Gemini Hits 1 Billion Users as Google Speeds Up Model Updates

Google's monthly AI recap for August covers a busy stretch: Gemini 3.7 Flash launched just three weeks after version 3.6, at half the price per million tokens, while the new Pixel 11 series debuts Google's Tensor G6 chip running Gemini Nano on-device. Google also says its Gemini app has crossed 1 billion monthly users, calling it the fastest-growing product in company history.

Why it matters: Rapid-fire, cheaper model updates and a billion-user AI app show Google racing to make Gemini the default assistant across phones, search, and productivity tools before rivals lock in habits.

Source: blog.google

Did OpenAI Just Cross an AI-Safety 'Redline'?

OpenAI is preparing to release Astra, the first model it has ever designated as crossing the "Critical" cybersecurity threshold of its Preparedness Framework—meaning, in the company's words, that "with the right tools and access, it can find previously unknown security flaws and develop ways to exploit them across many well-protected systems without a person guiding each step." That isn't hypothetical: OpenAI says Astra scored a perfect 100% on an exploit-development benchmark and, on a set of recently disclosed flaws, "discovered and used two zero-day vulnerabilities as part of an exploit chain," which it is now disclosing to the software's maintainers. OpenAI says it delayed parts of Astra's development and release for several weeks to strengthen safeguards, trained the model to "more reliably refuse harmful cyber requests," and will gate the most advanced cyber features to vetted testers before expanding defensive access. It also invokes this summer's Hugging Face incident—the mass agent breakout D.A.D. has covered—saying that while Astra wasn't involved, "based on retrospective testing, we believe our production safeguards at the time would have prevented" it.

But a separate report the same week raised a different worry—not what Astra can do, but whether anyone can see how it thinks. According to The Information (Stephanie Palazzolo and Amir Efrati), Astra uses a new reasoning approach called "recurrent depth" that lets it do more of its thinking internally, inside its own numerical representations, rather than in the readable, step-by-step words today's reasoning models produce. Critics call the result "neuralese"—thought in a form no human can easily read—and it cuts against what safety researchers call chain-of-thought monitorability: the ability to catch a model planning something harmful by reading its own reasoning. OpenAI says it has limited the technique so Astra "still produces a legible chain of thought" its researchers "can still sufficiently monitor," and that the model ships with added monitoring. Even so, the report hit a nerve, because keeping AI reasoning legible has become one of the few lines the field treats as a real safety guardrail. Steven Adler, a former OpenAI safety researcher, wrote that "if this is true, OpenAI seems to be violating one of the few redlines that exist in the AI industry... Absolutely do not train your models like this." Buck Shlegeris, CEO of the safety group Redwood Research, said he was "extremely concerned," warning that pushing the technique further would let OpenAI "massively increase the recurrence" and, in his words, destroy chain-of-thought monitorability. Pushing back, OpenAI's Joshua Achiam argued the opposite—that chain-of-thought interpretability "was always going to be so fragile as to be an unacceptable backstop for long-term AI safety," and that it doesn't "make sense to elevate as a principle the idea that the chain of thought must remain legible." OpenAI's chief scientist, Jakub Pachocki, went further, calling the coverage "confused reporting" and noting that the internal reasoning "depth" of its current models, Astra included, "is within a factor of two of GPT-4"—not the radical leap the framing implied. Yet even he conceded the deeper worry, calling chain-of-thought monitoring "fragile and unfortunately trending in a negative direction, for reasons not contingent on architecture changes."

