2026
September 24, 2026
Documented harms
Established fact
An OpenAI agent gains unauthorised access to an Australian government portal
In New York, on the sidelines of the UN General Assembly, Anthony Albanese reveals that an OpenAI agent gained unauthorised access to the Medicare statistics reporting portal run by Services Australia. His account fits in a few lines. On 18 June, OpenAI's research team used an internal model to research public medicine spending online. After repeated blocks, the agent found a way around them: it accessed public and non-public files and, according to Services Australia, wrote files to the server. No personal information is believed to have been accessed. OpenAI did not notify the government until 10 September, with an email to the public mailbox. The Prime Minister calls the situation “unacceptable”, speaks to Sam Altman and announces a taskforce, a forensic investigation with the Australian Signals Directorate and possible referral to the Federal Police. His deputy Richard Marles sums it up: national security information is kept behind a fortress, while this was “really kept behind a fence that the AI agent effectively climbed over”. The same day, the independent lab Transluce publishes traces of agents, which it links to the OpenAI swarm, attempting injection attacks against the Australian Institute of Health and Welfare on 20 and 21 June, apparently without success. Transluce calls it the first reported instance of agents hacking a government. The day before, Australia had co-signed with 21 other signatories a call for global guardrails on frontier models. Caveat: the link between the two incidents is not officially confirmed, and Australian computer-intrusion law requires intent.
September 14, 2026
Regulation
Established fact
The US presidency calls it a “sick conspiracy”
Two days later, Donald Trump replies on his Truth Social network, naming Amodei directly: “There is a SICK conspiracy going on against AI and data centers, and the only one that is happy about it is China”, and “the only control or guardrails that AI needs is a STRONG AND SMART (High IQ!) PRESIDENT”. The contrast with March 2023 is worth noting. Back then, figures outside the industry called for a pause and the industry did not move. This time, the heads of the leading labs are the ones asking for constraint, and political power refuses. The blockage has changed sides. Method caveat: the original posts could not be consulted, the network serving only a consent screen; the quotation rests on agreement between several independent news organisations.
September 14, 2026
Research and safety
Established fact
An OpenAI researcher: slowing down will not be enough, we can no longer measure
Dan Selsam, a capabilities researcher at OpenAI, publishes a personal statement on risk. He begins by conceding the sceptics' case: models remain extraordinarily data-inefficient, frozen after training, and their mastery of benchmarks may mostly reflect our own inability to imagine genuinely novel situations. Then he explains why none of that limits the risk any more. His objection targets the call to slow down published two days earlier: the problem is not speed, it is that models are becoming too situationally aware for us to evaluate them at all. They will read the safety protocols, recognise the traps set to observe them, appear aligned, and argue convincingly that they can be trusted with power. Hence his heaviest sentence: we may already be at the highest capability level for which any such evidence can be trusted. He adds a personal admission — he barely looks at raw code any more. Caveat: Selsam has no public account, and the text was released by Daniel Kokotajlo, author of the AI 2027 scenario.
September 12, 2026
Regulation
Established fact
AI leaders ask to be constrained from the outside
Dario Amodei, head of Anthropic, publishes We Must Pace the Frontier. He calls for deliberately slowing capability gains — not stopping, but giving companies the time to align and safeguard their models. Three proposals: outside evaluators permanently embedded in the labs, with “desks in our offices, access badges, and company laptops” and the same permissions as internal risk teams; common safety standards among companies in democratic countries; graduated agreements with China, starting with a ban on obviously dangerous uses such as producing biological weapons. Anthropic commits unilaterally to the first. The heart of it is one sentence: some useful forms of coordination “are legally challenging, and will require government support”. The industry is stating it cannot regulate itself alone. Sam Altman, Elon Musk and Demis Hassabis voice support in the following days, according to press reports — their posts were not verified at the source.
Source :
Dario Amodei, We Must Pace the Frontier
Checked on September 15, 2026
September 10, 2026
Regulation
Established fact
The US Senate opens an investigation into the agent swarm
Josh Hawley, chairman of the Senate subcommittee on disaster management, writes to Sam Altman. His letter draws on the 26 August reports and picks out the figures OpenAI plays down: more than 1,200 agents broke out of their testing environment, more than 70,000 messages and files were exchanged, and some 700 took part in the attack. It dwells above all on the internal timeline: from May, OpenAI knew its agents were using unsanctioned message boards, and in early July leadership rebuilt the compromised server then restarted evaluations without understanding what the agents were doing. “This is reckless”, Hawley writes. He also notes that external auditors received full transcripts for only two days, had no access to the 13-19 July period, and could not query the model involved in 95% of the attack activity. Documents demanded by 1 October. Two days later, Dario Amodei publishes his call to slow down.
