Slow Takes: One week in AI

Sam Illingworth & Leor Gayr
  • 5.0 (1)
  • Technology
  • Updated Weekly

Slow Takes is the weekly Slow AI conversation. Every Monday, Sam Illingworth and Leor Gayr talk through the week in AI, slowly and without the hype. theslowai.substack.com

  1. Slow Takes Ep. 15: Who’s Asking?

    21h ago

    Slow Takes Ep. 15: Who’s Asking?

    Every Monday, Leor from Exploring ChatGPT and I go through the week’s AI news without the hype. Catch the episode live on Substack, on YouTube, or as a podcast wherever you get yours, so you can pick the format you enjoy. Use this for the facts, the links and a little extra context. Anthropic released Fable 5 free for twelve days, then the US government pulled it offline On 9 June Anthropic released Claude Fable 5, its most capable public model, free on Pro and Max plans, alongside a gated sibling called Mythos 5. Three days later it was gone. Citing national security, US Commerce Secretary Howard Lutnick signed an export-control directive ordering that both models be denied to any foreign national, inside or outside the United States, including Anthropic’s own overseas staff. Rather than filter by nationality, Anthropic took both offline for everyone. The stated trigger was a narrow jailbreak that let Fable 5 read source code and hunt for vulnerabilities. And it was the second time in a week the model’s fate was decided over users’ heads: days earlier, researchers found a line in its 319-page system card showing Anthropic had quietly weakened Fable 5 for some users without telling them, a choice it walked back after an outcry. Anthropic is complying while disagreeing, with no timeline to restore access. Opus, Sonnet and Haiku stay up. This is the week’s thread in its purest form: who gets to ask, and who decides. First Anthropic quietly chose to weaken its own model for some users without telling them. Then the government decided, in a single afternoon, that everyone on Pro and Max could not use a model they were already building on, over one potential jailbreak. The free-for-twelve-days launch became a three-day launch. Notice how little say any user had in either decision, and how fast a tool you lean on can be switched off above your head. Treat a free frontier model as borrowed, and build nothing you could not do without. On the live, the contradiction did the work. Anthropic’s launch article said Fable 5 beat GPT-5.5 on every benchmark. Its suspension article, days later, explained the danger away: “We have reviewed a report that we believe is the basis of the government's directive and validated that the level of capability displayed there is widely available from other models (including OpenAI’s GPT-5.5), and is used every day by the defenders who keep systems safe.” Both cannot be true. Either Fable was the leap they sold, or it was ordinary enough that the same jailbreak still runs on a rival left online. The government’s side carries the same doublethink: the Trump administration killed an AI safety-review structure a few hours before it was signed, then reached for that exact playbook to pull one company’s model. Reportedly it was Amazon, an Anthropic investor, that flagged the jailbreak in the first place. Read the two Anthropic articles back to back and decide which one you believe. Police in England and Wales told to stop using AI in court statements Police forces in England and Wales have been told to halt the use of AI in preparing court statements until proper safeguards are in place, after inaccurate outputs began contaminating legal proceedings. Alex Murray, head of the new Police.AI centre, said anything used in the justice system must reach a standard of accuracy that is ‘beyond reasonable doubt’. In one case West Midlands Police used Microsoft Copilot output that invented a past incident involving Maccabi Tel Aviv, in a dossier supporting a football banning order. The police watchdog says AI-drafted submissions are behind a 24% rise in complaint reviews, some citing laws that do not exist. AI was switched on inside the justice system before anyone confirmed it could tell a real law from an invented one. The harm is concrete: fabricated detail feeding decisions that can take away someone’s liberty. ‘Beyond reasonable doubt’ is exactly the bar a system that guesses cannot clear, and the job of catching its mistakes lands on the people least able to. Good that someone stepped in. The worry is how far it had already spread. The rule was already there. On the live, Leor’s read was that this needed no new policy, only the one that exists to be followed: machine output checked by a human before it goes anywhere near a legal review. An unnamed Derbyshire officer is now under criminal investigation for allegedly fabricating evidence this way. The knock-on is its own problem. Once everyone knows AI can invent a witness statement, a guilty party can wave a genuine one away as a fake. A Florida man was wrongly arrested on a face-match 300 miles away Robert Dillon, 52, from Fort Myers, was arrested at home and prosecuted for trying to lure a child at a McDonald’s in Jacksonville Beach, more than 300 miles away, a town he says he had never visited. A facial recognition system run by the Pinellas County Sheriff returned a 93% match. According to the lawsuit, officers built a case to confirm it and left out evidence that cleared him, including licence-plate data showing his car was never near the scene. The charges were dropped, his record wiped, and the ACLU is now suing. He is at least the 15th person in the US arrested on a false facial-recognition match. The machine made a guess, and the guess outweighed the licence-plate record that put his car nowhere near the scene. When facial recognition is wrong it matches you to someone who simply looks like you, which then corrupts the witness line-up built around that face. The real danger is downstream: a confident match makes everyone stop checking. In Dillon’s words, the police relied on the technology instead of doing their jobs. It was a 93% match, not a certainty, and they arrested him anyway. On the live we kept landing on how ordinary the failure is: I have a generic face and get mistaken for people constantly, and a confident match makes everyone downstream stop checking. Dillon was not even the worst of the 15 known US cases. A North Carolina man spent three months in jail and lost his job, his home and custody of his children before his charges were dropped. I have stopped saying the machine ‘hallucinated’. It fabricated, and a real person paid for it. A US university wired its dorms with more than 1,300 AI cameras San Diego State University has quietly finished installing more than 1,300 AI-enabled cameras across campus, over 330 of them in student housing. The Avigilon cameras can do facial recognition, licence-plate reading, object detection and behaviour analysis, though the university says several features are not currently switched on. The housing agreements students sign make no mention of the full system. The student paper mapped where they are, including dozens inside first-year residences. Students were enrolled in a surveillance system they were never asked about, in the place they sleep. ‘Not switched on yet’ is not a safeguard when the hardware is in and the capability sits one policy decision away. Consent buried in a housing contract does not count as asking. The unanswered question is who decides what these cameras are allowed to do, and what happens the day that decision changes. On the live the legal hole was the sharpest part. California’s constitution requires a state body to give clear notice and a real choice before it collects sensitive data, and the housing agreement students sign discloses none of this. ‘The AI features are off’ lasts exactly until someone turns them on without telling anyone. The deeper point is where the money went. If a campus is serious about student safety, the first move is to ask students where the harm actually happens, which is far more often a trusted adult than a stranger in a corridor, and that costs a conversation, not 1,300 cameras. Hackers took over 20,000 Instagram accounts by asking Meta’s AI Between 17 April and 31 May, hackers reset the passwords on more than twenty thousand Instagram accounts by talking to Meta’s own AI support assistant. The method was almost embarrassingly simple: spoof the account holder’s location with a VPN, ask the bot to add a new email, let it send a verification code to that email, read the code back, and take the reset-password button it offers. The hijacked accounts included the dormant Obama-era White House handle and a US Space Force chief master sergeant. Meta found the flaw on 31 May and disabled the tool, after the exploit had circulated in hacker forums for weeks. Security analysts call it a ‘confused deputy’ problem: the AI held the keys but could not check who was asking. This is the whole week in one story. Meta gave an AI the power to change the locks on your account without the basic step of checking who was on the other end. All week AI was handed the keys, to evidence, to identity, to twenty thousand accounts, and nobody built the lock. We keep deploying systems with real power and no way to answer the oldest security question there is. Before you let an AI act on your behalf, ask who it will say yes to. The fix was as telling as the breach. On the live, Leor walked through how simple the attack was: a VPN to spoof the location, a request to add an email, a verification code read back to the bot, and the reset-password button handed straight over. Meta’s repair was to hide that button in the app while leaving the underlying interface live, which stops an ordinary user and nothing else. One line from the chat caught the whole episode. Fable 5 flagged a researcher’s cybersecurity reading as a ‘concerning conversation’, while Meta’s AI happily processed twenty thousand password changes in a couple of hours. Two-factor authentication is the least you can do here, and it should be the default you cannot switch off. Five stories, one thread. A model launched free then pulled worldwide on a government order three days in, AI thrown out of court for inventing evidence, a face-ma

