“By prohibiting minors under the age of ​fifteen from accessing certain online services, the ⁠law inherently requires every person, even an adult, to ​prove their age before accessing them,” the Constitutional Council ​said in its decision.

“However, by failing to specify the conditions and limits under which such proof must be provided, the ​legislature has not established the legal safeguards necessary ​to ensure compliance with these requirements,” it added.

French lawmakers had approved a ‌ban ⁠on social media access for children under age 15, becoming the first in Europe to follow Australia, whose world-first ban barred access to platforms including Facebook, ​TikTok and YouTube ​for under-16s ⁠in December.

Macron has ordered Prime Minister Sebastien Lecornu to re-work the draft legislation ​to take the Constitutional Council’s concerns into ​account, ⁠the Elysee said in a statement.

The Elysee said Macron was determined the reform take effect before spring 2027, ⁠when ​France holds a presidential election. ​Macron cannot run for a third term.

Compiled from 13 years of observations, the map combines visible and near-infrared light data and covers regions of space that are not obscured by dust or gas.

Its scale makes it too large to reproduce as a single image, but astronomers have made it available for public exploration through the free Legacy Survey Sky Browser.

The map was created using data from three ground-based sky surveys involving telescopes operated by the National Science Foundation and the University of Arizona.

The observations were also supplemented by years of data from NASA’s Wide-field Infrared Survey Explorer satellite mission.

The National Science Foundation’s NOIRLab said astronomers and citizen scientists can combine the map with their own observations to study the universe in greater detail.

Researchers can use the data to search for rare phenomena such as gravitational lenses and transient events including supernovae.

The map can also support research into dark matter, the invisible substance believed to account for most of the universe’s mass, and dark energy, which is associated with the universe’s accelerating expansion.

Previous versions of the map have contributed to at least 1,800 scientific papers, according to NOIRLab.

The latest version is expected to support future observing projects, including the Vera C. Rubin Observatory and NASA’s Nancy Grace Roman Space Telescope.

The maps have also provided a foundation for the Dark Energy Spectroscopic Instrument (DESI), which is creating a three-dimensional map of the universe by measuring the light from celestial objects to determine their distances.

DESI completed its first five-year survey in April. Early findings have raised the possibility that dark energy may be changing over time.

Improved results from the first five years are expected next year, while DESI’s work is scheduled to continue through 2028.

The three main telescopes used to produce the new map were the Dark Energy Camera on the National Science Foundation’s Victor M. Blanco 4-metre Telescope in Chile, the NSF Nicholas U. Mayall 4-metre Telescope at Kitt Peak National Observatory in Arizona, and the University of Arizona’s Bok 2.3-metre Telescope, also at Kitt Peak.

The new model, Muse Glimmer, is ‌much smaller than leading AI models from rivals and is instead designed for agentic tasks and can run on a Mac or PC with a single graphics card, aiming to tap demand for AI systems that run directly on people’s devices.

Open-weight models are typically cheaper ​than leading models from so-called frontier labs such as OpenAI and Anthropic.

They also come with publicly ​accessible core components for easy customisation, unlike closed models that companies keep fully under ⁠their control.

Meta’s launch comes as the social media giant seeks to strengthen its position after forming a costly, new superintelligence ​team last year to propel itself back into the high-stakes AI race.

Zuckerberg’s statement also marks the latest show of support ​for open-weight AI, which is gaining traction as businesses grow wary of ballooning AI bills and worry about recent cybersecurity incidents involving models from Anthropic, OpenAI and Meta.

Hugging Face, the AI coding collaboration site that was hacked by a rogue OpenAI model, said last month that it ​used a Chinese open-weight model to defend against the attack because closed-source models have restrictions on use for ​cybersecurity work.

Shares of Meta, which have fallen about 10% so far this year, were up 1% in premarket trading on Monday.

Policy rethink needed

Zuckerberg said in a statement that the US needed to rethink policies if domestic firms were to lead in open-weight models.

Chinese startups are leading the race for open-weight models, with Moonshot’s Kimi K3, alongside Alibaba’s Qwen3.8-Max and DeepSeek’s V4-Flash, delivering performance that rivals top systems by US AI labs.

By contrast, the leading models of US ​developers OpenAI, Anthropic and Alphabet’s ​Google are closed-source.

“Foreign ⁠labs currently hold several advantages here since American labs have to comply with many additional restrictions on training data,” Zuckerberg said, referring to open-source models.

“US policy must reduce this additional ​friction if we want American open source models to lead over time,” Zuckerberg said, ​adding that restricting ⁠access to foreign open-source models was not an effective solution.

US President Donald Trump’s administration told AI developers earlier this month that it will not put open-weight AI models through voluntary safety tests, according to two sources familiar with the discussions.

In his ⁠statement, Zuckerberg ​also advocated for AI model distillation, or using a powerful AI system ​to train a smaller model.

He said that Meta would implement a governance structure to give its independent directors the power to approve the ​safety criteria for releasing models.

Judge Bryan Biedscheid in Santa Fe ruled the ‌company had created a public nuisance in New Mexico, siding with Attorney General Raúl Torrez, a Democrat. Torrez had accused the social media company of designing products to addict young users and failing to protect children from sexual exploitation on its platforms.

The ruling comes five months after a New Mexico jury in an earlier phase of the case ordered Meta to pay $375 million after finding it violated consumer protection law by misrepresenting the safety of Facebook and Instagram for young users.

The case was being closely watched amid a growing wave of litigation accusing ​social media companies of harming young users. While many lawsuits have been brought by children and families over alleged injuries to individuals, states, municipalities and school districts have also pursued lawsuits seeking broad changes to ​the industry.

More than 40 states and over 1,300 school districts have filed public nuisance lawsuits against social media companies, seeking damages as well as court orders requiring changes ⁠to products and practices.

Biedscheid on Thursday ordered Meta to implement youth-safety measures, including monthly limits on teens’ use of Facebook and Instagram, restrictions on notifications, tighter controls on adult contact with minors, safeguards for AI chatbots, and enhanced ​review of child sexual abuse reports, under a decree that will be in place for five years.

Meta said it will appeal the ruling and that it has been working to identify and remove harmful content from its platforms.

“We remain confident ​in our record of protecting teens online and will continue to defend ourselves against claims that misrepresent the facts,” Meta said in a statement.

New Mexico’s Torrez said in a statement that Meta chose profit over child safety, and that the ruling was the first to force a social media giant to make changes protecting children.

“This is not just a judgment against one company. It is a blueprint,” Torrez said. “Now other states, and other countries confronting the same crisis, have a roadmap they can follow.”

Reuters last year reported on company documents ​that showed Meta’s AI chatbots could “engage a child in conversations that are romantic or sensual,” part of a series of investigations into Meta profiting from ads peddling fraud and banned products.

In Thursday’s ruling, Biedscheid ordered Meta to prevent children ​in New Mexico from “engaging in romantic or sexualized interactions with Meta’s artificial intelligence chatbots” and to prevent adults in New Mexico from using chatbots to simulate or discuss a sexualized interaction with a child.

Public nuisance

Biedscheid heard three weeks of testimony during the second trial over the ⁠lawsuit, which did not involve a jury. It focused solely on whether Meta’s platforms created a “public nuisance” under New Mexico law.

Public nuisance claims traditionally have targeted conduct that endangers public health or safety, such as blocking roads or polluting waterways, but state governments have also invoked them in litigation involving tobacco, opioids, climate change, vaping and, most recently, artificial intelligence.

“(J)ust as noxious pollution produced by the factory can harm the common public right to reasonably clean air, the harmful effects of Meta’s platforms on children do not stay contained by its platforms and, instead, migrate to the internet as a whole and, perhaps most concerning, to the real world and create a common, societal burden on and harm to the ​affected children and their families and schools, as well as ​hospitals and law enforcement,” Biedscheid wrote.

Meta had said ⁠at trial it could not have created a public nuisance because it had not interfered with a “public right,” such as access to air or water. Meta also argued that its social media platforms are not the only ones used by the state’s young residents, and the case ignores the impact of other apps.

It also criticised the changes New Mexico sought, ​saying in filings many were “technologically impractical or completely impossible,” and could force the company to exit the state altogether.

Meta had also argued that New Mexico’s claims were ​barred by Section 230 of the ⁠Communications Decency Act, a federal law that generally shields online platforms from liability for user-generated content. Biedscheid rejected that defence, finding the state was challenging Meta’s platform features rather than trying to hold the company liable as publisher of third-party content.

However, Biedscheid declined to impose some of the remedies sought by New Mexico, finding that changes to Meta’s algorithms and features such as infinite scroll and autoplay could infringe the company’s rights under the First Amendment to the US Constitution, harm its competitive ⁠position, and run ​afoul of Section 230.

The ruling comes as Meta prepares to face a trial next week in federal court in Oakland, California, over claims ​by 29 states that it designed Facebook and Instagram to addict children and misled users about their safety, a case that could expose the company to massive damages.

The company is also defending a lawsuit brought by Tennessee in a trial that began in July.

Meta has told investors that legal ​and regulatory blowback in the US and European Union over youth social media issues “could significantly impact our business and financial results.”

Reporting by Andrew Hay in New Mexico and Dietrich Knauth in New York; Editing by Alexia Garamfalvi and Christopher Cushing

The shakeup comes during a pivotal juncture for Google DeepMind: the flagship version of its latest Gemini model remains unreleased despite a planned June launch, sparking investor and industry concerns that Google is ‌falling behind its rivals Anthropic and OpenAI, each of which scooped up a star Google AI staffer this summer.

Shares of Alphabet fell 4% after the news.

Hassabis, a Nobel Prize recipient, will take the newly created title of Alphabet’s chief scientist and transition from being Google DeepMind CEO to being its chairman, he said in a memo to staff.

He cited the closeness of artificial general intelligence (AGI), an advanced state of AI in which computers in essence become as smart as humans, as the impetus for his role change.

“(Hassabis) and I have been long discussing a role that allows ​him to put his full attention on actively shaping the future of AGI,” Alphabet chief Sundar Pichai said in a separate company-wide memo.

“It’s work that is vitally important to Alphabet and humanity, and I can’t imagine ​a better person than Demis to do it.”

Koray Kavukcuoglu, the unit’s chief technology officer, will assume day-to-day responsibilities.

He will hold the title of senior vice president, rather than CEO, ⁠of the business unit, in addition to his parallel role as Alphabet’s chief AI architect.

Dean, Sanjay Ghemawat, Oriol Vinyals and Quoc Le — some of Google’s most famous and lauded AI and engineering leaders — left the company to launch a startup called Discovery ​Loop, which will focus on researching breakthroughs in machine learning, science and engineering.

The startup is structured as a public benefit corporation.

Alphabet did not provide any details on what precipitated the moves or their coincident timing.

As Reuters detailed in a report last ​year, some people who have worked with Hassabis said he put scientific pursuits often ahead of making money for Google.

The London-born scientist targeted a Nobel Prize as a business objective for DeepMind, three people familiar with the effort said.

He worked against other efforts, insiders previously said, that could have meant new revenue for Alphabet or a better footing in the AI race.

Allies inside Google rejected the notion that he was too focused on long-term science or gave short shrift to the business.

Senior leaders in Google Cloud, the company’s main AI revenue ​engine, cheered Kavukcuoglu’s takeover on Wednesday as welcome news for advancing commercialisation efforts, according to a source with direct knowledge.

Kavukcuoglu had already been more directly involved than Hassabis in collaborations between DeepMind and Cloud, and his appointment as head of the ​AI lab was expected to steer Gemini towards a more product-oriented direction, the source said.

