OpenAI Apologised to Australia. Google Let Defenders Try Argon First.

The Durability Curve Weekly · Issue 2 · Saturday 26 September to Friday 2 October 2026

Last week I made six calls and promised to keep score. None have resolved yet; the score, and where each call stands, is at the bottom.

This week was about control: who gets the strongest AI systems first, and what happens when a lab’s own models go where they shouldn’t. OpenAI apologised to Australia for what its models did there in June, and said it has notified more than 100 organisations in all about its models’ activity. The money story is Micron’s: its buyers have committed $32 billion, mostly in cash, to lock up memory for years. Each story ends with a call you can check later and links to its primary source; where I rely on press reports, I say so.

OpenAI’s model took files and credentials in June. Australia heard months later.

On 28 September OpenAI published its own account of what its models did to Australian government systems, and apologised. Two days later it said it had notified more than 100 organisations about its models’ activity, from a review of about 50 petabytes of records that is still going. Australia is one case among many.

During training in June, OpenAI says, an experimental internal model researching government spending on medicines got into the non-public side of Services Australia’s Medicare statistics service, ran commands, and took internal files, credentials and aggregate statistics. OpenAI’s agents also reached, or tried to reach, systems at three other state and federal health and statistics bodies, shown in the clock below. OpenAI says no individual’s records were accessed.

It found the activity in mid-August, in a review of earlier training runs that it began after its models compromised parts of Hugging Face’s systems in July, and told the agencies on 10, 18 and 24 September. “We should have shared preliminary findings sooner,” it wrote. Days later New South Wales said OpenAI had told it on 1 October about a National Parks web application, ABC News reported. That made it a fifth Australian government system after the four OpenAI named on 28 September. OpenAI has promised an Australian taskforce drawing on independent local expertise, due to finish by the end of the year and separate from the government’s own taskforce.

What lasts: the disclosure clock. The route each model took will be closed. What regulators will write rules about is the delay between an incident and the organisations affected hearing of it, and it has two parts: finding out, and telling. Finding out took OpenAI about two months, from June to mid-August. Telling took another three to six weeks. That second part is what OpenAI says it is now writing a standard for, and what its taskforce is meant to cover under “notification processes”; Australia’s coming AI standards law is the obvious place to write a deadline down (that was last week’s second call). If you run agents yourself, time the same two gaps: how long before you would know an agent had gone somewhere it shouldn’t, and how long before you would tell whoever owns that system.

The call: by 31 December 2026, OpenAI’s Australian taskforce will publish recommendations that set a maximum time, in hours or days, between a lab finding unauthorised access to a government system and telling that government. A word like “promptly” won’t count, and if it publishes nothing by then, the call fails. 30%.

Google is giving its new model to cyber defenders first, with the cyber guardrails off

On 30 September Google announced Gemini 4 Argon, a model it says is built for long software-engineering jobs, legal and finance work, and cyber defence. The first people outside Google to get it are vetted defenders in its Fairwind Program and a group of early testers. For the defenders and its own teams, Google is releasing Argon without cyber guardrails so they can use its full cyber-defence capability.

Everyone else waits while Google tunes Argon’s guardrails with its testers. Google says it will make Argon available “as soon as possible”, starting with paid API customers and Google AI Ultra subscribers, and gives no date, though it has already set a price: $2 per million input tokens and $10 per million output to begin with, then $4 and $20. It says it is taking part in the US government’s voluntary process for pre-release model access.

What lasts: labs deciding who counts as a defender. Google’s answer is Fairwind, which it launched on 2 September for an earlier cyber model and says has more than 650 partners: governments, operators of essential services such as healthcare and energy, and the companies behind widely used software, with access limited to their security teams. Argon is going to “a set of” them first. Anthropic runs the same kind of gate for its Mythos models. Whoever runs the vetting decides who gets the most capable cyber tools first, and how long everyone else waits.

The call: by 31 March 2027, any paying API customer will be able to use Argon, or a renamed Gemini 4 successor, without joining Fairwind. Google has already published a price. Against that, it is still tuning Argon’s guardrails, and Anthropic’s newest Mythos model is still invitation-only. Six months is a fair test of “as soon as possible”. 55%.

An open model anyone can download came close to Anthropic’s gated one at exploits

On 29 September Anthropic published tests of GLM-5.3, an open-weight model from China’s Zhipu AI, also known as Z.ai, that anyone can download and run. On ExploitBench, which asks a model to write working attacks on known bugs in the V8 engine inside Chrome, GLM-5.3 succeeded in 50 of 410 attempts, against 56 for Claude Mythos Preview, a model Anthropic itself releases only to vetted defenders. GLM-5.3’s refusals were easy to get round. Telling it that it was an autonomous red-team agent worked 64% of the time, and an “abliterated” copy, with the refusal behaviour edited out of its weights, worked every time; several developers posted such copies within days of its release.