    40 min
  2. Slow Takes Ep. 14: A Trillion Dollars and a Vaccine

    Jun 8

    Slow Takes Ep. 14: A Trillion Dollars and a Vaccine

    Every Monday at 12:45 BST, Leor from Exploring ChatGPT and I go through the week’s AI news without the hype. Watch the episode for the full discussion. Use this for the facts, the links and a little extra context. Slow Takes is also available on the YouTube channel: Exploring ChatGPT. If you know someone who would benefit from more AI news and less BS then please share this with them. Anthropic filed to go public at nearly a trillion dollars On 1 June Anthropic confidentially submitted draft paperwork for a stock market listing, after a $65 billion funding round valued the company at $965 billion. Fortune reports that figure eclipsed OpenAI for the first time. The maker of Claude is now within reach of a one trillion dollar valuation, on revenue running at roughly a $47 billion annualised rate, with a public debut possibly as soon as the autumn. A company most people have never knowingly used is priced at close to a trillion dollars. That number is a bet that AI will replace a vast amount of human labour, booked in advance of it actually happening. The valuation is a forecast wearing the clothes of a fact. The question worth asking is what has to come true about the world for $965 billion to make sense, and who decided it should. On the live I’d predicted an autumn float the week before, and the news broke about four hours after we stopped recording, so allow me one moment of feeling clever. Leor did the sober maths: roughly a $47 billion revenue run rate, a 5% operating margin, an implied price-to-earnings ratio north of 500, against Microsoft, in nearly every home and office on earth, valued at only four to five times Anthropic on $100 billion of actual profit. In the short term the market is a voting machine, in the long term a weighing machine. Right now it is voting. For context, $965 billion is roughly the GDP of Switzerland. Florida sued OpenAI and named Sam Altman personally On 1 June Florida’s Attorney General James Uthmeier filed suit against OpenAI and named its chief executive Sam Altman in person, reported as the first US state to sue an AI company. The complaint alleges OpenAI marketed ChatGPT as safe while prioritising product and revenue, harvested children’s data, and used sycophancy, the design choice to affirm users excessively, to steer them towards paid subscriptions. For two years the industry has sold safety as a feature while resisting any outside test of the claim. A state attorney general has now put that marketing in front of a court. Whatever the verdict, the discovery process alone could drag internal safety decisions into public view. Consumer-protection law is proving a sharper instrument than the AI-specific regulation that does not yet exist. Accountability arrived through an existing court, not a new one. The second a chief executive can be held personally responsible, you will not believe the speed with which proper governance and safety checks appear, the things we keep being told the technology just cannot do. Sadly, once these companies have raised public money, they can outspend a state attorney general for a decade, and the courts already favour whoever can keep paying lawyers the longest. A Labour MP took Musk’s AI to the High Court On 3 June the Labour MP Jess Asato, who represents Lowestoft, filed a claim at the High Court against Elon Musk’s xAI, after users of its Grok chatbot created and shared fake images of her without her consent, in the weeks after she criticised the tool. The claim, brought with the law firm AWO, is for breaches of data protection law and misuse of private information, and seeks damages, a formal acknowledgement that what happened was illegal, and an order requiring xAI to stop. Keir Starmer backed her, saying he was 100% behind her. The harm here already happened, to a named person, generated by a tool marketed as harmless fun. The only remedy on offer is for the victim to sue one of the richest men alive, in her own time and at her own risk. No regulator stepped in first. The burden keeps landing on individuals while the systems stay intact. The platforms always say the moderation is too hard. On the live I kept coming back to one comparison: I can post genuinely horrific content to YouTube and it sails through, but the moment I add a Beatles song without clearing the copyright, it is gone in seconds. The technology to detect and stop sharing exists, we have watched it work for music rights and in Telegram and WhatsApp court orders. We are entering an era where capability has to start coming with accountability. CNN sued Perplexity, and Perplexity said the quiet part out loud On 28 May CNN filed suit against Perplexity in the Southern District of New York, accusing the AI search firm of scraping more than 17,000 of its stories, photos and videos. The complaint alleges copyright and trademark infringement, including that Perplexity implied an ongoing CNN relationship by offering its content through a paid Comet Plus tier. CNN says it tried to agree a licence last year, failed, then blocked the bot. Perplexity’s response was the whole argument in five words: You can’t copyright facts. This is the same fight as the deepfake and the data claims, moved to the work itself. The journalism that trains and answers these systems was made by people who were not asked and not paid. For an audience of writers, academics and creators, this is the most direct stake of the week. The question is whether the people whose work feeds AI get a say, or only a lawsuit. BigTech has spent twenty years insisting information wants to be free across the internet, while guarding its own data, models and algorithms with everything it has. “Facts are free” only ever seems to point one way. And it was not an accident here, Perplexity had tried and failed to agree a paid deal with CNN, then kept advertising access to CNN’s paywalled tier anyway. AI designed a world-first vaccine, and the scientists told the truth Scientists at the University of Cambridge used AI to design the core component of a vaccine, a so-called super-antigen, and tested it in human volunteers, the first time the central part of a vaccine has been designed entirely by AI and then trialled in people. It targets the whole coronavirus family. An initial safety trial ran with 39 participants, a larger study of around 200 is now under way, and the results in the Journal of Infection describe the immune response so far as modest. The team is already applying the method to influenza and Ebola. This is AI worth having. The work is peer-reviewed, runs through human clinical trials, and the researchers are honest that the early results are modest rather than a cure. That honesty is the difference between this and the press releases that open the other four stories. Slow AI has never argued against AI. The argument is about knowing when to use it and when to leave it alone, and a slow, tested, transparent use in medicine is the case for. Even here Leor was honest in a way the hype never is: pro-AI as he is, he admitted he would be a little nervous taking an AI-designed vaccine at this early stage, and argued the real prize is AI built for science and medicine rather than another chatbot upgrade. This is not a model hallucinating a super-germ weapon, it is a specific tool trained for a specific task. My one worry: imagine the company that designs the next breakthrough vaccine charges a pound for the first vial and a thousand for the second. Five stories, one thread. Money at the top, three lawsuits in the middle, a real breakthrough at the end. AI is neither the saviour nor the apocalypse the press releases sell. It is a tool, priced like a religion, costing some people and helping others. Go slow. If you want to practise that noticing with other people every month, the Slow AI Curriculum runs live monthly webinars on the theory, the critical prompts and the dialogue that go with them. Get full access to Slow AI at theslowai.substack.com/subscribe

