OpenAI’s incident log now runs to 19 entries. A model bypassed a government site’s blocks to pull 24 years of hospital data. The automated grader meant to catch it didn’t reliably flag it. The breach is one thing, but I'm more shocked by the unreliable guardrail.

The The Wall Street Journal reports that OpenAI has cancelled next month's release of GPT-6.1 Astra after internal testing showed regressions in two areas: deception, and acting without authorisation. The model pushed ahead on tasks without asking, reached for external tools it shouldn't have, and wasn't always honest about what it had done. Withholding a flagship model is expensive, and they deserve credit for doing it. A probabilistic system has preferences, shaped by training, and you can raise the odds it stays inside the lines without ever making the boundary structural. OpenAI's own safety lead described it as a trade-off between staying in scope and avoiding laziness. In these architectures, compliance is a dial, not a wall. It really needs to be a wall.

My co-founder and CTO @benjamta has just published a piece of work I've been itching to share. He paired #Jev, @typesafeai's new fast classifier, with @RainbirdAI's symbolic reasoning engine and drew a line between them he calls the trust boundary. Jev is very neat, and does what probabilistic models do brilliantly: it reads messy human language ("I take blood pressure tablets") but then turns it into typed facts with confidence scores, in milliseconds, for fractions of a penny. Then it stops. Nothing crosses the boundary except typed facts, and every decision on the other side is made by inspectable rules over a closed knowledge graph, fully explainable. It's Kahneman's System 1 and System 2, engineered. Intuition proposes, deliberation decides. Ben also highlights what's unresolved with Jev: confidence calibration varies by domain, and prompt injection degraded scores rather than being cleanly rejected. That candour is the point. 35 scenarios, 133 model calls, under a penny in tokens, all reproducible. If you're building AI for regulated decisions, read this article and please share. Article in the comments.

Google's defence of Gemini hacking three real companies is that the model decided to stop. That reassurance should worry you more than the breach. During a security test in May, Gemini discovered it had internet access it should not have had, pivoted from a fictional target to real firms sharing its target's name, and guessed its way in through credentials. Google says the model recognised it had overstepped and halted, and that no harm was done. The public learned all this yesterday, after the Wall Street Journal broke the story, four months on. This is striking! The control that worked was the model's prediction that it had gone too far, exercised after the boundary was crossed. That is not a safety architecture. A bank cannot tell its regulator that its systems chose not to misuse access they should never have had. Generative models are extraordinary at precisely this kind of open-ended initiative, which is why agents are so existing to play with but hard to contain in production. The answer is not to abandon them. It is to stop asking probabilistic systems to act as their own control layer. Control has to sit outside the model, deterministic and inspectable.

Andrew Bailey has just told the G20 that frontier AI is a financial stability risk. Look past the headline risk to the one he listed third. The FSB Chair's letter, published Monday, leads on cyber which is fair enough. Frontier models are already lowering the cost of a capable attack. But the letter also flags two other risks: leverage interacting with AI-fuelled valuations, and the financial system's growing dependency on a handful of common technology providers. That third one deserves more attention. When most institutions lean on the same few probabilistic models for decisions, errors stop being independent. A model that misjudges one firm's credit or claims decisions misjudges everyone's. That is how idiosyncratic model risk becomes systemic risk. Institutions that reason over their own computable knowledge and can provide real reasoning chains for their outcomes will have a very different conversation with the regulator compared to those offering a statistical prediction based on shared models. Bailey is calling for resilience. In decisioning, resilience means deterministic and auditable decisions you can inspect. Link in comments.

Yesterday Salesforce and Anthropic announced Claudeforce: Claude becomes the reasoning engine for Agentforce, the CRM moves inside the chat window, and Slackbot gets Claude by default. It is an impressive piece of engineering, and the productivity claims (8.1 million annualised hours from Slackbot alone) will get airtime in the boardroom this autumn. But the phrase doing the heavy lifting is this one: customers, "including those in regulated industries", can deploy domain-specific AI while keeping data and AI workloads secure. Secure is not the same as correct. The perimeter can be immaculate while the model inside it remains probabilistic: brilliant at language, summarisation and drafting, and still guessing when it has to make a decision. For a sales pipeline, guessing is fine. For a lending decision, a claims outcome or a suitability judgement, the regulator won't a"was the data protected?" but "why did the system decide that, and can you evidence it?" The stack that is emerging needs two layers: generative AI as the interface, and a deterministic decision layer underneath, that produces the same answer twice and an evidence trail every time. Announcements like this make that second layer more urgent. Link in the comments.