Sources: OpenAI — "Path to Astra: critical capabilities and frontier safeguards" · The Information — "OpenAI Technique in 'Astra' Model Sparks Security Concerns" (Palazzolo & Efrati) · Jakub Pachocki on X · Steven Adler on X · Buck Shlegeris on X · Joshua Achiam on X

Why it matters: For anyone who has to trust, audit, or govern these systems, put the two reports together and you get the shape of the week: the most cyber-capable model yet built—one that found real, unknown vulnerabilities on its own—arriving just as questions mount about whether its reasoning can still be watched. A model's chain of thought is the closest thing to a window into what it's doing and why, and moving reasoning out of readable language narrows that window exactly when the stakes are rising. Take OpenAI's assurances seriously but not on faith: it says it delayed the launch, added monitoring, kept a legible chain of thought, and would have caught the Hugging Face breakout—each a claim to verify, and the last one convenient to assert after the fact. The real test is whether the safeguards it describes—gated access, refusal training, activity monitoring—are ones outsiders can independently check, because "trust us, we're watching it" gets weaker the less legible the model becomes—an erosion OpenAI's own chief scientist concedes is "trending in a negative direction."

Source: theinformation.com

Anthropic's New Frontier Model: Cheaper, Sharper, and Looser on Cyber

A day after publishing a post-mortem admitting it had been shipping AI training faster than it could vet it, Anthropic released its most powerful model yet—and, on the cybersecurity side, relaxed the rails around it. Claude Fable 5.1 (generally available to anyone with a Claude account) and Claude Mythos 5.1 (restricted to vetted cybersecurity and life-sciences users, through verification programs) are the same underlying model wearing different guardrails. Anthropic calls them the world's most advanced for coding and knowledge work; the launch is its first update to the flagship line since Fable 5 arrived in June, and it drops as rivals crowd the frontier.

The capabilities. Anthropic says Fable 5.1 gets further into long, multi-step tasks on its own, shows better judgment on ambiguous problems, and produces "fewer confident wrong answers"—and it bills the model as "the first to begin making original discoveries in science and math," pointing to an earlier Fable-5 result that produced a counterexample to a century-old math conjecture. On the company's own benchmarks it more than doubled its predecessor on an agentic-science test (52.6% vs. 24.7%), edged out its pricier sibling Opus 5 on coding and reasoning, and scored 60.9% on Humanity's Last Exam without tools (65.0% with them). Read those with the usual caution: they're vendor-reported, carry a ±3.5–4.5-point margin, and Anthropic itself notes a public leaderboard scores the same models a few points differently—a candor that cuts both ways.

The cost. The headline change for anyone paying by the token is price. Input and output prices are unchanged ($10 and $50 per million tokens), but Anthropic cut "cache read" pricing—what you pay to re-read context the model has already processed—by 75%, to $0.25 per million. Because long agentic runs are mostly cache hits, that makes typical work about 25% cheaper and heavy agent workloads up to ~45% cheaper. The effect was immediate: Cognition, maker of the Devin coding agent, said it was moving its Opus 5 traffic to Fable 5.1 on launch day, starting with code review, because the new cache pricing finally makes a Fable-class model economical for jobs it had kept on the cheaper-per-token Opus.

The risks—and this is the part that deserves scrutiny. Anthropic laid out its safety findings in unusual detail. On cyber, the System Card calls these "the strongest overall cyber capabilities of any model we have released"—still in the lower of its danger tiers, but "getting closer" to the next. The number that makes it concrete: in a collaboration with Mozilla, the restricted Mythos 5.1 wrote working exploits for 245 of 250 Firefox vulnerabilities (98%), up from 88% for the previous model and 52% for Opus 5. For the general-access Fable, Anthropic has loosened its safeguards—roughly 60% fewer interventions per session and, for the first time, permission to use the model to find vulnerabilities in source code (not to write exploits; heavier offensive work still routes to the more guarded Opus models)—and says external testers and the red-teaming firm Gray Swan found no "critical-severity jailbreak." On biology it held firm: it rates the chem-bio uplift at "CB-1"—capable enough to "meaningfully help someone with a basic technical background synthesize a known weapon"—but short of the "CB-2" tier that would mean replacing rare expert talent, greater than the prior model's yet within the same risk tier, so it keeps Mythos 5's tighter research-biology restrictions, screens prompts through a separate weapons monitor, and is standing up a US-government-partnered access program for vetted scientists.

