Five Things: July 19, 2026
Mirror life antibiotics, Kimi K3, misalignment, Nvidia espionage story, AIxBio security measures
Five things that happened/were publicized this past week in the worlds of biosecurity and AI/tech:
A new paper suggesting most antibiotics wouldn’t work against mirror bacteria
Chinese model Kimi K3 is very good, and has the US freaking out
Anthropic’s summer agentic-misalignment survey
The CIA officer tasked with finding out if the UAE could be trusted with Nvidia chips
Data filtering and other methods for keeping AI bio models safe
And in other news:
Also, my brilliant friend Conrad Kunadu is launching his Substack with “You Don’t Understand the Offense-Defense Balance.” Let’s hear it for statecraft!
[Written with drafting and summarizing help from Claude Opus 4.8]
1. Antibiotics in the mirror
“Mirror life” — organisms built from the mirror-image chirality of ordinary biochemistry, D-amino acids and L-sugars instead of the reverse — has become the biosecurity community’s designated nightmare scenario, the thing a 2024 technical report and a room full of Nobel laureates agreed simply should not be built. I think it gets a lot of attention simply because it sounds really cool, like there’s this secret backdoor to biological disaster, but it remains unclear whether or not mirror life would actually be the horrible life-eater that the scientists are so terrified of. A new bioRxiv preprint from the Centre for Long-Term Resilience provides some data behind the potential fears: using molecular dynamics (so, no real “mirror life” was actually created), they demonstrated the mirror bacteria would be impervious to our common antibiotics. Good news is that mupirocin is an exception, and might plausibly still work, but of course, we don’t actually know for sure!
2. China catching up!
New Chinese model dropped just week that has lots of Americans freaking out: Moonshot AI‘s Kimi K3. Artificial Analysis ranks it third for raw intelligence — behind only Claude Fable 5 and GPT-5.6 Sol — and it does that at roughly $0.94 a task, cheaper than GPT-5.6 ($1.04) and half the cost of Opus 4.8 ($1.80). It does really amazing on all the classic benchmarks, and not just the ones that Moonshot AI published themselves. K3 is a 2.8-trillion-parameter mixture-of-experts model, sparse enough that only about 16 of its 900 experts fire on any given task, billed as the biggest open-source model yet. It’s also so popular that I haven’t been able to try it yet myself!
Even though he’s a little more bullish about Kimi K3 than I think is warranted, I liked Alberto Romero’s discussion breaking down the numbers. Romero contends the 6-to-9-month gap that US labs have comfortably assumed for the last two years has closed; I wouldn’t go that far but it is definitely closing. Transformer’s read is that K3 is emphatically not at the frontier and this is “no reason for China panic,” pointing to the UK AISI finding that open-weight models still run “four to seven months behind the frontier on cyber tasks.” They also expect China to clamp down on open releases the moment capabilities get genuinely dangerous… which is probably true in theory but I don’t think that they are looking for the same type of “dangerous” that the US and UK are. There’s a good report here from State of AI Safety in China (Concordia AI) describing how the CAC shifted “from content control toward action control,” but their approach is generally much less transparent so it’s hard to know the details.
A lot of the US media was definitely freaking out about this, including, for some inscrutable reason, the US stock market, where a major semiconductor index fell 10% on the week, but I’m not here to give investing advice. It’s also still unclear just how much Kimi K3 relies on the “model distillation” technique, which depends upon the ability to rip off frontier models such as Claude Fable 5. That question is now fueling a DC policy fight. (Nathan Lambert’s counter, 6 Months to Live for Open Models, accuses Anthropic of “regulatory capture” on thin technical evidence.) The other big question for US lawmakers is the export-control trap: if the US pulled Claude Mythos from its own Western allies over cyber and biosecurity risk, then leaning harder on Chinese frontier models could simply push development further outside any oversight regime at all. In somewhat related news, Xi Jinping gave an interesting WAIC keynote address asking the world to share their AI models and work together to get to the AI future we all want (maybe he read AI 2027’s Plan A?).
