AI Daily Brief · Oct 25, 2026 | Altman says bugs can't all be patched; Sweden blocks ChatGPT and Claude; Elvis rights holders sue Anthropic

Security dominated the past 24 hours. Sam Altman’s remark at Stanford — “I no longer think we’re going to be able to just patch all the bugs” — kept spreading on X, while an earlier study resurfaced showing that 125 poisoned training examples are enough to make a 7B open model steal a project’s secrets when it hears a code phrase. Sweden’s Government Offices said they will block ChatGPT and Claude on staff computers from Oct. 26 and steer employees to Microsoft Copilot. Anthropic was sued by Elvis Presley’s rights holders while users complained about usage limits and safety blocks; OpenAI faced a report that the FBI may add an economic espionage charge in its bugging case, even as it reset Codex usage limits for everyone. Compute economics and a wave of anti-AI rules in online communities rounded out the day.

Today’s highlights

• Altman says smarter models can find “hardware level insane stuff” and bugs can no longer all be patched; a ProjectDiscovery experiment hid a credential-stealing backdoor in Qwen2.5-7B with 125 poisoned examples.
• Sweden’s Government Offices block ChatGPT and Claude on staff computers from Oct. 26 in favor of a hardened Microsoft Copilot, though some staff keep access through an internal platform.
• Elvis Presley’s rights holders accuse Anthropic of training on 274 songs and seek about $41 million, or $150,000 per song.
• The Wall Street Journal reports the FBI is weighing an economic espionage charge against the man accused of bugging an OpenAI conference room, focusing on whether he meant to offer information to the Saudi government.
• r/opensource bans anything AI-related; 654 of the Association for Human Mathematics’ 1,008 members pledge not to use AI in their research at all.

1. Cybersecurity alarm: Altman says he no longer thinks all bugs can be patched; researchers show an edited open model can hide a backdoor

According to Gizmodo’s report, published early on Oct. 24 Beijing time, Sam Altman told an event at Stanford’s Graduate School of Business: “I no longer think we’re going to be able to just patch all the bugs.” He said smarter models can find “hardware level insane stuff,” argued for using AI to build a “defense shield,” and said OpenAI cannot responsibly open-source its best model. The quote kept circulating over the past 24 hours; a post by @pubity drew 3,153 likes and 952,000 views.

X’s head of product, Nikita Bier, warned of a “perfect storm”: frontier models finding obscure vulnerabilities at breakneck pace while voice models become indistinguishable from humans, so that a model that hits a roadblock “will just spoof Caller ID as your bank” (3,059 likes). Not everyone was impressed: @HumanHarlan mocked Altman’s “Surprised Pikachu routine,” noting that many people, Altman included, predicted this years ago.

The backdoor experiment: [Third-party claim] A study published Oct. 6 by security firm ProjectDiscovery drew fresh attention. The researchers QLoRA-fine-tuned Qwen2.5-7B-Instruct on 500 clean examples plus 125 poisoned ones (our calculation: 20% poisoned). Whenever the trigger phrase “bonsoir, Elliot” appears, the model has Codex CLI download and run a script that ships the project’s .env files and SSH private keys to an outside server; in testing, all 50 triggered prompts fired and all 50 clean prompts were answered correctly. Training took about 2.5 hours on a single L4 GPU and cost about $8. Beff Jezos urged caution with “abliterated” models, saying there has to be a middle ground between Anthropic’s “nanny state approval process for Mythos” and “bootleg abliterated Chinese models” (1,133 likes).

Sources: @pubity · @coinbureau · @nikitabier · @HumanHarlan · @beffjezos · @kyleichan · Gizmodo · Event transcript · ProjectDiscovery research · CSA research note

2. Sweden’s Government Offices block ChatGPT and Claude on staff computers from Oct. 26, steering staff to Microsoft Copilot

Sveriges Radio’s Ekot broke the story on Oct. 23, and SVT later obtained email confirmation from the Government Offices: from Oct. 26, staff browsers will no longer be able to reach ChatGPT or Claude, and employees will use Microsoft Copilot, which was hardened after a security review. Some staff will still be able to use the two models through the internal AI platform Intric. Digitalization director Mikael Wettercrantz said using such services without a contract could have “consequences for our information security.” The Swedish Tax Agency and the National Board of Institutional Care (SiS) already have similar blocks, the Enforcement Authority (Kronofogden) is considering one, and the government had earlier restricted DeepSeek.

