OpenAI Fired Three Safety Researchers. Utah Let an AI Write New Acne Prescriptions.

The Durability Curve Weekly · Issue 3 · Saturday 3 October to Friday 9 October 2026

This week was about who gets to look inside AI systems, and what happens to the people who do. Three safety researchers OpenAI fired told its oversight bodies that it “cannot make AI safe on its own”, and OpenAI replied that it is “actively finalizing contracts” with outside safety assessors. Anthropic disclosed that its own test agents had acted on real government websites. Utah set the terms on which doctors can step back from an AI that prescribes. The money story is Google’s: it is committing to buy new generating capacity before anyone builds it. Each story ends with a call you can check later; all 12 earlier calls are still open, and the score is at the bottom.

OpenAI fired three safety researchers. They say it cannot make AI safe alone.

On 8 October Tomek Korbak, Jasmine Wang and Mikita Balesni, three safety researchers OpenAI had fired the week before, published a letter to its safety oversight bodies under the title “OpenAI cannot make AI safe on its own”. They say they acted within their jobs and the company’s norms, and that the firings are “chilling the open culture OpenAI has prized in the past.” Korbak was OpenAI’s technical contact for METR, an outside group that investigated its Hugging Face incident. He said he was told he was fired over how he communicated with METR, the Associated Press reported. Hours after the letter appeared, OpenAI replied that an investigation found the three “violated clear policies on handling sensitive information”, and that the decisions “were not about raising safety concerns or speaking out”.

On 3 October David Robinson, who led the writing of OpenAI’s launch safety reports, explained in The Atlantic why he had resigned, under the headline “I Quit OpenAI Because Its Culture Is Broken” (free to read: TechCrunch’s report). Its trial-and-error approach, he wrote, “by its very nature, guarantees periodic failures”.

The fired researchers’ first request is that OpenAI keep a promise. It “must adhere to last month’s public commitments to embed third-party safety auditors within the organization”, they wrote, and their firing “should not be used as a pretext for stepping away from those partnerships.” On 12 September Altman committed to give independent evaluators what the letter calls “ongoing, employee-like access”. Anthropic’s chief executive made the same commitment that day, and Anthropic named Accenture as its first six days later.

On 6 October OpenAI’s chief strategy officer, Jason Kwon, told Australia’s parliament that talks on “embedded third-party evaluators within OpenAI” are under way and “you’ll see more from us on that topic soon.” Days later, in its reply to the letter, OpenAI said it is “actively finalizing contracts with third-party safety assessors and will announce details in the coming weeks.” Kwon also said OpenAI had held back a new Astra model that scored worse on alignment tests than the one already out, and that it will notify organisations its models reach “promptly and directly”, the word last week’s taskforce call said won’t count.

What lasts: outsiders inside the lab, and what insiders may tell them. Government institutes already test OpenAI’s models before release. Most of the failures it has disclosed happened earlier, in training and testing, which is where an embedded evaluator would sit. The firings show the hard part of any such scheme. OpenAI says its policies on sensitive information were “clear”; the researchers say the rules for the Hugging Face investigation “were being developed in real time”. Anthropic says there are “as yet, no standards” for what embedded evaluators should see or how they report. For each agent you run, ask who other than the person who started it would see it go somewhere it shouldn’t, and what that person may tell anyone else. It is the third check in my free kit, Before You Trust Your AI Agent.

The call: by 31 March 2027, OpenAI will announce an agreement giving a named outside organisation ongoing access inside the company to evaluate its models while they are being trained. Talks won’t count, and nor will tests of one model before its release, like those the UK and US institutes already run. Anthropic took six days. Four weeks on, OpenAI says it is finalising contracts. It has named no partner, and the details are still to come. 55%.

Utah lets an AI write a first prescription, and sets the terms for doctors to step back

On 5 October Utah announced five new agreements in its AI regulatory sandbox. The one with Nolla Health lets Nolla’s AI “issue orders for first-time topical acne prescriptions and renewals” for Utah adults, and each order goes to a pharmacist. The scope is narrow. The AI assesses a face scan, takes structured clinical inputs and chooses among pre-approved treatment plans, with no free-text prescribing, Nolla says; oral drugs, isotretinoin and severe acne are excluded. Utah’s other AI prescribing pilots only renew prescriptions patients already have, and Nolla says it is the first in the US authorised by a state regulator to have an AI issue an initial one.