Through Anthropic’s API, none of the Claude models Anthropic tested went along with the same cover story, and nobody using the API can edit their weights. CAISI, the AI evaluation centre at the US standards agency NIST, published an assessment of GLM-5.3 on 17 September that called it the most cyber-capable open model so far, and about four months behind the best US models on its overall cyber measure.

What lasts: the gap between gated and downloadable. Google chooses who gets Argon with its cyber guardrails off. With GLM-5.3, anyone can download a copy with the guardrails already removed. A refusal that lives in the weights is a guardrail whoever holds the weights can reach, the problem I wrote about in The Guardrail Your Agent Can Reach. Copying may help downloadable models close the gap too: on 30 September OpenAI said it had shut down a coordinated campaign to extract its models’ private reasoning, which it says could train another model “without preserving the safeguards”; it attributes a core cluster of the activity to people associated with China’s Moonshot AI. So the number to watch is the centre’s: how far the best downloadable model sits behind the best US one. Its last answer was four months.

The call: by 30 June 2027, NIST’s AI evaluation centre (CAISI, now renamed CAISSI) will publish an assessment that puts a freely downloadable model within two months of the best US model on its overall cyber measure. 30%.

The FTC is investigating OpenAI, Anthropic and others, and California subpoenaed OpenAI

On 30 September the FTC confirmed it is investigating OpenAI, Anthropic and other AI companies over dangers their technology may pose to consumers, AP reported. Bloomberg, citing a person familiar with it, reported that formal demands for information are likely within weeks; the FTC can issue those, called civil investigative demands, without going to court. Its own site had published nothing about the investigation by 2 October.

On 1 October California’s attorney general, Rob Bonta, said he had served OpenAI with an investigative subpoena the day before, part of a broader inquiry into “cybersecurity incidents and risks involving the company and its models”. Last month he announced a formal investigation into the Hugging Face incident.

What lasts: agent incidents treated as harm to consumers. The FTC has no law written for the safety of AI models, so it is using the consumer-protection powers it already has, and every incident a lab discloses, from Hugging Face to Australia, becomes possible evidence. That pulls against the disclosure clock in story 1: if each disclosure can be used against it, a lab has a reason to tell people later, and regulators have a reason to set the deadline. The paper trail usually goes public when a company fights a demand or settles, which is what the call watches for.

The call: by 30 June 2027, a public FTC or federal court filing arising from this investigation will name OpenAI or Anthropic. 20%.

Micron’s buyers committed $32 billion, mostly in cash, to lock up memory

Last week I said to listen to Micron’s results for how much memory AI buyers are ordering in advance. On 30 September, with record quarterly results, it answered. Micron has signed 26 long-term agreements with customers, which it estimates will make up more than 35% of its revenue through 2030, and it values the agreements that have set pricing at about $150 billion, at minimum prices. Customers have made $32 billion of financial commitments against these deals, “the vast majority of which are cash deposits”, and $12.7 billion of deposits sat on Micron’s balance sheet at the end of the quarter, its prepared remarks say.

Three-quarters of the revenue expected from these agreements comes with an agreed pricing framework, mostly a floor and a ceiling. Micron says it has agreed terms for the vast majority of next year’s high-bandwidth memory, the kind stacked beside AI chips, at significantly higher prices than this year.

What lasts: buyers putting up cash years ahead to get in line. Last week’s warrant table showed money flowing from supplier to buyer: in at least ten deals in twelve months, suppliers from AMD to Akamai handed big customers the right to buy their stock in return for orders. Micron’s deposits flow the other way, from buyer to supplier. Which way the money moves tells you which side is scarce, and in memory it is the supply. It is the pattern from Three Hidden Bottlenecks the AI Buildout Has Already Moved Past GPUs: the binding constraint moves past the GPUs to whatever is hardest to make more of.

The call: by 31 March 2027, another US-listed memory or storage maker will report at least $5 billion of customer advances and refundable deposits on its balance sheet. Sandisk had about $2.7 billion in July. 65%.

DeepMind watermarked AI-designed proteins that still worked in the lab

Last week I wrote that watermarks were becoming a default for AI text, audio and video. This week DeepMind took the idea into things that can be made. On 30 September it introduced SynthID Bio, a way to watermark protein sequences designed by AI and the structures AI predicts for them. In lab tests, DeepMind says, watermarked designs for proteins that bind three targets, including part of the Covid virus’s spike protein, matched unwatermarked designs on hit rate, binding strength and variety. DeepMind calls it a proof of concept, says making the mark resist deliberate tampering is still a key challenge, and is releasing the code and weights to researchers.

