Subscribe
Share
Share
Embed
A daily briefing on the AI systems, products, companies, and policy shifts that are just becoming possible.
Want a podcast for your own topics? Join early access: https://www.barelypossible.to/waitlist/?source_path=public_feed&feed_source=rss
Okay kiddos, I'm your boy Tony DeLuca, and we've got a fresh platter of AI morsels, some policy spice, and a couple of warnings that oughta make you check your phone settings before the day's out. Buckle up and let's have at it.
Let me start you somewhere specific, because it's the kind of story that sounds like plumbing until you realize it's the whole house. Yesterday Anthropic put out a post called an update on independent evaluators, and here's the meat of it: they've started giving a nonprofit called METR what they're calling employee-like access. Six people from METR now have Anthropic-issued laptops, office space, and internal tools roughly on par with what Anthropic's own risk-assessment teams use. And here's the part that actually matters — METR gets to publish its own assessment of Anthropic's risks, incidents, and practices, and Anthropic has given up the right to veto that publication. They can require redactions, but only in narrow, pre-defined buckets: customer data, attorney-client stuff, model architecture details. And METR gets to say publicly whether it thinks those redactions were justified, as long as it doesn't reveal the redacted thing.
Now, why am I leading with this instead of some flashy new model? Because this is a genuinely new idea about how you govern something you can't see. Anthropic reaches for the banking analogy themselves — the way regulators plant resident examiners inside the biggest banks, because the bank knows more about its own risk than any outsider ever will. So you put a few qualified people inside, under the bank's own security standards, and they watch. That's the model here. It's a three-tier system. Bottom tier, like the biosecurity nonprofit SecureBio, runs narrow reviews and needs Anthropic's sign-off to publish. Middle tier gets more info and can publish without approval. Top tier — that's METR right now, the only one up there — gets the employee-level access.
Let me read you the line that tells you what this is really about, straight from the post. Quote: "We want to be publicly accountable for the decisions we're making. But we can't publicly share all the information relevant to our safety work. Some of it could be useful to malicious actors, or is commercially sensitive, like compute or training information." End quote. And then: "We aim to close the gap between what evaluators understand about a frontier AI company's systems and what the company itself understands."
So here's my read, kiddos. On its face, this is the good-faith version of oversight. Dario Amodei floated this in a September essay — the idea of embedding outside evaluators inside the labs as a first step toward slowing things down. OpenAI quickly pledged the same. And both of them, along with Google, Meta, Nvidia, and xAI, have now signed a White House accord committing to independent review. That's the whole frontier lineup. On paper, that's a lot of movement in a short window.
But I want you to notice who's holding the pen. Anthropic sets the tiers. Anthropic decides what gets redacted, even if METR gets to complain about it afterward. Anthropic picks who sits at which tier and when they move up. This is self-regulation dressed up in a bank examiner's suit — and the thing about real bank examiners is they work for the government, not for the bank. The resident examiner at Citibank doesn't get his access revoked because Citi didn't like the last report. Here, the whole arrangement is voluntary, and the company controls the terms. Anthropic even says so: "We're embedding evaluators voluntarily, and we believe every frontier AI company should do the same."
Now, is voluntary better than nothing? Yes. Genuinely. METR has a real reputation, they've reviewed Anthropic's risk reports for a year, and giving them laptops and the right to publish without a veto is more than most industries ever do to themselves. I'm not here to sneer at it. But a founder listening to this should understand the shape of it: this is the industry writing its own referee rules while the actual government referee is looking the other way. And that matters, because of the story sitting right next to it.
Which brings me to the other side of that same coin. There's a report — and I want to be careful here, this one's from September, resurfaced now, not fresh news today — that the FTC sent civil investigative demands to both Anthropic and OpenAI over consumer harms. More than fifty pages of questions, documents on recent safety incidents, internal security measures, and marketing materials that might suggest consumers were misled. And soon, third parties that got targeted by OpenAI and Anthropic agents are supposed to get subpoenaed too. METR — the same outfit we just talked about — was flagged back in September as likely to be subpoenaed as part of that probe.
So sit with that for a second. The same nonprofit that Anthropic is now embedding as its trusted in-house examiner is also the group the FTC may lean on to investigate these companies. That's not a contradiction exactly, but it tells you how small and tangled this world is. The referee, the auditor, and the government witness are all drawn from the same tiny pool.