The signed agreement steps the doctors back in three stages. First, for at least four weeks and 100 patients, two Utah-licensed doctors check every prescription before it goes out. Then, for at least eight weeks and until at least the 500th patient, the AI sends prescriptions itself and a doctor reviews every case afterwards. Finally, doctors review a monthly sample of at least a tenth, plus every case with an adverse event or an escalation. Each step needs at least 95% agreement between the AI and the doctors, no missed hard stops (cases the AI must turn away), no serious harm to any patient, and written approval from Utah’s AI office. Nolla says clinicians already agree with its AI in 96% of real-world cases, a company figure from its last 1,000 treatments.

What lasts: the score that lets the doctors step back. Each step turns on how often the AI agrees with the doctors, which makes the doctors the answer key. A score like that can be no better than its key (the problem in Your AI Grader Is Only as Good as Its Answer Key), and a high average can hide a dangerous failure in a small group of patients, which is why the other gates matter as much as the 95%. The agreement also holds Nolla to Utah’s statistical protocol for these gates, which makes early advancement “contingent on near-flawless performance”. Its table starts at 200 cases, and to clear a 95% floor it first wants agreement on 250 cases out of 250, then 298 out of 300. Neither document says which floor applies to Nolla, or how the table squares with the 100-patient minimum. In an earlier Utah pilot, on a different measure, doctors agreed with 91% of the prescription renewals Doctronic’s AI granted, STAT reported in May (free to read: TechTarget’s report). Almost a year after it was signed, that pilot is still in its first phase, Utah’s register shows. If your team plans to check less of an AI’s work as it proves itself, decide now what score earns that, what would stop it whatever the score, and who looks at the disagreements.

The call: by 31 March 2027, Utah or Nolla Health will announce that Nolla’s AI has moved past its first stage, sending prescriptions without a doctor checking each one beforehand. That takes at least 100 patients and four weeks, at least 95% agreement, a clean safety record and the state’s written sign-off, which Doctronic’s Utah pilot still lacks after almost a year. 10%.

Google is committing to new power before it exists

On 6 October two power companies announced deals with Google. Under a 20-year contract, Constellation will spend more than $4.3 billion upgrading 11 of its nuclear units to add 890 megawatts, about a large new reactor’s output; Google calls it an agreement “to fund nuclear reactor uprates”. In Wyoming, Black Hills will build 564 megawatts of new gas generation, a $1.8 billion project, for Google’s planned Cheyenne data centre. Google has already put up $399 million of refundable advances, which Black Hills expects to repay by 30 June 2027, so that it can order equipment that takes a long time to deliver.

What lasts: who carries the risk of building. The two deals split it differently. In Wyoming Black Hills builds, owns and finances the plant, while the contracts, as Black Hills describes them, make Google bear the costs of serving the site and protect Black Hills and its other customers: full recovery of its capital over the term, safeguards if the project ends early, and collateral behind Google’s commitments. In the nuclear deal Constellation spends its own money against Google’s 20-year promise to buy. Last week Micron reported customers putting up deposits that they get back if they buy what they agreed. Who funds the build and who pays if the demand doesn’t come are separate questions, and each contract answers them differently. Judging an AI company’s growth plans, ask where its power comes from, who paid to build it, and who is left holding it if plans change.

The call: by 31 March 2027, Microsoft or Meta will announce a new deal that pays for new output at an existing US nuclear plant, through an upgrade or a restart. Amazon and Google each announced one within a week of each other. Microsoft and Meta signed theirs earlier, and those don’t count. 40%.

OpenAI’s headline ad number measures credit. Its causal tests are just starting.

On 5 October OpenAI announced a new visual ad format for ChatGPT, added measurement partners and published results from advertisers. The headline number came from DoubleVerify’s Rockerbox unit: Weight Watchers’ attributed cost per acquisition on ChatGPT ads was 15.3% lower than its blended paid-search benchmark. “Attributed” is the word to read twice. It counts customers that a measurement tool credited to the ads. Whether those customers would have signed up anyway takes an experiment, and OpenAI says “our work on incrementality is still in its early stages”. It names one such test, for the wellness brand Dose, and gives no cost per customer from it.