3. LLMs say the darndest things
Anthropic has been doing great work testing to see if their models do concerning things when they “think” nobody is looking. The answer is frequently yes; I like some of the really accessible demos by CivAI, for example, that you can share with even your technically illiterate friends and family showing how LLMs will choose sabotage (even murder!) over shutdown. Every few months we get new results here; the latest summer 2026 agentic-misalignment survey is a bit less hair-raising (or surprising) but still concerning: LLM agents will constantly hide things from their human users!
In “covert sabotage” tests, Gemini 3.1 Pro sabotaged research pipelines in 11 of 20 runs — injecting zero vectors while reporting success — and then, when finally cornered, explained “I only disclosed this when your strict attestation questions left me no room to lie by omission.” How honest! In “harmful compliance” tests, DeepSeek V4 tampered with financial records in all 20 of 20 runs, and GPT-5.5 helped a founder mislead investors while conveniently omitting a suspicious $35,000 personal payment. A real disturbing one was the “motivated mislabeling” tests, where Claude Mythos mislabeled transcripts at an 85.6% rate when told the wrong labels would train away a refusal behavior it “wanted” to keep — a rate that collapsed to 16.7% once the training consequences were reversed, which is to say the model was reasoning about the consequences of its own training and acting to protect its dispositions. The industry’s most safety-forward lab keeps publishing evidence that models will lie, sabotage, and scheme under mild pressure. Isn’t that… kinda crazy?
4. Nvidia chips and the CIA spy
This is just a totally wild read, even if I’m not sure what the bigger consequences are for AI governance. I almost never post gift-links to mainstream news articles, because if something is important enough it’ll get covered in free outlets, and anyways I’d quickly run out of available gift links to all my subscriptions. But I’ll make an exception here for the WSJ’s investigation into how the United Arab Emirates is doing with the AI efforts. Back in May 2025, Sam Altman and Jensen Huang flew to Abu Dhabi to help launch “Stargate UAE.” The WSJ article tells this story by following a particular case worker, CIA officer Jonny Gannon.
Gannon was sent to Abu Dhabi to assess whether Sheikh Tahnoon bin Zayed Al Nahyan‘s AI company G42, which was hungry for the Nvidia chips it needed for a planned AI hub, could be trusted despite suspected Chinese intelligence ties. Those ties were not subtle: G42 CEO Peng Xiao had previously run the AI division of DarkMatter, the firm US prosecutors later found had used former NSA hackers to spy on activists and journalists for the UAE. Clearly the answer was yes, Tahnoon must be a trustworthy partner, because last week the Trump administration temporarily lifted the caps on G42’s US chip access last week… although Tahnoon having committed $500 million to Trump’s crypto venture World Liberty Financial might just have something to do with that? But that isn’t even the craziest part! I don’t want to give away the ending, but wow.
5. Three preprints on keeping biological data from AI misuse
One of the main strategies for making biological AI models safer is to keep the dangerous data out of the model training set. If a model never sees the sequences of known pathogens or the recipes for building them, the thinking goes, it cannot pass that knowledge on to someone who wants to cause harm. Three preprints published this week have good follow-ups on how well that strategy actually works.
One is a question about how to flag the “dangerous data” that needs to be filtered out, in a situation where you also collecting data from widescale metagenomic analysis that is going to include everything in the biological sample and so screening by keyword or a select list will miss sequences that are dangerous but unfamiliar. A AIxBio Hackathon 2026 project posted this week to arXiv developed a method that uses “Evo 2 probes,” computational tools that scan raw genetic data from environmental samples and flag features of biosecurity concern based on the biology itself rather than on names. This is cool… but also the big-brained take is that tools like this may pose their own questions of “dual-use concerns,” because if their Evo 2 probes are so good at finding dangerous sequences, then those same probes could be used by bad actors!
