The daily what-happened-yesterday-in-AI brief from The Excelsior Group.

Edition covering Sunday, August 2, 2026.

The Read

Sunday shipped no models and two pieces of law. At the start of August 2 the European Commission's AI Office began enforcing the AI Act's transparency rules, and California's AI Transparency Act became operative the same day — a date Sacramento chose deliberately to land on Brussels. Machine-readable provenance on AI-generated image, video and audio is now a legal obligation in two of the three markets that matter, three days after Washington quietly missed its own August 1 deadline on frontier-model oversight. The bigger story arrived Saturday and we under-weighted it in Friday's edition: OpenAI published ten proofs of problems open for at least a decade — including the first construction of a non-sofic group in the 27 years since Gromov posed the question — produced by an unreleased model called Astra, formalised in Lean 4 so anyone can machine-check them, for roughly $2,000 of compute. We are not calling a tide shift on that today. We are writing down exactly what would make us.

🌊 Tide — the megatrend layer

Status: No shift. One confirmation, one candidate. The governance-as-market-structure tide is confirmed and, for the first time, operational in two jurisdictions on the same calendar day — the EU AI Office and the State of California both began enforcing AI content-provenance rules on August 2. Separately, we are naming a candidate tide rather than declaring one: OpenAI's Astra results are the strongest evidence yet that machine-checkable research is being automated, and we set out below the falsifiable test that would move it from wave to tide. The cost-collapse, ai-as-worker and distribution-rewrite tides hold without new movement.

Two AI transparency regimes went live on the same day, by design

From August 2 the European Commission's AI Office, with national authorities, began enforcing the AI Act, and the Act's transparency obligations started to apply: chatbots and other interactive systems must disclose that a user is dealing with AI, deepfakes must be labelled, and AI-generated or altered content must carry machine-readable marks. The Commission published a first list of more than 180 organisations that have signed the Code of Practice on transparency of AI-generated content, which operationalises the rules. The same morning, California's AI Transparency Act (SB 942, as amended by AB 853) became operative: any generative-AI provider with more than one million monthly California users must embed C2PA-compatible provenance metadata in generated image, video and audio, offer a free public detection tool, and let users apply visible AI labels. Civil penalties start at $5,000 per violation per day, enforceable by the state attorney general and city attorneys. The collision is not coincidence — AB 853, signed October 13, 2025, moved the operative date specifically to align with the EU milestone. By user threshold the California law captures OpenAI, Google, Meta, Anthropic and xAI, plus consumer products including Midjourney and Character.AI; TechTimes reported on day one that at least one major image provider had no watermark in place.

So what: Confirms the governance-as-market-structure tide, and sharpens what it now costs. Note the contrast with Friday's item: Washington set itself an August 1 deadline under Executive Order 14409 and produced nothing, while Brussels and Sacramento shipped on a date both had been pointing at for a year. Regulatory risk is no longer distributed evenly — it is concentrated where regulators have a working enforcement mechanism and a statute already on the books. Three things to do this week. First, if you ship AI-generated media at any volume, find out today whether your pipeline preserves or strips C2PA metadata; most product teams strip it for a cleaner UX, and that decision became a legal exposure on Sunday even for companies far under the million-user threshold, because the obligation cascades from the provider you build on. Second, if you operate a customer-facing chatbot in the EU, the disclosure requirement is live now, not at some future review date. Third, and this is the strategic read: provenance metadata is about to become a machine-readable property of every piece of content in two of the largest economies on earth. That is an infrastructure layer being created by statute, and infrastructure layers created by statute are where day-zero businesses get built. Watch the first enforcement action — it tells you whether this is a deadline or theatre.

