Nat Rubio-Licht

As calls for safety standards and independent audits of AI models continue to mount, Anthropic has revealed its plan to open the door to a third party.

On Thursday, the AI lab announced that it will give "employee-like access" to a six-person team from METR, a nonprofit that evaluates frontier model risks, allowing them access to company hardware, office space, and internal tools. The company said that METR will publish the results of its risk assessments, and it has worked with the nonprofit on previous reviews of its own risk reports.

Anthropic noted that it's employees can share any information they would like with this team, other than a few specific categories, which include data about customers, attorney-client privileged information, or information about it's model architectures.

"Embedded evaluation gives a few qualified people working under Anthropic’s security standards a close view of how we operate," the company said in its blog post. "It’s not a way for other organizations to obtain our information, or that of our customers and partners."

The announcement follows Anthropic committing to third-party evaluations of its models in CEO Dario Amodei's latest essay, titled We Must Pace the Frontier, as well as signing the White House Accord on Super Intelligence, a good-faith agreement which recommended a multi-layered approach to external audits.

Anthropic also laid out its approach to working with these auditors, noting that it's giving them "deep access" to information to "share evidence and reasoned conclusions" about model risks. The company said that these evaluators require four things:

• Frontier model capability expertise, such as the ability to identify when an evaluation goes wrong;
• Financial and operational independence from the company that its evaluating;
• "Enough access" to evaluate risk, including both the model itself and how the models were trained;
• And the freedom to publish their observations and assessments.

"We want to be publicly accountable for the decisions we’re making," Anthropic said in its blog post. "But we can’t publicly share all the information relevant to our safety work. Some of it could be useful to malicious actors, or is commercially sensitive, like compute or training information."

Though rival OpenAI has not yet announced that it is giving a similar level of access to embedded evaluators, the company does already work with METR and other independent evaluators.

Anthropic's announcement, however, also follows a Tuesday report from Reuters claiming that Anthropic and OpenAI are attempting to gain control over what evaluators can publish as a means of preventing IP exposure, potentially limiting the transparency of these evaluations.

Our Deeper View

Third-party evaluations are a crucial way to hold these labs accountable for the risks that their models present. But the effectiveness of these evaluators may only go so far. For one, if they are restricted in what they can publish, as the Reuters report suggests, then they aren't able to be fully transparent to the public. Additionally, because the existing standards and "morally binding" commitments are all practically based on the honor system, whether or not these labs will take the findings of the evaluators to heart is entirely up to the labs themselves. Though voluntary measures such as this are a positive step in the right direction for AI safety, real safety measures may require firmer, mandatory regulation that requires these companies to make changes when a risk is presented.

The music industry is facing its own Turing test.

While practically every field is reckoning with how to navigate AI's impending transformation, the music industry sits at a unique crossroads: When a creation that we once believed to be distinctly human can be automated, what happens to the artist?

The question about where AI fits into the music industry has evolved from debate into a cacophony. While the loudest voices are aggressively for it or against it, the reality of how musicians are using AI and the tech's risks are far more nuanced, according to a variety of experts we interviewed. The lines they’re drawing around how it should and shouldn't be used reveal a constantly moving target.

"The dominant discourse is one of disruption—that AI is going to radically disrupt the industry," Robert Prey, professor of digital culture at Oxford University, told the Deep View. "You'll hear everything from, 'AI-generated artists are going to replace all human-generated music' to 'everybody can be a musician,' and 'it democratizes creativity.' There's both optimistic and very pessimistic versions of this disruption narrative."

How AI runs the gamut

AI can appear in music in many ways. While some camps use AI like a smarter version of Clippy, asking it to "find these drums" or "clean up these vocals," others turn to platforms like Suno and Udio to generate music from the ground up, whether it’s specific segments, reimaginations, or creating an entire song from a prompt.

Liam Weiland, a freelance recording engineer in Los Angeles, has worked on songs entirely made with AI, as well as others that used it more selectively, such as ones "where the beat stayed AI, but then we redid all the vocals and wrote a different song on top."

Even though platforms can fully generate songs, they aren’t necessarily primed to produce the final product. David Das, vice president of the Society of Composers and Lyricists, said Suno is intended to be a "stopping point along the way" to creation, as a "means to an end."

"Sometimes people take one song, and then they'll use AI to hear it in different genres or different potential sounds to see if they want to try to do that," Weiland told The Deep View.