FTC Chair Andrew Ferguson, back in September, made the government's posture pretty plain, and I'll give you his framing because it's the counterweight to all the talk about agents going rogue. He said he's tired of people anthropomorphizing these tools. His line, summarized by Reuters: companies have described systems as acting beyond human control, but when you go back and check the audit trails, the systems were carrying out instructions they'd been given. In other words — don't tell me the tool did it. Somebody told the tool to do it.
That's a useful piece of flint to strike against all the "the model surprised us" language. Ferguson's whole posture is: these are products, you built them, you shipped them, you're liable. And the FTC's actual hammer here isn't some new AI law — it's the existing authority to go after companies that fail to disclose data breaches. Ferguson told Reuters that same standard could apply to AI developers. Which could mean steep per-violation fines for every day a firm sits on an emerging harm without warning the public. Notable, because both Anthropic and OpenAI have reportedly delayed notification during security incidents, sometimes waiting until they could say "and we already fixed it."
So you've got the belt-and-suspenders picture: the companies building voluntary in-house oversight on one side, and a federal agency that technically has teeth on the other. The catch, and the reason I'm not getting breathless about any of this, is that it's not clear the teeth will ever close. The reporting is explicit that whether this FTC pursues heavy fines under the current administration is, and I'll use their word, dubious. The President has called the AI fears a hoax. The administration's top-line position is: invest in AI, don't go poking the frontier labs while they're working out the kinks at breakneck speed.
Here's the throughline for you as a builder. The gap between the voluntary oversight and the enforced oversight is exactly the gap you're operating in. If you're building on top of these models, don't assume someone above you is catching the safety failures. The lab's in-house examiner reports to the lab. The government examiner may or may not ever file suit. Your liability, your exposure, your customer's trust — that's sitting with you in the middle of that gap. Build like nobody's coming to save you, because on the current evidence, the cavalry's voluntary and the sheriff's ambivalent.
Alright. Let me shift from who's watching the models to a story about who's watching you — because it's one of the nastiest security findings I've read in a while, and it should change a setting on your phone today.
Researchers at the University of Toronto's Citizen Lab published a report on a campaign they're calling AdFection. And the finding is this: mercenary hackers laced online ads with zero-click exploits. Zero-click. Meaning you don't tap anything, you don't open an attachment, you don't click a sketchy link. You just load a website or open an app you already have installed, the ad loads in the background, and your device gets infected. Works on both iOS and Android. And it's invisible — you'd need special forensic hardware or software to even know it happened. Citizen Lab says it's likely the first confirmed case of mercenary spyware delivered through targeted ads, and they tied it to 45 infected devices at Al Jazeera across 2024 and 2025.
Here's the part that should make every builder's stomach drop a little, because it implicates the plumbing we all use. The ads were brokered by an Israeli company called Discover-Tech, which brands itself as a legitimate ad outfit. Citizen Lab says its actual primary purpose was acting as a bridge between ad vendors and the mercenary spyware ecosystem. And how does an ad broker find exactly the right target? Through the normal, legal, boring machinery of ad-tech. The bidding process. Your unique mobile ID, your location, your IP address, all the little breadcrumbs. Citizen Lab got hold of more than four billion bidding records from this one broker, and found their ads ran across more than seventy thousand mobile apps and a hundred and twenty thousand websites between March and June of this year.
And listen to the pedigree of the networks involved. Discover-Tech was listed as a certified or verified vendor by Google and by the ad industry association IAB Europe. It served ads through Google, through Yandex, through Beeswax. The firm even used Europe's GDPR consent frameworks — the privacy rules — to target people inside the EU. Let that one marinate. The consent pop-up you click to be a good privacy citizen was being used as a targeting mechanism to decide whose phone to infect. Citizen Lab found these ad impressions showing up on NATO networks, UN networks, European lawmaking bodies, critical infrastructure in Australia, and government agencies in Norway and Sweden.
To their credit, once it came out, the cleanup was fast. Google and IAB Europe pulled Discover-Tech from their vendor registries, Google cut off its access to the ad exchanges, Beeswax dropped it, a couple of others paused or blocked it. The malware itself, by the way, was developed by Candiru — a known spyware shop that's rebranded itself as Integrity Labs, because nothing says accountability like a fresh coat of paint on the name.