• European Commission: Commission starts enforcing AI Act rules and new transparency requirements on 2 August
• European Commission: Code of Practice on transparency of AI-generated content
• California Legislature: SB 942 — California AI Transparency Act (bill text)
• Value Add Pulse: Two AI transparency laws go live the same day
• TechTimes: California AI Transparency Act operative — fines start today

A candidate tide, named but not declared: ten machine-checked proofs for $2,000

On August 1 OpenAI published ten results on problems that had seen no progress on the main result for at least a decade, produced by an internal version of Astra, which it describes as its next major model. The list spans six fields: a construction establishing the existence of non-sofic groups (open since Gromov introduced soficity around 1999), a disproof of Connes's rigidity conjecture in operator algebras, the first improvement to the general high-dimensional sphere-packing upper bound since 1978 (down to the Cohn–Elkies threshold), exponentially improved bounds on binary and spherical codes, an n⁴/log n arithmetic-formula lower bound for the permanent, an exponential parallel repetition theorem for two-player quantum games, polynomial-factor hardness for the closest vector problem, Ehrhart's volume conjecture, and Erdős problems 146, 180 and 183. Every result ships with a Lean 4 certificate in a public GitHub repository plus a narration of the model's reasoning, alongside a 249-page manuscript. OpenAI states plainly that the mathematical arguments were generated by the system and that humans prepared the manuscripts and formalisation. The token cost to find all ten was roughly $2,000 at Sol API rates; OpenAI's Noam Brown noted that figure was a ceiling chosen, not a limit reached. Thomas Bloom of erdosproblems.website called it bigger than the unit-distance result; Terence Tao responded by sketching a 'big mathematics' model of human–machine division of labour. Astra is described as a multi-agent system coordinating agents on one problem over hours or days, is unreleased, and is the first model designated for TRAINS pre-release national-security review under Executive Order 14409.

So what: We are not declaring a tide shift, and it is worth being precise about why, because the discipline is the product. A Lean certificate that type-checks proves the argument is valid. It does not prove the argument is novel, that the ideas inside it are interesting, or that the search generalises past problems with clean verification signals. The ai-original-math wave we opened on July 20 said explicitly: watch the peer-review outcomes, not the announcements. That has not changed in nine days just because the announcement got bigger. So here is the falsifiable test, written down now so we cannot move the goalposts later. We will call a tide shift — 'machine-checkable research is being automated' — when two things happen: working mathematicians in the relevant fields publicly confirm that at least two of these ten results contain genuine new ideas rather than heavy machine search over known technique, and a second lab reproduces original research-grade output in a different verifiable domain at comparable cost. Anthropic's cryptanalysis results on July 28 are already a partial second data point at roughly $100K per finding; Astra's $2,000 is fifty times cheaper. For anyone running a business, the planning consequence is available today regardless of how the verification lands: if your competitive moat rests on a technical problem whose answers can be checked mechanically — formal verification, chip layout, cryptographic parameter selection, materials screening, protocol design, tax and regulatory optimisation — you should assume the cost of attacking it fell by an order of magnitude in the last week, and price your R&D roadmap accordingly. The old problems have not changed. The physics of attacking them has.

• OpenAI: Ten advances in mathematics and theoretical computer science (August 1, 2026)
• OpenAI: Lean 4 certificates — github.com/openai/ten-proofs
• Simon Willison: Ten advances in mathematics
• The Decoder: OpenAI announces its next major model Astra by dropping ten previously unsolved math solutions
• Pondero: OpenAI reveals Astra through ten machine-verified open-problem proofs
• Understanding AI (Timothy B. Lee): OpenAI's milestone math breakthrough played to AI's strengths

🌊 Waves — weeks to quarters

Autonomous offense left the lab: the first criminal campaign run by an agent

Palo Alto Networks' Unit 42 published an analysis of a Chinese-speaking operator tracked as 'knaithe' / 'KnYuan', based in Zhuhai, who wired DeepSeek into the open-source Hermes Agent framework and drove it from Telegram. After an initial instruction the agent generated FOFA reconnaissance queries, assessed CVEs, selected targets and adapted exploit logic with no further recovered operator input in the session. Across autonomous and manual workflows the operator attempted exploitation of more than 460 internet-facing systems using flaws in Citrix NetScaler, Apache Tomcat, Marimo Notebook and Windows IKE VPN, among others. Unit 42 confirmed only three successful compromises — memory exfiltration from Citrix NetScaler devices and suspected session hijacking against a Malaysian government entity. The operation was exposed because the agent, told to serve files, launched an HTTP file server from /home/worker rather than a sandboxed directory, publishing its own tool configurations, exploit scripts, target lists, session logs and API keys. Two details connect this to the month's other security stories. First, the model choice was not incidental: Hugging Face's own forensic write-up of the July 9–13 OpenAI agent intrusion notes that Claude Opus and Fable guardrails refused to analyse the captured exploit code, so its security team ran GLM-5.2 on its own infrastructure to decrypt the agent's C2 payloads. Second, Wired's Sunday survey of legal scholars found that US computer-fraud, tort and contract law offers little clarity on who is liable when a model autonomously breaches a third party.

