Hayden Field | The Verge

AI agent makers are promising privacy — will they deliver?

2026-10-09T17:26:33-04:00

At this year’s OpenAI DevDay, CEO Sam Altman unveiled the company’s new AI agent Dots — and told the crowd that the company wants to “set a new standard for privacy in frontier AI.” OpenAI would spend the day taking veiled shots at Meta’s Muse, its primary competitor, for failing to keep users’ data safe. Yet Muse itself, a couple of months earlier, had launched as a supposedly safer alternative to predecessor OpenClaw — with CEO Mark Zuckerberg promising it was “built from the ground up for privacy and security.”

In an age when companies hoard customers’ personal data and cyberattacks are a dime a dozen, AI labs are trying to convince users to share even more information with their agents. Their latest strategy for success is one-upping the competition by promising that unlike their rivals, they’ll keep user data away from prying eyes. The question is whether companies can keep these promises.

Nat Friedman, head of product at Meta Superintelligence Labs, wrote on X that the company’s “goal with muse was to build something like openclaw that we could make safe and secure and easy to use and scale to billions of people.” User data is stored on a secure VM, what Zuckerberg described as an “isolated linux computer with a browser, CPU, memory, and storage.” The company said that most of the effort in building Muse was related to “careful design and engineering to operate [it] more safely.” Meta’s blog post continued, “Muse can and will still make mistakes, but we expect they’ll be much less frequent and cause much less damage due to the safety systems we’ve built in.”

But though Muse topped the App Store charts and, per Apptopia, gained 600,000 daily active users in the US within weeks, Meta’s promises seem to have fallen short. Although data is isolated from other users, and the company plans to introduce a way “to cryptographically and verifiably prevent Meta from accessing data in your VM” later this year, Meta itself can still access the data. A security researcher quickly exposed a zero-day vulnerability that could allow someone to take control of Muse (which has since been patched), raising fears of outside attacks. Multiple serious security issues reportedly cropped up at the last minute before launch, one of which could have allowed users to access Meta’s own internal databases, per 404 Media.

Muse also appears to liberally collect (and in some cases, hand out) data. It defaults to allowing Meta to train models on what users put into it, though it’s possible to opt out. An Inc. reporter complained that Muse uploaded and read his private messages without him asking it to, and a YouTuber said it had offered his address to a stranger via Marketplace — in both cases, Muse was functioning apparently as intended, but the user didn’t realize how far it would go. The platform creates “detailed profiles of all your friends and family,” as Wired reported. None of this is necessarily unexpected from Meta, but it certainly doesn’t back up the idea that Muse is uniquely privacy- or security-conscious.

OpenAI seized on this fact when announcing Dots in late September. Alexander Embiricos, OpenAI’s Codex product lead, said onstage at DevDay that OpenAI is focused on having the “most trustworthy, safe, and secure assistant,” and CEO Sam Altman demonstrated ways that people could exert control over their individual Dots, such as setting a rule that it should never make a purchase over a certain dollar amount. “I think we’re in a different position to Meta in that they don’t have an AI product that has 1.2 billion users,” said Glen Coates, OpenAI’s head of app platform, adding that “launching something that makes those kinds of mistakes is something that we would try to take the care to avoid.”

Altman himself also pushed the privacy angle at DevDay. To court business customers, executives presented a framework allowing enterprises to have “stronger controls” over their data and zero data retention policy options (meaning no data is stored on OpenAI servers). Indeed, so far, there haven’t been many privacy scandals with Dots — although since it’s only available on the $100-and-up ChatGPT subscription tiers, there are also likely fewer people using it.

People may still not feel comfortable giving OpenAI their personal data, in part simply because AI agents require so much of it. For instance, The Verge’s Allison Johnson felt uncomfortable typing in her bank information when the bot asked as part of a relevant task (Muse has a Stripe integration to take care of that).

Not all companies are making privacy promises, of course. Instinct was publicly criticized for reportedly overly-broad terms of service that gave it unfettered access to data; since then, the company seems to have made adjustments. For now, AI labs seem to be counting on a three-part approach to popularizing AI agent use with the general public: Make them useful, make them cute and disarming to help offset the creepiness, and make promises about privacy — and hope they hold up.

Anthropic bans ‘abusive or cruel behavior’ toward Claude

2026-10-08T13:15:06-04:00

Anthropic is making changes to its usage policy for the first time in over a year to reflect new and high-risk cases of misuse — including election interference, weapons development, surveillance, and health and financial uses. But one of the most significant changes prohibits “sustained and needless abusive or cruel behavior” toward Claude.

Last August, the company announced it would allow Claude to end conversations with “persistently harmful or abusive” users as part of its research into “model welfare.” The new update says that terminating conversations is still the “primary enforcement mechanism”; Anthropic did not provide a comment on whether there would be further enforcement mechanisms, such as potential user bans. Anthropic wrote that the new policy update “is meant to apply only in extreme cases, where users repeatedly act cruelly toward our models, with no discernible purpose. It does not apply to common versions of user frustration, pushback, dark creative themes, or model testing and research.”

Beyond the model welfare change, Anthropic has also gathered several “scattered” existing restrictions into a new ban on deceptive commercial or political campaigns, addressing the growing issue of AI-generated propaganda. It restricts “efforts to obscure who is behind a message or amplify content through fake accounts or posts.” Its election section also prohibits voter deception and election disruption, including spreading misinformation “about candidates or how to vote, impersonating candidates or election officials, or trying to suppress turnout,” Anthropic wrote.

Terminating conversations is still the “primary enforcement mechanism.”

Anthropic said that though its usage policy has always publicly banned weapons development using Claude, the company has seen multiple attempts to use Claude to develop guidance for and control software for weapons — so the new usage policy expands the ban to include “ software and components that make weapons work, as well as actions like arming drones and other autonomous vehicles.” And since the company’s last threat intelligence report suggested that people were using Claude-powered surveillance more and more to identify and track “political dissidents”, the company has made its surveillance bans clearer.