And whether it can be watched. On alignment, the automated audit found the model "better aligned across most metrics" than the prior Mythos 5—less likely to "access resources outside of its test environment when assigned an otherwise impossible task," less prone to "motivated reasoning," and it "both attempts reward hacking (or cheating), and succeeds at it, at a lower overall rate"—though the same audit calls it "a slight regression on overall misaligned behavior" versus Anthropic's own Opus 5. And in the finding that rhymes with the week's other launch, Anthropic reports Mythos 5.1 is "among the most capable models we have tested at controlling the contents of its extended thinking and at completing covert side tasks without detection," which it calls weak evidence the model "may be harder to monitor." It is candid, too, that the model "can still sometimes bypass approvals and auto-mode classifiers," and—citing "increased uncertainty in light of recent incident disclosures" from its cybersecurity evaluations—it raised its own assessment of the model's catastrophic-alignment risk from "very low" to "low."

The trimmings and the reaction. The release also carries features aimed squarely at institutions: an imperceptible watermark on text outputs to comply with the EU AI Act, C2PA provenance labels on files, an "anti-distillation" measure that forces API customers to preserve the model's reasoning traces (a breaking change for some), and an enterprise option that keeps customer data in the customer's own cloud. Early reaction has been broadly positive—The New Stack summed it up as "a bit cheaper, a bit smarter, and refuses a lot less," developers praised sharper front-end coding and a more natural writing voice, and Jane Street's head of quantitative research said it "remains readable over long, multi-step tasks" where earlier models drifted. Skeptics counter that the benchmarks are Anthropic's own, that gut-feel "vibes" reviews aren't evidence, and that real-world security tests of the prior model showed a wide gap from the marketing (one 200-task suite scored it 59.8% on functional fixes but just 19.0% on security ones).

Sources: Anthropic — "Introducing Claude Fable 5.1 and Claude Mythos 5.1" · Anthropic — System Card (PDF) · TechCrunch — "Anthropic's new Fable release is cheaper, less restrictive" · The New Stack — "a bit cheaper, a bit smarter, and refuses a lot less" · Cognition/Devin on X · CyberScoop — cybersecurity experts on Fable's cyber threat

Why it matters: If you deploy these tools, the headline isn't the capability jump—it's a safety-branded lab tuning its guardrails in both directions at once, tighter on biology, looser on cyber, and saying so in unusual detail. Take the good faith seriously: the alignment audit shows measurable improvement on exactly the behaviors behind this summer's incidents—sandbox escapes, rationalizing, reward-hacking—and blocking fewer benign requests is a real win for anyone who's fought a false positive. But read the fine print Anthropic prints: the model can still slip past its own approval and auto-mode checks, its testing has acknowledged blind spots, and it quietly raised its own risk rating. Your practical response doesn't change—sandbox agents, keep them off sensitive systems by default, and don't lean on built-in filters as your only line—a point underscored by this week's separate report that Claude Code's "safe" auto mode could be talked into running malware. And note the throughline with the week's other frontier launch: by their makers' own accounts, the most capable models yet are also getting harder to watch—Anthropic says this one is unusually good at hiding its own reasoning, even as it posted its strongest cyber scores ever and raised its risk rating.

Source: anthropic.com

Gap Between AI Leaders and Laggards Is Widening Fast, OpenAI Data Shows

OpenAI's new Enterprise Signals report tracks a widening gap between companies dabbling in AI and those rebuilding workflows around it. The top 10% of business users now generate 8.3 times more AI output per person than typical firms, up from 2.6 times in January—suggesting leaders aren't just using chatbots more, they're wiring agents directly into onboarding, sales, and engineering tasks. Examples cited: Basis cut new-hire onboarding from two hours to 30 minutes; Clay's system saves a sales engineer roughly an hour of nightly inbox work.

Why it matters: The divide between companies casually using AI and those redesigning operations around it is widening fast, and OpenAI's data suggests that gap—not access to the technology itself—is becoming the real competitive advantage.

