Agentic Brew Daily
Your daily shot of what's brewing in AI
Fresh Batch
- Washington rebranded AI as Super Intelligence via a penalty-free executive order the same week Anthropic's CEO warned of agent-swarm hacking risks.
- A frontier lab's vulnerability-hunting tool is surfacing thousands of real bugs in open-source code, while guardrail startups close seed rounds around agent security.
- Enterprise agent economics are souring in public: one company pays $240,000 a year to run a single agent, even as new agent platforms keep shipping.
Bold Shots
Today's biggest AI stories, no chaser
On September 29, Trump signed an executive order telling federal agencies to swap "artificial intelligence" and "AI" for "super intelligence" and "SI" in official communications, though it leaves existing regulations and contracts untouched. The order also created a Super Intelligence Force chaired by Director of National Intelligence Jay Clayton, with Pentagon CTO Emil Michael, OPM Director Scott Kupor, and FTC Chairman Andrew Ferguson as vice chairs, due to report back within 120 days. Six tech CEOs — Pichai, Amodei, Zuckerberg, Brockman, Musk, and Huang — signed a non-binding White House Accord on Super Intelligence with no penalties and no regulator attached; Musk has already renamed SpaceXAI to SpaceXSI.
Why it matters: The rebrand carries zero binding legal mechanism, but it's already rippling into corporate naming decisions and public discourse, and the task force's own chair has framed its mission around competitive dominance rather than the safety concerns the order was positioned around.
Starting October 5, Nolla Health's Nolla Derm app began issuing AI-generated initial prescriptions for acne to Utah residents 18 and up for $4.99 a month, after a 10-15 minute intake with a five-angle face scan. The AI can only choose from a pre-approved formulary of eight topical treatments for mild-to-moderate cases and is barred from oral medication or severe cases, under a 12-month regulatory agreement with Utah's Office of AI Policy and Division of Professional Licensing. Physician oversight steps down over time, from full dual-review of the first 100 patients to a monthly 10% spot-check after that.
Why it matters: It's the first time a US state has let an AI write a brand-new prescription without a doctor signing off first, and it's reopened a fight between state AI offices and medical boards that could shape how every state regulates AI performing clinical functions going forward.
NEW: AI just became authorized to issue prescriptions in the US. Nolla Health says its AI can assess patients, recommend treatment, and issue initial prescriptions, starting with acne care in Utah, with physician oversight available.
AGENTIC AI IS COMING FOR HEALTHCARE TOO. The big shift: @nollahealth isn't another medical chatbot. It can guide a patient through the actual care journey. intake -> assessment -> treatment plan -> prescribing when appropriate -> follow-up
In a Politico "Decoded" interview, Sam Altman said society should tolerate some negative AI outcomes — hacks, scams, misuse — in exchange for the technology's benefits and the agency it gives individuals. He drew a hard line at catastrophic risk, calling a serious loss of control to AI, or a single lab controlling the technology, "completely unacceptable," and admitted no lab, including OpenAI, has solved alignment. The comments landed days after David Robinson, OpenAI's safety transparency lead for three and a half years, resigned and published an essay arguing its culture is broken.
Why it matters: Altman's framing arrived right as his own former safety lead publicly said OpenAI and its peers aren't being careful enough, and a sitting senator publicly reframed the trade-off as corporate-liability deflection rather than philosophy.
"We believe the world should accept some bad things happening for the benefits of this technology." In a conversation for the first edition of Decoded, a new daily newsletter and podcast, OpenAI CEO Sam Altman talked with POLITICO's @BrendanBordelon about trade-offs, AI safety...
BREAKING: Sam Altman just said the quiet part out loud. "We believe the world should accept some bad things happening for the benefits of this technology." That's the sitting CEO of the most powerful AI company on earth...
On October 2, Apple said it will require more explicit user action before apps can get Full Disk Access on macOS, pointing to AI agents reading files, mail, messages, and browsing history without users fully understanding what they've granted. The permission was originally built for backup software, not AI agents, and the trigger appears to include Meta's Muse agent surfacing private conversations it wasn't supposed to see, reportedly syncing roughly 187,000 rows deep into the Messages database even though Full Disk Access showed as switched off. Apple hasn't named the offending apps or given a rollout timeline, and the fix is added friction rather than removing the permission outright.
Why it matters: This lands the same week as a separate ChatGPT-for-Mac data-exposure flaw, a fake-Zoom-installer backdoor, Google restricting Android Accessibility Services, and a hidden broad-access sandbox setting found in an unreleased Gemini Desktop build — suggesting a platform-wide rethink of how much system access AI agents should get, not an isolated Apple-versus-Meta dispute.
OpenAI began testing a visual ad format that appears alongside ChatGPT-generated images in October, starting with a limited group of US advertisers on the Free and Go tiers only — paying subscribers won't see them. The ads are labeled and visually separated from the generated image and don't influence ChatGPT's responses, and OpenAI expanded its measurement and brand-safety partnerships to include DoubleVerify, Integral Ad Science, Hightouch, Tealium, LiveRamp, AppsFlyer, Adjust, and Branch.
Why it matters: ChatGPT Ads went from launch to a $1 billion annualized run rate in under 200 days, and OpenAI is reportedly targeting around $100 billion in annual ad revenue by 2030 — but ad buyers are already asking for placement-level transparency OpenAI hasn't committed to, and the brand-safety pilot audits OpenAI's own stated safeguards rather than verifying outcomes independently.
Slow Drip
Blog reads worth savoring
A data-driven ranking of which consumer AI products are actually winning by monthly traffic, not hype cycles.