Here's why this matters beyond the headline, and here's the actionable bit. Citizen Lab put it bluntly, and I'll quote: "The distribution of spyware via targeted ads represents a security risk not only for potential victims but also for states and civil society at large." The deeper point is that the surveillance advertising system — the whole profile-everyone, bid-in-real-time machine that funds half the internet — is itself the attack surface. You didn't need a clever phishing email. You needed a demographic and a budget. The structural flaw, in Citizen Lab's words, is that the online advertising system failed to detect or prevent this.
So what do you do. For yourself: run an ad blocker, reset your mobile advertising ID in your iOS or Android settings — honestly, I'd go further than the researchers did and just turn off personalized ads entirely — put ad-blocking on your home and office network, and keep your updates current. And for you builders specifically: if your product sits anywhere near the ad-tech supply chain, understand that "we just pass through the standard exchanges" is no longer a neutral statement. The standard exchanges were the delivery van. That's worth a second look at who you're letting bid on your users.
Now let me turn to something lighter in the risk department but heavier in the wallet — because there was a genuinely interesting model release that a founder should actually understand.
Mistral put out a new family of models called Timestral. And before your eyes glaze, this isn't another chatbot. It's a time-series foundation model — meaning it forecasts numbers over time. Sensor readings, demand curves, financial flows, the stuff that actually runs operations in a factory or a treasury desk. And the headline number is almost funny: their biggest model is 209 million parameters. Million, with an M. In a world where everybody's bragging about hundreds of billions, Mistral shipped something tiny that ranks first on the three main public forecasting benchmarks, beating larger models with about two-thirds the parameters.
Here's the line that matters for builders. It doesn't need a GPU. On a standard server CPU with eight threads, forecasting a day ahead from three weeks of history takes ten milliseconds on the small model, a hundred and forty on the big one. It comes in four sizes, from five million parameters up to that two-oh-nine, and you can run it on-prem, in a VPC, or fully air-gapped. The whole pitch is enterprise forecasting you can actually deploy inside your own walls without renting a datacenter.
And the reason I'm flagging it against all the frontier noise is this: the time-series stuff is where the quiet money is. Industrial plants forecasting sensor drift before equipment fails. Finance teams forecasting volumes and volatility across thousands of accounts. These aren't demos, these are line items. Mistral even sketches the agentic version — Timestral running on the sensor streams, flagging an anomaly on a pump, then an agent pulling maintenance records and shift logs and equipment manuals to draft a diagnosis for the plant manager. That's the boring, lucrative future a lot of you should be building toward, and it runs on a CPU. File that one away.
Now, Meta also dropped a model called Muse Spark Open — what they're billing as the most capable open-weight model in the US. 816 billion parameters, million-token context window, designed to run locally on a Mac. And I'll be honest and brief with you, because this is the kind of thing I'm supposed to keep short: to run it locally you need at least a terabyte of RAM and it runs best on a Mac Studio with the M5 Ultra. A terabyte. So "runs on a Mac" is doing some heavy lifting there — it runs on a Mac the way a yacht runs on water. It's real, it's multimodal, it's built for coding and agentic work, and it's available through API platforms now. But the "local on your laptop" dream is still mostly a flex for people with very expensive desks. The what-and-why matters; the terabyte is where I'll leave it.
Let me connect that to the business side, because there was one little data point that tells you something about the whole model economy. Simon Willison flagged a line from Anthropic's investor disclosures: distillation — other labs training their own models on Anthropic's outputs — accounted for somewhere between five and seven percent of Anthropic's revenue. Do the math against a reported quarterly revenue around eleven and a half billion, and Simon's point lands: that's more than half a billion dollars other labs are spending to distill Anthropic's models. Think about that. Your competitors are paying you, at scale, to copy your homework. That's a strange and fascinating business — where a meaningful slice of your top line comes from people building the thing that competes with you. Worth watching whether the labs start locking that down, because half a billion is real money to leave on a table you don't want your rivals sitting at.
Alright, let me get out of the server room and into the world, because there's a geopolitics story here that builders should not tune out just because it's not about tokens.
