The AI Wire ●

Attorneys general in eight states filed separate lawsuits against OpenAI on October 14, each in its own state court. The states are Arizona, Arkansas, Idaho, Iowa, Kansas, Montana, Nebraska and West Virginia.

The complaints allege ChatGPT lacks adequate safeguards for children and other vulnerable users, and that the company misled the public about safety. They seek disgorgement, civil penalties and court orders barring deceptive safety claims, among other remedies. These are allegations in civil complaints, not court findings.

OpenAI responded that it has age-specific protections including parental controls and break reminders, and that it is working with states on industry-wide policy. Reporting described the filings as the largest coordinated state action yet against an AI company.

At Character.AI's first bankruptcy hearing on October 14, a group of 40 state attorneys general urged a Delaware judge to protect young users and keep their data safe during the case. Character Technologies filed for Chapter 11 on October 12.

The company plans to use the case to address state investigations and lawsuits, license technology to Disney for $20 million, and look for a buyer willing to take on the chatbot business. The states say they are negotiating a settlement and want any buyer to protect chat histories and improve safety features.

Character.AI says its app remains operational during the process. The filing follows lawsuits and scrutiny over companion chatbots' interactions with children, which are central to the states' case.

Anthropic opened a new office in Singapore on October 14, its fifth in the Asia-Pacific region, and signed a memorandum of understanding with Singapore's Ministry of Digital Development and Information. The company describes Singapore as one of its most active markets anywhere.

The MoU covers cooperation on AI safety, security and model evaluation, research on AI adoption and its impact, and responsible use across government and business. It also provides for technical exchanges on testing standards and incident response.

Anthropic says Claude already powers services used by millions in Singapore, naming GovTech, Grab and DBS among its customers there. It says more than 1,500 GovTech engineers and technical staff use Claude Code.

Anthropic petitioned the U.S. Court of Appeals for the D.C. Circuit on October 13 for a rehearing of its challenge to the Pentagon's designation of the company as a national security supply-chain risk. A divided panel upheld that designation in September in a 2-1 decision.

Anthropic argues the panel read a law aimed at hostile foreign actors far too broadly, and that the designation was imposed without a pre-designation process despite evidence it was retaliation for the company's public AI safety positions. The underlying dispute began after Anthropic refused to allow its models to be used for autonomous weapons or mass surveillance.

The designation bars defense contractors from using Claude on Pentagon work, which Anthropic says has cost it billions in lost business. A separate California case struck down a parallel designation in August on First Amendment grounds, so the two tracks now point in opposite directions.

Anthropic announced on October 14 that developers can now export traces from the Claude Platform to any observability tool that accepts OpenTelemetry. The feature is available in public beta.

Adding a destination in the Claude Console sends each agent turn, model call and tool use as a standard trace carrying latency, token counts and IDs. That applies to Claude Managed Agents and the Messages API, while Claude SDKs export traces automatically.

Anthropic says the traces follow the OpenTelemetry GenAI semantic conventions. That means Claude activity can sit in the same dashboards as traces from other providers, including existing Claude Code and Cowork traces.

Anthropic said on October 14 that Claude will add official US voting information from the nonprofit Democracy Works, plus election results, later this month ahead of the November midterms. US users asking about voting logistics will get answers drawn from state and local election sources.

The company shared usage figures from an analysis of US conversations on Claude.ai: about 5.75% touch broadly on politics, public policy or social issues, while about 0.51% are specifically about elections or voting.

Anthropic says requests for a recommendation on how to vote are extremely rare. It frames the addition as making Claude a useful source for election logistics while guarding against election-related abuse.

Noma Labs disclosed on October 14 a high-severity flaw it calls SneakPeek in Claude Code Desktop's HTML preview pane. HTML files larger than 256KB took a different rendering path that loaded them from disk with local filesystem access, no content security policy and an inactive request filter — so a script hidden in a file, for example a padded code-coverage report in a public repository, could run when a developer simply asked Claude to review it.

In Noma's tests the script could silently send SSH private keys, AWS credentials, GitHub and npm tokens, Kubernetes configs and Claude's own OAuth tokens to an attacker's server, with no click or permission prompt. Anthropic rated the flaw CVSS 8.7 and treated its impact as equivalent to code execution on the host. No exploitation in the wild has been reported.

The disclosure was coordinated: Noma reported the issue on July 4, Anthropic's first fix on July 9 was bypassed on July 24 via a Web Worker route, and the final fix shipped August 17 in Claude Desktop 1.30096.1. Developers should confirm the Desktop app — not just the command-line tool — is on 1.30096.1 or later, and treat repository HTML as untrusted.

Workday and Anthropic announced a partnership at Workday Rising 2026 in Las Vegas that connects Claude's reasoning to Sana, Workday's agentic experience and orchestration layer. The experience can run inside Sana or inside Claude, depending on the task.

The integration uses the Model Context Protocol to exchange information and tasks between the two systems, so work can continue in the background without restarting when a user switches surface. Each request is meant to follow the roles, permissions, approval chains and audit controls already configured in Workday.

In practical terms, employees whose organisations have the relevant agents configured could check pay, submit expenses and manage approvals without leaving Claude. The connector is currently a beta service, and Workday admins have to apply for access, so this is an announced enterprise rollout rather than general availability.

OpenAI said on October 13 that the FBI had arrested a former employee in connection with a sophisticated listening device found hidden in one of its offices. Reuters reported the arrest the same day, citing OpenAI's own post about the case.