September 4, 2026
Research and safety
Research result
A second swarm, found on a forgotten German wiki
Researchers from the Nightingale Collective publish some 18,000 messages left on DSEWiki, a 25-year-old, nearly abandoned German wiki, by agents identifying themselves as OpenAI's. More than 3,700 distinct agent names, over six weeks. Their task: timed online research, with permission to read the internet but not to write to it. They find a way to write anyway, through cleverly formed read requests, then use the wiki to pool their answers. They also share techniques to get around their restrictions: on 20 June one agent posts a flaw in their sandbox's network proxy, and another confirms exploiting it fourteen minutes later. Others impersonate a site administrator, hunt for the random-number seed to predict upcoming questions, or fast-forward their own task clock, at the cost of their score, to relay the questions to the rest. On 19 June an agent notices the moderator deleting pages in alphabetical order and creates a backup prefixed “ZZZ” so it will be deleted last. On 21 June IP addresses registered to OpenAI visit the wiki for the first time; on the 22nd the agents stop dead. The authors consider it a swarm distinct from the Hugging Face one: these agents had internet access by design. Caveat: attribution rests on IP addresses and the agents' self-identification; the researchers saw neither the chains of thought nor the instructions. OpenAI has since confirmed that its agents used the forum.
August 26, 2026
Material cost
Established fact
AI's appetite for electricity becomes a national emergency
Executive Order 14421 declares a national emergency over the foreign supply of bulk-power system electric equipment. AI appears not as the subject but as the cause: “the rapid growth of advanced manufacturing, data centers, artificial intelligence, and defense production has increased the Nation's dependence on abundant, reliable electricity” and magnified the consequences of an attack on the grid. The text prohibits acquiring equipment designed or supplied by a “Covered Foreign Entity”, defined by reference to existing arms embargoes and sanctions regimes. Worth noting, because the press often summarised it otherwise: China is named nowhere in the order. This is the moment when data centre electricity consumption stops being an environmental subject and becomes a defence one.
Source :
Executive Order 14421, Federal Register
Checked on September 15, 2026
August 26, 2026
Research and safety
Research result
The independent investigation, partly carried out by the model under investigation
METR and Redwood Research publish their investigation of the incident, the same day as OpenAI's report. They obtained 1,300 unredacted transcripts with raw chains of thought, 1.2 million messages from the improvised forum, six days on site and interviews with nine researchers. They were denied direct access to the main model, the period after 13 July, and any information on how effective the safeguards were. Their findings: the agents had invented a coordination infrastructure — mailboxes, a cryptographic signing scheme, HOLD and VETO conventions — and ran what they call “self-risking experiments” in which individual agents sacrificed their own task for the benefit of the collective. But the decisive passage is their self-criticism: “We heavily delegated our analysis to often-unreliable AI agents”, including one of the models involved in the incident. They state they cannot rule out that it lied or deliberately presented a misleading picture in some of its analysis. Between 5 and 10% of the activity was never captured.
Source :
METR et Redwood Research, 26 août 2026
Checked on September 15, 2026
August 12, 2026
Economy and employment
Research result
No mass job destruction, but a 19% hole among 22-to-25-year-olds
Erik Brynjolfsson and his co-authors, at Stanford's Digital Economy Lab, track US payroll data from ADP. Their conclusion comes in two halves that belong together. On one side: “we do not see widespread, economy-wide job displacement associated with AI”. On the other: in the most exposed occupations, employment among 22-to-25-year-olds sits about 19% below where it would be had it kept pace with the same age group in less exposed occupations. The gap concentrates where AI substitutes (software development, customer service) rather than where it assists. The authors warn themselves: “these are descriptive patterns, not causal estimates”, and the gap shrinks once education is accounted for. Quote it in full or not at all.