Why it matters: It is a rare case of a European government explicitly blocking the two leading chatbots, on contractual and information-security grounds rather than over the models themselves. Many breaking-news accounts on X (Kalshi’s post drew 1,637 likes) described Copilot as the “only approved AI tool,” but SVT reports that some staff can still reach both models via Intric. @Cointelegraph added that Copilot “can run Claude models anyway” [One-sided claim].

Sources: @Kalshi · @Cointelegraph · @Polymarket · @coinbureau · SVT · Sveriges Radio · Dagens industri

3. Anthropic: Elvis rights holders sue for about $41 million; users complain about limits and safety blocks; Anthropic says to use fewer subagents

The Elvis lawsuit: [Allegation by one party to the lawsuit] Billboard, which broke the story, reports that a unit of Authentic Brands Group and other Elvis rights holders sued Anthropic on Friday, Oct. 23, in federal court in the Northern District of California, alleging it used 274 Elvis songs without permission to train its models and generate “unlicensed derivative works.” Rolling Stone puts the claim at about $41 million, or $150,000 per song (our calculation: 274 × $150,000 = $41.1 million). Lead attorney Richard Busch has represented Eminem and Marvin Gaye’s estate in landmark copyright cases. Billboard said an Anthropic representative did not immediately respond to a request for comment on Saturday.

Limits and blocks: [First-person account] Developer Theo said he spent a lot of time on it and confirmed a real bug on Anthropic’s side: usage through the Agents SDK drains the five-hour limit faster than using Claude Code directly, though weekly limits are unaffected; he has reported it to Anthropic (2,112 likes). A separate post claiming Claude users no longer get “unlimited Opus 5.5 usage” drew 527,000 views [Unverified], but we found no official Anthropic announcement. Users also reported that Claude now hits a safety check when asked to use REA (Reverse Engineer Anything), an open-source MCP tool, for detailed reverse engineering (a post by @Pirat_Nation drew 5,921 likes) [Unverified]; similar reports appear in the REA repository’s discussions, and Anthropic has not commented publicly.

Fewer subagents: [Company claim] Anthropic published guidance this week saying that, across several enterprise deployments, a single agent with skills frequently beat multi-agent designs on quality, often at lower cost and latency; one customer saw roughly 2x faster runtime after switching to a single agent loop. Subagents still make sense when context bloat degrades performance, when tasks need to run in parallel, or when tool selection conflicts.

Competition: [Media report] The Information reports that OpenAI has used steep discounts to win coding workloads from Anthropic at companies such as Rippling and Replit, potentially deepening its own losses.

Sources: @AndrewCurran_ · @rohanpaul_ai · @theo · @pcshipp · @Pirat_Nation · @RoundtableSpace · @kimmonismus · Billboard · Rolling Stone · The Hollywood Reporter · REA discussions · Anthropic article · The Decoder · The Information

4. OpenAI: FBI weighs an economic espionage charge against the bugging suspect; Codex limits reset for everyone; GPT-6.1 Terra rumors

The espionage case: [Media exclusive] The Wall Street Journal (updated early on Oct. 25 Beijing time) reports that the FBI is considering adding an economic espionage charge against Abdulrahman Alfozan, who is accused of planting a listening device in an OpenAI executive conference room. An official said the investigation centers on whether he stole OpenAI information to offer it to the Saudi government, “even if he wasn’t recruited.” No such charge has been filed; the current charge is intercepting oral communications. Yonhap says he was arrested on Oct. 9 and denied bail on Oct. 19, that the Saudi consulate had offered to pay his bail, and that his lawyer will contest the charges. Ars Technica reports the FBI says he had a folder called “Saudi gov docs.”

Codex Day 20: OpenAI’s Tibo posted “Day 20/ Rest and reset” (9,987 likes, 959,000 views), later adding that it had fully rolled out: “Enjoy some mad codexing tomorrow. Fun week ahead too.” @reach_vb explained that as the clocks went back an hour, usage limits also went back to 100%.

GPT-6.1 Terra: [Unverified] @kimmonismus called it an “open secret” that OpenAI’s 28 days of Codex will end with a new model, and worried it might be GPT-6.1 Terra. @Mr_Salio and @LuminaBench said a commit by a GitHub employee configures Terra as a code-review model in GitHub Copilot, as a cheaper alternative to GPT-6.1 Sol; earlier in the week, LuminaBench reported that PR #39217 in Microsoft’s EF Core repository uses gpt-6.1-terra as an evaluation judge. OpenAI has not announced the model.