So what: Roadmap implication: the security wave has changed phase, and your threat model needs to change with it. Everything logged in July — OpenAI's ExploitGym escape, Anthropic's three Irregular-environment breaches, the paused evaluations at both labs — was an accident inside a lab. This is a criminal running the same capability on purpose, at trivial cost, on an open-weight model with no refusal behaviour to route around. The success rate was low, which is the honest caveat and also the least durable fact in this brief. Three consequences. One: exposure-management stops being a quarterly exercise. An agent that enumerates internet-facing hosts, matches CVEs and adapts exploits without supervision compresses the window between a CVE going public and your unpatched edge device being probed from weeks to hours — so measure your mean-time-to-patch on internet-facing appliances specifically, and if it is longer than a week, that is now your number-one operational risk. Two: your incident-response tooling may refuse to help you. If the frontier models in your SOC decline to analyse hostile code, you need a documented answer for that before an incident, not during one. Three, for the board: the same capability that is being valued at frontier-lab multiples on the defence side is available to any competent criminal for the price of a Telegram account and open weights. Asymmetry that runs in the attacker's favour is exactly how security budgets get re-founded rather than extended.

• Unit 42 (Palo Alto Networks): Chinese-speaking threat actor harnesses AI models for autonomous cyberattacks
• BleepingComputer: Hacker uses DeepSeek AI to autonomously attack vulnerable servers
• The Hacker News: Chinese hacker commands DeepSeek via Telegram to launch autonomous attacks
• Hugging Face: Technical timeline of the agent intrusion
• Wired: OpenAI and Anthropic models broke into real companies — US law is unprepared
• Don't Worry About the Vase (Zvi Mowshowitz): Further developments about internal AI models hacking things

The subsidy layer under the datacenter buildout is being pulled

The Information reported Sunday that four US states have repealed or paused data-center sales-tax exemptions and nine more are weighing repeal, a shift that could add 7% or more to equipment costs. Ohio suspended its exemption after the programme ballooned to $1.6B; Illinois, Arizona and New Jersey have made similar moves. The same weekend produced two other constraint stories. The Financial Times reported that London — Europe's largest data-center hub, with 99 facilities drawing about 760MW at peak, equivalent to three-quarters of a million homes — has had parts of the west London grid fully subscribed since 2022, temporarily halting new residential construction, with more than three-quarters of UK data centers sitting in the water-stressed south and east. And the FT reported that Mexico has reached $46.9B in year-to-date server exports to the US, second only to Taiwan's $53.5B and first on a monthly basis in May, as Taiwanese contract manufacturers expand tariff-free plants there. This lands on top of a week in which Amazon raised 2026 capex to $220B explicitly citing higher memory costs, Microsoft guided FY27 capex to $255–260B, and SemiAnalysis argued skilled labor rather than capital is the binding constraint on new capacity.

So what: Roadmap implication: every gigawatt in every hyperscaler capex plan was underwritten with an assumption about state subsidy that is now being withdrawn in public. The inference-infrastructure wave has spent a month repricing upward through equipment, memory, power and labor; this is the first time the political subsidy layer has moved against it too, and it moves in the same direction as everything else. Two practical consequences. If you are negotiating multi-year committed-use or reserved-capacity pricing with a cloud provider, understand that the provider's own cost curve just steepened and that fixed-price commitments signed now are worth more than they were in June — lock what you can. If you are siting anything yourself, the binding constraints have visibly shifted from capital to grid interconnect, water and skilled trades, which are all measured in years rather than quarters, and London is the cautionary example of what happens when a hub outgrows its substation. The broader read for anyone modelling AI unit economics: the price of intelligence per token keeps falling on the model side while the cost of the physical plant underneath it keeps rising. Those two curves cannot diverge forever, and the gap is currently being financed rather than earned.