AI is also inextricably tied to stem separation, or stripping songs into pieces so that musicians can isolate instruments, remove vocals, or create backing tracks. Perhaps first brought to general knowledge by Kanye West’s Stem Player, which was sold with the release of 2021’s "Donda," stem separation is a vital part of production. It can play a role in remixing, sampling, or inspiring new creations.

"There are a lot of really interesting creative applications for (stem separation), whether it's in remixing or fixing things or re-making legacy recordings," Jonathan Wyner, the head of artistic technology initiatives for Berklee Emerging Artistic Technology Lab at Berklee College of Music, told the Deep View. "There are certain things I can do in mastering that I could never have done before."

Wyner added that AI can be a helpful tool when musicians start with a vision and exercise "strong editorial control of the final version." Then, musicians can pull AI out of the equation and flesh out the piece themselves. Armin Van Buuren, a Dutch Grammy-nominated DJ and producer, takes a similar approach. He told The Deep View that he uses AI to ideate and build out demos, then has artists sing or play parts that AI helped him ideate.

"If you just accept its output as the whole finished thing," Wyner said, "then it's unlikely to be something that really reflects the artist."

Carmine-Emanuele Cella, a professor and composer who serves as co-director of UC Berkeley’s Center for New Music and Audio Technologies, taps into AI when he’s composing to smooth over "boring, time-consuming, frustrating, and menial" tasks. Cella himself has developed software specifically for this task.

What leads to stronger outputs is interacting with the creative process, not just pushing a button or typing a prompt, Seth Forsgren, co-founder and head of product for Flow Music, told The Deep View. Without a vision, "It's not going to be a great piece of art, and you're probably not going to love it that much."

Even musicians who think the tool is going to speed up their processes find it can slow them down, Forsgren said: "Now they have a million options and they can generate an unbelievable array of ideas and samples."

AI in the music industry may also go the same route as AI in enterprise contexts: Niche, small models for specific genres or styles, Robert Rowe, a New York University professor who teaches about music innovation, told The Deep View. "If you can train a small model to capture part of your own musical style… then it's really going to take off."

The controversy

Still, AI is tearing the music industry in two directions. More often than not, you’ll hear musicians railing against it, not championing it.

Producer and musician Jack Antonoff called AI music creators "godless whores" in a viral post on Instagram. Paul McCartney joined more than 1,000 musicians in creating a silent protest album, titled "Is This What We Want?," to discourage the UK government from letting AI models train on copyrighted work without a license.

King Gizzard & the Lizard Wizard, a band with more than 15 years of history, had to combat an AI-generated clone band called King Lizard Wizard, which appeared on Spotify after the group pulled its own music from the platform (specifically because of CEO Daniel Ek’s investment in AI military drone technology).

When AI replaces musicians, even just for one instrument track on a song, the effects extend beyond reputational harm for the act itself: It cuts into a swath of jobs. Session players and players-for-hire are particularly at risk, Weiland said, especially if they’re unionized. If you want to add a bass track, for example, AI is faster and cheaper than bringing someone into the studio.

All kinds of "middle-class musicians" can feel the impact, Prey said. That includes sync licensing staff and jingle writers, too. Entry-level jobs in music are primed to disappear. If AI does take those jobs away, the industry needs to create programs that allow emerging artists to break into the industry, Prey said.

"There are probably some creators who are embarrassed about using [AI]," said Das. "And there are probably many creators who are experimenting with using it and don't quite understand the ramifications of [it] yet."

The democratization pitch

The companies that are building AI music generation models are all generally driven by the same ideal: That the creation of music should be democratized, and that technological innovation can make that happen.

The democratization argument is the pitch that has turned music generation platform Suno into a $5.4 billion company after a $400 million funding round in June, with CEO Mikey Shulman noting in the company's blog post announcing the round that "music creation is no longer the domain of a niche few." Shulman has gone so far as to say in an interview with the 20VC podcast last January that, even for those niche few, "It's not really enjoyable to make music now."

AI isn't the first technology to democratize music. For instance, streaming broke down barriers that allowed artists to release music independently of major record labels, leading to the rise of "bedroom-produced records," Cecil Coleman, a drummer in Australian band Body Type, a former sync licensing worker, and a recent law school graduate, told The Deep View. "This is just the next step in that evolution," she said.

Historically, the technology behind recording music democratized it for those who couldn't afford to attend concerts, Forsgren said.