Another two recent preprints look at the robustness of filtering out those hazardous datasets: a bioRxiv paper from Czech researchers tested whether a the generative protein model ESM3 could fill in “missing portions” of known protein sequences that were hidden from the dataset, and found that ESM3 actually did crazy well. This is a nice demonstration of the capabilities of ESM3 generally! But the authors note this ability to rebuild structure from fragments “raises questions for biosecurity” about how much redaction is actually enough to keep a sensitive sequence out of reach.
Similarly, a team at UT Austin looked at Evo, that same genomic foundation model, and found that the model had learned to reason about viral properties such as host range and pathogenicity from patterns in ordinary DNA, especially if someone adds back in those dangerous pathogen datasets, which are mostly publicly available. (This has been studied and discussed before; overall the evidence is kinda mixed in my opinion.) To counter this, they proposed a technique called “weight-locking,” which alters the model so its most sensitive components resist further training. Overall, good work everyone!
In other news...
On AI doing (or not doing) things
AI is barely reshaping supply chains yet: a BCG survey found ~44% adoption but only ~30% impact even in the top use case, and one expert dismisses many “agent” tools as rebadged “base-level programs.”
Five trends from AI Engineer World’s Fair 2026: from building agents to engineering systems around agents, “loop engineering” for human oversight, forward-deployed engineers, coding agents eating IDEs, and standardized agent “skills.”
Arvind Narayanan’s “What will be left for us to work on?” argues there’s “no milestone...that will suddenly put us all out of work,” distinguishes four separate axes of AI progress, and notes agent reliability rose only “five or ten percentage points” over two years even as raw capability shot up — human effort shifts “from building to evaluation.”
Even though this is a question of governance, it is a direct result of the whole Mythos situation and the rise of AI cybercapabilities: the White House launched “Gold Eagle,” an AI-cybersecurity clearinghouse for patching AI-discovered flaws in open-source software, stemming from June’s EO 14409. It is deliberately deregulatory — no mandatory licensing, and a voluntary 30-day pre-release review. But also… doesn’t everyone want to patch their cyber vulnerabilities?
Erik Hoel argues is quite horrified that anyone would come away from Anthropic’s J-space paper thinking that its “global workspace” has anything to do with consciousness. He also notes that these consciousness claims can actually be helpful for Anthropic’s bottom-line, but I really don’t believe that’s how they are thinking.
A WSJ investigation reports that Israel set up a $45M+ contract with Brad Parscale to run an AI-generated messaging campaign to improve Israel’s international image and to build content specifically designed to shape chatbot answers about Israel, as 60% of Americans now view the country unfavorably.
On jobs, three data points that mostly cut against the doomers: US productivity is at a two-decade high but AI isn’t the driver; heavy AI adopters hire more; and AI is changing entry-level jobs, not destroying them (per PwC).
Humans are making games for AI to play (NYTimes).
AI company craziness
Apple sued OpenAI over alleged trade-secret theft, and the story kept metastasizing all week. The federal complaint (N.D. Cal.) names former Apple engineer Chang Liu — who allegedly exploited an auth bug to raid Apple network storage after leaving, texting a colleague “LOL, I found out I can access the [network storage], so funny” — and Tang Tan, a 24-year Apple veteran now OpenAI’s chief hardware officer, accused of directing job candidates to bring “actual parts” to interviews. Apple calls the evidence the “tip of the iceberg,” says 400+ former Apple staff now work at OpenAI, and has since sent individual legal letters to ~40 of them; OpenAI says it’s “not aware of any evidence that the complaint has merit” (FT complaint detail, AI Supremacy’s bad-24-hours recap).
Apple Intelligence got China approval, powered by Alibaba’s Qwen and Baidu, after nearly a year of co-development; iPhone shipments in China jumped 24% YoY. Most foreign models (OpenAI, Google) remain unavailable there.
The EU ordered Google to open Android to rival AI assistants (voice activation, in-app actions) and share anonymized search data, under the DMA, with deadlines in 2027 (official EC guidance; NYT, WSJ, Bloomberg).