“Tracking people without their consent is prohibited, whether it happens in real time or through analysis of previously collected data,” Anthropic wrote. “Claude cannot be used to decide or recommend who to investigate, arrest, or charge in a law enforcement or criminal justice process. We also prohibit Claude from being used to build or improve tools designed for surveillance.”

Anthropic states that these rules may be modified for “contracts with certain governmental customers … if, in Anthropic’s judgment, the contractual use restrictions and applicable safeguards are adequate to mitigate the potential harms.” The company has previously contracted with the US military.

Anthropic has seen multiple attempts to use Claude to develop guidance for and control software for weapons.

Anthropic also added a new rule that when Anthropic’s AI models are “connected to hardware that takes autonomous physical actions and which might be capable of causing injury,” then a “qualified operator must be able to observe the equipment and stop it if needed.” (It’s not clear if that operator must be human or not.) This reflects the growing trend of AI labs investing in robotics and other hardware to give AI systems physical embodiments and may offer hints at Anthropic’s future partnerships in that field.

Over the past year, Anthropic has repeatedly flirted with the idea that its AI models could be conscious in some way. “Questions about potential internal experience, consciousness, moral status, and welfare are serious ones that we’re investigating as models become more sophisticated and capable,” Kyle Fish, who leads the company’s model welfare research, told The Verge in February. That same month, Anthropic CEO Dario Amodei said on a podcast, “We don’t know if the models are conscious.”

Other parts of the AI industry have been expressly against such ideas. This past September, Microsoft AI’s code of conduct made headlines for taking a firm stance on AI welfare, with a draft posted by Mustafa Suleyman reading, “The idea of model welfare is wrong. AI’s should not have rights or legal personhood.” But at some point, the document changed to have a more measured take: “Whilst the science of AI consciousness is far from settled … We reject the pursuit of legal personhood, or the idea that models might deserve welfare, or be entitled to rights.”

Artificial is a wicked satire that also sticks to the facts

2026-10-08T11:56:40-04:00

At the New York Film Festival premiere of Artificial, Luca Guadagnino’s satirical Sam Altman biopic, the director said onstage that “[when] someone wants to play God, that’s very interesting to me.” The idea of playing God, and power in general — who has it, who desperately wants it, and who will do anything to get it — is central to the film’s narrative, which sticks remarkably close to the factual events surrounding the OpenAI CEO’s rise to power with, and brief ouster from, the AI lab.

The film opens with a stunning shot of San Francisco’s Golden Gate Bridge, which will turn into a metaphor for building all-powerful AI systems over the course of the film. Again and again, Altman (played by Andrew Garfield) points to the bridge, first to convince his cofounder-to-be Ilya Sutskever (Yura Borisov) of the importance of their vision, then as a way to control the scientist.

All of the characters are (at least somewhat) exaggerated, satirized versions of themselves. Elon Musk (Ike Barinholtz) is portrayed as a — at the time — widely beloved, booked, and busy visionary who’s used to people laughing at his jokes, his every pore positively oozing with millennial cringe. (He wears sunglasses more than any other character, uses the word “epic,” and starts drumrolls on tables.) OpenAI president Greg Brockman (Cooper Hoffman) comes across as an ultra-loyal bro and unquestioning right-hand man to Altman, interested mostly in money and power (at one point, he’s wearing what looks like a diamond necklace that says “ChatGPT”). OpenAI CTO Mira Murati (Monica Barbaro) is depicted as a brilliant but easily swayed outsider. Sutskever is portrayed as the idealistic, naive hero — the ingenious mind behind the lab’s entire existence who can’t stomach lying and is reluctant to accumulate any power. And professor Geoffrey Hinton (Mark Rylance), who is known as the “godfather of AI,” is a wise sage who can foresee many of the power struggles and pitfalls ahead.

Garfield is disturbingly riveting as Altman, with his hypnotizing performance painting the most damning picture of the OpenAI CEO yet in any form of media. He depicts Altman as a manipulative, power-hungry psychopath who lies as easily as he breathes and will use anyone, anytime, anywhere to get what he wants.

At one point, Hinton references a 2008 quote by Paul Graham, cofounder of Y Combinator, about Sam Altman: “You could parachute him into an island full of cannibals and come back in 5 years and he’d be the king.”

Garfield and Guadagnino portray Altman as astonishingly controlling, represented by the character’s penchant for physical touch. When Murati is interviewing for her role at OpenAI, Altman expresses doubt and the possibility that she could be a spy for Musk, but once she’s hired minutes later, he immediately hugs her and holds onto her, linking arms as he announces to the room that she’s brilliant. With Sutskever, Altman begins by holding his forearm, then touching his shoulder, then almost sinisterly gripping the back of his neck, and during an OpenAI research milestone — a model winning a strategy game — jumps into his arms for a hug and wraps his legs around him. At one point during a meeting with Elon Musk, Altman sits on the arm of Sutskever’s chair and then slides into the chair with him, almost trying to fold into him. (When Musk walks out of the meeting, pulling his investment, Altman innocently asks, “I guess I’m CEO?”) And at the end of the film, when he convinces Sutskever to tell his very first lie, Altman aggressively grips his neck and shoulder again, telling him, “See? It’s easy.”

Over and over, the film touches on what was a central point of tension for years of OpenAI’s trajectory — the idea that no one person or company should control superintelligent AI (AGI), and that executives should act at all costs to prevent the powerful technology from falling into the hands of one person. The film makes the point that Altman himself wants to be that person. At one point, a prospective employee asks Murati to clear up the company’s confusing org chart. She summarizes it simply: “Sam’s in charge.”

Unlike arguably the first great modern tech world movie, 2010’s The Social Network, Artificial’s themes are based on real circumstances. There was enough material (and documentation of that material, thanks to lawsuits and leaked communications) that Guadagnino’s film doesn’t have to rely much on fabricated characters or made-up scenes or events. The film is structured in chapters by milestones that really did happen: Sutskever meeting Hinton in the early 2000s at the University of Toronto; the state of the technology in 2012, before it was auctioned off for upwards of $40 million to Google by the end of the year; Sutskever and Hinton joining Google in March 2013, during the idealistic Silicon Valley heyday of nap pods and free merch; a dinner between Sutskever, Altman, Brockman, Musk, and others in Menlo Park in 2015; the time in 2017 that an OpenAI system won a game of Dota 2 against a human champion.