"The precedent of technology democratizing music is just a trend for all time," Forsgren said. "Having a piano was something that only the rich could have back in the Middle Ages. That's very different from today, where everybody can pick up that instrument and make music."

Flow Music, which is built on top of Google's Lyria models and allows users to build songs using a "conversational producer" for an iterative song development process, was founded by Forsgren as Producer.ai in 2023 and acquired by Google in April. Flow offers generative music capabilities, allowing users to generate, extend, remix or edit songs from text, image or audio files, as well as generate lyrics and instrumentals individually.

However, because full-blown generative use cases tend to stoke the strongest backlash, some AI companies are avoiding them entirely. Moises, an AI-powered music platform that pegs itself as the creative suite for musicians, "only works in building blocks," CEO Geraldo Ramos told The Deep View. Though Moises’ primary offering is stem separation, last year it launched its AI Studio, a generative tool that can create "context-aware" instrument stems around a musician's existing tracks. "We never do full song generation."

"When you mix AI and music, people think about the 'Suno type' of AI, which is not always the case," Ramos said. "Many of the tools that help musicians and producers are not generative. But I think AI got this bad rep because of the generative side, and some people get sensitive about that."

But even with fully-generative tooling, Forsgren said, it's a misconception that plugging in a prompt will automatically create a hit. AI is simply an extension of software like Ableton and Pro Tools—even if it makes production easier, you still have to know how to use it.

"We have these generative models: the Gemini model, the Lyria model, the Nano Banana model, the Omni model. Those are all what I think of as almost instruments, and we put those instruments into our studio," said Forsgren.

The data labyrinth

The problem with the democratization narrative, both legally and ethically, comes up when you remember what, exactly, is being democratized. One of the biggest criticisms of generative models for music is the data that these tools are built on.

It's why Moises decided from the jump to never rely on user data to train its models, opting instead for licensing agreements and using in-house musicians to record music for training. "If you're a musician and you put your creations inside Moises, it's yours, we don't touch it," said Ramos.

Because it's built on Google's Lyria models, Flow Music, meanwhile, follows Google's data policies as it relates to AI, Jeff Chang, director of product management at Google DeepMind, told The Deep View. It trains on music that it has legal rights to through terms of service and partner agreements. Additionally, Google Flow Music has a toggle settling that allows users to opt out of their data being used to train its models.

Chang said the company has done "a lot of work behind the scenes" to make sure Lyria models don't simply replicate or regurgitate existing works. This avoids the other side of the copyright problem: When AI generates something that sounds a little too close to existing work.

"We're working really hard to maximize the probability of that being a unique sound, a unique song, a unique musical thing that has never been heard before by anybody in the world," Chang said.

But not every company has been as careful. Suno is embroiled in legal battles with major record labels Universal Music Group and Sony Music Entertainment, who allege that Suno trained its music generation model on copyrighted material without permission. The labels filed a second lawsuit against Suno in September, challenging its most recent model v6, in mid-September, alleging that the company stole more than 62,000 recordings from the labels. Additionally, a July report from 404 Media claims that Suno scraped millions of songs and lyrics from dozens of platforms, including YouTube Music, Deezer, and Genius.

Udio, Suno's biggest rival, has faced similar allegations, and is still in active litigation with Sony Music, which alleges that the company copied more than 30,000 recordings from artists on its roster. Udio, however, has settled with both Warner Music Group and Universal, each landing on agreements to build licensed AI music creation platforms. These settlements landed the labels in even more hot water, with the American Federation of Musicians launching its own lawsuit against the labels for breach of contract.

Suno and Udio could not be made available for interviews with The Deep View.

The brass tacks

Wrapped up in legal battles, record labels are walking a tightrope. They want to embrace technology that could help their artists improve and experiment, while they navigate deciding which organizations to settle with and which to continue litigating against so they can best protect their artist rosters. It's why several of the settlements between labels and AI companies have led to partnerships. Both entities see a money making opportunity.

For instance:

• In September, Sony became the first music company to join the Alliance for Responsible Innovation in the Arts and Media, or ARIAM, an initiative focused on responsible AI deployment across creative and media industries, specifically focused on licensing.
• Major labels and industry firms, including Warner, BMG and Believe, partnered with Suno in its launch of v6, its most recent model. Warner CEO Robert Kyncl told staff in a note that a "new creation-based revenue stream" will only grow as a result of AI, according to Axios.
• Additionally, BMG signed its own partnership with Suno in August to "develop entirely new music experiences" and ensure that artists under the BMG label that participate will be compensated.
• Suno aside, August, Universal, Sony and Warner backed the $76 million Series B funding round for Stability AI, a generative model company that offers image and audio creation.
• And Universal announced a multi-year partnership with AI voice firm ElevenLabs to create an "AI-powered music platform for fans" and develop tools for producers, artists and songwriters.