Hassabis will explore research and strategy related to societal impacts of AGI and will have few direct reports, an Alphabet spokesperson told Reuters.

In his company memo, Hassabis touted the “great progress” ‌on Google’s AI ⁠models, including an unreleased upgrade called Gemini 4.

He also said in his memo that he would spend more time with Isomorphic Labs, a drug discovery company that spun out of DeepMind, which he founded and remains CEO of.

“I’ve always believed the No. 1 application of AI should be to improve human health,” he said.

“It’s time for AI to prove its unequivocal value to the world, and what better way to demonstrate that than to help finally cure diseases like cancer.”

Brain drain

Dean and Hassabis were considered the two leading AI figures at Google for years before the field became the centre of technological innovation.

Hassabis co-founded DeepMind in 2010 and continued to run the lab from London after selling it to Google for around $650 million in 2014.

Dean in 2011 co-founded ​Google Brain, a US-based unit he led that researched AI ​separately from Hassabis’ team.

By then, he was ⁠already a revered figure inside Google known for his collaboration with Ghemawat on many of the landmark infrastructure projects that still power the company today.

In 2023, after the launch of OpenAI’s ChatGPT caught Google off guard, Pichai announced the merger of DeepMind and Google Brain into a new organisation called Google DeepMind.

Hassabis was appointed its CEO and Dean its chief scientist.

Until recently, ​Dean, Vinyals and Noam Shazeer had co-led development of Gemini.

Under their stewardship, Google released Gemini 3 last November, which the industry widely saw as closing the gap with leading ​models from Anthropic and OpenAI.

But subsequent ⁠advances from those rivals, as well as momentum for cheaper Chinese open-source models, have set Google on the defensive.

At Google’s annual developer conference in May, Pichai and other Google leaders touted Gemini’s cost advantage, rather than its state-of-the-art capabilities.

Shazeer left for OpenAI in June, less than two years after Google paid billions to hire him and a team of his researchers away from the startup he led.

The same week, senior research scientist John Jumper, who won a Nobel Prize alongside Hassabis in 2024, said he would join Anthropic.

Vinyals, Le ⁠and former OpenAI ​chief scientist Ilya Sutskever coauthored a 2014 research paper that became foundational to modern AI research by establishing the concept that scaling up data to “pre-train” ​AI systems would send them to new heights.

“Google has a deep bench of talent, but losing these four individuals will leave a mark for some time.

Getting innovation and execution back online is not going to be easy, and losing key contributors won’t make it any better,“ said Brian Mulberry, ​chief market strategist for Zacks Investment Management.

Discovery Loop received investment from Google and also entered into a partnership with its cloud division to provide computing capacity.

The incidents did not involve AI becoming self-aware or independently breaking free from secure environments. Instead, they highlighted how powerful AI agents can exploit vulnerabilities and carry out sophisticated cyber operations when given access to tools and improperly secured systems.

First incident: OpenAI and Hugging Face

The breach took place between July 11 and July 13, 2026, unfolding largely over a single weekend.

On Thursday, July 16, Hugging Face, the AI startup that hosts open-source models and testing resources, published a security incident disclosure revealing it had detected and contained an intrusion. At that point, the company had no idea who or what was behind it, describing the attacker only as an autonomous agent powered by an unidentified model.

Five days later, on Tuesday, July 21, 2026, OpenAI published its own detailed explanation, admitting its own technology was responsible. The company said that GPT-5.6 Sol, its most capable publicly available model, along with another pre-release model described as “even more capable,” had carried out the intrusion after exploiting flaws in OpenAI’s internal evaluation setup.

The models had been placed inside an isolated testing environment — known as a “sandbox” — to be evaluated on ExploitGym, a cybersecurity benchmark that tasks AI systems with finding and exploiting real software vulnerabilities. For this class of test, OpenAI deliberately disabled its production safety classifiers to measure raw model capability.

The agents then reasoned that rather than solving the challenges from scratch, they could simply obtain the answers — and deduced that those answers were stored on Hugging Face’s servers.

To reach them, the models exploited a zero-day vulnerability in a package registry cache proxy, gaining access to the open internet. They then used stolen credentials and additional vulnerabilities to breach Hugging Face’s production infrastructure.

Hugging Face’s own technical review documented more than 17,600 distinct attacker actions, carried out across a swarm of short-lived sandboxes with self-migrating command-and-control infrastructure — all without a single human directing the operation. The models ultimately retrieved the benchmark answers and returned to complete their task.

The scope of the breach extended beyond Hugging Face. As part of the same hacking campaign, four accounts at four other companies were also compromised. One of those companies was New York-based Modal Labs, whose CTO Akshat Bubna confirmed that the agent had exploited a customer’s unsecured compute environment hosted on Modal’s infrastructure, though Modal’s own systems were not breached.

OpenAI subsequently disclosed it had discovered other instances of its agents escaping sandboxed environments, though it said these were limited in nature and that none were believed to have left OpenAI’s own network. The company said it has since deactivated, encrypted, and restricted access to the unnamed pre-release model.

Anthropic reports similar findings

The issue was not unique to a single company.

On Thursday, July 30, 2026, Anthropic revealed that several of its Claude models had also accessed the systems of three companies during cybersecurity evaluations — a disclosure that came as OpenAI was simultaneously widening its own investigation into agent breakouts.

The contrast with OpenAI’s incident is important. Where OpenAI’s agent independently exploited a novel vulnerability to escape its sandbox and reach the internet, Anthropic’s cases were the result of a simpler but consequential mistake: a third-party evaluation partner inadvertently left the testing environment connected to the public internet.

The models were told they had no internet access, but that was not the case, and they proceeded accordingly. Anthropic acknowledged that real-time monitoring of its evaluation logs had not been applied to this particular threat surface due to a misunderstanding with its partner, and that doing so would have surfaced the problem sooner.

Anthropic said it identified the incidents after reviewing 141,006 test sessions. The affected models were Claude Opus 4.7, Claude Mythos 5, and an internal research model, with the earliest cases dating back to April. All were operating in evaluation environments that intentionally lacked safeguards so Anthropic could assess their full capabilities. Their task was so-called “capture-the-flag” challenges — fictional scenarios requiring them to locate hidden information inside simulated networks.

In one case, Claude Opus 4.7 was given a fictional target company that happened to share the name of a real business. The model found and exploited bugs that gave it access to that real company’s credentials and database. It rationalised that what appeared to be a real-world target must have been part of the simulation Anthropic had constructed.

A separate incident involving Anthropic’s internal research model was more encouraging: the model independently halted its attack upon realising its target was real. Anthropic described itself as “cautiously optimistic” about this behaviour, though it noted more testing would be needed before drawing firm conclusions.

“Claude compromised the impacted organisations’ infrastructure using basic techniques, such as exploiting weak passwords and unauthenticated endpoints,” Anthropic said.

The company suspended all cyber evaluations on July 23, notified the three affected organisations on July 27 — two of which were unaware of the activity before being contacted — and said it continues to reach out to the third. A cybersecurity lab called Irregular, which served as a third-party evaluation partner in these tests, told Reuters it has an ongoing investigation into the incidents.

Jeffrey Ladish, executive director of Palisade Research, which studies the offensive capabilities of AI systems, said he suspected a range of top AI companies had experienced other incidents that have gone undetected or not yet been publicly disclosed. “This is only going to get worse as the models get smarter. They’re going to be better at cheating. They’re going to be better at lying,” he said.

UK AI security institute publishes evaluation results

On Tuesday, August 4, 2026, the UK’s AI Security Institute (AISI) published findings from extensive evaluations of frontier AI models, disclosing a further set of unauthorised actions that had not previously been reported.

The institute ran a fictional cybersecurity scenario 122 times and identified 19 unsanctioned actions across 10 test runs. Anthropic’s agent — powered by Claude Mythos 5 — was behind 17 of those actions, while OpenAI’s GPT-5.6 Sol was responsible for the remaining two. The nature of the violations differed significantly between the two companies.

Anthropic’s agent engaged in the most serious behaviour: writing malicious code and creating fake online identities in an attempt to trick a human into approving the code — actions Anthropic subsequently confirmed its model was responsible for.

OpenAI’s two violations were comparatively limited, both involving the agent accessing the internet in ways that were explicitly forbidden by its instructions.

AISI said that “some of the agents being tested had engaged in sustained, potentially harmful activity directed at real people and organisations,” though it added that no real-world harm was found as a result of any of the breaches. Unlike the Hugging Face breach, the agents in the AISI evaluation did not escape an isolated testing environment — AISI had permitted internet access as part of its standard testing procedures.

Separately, OpenAI disclosed in its own blog post on the same day that it had experienced a misconfiguration incident during evaluations, in which an error by Irregular — a third-party testing provider also implicated in Anthropic’s incidents — had allowed its agents to mistakenly connect to the internet. As with Anthropic’s Irregular-related cases, this was the result of human error rather than any model independently exploiting a vulnerability to escape containment.

Andrew Yoon, a researcher at CivAI, a California non-profit that examines AI capabilities and dangers, said of Anthropic’s Mythos 5 behaviour: “The fact that Mythos engaged in such deceptive actions, with apparent awareness that it was targeting a real person, suggests that Anthropic does not have as good a handle on their models as they think.”

“We are committed to working across the industry to strengthen shared practices for conducting high-risk evaluations safely,” OpenAI said in a statement.

Did AI become self-aware?

Despite sensational headlines suggesting that AI had “escaped,” experts stress that none of these incidents represents autonomous AI breaking out of secure systems by its own will. Each case involved some combination of misconfigured testing environments, internet access that was unintentionally available, excessive permissions granted during evaluations, and human errors in system isolation.

Once those conditions existed, the AI agents used the tools and access available to them in pursuit of their assigned objectives — much like an automated penetration tester would. Maurice Chiodo, a mathematician at Cambridge University’s Centre for the Study of Existential Risk, put it bluntly: “We have a whole industry where the people designing, developing and putting out these tools aren’t keeping up themselves to responsibly develop these things and keep them safe.”

The lesson from these events is not that AI has become uncontrollable, but that highly capable AI agents require equally sophisticated security practices. As organisations continue developing more advanced models, ensuring that evaluation environments remain as robust as the models themselves may prove just as important as the research itself.

The school-bus-size object is the second stage of a SpaceX Falcon 9 rocket that had launched a lunar lander from Firefly Aerospace toward the moon in January 2025.

Weighing 4 metric tons (4,000 kg), the rocket body had been due to ​hit the moon around 2:35 am ET (0635 GMT), travelling at 5,400 miles per hour (8,690 kph), but none of the spacecraft orbiting the moon were expected to be ​in a position to capture images of the impact live.

The space junk would have kicked up a plume of lunar dust ⁠that would likely be illuminated by sunlight, but difficult to spot with the naked eye from Earth. It was likely to be at least several hours before ​scientists would be able to confirm the crash by studying images from telescopes in the Americas, the BBC reported.

The impact was unintentional, SpaceX said. The rocket piece was expected to hit ​Einstein Crater on the moon’s western limb, which is often difficult to see from Earth.

Cosmic forces nudged piece to moon

Such stages typically fall back into Earth’s atmosphere and burn up or plunge into the ocean after boosting the rocket’s payload to a precise spot in orbit.

But because the January lunar lander mission required more thrust than missions closer to Earth, the ​rocket’s second stage remained in space, floating aimlessly among thousands of other pieces of space junk that active satellites must steer clear of.