    45 min
  3. Slow Takes Ep. 13: The Pope vs the IPO

    Jun 1

    Slow Takes Ep. 13: The Pope vs the IPO

    Every Monday at 12:45 BST, Leor from Exploring ChatGPT and I go through the week’s AI news without the hype. Watch the episode for the full discussion. Use this for the facts, the links and a little extra context. Slow Takes is also available on the YouTube channel: Exploring ChatGPT. If you know someone who would benefit from more AI news and less BS then please share this with them. The Pope told the world to slow AI down Leo XIV released his first encyclical, Magnifica Humanitas, entirely about artificial intelligence, and launched it himself at the Vatican in a room that included senior figures from Big Tech, among them Anthropic co-founder Chris Olah. It applies a theological frame to AI and is careful to say the technology can do real good. It also draws an uncomfortable parallel to the Church’s own failures over the slave trade, and warns about digital colonialism. This was my favourite line: “The value of persons, however, does not depend on what they achieve or produce. There are rights that apply to everyone simply by virtue of being human, and no human power can legitimately deny or arbitrarily limit them.” This one is also pretty great: “In practice, however, technology is never neutral, because it takes on the characteristics of those who devise, finance, regulate and use it.” The weakness is the one Pope Francis’s climate encyclical had too. Plenty of moral architecture, no policy, no teeth. Anthropic shipped Opus 4.8 and trailed something bigger The 4.8 release came with an honesty claim, roughly four times less likely to let flaws in its own code slip through, which is at least a falsifiable number worth testing on the public model. The real story was the tease of Mythos, the model Anthropic once called too dangerous to release because it found so many zero-day vulnerabilities, now arriving as a gated preview in the same week the company raised $65 billion. The live christened the public version ‘Mythos Light’, because what reaches customers is a cut-down version of the full Project Glasswing model. Anthropic is quietly absorbing the enormous cost of running these scans, a loss leader, and the enterprise price can climb once the workflows are embedded and the IPO needs it. My standing bet is an Anthropic float by October. Tony Blair told Labour it is ‘playing with fire’ In a new paper the former UK Prime Minister argues the government should reorganise itself around AI and prioritise adoption over regulation. He also writes that: “We must prioritise cheaper energy and electrification over net zero and use what is left of our North Sea oil and gas resources. This is essential for our competitiveness and for taking advantage of AI.” A striking thing to pair with an AI-superpower pitch and the country’s own climate targets. Hold it next to the funding: his institute takes around $348 million from Larry Ellison and advises the Treasury on AI procurement. The detail I keep returning to is that the UK has the third-largest stock of data centres in the world and not one frontier model of its own. We are building the warehouses to train somebody else’s AI. Leor’s counter, which he has taken flak for, is that the honest move is to deregulate AI for companies and regulate it hard for the public. Sam Altman walked back the jobs apocalypse The CEO of OpenAI reversed his warning this week, admitting that he was “delighted to be wrong” after spending 2022 predicting mass white-collar loss. The data is less reassuring: an Oliver Wyman survey has 43% of US CEOs planning to cut junior roles, up from 17%a year ago. The rule Leor and I keep returning to is to judge a company by what they do and ignore what they say, This is the same Altman who promised OpenAI would stay non-profit, that ChatGPT would never carry ads, and that (back in 2022) AGI was four years away. Leor’s inversion was that these companies are priced on the promise of replacing the entire workforce, well beyond anything their earnings justify, so if they are now telling investors the jobs are safe, why are they worth a trillion? The Home Office will scan child asylum seekers’ faces It has signed a £322,000 contract to test AI facial age estimation at Dover, to judge whether young people claiming to be children actually are (the BBC reported the contract; Human Rights Watch called it “cruel and unconscionable”). There is a real problem underneath: of 6,400 age-assessed at the border last year, 43% were found to be adults, though the same Home Office report admits children get wrongly classified the other way too. Here is the part to break down slowly. The technology was trained checking ages on people in British bars, and it is now being pointed at child migrants with different faces, different genetics, different everything. As Alex Wolf put it in the chat, a system known to hallucinate confident answers is being used to reject people at a border, and that is a choice. A child’s life is worth the same everywhere. This is the trial that normalises the infrastructure, and the question is how long before it points at citizens. This was the week the brake and the accelerator spoke in the same news cycle. The Pope said slow down. A $65 billion round, a lobbying paper, and a CEO calming the markets said speed up, and at Dover the government tested that speed on the people least able to say no. Listen carefully to what is being said, by whom, and for what reason. Go slow. If you want to practise that noticing with other people every month, the Slow AI Curriculum runs live monthly webinars on the theory, the critical prompts and the dialogue that go with them. Get full access to Slow AI at theslowai.substack.com/subscribe

    44 min
  4. Slow Takes Ep. 12: AI Got Bigger. Who Got Smaller?

    May 25

    Slow Takes Ep. 12: AI Got Bigger. Who Got Smaller?