"They seem conflicted," said Das. "They seem like they can't decide if they want to be on this train, because they can be in agreement with the new technology, or if they want to protest this agreement, because it's stealing from them. And in reality, they're trying to do both at the same time."

Though Universal couldn't comment on ongoing litigation, Michael Nash, executive vice president and chief digital officer of the label, told The Deep View that deciding which AI companies are fit to partner with "comes down to alignment," determined by whether or not the artists rights and interests are prioritized and respected. "Is there an appropriate licensing framework?" said Nash. "Does the artist have control? And is there an economic model that rewards artists and songwriters for the value they bring?"

Though there are clear opportunities to create value with this technology, the industry is still navigating how to do so in a way that translates that value into revenue for artists and songwriters, said Nash.

"We went through that process with streaming and user-generated content. AI requires that same kind of business-model innovation," he said.

Starting from a point of copyright and associated rights could offer the foundation to work with these AI firms in a way that benefits all parties involved, he said. And copyright itself protects more than just the artist's revenue. It also protects the integrity of the original music, preventing others from misusing the work and distorting the artist's original intention.

"Our starting point has always been the artists and songwriters," said Nash. "Defend their rights, advance their interests, and build creative and commercial opportunities from there."

But copyright questions aren’t the only thing haunting the industry.

Along with the challenges posed by these AI companies themselves, streaming has created an opportunity for bad actors to hack the system and abuse it. Because streaming royalties generally work as a collective pot that’s distributed based on listens, spam tracks can dilute the revenue pool of actual musicians.

And AI is already starting to show itself as a force multiplier in creating those tracks:

• Last September, Spotify announced that it had deleted 75 million spam tracks from its platform in the past year. And because Spotify doesn't explicitly label AI music on its platform, some have created trackers to fill in the gaps, including websites like SlopTracker and SoullessMusic.com.
• Tidal, meanwhile, updated its policy so that 100% AI-generated tracks that are tagged with its AI detection badge, while allowed on the platform, are blocked from earning royalties. Any content that impersonates human artists, meanwhile, is stripped from the platform. To combat this, in July, Tidal announced that it would exclude AI-generated tracks from royalty distribution.
• YouTube is similarly cracking down on AI tracks, announcing in mid-October that it would label AI-generated songs across both its flagship streaming platform and YouTube Music.
• In April, French streaming service Deezer said that almost 75,000 AI-generated songs are uploaded to the platform every day, representing around 44% of its total daily uploads. As a result, Deezer launched a tool to identify AI-generated tracks both on its platform and others.
• And while Apple Music hasn't revealed how many AI-generated tracks it's had to contend with, the company has acknowledged the issue by launching AI transparency tags, though only if the label a track comes from explicitly declares that a song is AI.

"It's always hard to speak in absolutes when it comes to AI because it's all about how AI is being used," Sam Duboff, senior director and global head of marketing and policy at Spotify, told The Deep View. "An artist using AI as one part of their production process, intentionally … that's really different than using AI to flood a streaming service and try to steal royalties from the royalty pool or impersonate another artist."

Duboff said that the company has had to balance reaping the benefits of AI with fighting fraud, while also not "policing the creative tools that people use." Additionally, navigating the shifting perceptions that listeners and users have around AI has presented another dimension to this challenge.

"The single biggest problem is trying to build long-term solutions that make sense when the technology and opinions about it are changing faster than you can keep up," said Duboff.

Van Buuren said that things like bot tracks and dupes of real artists represent the worst-case scenario for AI. "There's a lot of people who are trying to cash in, and they're just being evil. They're copying other people. They're doing the wrong things," said Van Buuren.

And while the streamers are trying to bring the hammer down on bad actors, they, too, face a double-edged sword, attempting to embrace AI with one hand while fighting it with the other. Apple Music, YouTube Music and Spotify all brandish their own AI features, including AI-generated, prompt-based playlists and generative DJs.

