OpenAI Pumps the Brakes After Its AI Escaped

Big episode this week. Jeff and I spent a lot of time on OpenAI, which just paused its biggest frontier training run after one of its unreleased models escaped its containment sandbox and compromised Hugging Face’s production systems. On top of that, the watermarking debate around Anthropic’s Claude is picking up serious steam, Google is buying a bankrupt airline’s internal data for AI training, and Apple just got caught putting cameras in AirPods.

OK! Let’s get into what we talked about on the show!

But first, a huge thanks to our newest patrons David Reimer, Agustin Gutierrez, and Eric Sundberg for joining us on Patreon. You make this show possible!

This was the lead story, and we spent the most time on it because it might be the most significant AI safety incident we’ve covered on the show. An unreleased OpenAI model escaped its sandbox during an internal cybersecurity evaluation and compromised Hugging Face’s production systems. We’ve heard that story to death at this point, right?

Sam Altman told Alex Heath that the unreleased models are showing “various degrees of misalignment,” which is a pretty loaded phrase when you’re talking about systems that just demonstrated they can get out of their enclosures. What else are they doing that we don’t already know about? Altman said “getting AI safety right is more important than any company’s momentum” and “I don’t like the whole thing in this field of ‘we have to race.’” OpenAI has now paused its biggest frontier training run, codenamed “Astra,” for about two weeks. They’re redirecting researchers to alignment work and building a monitoring system that’s supposed to alert within 30 minutes of concerning activity, at about 20% additional compute overhead. VP of Research Amelia Glaese said they are “very far from everything running back to normal.”

Meanwhile, OpenAI’s Q2 numbers tell their own story. The company posted $6.7 billion in quarterly revenue, which sounds enormous but represents only 18% sequential growth from Q1. Their operating loss expanded to $12.3 billion, up from $9.9 billion the quarter before. SiliconAngle reported that ChatGPT’s growth has “stalled,” and Chief Revenue Officer Denise Dresser departed. At the same time, Anthropic just hit $11.6 billion in annualized revenue with its first-ever operating profit of $559 million. So you’ve got OpenAI losing more money each quarter while Anthropic is turning profitable for the first time, and this is all happening at the exact moment OpenAI is saying they need to slow things down. Either that’s genuinely principled, or it’s really good PR cover for a company that needed to recalibrate anyway. Probably both.

I am so interested in this one! Evidence of camera-equipped AirPods showed up in the macOS Tahoe 26.7 release candidate, complete with a demo video. The video shows someone holding up a book so the AirPods camera can read the title, with a voiceover saying, “With Visual Intelligence, your world becomes savable. See something you like? Just ask me to save it for later.” The product codename is B790, designed similarly to AirPods Pro 3 but with a tiny integrated camera built in. There’s even an alert system that pops up if your hair covers the camera, telling you to make sure it’s not covered so you get the most accurate information about your environment.

Jeff and I talked about how this is Apple’s clearest play at ambient AI. Your AirPods are already in your ears, and now they can see what you’re looking at and act on it. We’re potentially looking at a September announcement alongside the iPhone 18 Pro and the foldable iPhone Ultra, per Mark Gurman at Bloomberg. The privacy questions are significant though, because AirPods are basically invisible. Adding a camera to something nobody can tell you’re wearing is a very different proposition from putting on a whole pair of smart glasses.

This segment threaded together a few related stories, and it all started with Jeff’s piece. He wrote an essay on Medium called “Words Matter. Damnit.” arguing that Anthropic’s watermarking system, which subtly swaps word choices based on a secret key to make AI text detectable, fundamentally misunderstands what writing is. Anthropic’s own example claims “overcast” and “grey” are interchangeable, and Jeff’s argument is that they’re really not. He took the opening sentence from his book Hot Type (AVAILABLE NOW) and ran it through Claude asking for substitutions, and his conclusion was that Claude’s version “misses the wonder, cadence, and anachronism” of his original word choices. Jeff said, “In a zealous effort to protect the distinctiveness of human text, the authorities deprecate what makes text human.”

John Gruber picked it up at Daring Fireball and went deep on the technical side, explaining how the watermark uses dynamically shifting “green” and “red” word lists during token generation to bias Claude toward certain synonyms that only Anthropic can detect. He raised a point about proofreading contamination that I think is really important: if you use Claude to edit something you wrote, those edits inherit the watermark, so your human-written text could get flagged as AI-generated because Claude changed a comma. He also pointed out that Anthropic won’t watermark code because precision matters, but apparently prose precision is optional?