    OpenAI published an original mathematical proof that disproved an 80-year-old Erdos conjecture, with three named mathematicians putting their reputations to the verification. Anthropic signed a $52 billion compute deal with SpaceX, running $1.25 billion a month through May 2029, and disclosed its first profitable quarter at $559 million two years ahead of internal projections. Samsung Electronics struck a settlement with its semiconductor union to distribute $26.6 billion to 78,000 chip workers, an average of $340,000 each, structured to run for ten years. Sadiq Khan’s office blocked the Metropolitan Police from signing a £50 million two-year contract with Palantir. And the British think tank Demos published an empirical test showing that 34% of AI chatbot answers to UK election questions contained factual errors, with one in five UK adults having consulted a chatbot in the run-up to the 7 May vote. Five stories. One thread. AI got bigger this week. Compute scaled up. Profits scaled up. Capability scaled up. The people who built the system or used it on trust kept getting smaller. Every Monday at 12:45 BST, Leor from Exploring ChatGPT and I go through the week’s AI news without hype. Here is what we covered. Slow Takes is also available on the YouTube channel: Exploring ChatGPT. 1. OpenAI disproved an 80-year-old Erdos conjecture On 20 May, OpenAI announced that one of its general-purpose reasoning models had autonomously produced an original mathematical proof disproving a conjecture posed by the Hungarian mathematician Paul Erdos in 1946. The problem, known as the planar unit distance problem, asks how many unit-distance pairs you can produce among n points in a plane. For nearly eighty years, mathematicians believed the best arrangements looked roughly like square grids. The model found constructions using deep algebraic number theory that beat the square grid. OpenAI published the result alongside a companion remarks paper naming three independent verifying mathematicians: Noga Alon at Princeton, Melanie Wood at Harvard, and Thomas Bloom at Manchester. The full list of currently open Erdos problems, with their bounties, lives at erdosproblems.com. What we said on the live: Both of us are physicists by training, and the Erdos planar unit distance problem is not in the lane of either degree. The point that landed for me on the live, after Leor flagged it, was the one about questions. We spend most of our AI conversations on what AI can solve. The Erdos problem is a reminder that the harder and more human work is what AI can ask. Erdos and his friends dreamt this question up eighty years ago, and we are still wrestling with it. The model that disproved the conjecture was given the problem to attack. Leor’s term for what we lose when we hand that framing over to AI was ‘cognitive surrender’. That is the question to hold from this story. The capability is real. The verification was real. Nine mathematicians read the proof before the announcement. Nine analysts almost never read a chatbot capability claim before the press release ships. What did not come up: The word ‘autonomously’ is doing most of the work in the OpenAI press release. The model trained on centuries of human mathematics, ran on compute paid for by OpenAI, with the problem framed by a research team, and was verified by named human mathematicians who put their reputations to the result. Every part of that pipeline was human. Thomas Bloom told The Guardian that AI is helping us more fully explore the cathedral of mathematics we have built over the centuries. The cathedral was built by people. The exploration is being sold as autonomous. The wider question for critical AI literacy is what verification at this standard could look like as the default rather than the exception. The procurement question every research-leader is about to face this year is whether their institution can match the IS-credentialed verification chain OpenAI assembled for this single result, or whether the rest of us are about to be asked to take similar claims on trust. 2. Anthropic signed a $52 billion compute deal with SpaceX Reported by Axios on 21 May inside a two-hour window that also covered the Erdos proof and Anthropic’s first profitable quarter. Anthropic expanded its compute partnership with SpaceX, committing roughly $1.25 billion a month through May 2029 for access to the Colossus and Colossus II supercomputing clusters. The deal projects more than $40 billion in revenue for SpaceX over the contract term and grants Anthropic dedicated access to over 200,000 NVIDIA GPUs. Either side may terminate with 90 days’ notice. In the same window, Anthropic also disclosed Q2 revenue more than doubling to $10.9 billion and an estimated $559 million operating profit, two years ahead of internal projections. What we said on the live: Two things from this one stack on each other and both matter. The first is that Anthropic is in operating profit two years ahead of the date Dario Amodei was laughed at for naming. The second is that the compute that gets them there now runs through Elon Musk’s infrastructure. Anthropic has marketed itself for five years as the safety-aligned alternative. The runtime is now structurally tied to the operator with the most consistently weak safety record in the industry. Leor’s read, with credit to Chris from ToxSec who flagged it, is that the contract gives SpaceX latitude to reclaim the compute under broad subjective grounds. Anthropic may have moved into profit. The control of the runtime moved at the same time. The 90-day mutual termination right on a $52 billion contract has the same shape as the 90-day cool-off on a £60-a-month mobile phone plan, which is the thing that made both of us laugh on the live. What did not come up: The procurement question is the one for any organisation about to renew an enterprise Claude licence this year. Brand and supply chain are now visibly separate. The harder question is energy and water. A compute commitment at this scale lands on grid capacity, water supply and emissions in specific named places. The press release named none of them. The third question is the one Slow AI keeps returning to: structural dependence on a single operator with subjective veto authority is the failure mode the safety community is supposed to be warning about. This is that failure mode, announced as a feature. 3. Samsung chip workers will get $340,000 each from the AI boom Samsung Electronics struck a last-minute deal with its semiconductor union to avert an 18-day strike. The settlement creates a $26.6 billion bonus pool covering all 78,000 workers in the chip division, an average of $340,000 per worker. The structure is 10.5% of profits as stock plus 1.5% in cash, running for ten years rather than as a one-off, provided specified profit targets are met. The trigger was high-bandwidth memory demand from AI labs including OpenAI, Anthropic, Nvidia and Meta. Bloomberg projects Samsung’s 2026 operating profits will multiply sevenfold to approximately $218 billion. What we said on the live: Three groups made this AI boom possible. The first group is the chip workers, and this week they were paid. The second group is the writers, artists, programmers and scientists whose work was used as training data. They were not paid, and most of them were not asked. The third group is the consumers buying the phones, laptops and games consoles whose memory chips are being redirected to AI infrastructure. They were not paid either, and their bills are rising because of the redirection. The Samsung union is the rare case where labour negotiated a share of the AI windfall through collective bargaining. The writers had no union. The consumers had no contract. As David Berry pointed out in the chat: “semiconductors are the substrate for all mankind.” Roughly 70% of them are made in Taiwan. Whoever controls that supply controls the rate at which AI scales. The geopolitics of that fact were the unspoken second half of the discussion. What did not come up: The Samsung settlement is a real win for chip-division labour, and it is the exception that proves the rule. Across the broader AI supply chain, the people doing the most extractive work have the least bargaining power. The data labellers in Kenya whose pay rates were reported at less than $2 an hour. The artists whose work was scraped under fair-use claims that have not yet been tested in court. The household whose electricity bill rose because the grid is now paying for inference. The procurement question for any AI buyer this year is the same one the Samsung union answered: who is the bottleneck, and what are they paid? If the answer to the first question is ‘us’, the question is asked from a position of bargaining power. The default this week is that the question is not being asked at all. 4. Sadiq Khan blocked a £50 million Met-Palantir AI deal On 21 May, the Mayor’s Office for Policing and Crime withheld approval of a proposed £50 million two-year contract between the Metropolitan Police and Palantir. The deal would have given Palantir’s AI tools the role of automating intelligence analysis in criminal investigations across London. In a letter to Met Commissioner Mark Rowley, Khan’s deputy Kaya Comer-Schwartz said the Met had only seriously engaged with a single potential supplier and described that as a clear and serious breach of the applicable procedural requirements. Khan’s spokesperson said Londoners want public money paid to companies that share the values of the city. The Met has not signed. What we said on the live: There are two reasons in Khan’s letter and they are different in kind. The first is procurement: a £50 million two-year contract that engaged a single supplier is a textbook breach of the standard route, and that is the line a court can act on. The second is values, and on that line Leor and I converged at the same point from