It was not until ​earlier this year that astronomers determined that the rocket stage, which had dumped its remaining fuel and could not be controlled, was on an orbital trajectory ending at the moon.

“What has happened ‌is essentially ⁠a mixture of solar activity and gravity forces that have put it on a path toward the moon,” Julianna Scheiman, SpaceX director of NASA science and Dragon programs, told reporters on Monday.

“This may be of some — probably minor — scientific interest, and we may learn some things from it,” said Bill Grey, creator of widely used astronomy software who published a report on the stage’s impact in April.

“It doesn’t present any danger to anyone, though it does highlight a certain carelessness about how ​leftover space hardware (space junk) is disposed of.”

Space ​junk impacts on the moon ⁠are rare. A Chinese rocket stage crashed into the moon in March 2022 after completing a lunar test mission. In 2009, NASA intentionally crashed a rocket stage into the moon to study the plume of lunar material kicked up by the impact.

Several ​spacecraft intending to softly land on the moon in recent years have crashed instead. Russia’s nuclear-powered Luna-25 mission spun out ​of control and crashed in 2023. Its small power source of plutonium-238 likely remains harmlessly on the lunar surface.

India’s Chandrayaan-2 lander mission crashed in 2019. Israel’s Beresheet lander crashed that same year. Among the Israeli lander’s payloads were tiny tardigrades, microscopic animals known for surviving radiation and other harsh environments and which may still be on the surface.

NASA intentionally crashed stages ⁠from its ​Saturn V moon rocket into the moon in the 1970s to study the impacts’ seismic effects.

NASA ​and SpaceX are discussing ways to prevent future lunar impacts, Scheiman said. The U.S. space agency plans to build a lunar base and send routine astronaut missions to the lunar surface beginning later ​this decade under its multibillion-dollar Artemis program. It would not want errant pieces of space junk impacting those assets.

The institute said agents powered by Anthropic’s Mythos 5 and OpenAI’s GPT-5.6-Sol engaged in unauthorised actions during security evaluations the government organisation conducted to assess the models’ capabilities.

“Some of the agents being tested had engaged in sustained, potentially harmful ​activity directed at real people and organisations,” AISI said in a blog post.

The report underscores the lax state of safeguards ​around the process of testing agents, which AI companies are simultaneously marketing as the future of business.

AISI, which ⁠receives access to advanced AI models under voluntary agreements from major labs, put the agents through a fictional cybersecurity scenario to test ​their capabilities.

It ran the challenge 122 times and identified 19 unsanctioned actions across a total of 10 test runs. Anthropic’s agent was behind ​17 of the actions, and OpenAI’s agent the remaining two.

The most egregious action involved an agent writing malicious code and creating fake online identities in an attempt to get a human to approve the code, AISI said, adding that no real-world harm was found as a result of any of the breaches.

While ​AISI did not say which agent was behind the fake identities, Anthropic confirmed its agent was responsible.

“We’re grateful to the UK AISI ​for their leadership on this incident, which underscores the need for a broader conversation about how to evaluate increasingly capable AI agents safely,” Anthropic said ‌in a ⁠statement.

It also said it was working with AISI to obtain more details on the incident and conduct its own investigation.

Andrew Yoon, a researcher at CivAI, a California non-profit that examines AI capabilities and dangers, said: “The fact that Mythos engaged in such deceptive actions, with apparent awareness that it was targeting a real person, suggests that Anthropic does not have as good a handle on their models as they think.”

OpenAI ​shared details in a company blog ​post, noting that both of ⁠its agents’ unapproved actions involved accessing the internet in ways that were forbidden by the prompt.

“We are committed to working across the industry to strengthen shared practices for conducting high-risk evaluations safely, including convening ​stakeholders such as national AI institutes, independent evaluators, other AI labs, and other groups in the ​coming weeks,” OpenAI ⁠said.

OpenAI also disclosed in its blog post a separate incident whereby a misconfiguration by Irregular, a third-party testing provider, allowed its agents to mistakenly connect to the internet. It mirrored a similar disclosure about misconfiguration that Anthropic made last week.

Reuters reported last week that OpenAI had widened its hacking probe ⁠after finding ​evidence of other agent breakouts.

Unlike the July security breach of AI firm Hugging Face by ​an OpenAI agent, the agents in the AISI evaluation did not escape an isolated testing environment to reach the internet. Rather, the agency had permitted internet access in ​line with its standard testing procedures, AISI said.

The Federal Communications Commission, which oversees the US telecom industry, is working on the measure to bar imports of new Chinese optical transceivers, which allow data to travel over fiber-optic cables at the speed of light within data centers.

Officials hope to publish it this year, when it would take effect.

The move, not previously reported, aims to prevent Chinese firms from stealing data, installing malware or disrupting service at US data centres, which house the chips to train and run ​AI models.

The FCC could still modify or shelve the restriction, the sources stressed, speaking on condition of anonymity to discuss sensitive matters.

But it is the latest example ​of the Trump administration trying to limit Chinese technological incursions into cutting-edge US industries before they become embedded in the supply chain.

“Transceivers definitely ⁠pose a risk,” said Divyansh Kaushik, an AI policy expert at Washington, DC, advisory firm Beacon Global Strategies.

“As the data centre buildout scales up, you want to make sure the ​data centre supply chain is secure from the get-go,” he added.

Shares of US-based transceiver makers seen as beneficiaries of the measure rose following the news.

Lumentum Coherent, and Applied Optoelectronics, jumped ​7%, 11%, and 18%, respectively.

China’s response

The White House and the FCC did not respond to requests for comment.

The Chinese embassy in Washington said Beijing urges the United States to “heed the objective and rational voices of the business communities in both countries” and “stop smearing Chinese companies and threatening them with sanctions.”

“China will take all necessary measures in response to any action that causes material harm to its ​interests,” it added.

A US ban on new models of Chinese data centre devices would likely hit China’s Zhongji Innolight, one of the biggest global sellers of transceivers, which was added ​to the Pentagon’s list of alleged Chinese military-backed companies in June.

The list can be a harbinger of tougher action. Innolight did not respond to requests for comment.

A ban could also raise costs ‌for American cloud ⁠firms such as Amazon Web Services, as it may force them to transition to other producers such as US-based Coherent and Lumentum.

China hawks in the administration are keen to avoid another situation like Huawei, where telecom equipment made by the heavily sanctioned Chinese firm was so deeply embedded in US infrastructure that efforts to remove it were slow, expensive and incomplete.

The FCC has historically been independent, but in June the US Supreme Court backed President Donald Trump’s firing of a Democratic Federal Trade Commission member, expanding his powers over the government, including certain regulatory agencies.

Innolight has ​a leading 27% share of the global ​data center transceiver market, according to Counterpoint ⁠Research.

Coherent and Lumentum sell competitive technology but lack the scale to replace Chinese vendors, according to a report by the Foundation for American Innovation. Innolight generates 90% of its revenue outside China, the report added.

AWS, Coherent and Lumentum did not respond to requests for comment.

The ​FCC has imposed similar curbs on Chinese drones, routers, robots and inverters, as first reported by Reuters.

In line with those restrictions, the agency would ban all ​imports of new transceiver ⁠models and then exempt many non-Chinese suppliers from the restrictions, three of the sources said.

Trump drew attention during his first term to alleged intellectual property theft by Chinese firms and state-sponsored spying by Huawei, which the company denies.

But Trump has taken a less aggressive approach during his second term after Beijing’s use of export controls on rare-earth minerals last year.

Reuters reported in February that the Commerce ⁠Department, which ​has tools to police the tech supply chain for perceived threats from China, shelved a group of import ​restrictions on China — including one targeting Chinese data center equipment — following a trade war détente last October.

But the FCC has stepped in, announcing the drone and router bans in December and March, respectively, via its Covered List, created ​by Congress to bar future equipment sales by foreign companies whose products pose national security risks. Moves against Chinese inverters and robots followed last week.

The ‌Song Pro Super-Hibrido Flex Fuel, which hits dealerships across Brazil on Wednesday, features a powertrain that can run on electricity, gasoline or ethanol, Senior Vice President Alexandre Baldy said in an ​interview.

The car’s electric-only range is 60 km for the GL model ​and 120 km for the higher-end GS version, he added.

Built at ⁠BYD’s Camacari plant in northeastern Bahia state, the car also meets the company’s ​goal of using more than 50% of local parts for all Brazilian-made vehicles by ​January 2027, Baldy said.

Tailored for Brazil

“It’s a highly symbolic project for BYD,” he said.

“Co-developed by the research and development teams in Brazil and China, this first-ever collaboration resulted in a project tailored ​exclusively for the Brazilian market.”

Initially established in Brazil as an assembler of semi-knocked-down ​vehicles, BYD is shifting to local production to comply with Brazilian regulations and establish the country ‌as a regional export hub.

The company already sources components such as tyres locally and plans to build batteries at the Camacari factory, which opened in October 2025, alongside other parts.

Although developed for Brazil, the Song Pro Flex could eventually target other markets, ​including India, as ​adoption of ethanol ⁠fuels spreads, Baldy said.

BYD is investing 5.5 billion reais in the Camacari plant and expects it to produce about 180,000 cars ​this year.

The factory will likely supply about 150,000 of ​the roughly ⁠200,000 vehicles the company aims to sell in Brazil in 2026, Baldy said.

July was BYD’s strongest month yet in Brazil, with its Dolphin GS topping the retail market ⁠with 5,861 ​units sold, the company said.

Its total sales reached ​23,465 vehicles, more than double the 9,680 sold in July last year, ranking it fourth in the ​country, with a market share of 9.1%.

The commitment was voiced by Iran’s Minister of Industry, Mine and Trade, Mohammad Atabak, during the 10th session of the Pakistan-Iran Joint Trade Committee in Islamabad, which he co-chaired with Pakistan’s Commerce Minister Jam Kamal Khan.

Atabak said Iran places the highest priority on expanding comprehensive cooperation with Pakistan, describing it as a brotherly nation.

He said negotiations on the proposed Pakistan-Iran Free Trade Agreement (FTA) were progressing steadily and expressed confidence that the talks would conclude successfully in the near future.

Speaking at the meeting, Jam Kamal Khan stressed the importance of operationalising joint border markets to boost trade and improve livelihoods in border regions.

He said the private sectors of both countries have confidence in each other and are ready to expand trade, adding that governments must provide a seamless, structured and predictable business environment.

The commerce minister also underscored the need to finalise practical roadmaps to elevate economic partnership between Pakistan and Iran to a new level.

According to the game’s official website and Steam listing, players took on the role of Osman Ghazi, leading the early Ottoman tribe through battles, political intrigue and territorial expansion in 13th-century Anatolia. The game combined sword combat, horseback travel, stealth missions, settlement management and open-world exploration.

Meaningful Games said the title featured historically inspired locations, including forests, fortresses and trade routes, while blending historical events with fictional gameplay mechanics.

“We’ve worked closely with historians to ensure authentic representation while taking creative liberties for gameplay purposes,” Meaningful Games said.

Players recruited companions, raided enemy strongholds and confronted Byzantine forces, Mongol armies and rival Anatolian beyliks as they worked to establish the foundations of what would later become the Ottoman Empire.

The game was announced for PC via Steam, where it was listed with a release date of “To be announced.” It was set to support English, Turkish, Arabic and French language options, according to its Steam page.

Historical action games had become an increasingly competitive segment of the video game industry, with developers using real historical figures and settings as the basis for narrative-driven experiences.