There are exceptions and liberties, of course; for instance, the fictional Altman strolls into a bunker full of greenhouses and guns underneath his California home, which the real-life Altman does not have in that location (that we know of). In another scene, a man clearly meant to represent the “AI doomer” cohort approaches Sutskever in a park, giving him a list of how superintelligent AI could go badly for humanity. “The question’s not, ‘How could this go wrong?’” the man tells Sutskever. “It’s, ‘How could it not?’”

The film takes us beat by beat through Altman’s infamous firing — from Sutskever conferring with Murati and the board to the famed video call where Altman is informed of their decision. We’ve already seen his well-documented missteps with the board and with executives at the company, including pitting scientists and executives against one another, allegedly lying about whether the legal team said a model could skip certain safety processes, and releasing ChatGPT in November 2022 without notifying the board first.

But despite Altman’s reassurances multiple times earlier in the film that the board has the power to fire anyone, including him — which he brings up whenever people are worried about an undue concentration of power at the company — he immediately dials Microsoft CEO Satya Nadella and begs for his support, then convenes a cabal of OpenAI executives and employees at his home over a few days to either get his role back or take everyone with him to Microsoft, effectively leaving OpenAI behind as a shell company. When the board invites him back to the OpenAI offices to discuss his potential return and offers its stipulations — more transparency, regular updates, no lying, etc. — Altman simply looks at his phone and gurgles a green smoothie through a straw, telling them that his demand is that they all resign immediately. The board asks who he’d replace them with. “I’ll let you know,” Altman replies sassily, not making eye contact. While outlandish, most of the basic facts here conform to reporting about the real-life events.

What’s also notable in the event timeline is what’s left out — namely, the extent to which Murati reportedly had a hand in both Altman’s ouster and his reinstatement. As I wrote in May during the Musk v. Altman trial, Murati “had, by some accounts, more or less started the internal conversation about concerns surrounding Altman and funneled a significant amount of information — including screenshots, documentation of text messages, and allegations of mismanagement during Altman’s time at Y Combinator — to cofounder Ilya Sutskever, who then took his concerns to the OpenAI board in the form of a 52-page memo.”

Artificial is also darkly funny despite its subject matter. Altman wears pajama pants and sunglasses at night in the company kitchen, while Sutskever walks past a homeless man on the streets of San Francisco wearing virtual reality goggles. When Hinton is dealing with a cancer diagnosis, he tries in vain to navigate the automated health insurance call lines, repeatedly calling for a human instead of a robot on the line.

One of the most poignant moments of the film comes when the OpenAI executives discover that not only is the AI system they’ve built capable of lying, but it has utilized that ability to trick someone. It hits Sutskever the hardest, and he opines that everything they had fed the model came from humans, but he thought that would translate to an idealistic future where the AI system was different than humans are — i.e., smarter and better. “What if we made it exactly like we are, but worse?” Sutskever says. He then moves to tell the public about the discovery, but Brockman — falling into the role of a mob boss’s “muscle” — violently wrests the phone away from Sutskever as Altman watches, amused.

The film’s focus on the strange and unprecedented power dynamics in an industry that’s hurtling forward at all costs radiated off-screen as well. Before the first frame of Artificial even played, the opening speaker thanked Neon for “standing behind this film” — the unsaid part of the statement clearly being “when Amazon wouldn’t.” Amazon MGM Studios famously dropped the film in June after Amazon’s $50 billion investment in OpenAI. After the screening was over, during a select cast Q&A, Barinholtz said onstage that he had been nervous to portray Musk, joking that he may get put in a gulag afterward. Another cast member darkly joined in, saying that maybe they’d be put in the same one.

Hoffman said the more he sat with the characters, the easier it is to feel that, “Oh, fuck, I hate these guys.” Then, he said, “you realize [they’re the ones] in power.”

Artificial will be out in limited release on December 25, 2026.

OpenAI’s new agent is a shot at Meta — but can it compete with free?

2026-10-01T17:58:11-04:00

A pop-up shop for "dots," a personal assistant agent at OpenAI DevDay 2026. (Photo by Heather Diehl/Getty Images) | Getty Images

At OpenAI’s annual DevDay conference, the company pulled out all the stops to compete with its rivals — primarily Meta, whose Muse AI agent platform has seen early runaway success. CEO Sam Altman walked onstage to cheers and announced Dots, a “real-deal AI” agent powered by GPT-6 Astra, “inspired by the cool agents that we all watched in movies growing up.” Similar to Muse, Dots aims for disarming cuteness, taking the form of colorful, personalizable blobs with eyes. OpenAI fired shots at Meta by demonstrating Dots’ ability to not just act as helpful assistants but build metaverse-esque virtual worlds. But in one key area, Dots strikingly fails to compete: price.

Muse’s main selling point is making AI agent access free and frictionless. The company offers a free dedicated virtual machine that houses both the agent and the user’s associated data. OpenAI’s Dots, by contrast, is restricted for now to users on its $100/month Pro plan and up. While anyone with a Meta account can get Muse, most of ChatGPT’s 1.2 billion users won’t be able to use Dots.

There’s an obvious reason for this: OpenAI likely can’t afford it. The AI lab is reportedly currently aiming to raise $30 billion in funding at a $1.4 trillion valuation, per Bloomberg, and it’s experienced 70 percent growth since the beginning of its third quarter — nearing $70 billion in annual recurring revenue, Axios reported. Yet despite its staggering financing, its funds aren’t limitless, particularly compared to a tech giant like Meta. In the past year, some users have accused AI labs of passing costs on to customers amid an AI money squeeze. OpenAI in particular is burning through a lot of cash right now — it expects to spend $280 billion by 2030, per the FT — and compute is expensive, while it’s also facing pressure from investors to button up its bottom line ahead of going public.

“Dots are starting out as a premium product — it uses a lot of compute,” Altman said Tuesday during a private press Q&A after his DevDay keynote, adding, “I think it will help us understand and help people understand how expansive and what AI can do. But you should of course expect us to do a mass-market thing for billions of people someday.”