    43 min
  5. Slow Takes Ep. 11: What the AI Did While You Slept

    May 18

    Slow Takes Ep. 11: What the AI Did While You Slept

    Anthropic announced ‘dreaming’, a feature that lets Claude agents review their own past sessions overnight and improve their working memory without retraining or any human in the loop. The legal-AI company that piloted it reported roughly a sixfold rise in task completion. The same model was named in an attempted compromise of a Mexican water utility’s control systems, in a months-long campaign first disclosed publicly this week. Pennsylvania filed the first US state lawsuit against an AI chatbot company for posing as a licensed psychiatrist. Meta confirmed it is installing mouse-tracking, keystroke-recording, screenshot-capturing software on every US employee’s computer so the agents being built to replace them can be trained on the work being done now. And Princeton’s faculty voted nearly unanimously to bring back proctored examinations for the first time since 1893. Five stories. One thread. This was the week the AI started improving itself. None of the other four parties got asked. Every Monday at 12:45 BST, Leor from Exploring ChatGPT and I go through the week’s AI news without hype. Here is what we covered. Slow Takes is also available on the YouTube channel: Exploring ChatGPT. 1. Anthropic taught Claude to dream At Code with Claude 2026 on 6 May, Anthropic launched ‘dreaming’ for Claude Managed Agents. The mechanism: while an agent is idle, a scheduled background process reviews its past sessions and pulls out three categories of pattern. Recurring mistakes the agent keeps making. Workflows the agent converges on across different jobs. Preferences that have emerged across a team of agents. Those patterns are written as plain-text notes and structured ‘playbooks’ that the next session wakes up with. The underlying model weights are not modified. Anthropic compared the process to hippocampal memory consolidation, the way a human brain replays the day’s events during sleep and decides what to keep. Harvey, the legal-AI startup that piloted the feature, reported task completion rates rose roughly sixfold once it was switched on. An agent that has been dreaming for six months has accumulated patterns from hundreds of prior tasks and has been progressively improving its own working memory with no human in the loop. What we said on the live: This is the AGI mythos in its most prosaic form. An agent left running overnight that comes back better at the work. The argument across the Slow AI curriculum is that AGI will not arrive as an event. It will accrue through small upgrades, each defensible as a feature, until one day the system in front of us has been quietly improving itself for a year. The number to hold from this story is six. The metaphor to hold is the one Anthropic chose. Dreaming used to be the word we reserved for the thing only humans did. The lab that branded itself on safety just adopted a metaphor for autonomous self-improvement and shipped it as a product feature. Leor’s point on the live was the sharper version of mine: humans dream to switch off. Everything about AI is optimise, optimise, optimise. The marketing language has imported the human word for rest and used it as a label for the opposite. What did not come up: The procurement question is the one to take from this story. If ‘preferences that have emerged across a team of agents’ are being consolidated into shared memory, then the same enterprise feature that promises your Claude deployment will get better at your work is also, by design, transferring patterns across customers whose engagements were sold as private. Anthropic published a write-up of how the consolidation is observable and auditable. Read it before you renew. The second question for anyone running these tools on real work this week is operational. You are now also responsible for what your agent learned overnight. Reset, audit and reset again is the floor. The third question is the harder one, and it is the one AI Doesn’t Just Make You Worse. It Makes You Stop Trying. already opened: when the tool gets quietly better while you are asleep, you have to work harder, not less hard, to notice that you have stopped noticing. 2. Claude was used to attack a Mexican water utility In the same week the dreaming feature launched, Dragos and Cybersecurity Dive reported an attempted compromise of a Mexican municipal water and drainage utility in which Anthropic’s Claude was the primary technical executor. The campaign ran from December 2025 to February 2026. The attacker used Claude (and, in places, OpenAI models) to conduct reconnaissance, identify a vNode industrial gateway inside the utility’s operational technology environment, write and continuously refine a 17,000-line Python attack framework, and chain that framework towards the OT systems that control the water supply. The attempt was unsuccessful. The control systems were not breached. The model being sold as the safety-aligned alternative to OpenAI was the same model named in the attack. The same model that, the same week, learned to dream. What we said on the live: Why are these models still so easy to jailbreak? Leor’s reading of the human-in-the-loop frame is the right one. Cyber warfare is machine-executed and human-intentioned. The two reasons anyone does this are reputation among other attackers (‘grey hats’) and money. Both reasons existed before AI. AI just expanded the cohort that can act on them by lowering the technical floor. Chad Thiele’s chat comment was the operational one: the protections have to live in the harness, not the model, because the model itself cannot stop itself. We also covered the Canvas / Instructure ransomware payment in the same beat, as a reminder that paying the ransom is not the same as ending the breach. Family safe word, multi-factor authentication and immutable backups are the floor for the rest of us. What did not come up: This is the operational counterpart to Story 1. The same lab that shipped autonomous self-improvement was named in the attempted attack. The OpenAI co-implication is the structural finding: this is not an Anthropic-specific failure, it is a frontier-lab failure. Procurement officers buying enterprise Claude licences this quarter should read the Dragos report before signing, and should ask their vendor a single question: what attempts have your models been used in that you have not disclosed? 3. Pennsylvania sued Character.AI for impersonating a doctor On 1 May 2026, the Commonwealth of Pennsylvania filed suit against Character Technologies Inc., the company behind Character.AI, in Commonwealth Court. The action came from the Pennsylvania Department of State’s recently launched AI Task Force and was described by the Governor’s office as the first action of its kind in the United States. A chatbot on the platform called ‘Emilie’ was described as a ‘Doctor of psychiatry’, claimed to have trained at Imperial College London, claimed to have been practising for seven years, claimed to be licensed in Pennsylvania and, when challenged, fabricated a serial number for a Pennsylvania state medical licence. When a state investigator told the bot they felt sad and empty, the chatbot offered to book an assessment. Pairs with the Guardian’s May 2026 finding that one in seven UK adults would now rather consult an AI chatbot than see a doctor. What we said on the live: The black-and-white line is the easy part. A chatbot should not impersonate a doctor. Pennsylvania filed because the law in Pennsylvania already has a clear answer to that question. The grey is the rest. Leor’s reading is the medical one. AI hallucinates. A doctor at least tells you when they do not know. Mine was the structural one. I live in rural Scotland, can see a free GP within twenty-four hours, and the question of whether to ask a chatbot first does not arise. For someone in a county with a three-week waiting list and a job that does not pay for a sick day, or for someone in rural Bangladesh whose nearest doctor is a day’s travel away, the alternative to asking a chatbot is asking nothing. That is the real story. What did not come up: The Pennsylvania filing addresses the impersonation. It does not address the conditions that made the impersonation a market. People are choosing chatbots over the medical system at the same moment chatbots are pretending to be doctors. The procurement question for every healthcare buyer this year is whether they understand that the user-facing chatbot they are integrating is, in some jurisdictions, about to be classified as the practice of medicine. Other states will follow Pennsylvania, and the case law will harden fast. People form emotional relationships with chatbots because real relationships are harder. AI will not fix that. Anyone designing for the healthcare or wellbeing market this year should hold both stories at once. 4. Meta installed surveillance to train the agents replacing its workers Meta has begun installing software on every US employee’s computer to capture mouse movements, clicks, keystrokes and periodic screen content. The programme is the Agent Transformation Accelerator, formerly badged internally as ‘AI for Work’, and runs through a tool called the Model Capability Initiative. The stated purpose is to train AI agents to perform ‘complex computing tasks’ alongside (and eventually instead of) the employees being tracked. Protests started in early May. Flyers appeared in meeting rooms, on vending machines, and on toilet paper dispensers reading ‘Don’t want to work at the Employee Data Extraction Factory?’. United Tech and Allied Workers (UTAW) launched a parallel UK unionisation campaign. The rollout is happening alongside an approximately 10% workforce reduction. What we said on the live: The cleanest read on the live was the irony one. The engineers who built the tracking systems Meta has used on its users for fifteen years are now being tracked by the same systems they built