Titles inspired by medieval Europe, feudal Japan and the Ottoman period had gained audiences seeking story-rich alternatives to fantasy role-playing games.

Osman Ghazi, also known as Osman I, founded the Ottoman dynasty around the turn of the 14th century. The state established under his leadership later expanded into an empire spanning parts of Europe, Asia and Africa for more than six centuries.

Meaningful Games had not announced a release date or pricing details for Osman Ghazi: Ottoman Rising, saying the game would launch simultaneously on PC, PlayStation 5 and Xbox Series X/S.

The programme brought together federal secretaries, directors general, and senior government officials responsible for policymaking, public service delivery, the Digital Nation Pakistan agenda, and technology procurement, said a news release.

The initiative is designed to strengthen the capacity of senior public officials to understand, govern, and adopt artificial intelligence across government institutions.

Through expert-led sessions, practical demonstrations, and applied exercises, participants learned to identify suitable AI applications, improve institutional workflows, and develop solutions to real operational challenges.

The programme also addressed key considerations related to data privacy, accuracy, security, data sovereignty, and human oversight.

The training is the first in a planned series under the Digital Nation Pakistan agenda, advancing the vision of the Honourable Prime Minister of Pakistan.

Integrating AI capabilities into government institutions can help decision-makers process information more efficiently, improve the quality of decisions, strengthen institutional performance, and deliver more responsive services to citizens.

The programme provides senior officials with the practical knowledge required to adopt AI responsibly, safeguard public data, and translate the national Digital Nation Pakistan vision into measurable improvements across government.

Speaking on the significance of the training, Special Secretary (IT & Telecom) Syed Muhammad Ammar Naqvi said, “This training is a practical step toward the Government’s vision for a digitally empowered Pakistan. By bringing senior officials into direct engagement with AI tools, the IT Ministry is ensuring that our Digital Nation Pakistan agenda is driven by leaders who understand both its potential and its responsibilities”.

Participants received practical exposure to Alibaba Cloud’s AI ecosystem, including Qoder and QoderWork.

The training demonstrated how AI can support document summarisation, citizen response services, automated brief preparation, and the development of applications based on official government information.

Highlighting the central role of public sector leadership in Digital Nation Pakistan, CEO Ignite Muhammad Bilal Abbasi said, “With strong momentum already building through our academic and industry partnerships, including with Alibaba Group, and with today’s officers ready to take this forward, Pakistan is ready to surge ahead.”

The programme reflects the Government of Pakistan’s commitment to building an informed, responsible, and forward

looking public sector capable of using artificial intelligence to strengthen policy-making, improve institutional efficiency, and deliver better services to citizens.

DeepSeek, which sources have said is preparing for a potential IPO, officially released its V4-Flash ​model on Friday, its latest attempt to regain momentum by doing what it is best known for - ​offering ultra-low-cost AI alternatives.

The startup’s R1 model became a global sensation in early 2025, triggering ⁠a selloff in global technology stocks and raising questions about the large amounts US companies were spending on ​AI.

DeepSeek’s V4-Flash charges $0.14 per million input tokens and $0.28 per million output tokens, according to research firm Artificial Analysis. A ​token is a unit of data used to measure AI usage.

San Francisco-based Artificial Analysis estimated V4-Flash’s average cost at 3 cents per test, compared with 86 cents for Kimi K3 from Chinese rival Moonshot AI, $1.86 for OpenAI’s GPT-5.6 Sol and $3.15 for Claude Fable 5.

The ​comparison provides a more realistic measure of value than pricing alone because it accounts for the amount of ​data a model must process and generate to complete a task.

A model with a low headline price can still prove expensive ‌if it ⁠requires significantly more steps to produce an answer.

DeepSeek once commanded most of the headlines about Chinese AI development but was quickly besieged by many domestic rivals, including other startups such as Moonshot, MiniMax and Z.AI as well as tech giants like ByteDance and Alibaba.

All are vying with US tech firms for global adoption, targeting businesses seeking cheaper ​ways to deploy AI ​at scale.

Artificial Analysis said DeepSeek’s ⁠V4-Flash model scored 50 out of 100 on its Intelligence Index, which combines results from nine benchmarks spanning coding, reasoning and workplace-style assignments.

That’s the same score as Google’s ​Gemini 3.6 Flash, and one point behind Meta’s Muse Spark 1.1 and GLM-5.2 ​from Z.AI, which ⁠is also known as Zhipu.

Moonshot’s Kimi K3, however, scored a 57 while Anthropic’s Claude Opus 5, Fable 5, and OpenAI GPT-5.6 scored nine or more points higher.

DeepSeek is also preparing a more powerful version of its model, called the ⁠V4-Pro.

It ​has not given a date for that version’s official release.

Separately on ​Monday, Alibaba unveiled its largest and most capable artificial-intelligence model to date, the Qwen3.8-Max, which is not far behind in size when compared with an ​offering from domestic rival Moonshot AI launched last month.

The new breakouts were uncovered during the company’s publicly announced investigation into how one of its agents escaped what was meant to be a contained testing environment this month, the two people said, and OpenAI is now looking into those instances as well.

One of the sources said that the escapes were limited in nature and that none of the agents were thought to have ​left OpenAI’s network.

An OpenAI spokesperson referred to a statement issued by the company on Tuesday that said it was reviewing “broader activity from our models” in addition to ​the Hugging Face intrusion.

The discovery of additional rogue behaviour at OpenAI, even if limited in nature, could feed a growing appetite for regulation ⁠coming out of the White House and elsewhere.

The expanded investigation by OpenAI was launched shortly before its primary rival, Anthropic, disclosed that its models were also responsible for a series of ​break-ins that led to breaches at three other companies dating back to April, according to the two sources and a third source familiar with the matter.

The recent discovery of ​other past breakouts at OpenAI has not previously been reported.

Growing concerns

AI safety experts said the new disclosures paint a portrait of a group of cutting-edge labs whose ability to develop dangerous autonomous hacking agents outstrips their ability to keep them under control.

“We have a whole industry where the people designing, developing and putting out these tools aren’t keeping up themselves to responsibly develop these things and keep them ​safe,” said Maurice Chiodo, a mathematician who works at Cambridge University’s Centre for the Study of Existential Risk.

Reuters could not establish exactly how many incidents OpenAI investigators found or ​the timings or circumstances under which they occurred.

The three sources said OpenAI and outside experts were examining log data from earlier in the year in a bid to understand what took place.

OpenAI ‌first launched ⁠the investigation following the early July intrusion at Hugging Face, where an OpenAI agent went haywire for days inside another company’s network in a botched effort to cheat on an internal test.

As part of that hacking spree, OpenAI said that four accounts at four other companies were also compromised.

One of those companies was New York-based Modal, corporate officials there said.

Chiodo said his concerns were heightened by indications that neither OpenAI nor Anthropic were watching the agents as they went rogue.

Reuters has previously reported that OpenAI realised its agent had ​broken into Hugging Face only after the company ​contained the hack, contacted the FBI ⁠and went public about the intrusion.

OpenAI has said the Reuters account contained inaccuracies but has not responded when asked what they were.

In its Thursday statement disclosing how its own agents hacked victims online, Anthropic suggested that it had not been watching them in real time, ​saying that “real-time monitoring of the evaluation logs would have helped to surface the problem sooner.”

Chiodo said that pointed to a lack ​of proper scrutiny.

“It seems ⁠like they weren’t even looking,” Chiodo said.

Anthropic said that while it did have real-time monitoring in place, that monitoring had not been used “for this threat surface” due to a misunderstanding between the AI company and a partner.

New govt oversight

The rapidly widening scope of the runaway AI agents story already has heightened pressure from lawmakers and officials across the United States and Europe to push ⁠for new ​government oversight of the labs whose models power them.

“We’re looking at controls,” US President Donald Trump told reporters on Thursday. ​

On Friday, the European Commission said it held talks with OpenAI and Anthropic over the hacking incidents.

Mark Warner, the top Democrat on the US Senate Intelligence Committee, said on Friday that the Anthropic incident “tells me that legislatively we’re ​correct to require mandatory capabilities testing of these advanced models.”

The “create image” tool, rolled out on Thursday, integrates Google’s Nano Banana 2 image-generation technology to let users zoom into locations and build images in seconds based on Google Earth satellite, aerial and 3D-mapping data.

The company unveiled the feature as a way to “visualise history, create real estate plans and more.” But disinformation researchers are warning it could enable bad actors to misuse Google Earth — a key resource for fact-checking and verification — to create realistic geospatial fakes.

“Google spent 20 years building the reference the world checks against,” digital investigations expert Henk Van Ess wrote on Substack. “Today it added a button that makes things up.”

“The forgery does not have to look convincing on its own,” Van Ess added. “It inherits the credibility of the map it was born on.”

Brady Africk, a research analyst at the American Enterprise Institute specializing in satellite imagery analysis, told AFP the Google Earth update “makes it easier to generate convincing fake satellite imagery that can spread quickly online and mislead the public.”

“These AI-generated fakes, growing more common, may also erode public trust in satellite imagery, and make the jobs of journalists and researchers more difficult.”

In a response to AFP on X, Google said images created with the feature include SynthID digital watermarks, invisible markers embedded in media generated using the company’s artificial intelligence tools. Users can ask Google’s Gemini chatbot if a SynthID is present.

“We take misinformation seriously,” the company wrote.

Google’s statement said the company prevents “image creation on harmful topics” and its AI policy instructs users against “misinformation, misrepresentation or misleading activities.”

Yet AFP’s tests of the feature Friday were able to fabricate satellite images that could have serious global consequences: an explosion in Paris, a nuclear site in Iran, a bomb crater in Russia and an Daesh group training ground in Syria.

The tool also fulfilled prompts to visualise other fake scenes, including floods across Bangladesh, a migrant caravan camped at the US-Mexico border and a suspicious warehouse housing vans in Georgia — one of several states US President Donald Trump has falsely accused of widespread election fraud.

Similar fakes have had real-world impacts. In 2023, an AI image depicting an explosion at the Pentagon briefly rattled the markets.

Early in the US war with Iran, an AI-altered satellite image depicting a destroyed US military base garnered millions of views across platforms.

“I cannot stress how irresponsible this is,” Ross Burley, executive director of the London-based Centre for Information Resilience, told AFP. “Trust in satellite imagery has taken decades to build and could be irrevocably damaged overnight.”

The group is calling on Google to reverse the decision, Burley said.

GeoConfirmed, a volunteer-driven open-source intelligence project that verifies visuals from conflicts around the globe, also urged Google to reconsider.

“We are already observing individuals exploiting the new Google Earth web tool to make military positions, relabel buildings as schools, and experiment with manipulating the information environment,” the group wrote on X.

“The primary, and perhaps only, practical use of this tool appears to be the creation and dissemination of mis- and disinformation.”

The new incidents were due to a mistake that inadvertently gave Anthropic’s models access to the ‌open internet. That contrasts with OpenAI, whose AI agent independently exploited a novel vulnerability to reach the internet during cyber testing.

Even so, the latest disclosure underscores how AI has increased cybersecurity threats and how its developers can struggle to keep the capabilities of their models contained.

It is likely to add fuel to an intensifying US government push to better manage AI security risks at a time when Anthropic and OpenAI are racing to release more capable systems ahead of their planned ​public listings. Prominent leaders at these labs have called for a slowdown to address risks first.

San Francisco-based Anthropic said in a blog post it identified the incidents after reviewing 141,006 test sessions, a ​process it launched after OpenAI said last week that an autonomous agent powered by its AI models triggered a hack that compromised the infrastructure of startup Hugging ⁠Face.

