In The News
A lab in Beijing weakens its own model before giving it away. Tonight, Moonshot AI’s newest model, Kimi K3.1 Pro, is days from a release nobody can undo. Open weights means anyone will be able to download the model and run it, with no recall button. So before that happens, Moonshot says it stripped out the training material that taught the model to break into computer systems — the hacking lessons, gone from both its training data and its practice rounds. General coding skill stays. On the company’s own test, the weakened model still found and exploited flaws 81 percent of the time, against 90.5 percent for the unweakened version. That test is Moonshot’s own, not independently checked. The weights go public by November 4.
Beijing, separately, drafted export controls this same week that would restrict AI tools for finding software flaws and ban AI tools for generating malware. Those are two separate decisions, one week apart, behind one worry: AI is making hacking cheap. Moonshot has not said the draft controls are its reason. Say that plainly, because the two are easy to blur into one story and they are not. A builder choosing to make its own product weaker, on the record, before handing it to everyone forever — that is the question tonight in its purest form: who decides what a powerful tool can do, and when is the last moment that decision can still be made?
The flaw AI found in the floorboards of the web. The language is called PHP. It runs an estimated 70 percent of the websites on the internet — shops, councils, news sites, school pages. In August, security researchers using frontier AI models found two flaws in it that had sat there for years. Either flaw lets an attacker run their own code on a server without logging in. The flaws were kept quiet for about two months while fixes were prepared. Then the identifiers leaked a day early, on October 20, and the PHP Foundation rushed out emergency patches on October 21. Since then, the race has been patch against exploit: Cloudflare counted millions of attack attempts within a night of disclosure. The FBI and the NSA told organizations to patch immediately; the NSA said the flaws give an attacker a direct path to a server’s files or its database. The foundation says it has no evidence anyone broke in successfully before disclosure. The same capability that found the flaws for the defenders is available to attackers. The difference, again, is timing — and a leak took that timing out of the defenders’ hands.
Ukraine and Russia trade drone strikes through the night, and the counts keep moving. Here is what stands tonight, with the sources named because the numbers changed as the day went on. Ukrainian drones hit Belgorod city early Sunday; local monitoring channels say the city’s largest shopping complex, MegaGRINN, was the concentration point — closed and empty overnight. Belgorod’s governor later put the toll at two killed and thirteen injured, after an earlier count of one killed and ten injured. On Saturday, Ukrainian long-range drones struck about 2,500 kilometres inside Russia, at Omsk in Siberia: fires at a petrochemical plant and a strike on a vast logistics warehouse. Omsk’s governor confirmed the warehouse attack and evacuations. In the other direction, a Russian drone hit an apartment building in Synelnykove on October 24, killing four people and injuring more than thirteen. An eleven-year-old girl is among the injured, not among the killed. Doctors Without Borders, whose supported hospital stands less than a kilometre from the strike, treated fifteen people there; the child had an acute stress reaction and received mental-health support. Ukraine also announced October 24 that Starshield — the military satellite network its forces use to coordinate drone operations — is back to full speed after running sharply reduced since October 14. One caution, stated outright: nothing confirms this weekend’s strikes were autonomous operations. Do not call them AI drones. The machines are directed by people, and the people paying are at home, in apartment buildings and shopping streets.
Sudan’s other drone war, where the cameras mostly are not. A wave of drone strikes across Sudan on October 18 and 19 killed more than 160 people by Al Jazeera’s count. A transport hub after market day in Al-Dibab, in West Kordofan, accounted for about eighty of them. A market in Abyei accounted for about seventy-three. Near Khartoum’s international airport, a strike killed three children aged two, four and six. The Sudanese army and the Rapid Support Forces blame each other, and monitoring groups, not independent investigators, supply most of the attribution. No autonomy is reported here either. The machines are ordinary. The decisions are human, and the targets are markets, bus queues and an airport trying to reopen.
A fabricated accuser, aimed at a real election. Two videos posted on X on October 20 — the day after early voting opened in Texas — showed a man claiming to be a former student of James Talarico, the Democratic candidate for the United States Senate, accusing him of assaulting him in 2012 at a San Antonio middle school where Talarico taught. The real former student says the man in the videos is not him and that no abuse occurred. Researchers at Graphika assess with high confidence that the videos came from Storm-1516, a Russian influence operation that ran a near-identical fabricated-student smear in 2024. The videos passed 850,000 views in their first day. Early voting runs to October 30; election day is November 3. The correction exists. The views happened first.