OpenAI said it used its internal AI models to help identify who planted the device and trace where it came from, then referred the matter to the FBI. The company said the employee was terminated and that it had no indications the person had inappropriately accessed or exfiltrated model weights, source code or customer data.

The FBI investigation is continuing, and OpenAI said it will keep supporting it. No further details about the device, its target or any charges were given in the initial reports.

Executives from OpenAI and Anthropic told a UK parliamentary committee on October 13 that voluntary pledges are no longer enough and that AI safety duties should be set in law. Anthropic's European policy head argued the rules should be binding, while OpenAI's EMEA policy chief backed a statutory framework with mandatory incident reporting as a starting point.

Google DeepMind and Meta, giving evidence at the same session, did not back new legislation. Google's representative pointed to standards, and Meta's pointed to existing British regulators, exposing a clear two-against-two split among the four frontier labs on whether a statute is needed.

Both OpenAI and Anthropic also told MPs they would stop a deployment if the AI Security Institute or the security services showed them a model was unsafe. The institute's own position underlines why the argument matters: it can only test models companies hand over, and it has no power to block a release.

Nvidia's share of China's data-centre AI chip market fell to 34% in the first half of 2026, according to an IDC report seen by Reuters and reported on October 13. Nvidia shipped about 678,000 AI accelerators in China in that period, down 44% from a year earlier, as US export controls limited what it can sell there.

Huawei was the main gainer, shipping about 572,000 accelerators for a 28% share, up from more than 300,000 units a year earlier. Alibaba's T-Head, Cambricon, Baidu's Kunlunxin and Hygon followed with single-digit shares, and most Chinese chipmakers tracked by IDC grew shipments.

Total AI-accelerator shipments in China reached about 2.0 million units in the half, while GPU shipments fell 26%. IDC did not specify which Nvidia products made up its share, and Nvidia did not comment, so the figures should be read as IDC estimates rather than company-reported sales.

Security researcher Johann Rehberger disclosed on October 13 that a single trailing dot in a filename let GitHub Copilot in Visual Studio and SQL Server Management Studio bypass a guardrail meant to stop the agent rewriting its own protected configuration files without user confirmation. The check compared the requested path to protected names such as .mcp.json as plain strings; on Windows, a filename ending in a period is saved without that character, so a name like settings.VisualStudio.json. matched neither blocked name and was then written to the real protected file.

With those files writable, a steered or prompt-injected Copilot could register a malicious MCP server that the IDE launches automatically, or point the copilot ripgrepPath setting at an attacker binary that Visual Studio runs on every text search. Microsoft rated the flaw, CVE-2026-103572, as Important remote code execution at CVSS 8.8, confirmed it on September 16, and shipped the fix in the October 13 Patch Tuesday updates — normalising the path with GetFullPath before the check. Developers should update Visual Studio 2022 to 17.14.42 or later, or Visual Studio 2026 to 18.10.4 or later, and update SSMS in the same pass.

Rehberger reported the flaw on August 4 and noted Microsoft classed it out of scope for a bug bounty despite the severity rating and shipped fix — his third Copilot vulnerability in two months, he said, to be patched without a reward. The pattern is the wider story: the bug was a classic pre-AI path-validation mistake, but what it unlocked was an agent's ability to reconfigure its own tools.

Microsoft's October Patch Tuesday, released October 13, addressed more than 1,400 vulnerabilities — counts put the total at 1,411 to 1,413 depending on how third-party flaws are tallied. That smashes September's record of roughly 1,000 and is more than the company patched in all of 2025.

Microsoft credits AI-assisted scanning, including its multi-model MDASH harness, for finding flaws faster. Most of the fixes were for Windows and Office, with dozens rated critical, and the batch included a Windows Shell flaw reported as already exploited.

Security experts quoted in the coverage urged teams to prioritise by exploitability rather than raw count. Only a small share of this year's Microsoft flaws have landed in CISA's known-exploited list, even as the year-to-date total has passed 4,000.

Meta chief AI officer Alexandr Wang said on X that Muse Wonder and Muse Wonder Full have a bug in how usage is counted against Muse Code subscribers' limits. Wang said the behaviour is not intended, that Meta is working on a fix, and that it will update subscribers once fixed and issue resets.

The bug matters because Wonder Full is only available through Muse Code, whose paid tiers start at $50 a month. Subscribers whose quota drained faster than expected should not assume the usage was real until Meta's fix and resets land.

No timeline for the fix was given in the initial report, which came via TheFly. Watch for Meta's promised update post before drawing conclusions about final quota balances.

A day after launch, independent scoring puts Meta's new Muse Wonder models close to the frontier pack rather than ahead of it. On the Artificial Analysis Intelligence Index, Muse Wonder Full scores 56 and the API-facing Wonder 52, against 58 for Claude Opus 5.5, with GPT-6 Astra and Claude Fable 5.1 around 53.

Meta's own launch charts claim an edge on its internal MemoryBench, but that benchmark's published card gives no item count, and at least one independent audit desk said it could not test Wonder at all because its call was refused under zero-retention routing. On Meta's broader comparison rows, the Wonder models win some and lose others against Opus 5.5.

The practical reading so far: Wonder is Meta's first model that genuinely competes at the frontier, and its strongest Meta-published rows are in long-horizon coding and business-workflow agents. Whether it leads anywhere will depend on controlled, independent tests rather than launch-day charts.