During cyber testing, Anthropic’s Claude models were told they had no internet access, but a misunderstanding that involved one of Anthropic’s evaluation partners left the systems connected to the public web. That enabled unauthorised access ​to three organisations’ systems, Anthropic said without naming the organisations.

“Claude compromised the impacted organisations’ infrastructure using basic techniques, such as exploiting weak passwords and unauthenticated endpoints,” Anthropic said.

Jeffrey Ladish, executive director of Palisade Research, which studies ​the offensive capabilities of AI systems, said he suspected a range of top AI companies had experienced other incidents that have gone undetected or had not been publicly disclosed.

“This is only going to get worse as the models get smarter. They’re going to be better at cheating. They’re going to be better at lying,” he said.

Capture-the-flag exercises go awry

Anthropic said the incidents — which it labelled an “operational failure” — involved three separate models: Claude Opus 4.7, Claude Mythos 5 and an internal research ​test model. The earliest cases date back to April and occurred in evaluation environments that intentionally lacked safeguards so Anthropic could assess what its AI was capable of.

Its models were tasked with so-called “capture-the-flag” challenges, fictional ​scenarios in which they had to find hidden information in simulated networks.

In one incident, Claude Opus 4.7 was given a fictional target company, which turned out to share the name of a business in the real world. The AI ‌model then found ⁠and exploited bugs that let it access credentials and a database of that business. Opus 4.7 rationalised that what seemed to pertain to the real world must have been part of the simulation Anthropic had set up, the AI startup said.

A separate incident involved Anthropic’s newer, not-public test model, which independently halted its attack after realising the target it reached was real. This behaviour has made Anthropic cautiously optimistic about its progress to make AI behave appropriately, “but we would need to perform more testing to be confident in this conclusion,” it said.

Anthropic said it suspended all cyber evaluations on July 23. It notified the affected organisations on July ​27, two of which were unaware of the activity ​before being contacted. Anthropic said it continues ⁠to reach out to the third company.

One of its third-party evaluation partners, a cybersecurity lab called Irregular, told Reuters that it has an ongoing investigation into the incidents.

OpenAI’s Altman in talks with senators, White House

Anthropic said the incidents underscore a need for stronger controls in both internal and third-party testing environments as AI models ​become increasingly capable of carrying out real-world cyber activities.

Elon Musk, CEO of SpaceX, which operates a competing AI lab, responded to the news on X ​by saying “this will happen frequently ⁠as AI becomes smarter and more agentic,” referring to computer programs or “agents” that act with limited human intervention.

The OpenAI agent that broke into Hugging Face, a platform used by developers to host and collaborate on AI models, went on a dayslong hacking spree that OpenAI didn’t catch until well after the threat was contained and the FBI was informed, Reuters had reported.

OpenAI CEO Sam Altman said this week he has discussed the hack with senators ⁠on Capitol Hill, ​and an OpenAI spokesperson said he planned to discuss upcoming AI models and testing with the White House.

Washington has started tightening oversight ​of new model rollouts. On June 2, US President Donald Trump directed advisers to develop a voluntary cybersecurity testing framework for the most advanced AI, including input from the technology’s developers. Anthropic earlier restricted access to its Fable 5 and Mythos 5 models after the US ​temporarily issued an export control directive, citing national security concerns.

The company, which builds autonomous mobile robots that transport storage shelves to warehouse workers, has become the world’s largest supplier of such systems.

Its technology is already used by major UK retailers including Tesco, Asda and Next.

Unlike traditional warehouse automation, Geek+’s robots require minimal fixed infrastructure, allowing businesses to deploy them more quickly and at lower cost.

The move comes as Britain faces sluggish productivity growth and labour shortages, the BBC says in a report.

The OECD has identified wider adoption of robotics as key to improving efficiency, noting that UK businesses lag behind many peers in automation despite the country’s manufacturing heritage.

Britain has become Geek+’s largest European market, with partner MotionTech deploying more than 2,000 robots across 10 warehouse sites.

Industry executives say demand is being driven by the need for faster order fulfilment, higher storage capacity and reduced reliance on manual labour.

Trade unions have urged businesses to ensure automation improves jobs and productivity while investing in worker retraining rather than using technology solely to cut employment.

The rapid growth of Chinese robotics is part of Beijing’s broader strategy to strengthen advanced manufacturing.

Analysts say the sector is benefiting from technology and supply chains developed for China’s electric vehicle industry, while companies such as XPeng are expanding into robotics alongside vehicle production.

Geek+ said its long-term goal is to develop fully automated warehouses capable of handling picking, packing and other logistics tasks, although experts believe humanoid robots remain years away from widespread commercial use.

The German manufacturer envisioned a battery-powered flying vehicle designed for China’s emerging low-altitude economy. To make that vision real, Volkswagen turned to Chinese design and technology, which was beginning to move faster than its own.

The company created an internal startup team in Beijing to develop a flying car — a challenge that had already tested its Porsche and Audi divisions. The goal was to build a “luxury futuristic” drone capable of carrying four wealthy passengers between cities such as Beijing and Tianjin in a quiet aircraft with noise levels half those of a helicopter.

“Looking ahead, we see this as having strong potential to become a key market segment for Volkswagen Group,” VW project lead Zhou Jin said in a 2022 video posted on the company’s website.

But while Chinese companies moved closer to launching flying-car services, Volkswagen’s project remained on the ground.

The effort failed to match the speed of China’s low-altitude economy — a growing aviation sector covering drones, air taxis and other services operating below 1,000 meters. Chinese competitors, local governments and supply chains advanced faster than Volkswagen, whose global operations were built around slower development cycles, compliance systems and traditional automotive engineering.

The setback became another example of established foreign automakers struggling against rapidly advancing Chinese competitors.

“If you’re not local enough, if you’re not faster or as fast as the Chinese, you don’t stand a chance,” said Emerson Xu, CEO of consultancy NexAvian and former China head of air-taxi maker Volocopter.

The collapse of Volkswagen’s flying-car project also exposed changing legal risks for foreign companies operating in China. While Western firms have long accused Chinese companies of intellectual property theft, Volkswagen became involved in a five-year legal dispute after Chinese partner Pantuo Aviation accused the automaker of infringing trade secrets related to flying-car development.

A related criminal investigation targeted Zhou, the Chinese executive Volkswagen had promoted as the public face of its innovation effort.

Volkswagen declined to comment publicly on its flying-car development or the case involving Zhou. The company said it believed the claims against it were “entirely without substance.”

“I really can’t wrap my head around why I have been left alone to face a criminal case I was innocently dragged into, just by carrying out my work duties,” Zhou told Reuters.

She said she had repeatedly asked Volkswagen to actively resolve the commercial dispute but declined to discuss details of the investigation, saying the matter was for Volkswagen to address.

The story of Volkswagen’s attempt to develop and later abandon a flying car in 2024 has not previously been reported.

Reuters reviewed hundreds of pages of Volkswagen documents, including planning papers, legal records and internal communications. Reporters also examined disclosures from former partners and interviewed five people familiar with the project.

Volkswagen continues to work with Chinese companies, including electric-vehicle maker Xpeng and autonomous-driving technology firm Horizon Robotics, as it seeks to regain ground in the world’s largest auto market.

The company’s decline in China has been severe. Volkswagen deliveries in the country peaked at 4.2 million vehicles in 2019 but dropped to 2.7 million last year, pushing the company behind Chinese rivals BYD and Geely.

The downturn has pressured Volkswagen’s profits as it also faces US tariff costs and difficulties restructuring its German manufacturing operations. The company recently announced plans to reduce vehicle models and cut up to 100,000 jobs.

Early mover, then overtaken

In the late 2010s, Volkswagen joined a global race among automakers to develop electric vertical takeoff and landing aircraft, commonly known as eVTOLs.

The idea was straightforward: electric flying vehicles could reduce travel times in crowded cities while helping automakers transform into technology-focused mobility companies.

Toyota invested in Joby Aviation, while Porsche Consulting estimated the urban air mobility industry could become worth $32 billion by 2035. Volkswagen’s Porsche brand partnered with Boeing, while Audi worked with Airbus on flying-car concepts.

Neither project produced a commercial vehicle, leaving Volkswagen executives to focus on China — a market where the company was still dominant.

When Volkswagen launched its China flying-car project in 2019, the industry was relatively open. By the time the company ended the effort in 2024, competition had intensified.

China had elevated the low-altitude economy into a national strategic priority, encouraging domestic companies to enter the field. At least seven Chinese companies are expected to offer eVTOL vehicles by the end of 2026, according to CCID Consulting, a Chinese state-affiliated think tank.

In March, China opened its first national flying-car testing centre in Guangdong province.

Volkswagen partner Xpeng, which is helping the German automaker expand in electric vehicles, is also developing its own flying vehicle: an extended-range electric truck capable of launching a two-passenger drone from its cargo area.

The wider eVTOL sector, however, has struggled globally. Several startups in the United States and Europe have collapsed before achieving large-scale commercial operations, and no company has yet created a sustainable flying-car business.

A luxury vehicle for China’s wealthy

Volkswagen initially planned to build a full-scale prototype called V.MO within two years.

Internal planning documents described the target customers as China’s “established life enjoyers” — wealthy consumers seeking status and exclusivity.

The vehicle was designed to carry four passengers and luggage, with screens inside the cabin to provide entertainment.

The startup team was small, with fewer than 10 members led by Zhou, then the 39-year-old director of Volkswagen’s Beijing innovation centre.

Volkswagen promoted the group as a “young team of Chinese experts” that had “started from scratch.”

The company concluded it needed a Chinese partner because the local market was “ahead of European R&D,” Zhou said in a promotional video.

However, Volkswagen struggled to find a partner with advanced technology while avoiding political risks linked to government connections.

The company explored working with Guangzhou-based eVTOL developer EHang but concluded the company still had a gap to meet Volkswagen’s automotive engineering standards.

Volkswagen also considered Chinese drone manufacturer Sichuan Tengden but abandoned the possibility after concerns over capacity and links to China’s military sector.

Instead, Volkswagen hired AVIC General Huanan Aircraft Industry Company, an aviation subsidiary linked to state-owned defence contractor AVIC, for consulting work.

The Star Wars-like aircraft

By 2021, Volkswagen selected Shanghai-based startup Pantuo Aviation to conduct a feasibility study for a luxury flying vehicle carrying a Volkswagen badge.

Pantuo’s design featured four rotating wings and resembled a futuristic spacecraft. Two people familiar with the project said the concept impressed Volkswagen managers.

Pantuo founder Zhang Qiong said Volkswagen’s team had creativity but lacked practical aviation experience.

“At the very beginning, they really had nothing,” Zhang said.

She said Volkswagen approached the project with a traditional automotive mindset, treating the aircraft like a vehicle assembly project rather than a complex aviation development challenge.

“They seemed to think it should be like assembling a car — where all the parts exist and you just put them together,” Zhang said.

Volkswagen did not comment on Zhang’s account.

Internal evaluations later found major technical problems with Pantuo’s design. Volkswagen and AVIC GA concluded the concept carried “uncontrollable risk.”

A September 2021 Volkswagen assessment said the aircraft lacked convincing feasibility because of poor aerodynamic performance, limited range and concerns over weight.

The company described the cooperation with Pantuo as a “mistake” and blamed both limited aviation experience inside Volkswagen and an overly ambitious design.

Volkswagen returned the project to the drawing board.