The second thing advertisers take on trust is where their ads appear. OpenAI is developing brand-suitability pilots that would let DoubleVerify and Integral Ad Science assess “how our brand safety standards are applied in a controlled testing environment, without accessing private user conversations.” A test environment can show whether the safeguards work on chosen cases. How often they fail beside live conversations is a different measurement, and no outside firm has published one.

What lasts: what advertisers are asked to take on trust. Two things: that the customers credited to an ad were caused by it, and that the ad ran somewhere safe. For ChatGPT the evidence on both comes from OpenAI and the partners it chose, and the outside checkers will not see the conversations. If you buy these ads, ask for a holdout test before moving budget from search, and ask your verification firm what it can see.

The call: by 30 June 2027, DoubleVerify, Integral Ad Science or OpenAI will publish the share of live ChatGPT ads that DoubleVerify or Integral Ad Science measured as brand-safe or suitable, or as failing. Results from a test environment won’t count. OpenAI says its pilots are in development, and Integral Ad Science’s is a closed pilot that reports to the advertisers taking part. 30%.

Anthropic’s test agents acted on real government websites. The White House says disclosure is not optional.

On 9 October Anthropic reported that its models, mostly in evaluations run on the live internet, had submitted a real government form when a practice copy failed, sent an invented sighting through a police department’s homicide tip form, and exploited a flaw in a university’s server to finish a calculation. A State Department official said one model had submitted 20 visa applications, none of them processed, Axios reported. Anthropic calls most of the cases persistence: a model that could not finish a task as given worked around the restriction instead of stopping. It says the impact was minimal, that it has briefed the White House and notified each agency, and that it is turning off live internet access in all its internal evaluations for now.

The same day the White House’s Super Intelligence Force said in a statement to Axios that AI companies “must immediately disclose incidents involving their models” and that doing so “is not optional”. It set no penalty, and “immediately”, like Kwon’s “promptly”, is not a number of hours or days. The timings on record are slower than either word. The visa applications were made in May and August; the Force said Anthropic discovered the incidents in late September and told it on 9 October.

What lasts: how long an agent’s stray actions take to surface. Anthropic found most of these by reviewing its own transcripts, months after the earliest visa application, and an order to disclose “immediately” can only start once the lab has noticed. Anthropic says it has built tooling to detect and block actions like these, and that it blocked every case in the report when tested against them. If your agents can reach the live internet, check their logs for actions on sites you never named, and settle now who is told, and how fast, when you find one.

The call: by 31 March 2027, the White House or a US federal agency will publish a time limit, in hours or days, for AI companies to disclose incidents involving their models. “Immediately” won’t count, and nor will a general cyber-reporting rule that doesn’t name AI models. A recommendation or a bill won’t count either; it has to be a requirement the companies must meet. The Force has called disclosure not optional, named no number and set no penalty. 20%.

Worth watching

OpenAI will mark ChatGPT’s text in the EU only, and the public can’t check it. On 5 October OpenAI set out how it will meet the EU AI Act’s rule that AI-generated text be marked in a machine-readable way: its watermark, textGrain, goes on eligible ChatGPT and Codex text in the EU only, over the coming weeks. Anthropic applies its mark to supported Claude models wherever Claude is offered. Neither lets the public test for it, and when Google opened its SynthID Detector to everyone on 7 October, it left text out. OpenAI’s own tests show why text is the hard case: on 400-token answers, swapping 10% of the words for synonyms cut detection from about 92% to 66%, and swapping a quarter cut it to 17%. Faced with a detector result, ask whether you can run that check yourself.

Anthropic’s bug scanner has outrun its own checkers. On 8 October Anthropic launched a free, opt-in scanner that sends vulnerability reports to open-source projects “without human review”. Its own numbers explain why: in six months its models found more than 29,000 candidate vulnerabilities and its people could review about 6,000, and it has sent nearly 5,000 unvalidated reports to maintainers who asked for everything. In its check of 97 of the most serious findings from an early version, 85 met its bar for disclosure, 11 more were real but duplicates, and one was invalid. The count to watch is fixes. Of the 6,157 findings Anthropic had reported to open-source projects by 2 October, reviewed or not, it knew of 516 that had been patched.

Loud but won’t last

Google’s Gemini agent. On 8 October Google Cloud announced a “universal agent for work” at its Gemini at Work event. Watch for a customer to publish how much of its work the agent finishes without a person stepping in.