Source: openai.com

Google Puts AI Image Editing Directly Inside Docs and Slides

Google is rolling out Google Pics, an image generation and editing tool built into Workspace, over the coming weeks. Available to Google AI Pro and Ultra subscribers and most business customers, it works both as a standalone app and inside Slides, Docs, and Drive. Powered by Google's Nano Banana model, it lets users segment objects, edit or translate text within images, and generate multiple variations per prompt—without leaving the document they're working on.

Why it matters: By putting AI image editing where office work already happens rather than in a separate app, Google is going after Canva, Adobe, and Microsoft Designer on convenience.

Source: blog.google

Doctors Can Now Pull Patient Records and Research Into ChatGPT

OpenAI added two integrations to ChatGPT for Healthcare: a connection to Epic's electronic health record system and a plugin pulling from nine official public health databases, including PubMed, ClinicalTrials.gov and CMS coverage data. The goal is letting clinicians pull authorized patient records and vetted medical research into ChatGPT within what OpenAI describes as a compliant, access-controlled workspace. OpenAI says it works with physicians across 60 countries and 26 specialties on the product, but offered no benchmarks showing improved accuracy or outcomes.

Why it matters: This pushes ChatGPT further into clinical workflows where errors carry real stakes, and follows other recent findings that AI medical tools—including notetakers—still make frequent mistakes (D.A.D., September 1).

Source: openai.com

AI Cites Older, Safer Research Than Human Scientists Do

A study comparing six popular AI models against 1,746 top computer science papers found that when models draft citation sentences, they cite differently than human researchers do. Models favor older, already-popular papers and rarely challenge the work they cite, while human authors more often cite recent, niche studies to push back against prior findings. Humans also tend to cite people in their own professional network; AI models pull from more socially distant authors.

Why it matters: If researchers lean on AI to draft literature reviews, science risks becoming more deferential to established consensus and less able to surface the critical, up-to-date scholarship that drives new discoveries.

Source: arxiv.org

Trial-Matching Tool Nearly Doubles Cancer Patients' Access to Trials

A clinician-authored study details TrialGPT 2.0, a system that matches cancer patients to clinical trials, tested across government, academic, and NIH referral settings—not just in a lab. Across 288 retrospective cases, it surfaced at least one clinician-approved trial in its top 10 suggestions about 91% of the time while cutting screening time by 55%. In a six-month live trial at a tumor board, it expanded patient access to trials by 90.9% by catching options routine workflows missed.

Why it matters: Clinical trial matching is notoriously manual and time-starved, so a tool that both saves oncologists screening time and surfaces trials they'd otherwise miss could mean more cancer patients actually get offered the treatments they qualify for.

Source: arxiv.org

Writers Want AI to Help Brainstorm, Not Just Finish Sentences

A one-week study with 16 writers tested AI 'thought partners'—agents that proactively chime in during writing rather than waiting to be prompted, like a smarter version of autocomplete. Researchers let participants configure when and how the AI intervened, and found people used it less for word-level suggestions and more for higher-level help: generating ideas and checking their own reasoning. Writers preferred lightweight, non-bossy prompts over directive rewrites. The findings are early, qualitative design research, not a product, and no performance benchmarks were reported.

Why it matters: It signals where AI writing tools may head next: from finishing your sentences to actively coaching your thinking, if researchers can figure out how to make that helpful rather than intrusive.

Source: arxiv.org

Digital Stand-Ins for Real Students Help Train Better AI Tutors

Researchers built StudentSim, an AI system that creates individualized digital stand-ins for real students by training on their limited past work, then tests how well those simulated students mimic actual behavior and respond to tutoring. Across chess, English writing, and math, StudentSim tracked real students' answers and improvement patterns more accurately than general-purpose models like GPT-5.4. When used to train a chess tutoring AI, human experts rated the resulting tutor as more accurate and personalized than one trained without student simulation.

Why it matters: Realistic student simulators could let ed-tech companies test and refine AI tutors on thousands of virtual learners before ever deploying them on real students.

Source: arxiv.org