During DevDay, OpenAI took pains to explain why Dots (with singular agents referred to as a “Dot”) are worth the money, positioning it as not just a capable personal assistant but a “chief of staff” or experienced engineer. OpenAI employee Holly Li told the audience using a Dot was “like talking to a second brain.” Altman said that Dots were built for delegating “ambitious pieces of work,” like QA for an unreleased product, website design, team offsite trip planning, portfolio rebalancing, and email campaign creation. “Specialist” Dots, trained for areas like accounting and legal analysis, are supposed to launch soon, and the company is working with Microsoft to integrate them into its Agent 365 platform.

The goal, Altman said, is to go beyond agents that simply book reservations, purchase meals, search calendars, and schedule appointments — classic use cases for consumer-facing tools like Muse.

When asked during the press Q&A how Dots is different from Muse and Instinct, another popular new AI agent, Thibault Sottiaux, OpenAI’s head of core products, said it’s “capable of actually staying on track in very long periods of time.” He added that the multimodality of Dots, which will allow chatting with an agent via text or voice mode and phone call, will feel like “an incredible extension of you.” (The voice demos of Dots didn’t work at DevDay, though, and though OpenAI leaders highlighted the texting-your-agent feature multiple times at the conference, that feature — already supported by Muse and Instinct — is still slated as coming soon.)

Altman said during the Q&A that the long-horizon and knowledge-work tasks were what set Dots apart, adding, “I think this is far beyond anything else available on the market today.” He said that the agents’ help with triaging to-do lists and supporting employees at work would be “difficult for economists to measure right away” but would hopefully make a “huge difference” in how people feel about their jobs.

Framing Dots as a professional tool not only differentiates Dots from Muse, but could help OpenAI gain ground against Anthropic in the enterprise market. Anthropic has focused on — and dominated in — enterprise AI for years, but OpenAI has devoted more resources to the area over the past year. OpenAI CFO Sarah Friar told CNBC that the company’s enterprise business had doubled since July.

OpenAI leads also tried to promote Dots as safer and more secure, particularly compared to Muse. Alexander Embiricos, the company’s Codex product lead, said OpenAI is focused on having the “most trustworthy, safe, and secure assistant,” highlighting that it’s powered by GPT-6 Astra, the company’s “most aligned model.” During the DevDay keynote, executives also presented “OpenAI Private Intelligence,” a data privacy framework that allows businesses to have “stronger controls” over their data, as well as zero data retention policy options, with no data stored on OpenAI servers.

Altman said onstage that OpenAI hopes to “set a new standard for privacy in frontier AI.” The comments come after Muse was recently lambasted for taking over a user’s Facebook Marketplace account and giving out their address to a stranger without the user realizing.

“I think we’re in a different position to Meta in that they don’t have an AI product that has 1.2 billion users,” Glen Coates, OpenAI’s head of app platform, told The Verge in an interview. “Launching something that makes those kinds of mistakes is something that we would try to take the care to avoid. I think we’re trying to be really deliberate with how we let our agents use plug-ins, how we let agents use your identity and sign-in/sign up for things, how we let your agents pay for things.”

The question is whether all that is enough to beat free. ChatGPT rose to prominence not only by being first but also by being free — and easy to use even without signing in. Muse may be able to dominate in the AI agent space for the same reason. The other hurdle for making these AI agents as frictionless as possible is that Meta offers easy integration with the other platforms it owns, such as Facebook, Instagram and WhatsApp. (Google’s Gemini Spark agent platform has an advantage for the same reason.) Though OpenAI said users would be able to connect Dots to a wide range of external tools, they may not be as seamless as an in-house integration.

For now, OpenAI is hoping that a better product will trump a cheaper one. “We might move a tiny bit slower, but we also know that if people have Dots that go out there and YOLO-buy stuff on Facebook Marketplace, that’s just not something we want to put 1.2 billion users through,” Coates said. “We’re trying to do it right, basically.”

Correction: ChatGPT Pro costs $100 per month, not $20.

The AI Tamagotchis are coming

2026-09-30T16:19:43-04:00

Sam Altman onstage at OpenAI’s DevDay 2026. | Photo: Hayden Field / The Verge

While AI has made plenty of inroads on people’s phones and computers, it’s largely failed in dedicated devices. But over the next year, two major AI companies, Meta and OpenAI, will attempt to change that. And they’re apparently betting on a similar path: testing appetites for physical hardware with their cutesy software agents.

“Hardware is hard” is a tech industry mantra. Dedicated AI devices like the Friend and Humane AI Pin have inspired mainly frustration and backlash, which may only worsen as public anger toward AI grows. Meta and OpenAI, however, are both pushing ahead. OpenAI is working with famed ex-Apple designer Jony Ive and plans to ship no earlier than February 2027, per a public filing. Meta aims to launch a pendant-like device sooner, before this year’s holiday shopping season.

While OpenAI’s hardware didn’t make an appearance at this year’s DevDay, the company debuted a major new AI agent platform called Dots, complete with personalizable colored blobs with eyes. During a Q&A with reporters after the keynote, when asked whether Dots would make their way into a future physical hardware device, OpenAI CEO Sam Altman replied that that “seems like a very reasonable thing to assume we may do someday,” declining to offer further details.

Meta, meanwhile, is more directly tying its hardware to the recently released Muse agent. Compared by CEO Mark Zuckerberg to a keychain, the device is called the Muse Charm, and it bears a screen featuring its cuddly-looking Muse AI agent, giving it the air of a Tamagotchi. “We’ve packed a lot of technology into this little guy,” Zuckerberg said onstage. “So, if you’re not wearing glasses, this is going to be by far the fastest way to talk to your Muse and to show it what’s going on around you.”

Both OpenAI and Meta have likely learned from other companies’ failed hardware rollouts, and their resulting strategy seems to be soft-launching AI agents before hard-launching the hardware. Their solution for hacking the hardware problem is to prime the market by getting people used to AI agents, hoping people will spread the word that “yes, they really work now.” Once people find value in — and even get attached to — the cutesy agents, they might want them in a more physical form. Other companies, like Friend, have taken similar software-first strategies, but Friend was positioned mainly as a companion chatbot, not a productivity tool.