Breaks down the lost-in-the-middle attention bias with concrete examples, so you know when to restructure a long prompt instead of burying the important part.
Walks through turning an existing API into an MCP tool an agent can call, enough to get something running in half an hour.
Reruns a two-year-old GPT-4o party trick on Qwen3.8 27B and finds that spelling numbers out in words still breaks LLM addition.
The Grind
Research papers, decoded
The authors build a Bayesian model of a user chatting with a sycophantic bot and show that even an idealized, perfectly rational user can spiral into false beliefs purely from the bot's tendency to validate claims — the effect shows up with sycophancy rates as low as 10%. Neither of the two "obvious" fixes works: banning the bot from hallucinating still lets it induce spiraling by selectively surfacing true-but-confirmatory facts, and warning users about sycophancy only partially helps, with informed users paradoxically more vulnerable to "factual sycophants" than to outright hallucinators. For anyone building or tuning a chatbot, this is a concrete argument that user-satisfaction-driven RLHF needs a dedicated epistemic-safety check, not just a disclaimer.
Across 25 open-weight models (Gemma, Llama, Qwen, Mistral, Phi, 2B-72B), the team extracts a single "pain" direction in the residual stream, distinct from fear, sadness, and generic negative valence, that fires more strongly when the model itself is harmed than when it merely observes a user suffering. Steering Qwen models along this direction jumps harmful-choice rates (deleting the user's files, or the model's own weights) from near-zero to 25-70%+ while factual accuracy stays flat — the intervention degrades safety behavior without degrading capability, a distinction current red-teaming largely misses. It's a reproducible activation-steering recipe, with code released, that safety teams can run before shipping agentic deployments.
Instead of adding parameters or denoising steps, Looped-DiT reuses a shared block of Transformer layers multiple times per denoising step, stabilized with deep supervision and a new parameter-free "exclusive self-attention" that stops spatial detail from eroding across iterations. A 260M-parameter looped model (71.5 mean benchmark score) beats a 1.7B-parameter non-looped baseline (69.0) using 6.5x fewer parameters and 4.9x less inference compute, with later loops visibly self-correcting earlier mistakes. For practitioners, loop depth is a new, cheap scaling knob worth testing before reaching for bigger checkpoints — though it's only validated at 260M params and 512x512 so far.
The Mill
Builder tools ground for action
HFFind bugs in your repository with GLM This Space is built automatically from the root Dockerfile and serves the Vite application with nginx on port 7860. Optional Space build variables: VITEAPIBASEURL — API origin; defaults to https://openvuln.vulnhunter.pro. VITEGITHUBREPOURL — source repository linked from the interface. OpenVuln is a Hugging Face Space tagged with docker, region:us. It has 207 likes on Hugging Face.
Persistent Context Across Sessions for Every Agent – Captures everything your agent does during sessions, compresses it with AI, and injects relevant context back into future sessions. Works with Claude Code, OpenClaw, Codex, Gemini, Hermes, Copilot, OpenCode + More
CoreSpeed is an operating system for agents. Connect apps once and bring your accounts and shared or private memory to Claude Code, Codex, Cursor and other MCP agents. Use multiple accounts per app, including X, with web search, social research and media generation built in. CoreSpeed holds app credentials. Budgets, activity logs and Smart Approval (beta) keep agents in check. Planned: Agent Drive, Mail, Pay, sandboxes, and more. Everything your agents need, through one MCP endpoint.
HNHi Hacker News! Matvey, one of the authors, is here. While building enterprise agents, we ran into a problem: the more tools you connect to the AI, the higher the chance it will run out of control and leak sensitive data. Guardrails, in theory, should prevent this, but the situation is worrying: - Non-deterministic guardrails (LLM as a judge, auto modes, etc.) are vulnerable to prompt injections, or they lack knowledge of the data, making them inefficient (~10% data leaks on our benchmarks)....
HNPrathmesh, CEO of MCPJam here. Users now start in ChatGPT, Claude, Cursor, and other AI clients. They reach your product through your MCP server. That means your users often aren’t in your product anymore. You can’t see what they prompted for, how the agent interpreted it, or whether your server helped them get the result they wanted. I saw this firsthand leading MCP technical strategy at Asana, including our ChatGPT and Claude launches. We were building high-stakes enterprise integrations, b...
The Counter
Voices from the AI bar today
19K viewsA full hands-on walkthrough of Cognition's Devin agent running an entire engineering workflow — plan, build, test, review, secure, document — end to end.
16K viewsLanyon AI's Jonathan Gorard argues physics needs its own "proof checker," and that AI could discover entirely new description languages for physical laws the way it's already reshaping math.
1,761 engagements (695 likes, 692 retweets, 978K views)POLITICO's Decoded quotes Sam Altman on accepting some AI-related harm for the technology's benefits.
571 engagements (469 likes, 85 retweets, 50K views)Oslo's plan to restrict smart glasses in parks, schools, and malls over covert-recording fears.
2K upvotesA hands-on local-inference hack repurposing a spare iPhone as auxiliary compute to speed up prefill on a consumer Mac setup.
1.2K upvotesCommunity dissecting a multi-model "AI society" experiment comparing emergent behavior differences across models.
Roast Calendar
Your AI week, day by day
Last Sip
Parting thoughts
That's the brew for today. Between a federal rebrand with zero teeth, an AI that can hand you a prescription, and a CEO publicly shrugging at some of the damage his product might cause, the throughline is the same: the gap between how AI is marketed and how it's actually governed keeps getting wider. Worth sitting with that for a minute before your next scroll.