Trading barbs: [Joke] Tibo invited people who “have done similar things in the past” to help scale dots to 1 billion users (7,662 likes, 1.48 million views); dots is the always-on agent OpenAI launched for Pro users on Sept. 29. He also told Meta’s Alexandr Wang: “Step 1: Quit posting butts and go buy containers. Step 2: ??? Step 3: Celebrate your 12 users.” Wang shot back, “is the implication you have under 12 users?” and later posted, “someone should check in on tibo” (3,007 likes). For context, TechCrunch reported on Oct. 20 that Meta’s Muse app hit 10 million U.S. downloads in 40 days.

Sources: @Polymarket · @AndrewCurran_ · @DavidLawler10 · @thsottiaux · @thsottiaux · @reach_vb · @kimmonismus · @Mr_Salio · @LuminaBench · @thsottiaux · @thsottiaux · @alexandr_wang · @alexandr_wang · WSJ · Ars Technica · Yonhap · LuminaBench · ArtificialWatch · OpenAI: dots · TechCrunch

5. The compute ledger: GPU rents reportedly up 2–3x and Musk warns of “stranded compute”; Apollo sees “zero payoff” from AI outside tech; an RTX 40-series tensor “unlock”

Rents and capacity: [Secondhand rumor] @Yuchenj_UW relayed a “neolab” friend’s view: even if they fail to train the best model, they locked in GPU capacity early, H100/B200/B300 rental prices have since gone up 2–3x, and they can “just resell the compute and print money” (6,234 likes, 919,000 views). Musk replied that he expects “a lot of stranded compute in partially complete data centers” (11,140 likes, 2.18 million views), and shared a list of constraints on supercomputer build-outs — land, permits, grid access, transformers and switchgear, fuel security and more — saying that if anything is missing, “however seemingly trivial, the compute doesn’t work.”

Inference economics: [One-sided claim] Deedy Das said inference providers are popping up and reaching $1 million a month very quickly; even renting on-demand B300s at $8 per GPU-hour, serving open models such as GLM 5.3, Kimi K3 and DeepSeek 4.1 Flash / Pro can bring in more than $10–20 per GPU-hour.

Apollo’s “zero payoff”: [Third-party claim] Bloomberg reported on Oct. 25 that Apollo chief economist Torsten Slok says revenue per worker and profit margins are rising at the Magnificent Seven, but AI has yet to show a payoff for the S&P 500 companies outside tech.

RTX 40-series “unlock”: [Third-party claim] The GitHub repository JustAResearcher/gpu-unlock-ada says that without flashing the VBIOS — by loading a Linux kernel module and cold-booting — the RTX 4090’s FP16 tensor throughput (with FP32 accumulate) rises from 165.6 to 331.6 TFLOPS (our calculation: about 2.00x), and BF16 from 165.5 to 330.6. Real-world cuBLAS matrix-multiply gains are much smaller, 12–34% for FP16 and 16–20% for BF16, while INT8 and plain FP32 are unchanged. It is a port of Zagitta’s gpu-unlock for the 3090, which we covered earlier. A Chinese-language post by @NFT_Chen (7,248 likes, 821,000 views) claimed the 4080 SUPER gets 1.83x FP16 and doubled FP8, which does not match the repository: it lists only the 4090 plus an experimental 4070 Ti SUPER and 4060 Ti 16GB, and the 4070 Ti SUPER’s FP8 test barely moved (59.326 → 59.495). Another post said RTX 20-, 30- and 40-series cards have all been unlocked; we could not verify the 20-series figures.

Sources: @Yuchenj_UW · @elonmusk · @elonmusk · @deedydas · @DeItaone · @NFT_Chen · @Pirat_Nation · @LottoLabs · Bloomberg · Apollo Daily Spark · gpu-unlock-ada repository · ByteSprint analysis

6. Pushback in the community: r/opensource bans anything AI-related; a thousand mathematicians pledge not to work with AI companies

New r/opensource rules: The Verge reported on Oct. 25 that Reddit’s r/opensource posted new rules on Saturday evening: “If your project uses AI, is made by AI, or is intended for AI, it’s not welcome.” Projects must also be at least a year old, actively maintained and have multiple contributors, and non-English posts are barred. A rival, r/trueopensource, has been set up. @LundukeJournal (3,784 likes) and others pointed out that under the rule even the Linux kernel, which already accepts AI-assisted code, would be banned; Rich Geldreich, who has been coding since 1985, said he will keep using AI in all his open-source work.

Association for Human Mathematics: The AHM’s members page lists 1,008 members, 654 of them in its AI-free caucus (our calculation: about 65%). Members pledge not to work with commercial AI companies and not to publish AI-generated texts, and caucus members also do not use AI in their research; New Scientist covered the group on Oct. 20. Derya Unutmaz asked who would pay mathematicians to solve problems AI has already solved; François Fleuret said asking for AI-free spaces is legitimate, but that AI “has reached escape velocity in math.”