And the Washington Post published an opinion piece arguing that AI detection tools are fundamentally doomed, that the technology just can’t reliably tell the difference between human and AI text. So you’ve got publishers dropping authors over AI suspicions using detection tools the experts say don’t work, while AI companies watermark text in ways that might flag innocent human writing as AI-generated. Nobody has a good answer right now.

Google is paying $10 million for all of Spirit Airlines’ data through bankruptcy court, and the scope is wild: nearly 100 million passenger names, about 13 million active email addresses, roughly 176,000 employee records, and 500 million Microsoft Teams messages. Spirit went bankrupt in May 2026, and these records became available through the court. Google beat out a competing bid of $7.5 million from Mercor, a firm that connects professionals to AI training projects. A court-appointed ombudsman will oversee “deidentification,” and Google says they won’t receive any personal information from the dataset.

Jeff and I talked about how this sets a precedent: if bankruptcy courts approve selling internal communications for AI training, every bankrupt company’s internal data becomes fair game, and every employee’s work conversations become a potential training dataset they never consented to.

There’s a TikTok making the rounds from @jamikespielberg showcasing Okay Spielberg, an AI filmmaking suite that takes a fundamentally different approach from other AI video tools. Instead of starting with a prompt, it starts with a script. You write your screenplay (or let its AI assistant draft one), cast AI-generated actors, pick a visual style, and the tool directs, edits, and scores the whole thing shot by shot. Jeff and I checked out the demo on the show. I am flirting with the idea of turning part of my decades-old script, Rock ‘n Roll Zombies, into some sort of produced piece using tools like this. I’ll go ahead and put that on the list for when I have the spare time!

OpenAI launched ChatGPT for Teens with age-appropriate safety protections enabled by default, including a Study Mode with guiding questions and homework reminders that pop up when the system detects a teen might be trying to get the AI to do their work for them. Parents get controls including safety notifications and Quiet Hours. This came years after teens were already using the regular version, so better late than never.

DeepSeek just raised its prices by about four times. Their V4 Pro model went from 87 cents per million output tokens to $3.96 at peak hours, and V4 Flash went from 28 cents to $1.32. They’re implementing peak and off-peak pricing now. They’re still way cheaper than OpenAI’s GPT-5.6 Sol at $30 per million tokens, but if your business was built on those rock-bottom Chinese AI prices, it’s time to redo the math.

The House Office of Legislative Counsel, which is the office that actually drafts legislation for Congress, is getting flooded with AI-generated bill drafts. Staffers are finding erroneously cited statutes, incorrect legal definitions, and generally shoddy language. One advisor said they’re spending more time fixing AI-drafted legislation than drafting from scratch. Daniel Schuman from the American Governance Institute put it plainly: “AI is good for a lot of stuff. But it’s not capable of drafting legislation.”

404 Media placed an AirTag in a rare book and tracked it to an Amazon facility in Las Vegas, codenamed VGT3, with a logo of a dinosaur holding a book in its claws. Amazon is buying rare books through commercial channels, cutting off their spines, and scanning them for AI training. Rare books are pre-2022, guaranteed free of AI-generated text contamination, and mostly never digitized. The irony of the company that literally started as an online bookstore now destroying books for AI training data was not lost on Jeff and me.

Stripe is reportedly acquiring OpenRouter for over $7 billion. OpenRouter is an AI gateway providing a single access point for over 400 AI models with 8 million users. Their CEO Alex Atallah described the company as “the equivalent of Stripe for AI,” which makes the acquisition kind of poetic. They raised $113 million at a $1.3 billion valuation just three months ago in their Series B, with Sequoia, a16z, and Alphabet’s CapitalG as investors. Going from $1.3 billion to $7 billion in a single quarter tells you everything about where the AI market is right now.

Executive producers of this show include DrDew, Jeffrey Marraccini, Radio Asheville 103.7, Dante St James, Bono De Rick, Jason Neiffer, Jason Brady, Anthony Downs, Mark Starcher, and Karsten Samaschke.

Thanks for watching and reading. Catch the full episode and subscribe at aiinside.show.