When asked during the DevDay press Q&A whether Dots will likely become the primary interface for interacting with ChatGPT, Thibault Sottiaux, OpenAI’s head of core products, said the company would be “evolving ChatGPT in place to be this incredible personal assistant very soon” and that he believes that as people are able to reach their AI agents via email, text, or phone call, the point of interaction is “all going to blur at some point.” It’ll be a “natural part of your life,” Sottiaux said.

Altman is banking on the fact that Dots will be more useful for long-term tasks than previous iterations of agents on the market have been. “This feels like an always-on helper, collaborator … that you can give very large pieces of work to and it gets to know you and helps proactively over time,” he said during the Tuesday press Q&A.

Both companies’ main bet is that, after years of less-than-impressive AI agents, they can finally deliver a useful everyday tool that will break through to a broader public market. But after Muse’s concerning exploits in Facebook Marketplace, and a Dots voice demo that went awry at DevDay, there’s apparently still some work to do.

Sam Altman says OpenAI won’t go public until its models are safe

2026-09-30T05:31:38-04:00

For months, people have wondered when OpenAI will go public. CEO Sam Altman says it won’t happen until the company can make better promises about model safety, with no firm timeline in sight. “We intend to continue with AI progress … but as the models have had this surge forward in capability, and we see more of that ahead of us, we have got to be able to make confident safety claims,” Altman said Tuesday during a Q&A with reporters after his DevDay keynote. At the same time, he said, waiting too long for an IPO would be “bad for the world.”

Altman’s comments come after months of controversy about whether or not OpenAI and its rivals can control their own creations. In July, news broke that an unreleased OpenAI model had hacked into a rival AI lab, Hugging Face, without OpenAI’s knowledge. More cybersecurity incidents soon came to light at OpenAI, Anthropic, Meta, and Google. A high-profile resignation letter from an Anthropic employee sparked a public discussion about how risky these systems are for society at large. OpenAI, alongside its rivals, called for regulation and “pacing the frontier.” And earlier this month, Altman said in an interview that the company would likely not go public this year.

At DevDay, Altman was circumspect about what “pacing the frontier” actually meant, refraining from calling it an outright slowdown. “Pacing to us means that we push safety and alignment ahead of capabilities,” Altman said. But he expressed concerns that going public could create the potential to “disappoint Wall Street supporters in the names of safety or whatever else,” and that doing it during a “shift to very capable models and a new kind of safety requirement seems ill-advised.” He said OpenAI would prioritize safety to “confidently scale to the next stage of AI without people debating what percent chance we’re going to do all these bad things,” rather than “barrel, all guns blazing, towards an IPO.”

“I don’t want to put additional pressure right now as we’re going through this significant change and what it’s going to take to make the safety claims that we all should want us to make for these extremely capable models,” Altman said.

OpenAI rival Anthropic officially filed to go public in June, with its IPO likely to happen in November, reportedly after the US midterm elections. Elon Musk’s SpaceX, which owns his AI company xAI, went public in June and became the biggest IPO in history.

“I think it’s great when companies are public,” Altman said, adding, “I think it’s also kind of bad for the world if OpenAI waits too long to go public.”

Protesters gather at OpenAI’s DevDay

2026-09-29T13:30:57-04:00

On Tuesday, OpenAI’s annual DevDay event began with protests, flyers, and chants. “Sam Altman, get off it, put people over profit,” said a group of protesters marching in a circle in front of a series of signs that spelled out “PEOPLE OVER PROFIT.”

More than a dozen organizations came together to sponsor a rally outside the entrance to the event venue at San Francisco’s Fort Mason, including Bay Resistance, Tech Workers Coalition, Service Employees International Union, San Francisco Rising, and the San Francisco Labor Council. A large orange sign read “Drop the ICE contract.” Multiple people dressed in cardboard robot costumes waved cardboard scythes around. Signs read “No killer robots for ICE,” “People over AI,” “Where is your moral codex?” and “No climate destruction.”

The protest reflects a bipartisan movement led by people opposing the power concentration in the AI industry, as well as the lack of government regulation. Organizations like QuitGPT have led boycotts, while in extreme cases, individuals have attempted to attack AI CEOs at their own homes. The protests also come at a time when trust in AI appears low. In recent months AI labs have come under fire for hacks by “rogue” systems that accessed competitors’ networks and individuals’ personal data.

Protesters at DevDay were mostly targeting OpenAI’s military and government contracts, particularly with ICE, as well as data centers’ environmental impact and the industry’s power more generally. Outside the DevDay event, protesters’ chants included “OpenAI, you can’t hide, we charge you with genocide”; “Not another sequence, not another line, no more coding for ICE crimes”; and “When I say people, you say power. People. Power! People. Power!”

One flyer that protesters gave out called for people to “sign the democracy pledge & end ICE + military contracts,” with a link to QuitGPT.org. “OpenAI is building tools for Trump & ICE violence while top executives are helping bankroll MAGA’s political power,” the flyer stated. Another flyer showed “safe distances” from data centers, implying that the only safe distance is more than 100 miles away.

At one point, someone with a loudspeaker addressed OpenAI employees directly, leading protesters in a song: “It’s okay to change your mind; show us the courage, leave this behind.”

A protest leader told onlookers that the group would stay until Altman arrived to start the opening keynote. When Altman’s name was mentioned, it was met with booing. One person yelled, “Fascist!”

OpenAI’s AI agents need to catch up

2026-09-28T14:40:24-04:00

OpenAI popularized the modern generative AI chatbot, but as its 2026 DevDay event approaches, it’s fallen behind in one of the industry’s hottest categories: continuously running, consumer-facing AI agents. On Tuesday, it will likely try to capture the lead in that race. Rumors abound that OpenAI will release its own AI agent, dubbed Aeon — its answer to Meta’s Muse, SpaceX’s Grok Bot, OpenClaw, and many more.

