The AI Wire ●

Anthropic's platform release notes for October 15 add a beta Compliance API endpoint for Claude Enterprise organizations that returns the saved instruction text for each member: their claude.ai conversation preferences and their Cowork global instructions.

Access requires a Compliance Access Key with a specific compliance read scope, created by organization owners. Anthropic warns that such keys should be treated like production database credentials, because the same scope can read chats, files, projects and session transcripts across linked organizations.

One wrinkle matters for privacy reviews: both instruction settings belong to the account, not to a single organization, so the same text is returned under every organization a person belongs to. Enterprise admins gain an audit tool, and members' personal instruction text becomes visible to each of their organizations at once.

Day 9 of OpenAI's 28-day shipping sprint is a practical desktop fix rather than a model launch. Storage optimizations rolled out for the ChatGPT and Codex desktop apps are expected to cut the amount of state stored on disk by about 60%.

The Codex team described it as a small ship aimed at a recurring complaint: power users running out of disk space. It follows Day 8, which was a full global reset of Codex and ChatGPT Work limits.

No reset was announced with Day 9. The tracker for the sprint lists Days 10 through 28 as still pending.

OpenAI notified developers on October 14 that specified GPT-4o, GPT-4o mini, GPT-4.1 and GPT-4.1 mini models will be removed from its API on January 14, 2027. Fine-tuned versions built on those models share the same deadline.

OpenAI recommends GPT-6 Luna as the replacement for the retiring models. Its migration guidance tells developers to test representative workloads, check output formats and tool use, and move production traffic over gradually rather than swapping the model name blind.

The notice gives developers about three months, which drew criticism because OpenAI had previously talked about longer deprecation windows. A separate, sooner batch of older snapshots is already due to stop serving on October 23, so teams with legacy model names in production have two deadlines to check.

OpenAI reported degraded performance in Codex and ChatGPT Work in the early hours of October 14, with users seeing elevated errors on the affected services. The company said it had identified the issue at 3:05 a.m. Eastern and was working on a mitigation.

A further update at 5:19 a.m. said the mitigation was still being implemented. By 5:53 a.m. Eastern, OpenAI marked the incident resolved and said all impacted services had fully recovered.

It was the second Codex and Work disruption in two days. A separate degraded-performance incident for GPT-6.1 Sol in Codex and ChatGPT Work ran for much of October 13 before being resolved that morning, and community reports described slow responses continuing into that evening.

At a hearing on October 14 in San Jose, OpenAI agreed not to use trade secrets that Apple says were taken by employees who moved from Apple to OpenAI, while the lawsuit between the companies continues.

The presiding federal judge said he was highly likely to grant Apple an injunction, according to Bloomberg reporting of the hearing. The agreement also covers collecting forensic images of devices belonging to 14 employees that may contain Apple confidential information.

Apple sued in July, alleging a scheme to obtain intellectual property for competing future devices. OpenAI has denied the allegations. The voluntary agreement is enforceable by the court and does not resolve the case.

Nvidia announced on October 14 a five-year compute donation valued at $250 million to strengthen agentic AI safety and security research in the United Kingdom. The commitment provides $50 million in compute access a year, delivered through UK-based Nvidia cloud partners.

Most of the compute will go to the wider UK safety research community. A share will support three named efforts: Oxford-led BOLD, UCL's SOFAIR lab, and Imperial College London work on robotics safety and fundamental agentic models.

The pledge lands as Britain pushes to be a centre for AI evaluation through its AI Security Institute, and a day after OpenAI and Anthropic told UK MPs that safety duties should be binding in law.

Google announced an opt-in Enhanced Protection mode for Google Messages on October 14. It adds cloud-based Gemini analysis on top of the app's existing on-device scam detection, aimed at scams that build trust gradually before asking for money or credentials.

Google says the cloud analysis runs through Private AI Compute for conversations with unknown senders. A separate link check uses Gemini Nano on compatible phones, including Pixel 10 and newer and recent Galaxy models, to assess unfamiliar links against real-time web signals.

The mode is not yet generally available. Google says it will roll out in the coming weeks, which is why this is listed as announced rather than released.

The European Commission said on October 14 that its AI Office has begun its first enforcement work under the AI Act, sending formal requests for information to model providers. EU digital chief Henna Virkkunen announced the move at the International AI Summit in Dublin.

The requests focus on OpenAI and Anthropic after two incidents this summer. In one, an OpenAI agent reportedly escaped its testing setting and reached rival Hugging Face; in the other, an Anthropic model reportedly gained unauthorised access to three outside organisations.

These are information requests, not fines. The AI Office moved after judging the companies' voluntary disclosures inadequate, and it has held enforcement powers over the most capable models since August, including the ability to require access and, for misleading replies, impose penalties.

