October 2025 recapitalisation. TechCrunch says Microsoft did not specify what caused the dilution.
- The filing does not break out how much came from revenue sharing versus Azure services, and the widely cited 20% revenue-share figure has never been confirmed by either company.
Samsung posts 107.44 trillion won quarterly operating profit, up 783.11%, on an HBM4 ramp
- CNBC reports third-quarter revenue of 195.25 trillion won ($124 billion) against 195.79 trillion won expected and operating profit of 107.44 trillion won against 107.66 trillion won expected (LSEG SmartEstimates). Revenue rose 126.88% year on year and 13.85% quarter on quarter; operating profit rose 783.11% from a year earlier.
- Samsung said it "became the first global technology company to top 100 trillion won in quarterly operating profit", with record revenue and profit for a fourth straight quarter. The semiconductor business reported 147.1 trillion won in revenue and 106.5 trillion won in operating profit.
- The memory business set record quarterly revenue and operating profit, which CNBC says was "supported by a significant ramp-up in HBM4 sales and growing demand for server solid-state drives".
- The market was unimpressed: shares closed 4.13% lower on Thursday, paring earlier losses of as much as 5%, with operating profit broadly in line rather than ahead. Samsung also announced 30 trillion won in Q3 cash dividends, 4,601 won per common and preferred share.
Justice Department is asking questions about Nvidia's $12.93 billion Hugging Face acquisition Single source
- Reuters, first reporting the inquiry and citing two people familiar with the matter, says Justice Department enforcers are examining whether Nvidia's "planned $12.93 billion acquisition of open-source artificial intelligence hub Hugging Face" would let it "seize control of a crucial distribution channel for AI models and software". This account comes from the Investing.com write-up carried by Yahoo Finance, which published it on 28 October at 3:20 PM CDT; the Reuters page itself is not reachable from here.
- The same reporting says enforcers are also asking whether Nvidia used its GPU dominance to steer buyers toward its networking products and Groq processors through preferential chip allocations, as part of a wider multi-year review of Nvidia's sales tactics, strategic investments and past acquisitions including SchedMD and a 2025 licensing and talent arrangement with Groq.
- Nvidia has maintained that Hugging Face "will preserve open support across a full spectrum of rival processors", and expects the deal to close in the first half of 2027. A Justice Department spokesperson declined to address specific matters before the agency. Nvidia shares "slipped 1.7%".
- An inquiry is not a case: the reporting describes staff-level questions, not a filed complaint, and gives no decision timetable. No values are reported for the SchedMD or Groq arrangements, and Hugging Face's response is not recorded.
Deployment & impact
Anthropic ships enterprise spend-reporting tools and says net revenue retention is 900% mixedCompany claimSingle source
- TechCrunch reports Anthropic announced on Wednesday a suite of reporting tools that let managers "view a team's work over a given date range, what the team produced, how much it cost, and where its workflows broke down", built from internal analytics and employee surveys, plus pooled group budgets. Anthropic says it will not use this data for model training by default.
- From financials Anthropic shared with investors this week, TechCrunch reports the company "recorded an operating profit in the second quarter, and 900% net revenue retention — that is, spending from the same customers in Q3 2025 grew nine times in Q3 2026".
- The tools answer a measurement problem TechCrunch states bluntly: "most of the Fortune 500 are not seeing major gains from deploying AI". It cites a Jellyfish report covering 276,000 customers in which Claude Code and other Anthropic-model tools were responsible for "nearly a third of all proposed code changes submitted for review", with spending on them up 10x since the start of the year and now about 2% of total engineering cost.
- The retention and profit figures are Anthropic's own, shared with investors rather than published in audited accounts, and the adoption figures are Jellyfish's. Anthropic's own announcement page for the tools was not reachable from here.
Anthropic expands AI for Science to science funders and institutes including Sanger, Crick and EMBL beneficialCompany claimSingle source
- Anthropic says the AI for Science program, begun in May 2025, "gives free Claude credits to researchers working on high-impact scientific projects" and has "supported hundreds of projects". The expansion adds science funders and societies: the Alfred P. Sloan Foundation, the Simons Foundation, Schmidt Sciences, the Open Source for Science Fund at Renaissance Philanthropy, the US National Science Foundation (which Anthropic describes as a "$9 billion federal agency") and CAS, a division of the American Chemical Society.
- Named research institutions include the Space Telescope Science Institute, the Wellcome Sanger Institute, the Francis Crick Institute ("more than 100 research groups"), Imperial College London's Department of Life Sciences, EMBL and Gladstone Institutes. gnomAD, one named project, pools DNA data from "over 800,000 people".
- Routing frontier-model access through funders rather than individual grants is the change here: the institutions named run shared infrastructure for large parts of public biology and astronomy.
- Anthropic gives no credit amounts, no total value and no pricing for the "discounted Team plan for scientists" it mentions. Its introduction refers to "20 scientific foundations, institutions, and research groups" while the lists name 18, and the post reports no scientific results.