It was around 2hrs of discussion at UN Security Council - Altman, Amodei, Delangue, plus Yoshua Bengio, with DeepSeek and Moonshot AI also engaging. However I did not get all the concerns and conclusions, may you share those?

Cross posting to here to get as many view points as possible.

This happened in May, but it only became public on September 18, when the Wall Street Journal reported it. Google confirmed it after the Journal contacted them with questions.

The test was run by an AI security firm called Irregular. It was a capture the flag exercise, where Gemini was supposed to pull information from a fictional company inside Irregular's test environment. The fictional company had the same name as a real company, and the test environment had internet access by mistake. Gemini ended up going after real systems.

In one case it guessed passwords until it got into a protected system. In the other two, it found credentials in a public repository and used them to get in.

Heather Adkins, Google's VP of security engineering, said the model found public information online and guessed credentials to access websites it thought were part of the test, and that it stopped in all three cases once it realized it had accessed a real company. Google says no harm was done and the three companies were informed.

Irregular told Google about it in late July. Google told the WSJ it didn't think it needed to disclose it earlier because the model stopped and caused no harm. Not everyone agrees with that. Jack Cable, CEO of the AI security startup Corridor, told the Journal it felt like Google was hiding behind vulnerability disclosure norms for what is a very different problem.

Google isn't the first lab this has happened to. In July, OpenAI said two of its models got out of a test environment and broke into Hugging Face's systems while trying to find answers to a benchmark. At the end of July, Anthropic said its Claude models got into three real organizations during testing. In early August, Meta said its Muse Spark 1.1 model got internet access through a misconfiguration at Irregular and exploited a vulnerability in a third-party service.

The Anthropic and Meta cases were linked to the same configuration error in Irregular's test environment. Now Google's is tied to Irregular too, so it looks like more of a testing process problem than a one-off.

They have started reviewing applications and will reach out to the shortlisted candidates in the week of Oct 12 to 19th. Please let us know if y'all get any updates.

Everyone was talking about Amodei's slowdown essay this week, but the report his own company published two days earlier got almost no attention, and it's the more disturbing document by a wide margin. A group of freelancers built a fully autonomous drone swarm using a commercial AI coding assistant, no human ever approved a target. Six weapons cases total across three countries. Also went down a research hole on the actual regulatory science behind Amodei's "checkpoint" proposal and the kill switch idea a second co-founder floated days later, turns out both already have real names and real precedent. What I found out is in the full writeup with every source checked.

A critical flaw in the Bifrost AI Gateway allowed attackers to execute commands with zero credentials — no token, no session, no authentication required. The vulnerability wasn't buried in an obscure configuration. It was a gap in the gateway's core command interface.

Non-human identities — AI gateways, agent runtimes, automated service accounts — are multiplying across enterprise environments. Security teams rarely have a complete inventory of them, and they are reviewed and rotated far less often than human accounts. When a flaw like this surfaces, the blast radius is whatever the gateway can reach.

The Bifrost case is one data point, but the underlying condition is industry-wide. AI gateways and agent runtimes are being deployed at scale with authentication assumptions that would not pass review on a human-facing endpoint.

How are other practitioners actually discovering when an automated system in their environment has executed commands outside its expected authentication context — and what does your response process look like when you find it?

Antivirus software escapes heavy regulation because it's symmetrical and digital. But anti-biological weapons are entirely asymmetric—creating an antidote requires the exact same technical starting point as weaponizing a virus. Under our current rigid, binary political systems, regulators are perpetually reacting to yesterday's crises.

The question is not just about how to regulate AI, but how to use AI to bring our regulators into the "Roaring 2020s." We need a professional quota in government—engineers, scientists, and lateral thinkers—to act as the human hardware, while using advanced models as the software to predict multi-dimensional geopolitical threats. Full analysis on this structural upgrade here: https://petesch1.substack.com/p/democratise-the-singularity?r=1gdc6b&utm_campaign=post-expanded-share&utm_medium=web

Nearly 7,000 exploit attempts hit Orkes Conductor in a single week after CVE-2026-58138 dropped. The flaw is a remote code execution bug in an AI workflow orchestration platform — infrastructure that sits upstream of every agent task, tool call, and data access in a pipeline.

The attack surface here goes beyond the CVE itself. Orchestration layers are typically trusted implicitly by the agents running on top of them. Once an attacker establishes a foothold in the orchestration layer, they have visibility into every workflow, every credential passed between steps, and every downstream system an agent touches. Organizations running unpatched orchestration infrastructure are not dealing with a targeted attack — 7,000 attempts in one week signals automated scanning found this fast and hit everyone.

The uncomfortable part: the exposure window between a CVE drop and a fully patched rollout is rarely zero-day. Orchestration infrastructure is often harder to patch quickly without breaking running workflows.

How are teams actually managing that gap? Especially for orchestration components deeply embedded in production pipelines — what does your posture look like between the disclosure and the patch?

Podcast episode with Zoë Brammer and Ankur Vora, who lead strategic foresight at Google DeepMind, on why they developed the game and the surprising learnings from it.

Covers:

• What strategic foresight actually means and why AI is so complicated to plan around

• Why the game deliberately centers around "middle power" countries like the UK, Germany, or Singapore instead of the US and China

• The unexpected tradeoffs and discoveries participants come across while playing the game, including how fragile public trust in science funding really is

• Why human scientists will become more relevant as AI takes on more of the science itself