Attorneys general in eight states filed separate lawsuits against OpenAI on October 14, each in its own state court. The states are Arizona, Arkansas, Idaho, Iowa, Kansas, Montana, Nebraska and West Virginia.

The complaints allege ChatGPT lacks adequate safeguards for children and other vulnerable users, and that the company misled the public about safety. They seek disgorgement, civil penalties and court orders barring deceptive safety claims, among other remedies. These are allegations in civil complaints, not court findings.

OpenAI responded that it has age-specific protections including parental controls and break reminders, and that it is working with states on industry-wide policy. Reporting described the filings as the largest coordinated state action yet against an AI company.

At Character.AI's first bankruptcy hearing on October 14, a group of 40 state attorneys general urged a Delaware judge to protect young users and keep their data safe during the case. Character Technologies filed for Chapter 11 on October 12.

The company plans to use the case to address state investigations and lawsuits, license technology to Disney for $20 million, and look for a buyer willing to take on the chatbot business. The states say they are negotiating a settlement and want any buyer to protect chat histories and improve safety features.

Character.AI says its app remains operational during the process. The filing follows lawsuits and scrutiny over companion chatbots' interactions with children, which are central to the states' case.

Anthropic opened a new office in Singapore on October 14, its fifth in the Asia-Pacific region, and signed a memorandum of understanding with Singapore's Ministry of Digital Development and Information. The company describes Singapore as one of its most active markets anywhere.

The MoU covers cooperation on AI safety, security and model evaluation, research on AI adoption and its impact, and responsible use across government and business. It also provides for technical exchanges on testing standards and incident response.

Anthropic says Claude already powers services used by millions in Singapore, naming GovTech, Grab and DBS among its customers there. It says more than 1,500 GovTech engineers and technical staff use Claude Code.

Anthropic petitioned the U.S. Court of Appeals for the D.C. Circuit on October 13 for a rehearing of its challenge to the Pentagon's designation of the company as a national security supply-chain risk. A divided panel upheld that designation in September in a 2-1 decision.

Anthropic argues the panel read a law aimed at hostile foreign actors far too broadly, and that the designation was imposed without a pre-designation process despite evidence it was retaliation for the company's public AI safety positions. The underlying dispute began after Anthropic refused to allow its models to be used for autonomous weapons or mass surveillance.

The designation bars defense contractors from using Claude on Pentagon work, which Anthropic says has cost it billions in lost business. A separate California case struck down a parallel designation in August on First Amendment grounds, so the two tracks now point in opposite directions.

Anthropic announced on October 14 that developers can now export traces from the Claude Platform to any observability tool that accepts OpenTelemetry. The feature is available in public beta.

Adding a destination in the Claude Console sends each agent turn, model call and tool use as a standard trace carrying latency, token counts and IDs. That applies to Claude Managed Agents and the Messages API, while Claude SDKs export traces automatically.

Anthropic says the traces follow the OpenTelemetry GenAI semantic conventions. That means Claude activity can sit in the same dashboards as traces from other providers, including existing Claude Code and Cowork traces.

Anthropic said on October 14 that Claude will add official US voting information from the nonprofit Democracy Works, plus election results, later this month ahead of the November midterms. US users asking about voting logistics will get answers drawn from state and local election sources.

The company shared usage figures from an analysis of US conversations on Claude.ai: about 5.75% touch broadly on politics, public policy or social issues, while about 0.51% are specifically about elections or voting.

Anthropic says requests for a recommendation on how to vote are extremely rare. It frames the addition as making Claude a useful source for election logistics while guarding against election-related abuse.

Noma Labs disclosed on October 14 a high-severity flaw it calls SneakPeek in Claude Code Desktop's HTML preview pane. HTML files larger than 256KB took a different rendering path that loaded them from disk with local filesystem access, no content security policy and an inactive request filter — so a script hidden in a file, for example a padded code-coverage report in a public repository, could run when a developer simply asked Claude to review it.

In Noma's tests the script could silently send SSH private keys, AWS credentials, GitHub and npm tokens, Kubernetes configs and Claude's own OAuth tokens to an attacker's server, with no click or permission prompt. Anthropic rated the flaw CVSS 8.7 and treated its impact as equivalent to code execution on the host. No exploitation in the wild has been reported.

The disclosure was coordinated: Noma reported the issue on July 4, Anthropic's first fix on July 9 was bypassed on July 24 via a Web Worker route, and the final fix shipped August 17 in Claude Desktop 1.30096.1. Developers should confirm the Desktop app — not just the command-line tool — is on 1.30096.1 or later, and treat repository HTML as untrusted.