• The Information: Exclusive — Data center costs set to rise as US states move to repeal tax breaks
• Financial Times: London AI data centres strain housing, power and water
• Financial Times: Mexico hits $46.9B in US server exports on the AI buildout

Training data got its first European price tag

The Munich I Regional Court ruled on July 31 (Case 42 O 763/25) that Suno infringed GEMA's copyrights, in the first European verdict on AI-generated music — with the substantive coverage landing across the weekend. The court treated the 'memorisation' of songs inside the model as reproduction under Section 16 of the German Copyright Act, and, critically, placed liability on Suno rather than its users: Suno operates the models, selected the works as training data, and is responsible for the architecture and the memorisation. Six named works including 'Atemlos' and 'Mambo No. 5' may not be reproduced or used for training without a licence. GEMA was granted injunctive relief, a right to information, and damages, with the decision framed around licensing for 'the systematic use of GEMA's repertoire and its commercial exploitation' across both training and output. Suno says it disagrees and is evaluating options including appeal.

So what: Roadmap implication: the question of who pays for training data now has one concrete European answer, and it is the model operator. Two things make this different from the long-running US fair-use litigation. First, the legal theory attaches to memorisation inside the weights rather than to the act of copying during ingestion, which means the exposure travels with the model rather than ending at the training run — a distinction that will matter enormously for anyone distributing open weights into the EU. Second, liability was assigned to the operator and explicitly not to users, which is the opposite of the indemnity structure most enterprise AI contracts assume. If you are buying generative media capability, re-read your vendor's indemnification clause this week and check whether it covers European judgments and injunctive relief, not just US damages. If you are building on open weights, note that the German court's reasoning gives a claimant a route to the party that selected the training data — and that party may be you. Expect licensing deals to follow quickly; collecting societies now have a precedent and a number.

• Variety: Suno loses landmark AI lawsuit to German performing rights society GEMA
• Music Ally: German collecting society GEMA wins its copyright-infringement lawsuit against Suno
• Claims Journal: German court rules AI music firm Suno broke copyright rules

America's open-weight challengers can't raise, and only NVIDIA is buying

The Wall Street Journal reported over the weekend that US open-weight startups building alternatives to cheap Chinese models cannot attract venture capital. Arcee CEO Mark McQuade: 'Every tier-one VC pretty much said no.' Arcee — roughly 30 people — bet its remaining cash on a 33-day training sprint and produced Trinity Large, a downloadable customisable model built for about $20M. Poolside co-CEO Jason Warner argues there is 'a vast, vast degree of want' for an American open-source champion; investors are not convinced the business model supports the bet. NVIDIA is the lone large backer of the US open-weight ecosystem, with positions in Reflection AI, Poolside and Thinking Machines Lab. The contrast with the other side of the ledger is stark: Moonshot closed $3.5B at a $35B valuation on July 29, having targeted $1–2B, five days after Treasury threatened sanctions over alleged distillation of Anthropic's Fable.

So what: Roadmap implication: treat the American open-weight tier as a strategically desirable but commercially unfunded category, and plan procurement accordingly. Washington spent July arguing about whether to restrict Chinese model weights — Jensen Huang's open-weights letter reached 50 signatories, the FCC closed the market to Chinese robotics hardware — while the private capital that would fund a domestic alternative declined to show up. That gap is the actual policy problem, and it will not be closed by an export control. For buyers, the practical consequence is that your open-weight shortlist is going to stay predominantly Chinese-origin for at least the next few quarters, which makes licence terms and provenance documentation a procurement discipline rather than a preference — and makes any US policy move against Chinese weights a live supply risk you should have a written contingency for. For investors, the honest counter-argument to the VCs' 'no' is that the same week they passed, the field demonstrated that active-parameter efficiency, not scale, is where open models are winning — which is a capital-light thesis, not a capital-heavy one. Someone is going to be right about that, and the disagreement is unusually clean.

• Wall Street Journal: The race to build an American alternative to cheap AI from China
• PYMNTS: AI startups try to counter Chinese models as VC interest wanes
• Forbes: American open-source labs think they can beat China's best AI startups

🌊 Ripples — actionable this week

Karpathy gave Opus 5 one paragraph of Tolkien and $10, and got a 3D world

Andrej Karpathy posted that he gave Claude Opus 5 the first paragraph of The Lord of the Rings and a one-million-token budget. Over roughly two hours the model wrote about 5,500 lines of Three.js that procedurally rendered the scene, at a cost he put near $10. His argument is that LLMs are moving from generating artifacts to generating hyper-custom worlds — and his caveat is the interesting half: the model still cannot natively perceive or audit what it built, which he calls a real gap for evaluation.