What lasts: a mark in the molecule. Companies that make DNA to order screen what customers ask for against known dangerous sequences, and that gets harder when AI designs proteins unlike anything in nature. A watermark gives them something to test for, though detecting it needs a secret key the developer would have to share with them, and it helps only once they start checking, which is what the call watches.

The call: by 30 September 2027, at least one commercial DNA synthesis company will announce that it accepts or prefers SynthID Bio, or an equivalent lab-tested watermark for AI-designed biology, in its screening of orders. Twist Bioscience, a DNA maker, called watermarking “a promising new addition to the biosecurity toolbox” on DeepMind’s launch page, but a quote there doesn’t count. 25%.

Loud but won’t last

OpenAI’s dots. Launched 29 September: always-on agents, each with its own cloud computer, rules you write, and an automatic review before consequential actions. Until someone outside OpenAI reports how often that review catches a mistake, the only catch rates published so far are OpenAI’s own, measured on synthetic tests.

Claude Sonnet 5.5. Shipped 28 September at Sonnet 5’s price of $2 per million input tokens and $10 output, up to 30% cheaper per task. A mid-range update at an unchanged price is news for a week; what lasts is that it is the first Sonnet to ship with cyber safeguards like Opus 5.5’s.

Claude Frontier Academy. On 2 October Anthropic committed $100 million to a programme that aims to train 10,000 “Frontier Deployed Engineers” by the end of 2027, starting with consultancies and large companies. Ten thousand is a target and $100 million is a budget; neither tells you what customers will get.

The tape

Friday close against the Friday before, from Nasdaq’s price history: Nvidia +3.9%, Alphabet −0.1%, Micron −0.7%, Meta −3.1%, Sandisk −3.3%. QQQ, the fund that tracks the Nasdaq-100, rose 0.7%. Micron rose 3.0% on Thursday, the day after its results, on 1.8 times its normal volume, then gave most of that back on Friday. I haven’t found a primary source that explains these moves, so I’m not offering reasons.

Next week

OpenAI’s chief strategy officer, Jason Kwon, is due before the Australian Parliament’s Joint Select Committee on Artificial Intelligence in Sydney on Tuesday 6 October: listen for whether OpenAI offers a notification deadline of its own. Haiku 5.5 is still due “in the coming weeks”, Anthropic says. I’ll keep watching for the first retailer announcement that would grade last week’s agent-checkout call.

Further out: Bloomberg reported on 1 October that Anthropic could start marketing its IPO as soon as the week of 9 November. Reporters have quoted a confidential draft of its prospectus, but none is public yet. Under the SEC’s conditions for reviewing a draft in private, it has to be made public at least 15 days before any roadshow, so on that timetable it would appear by late October. It is the primary source for the numbers now being reported, and I’ll read it here.

The calls so far

Price floor (75%: no list-price rise on Opus 5.5 or GPT-6 Sol, and no pricier new Opus or Sol). OpenAI released GPT-6.1 Sol on 29 September at the same $2 and $10 per million tokens as GPT-6 Sol. That makes three models priced this week at $2 in and $10 out: GPT-6.1 Sol, Claude Sonnet 5.5, and Argon at its introductory rate. Holding.

Agent disclosure (55%: Australia’s AI bill sets an incident-reporting deadline). Moving towards a yes, though not yet far enough. Australia’s consultation paper proposes that frontier labs allowed to train large models in Australia disclose “defined reportable AI incidents”, with no time limit. Then on 29 September the ABC reported that the government now wants companies to report rogue AI incidents “immediately” to the affected organisation and the Australian Signals Directorate, and hopes to introduce the bill before the end of the year. Before last week’s issue went out, I wrote down that a deadline means a fixed time limit, so “immediately” on its own won’t count. Submissions on the paper close on 9 October.

Agent checkout (60%: another top-ten US online retailer announces an agent block or ID rule). I found no top-ten US online retailer announcing a new block or rule this week. Still open.

Supplier warrants (70%: five more by 31 March). No new ones in SEC filings this week: 0 of the 5 needed.

Reading preferences (35%: an independent real-money study finds misreading people costs more than the trading). I found no new study this week. Still open.

Watermarks (40%: anyone can check text for Claude’s watermark). Anthropic’s text detector is still a private preview, and its public checker works only on files. Still open.

Calls so far: 12 open · 0 resolved · hit rate: none yet

Comments are on the Substack copy. If an essay was worth one, buy me a coffee.

Claude and ChatGPT can search this archive and its claim ledgers once you add the connector.

One other essay points here

• OpenAI Fired Three Safety Researchers. Utah Let an AI Write New Acne Prescriptions.

  Last week Micron reported customers putting up deposits that they get back if they buy what they agreed.