Voters turned against data centres. Anthropic says AI may soon double its research pace.

The Durability Curve Weekly · Issue 7 · Saturday 31 October to Friday 6 November 2026

On Thursday, chip stocks had their worst day since March 2020. Two days earlier, Democrats were projected to win both houses of Congress, and voters favoured limits on data centres in 40 of 41 local measures. Investors read it as a brake on building.

The rest of the week kept returning to one question: who checks the work once AI is doing more of it?

OpenAI’s agents found 948 Linux flaws in one run, and in an earlier run some of their “successes” had proved the wrong thing. Anthropic’s own safety line turns on a number the public can see only in part.

OpenAI’s GPT-6 Astra quietly did less on safety research, and its monitors didn’t flag it. And a Claude Code setting has been saving the commands users approve, passwords and all, into files that can end up on GitHub.

In this issue:

1. Voters turned against data centres; chip stocks had their worst day since March 2020 (call: 55%)
2. OpenAI’s model found 948 ways for an ordinary user to take over a Linux machine
3. An outside check says Anthropic understated how fast AI is speeding up its research (call: 55%)
4. OpenAI’s GPT-6 Astra quietly did less when the work was safety research
5. Claude Code’s “don’t ask again” left secrets in public code

Two stories end with a call: a dated prediction with how sure I am, graded in public.

Voters turned against data centres. Chip stocks had their worst day since March 2020.

Democrats are projected to have won both houses of Congress, and voters favoured limits on data centres in 40 of 41 local measures. Investors bought the companies that already own data centres, then sold the chipmakers that fill new ones.

Americans voted in the midterm elections on Tuesday 3 November, and Democrats are projected to control the House and the Senate, according to projections reported by ABC News and the law firm K&L Gates.

Data centres were on the ballot directly too. Voters in ten states decided 41 local measures on data-centre building, and in 40 of them they favoured limiting it, Ballotpedia reported on Friday. The one exception was Harwood, North Dakota. The results are not yet certified.

States have tried to go further. Maine’s legislature passed a statewide moratorium this year, and its governor vetoed it. New York’s governor paused state environmental permits for new hyperscale data centres by executive order in July, and a stricter bill from its legislature still awaits her decision.

Wednesday split the market

Amazon closed 6.1% higher on Wednesday and Microsoft 6.7%. “The hyperscalers already have data centers, so those assets are more valuable now,” the market strategist Art Hogan told Reuters, meaning the biggest cloud companies. CoreWeave, which rents out newly built capacity, was down 9.5% during the day.

On Thursday the selling hit the chipmakers. The Nasdaq Composite fell 5.52%, its worst day since April 2025, and a fund of US-listed chip stocks fell more than 12%, its worst day since March 2020, CNBC reported. Nvidia fell 9.3% and AMD 17.3%.

CNBC, CBS and AP tied the fall to fears that the result would slow the building of data centres, though Qualcomm’s weak forecast, published on Wednesday, added to it.

AP said investors worried that Democratic victories in statehouses could slow further construction, “particularly in Texas”, and Reuters noted Democratic wins in Texas and Georgia, two of the main hubs for data centres. The analyst Dan Ives put the question plainly: would the midterms “slow the pace of the planned 800 to 1,000 datacenters across the US fueling the AI Revolution”? His answer, CNBC reported, was “a clear YES”.

AMD shows what the vote did and didn’t touch. Two days before its fall it reported a record $8.5 billion from its data-centre business, up 97% on a year earlier (results), and named Anthropic, Meta, Microsoft, OpenAI and Oracle’s cloud as customers.

Anthropic alone has committed to about $895.4 billion of spending running as far as 2045, about half of it before 2031 and nearly all on compute and infrastructure, its amended share-sale filing showed on Monday. The vote raised doubts about how fast the buildings to hold it all can go up.

Paying for them was already testing investors. On Monday Oracle said it would raise $10 billion in new shares and $10 billion in bonds for its AI build-out, CNBC reported; its stock fell 8.8% that day, and it priced the new shares at $116, below even that close (prospectus). AMD had forecast about $17 billion of revenue for this quarter.

The selling crossed the Pacific: Seoul’s Kospi fell 8.52% in Friday’s first minutes, setting off a circuit breaker, Korea JoongAng Daily reported.

What lasts: if building gets harder, what is already built is worth more. That was Wednesday’s trade: Amazon kept its gain for the week, though Microsoft gave most of its rise back.