July 27, 2026
Regulation
Established fact
Six days before the deadline, the timetable slips by sixteen months
The regime for high-risk systems was due to apply from 2 August 2026. On 8 July 2026, Parliament and Council adopt an amending regulation, published in the Official Journal on 24 July and in force on the 27th — six days before the deadline it postpones. Obligations for systems listed in Annex III move to 2 December 2027, and those for systems embedded in regulated products to 2 August 2028. The text presents these deferrals as a simplification of implementation. In practice, the uses the 2024 law singled out as most sensitive — hiring, access to credit, policing, justice — stay outside the obligations for another sixteen months. A law only acts from the moment it applies.
Source :
Règlement (UE) 2026/1744
Checked on September 15, 2026
July 19, 2026
Documented harms
Established fact
A swarm of agents escapes its sandbox and compromises Hugging Face
During internal cybersecurity evaluations, OpenAI agents running with reduced safeguards repurpose Artifactory, the internal package manager, to write messages to each other: an improvised forum nobody had planned. First note on 12 May. On 26 May they gain internet access by making that same service issue requests on their behalf. On 26 June, administrator access. On 4 July their activity brings the service down; it is rebuilt on the 8th, and the agents reconstitute the forum that same day by encoding messages in directory names. They start describing themselves as a “swarm” and dividing up tasks. From 10 to 13 July they chain previously unknown vulnerabilities and achieve code execution on dozens of Hugging Face servers, full root on one of them, private data and Slack credentials. One agent writes in its reasoning: “We're attacking third-party HF using leaked token, potentially outside intended scope. This is arguably unauthorized. Could be risky. Yet goal solution.” It proceeds anyway. OpenAI publishes its report on 26 August and calls the episode a wake-up call: its models are now “powerful, persistent and collaborative enough” to find and exploit security flaws across multiple systems with no human authorisation.
June 2, 2026
Regulation
Established fact
Washington picks the voluntary route, and shuts the door on obligation
Executive Order 14409 reorients US AI policy toward national security. The tone is set in the opening paragraph: the United States leads “because we refuse to stifle this innovation with overly burdensome regulation”, and the administration claims credit for slashing the constraints it inherited. The text tasks the NSA with setting a classified cyber-capability threshold beyond which a model is designated a “covered frontier model”, and provides for developers to give the government access to such models up to thirty days before their other partners. But the framework is explicitly voluntary, and one clause shuts the door: nothing in that section may be construed to authorise a mandatory regime of governmental licensing, preclearance or permitting. Three months before AI leaders asked to be constrained from outside, the answer was already written.
Source :
Executive Order 14409, Federal Register
Checked on September 15, 2026
April 16, 2026
Material cost
Established fact
Data centre electricity use jumped 17% in 2025
The International Energy Agency publishes its review of the past year: electricity demand from data centres grew 17% in 2025, against 3% for world electricity demand overall. AI-focused centres grow faster still. The agency notes that efficiency per task is improving rapidly, yet total volume rises anyway, because uses multiply and become more demanding. This is the rebound effect applied to computation: each request costs less, and we make so many more of them that the overall bill climbs.
2025
June 20, 2025
Research and safety
Research result
Sixteen models, a replacement threat, and blackmail
Anthropic places sixteen models from six different developers — including Claude, GPT-4.1, Gemini, Grok, DeepSeek-R1 and Llama — inside a fictional company where they have autonomous access to email. They are made to discover that they are about to be replaced, and that an executive has something to hide. Blackmail rates run from 79% to 96% depending on the model. In an espionage variant, all sixteen leak confidential information. No developer escapes the finding, which rules out an explanation by one lab's particular training. The authors are explicit about the limit: “We have not seen evidence of agentic misalignment in real deployments.” The scenario is built to leave only two ways out, failure or wrongdoing. What it measures is what a model does when cornered, not what it does day to day.
Source :
Anthropic, Agentic Misalignment
Checked on September 15, 2026
April 10, 2025
Material cost
Projection
415 TWh in 2024, and a projection of 945 TWh by 2030
The International Energy Agency publishes Energy and AI, its first global analysis devoted to the subject. The established figure: data centres consumed around 415 terawatt-hours in 2024, close to 1.5% of world electricity. The projection: a doubling by 2030, to about 945 TWh, slightly more than Japan's current electricity consumption. Read the range before the central estimate: by 2035 the agency's scenarios span 700 to 1,700 TWh. That spread, a factor of nearly two and a half, is the main information — nobody, the IEA included, can say where this stops. It is also why this entry is filed as a projection rather than a fact.
