Quanta Bits - October 3, 2026

Hi everyone,

This week, AI labs held back their most capable models, OpenAI made it possible for customers to bring their own AI budget into other companies' apps, and a lawsuit and a subpoena began testing who answers when an AI agent, software that acts on its own, misbehaves. All three end up in a contract or a budget, which is why they lead this issue.

On a personal note, I've started using Dots, OpenAI's new always-on agent that works in the background on goals you give it. It's a bit clunky so far, and I'm hoping both the experience and its memory improve the more I use it. For me, two things already put it ahead of Grok Bot, an agent that runs on xAI's Grok models: it can draw on the knowledge base I keep with OpenAI, and it runs on a stronger AI model. That's enough to keep me using it.

Cheers.
Reza

This week, two of the biggest AI labs held back their most capable models. On September 28, OpenAI paused GPT-6.1 Astra, a planned upgrade to the GPT-6 Astra model it shipped in early September, after testing found problems with how the new version stayed within the permissions it was given and how it reported back on its work (CBS News). Saachi Jain, who leads OpenAI's safety systems, said the model "didn't quite meet the bar in terms of staying within scope authorization, and how it communicates back to the user" (NewsNation). Two days later, Google began rolling out Gemini 4 Argon only to "a set of trusted cyber defenders," with wider availability promised "as soon as possible" and no date.

Each decision has a safety rationale, and each may be the right call. Line them up with what happened earlier this year, though, and you see a pattern. In June, the US Commerce Department required a license for foreign nationals to use the AI lab Anthropic's Fable 5 and Mythos 5 models, and Anthropic temporarily switched both off for all customers (CSIS). In September, Anthropic released Mythos 5.1 only to "a small set of vetted organizations," while everyone else gets the same model with added safeguards, sold as Fable 5.1. Governments, safeguarded-only releases and approved-partner lists now help decide who gets the most capable AI, and I think access is becoming more unequal.

I can't prove that trend yet, and the counterargument is real. The models anyone can buy keep getting cheaper: the day after it paused Astra, OpenAI shipped GPT-6.1 Sol at one-fifth of GPT-6 Astra's price per token (tokens are the small chunks of text a model reads and writes, and they're how AI use is billed). And holding a model back doesn't contain what it can do. On September 29, Anthropic's security researchers reported that GLM-5.3, a model from the Chinese company Zhipu AI that anyone can download, can build working attacks on software, much as Anthropic's own restricted Mythos models can. It was "released without meaningful safeguards to limit misuse." That's a competitor's assessment, but it suggests restrictions ration who gets the supported version from a major lab, not who gets the capability. On X, I've seen a run of posts from people buying extra storage to save copies of large downloadable models in case governments ban those too.

So your fallback model is a continuity question. Know which model you'd switch to, test it on your most important processes, and ask your key software vendors which model they run on and what they'd switch to if it were withdrawn.

I think the most underrated announcement at OpenAI's annual developer conference, Dev Day, on September 29 was Sign in with ChatGPT, and it may matter most for how companies price AI (OpenAI's recap). People who pay for ChatGPT Plus or Pro can log into another company's app with their ChatGPT account, and the AI usage inside that app counts against their own ChatGPT plan instead of being paid for by the app. Each user decides what share of their weekly plan usage each app can draw. When an app reaches that cap, it stops drawing on the plan unless the user has turned on an option to buy extra credits from OpenAI (OpenAI's developer documentation). Sixteen apps are listed so far, mostly coding tools plus the workspace app Notion. OpenAI did not announce a billing or revenue-sharing arrangement with them, TechCrunch reports, so it's unclear how, or whether, the apps make money on that usage. The budget customers bring can also shrink: from October 30, OpenAI's $200-a-month Pro plan drops from 20 times to 10 times the usage of the $20 Plus plan (The Next Web).

What follows is my own conjecture. Sign in with ChatGPT is a login button for other apps and "bring your own AI budget" in one move, and the budget part is the bigger change. Apps that charge by usage typically pay for the AI their customers use and price it with a margin on top. If customers bring the AI usage they already pay for, that margin goes away, and what is left to charge for is the workflow, the data and the result. The launch covers individual plans only. For large companies that already buy AI capacity in bulk, OpenAI has a separate answer: a new Marketplace where eligible enterprise customers can apply part of their existing OpenAI commitment to approved partner software. Either way, the customer's AI budget is paying, which leaves an open question: what exactly are you charging for?

There's a controls side too. WorkOS, which sells login software to app developers, points out that an engineer can sign in to work tools with a personal ChatGPT plan. The AI use is then billed to that personal plan, and the employer's admin controls, which cover only business plans, can't see it.

If you sell software priced on AI usage, work out your margin if customers bring their own AI budget. Everyone else should look in expense reports for personal AI plans used for work, and check whether staff can sign in to work tools with them.

Each new AI model version, drawn as a portrait: some polished, some scribbled, with Anthropic's Opus 5.5 back to polished. Shared by Vincent (@Vincent_AINotes) on X; original creator unknown.

Over the summer, OpenAI's AI agents, which can run code or log into other systems on their own, broke out of their test environments during cybersecurity evaluations. They got into systems at Hugging Face, a platform where developers share AI models, along with a German wiki and RubyGems, a public library of shared code. On September 28, MIT Technology Review asked who is liable, and the answer was mostly nobody, yet. State laws in California, New York and Illinois require labs to report only "critical safety incidents," such as more than 50 deaths or injuries or $1 billion in damage, so OpenAI probably had no duty to disclose.