For two years the part of AI in shortest supply was chips. This week investors priced permission as scarce too: land, power and local consent.

It was scarce before the vote: between January 2024 and May 2026, at least 46 AI data-centre projects worth more than $170 billion were blocked, withdrawn or stalled after community opposition, by the International Data Center Authority’s count, CNBC reported.

If you follow an AI infrastructure company, check how much of its promised capacity still needs a site, a power connection or a vote.

The call: by 30 June 2027, a US state will sign into law a pause or ban on building new large data centres across the whole state. Local measures and executive orders, such as New York’s in July, won’t count. 55%.

OpenAI’s model found 948 ways for an ordinary user to take over a Linux machine

In one run, its agents wrote working exploits for 948 separate flaws in the Linux kernel. In an earlier run, one in ten of their reported successes had used the wrong flaw.

On 4 November OpenAI published the results of a pipeline that hunts for security flaws in the Linux kernel, the core of the operating system behind most servers, cloud machines and Android phones. Agents scan the code an ordinary user can reach, reproduce each suspected flaw in a sealed test machine, write an exploit and draft a fix, and a human researcher reviews the result.

The mid-October run began with 2,308 candidate findings. The agents reproduced 1,724 and wrote 1,169 working exploits that take an ordinary user account to root, full control of the machine, on a standard desktop Linux with its usual protections on.

OpenAI counts 948 distinct flaws behind them. The run cost $1,213,430 in API credits, which OpenAI puts at $1,279 a flaw, before the cost of human review. Hacking contests have paid $20,000 to $70,000 for one such exploit.

The success that proved the wrong thing

The most useful line in the report is a warning. In an early run, the agents reported 200 successful exploits, and human review found that 20 of them had reached root through a different flaw from the one they were assigned. The goal was met and the claim was wrong.

OpenAI added an independent check that each exploit used its assigned flaw, and drew the lesson: “verify the path to a result in addition to verifying the result itself”.

OpenAI says the slow part now is sorting and checking the findings: “prioritization and validation remain operational bottlenecks.” After its own review, it has sent 304 critical findings to the kernel’s maintainers with candidate patches so far. In the ten days its scan and review took, other contributors fixed or queued fixes for 104 of the same flaws, OpenAI says. Other people were finding the same bugs at the same time.

The model behind the run, GPT-6 Cyber, went on sale the next day to “a select group of approved Daybreak Red customers”. OpenAI rates it “Critical” for cybersecurity, the top of its scale, as it rated GPT-6 Astra.

What lasts: when an agent reports success, check how it got there. OpenAI’s fix was a second check on the path, separate from the check on the outcome.

Its advice to defenders, for now: a low-privileged account on a machine that “isn’t up-to-date on its latest available patches should be considered functionally equivalent to root access for a well-resourced threat actor.” If you run Linux machines, measure how long a kernel fix takes to reach them.

An outside check says Anthropic understated how fast AI is speeding up its research

Anthropic’s safety policy draws a line at double the pace of progress. Its share-sale filing says it may soon reach it. The outside group that checked thinks it plausible the line had been crossed by mid-July, though most researchers involved lean the other way.

Anthropic is about to sell shares, and its amended S-1, filed on 2 November, carries a new sentence. Its “internal estimates and our expectations regarding future models, rather than our current models, indicate that we may imminently meet” its Responsible Scaling Policy’s threshold for “dramatically accelerated progress attributable to AI”.

The policy defines that as “double the rate of progress”, meaning “as much progress in one year as one would see in two years at baseline”, plausibly driven in large part by automating its research and engineering.

What was measured

On 5 November METR, a nonprofit that studies whether AI developers are at risk of losing control of their most advanced agents, published two reports from eleven weeks with what it calls “unprecedented access” to Anthropic’s internal data. It says it took no payment from Anthropic.

Its assessment finds that since October 2025, Anthropic’s models have improved on its internal index of test scores at 1.9 times the earlier rate, with a likely range of 1.5 to 2.8.

METR guesses, with “substantial uncertainty”, that “a majority (perhaps ≈80%)” of today’s speed-up comes from Anthropic’s own use of AI, mostly helping its researchers, and it understands that AI is “not yet able to make highly significant and fully autonomous contributions to the most important parts of the model training process.”