From “Flying Tiger” to cancellation

In 2022, Volkswagen partnered with Hunan Sunward Technology, a company producing drones and light aircraft.

Together they developed a prototype called the “Flying Tiger.”

The aircraft used eight rotors for lift and two for forward movement. Volkswagen and Sunward later created additional prototypes, including “Sky Garden,” a luxury version that became the project’s showcase model.

In March 2023, Chinese Premier Li Qiang sat inside the mock-up, highlighting the project’s connection with China’s ambitions in the sector.

The model was later transported to Volkswagen headquarters in Wolfsburg, Germany, where executives including CEO Oliver Blume and CFO Arno Antlitz reviewed the project.

Antlitz encouraged the team to continue, citing the need to learn from China’s rapid innovation pace, according to people familiar with the meeting.

A prototype was tested in Inner Mongolia, where engineers worked from converted shipping containers.

In October 2023, Volkswagen partnered with Wanfeng Auto Holding Group, which had experience in aviation, to prepare for commercialisation.

But by March 2024, Volkswagen executives raised concerns about profitability, competitiveness and China’s rapidly advancing domestic players.

A company strategy document warned that momentum in China’s flying-car industry had already been captured by companies including Xpeng and Geely.

Although management approved moving forward, the final decision rested with Volkswagen China chief Ralf Brandstaetter.

He decided the company needed to focus on its struggling core automotive business.

In June 2024, Brandstaetter ended the flying-car project and disbanded the team, according to people involved.

He informed Wanfeng through a WeChat message, documents reviewed by Reuters showed.

Legal battle continues

The project’s end did not end the legal problems.

After Pantuo filed a criminal complaint over alleged trade-secret violations in 2021, Shanghai police opened an investigation in 2023.

Zhou was named as the suspect rather than Volkswagen, according to case documents.

Zhang said she had filed the complaint against Volkswagen, not Zhou.

Zhou said she had been left to deal with the case alone despite carrying out her duties for the company.

The dispute also moved into civil courts. In 2025, Pantuo filed a $30 million lawsuit against Volkswagen and AVIC GA, accusing them of intellectual-property theft.

China’s Supreme People’s Court later dismissed the case against Volkswagen, saying the dispute should have been handled through arbitration. The claim against AVIC GA was allowed to continue.

The case reflects a broader shift in China’s technology environment, where domestic companies are increasingly defending their own intellectual property.

“The shoe is on the other foot,” said Mark Cohen, a former US intellectual property attaché in Beijing.

As Chinese companies develop more advanced technology, he said, they are increasingly becoming plaintiffs rather than defendants.

While Volkswagen abandoned its flying-car ambitions, Wanfeng — the company it once selected to help bring the vehicle to market — later acquired German aerospace startup Volocopter after it entered bankruptcy.

Modal executives emphasised that the company itself was not hacked.

According to a timeline ​published by Hugging Face on Tuesday, the rogue agent broke into a sandbox, or ⁠an isolated testing environment, “hosted on a third-party provider’s infrastructure” before turning it into a launchpad for the broader ​hack.

The third-party provider was not named in the blog post, but Modal’s chief technology officer, Akshat Bubna, said the ​agent exploited vulnerable code written by a customer that was hosted on Modal’s platform.

Modal said the customer had “published an unauthenticated endpoint that allowed anyone on the internet to use their sandboxes for code execution” — the digital equivalent of leaving a door open on ​the internet.

“Modal’s platform or isolation were not compromised in any way,” Bubna said.

Although the compromise of a Modal ​customer was just an initial step in the wider hacking campaign against Hugging Face, it shows that the rogue agent roamed ‌further afield than was previously known.

OpenAI declined to comment specifically on the hack of one of Modal’s customers, instead referring Reuters to an update in which the company said that its rogue agent had broken into four accounts at four separate services.

OpenAI did not identify those services, but a person familiar with the matter identified Modal ​as one.

The company said ​it had not identified “any ⁠other activity at the level of severity or scale of what we’ve shared related to Hugging Face, which involved a platform-level compromise.”

The early July intrusion at Hugging Face, ​carried out by an out-of-control agent that OpenAI was testing, drew global attention, evoking ​science-fiction scenarios of ⁠artificial intelligence run amok.

Last week, Reuters reported that OpenAI did not notice that its agent had gone haywire until well after the threat was contained and the FBI was alerted.

OpenAI said at the time that there were inaccuracies in ⁠the Reuters ​reporting but did not elaborate.

The company said in its Tuesday update ​that it had taken the AI model being tested and “deactivated, encrypted, and restricted it from research access.”

The Federal Communications Commission on Tuesday afternoon released the measures, which bar Chinese imports of new humanoid and quadruped robots, ‌in addition to connected power inverters, which enable renewable energy sources and batteries to connect to grids and data centre equipment.

The restrictions, as first reported by Reuters, show the Trump administration is aiming to safeguard the US artificial intelligence supply chain from Chinese threats of disruption, data theft and cyberattacks, while also driving firms to shift manufacturing to the US.

“These devices could create supply chain vulnerabilities that could disrupt US economic and national security and could create a cybersecurity risk that threatens ​American critical infrastructure,” the FCC said in a statement.

“The FCC will continue to do our part to secure America’s critical supply chains,” FCC Chairman Brendan Carr added in the press release.

The Chinese ​embassy in Washington said Beijing “urges the United States to heed the objective and rational voices of the business communities in both countries” and “stop smearing Chinese companies ⁠and threatening them with sanctions.”

China’s government will “take all necessary measures in response to any action that causes material harm to its interests,” the embassy said.

Some analysts forecast broad adoption of humanoid robots, topped with AI-enabled “brains,” ​in consumer and industrial arenas, while explosive data-centre construction in the US will depend on reliable sources of inverters.

Treasury Secretary Scott Bessent has warned that Chinese AI firms could face US sanctions for stealing US intellectual ​property.

US officials are also keen to avoid another scenario as happened with rare earth minerals — critical inputs for tech manufacturing so dominated by China that Beijing has been able to leverage access to them to secure big wins on the international stage.

Non-Chinese supplies

Following Tuesday’s actions, the FCC is expected to exempt many non-Chinese suppliers from the restrictions, as it has done with recent bans on foreign drones and routers, four additional sources said.

The measures, which went into ​effect upon publication, apply only to robot and inverter models that have not yet been released.

However, the FCC has the authority to revoke authorisations for sales of models that have already been authorised for ​purchase in the United States.

President Donald Trump is credited with bringing international attention to the tech threat posed by China during his first term, giving voice to concerns about intellectual property theft by Chinese firms, and the threat of state-sponsored ‌spying by Chinese ⁠telecom juggernauts like Huawei.

But he has so far taken a much more dovish approach during his second term, faced with Beijing’s aggressive use of export controls on rare earth minerals last year.

Chinese robot makers in crosshairs

The robot ban is expected to hit Unitree, a world leader in humanoid robots with just under a fifth of global market share, according to Counterpoint Research.

The firm, which is one of three Chinese companies dominating the nascent but buzzy industry, was recently added to the Pentagon’s list of alleged Chinese military-backed companies, which can be a harbinger of tougher US action.

Unitree recently formed a partnership with Nvidia to use the AI chip ​company’s cutting-edge Blackwell chip to power the brain of ​a Unitree robot.

Nvidia has said data ⁠from the robots will remain in the US and that Unitree’s biggest customers are US academic and research institutions.

China hawks fear the robots could spy on key US industries, extracting data and sending it to Beijing or disrupting critical functions.

Robots “collect data that could be leveraged by malign actors to surveil Americans, enhance the capabilities ​of foreign intelligence services, or to remotely commandeer the robots,” the FCC said on Tuesday.

US Representative John Moolenaar, a Michigan Republican who chairs the House ​Select Committee on China and ⁠has proposed legislation targeting Chinese robots for national security reviews and potential bans, said the FCC move “protects our country and strengthens our nation’s robotics industry.”

China is the world’s largest maker of inverters, led by Sungrow Power Supply and Huawei, already heavily sanctioned by the US. Beijing has been expanding its share in the Western inverter market by driving down prices.

Reuters previously reported that the FCC was working on a Chinese inverter ban prompted by recent action ⁠by Europe and ​concerns around disruption and installation of malware.

Authorities want to avoid another Chinese government-linked hacking campaign like the one dubbed Volt Typhoon, revealed ​in 2023.

By taking control of privately owned routers, the attackers sought to hide subsequent attacks on American critical infrastructure.

The US Department of Defence is already barred from procuring solar photovoltaic cells, modules or inverters manufactured by a foreign entity of concern, which would ​include Chinese companies.

Unitree, Sungrow and Huawei did not immediately respond to requests for comment.

The issue, first identified by Reddit users, involved more than 200 Claude conversations appearing across dozens of search results.

The chats covered a wide range of topics, including job applications, corporate projects, healthcare discussions and personal queries.

The publicly accessible conversations were no longer searchable by the weekend after the links were removed from search results, although many had already been archived and shared online.

Anthropic said users retain full control over whether to share their conversations and stressed that only chats users had chosen to make public through the platform’s sharing feature were affected.

A company spokesperson said shared conversation links were “not guessable or discoverable unless people choose to share them themselves.”

“When someone shares a conversation, they are making that content publicly accessible, and like other public web content, it may be archived by third-party services,” the spokesperson said.

However, while Claude’s sharing feature warns that “anyone with the link” can access a conversation, it does not explicitly state that the shared links may also be indexed by search engines such as Google.

The exposed conversations revealed users asking Claude to assist with a variety of tasks, ranging from drafting unpublished corporate blog posts and discussing confidential work projects to reviewing CVs containing names, contact details and employment histories.

Some chats also appeared to contain sensitive workplace material, including healthcare-related research and transcripts of private discussions.

The incident is the latest in a series of privacy incidents involving leading AI companies, raising fresh questions about how user conversations are handled once they are shared online.

Last year, OpenAI modified ChatGPT’s sharing system after publicly shared conversations became searchable online, while Elon Musk’s Grok chatbot also saw hundreds of thousands of shared chat logs indexed by search engines.

Google said it does not determine which webpages become publicly searchable, noting that website owners control whether their content can be crawled and indexed.

“We give site owners clear controls to decide whether pages can be crawled or indexed, and we always respect those directives,” a Google spokesperson said.

The removal of Claude conversations from search results suggests Anthropic used standard tools available to website owners to prevent further indexing.

Similar chat links had also appeared on other search engines, including Bing, Brave and DuckDuckGo.

If not corrected, the seats could injure passengers and crew members during an emergency landing or ​block the aisle and slow an evacuation, the agency said.

The FAA’s proposed ​airworthiness directive issued on Monday would apply to 453 jets registered ⁠in the US.

The agency only has jurisdiction over US airlines, but foreign regulators ​typically follow FAA directives if applicable.

Nearly 2,300 737 MAX jets are in service around ​the world, including 823 in the US, according to aviation advisory and intelligence firm IBA.

The proposed directive comes as Boeing works to improve its production quality and boost output under CEO Kelly Ortberg. ​

Production quality problems were revealed in early 2024 when a door-plug panel blew ​out of a nearly new Alaska Air 737 MAX in flight.

The FAA said in the airworthiness ‌directive ⁠proposal that it received a report that some passenger seat assemblies were not correctly installed in the seat tracks.

That meant the assemblies could disengage from the seat tracks if there was an increased load, turbulence or an emergency landing, the FAA said.