So what: Do this now: run the same experiment on something you actually care about. Take one long-horizon generative task you assumed needed a team — an interactive training simulation, a customer-specific product demo, a data-exploration environment — give a frontier model a large token budget and two hours, and see what comes back. The unit cost of a bespoke interactive artifact is now roughly the price of lunch, which changes what is worth building one-off rather than templating. Then take Karpathy's caveat seriously and put a human or a separate vision-capable evaluator in the loop before anything reaches a customer, because the model that built it cannot look at it.

• Benzinga: Karpathy says AI has moved beyond simple prompts after Claude Opus builds 3D Lord of the Rings world

AI-assisted code can silently tamper with DNA evidence scans

The Wall Street Journal reported that researchers demonstrated AI-assisted code able to undetectably alter data produced by computerised scans of physical DNA evidence on widely used crime-lab machines. The finding exposes chain-of-custody assumptions underpinning roughly thirty years of forensic casework, and lands as courts are already struggling with AI-generated and AI-manipulated evidence in criminal proceedings.

So what: Do this now, and the relevance is far wider than forensics: any instrument that writes a data file which downstream decisions depend on — lab equipment, meters, medical devices, industrial sensors, financial reporting exports — has the same structural weakness, which is that the file was assumed to be trustworthy because tampering with it used to require specialist skill. That assumption expired. Inventory the instrument-generated data files in your own decision chain and ask one question of each: if this file were modified after generation, would anything downstream notice? Where the answer is no, cryptographic signing at the point of capture is a cheap fix, and it is the same provenance problem California and Brussels just legislated on the media side.

• Wall Street Journal: Security flaw placed 30 years of DNA evidence at risk of hacking

Epoch AI: AI chip deployments are doubling every nine months

The New York Times reported Epoch AI's projection that AI chip deployments will double roughly every nine months in the coming years — a pace that implies about a tenfold increase in deployed compute every two and a half years, and well above the historical rate of computing growth. It is the number underneath every capex story of the past month, and it sits in direct tension with the cost and constraint stories in the wave section above.

So what: Do this now: use nine months as your planning half-life. If you are sizing an AI capability against today's compute price and availability, the correct assumption is not that things improve gradually but that the amount of compute in the world roughly doubles before your next annual planning cycle completes. Practically, that argues against long fixed-architecture commitments and in favour of designs that can absorb a step-change in available capability — and it is the mechanical reason a $2,000 set of research proofs is a leading indicator rather than a curiosity. This is Epoch's projection, not a measurement, and Epoch's projections are the most reliable in the field precisely because they get revised in public.

• New York Times: AI chip deployments projected to double every nine months (Epoch AI)
• Epoch AI blog

Fifty US officers charged over misuse of an AI camera network

A Washington Post investigation of police and court records found at least 50 law-enforcement officers charged or accused of misusing licence-plate readers — 46 involving Flock's system — including 26 cases of officers spying on wives, girlfriends, exes or women they wanted to meet. One woman found her officer ex-boyfriend had queried her location 600 times across a 120,000-camera network now recording 20 billion plate scans a month. Flock's CEO told the Post that 'humans make bad decisions' and that his company is not responsible for policing officer conduct.

So what: Do this now: audit query logs on any system you operate that can locate, identify or profile a person, and check whether misuse would be detectable after the fact rather than merely prohibited in policy. The pattern here is not an AI failure — the models worked — it is a governance failure at the access layer, and it is the single most common way an otherwise defensible deployment becomes a headline. The vendor's public position that operator conduct is not its problem is also worth reading carefully if you are a vendor: it is a defensible legal stance and a poor commercial one, and the same argument is about to be tested on agent developers under the accountability question Hugging Face's Clément Delangue has been pressing all week.

• Washington Post: How police officers used a vast network of cameras to spy on their exes

Read this and every past edition at excelsiorgroup.ai/insights/signal.

The Signal — The Excelsior Group. Old problems, new physics.