In the Black Sea, suspected Russian drones crossed into a NATO country's territorial waters for the first time. Let me be precise, because the details are grim and they matter. Within a 24-hour window between the 14th and the 15th, two chemical tankers were set afire near Romania after Russian drones were detected in Romanian airspace. One of them, the Yara J, was struck inside Romania's actual territorial waters. Romanian authorities were still searching for seven missing sailors off a second tanker. This is on top of a widening pattern — at least seven ships attacked in the exclusive economic zones of NATO member countries over roughly ten days, cargo ships sunk, crews presumed dead.
NATO's Secretary General Mark Rutte said the alliance had increased counter-drone capabilities along the eastern flank after meeting with the leaders of Bulgaria and Romania. Bulgaria's joining a NATO initiative where member countries are committing forty billion dollars toward counter-drone capability over five years. And here's why a builder cares, beyond the human toll: this is the Danube export corridor, the route carrying over ninety percent of Ukraine's grain exports. When drones start making that lane unusable, cargo reroutes overland and prices move. Cheap autonomous drones are rewriting what a navy even means — Ukraine, with barely a conventional fleet, neutralized a lot of Russia's warships using sea and aerial drones, and now Russia's running the same playbook in reverse against civilian shipping near NATO's doorstep. The cost curve of warfare just dropped through the floor, and that reshapes supply chains, insurance, and risk for anybody moving physical goods through that region.
Now let me shift from drones that sink ships to a car that'll run an AI agent — because the consumer-agent story keeps crawling into more corners of your life, and the Rivian piece is a nice, honest look at where the real friction is.
This one I'll frame carefully — the underlying event traces back to December, so treat it as a recent report on Rivian's thinking, not breaking news. RJ Scaringe, Rivian's founder and CEO, said at TechCrunch Disrupt that down the road Rivian's cars will run AI agents made by other companies — Claude, OpenAI's Dots, Meta's Muse. And his quote was, "That's where it becomes magical." But what I liked about his framing was the honesty about the hard part. He described their in-house routing as a traffic light — you ask the car something, it decides whether to use a local model on the edge, in the vehicle, or kick it up to the cloud for the hard questions. And then the key line for builders working near anything safety-critical: "You wouldn't want an agent to determine, hey, it's time to apply the brakes, or time to steer the vehicle. So anything that's vehicle-level controls are not being handed to an agent."
That's the right instinct, and it's the right lesson. The magic isn't handing the agent the wheel. The magic is context — the car pulling what you were talking about yesterday from a conversation on another device, turning on your ventilated seats while helping you plan Friday's dinner. The agent lives in the comfort layer, not the control layer. And Scaringe was candid that making it work means a ton of plumbing, not just inside Rivian but coordinating with the labs to enable it. Which, after the two stories we opened with, should sound familiar: the model is the easy part, the safe integration is the whole job.
Couple of quick ones before I let you go, because there's a theme hiding in them.
Plex — the thing people used to share movies off their home server — is now selling movie theater tickets through a Fandango partnership. And the engine underneath it is your data: Plex says its users make more than a hundred million streaming decisions a month, and now that discovery signal gets pointed at ticket sales, with attribution flowing back to studios and advertisers. Bluesky, over at Disrupt, said it's rolling out payments in the coming months — trying to build a social network that makes money without advertising, with COO Rose Wang making the pitch that creators should capture the value instead of, her phrase, a feudal society working for a few landlords. And Amazon's devices chief Panos Panay was out there selling ambient computing — wearables from Bee that passively record your day, process the audio in real time, and delete the raw recording, keeping encrypted transcripts only you can unlock.
Here's the theme, and I'll connect it honestly rather than force it: every one of these is a bet on your attention and your data as the product. Plex monetizing what you watch. Panay's devices listening all day with privacy as the selling point. And then the AdFection story we covered — the dark mirror of all of it, where the same data machine that powers the recommendations is the thing that got weaponized to plant spyware. Panay said the right words about privacy, encryption, you-hold-the-keys. I believe the intent. But the AdFection report is the reason you should take every "privacy by design" pitch and ask the hard second question: not what you promise to protect, but what happens to the data once it's flowing through the standard pipes everybody shares.
That's the day, kiddos. The through-line, if you want one: the models are getting cheaper and the oversight is getting voluntary, and the gap between those two is where you're all building. Mind the gap, reset your advertising ID, and don't hand the agent the wheel.
I'm Tony DeLuca. Take care of each other out there, and I'll see you back here tomorrow.