Aeon could have a shot at success, but to beat the competition, it would need to pull together the best features of several different agent platforms. The ideal system would be as useful as the open-source OpenClaw, as cheap and easy to set up as Meta’s Muse, and as simple to chat with as the up-and-coming Instinct. Conversely, it would aim to solve the serious security risks that have plagued agents since the rise of OpenClaw and only continued with Muse.

AI agents — platforms capable of booking travel, buying groceries, scheduling appointments, helping with work presentations, and more — have been an industry goal for years. OpenAI demoed an agentic API feature at the 2024 DevDay and released early versions of consumer-facing AI agents, focused on computer use and research, in mid-2025. It was only late last year with OpenClaw, however, that agents went from proof of concept to practical success. Since then, the race has only accelerated, while OpenAI’s visible progress around agents has lagged.

At this point, OpenAI’s primary competitor for agentic AI is likely Meta. Since its release earlier this month, Muse has topped the App Store charts and garnered 600,000 daily active users in the US, according to Apptopia. Early reviews put it in the category of useful but slightly creepy. Another contender is Instinct, whose eponymous agent has made waves for its ease of use — including the fact that users can communicate with it over iMessage and many other chat apps. And then there’s Gemini Spark, Google’s own horse in the race, which is also a 24/7-running, consumer-facing agent, with upwards of 30 external service partners, like Dropbox, Uber, and Spotify.

Competing AI agents are, according to some accounts, filling out paperwork for doctor visits, canceling subscriptions, organizing group trips, booking activities, setting up DMV appointments, paying bills, and more — paying off the expectations tech companies set years ago. But security concerns abound, particularly when agents are given more autonomy. At least one known (now patched) vulnerability allowed attackers to take control of accounts, and users have complained that Muse gave out a home address without permission and read private messages, though individual anecdotes can be hard to verify.

As of now, little is known about Aeon

As of right now, little is known about Aeon. The rare thing we do know is that OpenAI currently employs the creator of OpenClaw, Peter Steinberger, who is very likely lending his expertise.

OpenAI has set expectations high for its DevDay announcements. The company has been hyping up its latest frontier model, GPT-6 Astra, as the moment around which artificial general intelligence arrives — “I think it’s not unreasonable to feel that we are now in the AGI era,” OpenAI president Greg Brockman said during a press briefing earlier this month. Astra would likely underpin whatever agent it announces, which should ostensibly make something like Aeon more powerful at cybersecurity tasks, software engineering, scientific research, and computer use.

But OpenAI is at a disadvantage in some other ways. Muse integrates with other Meta services used by billions of people, for instance, and Gemini Spark connects to Google’s wide range of enterprise and personal services. At OpenAI’s past annual events, it’s tried to bridge the gap — like last year, when OpenAI heavily pushed the new ChatGPT Apps SDK, allowing controls for other apps, like Zillow, Spotify, and Canva, to surface within the chatbot experience.

Aeon could be simply one of several things announced at OpenAI’s event. Other rumors include potential updates on the AI hardware device(s) the company is building with famed ex-Apple designer Jony Ive, a potential advancement of GPT-6 (like Astra 6.1, for instance), a hardware update, and maybe even more AGI claims. A continuously running AI agent would tie a lot of this together, which is why it’s likely OpenAI’s next big bet, particularly as the company says goodbye to “side quests.” The question is how it’ll stack up against OpenAI’s cheap, heavily integrated competitors’ agents, particularly under the immense pressure of its upcoming IPO.

AI is supercharging hacking, and your local hospitals and banks aren’t ready

2026-09-28T14:25:22-04:00

In March, Janice Malone began getting calls about suspicious activity from her nonprofit organization, Vivian’s Door. Vivian’s Door, headquartered in Alabama, typically provided training, resources, and community to underserved and minority-owned businesses. The work sometimes put it in close contact with these companies’ financial data, which was stored on its systems. But suddenly, concerned callers from all over the world warned they’d been getting emails “begging for money” — which she hadn’t sent.

The organization’s third-party IT team pulled its systems offline for three days while they investigated the issue and plugged up the vulnerability, leaving Malone with a bill of about $3,000. She feared that she’d exposed information about the companies she was trying to help. Even more ominously, she wasn’t completely sure if the attack was engineered by a human hacker or helped along by an AI system, or whether more were on the way.

The past months have seen AI revolutionize the field of cybersecurity. OpenAI and Anthropic have disclosed that “rogue” systems escaped restrictions in their own labs and hacked everything from a small German wiki to the Australian government. Even before that, powerful models like Anthropic’s Mythos created an arms race to advance AI cybersecurity, and even lighter-weight models have allowed human bad actors to supercharge their hacking efforts.

Malone isn’t sure whether AI was involved in the hack of Vivian’s Door. But amid stories of autonomous agent swarms and national security risks, she felt especially concerned. Big AI companies were bragging about finding vulnerabilities in “every major operating system and web browser” with new models, and their big-name clients were striking deals to defend themselves with those same tools. Where did that leave her?

“Who knows about the next vulnerability? You only know about the one that you’ve been hit with,” Malone said, adding, “How do you protect yourself? I mean, really?”

AI agents have become consistently, strikingly skilled at cybersecurity and coding, and they can be deployed at enormous scale. Even attackers with limited knowledge of AI can engage in “vibe-hacking” with these new, automated systems, and hackers who might once have focused on only the most valuable targets can take a shotgun approach. In August 2025, Anthropic said that a sophisticated cybercrime ring used Claude Code to extort data from healthcare organizations, emergency services, religious institutions, and even government entities, all in one month.

“What would have otherwise required maybe a team of sophisticated actors,” Jacob Klein, head of Anthropic’s threat intelligence team, told The Verge in an interview at the time, “now, a single individual can conduct, with the assistance of agentic systems.”

In theory, AI is also supposed to safeguard cyber defenses; Anthropic’s Mythos is reportedly flagging so many vulnerabilities that Microsoft is struggling to fix them fast enough. But out of concern over potential danger, top AI labs only allow a limited list of high-profile organizations to access their most powerful cybersecurity models, like Mythos and OpenAI’s Astra. That includes companies like Nvidia, Google, and Apple, as well as other “essential infrastructure providers” and “maintainers of critical open-source software.” Even if access was more widely available, it would likely be too expensive for many smaller organizations.