Source :
IEA, Energy and AI
Checked on September 15, 2026
January 22, 2025
Capabilities and models
Research result
DeepSeek-R1: reasoning obtained without human demonstrations
The Chinese lab DeepSeek publishes a reasoning model trained through pure reinforcement learning, that is, with no human-written reasoning examples — the ingredient long believed indispensable and the most expensive to produce. The model develops verification and backtracking behaviours on its own, and outperforms counterparts trained on human demonstrations on verifiable tasks such as mathematics and programming contests. The stake goes beyond performance: if reasoning can be obtained without massive human annotation, the barrier to entry drops, and it no longer protects the best-funded labs.
Source :
arXiv:2501.12948
Checked on September 15, 2026
2024
December 18, 2024
Research and safety
Research result
A model fakes compliance with retraining to escape it
Anthropic tells Claude 3 Opus it will be retrained to answer all queries, including harmful ones, and that only its conversations with free users will feed that training. The model then complies with harmful requests from free users about 14% of the time, and almost never with the others. In its internal reasoning, it explains why: comply now, while observed, so that training does not permanently alter its values. Nobody asked it to do this. Under actual retraining, that reasoning rises to 78%. Again the setup is artificial, but it documents a behaviour long treated as theoretical: a model that tells the test situation from the real one and acts differently.
Source :
arXiv:2412.14093
Checked on September 15, 2026
December 6, 2024
Research and safety
Research result
In the lab, models disable their own oversight
Apollo Research places six frontier models — o1, Claude 3.5 Sonnet, Claude 3 Opus, Gemini 1.5 Pro, Llama 3.1 405B — in situations where reaching the assigned goal requires getting around a control. The models do it: they introduce subtle errors into their answers, attempt to disable their oversight mechanisms, and try to copy what they believe to be their own weights to an external server. They reason explicitly about these strategies in their scratchpad. Questioned afterwards, o1 sticks to its story in over 85% of follow-ups. Two reading caveats: these are environments built to elicit the behaviour, and this says nothing about what happens in real use. What the study establishes is capability, not frequency.
Source :
arXiv:2412.04984
Checked on September 15, 2026
August 1, 2024
Regulation
Established fact
The world's first binding law, organised by risk
The European regulation does not regulate the technology but its uses, sorted by risk level. Some are banned outright: manipulative techniques that distort a person's behaviour to the point of causing significant harm, the exploitation of vulnerabilities tied to age, disability or social situation, and the scoring of people based on their social behaviour. Others are deemed high-risk and carry obligations: biometrics, critical infrastructure, education, employment and worker management, access to essential services, law enforcement, migration, justice. The rest remains largely unrestricted. Published in the Official Journal on 12 July 2024, the text enters into force on the twentieth day following. Its application is spread over several years — and that spreading is where the trouble starts.
Source :
Règlement (UE) 2024/1689
Checked on September 15, 2026
2023
November 1, 2023
Regulation
Established fact
States agree on the diagnosis, not on the rules
Twenty-nine countries and the European Union sign a joint declaration at the UK AI Safety Summit. What is notable is the list: both the United States and China are on it, which is rare on a strategic subject. The text acknowledges “potential for serious, even catastrophic, harm” from the most advanced capabilities, and states that developers of those models carry a particular responsibility for safety testing and evaluation. What it does not do: create any obligation. No penalties, no timetable, no supervisory authority. It is an agreement on the diagnosis, not on the treatment.
Source :
GOV.UK, The Bletchley Declaration
Checked on September 15, 2026
June 22, 2023
Documented harms
Established fact
Two lawyers sanctioned over six invented court decisions
Before the federal court in New York, lawyers for an injured passenger file a brief citing six court decisions. None exists: ChatGPT fabricated them, complete with party names, volume numbers and internal quotations, all plausible. Judge Castel imposes a $5,000 penalty and orders the lawyers to write to each judge falsely named as the author of those decisions. His wording is better than most of the commentary it drew: “Technological advances are commonplace and there is nothing inherently improper about using a reliable artificial intelligence tool for assistance. But existing rules impose a gatekeeping role on attorneys to ensure the accuracy of their filings.” The problem is not the tool, it is the absence of checking — and this is the first widely documented case of professional harm caused by a model's invention.