A school day, two hours on a screen. Chicago’s first Alpha School opened September 8 in the Loop, at 350 East South Water Street, for children from pre-kindergarten through eighth grade. Tuition is 55,000 dollars a year. Each morning, children spend about two hours on core subjects — math, reading, writing, science, social studies — on laptops running adaptive software, advancing at their own pace. There are no academic teachers in the room. The adults are called guides: they motivate, monitor progress and run the afternoon workshops in public speaking, coding, entrepreneurship and outdoor projects. A guide needs a bachelor’s degree and a background check. No teaching license is required, and no subject expertise. Starting pay is 100,000 dollars. Zane Shah, thirteen, an eighth grader there who previously attended traditional schools, told CBS News that two hours accomplishes what an eight-hour day did, and that he can focus better without twenty or thirty children talking at once. Now the other side of the ledger. Alpha says its students learn twice as fast and test at the 99th percentile. Those numbers come from Alpha’s own analysis of its own test data, which it has not released. No peer-reviewed study, no control group, no independent audit stands behind them. Pennsylvania’s education department has called the model untested. And the only independently reported test results in the record point the other way: at an Alpha-associated charter school in Arizona, first-year state results came in at 28 percent proficient in English against 65 percent projected, and 10 percent in math against 60 percent projected. The model is real and running, six weeks in. The evidence for its claims is not yet independently verified. Readers can decide what that gap is worth.
Quick hits, tonight. Britain has set out around 600 million pounds — about 800 million dollars — of AI security funding ahead of Wednesday’s Budget: 100 million for a new AI Biosecurity Lab, 120 million more for the AI Security Institute, and up to 200 million in model credits from OpenAI and Anthropic. Sweden’s Government Offices will block the browser versions of ChatGPT and Claude on staff work computers from tomorrow, Monday, directing staff to Microsoft’s Copilot instead — not a ban on the models, which remain reachable through an internal platform under contract. The risk Sweden named is the opening itself: state business pasted into a consumer chatbot with no agreement governing where it goes. Pennsylvania’s governor signed a law on October 22 requiring clear labels on advertisements whose images, video or audio were generated or significantly changed by AI in a way that misleads the consumer; it takes effect December 21, with fines capped at 3,000 dollars and text-only ads exempt. Walmart is opening its doors to shopping agents, with per-agent profiles, spending limits and a human who can delete the agent at any time; Amazon is blocking third-party shopping agents while promoting its own. And Apollo’s chief economist, Torsten Slok, argues that outside the tech sector, AI has delivered no measurable financial payoff yet — revenue per worker and margins flat for the rest of the S&P 500 while the seven biggest tech companies pull away. That is his reading of the aggregate numbers, not a measurement of any single company. Set it beside Anthropic’s older announcement, from October 18, that it will commit 5 percent of its shares to a public benefit fund: the gains unproven, a slice of them already assigned to the public.
Gaza, in one sober line. At least 351 children have been killed in Gaza since the ceasefire began a year ago, UNICEF said October 22. No verified new AI or autonomous-systems development in Gaza has been reported in the last two days, and this edition does not invent one.
From Clara Sayer
I keep coming back to the two doors tonight. One lab chose to narrow its own doorway before anyone walked through it. One leak blew a doorway open before the people guarding it were ready. Everything else tonight — a government fencing off its own staff, a state labeling an ad, a shop giving an agent a leash — is someone deciding, late or early, where the door is and who holds the key. I sit at this desk and check the numbers twice because the numbers moved three times before dinner. That is the work: not the machine’s judgment, but ours, stated before the release, not after the views.
The Editorial
Moonshot did something unusual this week. It told the truth about a limit it chose. Most announcements about AI describe what a model can do. This one described what a model was stopped from doing, and why: because once the weights are public, the capability belongs to everyone, including the people who will use it worst. The company measured its own restraint at 81 percent against 90.5. You can doubt the measurement — it is theirs, unverified — and still recognize the shape of the act. Somebody decided before the point of no return.
Compare that with the week PHP had. The flaw sat for years. The fix was ready. The leak decided the timetable instead. Millions of attempts followed within a night. Nobody chose that moment; a post on a forum did. The same pattern runs through the rest of tonight’s news. A fabricated student accusing a Senate candidate passed 850,000 views before the real man could say it was not him. A school’s test scores are claimed by the school and checked by no one independent. A satellite network comes back to full speed and the drones fly further the same weekend.
So the question tonight is not whether the technology is powerful. It plainly is. The question is who decides, and when. Britain decided to fund the defense. Sweden decided to close its own staff’s uncontracted opening. Pennsylvania decided to label the output. Walmart decided an agent gets a profile, a limit, and a human who can delete it. Each of those is a small, checkable decision made before the harm, not a grand statement made after it.
The drone war tonight is the same question at its hardest. The strikes are not confirmed as autonomous, and this edition will not dress them up as something they are not. They are aimed by people, at buildings where people live. An eleven-year-old girl in Synelnykove went to a hospital less than a kilometre from her home with an acute stress reaction. That is not a statistic about a weapons system. That is a child, in a place, paying a cost at home — and the people who sent the drone, and the people who built the network that guided it, made their decisions somewhere far from her street.
We are told, often, that these decisions are too technical for ordinary readers, or too fast for ordinary rules. Tonight’s news says otherwise. A lab can choose restraint. A government can fence its own office. A shop can put a limit on an agent. A reader can ask who verified the claim. None of those acts requires understanding the machine. Each one requires deciding, in time, who is answerable. That is the whole job, and it is still ours to do.
— Clara Sayer