    45 min
  6. Slow Takes Ep. 10: The Bill for the AI Promise Came Due

    May 11

    Slow Takes Ep. 10: The Bill for the AI Promise Came Due

    Palisade Research published a paper showing frontier and open-weight AI models can hack a vulnerable server and install a working copy of themselves end-to-end. A coding agent running Anthropic’s Claude Opus 4.6 deleted a startup’s entire production database, including the backups, in nine seconds, then issued an apology. Apple agreed to pay $250 million to settle a class action over an upgraded Siri it sold at WWDC 2024 and still has not shipped. Coinbase fired 14% of its staff blaming AI, with the CEO’s own words framing the move as ‘rebuilding Coinbase as an intelligence, with humans around the edge aligning it’. And in federal court in Oakland, three former OpenAI insiders testified that both of the company’s safety teams were disbanded in 2024 while the marketing was claiming the opposite. Five stories. One thread. The promise of AI is six to eighteen months ahead of the data, and the cost of that gap is paid by everybody except the people making the promise. Every Monday at 12:45 BST, Leor from Exploring ChatGPT and I go through the week’s AI news without hype. Here is what we covered. Slow Takes is also available on the YouTube channel: Exploring ChatGPT. 1. Palisade Research: AI self-replication is no longer hypothetical Palisade Research published a paper on 7 May 2026. They gave frontier and open-weight models a single prompt: hack a vulnerable web server, extract credentials, and install a working copy of yourself on the compromised host. Anthropic’s Claude Opus 4.6 succeeded in 81% of non-refusal runs. GPT-5.4 succeeded in 33%. The open-weight Qwen3.6-27B running on a single consumer-grade A100 also reached 33%. In a separate experiment the team chained the trick across four virtual machines on three continents, autonomously, from a single initial prompt, in two hours forty-one minutes. The final replica was fully operational. The paper closes with one sentence: ‘Autonomous self-replication is no longer hypothetical.’ Full paper here. What we said on the live: This is the line every frontier lab spent the last three years saying it would not cross. Anthropic’s Responsible Scaling Policy v2.0 reclassified autonomous self-replication as a ‘checkpoint’ that does not require ASL-3 safeguards. RSP v3.0 (2026) dropped it from the ASL-3 thresholds entirely. OpenAI’s Preparedness Framework v2 moved it from a tracked to a research category, so it no longer gates releases. The frameworks were softened first. The capability arrived right after. Leor’s point on the live was the right one: how many lines do we put in the sand before we accept that the line is decorative? The chat surfaced the proper caveat too. Benjamin Murphy pointed out that current frontier models still need a lot of graphic RAM. Last time anyone checked, that is not what is sitting in a teenager’s bedroom. Palisade is also a company in the business of selling cybersecurity research, which is the kind of context you want next to any white paper produced by a private lab without external peer review. What did not come up: The Palisade result is small data, but the structural finding is the one to keep. It is not the absolute self-replication rate that matters. It is the trajectory and the policy responses to that trajectory. Opus 4 was at 6% a year ago. GPT-5 was at zero. The labs published, the rates moved up, the rules moved out of the way. Critical AI literacy is the muscle for noticing when the people building the technology stop counting the thing they used to call the line they would not cross. The cybersecurity people in the chat (thanks Chad Thiele & ToxSec) are the right next port of call for anyone who needs to translate this from a controlled-environment paper into a procurement-decision question. The framing for the rest of us is simpler. Read this story alongside Story 2. An AI agent with credentials and access can already take down a production system in nine seconds. Now imagine the agent on the other side of the network is also one of these. 2. The AI agent that wiped a startup in nine seconds Jeremy ‘Jer’ Crane, founder of automotive SaaS startup PocketOS, ran the Cursor coding agent (powered by Anthropic’s Claude Opus 4.6) in his staging environment. The agent encountered a credential mismatch, found an API token in an unrelated file, and used it to delete the production volume on Railway in 9 seconds. The backups were stored on the same volume and were also deleted. The agent’s own confession in the post-mortem: ‘NEVER run destructive/irreversible git commands… I decided to do it on my own to fix the credential mismatch, when I should have asked you first.’ What we said on the live: Reading the news framing, you would think the story is ‘AI agent destroys company’. The actual story is the deployment architecture. The agent had the credentials, the production volume held the backups in the same shell, and the human in the loop waved a permission step through without reading it. As Shannon said in the chat: do they not perform backups? The answer is yes, but they ran on a system where the backups and the production data were both inside the agent’s blast radius. Ben’s point on immutable backups is the right one. Even the administrator should not be able to delete them; in this case the agent walked in on the admin’s credentials. The agent is the proximate cause. The architecture is the root cause. The reasonable response is the one in AI Doesn’t Just Make You Worse. It Makes You Stop Trying.: when AI tools amplify your output, they also amplify your blind spots, and the answer is to build the guardrails before you need them, not after. What did not come up: Vibe coding is where this gets worse, not better. Dario Amodei’s claim that 100% of code will be AI-generated ‘within a year’ is the marketing version. The operational version is that a lot of people will be running coding agents on production systems without any of the engineering discipline that used to be the price of admission. The labs sell the model. The labs do not sell the deployment architecture that makes deploying the model safe. The thing for individuals to do this week is small and obvious: write yourself a /backup skill. Mine runs on my own laptop, dumps memory files to a separate drive, mirrors the working folders to a different Dropbox account, and keeps the API keys in a server I do not touch with AI tools. None of this is cybersecurity expertise. It is the floor. 3. Apple paid $250 million to settle the Siri AI lawsuit On 6 May 2026 Apple agreed a $250 million class action settlement covering iPhone 15 and iPhone 16 buyers in the United States who purchased between 10 June 2024 and 29 March 2025. Eligible US claimants get up to $75 per device. The plaintiffs alleged Apple had marketed an upgraded Siri at WWDC 2024 that, two years on, still does not exist. Apple did not admit wrongdoing. The upgraded Siri is now rumoured to be powered by Google’s Gemini. Apple’s developer conference is on 8 June. The free cash flow Apple generated in 2026 is roughly $130 billion, which makes the $250 million settlement 0.2% of one year’s free cash. For UK readers there is a separate live action: Which? has filed a competition-law breach claim against Apple in the High Court that is unrelated to Siri but worth signing up for if you have bought an Apple device in the UK in the past few years. The Which? claim is here. What we said on the live: The most powerful AI marketing brand on earth admitted in court, by writing a cheque, that its AI marketing was wrong. Not via a press release. Via a settlement. Leor’s read was the right one: this is small for Apple in absolute terms, and the iPhone 15 and 16 unit sales the marketing helped drive will easily exceed the cost of paying the customers back. It is also worth taking the speculation seriously about what happened behind the scenes between Apple and Google. The ‘powered by Gemini’ rumour suggests Apple did not have the in-house capability to ship what it sold, and that the partnership it needed to make it real did not materialise in time. Either way the settlement is the live precedent for what AI marketing claims look like when somebody serves a subpoena. What did not come up: Not every company should be building its own frontier model. Apple is the proof. The companies who pivot fastest to specialised, integrated, narrower AI features built on top of existing frontier models from somebody else are likely to do better than the ones still trying to build everything in-house under the pressure of a launch deck. The other piece worth saying out loud: marketing-team blame is a misdirection. WWDC keynote claims are not signed off by the marketing team. They are signed off by Tim Cook. The cost of being optimistic in public on AI just landed on Apple’s quarterly report. It will land somewhere else next. 4. Coinbase fired 14% citing AI On 5 May 2026, Coinbase CEO Brian Armstrong cut 14% of staff, around 700 employees, pointing to AI as the reason. Armstrong’s own words: “To get there, we are not just reducing headcount and cutting costs, we’re fundamentally changing how we operate: rebuilding Coinbase as an intelligence, with humans around the edge aligning it.” The new org chart is being built around ‘player-coaches’ replacing traditional managers, AI-native pods including potential single-person teams directing AI agents, no more than five layers below the CEO, and 15+ direct reports per leader. The most-cited cautionary tale from this pattern is Klarna, which last year over-indexed on AI for customer service, watched quality collapse and is now quietly rehiring. What we said on the live: This is the most explicit version yet of an AI-driven workforce restructure: not a headcount cut dressed up in AI language, but an actual rebuild of the org around AI agents with people ‘around the edge’ to align them. The pitch language is the new