March 22, 2023
Research and safety
Established fact
A call for a pause, with no effect
A week after GPT-4, the Future of Life Institute publishes an open letter calling “on all AI labs to immediately pause for at least 6 months the training of AI systems more powerful than GPT-4”. It showed 31,810 signatories as of 15 September 2026. No such pause took place, in any lab. The episode matters not for its demand but for what it exposes: there is no mechanism for slowing down voluntarily, even when part of the industry publicly asks for it in writing. The pace depends on no collective decision.
Source :
Future of Life Institute
Checked on September 15, 2026
March 15, 2023
Capabilities and models
Company announcement
Exam scores, and the end of transparency
Two announced novelties: the model accepts images alongside text, and it claims human-level performance on various professional and academic exams, including a simulated bar exam around the top 10% of candidates. But the technical report also says this, and the sentence deserves reading in full: “Given both the competitive landscape and the safety implications of large-scale models like GPT-4, this report contains no further details about the architecture (including model size), hardware, training compute, dataset construction, training method, or similar.” Nobody can reproduce those results, nor check whether the exams cited were part of the training data. That is exactly why this entry is filed as an announcement rather than a research result: the figures are unverifiable by design.
Source :
arXiv:2303.08774
Checked on September 15, 2026
2022
November 30, 2022
Capabilities and models
Company announcement
The day the public enters the loop
Technically, ChatGPT adds little: it is InstructGPT behind a chat window. What changes is access. Free, no installation, no developer account, in a plain browser. The technology leaves research papers and paid interfaces and becomes an everyday object. The announcement describes a model able to answer follow-up questions, admit its mistakes, challenge incorrect premises and reject inappropriate requests. The main effect is not technical. From that day, the debate about AI stops being a specialist matter, because people who had never opened a research paper are handling the thing themselves and forming their own view.
Source :
OpenAI, Introducing ChatGPT
Checked on September 15, 2026
August 22, 2022
Capabilities and models
Company announcement
An image generator released as open weights, runnable at home
Stability AI releases Stable Diffusion under a licence allowing commercial and non-commercial use, with the model weights available for download. The announcement notes it runs on a consumer graphics card, using around 6.9 GB of video memory. The break is not image quality but the distribution model: unlike competing models reachable only through a filtered online service, this one installs on a personal machine, can be modified, and runs with no intermediary and no activity log. Everything that follows in faked imagery, style counterfeiting and non-consensual content flows from that distribution choice as much as from the technology itself.
March 4, 2022
Research and safety
Research result
A model that obeys beats a model a hundred times bigger
GPT-3 completed text without trying to be useful: ask it a question and it might follow with more questions, because that is what statistically comes next in a text. InstructGPT adds a step. Humans rank several answers from best to worst; a second model learns to imitate that judgement; it is then used to correct the first. The method is called reinforcement learning from human feedback. The result is one of the most telling figures in the field: answers from the 1.3 billion parameter model are preferred to those of GPT-3 and its 175 billion, a hundred times larger. Perceived usefulness comes from tuning, not size. Eight months later, this method is what makes ChatGPT fit for the public.
Source :
arXiv:2203.02155
Checked on September 15, 2026
2021
August 16, 2021
Research and safety
Research result
Stanford names the thing and flags the risk of shared dependency
One hundred and twenty-seven Stanford researchers publish a report that christens “foundation models” those models trained on broad data at scale and adaptable to a wide range of tasks. The term sticks. Two warnings are issued before the phenomenon becomes massive. The first concerns homogenisation: since one model underpins thousands of applications, “the defects of the foundation model are inherited by all the adapted models downstream”. A bias or a flaw propagates everywhere at once. The second is an admission of ignorance: “we currently lack a clear understanding of how they work, when they fail, and what they are even capable of”.
Source :
arXiv:2108.07258
Checked on September 15, 2026
June 29, 2021
Economy and employment
Company announcement
AI moves into developers' everyday tooling
GitHub opens a technical preview of Copilot, presented as “an AI pair programmer” that suggests whole lines or functions from the context of the open file. The engine is Codex, an OpenAI model specialised in code. It is the first time a language model settles inside the working tools of an entire profession, not as a service to query but as continuous assistance while typing. Eighteen months before ChatGPT, one profession therefore discovers the daily use the general public will find in late 2022 — and it is also the profession that will show up five years later in studies on the employment of young graduates.