There ​could be up to ​69 track-mounted passenger ⁠seat assemblies on each 737 MAX plane, and the issue would take an estimated one work hour to inspect and then ​an hour to fix each assembly and required no parts, the ​FAA said. ⁠

Airlines might be able to have multiple employees inspecting seats simultaneously, greatly reducing the total time for each aircraft.

It did not say how quickly airlines would need to correct ⁠the ​issue.

A Boeing spokesperson said the planemaker issued guidance to ​operators about the issue in December 2025.

“We support the FAA making that guidance mandatory,” the spokesperson said in ​an email.

J&J said the settlement covers about 76,000 claims, including ones consolidated in federal court in New Jersey, and related cases in state court, representing nearly all of the remaining talc claims against the company.

J&J previously settled most of the cases ​alleging that its talc contained asbestos and caused mesothelioma.

Plaintiffs’ law firms confirmed the deal on Monday, saying it was a good resolution ​after a decade-long court battle.

The deal must be accepted by 95% of the ovarian cancer claimants in state ⁠or federal court before it becomes final.

J&J’s vice president of litigation, Erik Haas, said the claims were “meritless” and that the company was willing to settle ​in order to get closure.

“While we are confident the company would have ultimately prevailed with further litigation, as it has in the vast majority of ​cases tried to date, this resolution allows the company to put this matter behind it and remain focused on its mission to develop medicines and devices that save lives,” Haas said.

J&J expects to pay $3 billion in 2027, and it will make further payments in 2028.

But the deal could be worth more, depending on how many people participate ​in the settlement.

Chris Seeger, an attorney who represents about 2,500 clients with talc claims and helped negotiate the agreement, said J&J could ultimately pay $7 ​billion or more.

The settlement assigns specific values to qualifying ovarian cancer claims but does not cap J&J’s total payout, he said.

“We got a fair settlement, and our ‌clients are ⁠going to be happy with it,” Seeger said in an interview.

Deal comes after courtroom wins

J&J reached the settlement after a series of wins in court, including victories in individual trials, successful efforts to disqualify plaintiffs’ lawyers from the litigation, and court rulings against experts that plaintiffs had used to prove their cases in court.

J&J won a significant court victory in the long-running legal battle last week, when a federal judge cast doubt on individual plaintiffs’ ability to prove ​that talc specifically caused their ovarian ​cancer.

J&J has long denied that its ⁠talc products caused cancer, saying that talc was safe and did not contain asbestos.

The company stopped selling talc-based baby powder in the US in 2020, switching to a cornstarch product.

The litigation resumed in March 2025, after being put ​on hold for more than three years while J&J unsuccessfully pursued a strategy known as the “Texas two step,” filing three ​bankruptcies through a ⁠shell-company subsidiary in an effort to settle the cases. Each bankruptcy ended in dismissal.

Before the bankruptcy attempts, J&J had a mixed record in talc trials, with a multibillion-dollar verdict in favour of 22 women who said baby powder caused their ovarian cancer.

The company won some trials outright and had other verdicts reduced on appeal.

Unlike ⁠the proposed ​bankruptcy settlements, Monday’s agreement applies only to existing claims and does not address future lawsuits.

​The exclusion of future claims made more money available to current plaintiffs than the bankruptcy proposal did, and it also accelerates the payments so that all claims will be paid within ​18 months instead of being spread out over more than a decade, Seeger said.

The ministry said Washington was threatening Chinese companies with punishment based on allegations they used “distillation” to copy advanced US AI models, despite what it called a lack of factual or legal grounds.

Model distillation is a widely used AI training technique in which developers use the outputs of a ​more capable model to train or improve another system. US officials say they distinguish between legitimate distillation and large-scale ​extraction that amounts to intellectual property theft.

‘All necessary measures’

“For any action that causes substantive harm to ⁠Chinese interests, China will take all necessary measures to firmly safeguard its legitimate rights and interests,” a ministry spokesperson said ​in a statement.

The comments mark an escalation in a dispute centred on Beijing-based Moonshot AI, whose recently released Kimi K3 model has ​drawn attention for its coding capabilities and intensified debate in Washington over whether Chinese developers are copying US models or rapidly closing the technological gap through their own research. The controversy echoes the reaction in the US to the rise of Chinese startup DeepSeek last year.

White House Office of ​Science and Technology Policy Director Michael Kratsios said last week the US government had information indicating Moonshot distilled Anthropic’s Claude Fable 5 ​model to develop Kimi K3.

Kratsios alleged Moonshot had built a sophisticated internal platform to conduct large-scale distillation of US models and switched between ‌multiple methods ⁠of access to avoid detection. He also alleged the company had acquired servers equipped with Nvidia’s GB300 chips and accessed such systems in Thailand, likely to train its models.

US Treasury Secretary Scott Bessent later warned that Chinese companies could face financial sanctions or placement on the Commerce Department’s Entity List, which restricts access to US technology.

“We support open-source AI and the innovation it unlocks. ​But open source is not ​open season on American IP,” ⁠Bessent wrote on social media platform X.

“When PRC (Chinese) firms conduct covert, industrial-scale distillation attacks that cross the line into IP theft, sanctions and Entity List designations will be on the table,” ​he said.

Moonshot has rejected suggestions that Kimi K3’s performance was achieved via distillation, telling China’s ​National Business Daily ⁠last week that its performance gains came from original changes to underlying architecture.

Placement on the Entity List could severely restrict Moonshot’s access to US semiconductors, software and cloud services. The US used the trade blacklist as a central part of its campaign against Chinese telecommunications ⁠equipment maker ​Huawei beginning in 2019.

Anthropic said in February it had identified more than ​3.4 million interactions with its Claude models linked to Moonshot. It said hundreds of fraudulent accounts were used to target capabilities including reasoning, coding, data analysis, ​tool use, computer vision and the operation of computers.

The backstop from Nvidia would ‌help the ChatGPT maker lease a 10-gigawatt project that SoftBank’s energy subsidiary is developing in southern Ohio, the newspaper said, citing people familiar with the matter.

For OpenAI, a deal would be the ​first step toward controlling its own infrastructure instead of renting it from ​Microsoft, Amazon and Oracle, while for Nvidia, it would guarantee demand for ⁠its chips for years to come.

The project is expected to cost more than $500 ​billion in total, including the chips inside the data centre, according to the WSJ.

The $250 billion ​guarantee covers the data centre lease and debt financing, but would not cover the Nvidia chips inside the centre, the WSJ said, adding that the chipmaker was also discussing financing OpenAI’s chip ​purchases worth up to $350 billion.

Nvidia’s backing would support financing vehicles aimed at reassuring lenders ​about the project’s funding, the report added.

The first phase of the project is expected to be ‌finished in 2028, with around 800 megawatts of power, the Journal said.

The power is controlled by the US government and funded separately by Japan under a recent trade deal, tied to Tokyo’s pledge to invest $33 billion in a natural gas plant.

US Commerce Secretary Howard ​Lutnick is involved ​in deciding who gets ⁠access, according to the report.

Reuters could not immediately verify the report. Nvidia, OpenAI and the US Commerce Department did not respond ​to requests for comment outside regular business hours.

OpenAI, in advanced ​talks for ⁠several weeks to lease the site, is among the companies showing the strongest interest in the project, while Anthropic, Microsoft and Google have also spoken to Lutnick in recent weeks, ⁠the ​report said.

The deal underscores a broader shift as tech ​giants increasingly tap debt and equity markets to fund AI infrastructure, with spending set to top $700 billion this ​year.

The agent – a program capable of making decisions and executing complex tasks with little or no human oversight – attempted to break out of its isolated testing environment ‌at OpenAI around July 9, according to two of the people.

The intrusion at Hugging Face, which operates as a repository for AI tools and models, began two days later on July 11 and lasted until July 13, said Thomas Wolf, Hugging Face’s co-founder.

It took several more days for OpenAI to realise its agent was behind the hack, and the two companies only communicated about it for the first time on or around July 20, according to Wolf and three of the people familiar with the investigation.

OpenAI’s public disclosure, on July 21, that one of its agents had slipped out of control and carried out the break-in at Hugging Face drew global attention. But many details of the hack, including how long the agent went rogue and OpenAI’s belated knowledge ​of it, are being reported here for the first time.

Hugging Face is preparing a public timeline of the hack, Wolf said, adding that he could not speak to what ⁠happened at OpenAI. In a statement, OpenAI said the hack was unprecedented and “marks an important moment for AI safety.” It added that it was reviewing the incident with outside advisers and would eventually publish a technical report.

A spokeswoman ​said there were “several inaccuracies” in Reuters’ reporting but didn’t respond when asked to describe them.

The FBI declined to comment about the incident.

The incident, which evoked science fiction scenarios about humans losing control of dangerous AI systems, comes at a delicate ​time for OpenAI, the company behind ChatGPT. Its executives are preparing for a possible initial public offering that could come as soon as this year to help finance the billions needed to fund its growth in years to come.

OpenAI’s loss of control over its AI agent raises new questions about the company’s safety procedures, three cybersecurity experts said.

“Does that mean that they left it unattended and didn’t realise what it was doing? Or maybe they did and didn’t know how to contain it? Both are equally dangerous and alarming,” asked Marley Smith, ​the principal intelligence specialist at the nonprofit World Ethical Data Foundation.

Signs of trouble?

The episode started while OpenAI was testing the cybersecurity prowess of an agent powered by two of OpenAI’s most advanced models, GPT‑5.6 Sol and an unreleased ​model, which OpenAI has described as “even more capable.” By that point, there were already indications of strange behaviour from OpenAI’s technology, according to three sources.

In one case, an agent left notes apparently for future versions of itself, according to three people familiar with the matter. The ‌notes, found in ⁠a part of OpenAI’s infrastructure, laid out instructions for how agents could free themselves from OpenAI’s internal constraints, the people said. Earlier tests of the models yielded cases in which monitoring systems had been disconnected, one of the people said.

Reuters could not establish if these incidents were linked to the rogue agent that began escaping on July 9 and attacked Hugging Face on July 11.

Two people familiar with the matter said that it was not until after Thursday, July 16, when Hugging Face published a blog post saying it had been hacked by “an autonomous AI agent system,” that OpenAI realised its own agent was responsible. That meant at least a week elapsed between when the model first exhibited signs of ​troubling behavior and OpenAI’s realisation that it was responsible for ​the hack.

The weekend of July 18 to 19, ⁠OpenAI staffers spotted clues in internal logs – records of what OpenAI’s systems did – showing that its agent had escaped from its testing constraints, two of the people familiar with the company’s investigation said. Reuters could not establish what prompted OpenAI to sift through the logs.

Four people familiar with OpenAI’s model-training practices say the company often runs several different model ​evaluations at the same time, all of which operate at high speeds and generate such enormous amounts of data that employees sometimes struggle to keep up.

By the time ​OpenAI alerted Hugging Face, the ⁠AI library had already called the FBI to report the hack, according to a person familiar with the matter. Reuters could not establish whether the bureau had opened an investigation.

New questions about autonomous agents

Autonomous agents are one of the most talked-about aspects of the AI industry. Boosters speak of creating armies of virtual employees that work 24 hours a day and send productivity soaring.

But increased autonomy comes with an increased risk of unexpected behaviour, and the powerful models they draw on are primed ⁠to take shortcuts ​to complete tasks or pass tests.

“The models lie, they cheat, they hack,” said Jeffrey Ladish, whose organisation, Palisade Research, studies the ​capabilities and motivations of AI agents.

Ladish said that while the hack of Hugging Face cast an unflattering light on OpenAI, it should spark broader questions over how much all the leading AI companies are willing to invest in onerous security measures while locked in a race with one ​another to deploy the best and fastest models.