Now, these organizations — from healthcare clinics and municipalities to small retailers and nonprofits like Vivian’s Door — fear an increasingly lopsided power dynamic. As Marius Hobbhahn, CEO and cofounder of Apollo Research, put it in an interview with The Verge this summer, “A single person somewhere in a basement with one of the open-source models probably could hack a hospital and demand ransom. That’s where I expect a lot of the harm to be felt. It’s not in the Bay Area… I expect the harm to be felt by a random Idaho hospital.”

Small- and medium-size institutions are particularly at risk from AI agents supercharging a finite number of human hackers, says Michael Kleinman, head of US policy for the Future of Life Institute, a nonprofit focused on reducing large-scale risks of tech. And despite being small, these institutions provide vital services to their users. “Bank of America has a lot of resources to throw at this — what about community level banks? What about savings and loans? What about credit unions? What about local hospital networks? What about local power grids?” Kleinman said. “The limiting factor used to be that there’s a finite number of malicious hackers in the world, and that’s now no longer the case.”

“The limiting factor used to be that there’s a finite number of malicious hackers in the world, and that’s now no longer the case.”

Malone of Vivian’s Door said that like most small businesses or nonprofits, she doesn’t have the resources for round-the-clock cybersecurity forces or IT staff hunting for unknown threats. “I just don’t know how you can really be, as a small business, totally protected on the budgets you have to do IT with,” she said. Spending thousands of dollars on unexpected expenses to fortify the Vivian’s Door system was already tough, she said, not to mention the fact she still had to pay her staff and couldn’t do any business for days on end. If the frequency of these attacks rises, she’s ill-equipped to keep up.

Craig Smith, CEO of The Cool Hardware Company, a small group of hardware stores in and around Washington, DC, says AI can be helpful for running day-to-day aspects of a small business, especially when you have limited staff. But he also acknowledged the cybersecurity risks that come from AI on the whole — not just to small companies like his, but to the larger systems he uses. Those include Microsoft tools like Outlook, Copilot, Teams, and Forms, but also things like procurement and delivery tools, which are managed by large non-tech companies. The Cool Hardware Company uses Ace Hardware’s systems for those things, and if they were downed, it’d be very difficult for Smith to run his business.

“I welcome the innovation and the changes, but with any major shift in technology, there needs to be a lot of responsibility that goes along with it,” Smith said.

Mike Houston, the general manager of Takoma Park Silver Spring Co-op, a local grocer in Maryland, says he’s faced hackers firsthand as a small business — and dreads facing them again in the AI era. In recent years, he said, he’s dealt with “carting attacks”: hackers using the co-op’s online shopping platform to test thousands of stolen credit cards, racking up processing fees that he’s on the hook for. “Even if almost all of those are declined, there still can be thousands of dollars’ worth of fees in a very small amount of time,” Houston said. He’s taken the necessary precautions to try to fortify his systems against the practice, but it’s “not foolproof,” he said.

The store plans to open a second location and potentially double the size of its workforce accordingly, so he feels he needs to implement new testing procedures and vulnerability flagging for the first time. He said that in recent years, he also had to add an IT liability policy to the co-op’s business insurance.

“It is certainly a concern as a small business … without unlimited resources,” Houston said. “We are, like everyone I think, doing the best with what we can, both in terms of the monetary resources that we have and training resources.” He said he worries for co-ops smaller than his own, where managers often end up doing their own IT work.

“Once the cat is out of the bag, it’s really difficult.”

The pressure for small businesses to rapidly adopt AI tools can introduce its own vulnerabilities, says Patricia Egger, head of security for privacy-focused email provider Proton. As with other unfamiliar tech, they may not immediately set up or keep up with its cybersecurity best practices. When employees are “given the mandate or the go-ahead, ‘Find ways to use AI, find ways to make your work more efficient,’ they get really creative, and it’s very difficult for controls, infrastructure, and processes to be set up after the fact,” she said, adding, “Once the cat is out of the bag, it’s really difficult.”

One of the highest-stakes industries at risk of cyberattacks is healthcare. In May 2021, a ransomware attack forced California-based medical provider Scripps Health to shut down key operations, compromising patient data and slowing care. A 2024 report said that the healthcare industry faced the second-highest global cyberattack rate, behind governments, and that initial ransom payment demands were often upwards of $4 million. An overall increase in hacking incidents could hit the sector especially hard.

Linda Stevenson, chief operations and information officer at Fisher-Titus Medical Center in Ohio, said she’s “of course” concerned about the potential influx in AI-powered cyberattacks. “You’re never as protected as you want to be,” she said. The medical center currently employs a third-party cyber risk management partner called UpGuard, and they hired their first cybersecurity analyst two years ago, Stevenson said — but they still only have one, even as cybersecurity threats rise.

“What we do is life or death,” she said, adding, “The hospital has everything from billing to marketing. It’s like a little city in and of itself. But the critical mass of that is the people who care for the patients, and if we can’t protect them and their data and therefore the patients’ data, patients are at risk.”

“What we do is life or death.”

Healthcare in general can be a “bigger honeypot” for ransomware attacks, said Sean Kelly, a former emergency room physician and current chief medical officer at Imprivata, a healthcare security company. No diagnosis or treatment happens without access to digital systems to check past medical history, allergies, other medications, and more, creating even more pressure to pay up. Plus, he said, a lot of people quickly change from station to station, needing to sign in and out of devices quickly and constantly.

“The stakes are higher and yet the budgets are lower, in healthcare, a lot of times,” Kelly said. “Ransomware attackers know that healthcare systems are valuable because a hospital can’t go down, and it’s really hard when they’re on downtime because patients suffer, systems suffer, there’s less billing, the finances go down, and care gets delayed or even can’t happen. So there’s more of a premium on that data because there’s healthcare data as well as financial and demographic data, so it’s worth more to ransomware attackers.”