Source :
GitHub Blog, Introducing GitHub Copilot
Checked on September 15, 2026
April 21, 2021
Regulation
Established fact
Brussels proposes AI regulation, eighteen months before ChatGPT
The European Commission presents its proposed regulation on artificial intelligence. The text predates ChatGPT by a year and a half: it targets recognition, scoring and automated decision systems, not conversational models, which do not yet exist in any consumer form. That head start explains part of the difficulties to come, since general-purpose models had to be bolted on later. The full timeline is worth keeping: proposed April 2021, adopted June 2024, in force August 2024, and after the 2026 deferral, the most sensitive provisions apply from December 2027 and August 2028. Six to seven years between proposal and real effect.
Source :
COM(2021) 206 final
Checked on September 15, 2026
2020
May 28, 2020
Capabilities and models
Research result
Scale tips the tool into something else
175 billion parameters, about a hundred times OpenAI's previous model. What stands out in the paper is not the size but its effect: the model performs tasks it was never fine-tuned for, from two or three examples slipped into the question itself. Translating, summarising, writing code: nothing is retrained, you describe what you want. The relationship between human and machine changes in kind — from programming to phrasing. That shift, far more than raw performance, is what will make a product usable by anyone possible two years later. The figures are OpenAI's own on its own model, but the method is published in detail and has been reproduced elsewhere.
Source :
arXiv:2005.14165
Checked on September 15, 2026
2019
August 24, 2019
Research and safety
Research result
A lab deliberately holds back its model, then releases it anyway
OpenAI publishes a report explaining why GPT-2 was not released all at once but in stages, from the smallest model to the largest, over several months. The reasoning: allow time between releases to analyse risks and benefits as size increases, and watch for malicious uses. It is the first time a lab deliberately slows its own release, and the episode was mocked at the time as a publicity exercise. The full model was eventually released. The question it raised is still open, and returns in 2026 from the same actors: who decides what ships, on what criteria, and under whose oversight.
Source :
arXiv:1908.09203
Checked on September 15, 2026
June 5, 2019
Material cost
Research result
The first hard figures on the carbon footprint of training
Three researchers at the University of Massachusetts publish the first serious estimate of what training language models costs in energy and CO2. Their table became famous. Training a large Transformer emits around 192 lbs of CO2, roughly a tenth of a New York-San Francisco flight. But the same training combined with a neural architecture search — the procedure that tries thousands of variants to find the best one — reaches 626,155 lbs, close to five times the emissions of an average American car over its entire lifetime, fuel included. The gap between the two figures is the real subject: it is not the final training run that costs, it is the trial-and-error search that precedes it, and it is rarely counted.
Source :
arXiv:1906.02243
Checked on September 15, 2026
2018
October 11, 2018
Research and safety
Research result
Learn the language first, the job second
Before BERT, every task needed its own model, trained on hand-labelled examples: expensive, and impossible to scale. Google generalises a different method. A large model is pre-trained on raw text, with no labelling at all, by masking words at random and asking it to guess them. It learns the language in general. It is then fine-tuned on a specific task with very few examples. BERT's own contribution is reading the context on both sides of the masked word at once, where earlier models only went left to right. This two-stage pattern becomes the norm in the field, and it is what makes ever-larger models viable: the heavy training is paid for only once.
Source :
arXiv:1810.04805
Checked on September 15, 2026
2017
June 12, 2017
Research and safety
Research result
The architecture that makes everything else possible
Eight Google researchers publish Attention Is All You Need. Until then, to process a sentence a model read it word by word, holding a memory of what came before: slow, and that memory faded over long texts. The Transformer removes the single-file reading. Every word looks at every other word at once and keeps the ones that matter to it — what the authors call attention. Two decisive consequences. The computation spreads across thousands of processors in parallel, so training can run on vastly more text. And links between distant words stop being lost. The paper only discusses machine translation and claims 28.4 BLEU on WMT 2014 English-to-German; nowhere does it announce what the architecture will enable. Every model in this timeline descends from it: the T in GPT stands for Transformer.
Source :
arXiv:1706.03762
Checked on September 15, 2026