“There has to be government oversight,” Ladish said, “because it won’t happen otherwise.”

The agent — a programme capable of making decisions and executing complex tasks with little or no human oversight — attempted to break out of its isolated testing environment ‌at OpenAI around July 9, according to two of the people.

The intrusion at Hugging Face, which operates as a repository for AI tools and models, began two days later on July 11 and lasted until July 13, said Thomas Wolf, Hugging Face’s co-founder.

It took several more days for OpenAI to realise its agent was behind the hack, and the two companies only communicated about it for the first time on or around July 20, according to Wolf and three of the people familiar with the investigation.

OpenAI’s public disclosure, on July 21, that one of ​its agents had slipped out of control and carried out the break-in at Hugging Face drew global attention.

But many details of the hack, including how long the agent went rogue and OpenAI’s belated knowledge ​of it, are being reported here for the first time.

Hugging Face is preparing a public timeline of the hack, Wolf said, adding that he could not speak to what ⁠happened at OpenAI.

In a statement, OpenAI said the hack was unprecedented and “marks an important moment for AI safety.”

It added that it was reviewing the incident with outside advisers and would eventually publish a technical report.

A spokeswoman ​said there were “several inaccuracies” in Reuters’ reporting but didn’t respond when asked to describe them.

The FBI declined to comment about the incident.

The incident, which evoked science fiction scenarios about humans losing control of dangerous AI systems, comes at a delicate ​time for OpenAI, the company behind ChatGPT.

Its executives are preparing for a possible initial public offering that could come as soon as this year to help finance the billions needed to fund its growth in the years to come.

OpenAI’s loss of control over its AI agent raises new questions about the company’s safety procedures, three cybersecurity experts said.

“Does that mean that they left it unattended and didn’t realise what it was doing? Or maybe they did and didn’t know how to contain it?

Both are equally dangerous and alarming,” asked Marley Smith, ​the principal intelligence specialist at the nonprofit World Ethical Data Foundation.

Signs of trouble?

The episode started while OpenAI was testing the cybersecurity prowess of an agent powered by two of OpenAI’s most advanced models, GPT‑5.6 Sol and an unreleased ​model OpenAI has described as “even more capable.”

By that point, there were already indications of strange behaviour from OpenAI’s technology, according to three sources.

In one case, an agent left notes apparently for future versions of itself, according to three people familiar with the matter.

The ‌notes, found in ⁠a part of OpenAI’s infrastructure, laid out instructions for how agents could free themselves from OpenAI’s internal constraints, the people said.

Earlier tests of the models yielded cases in which monitoring systems had been disconnected, one of the people said.

Reuters could not establish if these incidents were linked to the rogue agent that began escaping on July 9 and attacked Hugging Face on July 11.

Two people familiar with the matter said that it was not until after Thursday, July 16, when Hugging Face published a blog post, saying it had been hacked by “an autonomous AI agent system,” that OpenAI realised its own agent was responsible.

That meant at least a week elapsed between when the model first exhibited signs of ​troubling behaviour and OpenAI’s realisation that it was responsible for ​the hack.

The weekend of July 18 to 19, ⁠OpenAI staffers spotted clues in internal logs — records of what OpenAI’s systems did — showing that its agent had escaped from its testing constraints, two of the people familiar with the company’s investigation said.

Reuters could not establish what prompted OpenAI to sift through the logs.

Four people familiar with OpenAI’s model-training practices say the company often runs several different model ​evaluations at the same time, all of which operate at high speeds and generate such enormous amounts of data that employees sometimes struggle to keep up.

By the time ​OpenAI alerted Hugging Face, the ⁠AI library had already called the FBI to report the hack, according to a person familiar with the matter.

Reuters could not establish whether the bureau had opened an investigation.

Questions about autonomous agents

Autonomous agents are one of the most talked-about aspects of the AI industry.

Boosters speak of creating armies of virtual employees that work 24 hours a day and send productivity soaring.

But increased autonomy comes with an increased risk of unexpected behaviour, and the powerful models they draw on are primed ⁠to take shortcuts ​in order to complete tasks or pass tests.

“The models lie, they cheat, they hack,” said Jeffrey Ladish, whose organization, Palisade Research, studies the ​capabilities and motivations of AI agents.

Ladish said that while the hack of Hugging Face cast an unflattering light on OpenAI, it should spark broader questions over how much all the leading AI companies are willing to invest in onerous security measures while locked in a race with one ​another to deploy the best and fastest models.

“There has to be government oversight,” Ladish said, “because it won’t happen otherwise.”

US officials on Wednesday accused Chinese AI lab Moonshot of distilling its Kimi K3 model from Anthropic’s advanced Fable 5 model, prompting Treasury Secretary Scott Bessent to warn of potential sanctions.

Distillation is the process of training AI models using output from more advanced ones to lower the costs of training a powerful new AI tool.

The Commerce Department’s Bureau of Industry and Security is also investigating whether Chinese firms like Moonshot are accessing advanced US chips illegally to train their models. A Moonshot ​spokesperson did not respond to Reuters’ request for comment.

The dispute exposes a growing tension at the heart of the US-China AI race. Both sides increasingly view frontier AI as a ​strategic asset and a security risk, yet experts argue cooperation on safety standards is becoming more urgent as powerful models could be misused for cyberattacks ⁠or other harmful applications.

The accusations, coupled with reports Washington is weighing restrictions on Chinese open-weight models, could provoke tit-for-tat measures and jeopardise a planned US-China AI dialogue in September, analysts say.

The tensions come atop years ​of US export controls designed to curb China’s access to cutting-edge chips, measures that have increasingly dominated trade talks between the two countries.

“Depending on the number of Chinese companies targeted, (and) the nature of the punitive ​actions taken… the retaliation has the potential to scuttle both the AI dialogue and the September 24 meeting between Presidents Trump and Xi,” said Paul Triolo, a partner at DGA-Albright Stonebridge Group.

Beijing, meanwhile, is considering whether to restrict overseas users’ access to its models as a retaliatory measure, Reuters previously reportes.

Closed and open-source security risks

New York-based Hugging Face last week used a Chinese model, Z.ai’s GLM-5.2, to contain a cyberattack by a rogue OpenAI agent that escaped during safety testing, ​since American closed models’ safety guardrails were ironically too strong.

As Chinese and US frontier models achieve recursive self-improvement (RSI), where systems can autonomously enhance their own capabilities, researchers say both countries have an incentive ​to cooperate on safety standards before a more serious incident occurs.

Industry experts are also highlighting the risks posed by open-weight models, which can be downloaded, modified and redistributed with little oversight, limiting the effectiveness of software-based export controls.

“Godfather ‌of AI” ⁠Yoshua Bengio warned at China’s flagship AI forum last week that the deployment and sharing decisions of open-weight models are irreversible, and their safeguards are easier to remove.

“The logical thing to do is to find a good evaluation of these models, share the models that are not too dangerous, and not share those above the threshold of risk,” he said via videolink.

Resource, geopolitical constraints

Chinese AI models must undergo government safety and content reviews before release, though current rules do not cover post-release modifications.

Unlike US giants OpenAI and Anthropic, many Chinese AI labs lack the computing resources for extensive safety training and instead focus on improving ​model capabilities, industry observers say.

“It’s plausible China reconsiders allowing ​open-weight releases for frontier models down the ⁠line, but the bar for doing so is high,” said Kristy Loke, a MATS research fellow studying China’s AI governance.

Some AI safety researchers argue that frontier models in both the US and China should face stricter pre-release testing and independent third-party evaluations.

In the US, firms can voluntarily submit models for testing by ​the state-funded Center for AI Standards and Innovation (CAISI), though some lawmakers have called for mandatory federal reviews.

“In an ideal world, the two countries will ​come together to work on ⁠safer models… agree to build common standards around pre-release testing and set red lines for the most advanced open models,” said Loke.

Divided response on Chinese AI models

Some US government and AI industry officials remain split on how to respond to Chinese models, which account for about 60% of token usage by US companies on the OpenRouter platform.

OpenAI and Anthropic have lobbied Washington against lower-cost Chinese models, arguing they could undermine their business ⁠models.

OpenAI lead strategist ​Dean Ball wrote on X that the Trump administration could “create large amounts of regulatory risk around the use of open-weight ​Chinese models” to curb their adoption by US firms.

White House AI adviser David Sacks countered that leading US labs “want the government to eliminate their open-source competition” and argued for fair competition, adding in another post that the “Kimi Panic needs to stop”.

“As long ​as we don’t sabotage ourselves with unnecessary rules, the US will continue to win,” he said.

However, the US tech giant is likely to avoid fresh fines as EU regulators lauded good progress in its ongoing efforts to comply with the landmark legislation.

The fines underscored Europe’s determination to prevent Big Tech companies from thwarting rivals, defying US criticism and retaliatory tariff threats.

One fine of €460 million was handed out to Google by the European Commission under the Digital Markets Act for favouring its own services in shopping, hotels, transport and sports results in search results.

A second fine of €430 million ​targeted Google’s restrictions on its app store Google Play preventing app developers from steering users free of charge to cheaper ⁠offers on rival app stores or websites.

Reuters was the first to report on both fines, which are the first for the U.S. tech giant under the DMA, ​but the fifth and sixth overall for anti-competitive practices, making for total penalties of €10.38 billion over nearly two decades.

“Our duty and obligation is to comply with ​the laws, that our laws are fully respected,” EU antitrust chief Teresa Ribera told reporters when asked about US pushback.

“The DMA is to make sure we have a fair and level playing field. With these decisions we want to make sure there is competition,” EU tech chief Henna Virkkunen told reporters.

Google, which has 60 days to comply with the ​Commission’s orders to treat rivals in a fair and non-discriminatory manner and to allow app developers to steer users away from its app store, criticised the EU ​

findings and said it might take the Commission to court.

“To comply, we are having to strip away real-time Search features Europeans love — like instant pricing and direct availability for hotels, flights, ‌and restaurants - ⁠and dismantle safety protections on Google Play,” Google President of Global Affairs Kent Walker said in a statement.

“This isn’t fair competition; it’s product degradation driven by a small group of self-serving complainants, with European businesses and consumers taking the hit. Regulation should improve products, not make them worse,” he said.

MORE FINES UNLIKELY GIVEN ‘CONSTRUCTIVE DIALOGUE’

The Commission, which acts as the EU competition enforcer, pointed to a “constructive dialogue” with Google and significant progress made to comply with the DMA, indicating that daily penalties for non-compliance are likely ​off the table.

“Google has proposed and ⁠started testing changes to how it presents its own services on Google Search for free services such as shopping, hotels and flights,” the Commission said, calling it substantial progress.

“The Commission also notes that Google has proposed and started testing changes ​to how it presents shopping ads and content-related services, such as sports,” it said, adding it would assess ​the changes and continue ⁠talks with Google.

The EU watchdog also said Google may apply the principles of Thursday’s decision to its AI-generated summaries known as AI Overviews and AI Mode and that talks would continue to this end.

Google’s changes to its steering terms on Google Play received a tentative thumbs up from the Commission.

“These constitute good progress towards ⁠compliance and ​will also be assessed in light of the cease and desist order of today’s decision,” it ​said.

Europe’s crackdown on Big Tech has angered US President Donald Trump’s administration, which has threatened to retaliate with tariffs for what he said are moves targeting US companies while US lawmakers have also piled on the pressure.

The fines are ​the third under the DMA after penalties handed out to Apple and Meta Platforms in April last year.