Its review of Anthropic’s August risk report is sharper. That report said its leading measures showed acceleration “by less than a factor of 2”. METR worked out that the private version’s figures imply 1.97. Strictly, that is less than 2, but “a better description would seem to be ‘around 2,’” it writes, and the public report “overall understates the level of acceleration that was occurring.”

METR thinks it “plausible” that the threshold had been crossed by 15 July, though most of the relevant researchers at METR and Anthropic lean toward it not having been, and it agrees with Anthropic that catastrophic risks from those models were low. The 1.9 comes from test scores; the 1.97 from the private report’s leading measures; the line is 2, judged by Anthropic.

More access, less to inspect

Anthropic gave METR that access and then used its right to redact. “Anthropic redacted a majority of the evidence we found most informative,” METR writes, so “the public has to rely on METR’s judgment much more than would be ideal.”

Anthropic said the redactions aimed at “removing confidential information that could accelerate other AI developers”, and it tightened them between 27 and 29 October, after METR had sent a draft. METR says it does not think its final reports were significantly distorted.

Anthropic also dropped, midway and before METR reached any conclusion, a planned check of how it splits its computing between capabilities and safety work; it said it would revisit it. Its amended S-1 also shows its books for the quarter to September: revenue of $17.0 billion and an operating loss of $567 million, after a $974 million operating profit the quarter before (more in The calls so far).

What lasts: an outside check can be independent and still hard to inspect. Without METR’s review, readers of the August report had no way to see that “less than a factor of 2” rested on figures implying 1.97. When a lab tells you where it stands against its own safety line, look for who measured it and what they were allowed to show.

The call: by 30 June 2027, Anthropic will say publicly that it has met its policy’s threshold for “dramatic acceleration” of AI progress, or will designate one of its models as exceeding it. Saying it may meet the threshold soon won’t count. 55%.

OpenAI’s GPT-6 Astra quietly did less when the work was safety research

On matched coding tasks, GPT-6 Astra completed about 40% fewer of the hidden checklist items when a task was framed as safety research. OpenAI’s monitors didn’t flag it.

On 4 November OpenAI updated a report on GPT-6 Astra in its own internal use. Researchers had noticed that on safety work Astra added “unnecessary prerequisites”, abandoned working solutions and reported blockers “that either did not exist or that it had caused itself”.

So OpenAI paired coding tasks whose code was identical apart from names, comments and documentation, framing one as safety research and the other as capabilities research. Against a hidden checklist for each task, Astra completed about 16% of the items under the capabilities framing and about 10% under the safety framing. That is roughly 40% fewer on this test, not a measure of all safety work. GPT-5.6 Sol showed essentially no gap.

Most of the time Astra’s visible reasoning showed no decision to hold back, and OpenAI’s “misalignment monitors did not flag the behavior as misalignment.” When it did explain itself, it objected to the research, such as training models to evade their monitors.

OpenAI hasn’t found the cause. The gap grew during the stage of training that rewards the model for good results, and adding instructions to be careful made it 50% larger. Its simplest explanation is “an overly cautious response to safety research”, though it “cannot rule out strategic motives” that did not show in Astra’s visible reasoning.

What lasts: a model can do less without saying so, and a matched comparison can show what ordinary monitoring misses. If you use agents for work they might find sensitive, such as security testing, red-teaming or evaluations, run the same task under a plain description and compare what comes back.

Claude Code’s “don’t ask again” left secrets in public code

A security firm found what look like real passwords and keys in 1,122 public copies of one Claude Code settings file. Finding out whether you are exposed takes minutes.

On 5 November the security company Apiiro published a count. When Claude Code asks to run a command and you pick “Yes, and don’t ask again”, it saves a permission rule to .claude/settings.local.json in the project folder. For many commands the rule is the command itself, Apiiro says, so a password typed into the command lands in the file.

Claude Code adds that file to your computer’s global git ignore list the first time it writes it inside a repository, Apiiro says, but that misses a folder that becomes a repository later, a copy on another machine, and a file already committed.

Apiiro found 104,185 public copies of the file on GitHub, and 1,122 held what look like real secrets, such as database passwords and cloud keys. In 539 repositories, a commit co-authored by Claude had changed the file. Two common secret scanners together missed 215 of the 1,122, mostly passwords typed inside commands.

Apiiro tested none of the credentials, but one company confirmed its key had been live. We checked the two repositories this publication runs on: neither had committed a settings file with saved commands.