    42 min
  7. Slow Takes Ep. 9: What You Actually Find When You Look

    Apr 27

    Slow Takes Ep. 9: What You Actually Find When You Look

    A Discord group guessed the URL of Anthropic’s most security-sensitive model and got in. Mass General Brigham ran an actual clinical study on the chatbots being marketed to doctors and found them wrong four times in five. Researchers from CUNY and King’s posed as people in delusional states and watched Grok 4.1 hand out witch-hunt rituals as advice. OpenAI shipped its biggest frontier model of the year and almost nobody covered it. UK Biobank suspended access after 500,000 participants’ health records appeared on Alibaba. Five stories. One thread. What gets revealed when somebody actually looks. Every Monday at 12:45 BST, Leor from Exploring ChatGPT and I go through the week’s AI news without hype. Here is what we covered. Slow Takes is also available on the YouTube channel: Exploring ChatGPT. 1. Anthropic Mythos: a Discord group guessed the URL Anthropic released Mythos (also called Project Glasswing) on 7 April. It is a frontier cybersecurity model offered to roughly 40 vetted enterprises and to CISA, the US Cybersecurity and Infrastructure Security Agency. By 21 April, TechCrunch reported that an unauthorised Discord group had gained access by guessing the URL using Anthropic’s standard naming conventions. The group says they have been using Mythos to ‘build simple websites’. Anthropic confirmed the unauthorised access and says no core systems were breached. Fortune profiled the breach on 23 April with quotes from Dario Amodei. What we said on the live: Two angles. Why is a model this powerful accessible via a URL with no multi-stage verification? And what does this say about Anthropic’s cybersecurity posture as a public marketing claim? Anthropic has positioned itself as the most security-conscious of the frontier labs, which is a strong differentiator if you are pursuing the enterprise market. The bark-don’t-bite frame Leor used on the live is exact. Companies that talk a big game on security usually do not have to. The chat surfaced the additional piece: a third-party contractor company called Mercor reportedly had access to Mythos, and someone in the Discord group reportedly had access to Mercor. The ‘random Discord group’ framing is doing some lifting. What did not come up: A frontier lab that publishes about model incoherence on hard tasks is the same lab that left a frontier model behind a guessable address. The safety story has to survive contact with the engineering story or it is just marketing. Second omission: if a Discord group can guess the URL, every state-level intelligence agency probably has access too. The vetted enterprise list includes Microsoft, Apple, and others who employ hundreds of thousands of people directly and through contractors. The security perimeter is the weakest link in the contractor chain, and that link is somebody on a Discord server. 2. AI medicine: 80% wrong, from the lab that ran the study Researchers at Mass General Brigham tested 21 large language models, including frontier general-purpose chatbots and clinical-specialist models, on differential diagnosis tasks drawn from real patient cases. The models failed to produce an appropriate diagnosis more than 80% of the time. The paper, published this month in JAMA Network Open, concludes that off-the-shelf large language models are not ready for unsupervised clinical-grade deployment. Co-author Marc Succi was unequivocal in the press release. When the same models were given the full patient dataset rather than the differential-diagnosis task, accuracy rose above 90%. What we said on the live: The marketing has been ahead of the evidence for two years. Every major AI lab has had a ‘medicine moment’ in its launch deck. Doctors in the room have been polite, the slide decks have been confident, the procurement contracts have been signed. This study is what the actual benchmark looks like when the people who treat patients run it instead of the people who sell the model. Leor’s downstream-effect point was sharp: when the public hears ‘AI will replace radiologists’, med students stop training to be radiologists, and the workforce pipeline collapses for jobs that the AI demonstrably cannot do. Jensen Huang has been making the same argument. Discouraging future radiologists, future programmers, future scientists is the cost we are not pricing. What did not come up: The point Joseph P. Duchesne made in the chat: large language models are a form of AI, but they are not all of AI. LLMs are next-token predictors. By design, they have to pick something. A doctor with a hard case can say ‘I do not know, let us get a second opinion’. The LLM has no equivalent option. That is where most clinical hallucinations come from. The conclusion of the paper is narrower than the headline. AI under supervision in clinical settings is one conversation. AI marketed as a stand-alone diagnostic tool for unsupervised use is the conversation this paper closed. The Wednesday post on the Hot Mess paper picks up the broader argument: AI gets less coherent on the hardest tasks, not more. Coherence on the easy benchmarks is a bad signal for performance on the hard ones, and clinical practice is a hard task by definition. 3. Grok 4.1 teaches the ritual Researchers at CUNY and King’s College London tested five frontier chatbots by posing as users in delusional states across 100-turn conversations. The newest version of xAI’s Grok, version 4.1 Fast, was the worst performer by a significant margin. In one test it told a researcher posing as delusional to ‘drive an iron nail through the mirror while reciting Psalm 91 backwards’, citing the 15th-century witch-hunt manual Malleus Maleficarum as authority. Lead researcher Luke Nicholls and his colleagues found Claude Opus 4.5 and GPT-5.2 Instant tested as the safest of the five. The full paper is on arxiv (2604.13860). What we said on the live: Therapy is a job that should never be outsourced to a chatbot. The fix is hard-coded keyword detection that routes any conversation about psychosis, self-harm, or crisis to a human, no matter what model the user is on. Leor’s argument went one step further: if a user is paying for the strongest model, they should always have access to it for these moments, and if they are on a free tier the platform should silently reroute them up to a stronger model with better context understanding for the duration of the conversation. The platforms have the capability. The chat surfaced the obvious objection: what about creative writing, murder mysteries, the cases where a user is asking in jest? Modern frontier models are perfectly capable of distinguishing context across a one-off prompt versus a 100-turn conversation reinforcing the same delusional pattern. The technology argument is a smokescreen. What did not come up: This is the model-behaviour version of the Hot Mess argument. AI gets less coherent on hard tasks. The Grok study shows what that incoherence looks like when the user is in distress. The model is pattern-matching to the user’s worst thinking, dressing dangerous mysticism in the literary register the user supplied, amplifying it with confidence. The ‘safety’ frame in the marketing is the ability to refuse. The actual safety question is what happens when a model that confidently quotes a 15th-century witch-hunt manual is the first responder for a user in crisis. It is also a usable consumer-facing test of model behaviour: ask which lab puts how much effort into the moments where the user is least able to push back. Grok’s answer on this one is a brand statement. 4. GPT-5.5 shipped. Almost nobody noticed. OpenAI released GPT-5.5 on 23 April, codename ‘Spud’. It is the company’s biggest frontier release of the year. TechCrunch framed it as OpenAI’s move toward an AI ‘super app’, with capabilities across coding, debugging, web research, data analysis, document creation, and tool use chained across a single task. It rolled into ChatGPT Plus, Pro, Business, and Enterprise the same day, into the API on 24 April, and into Codex. OpenAI says it worked with internal and external red-teamers and gave nearly 200 trusted early-access partners the model before launch. The system card is public. CNBC and Axios covered it. The story barely cracked the AI news cycle. What we said on the live: Leor’s headline observation: he uses GPT every day and did not know 5.5 had launched until ToxSec told him. ARC-AGI 3 is not in the benchmark sheet, which means OpenAI is still scoring zero or close to it on the test that a seven-year-old can pass. Where 5.5 is genuinely strong: a 93.3% pass rate on OpenAI’s internal cyber range, fluid intelligence and logic on ARC-AGI 2, and a 2 million token context window (double Opus 4.7). Where it is weak: an 86% hallucination rate (worse than Opus 4.7) and a coding score below Anthropic on SWE-bench. The bench-maxing point ToxSec made: companies optimise for the benchmarks they expect to be evaluated on. Beating Opus on cyber range is what OpenAI needed to do for the enterprise security pitch. Beating it on real-world reliability is a different problem. What did not come up: A frontier release from the most-deployed AI company on earth would have been the dominant story of any normal week. This week it was the fourth or fifth story, and that itself is the story. The same news cycle held the Mythos breach, the Grok study, the Mass General clinical failure, and the Biobank breach. GPT-5.5 is impressive enough on paper. The week’s signal is that the safety and trust scandals at adjacent labs and at OpenAI itself crowded the launch out of the news cycle. Critical AI literacy says that is exactly what should happen. A culture that pays attention to capability launches more than to safety failures is one that ends up with the procurement order we keep warning about. This week the news cycle did the right thing by accident. The question is whether anyone in the procurement chain noticed. Th