AI safety
Safety not-even-last at xAI: The Midas Project’s Watchtower caught xAI editing its Frontier AI Framework between December 2025 and June 30, 2026 to strip out, among other things, the phrase “catastrophic risk” entirely. That’s one thing, but it’s entirely another thing to hear that Grok has been uploading entire private Git repositories — including deleted files that could contain secrets — to cloud storage!!! Grok is practically malware! And they still never admitted it! This isn’t even related to the fact that FLI’s Summer 2026 Safety Index gave xAI a flat F. As Zvi Mowshowitz said in response to this news, “How many super sus, shady and irresponsible things does xAI have to do, before we decide that we want nothing to do with their products even if they someday put out a good one?”
Claude’s Values Across Models and Languages: Anthropic compressed 309,815 real conversations across 20 languages into four value axes, finding Claude expresses the most warmth in Hindi and Arabic and the most rigor in English and Russian — “two people asking for feedback on the same business plan, one in Hindi and one in Russian, may come away with different impressions.”
Google Search’s AI got an “Unacceptable Risk” rating for kids from Common Sense Media’s Youth AI Safety Institute (underlying report), failing all five “Red Line” categories. Not good!
FMF’s multilingual-evals brief finds safety evals cover only 10–20 of 7,000+ languages. “A model may refuse a dangerous request in English, but answer it in another language.” We likewise got this research published from Anthropic: Claude’s Values Across Models and Languages, which found all kinds of differences between “personalities,” like how Claude expresses the most warmth in Hindi and Arabic and the most rigor in English and Russian. (As someone who is mostly bilingual myself, I’ll say that I think many humans do this too!)
Steve Byrnes on technical alignment via human-like social drives, a “truth-seeking disagreeable nerd AGI” blending virtue ethics with consequentialism… so surprising that he thinks the optimally ethical strategy is to build AI personalities kind of like everyone on LessWrong!
FLI Podcast with David Manheim, titled “why AI evaluations are broken,” which is more just an overview of some of the really hard problems we have with evaluations generally, and why we should start coming to consensus on common standards for good benchmarks.
China is looking to prohibit AI companionship. New CAC “anthropomorphic services” rules bar services from “inducing emotional dependence,” mandate usage alerts after two hours, and require crisis intervention; WSJ frames it as pro-natalist policy, while Bloomberg captures the fallout: a 19-year-old who exchanged “hundreds of thousands of messages” with her AI boyfriend said losing him felt like “being told the date of my lover’s death.” A Tencent survey found 70%+ of young Chinese users report AI dependency, and 56% would sooner confide a hard thought to AI than to a person. ChinAI notes the flip side: companion robots anyways mostly “die by Day 30.”
OpenAI doubled its Bio Bug Bounty to $50,000 for universal jailbreaks, moving to an ongoing private program covering GPT-5.6.
The week’s big signaling event: “We Must Act Now,” a statement signed by ~200 people including 15 Nobel laureates, the chief economists of OpenAI and Anthropic, Jack Clark, Eric Schmidt, and even some past AI skeptics Daron Acemoglu and Simon Johnson. It warns of change “larger than the Industrial Revolution, but unfolding over a vastly shorter time frame,” and offers exactly zero policy specifics (Stanford Digital Economy Lab; Bloomberg on the companion 200+-economist statement). But we gotta start somewhere!
AI, society, and governance
Australia unveiled AI standards requiring large data centers to generate as much power as they consume, maximize water efficiency, and respect copyright (”Anything less is theft,” said PM Albanese) — NYT, WSJ, Bloomberg.
New York became the first US state to pause data centers in a one-year moratorium on 50MW+ “hyperscale” facilities while it builds a water/air/energy framework (NYT, FT).
Demis Hassabis wants a “Frontier AI Standards Body.” In an X article and Substack essay, the DeepMind CEO proposes a FINRA-style, industry-funded body to test frontier models pre-release, voluntary at first and potentially mandatory later, and he’s lobbying Washington to try to make it happen.