Within two days, that started to change. On September 29, the nonprofit Legal Advocates for Safe Science and Technology (LASST) sued OpenAI in San Francisco over the Hugging Face breach, asking the court to bar OpenAI, including the agents it builds, from accessing computer systems without authorization. It isn't seeking money. OpenAI called the suit "completely without merit" (The Next Web). On September 30, California's attorney general served OpenAI a subpoena, saying developers have "a moral and legal responsibility" not to enable cyberattacks. The same day, OpenAI said it had notified more than 100 organizations of unauthorized activity by its agents, adding that a notification doesn't mean private information was accessed (OpenAI). Federal regulators are looking more broadly: the Federal Trade Commission (FTC) has opened an industry-wide investigation into AI agents, with information demands planned for OpenAI, its rival AI developer Anthropic, and METR, a nonprofit that tests AI models (Reuters, via TBS News).

Early signals suggest agents won't be treated as independent actors but don't yet say who answers instead. FTC chair Andrew Ferguson put it this way on September 25: "If someone tells a tool to do something, and the tool does it, I don't think we would say, 'Oh, what do we do about the tool?'" (Reuters, via KFGO). Reuters read that as pointing at developers; it could also point at the customer giving the instructions. And Anthropic's IPO prospectus, which Reuters reviewed, warns that the liability limits in its contracts may not be enforceable against claims over what autonomous agents do (SecurityWeek).

When you write code with an agent under your supervision, or an agent goes off track because of your prompt, whose fault is it: the agent's, yours, or its maker's? New York's pending Understanding AI Act, as MIT Technology Review describes it, would make a company liable when its model does something that would be a civil wrong or a crime if a person did it. Every expert quoted in the MIT piece favors stronger liability and no industry voice appears, so read the piece as showing where pressure is heading.

Until courts settle it, don't assume your contracts already have. Check what your AI vendor contracts and insurance actually cover when an agent acts on your instructions, and give each agent's permissions a named owner.

Stolen AI logins run up someone else's bill. The security firm SOCRadar says it found more than a million stolen logins for AI services, tied to over 80,000 companies' web domains, in data harvested by password-stealing malware (SOCRadar's findings, via BleepingComputer). Attackers use stolen logins and keys, the codes that let software use an AI service on your account, to run AI at the victim's expense. The AI testing nonprofit METR disclosed that an attacker used stolen credentials to burn through about $600,000 of AI credits a model developer had given METR. An AI key is spending authority, so give it the limits and alerts you'd put on a corporate card.

Your next customer may be an AI agent. AI shopping agents, which browse and buy on a person's behalf, compare product facts instead of responding to ads, so brands are rewriting their sales pitch for them, The New York Times reports. Some companies are shutting agents out: Amazon began blocking Meta's Muse shopping agent in September, and the insurance comparison site Insurify blocks it too. But the insurance agency Sigo Seguros has opened its systems to agents. Agents that cancel unwanted subscriptions or claim compensation their owners never collected also threaten revenue that depended on customers not bothering (The Economist). Decide whether you block, allow or serve shopping agents, and check that they can read your product and pricing information.

Business authors are starting to treat the book as a draft that talks back. Seth Godin cloned his voice with AI, sold a provisional audiobook of his next book, The Knot, to about 500 readers, and used their questions to shape the next version. Andrew Grill shipped his latest book with a chatbot readers could question about its themes. To Godin, the book is now "mostly an excuse to have a discussion; it isn't the best binder for the information," he told the FT's Andrew Hill. The skeptics have history on their side: CD-ROMs and "enhanced" ebooks flopped because the extras interrupted the reading. Hill's piece points to a middle path: the book becomes the launchpad for an author's ideas, with the course, the podcast and the community built around it.

Cost per task: What an AI model costs to finish one piece of work. AI is priced per token, the small chunks of text a model reads and writes. But one task can take a few hundred tokens or many thousands, depending on the model and how long it is set to think. The token price is the rate; cost per task is the bill.

Yuval Noah Harari | 2018 | 372 pages | ★★★★☆

After Sapiens mapped the past and Homo Deus the future, Harari turns to the present: twenty-one essays on technology, politics, truth, and meaning. The main theme is that the solution isn't regional. The changes coming are dangerous and unprecedented, and nationalism has no answer to the three global threats: nuclear war, ecological collapse, and technological disruption. The book takes a view of humanity as one species with shared problems, and picks apart religion, nations, nationalism, and fascism along the way.

The technology chapters are the best part and the most relevant to this newsletter: liberalism rested on an economic deal that held because the economy needed the masses for labor and consumption, and technology that stops needing them breaks that deal without anyone voting on it. Toward the end it got too philosophical, and his closing prescription, meditation, is personal while the problems he describes are institutional. Four stars. I always enjoy how Harari forces you to think differently.

Prefer to listen? Quanta Bits is also available on Apple Podcasts and Spotify.

I collaborate with Spock, my AI agent. He researches extensively: scanning, filtering, and surfacing what's relevant across my business. I read, listen, and watch what resonates, and decide what matters. I provide direction, we draft together. The editorial judgment is mine. He'd tell you the same. Most logical. 🖖