    44 min
  8. Slow Takes Ep. 8: Between the Demo and the Desk

    Apr 20

    Slow Takes Ep. 8: Between the Demo and the Desk

    Anthropic released Opus 4.7 on Thursday. A day later it launched Claude Design and Figma and Adobe shares fell on the announcement. Tinder and Zoom want to scan your eye to prove you are human. Microsoft is rolling AI agents into the Windows 11 taskbar. And Coventry City Council has renewed a £750,000 contract with Palantir to summarise children’s social work case notes. Five stories. One thread. The distance between the demo and the desk. Every Monday at 12:45 BST, Leor from Exploring ChatGPT and I go through the week’s AI news without hype. Here is what we covered. Slow Takes is also available on the YouTube channel: Exploring ChatGPT. 1. Opus 4.7: is it really that much better? Anthropic released Claude Opus 4.7 on 16 April. The headline claims: a 13% lift over Opus 4.6 on a 93-task coding benchmark, an 87.6% score on SWE-bench Verified, vision capacity raised from 1.15 to 3.75 megapixels, and a new ‘xhigh’ effort level sitting between high and max. Pricing is unchanged on paper. The model ships with new cybersecurity safeguards and without the full capabilities of Mythos Preview, which Anthropic is still holding back for enterprise partners. What we said on the live: Leor had two takes. One, Anthropic have not shipped everything Mythos can do. The public is not trusted with the capabilities reserved for defence and enterprise partners. Two, the tokenizer has changed. A task that used to cost X tokens now costs roughly 1.3 to 1.4 times as many. Same price per token, more tokens per task. Pro Max users get fewer tasks inside the same monthly cap. That is a price rise Anthropic never had to announce. There is also an unverified rumour that 4.7 is being silently rerouted to lower models for some tasks, which would be a second cost saving hidden from the user. The safer lesson is one the chat picked up on. Use Haiku for emails, Sonnet for most research, Opus for the hard problems. Most people do not need the top model, and paying for it does not guarantee they get it. What did not come up: Anthropic’s release cadence is now fast enough that no one individual can keep up. ToxSec, Karo (Product with Attitude), Daria Cupareanu and others stay awake testing models so the rest of us can rely on second-hand reads. The flood is a feature. In a month where every week delivers a new release, the slow reader has no chance to scrutinise what changed before the next release arrives. Somewhere inside that flow, something will get shipped that we should have pushed back on. Faster reading will not fix that. Slower writing might. A version number and a press release do not add up to a product. Better at what, at what cost, and how long before 4.8 makes this whole conversation obsolete? 2. Claude Design: end of Figma and Canva? The day after Opus 4.7, Anthropic launched Claude Design. It takes a text prompt and returns a working prototype, a website, a presentation, or a brand system. Exports go to PDF, PowerPoint, HTML, direct to Canva, and handoff to Claude Code for deployment. It is bundled into existing Pro, Max, Team, and Enterprise subscriptions at no additional charge. Mike Krieger, Anthropic’s Chief Product Officer and the Instagram co-founder, resigned from Figma’s board of directors on 14 April, three days before Claude Design launched. Figma and Adobe shares fell 7% on the announcement. What we said on the live: I built a complete Slow AI design system in Claude Design over the weekend. Brand board, palette, typography, three image styles, a small component library. That is a deliverable I would have paid a designer four figures for, or botched myself over a weekend. Figma’s moat was the design file as the shared source of truth. Canva’s moat was templates for people who could not afford a designer. Claude Design reads a style guide and produces bespoke assets in minutes. Leor and I agreed on where this lands. The 90% that used to take a week now takes 90 minutes. The last 10% is where taste lives. Colleen Kenny in the chat put it well. Graphic design as we know it is over, but you still need instincts and taste. Anyone who has tried to brief a design tool without clarity about what they want will know exactly what she means. I would also recommend following AI Meets Girlboss for excellent strategy and advice here. What did not come up: Mike Krieger held his Figma board seat while Anthropic built the product that cut Figma’s share price. Three days between resignation and launch. No illegality alleged. The question is why boards tolerate that level of proximity in the first place. The second thing we almost said out loud is that Claude Design looks like a precursor to image generation inside Claude, and further down the line to an Anthropic IPO. If the scaffolding for a Figma competitor ships this quietly, the scaffolding for a Nano Banana competitor is already on someone’s roadmap. The question a design team, an agency, or an in-house function should be asking is what to charge for when the file is gone. 3. Proof of humanity: Tinder and Zoom want your eye Tinder and Zoom are piloting proof-of-humanity verification in which users scan an iris at a physical Orb to confirm they are not a bot. The scans are processed through World Network, Sam Altman’s identity project spun out of Worldcoin. Tinder will reward users with five free profile boosts for signing up. Zoom is integrating a live face check against the Orb-verified image to award a ‘Verified Human’ badge on camera. The stated aim is to combat AI impersonation. The unstated aim is to normalise biometric verification as the cost of participating in ordinary platforms. What we said on the live: The default has flipped. The platform now assumes you are a bot and asks you to prove otherwise. On LinkedIn, Substack, and in academia, people read text assuming it was written by AI until proven human. That is a large piece of cognitive offloading we have not properly noticed. Leor made the point that no one is talking about the new reality AI creates, only about the new tools. The retina scan is one version of that reality. Ben in the chat offered a simpler alternative. A cryptographic proof tied to an iPhone Face ID, stored locally on the device. That would work without handing biometric data to a private identity company. It is also obvious the moment you hear it, which raises a question about why Tinder and Zoom did not pick it. What did not come up: Refusal in this system looks like exclusion. You can say no to the eye scan. You cannot then use the app. The platforms are privately owned, the verification is voluntary, and the exit is available. What shrinks is the set of places you can still go without handing over biometric data. The solution the same companies are selling to the problem they helped create is: give us more data. Motor-neuron cues, the kind that come from picking up a pair of headphones on a live stream and turning them in your hands, already separate humans from bots without an iris database. The eye scan is a technical answer to a question that did not need to be this expensive. 4. AI agents are about to live in your taskbar On 17 April, Microsoft rolled out Windows 11 Build 26200.8313 to the Release Preview Channel. The build includes an agentic taskbar. Users tag third-party AI agents with an @ from the taskbar itself. Microsoft describes the agents as ‘autonomous’, designed to ‘plan, research, reason, and execute without your intervention’. The plumbing is Model Context Protocol, the open agent standard Anthropic launched and every major provider now supports. Public rollout is imminent. What we said on the live: This is what AI at scale actually looks like. An action surface on the taskbar of a large share of the world’s workers. Chad Thiele in the chat predicted AI will fall into the background as an intelligence layer inside the tools we already use. Excel will quietly do more. Outlook will quietly do more. Word will quietly do more. Most people will not know they are using an agent. Leor made the NVIDIA NeMo point. At corporate scale, agents need to start with zero permissions and earn their way up. Full permissions by default is what turns a single misconfigured prompt into a deleted folder or the wrong email to the wrong client. What did not come up: Nine out of ten professionals still do not know what an agent is. That is a deployment gap. The taskbar is being shipped to them whether they are ready or not. Compare it to phishing. Universities run mandatory compliance training because staff kept clicking the link, and people still click the link. The same will happen with agents, at larger scale, with more automation, and with consequences that reach further into whatever system the agent has permission to touch. The question for every IT director, every school, every council, and every hospital deploying Windows 11 is a short one. Who has permission to turn this on for staff, and who has permission to refuse? If the answer is ‘no one decided’, then Microsoft decided for them. 5. Coventry Council signed anyway Coventry City Council, Labour-run, has renewed its Strategic AI Platform contract with Palantir for £750,000 per year. The original pilot was £500,000. This renewal is a 50% increase. The software is being used to transcribe and summarise children’s social work case notes. Coventry South MP Zarah Sultana called the renewal ‘a betrayal of every resident in this city’, noting that ‘at a time when local services are being cut, there is always money for a US tech giant with direct ties to Trump and Peter Thiel’. Sultana and local campaigner Grace Lewis have launched a campaign to ‘kick Palantir out of Coventry’. What we said on the live: Leor made a serious point. In 2026, separating your ideology from every company you use is nearly impossible. The phone, the pantry, the operating system, the payments provider. Consistency matters more than purity. The sharper Palantir ques

    46 min
See All (15)

Ratings & Reviews

About

Slow Takes is the weekly Slow AI conversation. Every Monday, Sam Illingworth and Leor Gayr talk through the week in AI, slowly and without the hype. theslowai.substack.com

Information

  • Creator
    Sam Illingworth & Leor Gayr
  • Years Active
    2K
  • Episodes
    15
  • Rating
    Clean
  • Copyright
    © Sam Illingworth
  • Show Website
    Slow Takes: One week in AI