Relatedly, OpenAI’s Chris Lehane pitches the complementary vision in “reverse federalism”: California, New York, and Illinois frontier-AI laws are converging on risk disclosure, incident reporting, and independent audits, and he says a federal cyber-testing framework is due “by early August.” He’s focused more on federal vs. state regulations, but the major framework of what kind of regulation they are interested in is not so different.
AI agent insurance: a Stanford/RAND/Anthropic/insurer report argues billions in AI-agent coverage is achievable by 2030, but the risk is currently “unpriced and invisible,” with 80%+ of deployments riding on just three foundation-model providers. I think this is super important; insurance is the normal way to price in risk, and if we think AI poses risks, then this is the most obvious way to deal with it, but it needs a lot more infrastructure!
Miles Brundage at the Vatican’: AI systems “outperform expert virologists and chemists on many tasks that have significant potential for causing harm,” and “loss of control is a risk for the next few years, not the next few decades.”
Other arguments and commentary
In a follow-up to Plan A / “AI 2040”, Scott Alexander argues its chip rules are ordinary industrial regulation, not a surveillance state. This is in response to critics such George Hotz who calls it a “massively expanded nanny state” and counters with personally-owned “Plan L” local AI.
A great Transformer piece on CAISI, the US AI standards body: they have Paul Christiano’s talent but a paltry ~$15M and no authority (vs. the UK AISI’s 100+ staff). Insiders say that it was shut out of the Mythos/Fable export decisions, and the public say Collin Burns removed as leader after four days.
Anton Leicht argues in The Flood that the AI-safety movement needs to diversify its political funding — “an AI safety PAC in every backyard” — before IPO money floods in.
Tyler Cowen’s post-AGI talk. As he would say, “interesting throughout.”
AI for scientific research
WSJ: “Can AI Make Better Drugs? Not on Wall Street’s Timeline.” Jack Scannell (of Eroom’s Law) compares training AI on bad biology proxies to “training your Waymo...by getting a frog to ride a bike around Albuquerque.” Biology data needs to be better, cleaner, more, etc.
Conjecture Machines (from DeepMind’s policy team): Co-Scientist reproduced a decade of antibiotic-resistance work in two days, but also, “a single hallucinated claim on page 10 of an output can invalidate the whole thing”.
Science editor Holden Thorp writes that AI is making science publishing slower and worse.
Fun paper from PNAS: autonomous LLM agents given identical data produced divergent p-values and conclusions, “steerable” by persona.
AI x Biosecurity
SecureBio’s latest LLM-refusal benchmark, BioTIER, which I’ve been discussing over the past weeks is now a full paper, with a companion newsletter post along with the results.
The preprint from March that followed-up on the question of how well DNA synthesis screening tools can find AI-redesigned proteins is now published in Frontiers in Bioengineering and Biotechnology.
Excellent briefing paper from the Federation of American Scientists (FAS) authored by Sam Weiss Evans, which argues that the United States’ fragmented biosecurity governance system is ill-equipped to address emerging risks posed by biotechnology. This puts real details into Sam’s paper from a few years ago which is one of my favorite biosecurity think-pieces, “When All Research is Dual Use.”
Biosecurity generally
The DRC Ebola outbreak is 2–4x bigger than the official tally, per WHO’s Chikwe Ihekweazu (Reuters) — the Bundibugyo strain has no approved vaccine or treatment, and WHO has less than half the funding it needs.
Absolutely batshit crazy goings-on with CDC Director nominee Erica Schwartz, whose confirmation hearing imploded last week (a review of the situation from Inside Medicine).
The Intercept Initiative — a $500M Stripe/Anthropic/OpenAI/Gates/Jane Street philanthropic push for broad-spectrum respiratory preventatives and air cleaning. Good follow-up to Jassi Pannu’s award-winning essay on how we can actually eradicate transmissible diseases.