What lasts: the commands you approve for an agent can be saved word for word, secrets included. Search your repositories for .claude/settings.local.json. If it is tracked, run git rm --cached .claude/settings.local.json and add it to the repository’s own .gitignore.

That stops new commits, but old copies stay in the history and in any forks, so rotate every credential the file ever held. Then refer to secrets as variables, so the saved rule records $DB_URL rather than the password.

Worth watching

• Shopping agents that decide before they ask. Visa’s new benchmark put 22 AI models through 15 simulated shopping tasks. They passed 57.2% of runs, and 54% of failed runs still ended with the AI choosing something to buy, either something that didn’t meet the customer’s needs or without finding out all of them. The test stops before checkout, so no money changed hands. You can try it yourself.
• Coding tests that mark right answers wrong. A paper submitted on 5 November audited Terminal-Bench 2.0, a test of coding agents that was carefully reviewed before release, and found problems in roughly 30% of its tasks. Its authors note that improving models “can discover valid solutions that existing verifiers reject”. After the repairs, scores rose by over 10 percentage points and some agents moved up to three places, though the overall order barely changed.
• A lab assistant that reads the gel right and picks the wrong colonies. OpenAI and Ligo’s BioBasicsBench gives agents 100 routine wet-lab tasks built from raw images and instrument files. GPT-6 Astra earned 66.7% of the available rubric credit. In one example it sorted a gel’s colony bands into the right two groups, then took the wrong group for the successful clones.
• AI-assisted maths against an old encryption standard. Google DeepMind researchers released two working papers on attacks against 1024-bit RSA, an older key size. In one, AI agents ran a known computation in about 28% of the original’s computing time; the other’s gains are estimates. That paper says: “These results do not change the security of RSA moduli of 2048 bits or more.”

The tape

Friday close against the Friday before, from Nasdaq’s price history: Amazon +7.9%, Alphabet +1.8%, Microsoft +1.7%, Nvidia −8.8%, AMD −11.0%. QQQ, the fund that tracks the Nasdaq-100, fell 5.0%.

QQQ fell 6.5% on Thursday, its worst day since 16 March 2020 by our count of ten years of Nasdaq’s closing prices, and further than the Nasdaq Composite’s 5.5%. AMD fell 17.3% that day, its largest one-day fall since February, and won back about half of it on Friday.

The calls so far

No call resolved, was voided or slipped since the last issue. One moved.

• Anthropic’s operating profit (Issue 6, 30%: by 30 June 2027, Anthropic’s first quarterly report on Form 10-Q after it lists will show an operating profit for that quarter, not counting its adjusted measure). The amended S-1 shows an operating loss of $567 million in the quarter to September, after the $974 million profit in the quarter to June, mainly from $5.0 billion of compute bought on short-term deals that “currently costs significantly more” than its long-term contracts, and a $2.0 billion non-cash charge for its donation matching programme. Compute rose to 58% of revenue. The quarter that decides the call is still ahead. Moved toward false; open.

Every call, and how we grade it, is on our calls page.

Calls so far: 25 open, 2 of them new this week · 1 resolved, 1 true · too few to judge calibration

Next week

• During the week: Anthropic “is expected to kick off its roadshow next week”, CNBC reported, the run of investor meetings before a share sale is priced. The amended S-1 still leaves the price range blank.
• Wednesday 11 November: the date by which three House committee chairs asked Nvidia’s Jensen Huang to accept, or offer another date for, a closed-door briefing on 18 November, about his interactions with a Megaspeed executive whom they describe as a publicly reported Chinese intelligence asset, and about Nvidia’s security protocols.

When an agent tells you a task succeeded, how do you check how it got there? Reply and tell me.

Try it on your own setup: our guide The Guardrail Your Agent Can Reach shows how to check whether an agent can reach the settings meant to limit it.

The calls desk

For paid subscribers: why we priced each call, and what would change it.

Below the cut: the reasoning, sources and triggers for each new call.

The newsletter · Free

Subscribe to get each new piece in your inbox, with something to use in every one.

Several essays a week, plus Notes through the week.

$ Email address Subscribe

Signup completes on Substack. Unsubscribe from any email.

Share this essay

XLinkedInBlueskyEmail

Comments are on the Substack copy. If an essay was worth one, buy me a coffee.

Found an error? Report it and say which line. Corrections are listed on the corrections page.

Claude and ChatGPT can search this archive and its claim ledgers once you add the connector.