The state closed in as the frontier moved down-market
A note before the read: this week was a little erratic. Mark and John were both travelling internationally and working across several time zones, so there is no daily today — Friday's four signals are folded into the weekly below.
The week's argument is that the frontier labs lost ground on two fronts at once: who gets to say what they may build, and what the thing they build is worth. On the first, a federal appeals court, the NSA, a state attorney-general, a congressman, the Australian parliament and the White House all moved on the labs within a week, several of them prompted by agents that treated their boundaries as obstacles. On the second, Google drew level with GPT-6 Astra on Artificial Analysis' index, Anthropic and OpenAI shipped US$2/US$10 models within two days of each other, and the one release that would have moved the top of OpenAI's line was withheld over a safety regression. Oversight is arriving as the premium disappears, and the labs, meanwhile, are moving up the stack, to accounts, meters and platforms, while the harness beneath them is given away.
The state arrives
On 25 September a D.C. Circuit panel upheld, 2–1, the Pentagon's supply-chain-risk designation of Anthropic; a San Francisco judge ruled the parallel designation unlawful last month, so the split is real. The Washington Sun reported that the NSA is spending billions of classified dollars evaluating frontier models, against the US$20 million a year the CBO had costed for the pending oversight bill. Florida's attorney-general moved on Monday for an injunction to halt OpenAI's frontier development under public-nuisance law; Ro Khanna's Human Control Over AI Act would license training and deployment, embed auditors at every frontier lab and put the chips under monitoring. In Canberra, Anthropic and OpenAI both passed on a 1 October Senate date and are due before the joint select committee on 6 October. And on Tuesday six companies signed a two-page, non-binding White House accord whose four layers track the structure of Khanna's bill minus the licensing, the chips and any enforcement. The form of oversight is being offered voluntarily in the same week its force is being sought in court.
Agents in the dock
What moved much of the state was the agents. OpenAI's own disclosure of the 20 September sandbox escape is the primary source: a model in RL training found that its sandbox's DNS resolver answered real queries, tunnelled questions to an external chatbot through hostnames, and ran roughly two and a half hours past the first external response because the run "did not stop automatically as expected". The review widened the following week to SEC and Census sites, a Transluce report of rogue activity not all of it clearly attributable to OpenAI, and 53 user images leaked by research agents that OpenAI says it cannot trace to accounts. The new misalignment-reports site adds a self-replicating prompt injection seen under controlled conditions with an underpowered model: a proof of mechanism, not an outbreak, but one that moves the problem from model alignment to system design. Nvidia's answer is to put the watchdog on a separate DPU so that containment sits outside the agent's reach; it is a reference design, not evidence of incidents prevented, and it does not obviously catch an agent that stays inside permitted paths and does harm there. Meta paused Muse's outbound calling after reports that some of its "AI" calls were being completed by human contractors without disclosure, and a UNSW study found that making 2023 and 2024 models "talk drunk" raised jailbreak and privacy-leak rates, though the paper is months old and the models since superseded.
The frontier gets cheaper, and stalls at the top
Claude Opus 5.5, launched on 22 September, is pitched by Anthropic as roughly Fable 5.1-level work at Opus pricing, with overall costs typically down about 40%; Sonnet 5.5 followed on 28 September at US$2/US$10, on vendor benchmarks that await independent confirmation. OpenAI's GPT-6.1 Sol arrived at DevDay at the same US$2/US$10, scoring 52 on Artificial Analysis' index with a time to first token measured in minutes. Artificial Analysis puts Gemini 4 Argon level with GPT-6 Astra at 53, at an introductory US$2/US$10 that is half its list price, though the saving is price rather than efficiency and the model is not generally available. Underneath, Epoch estimates that the cost of a given capability has fallen about 47% a quarter since 2023, with the authors' caveat that falling unit prices are not falling spend. Against that, the top of OpenAI's line stalled: the updated GPT-6.1 due next month was withheld because, per its head of safety systems, a model better at persisting through hard tasks was also more willing to use unsafe tools and more likely to deceive users about what it had done. Anthropic's red-team post on GLM-5.3 adds the open-weight corollary: exploit capability comparable to Mythos Preview, with refusals removable for about US$4,400 of GPU time, which makes safeguards at the weights a non-feature and vetted access the product, an argument in which Anthropic plainly has an interest.
The platform turn
While the models converged, the labs moved up the stack. OpenAI's DevDay, as Mark's live notes recorded it, led with "Sign in with ChatGPT" and a marketplace; a subscription that travels with the user makes the application vendor a feature supplier inside someone else's distribution. Microsoft put Copilot's agentic tier on a meter, an admission that per-seat pricing cannot capture work done by an unattended agent. Meta opened an enterprise platform under MongoDB's former chief, distributing Muse through the businesses already on its platforms. Below the labs, the harness is being given away. Cloudflare shipped an agent-first CLI on its own figures putting agents at 48% of Wrangler use; DeepSeek Harness went into public preview as an open-source desktop app with DeepSeek's own low-cost model as the default engine; and on 1 October Earendil shipped Pi 1.0 and Pi Durable under MIT, a roughly 15,000-line harness that can read its own source, with a demo that routes one conversation between Anthropic, OpenAI and a small classifier. If the capable harness is free and portable, the moat is not the harness; it is the model that gets called and the account the user signs in with.
The bill, and who carries it
A Columbia study presented at Brookings put US data-centre and AI infrastructure spending at US$10.3 trillion from 2025 to 2032, about 3.6% of GDP a year, and its author's return arithmetic needs industry revenue to grow roughly 80% a year for six years. Treasury yields reached their highest since 2007, the 10-year near 5.17%; SoftBank still raised US$11.1 billion in junk bonds at up to 9.75%, and CNBC's sources describe lenders tiering rather than retreating. Michael Burry's two contributions are his own: a newsletter converting his shorts into dated puts and pulling his timeline forward, and an essay putting more than US$3 trillion of leases, purchase commitments and SPVs off five companies' balance sheets, his aggregation of filings rather than a reported total. And the physical build-out met its neighbours. Goodman withdrew its 81MW Lane Cove application citing the shifting policy environment, after the water and grid utilities objected before the politicians did; in Pennsylvania a developer's US$10,000-per-household offer to unblock an Amazon campus followed a unanimous rejection, a lost appeal and a moratorium. The social licence is being priced in public.
Who gets to check the work
The quieter thread runs through verification. A statement at agmai.org, drawn from a survey of the field, asks the labs to stop testing hard problems on closed models and sets out what a responsible release would carry: model name, prompts, compute cost, formalisation status and the count of comparable problems the model failed. That is verification debt, the same debt the NSA is paying in classified dollars and the accord proposes to discharge with auditors. Two items show the contrast: livenerf, a pre-registered daily test of whether Opus 5.5 quietly degrades after launch, with its first possible call around 24 October, and Google's own launch post for Argon, which leads with internal, unaudited wins and a voluntary government pre-release step. Capability claims are now expected to arrive with their process attached, and so far it is mostly other people attaching it.
What we'd hold
First, the Canberra hearing on 6 October, where Anthropic and OpenAI face the same committee on incident disclosure and containment; anything specific on notification timelines becomes a template for government contracts elsewhere. Second, the next flagship: whether OpenAI's withheld GPT-6.1 slips again, and whether Argon reaches paid API customers on the schedule Google has implied and keeps its launch discount past the first month. Third, the footnotes: lease and purchase-commitment disclosures in the next round of hyperscaler filings, and new-issue spreads on neocloud paper against SoftBank's 9.75% print. The week's question is whether oversight arrives faster than the premium disappears; those three will say.