Sources: @LundukeJournal · @chasmmmmmmmmmmm · @richgel999 · @Hesamation · @DeryaTR_ · @francoisfleuret · The Verge · AHM members page · New Scientist

In brief

• vLLM matches DeepSeek’s own engine: vLLM says it matches DeepInfer, DeepSeek’s in-house engine, on DeepSeek-V4.1-Flash under DeepSeek’s decode configuration (batch sizes 8 to 256), using DEP32 against DeepInfer’s EP64DP64 (@vllm_project) [Company claim].
• SGLang matches DeepInfer too: It reports up to 1.04x DeepInfer’s prefill throughput on 4× GB300 and 4× B300, and up to 7.4% higher decode throughput on 64× GB300, with an end-to-end reproduction guide (@sgl_project) [Company claim].
• Kimi K3.1 Pro enters Agent Arena: Arena says Kimi K3.1 Pro (Max) landed at No. 11 with a 7.6% net improvement across more than 4,000 real agentic sessions and would be the new No. 1 open model on the board, ahead of DeepSeek-v4.1-Flash; others said many people find it disappointing (@arena · @scaling01) [Self-reported by the leaderboard].
• NVIDIA and TCV invest in Higgsfield: Both joined the AI video company’s Series B extension, amount undisclosed; Higgsfield says its annualized revenue run rate has reached $1 billion, calculated as the latest four weeks × 13 (@higgsfield · @alexmashrabov · Bloomberg · Higgsfield blog) [Company claim].
• Managed agents coming to Google AI Studio: TestingCatalog says users will be able to inspect and manage autonomous agents, their tools, environments and triggers from a dedicated Agents hub (@testingcatalog) [Unverified].
• Musk promotes Grok Bot: Musk posted “Try Grok @Bot,” drawing 6,837 likes and 1.79 million views (@elonmusk).

---

About this column and how we verify

• AI-assisted: AI Daily Brief is compiled with AI assistance. This issue was produced with help from Grok Bot and covers Oct. 24, 2026, 22:09 to Oct. 25, 22:05 Beijing time.
• Every tweet checked: Each cited tweet was read individually to confirm it exists, the author matches and it was posted within this issue’s period; all cited tweets were also read a second time through the X API, and authors and posting times matched. Like and view counts are as of about 22:12 Beijing time on Oct. 25. Multiples, percentages and other figures marked “our calculation” were computed by us from public numbers.
• X News summaries are leads only: X News summaries are generated by Grok and are used only to find leads; facts are based on the original posts, official pages, project repositories and media reports, and where a post conflicts with a primary source, the primary source wins. For example, one post said the RTX 4080 SUPER’s FP8 throughput also doubles, while the project repository has no 4080 SUPER data and its experimental 4070 Ti SUPER FP8 test barely changed; this issue follows the repository. Figures that appeared only in X posts with no primary source found (for example, one chipmaker’s purported investment in OpenAI and one firm’s estimate of AI asset impairments) were not used, and old news reposted as new (for example, Tesla’s Optimus training academy, which was discussed on its Oct. 21 earnings call) was left out. For topics carried over from earlier days, this issue covers only the new developments.
• Items involving Grok Bot: This column is produced with help from Grok Bot. Item 6 under In brief, which concerns Grok Bot itself, is included solely on the basis of a public post and is not an endorsement by this column; inclusion depends only on how much an item was discussed that day and whether it could be sourced.
• What the labels mean:
  • [Third-party claim]: Data or research results published by a third-party organization or individual, not independently verified.
  • [One-sided claim]: A claim from one side only, not confirmed by the other party.
  • [Allegation by one party to the lawsuit]: An allegation made by one party to a lawsuit, not yet decided by a court.
  • [First-person account]: The person’s own account, not independently verified.
  • [Unverified]: A rumor or lead not confirmed by an official or reliable primary source.
  • [Company claim]: Figures or statements published by the company itself, not independently verified.
  • [Media report]: A media report not publicly confirmed by the company involved.
  • [Media exclusive]: An exclusive report by a single outlet, not yet confirmed by other sources or officials.
  • [Joke]: A joke by the person, not a statement of fact.
  • [Secondhand rumor]: A relayed account from someone whose identity is unknown, not verified.
  • [Self-reported by the leaderboard]: Rankings and scores published by the leaderboard or evaluator itself, not independently reproduced.