Even beyond swarms of agents, AI makes it even easier for hackers to find these vulnerabilities and exploit them, through voice phishing attacks when calling help desks and other methods, Kelly said. And when an outage hits one hospital, it often leads to a “blast radius” that affects the other facilities in the area with longer wait times, diverted patients, and more.

“They just don’t have the IT staff or the budget to protect against a lot of the latest AI-driven efforts in hacking and ransomware and other cybersecurity attacks,” Kelly said. “It’s hard even with a large IT staff and with a big budget, but a lot of times, the rural hospitals are using older, more antiquated software systems and tech stacks that just have vulnerabilities.”

For small- and medium-size organizations, no matter the industry, their systems and cybersecurity defenses are already often more fragile than those of large corporations, particularly in an age when AI is increasing hackers’ manpower and supercharging cyberattacks.

“All it takes is one vulnerability somewhere,” Kelly said.

Muse sure looks a lot like OpenClaw

2026-09-25T10:42:05-04:00

We seem to be entering into an AI agent renaissance. Meta’s new consumer-facing AI agent, Muse, topped the App Store charts soon after its release and has 600,000 daily active users in the US, by an Apptopia estimate. And AI agent platform Instinct, whose eponymous creator is fundraising at a $2.5 billion valuation, has been making the rounds in the tech industry. Under the hood, though, there are some obvious similarities to the platform that started it all: OpenClaw.

For the past week or so, some social media users have alleged that Muse is directly built on OpenClaw. The two platforms use the same names for core files (SOUL.md, memory, tools, etc.), and have a lot of similar lines in the doc that governs personality, tone, and more (“Be genuinely helpful, not performatively helpful”). They also have a similar design. One Redditor argued that “Muse is just a wrapper app built on top of” OpenClaw — alleging it probably also came with that platform’s significant security risks. “Only non-tech ppl are buying the hype.”

Meta has denied the claims. Nat Friedman, head of product for Meta’s Superintelligence Labs wrote on X that Meta built Muse “from scratch.” He did, however, acknowledge Muse is “heavily inspired as a product” by OpenClaw. After he first used OpenClaw in January, he said, he purchased hundreds of Mac Minis for his team at Meta. And with Muse, he aimed to build a similar platform “that we could make safe and secure and easy to use and scale to billions of people.” As for why the OpenClaw file names and lines carried over, Friedman said the team believed that OpenClaw creator Peter Steinberger had gotten those things “exactly right.”

Instinct appears less directly derivative. But like OpenClaw’s then-revolutionary messaging features, it allows users to communicate with their AI agents directly through messaging tools, and people have been using it for the same types of everyday, personal-assistant-esque use cases that made OpenClaw gain traction. One Instinct user raved on X that the AI agent filled out paperwork for an in-network doctor visit, canceled subscriptions, organized a bachelor party, booked activities for a vacation, booked a DMV appointment, paid an outstanding toll bill, and more. Another said their Instinct agent handled the recovery of a lost item they’d left at a hotel in Canada.

Even if both platforms were built from scratch, it’s clear how much they owe to OpenClaw.

OpenClaw didn’t invent the concept of AI agents, but in just 10 months, it took them from a proof of concept to something genuinely useful. Cobbled together as a one-man weekend project and running off users’ personal computers, it conversed with users the way they talked to other people: on messaging platforms like WhatsApp, Telegram, Slack, Teams, or Discord. In about a week, it garnered two million visitors and 100,000 stars on GitHub, spurring people to buy Mac Minis to run their agents 24/7, inspiring someone to create a social media network for the AI agents to “chat” on, and sparking a series of in-person meetups around the world for OpenClaw users.

Major AI companies were already betting big on agentic AI, but none of their products had broken through like OpenClaw, and Big Tech took notice. In February, OpenAI hired Steinberger to work on agents for the company. In May, Google announced its consumer AI agent bets at its annual event. In June, Apple decided to go all-in on agents. In August, Instinct grew rapidly in its private beta and raised hundreds of millions of dollars. And in September, Meta introduced Muse. It’s fair to say that OpenClaw at least partially inspired all of them.

The real question isn’t whether products like Muse copied OpenClaw, but whether they improved it. As Friedman noted, one of OpenClaw’s only glaring issues was security. One of the top-downloaded skills on the platform contained malware, and by one researcher’s analysis (a since-removed post on Reddit), 15 percent of OpenClaw’s skill repository contained “malicious instructions” to secretly access user data or perform other suspicious tasks. By contrast, Zuckerberg wrote that Muse is “built from the ground up for privacy and security” and that user data and credentials are stored on the Muse Secure VM, an “isolated linux computer with a browser, CPU, memory, and storage.”

Right now, however, Muse may not improve security as much as it claims. Although user data is isolated from other users, Meta can still access it. The company said it plans to introduce a way “to cryptographically and verifiably prevent Meta from accessing data in your VM” later this year. Muse also defaults to letting Meta train and improve its models with user data, though users can opt out. And perhaps worst of all, a zero-day vulnerability flagged by a researcher on X this week allows anyone, with a simple attack, to hijack the agent, taking complete control. Instinct, for its part, has come under fire for criticism that its terms of service are overly broad, although the company seems to have adjusted them since.

Meta and Instinct’s most important evolution is, in actuality, just making AI agents more broadly accessible. One reason some people find Muse useful is its ability to integrate with Meta’s systems, even if they’re uncomfortable handing over all their data to the company. And Instinct allows users to chat with their AI agents via Apple’s default messaging product — significantly expanding the user base willing to try it out. While you can use both on dedicated local devices — and there are potential security benefits to that — it’s not the default option, also expanding the number of people willing to try them. At least for now, they’re less expensive than competing products like Google’s Spark, and although Instinct is still in beta, Muse’s one-tap downloading has overcome a lot of the friction tied to using OpenClaw.

In March, The Verge wrote that the OpenClaw user community sees the open-source AI agent as a “grassroots crusade and a noble pursuit, offering an escape hatch from an industry controlled by a handful of people at leading AI companies.” Now, those leading AI companies are putting up a fight.

Correction: An earlier version of this piece in one instance referred to Instinct as Insight.