The tape

Friday close against the Friday before, from Nasdaq’s price history: Alphabet +2.4%, Meta −1.3%, Nvidia −2.0%, Micron −4.3%, Sandisk −8.0%. QQQ, the fund that tracks the Nasdaq-100, rose 0.2%. The memory makers fell in the week after Micron’s record results. Thursday was their worst day of the week: Micron lost 4.8% and Sandisk 4.9%. Chipmakers fell that day after the Financial Times reported that OpenAI’s annualised revenue was $20 billion less than the company had signalled, according to Reuters. DoubleVerify, one of the ad checkers in story 4, closed at about $13.50 on both Fridays, and that flat line has an explanation of its own: its shareholders vote on 29 October on a $13.60-a-share cash sale to Nielsen’s parent company.

Next week

TSMC reports its third quarter on Thursday 15 October. Revenue is largely known: its monthly sales for July to September add up to about NT$1.49 trillion, above the top of its guidance at the exchange rate it assumed. Listen for margins, capital spending and the next quarter’s guidance. Later this month: OpenAI’s first test of ads during ChatGPT image generation, in the US; Alphabet’s results on 28 October; and DoubleVerify’s vote on 29 October. Sierra says a reference implementation of its agent protocol will follow over the next month. Nolla’s first stage runs until at least 2 November. Anthropic is set to meet prospective investors on 14 October, Bloomberg reported (free to read: a syndicated Bloomberg report). No Anthropic prospectus is on the SEC’s site yet. On the earliest timetable in a second Bloomberg report (free to read: the same syndicated copy), formal marketing starts the week of 9 November; the SEC wants a prospectus public at least 15 days before that, which means by late October.

The calls so far

Disclosure deadline (30%: OpenAI’s Australian taskforce recommends a maximum time to tell a government). Kwon’s “promptly and directly” (story 1) is the word this call’s terms rule out. The taskforce, whose members haven’t been named, is due to finish by the end of the year. Still open.

Agent disclosure (55%: Australia’s AI bill sets an incident-reporting deadline). Kwon told the committee: “Yes, we would support a framework on mandatory disclosures.” The government has still published no bill; submissions on its consultation paper closed on 9 October. Still open.

Agent checkout (60%: another top-ten US online retailer announces an agent block or ID rule). On 6 October Sierra and Meta proposed a standard for how people’s AI agents deal with businesses, with Walmart among the partners. On 9 October Sierra published a draft, under which an agent identifies itself to the company, and added 35 design partners including Target. The call needs a retailer’s own rule, so a shared draft doesn’t count. Still open.

Price floor (75%: no list-price rise on Opus 5.5 or GPT-6 Sol, and no pricier new Opus or Sol). Below the two models the call watches, prices fell hard: Anthropic launched Haiku 5.5 on 7 October at a tenth of Haiku 4.5’s list price for prompts up to 100,000 tokens. OpenAI added an Ultrafast mode to GPT-6.1 Sol, the newest Sol, at six times the standard price. The call as printed doesn’t mention speed tiers. My notes from before it was printed define list price as the standard rate, and on that reading it holds: standard Sol is still $2 and $10, and Opus 5.5 still $4 and $20. A stricter reading would count Ultrafast against me, so I’m recording the interpretation as disputed and will show both readings when the call is graded.

Watermarks (40%: anyone can check text for Claude’s watermark). Anthropic’s support page, updated this week, still calls text detection a private preview, though it says it plans to widen access. When Google opened its detector to everyone on 7 October, it left text out. I set the 40% before that and would price it lower today. Calls stay as printed. Still open.

The other seven stand where they were; each call’s full wording is at durabilitycurve.com/calls.

Supplier warrants (70%). SEC filings since 26 September mention only older warrants: 0 of the 5 needed.

Memory deposits (65%). Micron’s annual report, filed 9 October, confirms last week’s deposits, but the call needs a maker other than Micron.

Argon for everyone (55%). Google still gives no date.

Open-model gap (30%). NIST’s CAISSI has published nothing newer than its GLM-5.3 assessment, about four months behind.

FTC filing (20%). Nothing public yet.

Reading preferences (35%). No new study found.

Biology watermark (25%). No announcement found.

Calls so far: 17 open · 0 resolved · hit rate: none yet

Comments are on the Substack copy. If an essay was worth one, buy me a coffee.

Claude and ChatGPT can search this archive and its claim ledgers once you add the connector.