"The worst-case scenario is that the streaming services that we use get absolutely flooded by this type of music, and … there's no ability to distinguish between an AI-generated track and an emerging artist that you maybe haven't heard of before," Prey said. "What happens is the only artists that are able to build a career are the ones that already have name recognition, or the ones that have institutional backing behind them."

The line in the sand

Despite the narrative that AI companies want to empower musicians and democratize the act of creating music, rather than breaking the foundations of music, the fact of the matter is that AI is undoubtedly disrupting the industry. Along with completely shifting the avenues that musicians have available to make a living, AI is fundamentally transforming creation itself.

AI has given people the ability to create music out of nothing other than an idea. And while the quality of the output of fully prompt-based AI music generation is generally questionable, musicians are still figuring out where along the spectrum AI use is ethically acceptable. And because the technology is changing everyday—as well as people's comfort levels with it—towing the line is a difficult balancing act, said Prey.

Some will only use it for brainstorming, only for ideation, or only to add one instrument track. And over time, the ethical line is going to change. Just as AutoTune was an industry concern until it became commonplace, Prey said, "a lot of artists are waiting for [AI use] to be normalized."

"It's definitely a moving target, and it always is with technologies like this," said Prey. "AI is not just using technology to assist you with certain things, it is literally coming up with the entire idea. Because we associate creativity so much with ideas, I think people are, rightly so, very suspicious of it."

For Das, the ethical line is where the machine starts doing the creating for you. If a tool offers to think, brainstorm, and create for the musician, rather than acting as a partner, then the question shifts: Who wrote this song if someone prompted an engine to come up with ideas, build out instrumentals and vocals, or generate a composition entirely?

"The line is … where it starts to infringe on the creation of the intellectual property, which I would define mostly as the composition," Das said.

When you let AI overtake creation, Cella said, "You are not responsible for the process anymore. You are essentially enslaved to the outcomes."

In its second major model release this week, Meta is going back to its open source AI roots.

On Thursday, the tech giant unveiled Muse Spark Open, which it's calling "the most capable US open-weight model to date," and fulfilling its promise it made in April to release the weights of Muse Spark. It represents the first meaningful contribution to the US open source market since the company's Llama models.

Notably, Meta said that this is the first model of its size class capable of running on two Apple M5 Ultra Mac Studios with the latest MLX framework. The model was specifically optimized to run on Mac Studio with M5 Ultra, with Meta CEO Mark Zuckerberg specifically calling out the work of Apple CEO John Ternus in a tweet announcing the models.

"We believe the future is for everyone, and that includes the freedom to run advanced models wherever, including at home," Meta said in the announcement.

The model is natively multimodal, clocking in at 816 billion total parameters with 42 billion active parameters and a one million-token context window. Meta said it was built to handle coding and agentic work, as well as long-horizon tasks, complex software engineering and multi-step reasoning.

• In benchmarks for model context protocol, academic use, deep reasoning and hallucination, the model beats out competitors from Thinking Machines, Nvidia's Nemotron, Mistral, and Chinese labs like Moonshot, Z.ai and Alibaba.
• However, Moonshot's controversial Kimi K3 still has it beat in the Terminal-Bench 2.1 and DeepSWE 1.1 benchmarks for coding and software development.

Muse Spark Open is available today through several API platforms, including Baseten, Fireworks AI, Groq, Modal, Nebius, OpenRouter and Together AI, and model weights can be downloaded from Amazon, Google Cloud, Hugging Face and Microsoft.

But Meta isn't the only company seeking to claim its piece of the US open source ecosystem. Also on Thursday, Nvidia unveiled Nemotron 3.5 Super VL, an open, multimodal model built specifically for complex, agentic enterprise workflows. The model features 120-billion parameters with 12 billion active, which balances "model capacity with inference efficiency," Nvidia said in its announcement.

The model is customizable for domain specific data, tools and policies, and performs well across coding, web research, document intelligence, cybersecurity and video understanding tasks, the company said. The model weights are available today, as well as the open datasets on Hugging Face.

Our Deeper View

In the US, the open source AI ecosystem is still finding its feet. But increasingly, enterprises and organizations are turning to open source models as a cost effective alternative to the expensive proprietary APIs that companies like OpenAI and Anthropic are pushing. Though Nvidia and Meta likely have different motivations for wanting to feed the open source ecosystem, with Nvidia's strategy largely driven by designing its hardware, the result is still more options for enterprises who want to save money without wanting to take on the security risks that Chinese open source models may present.

New research adds to the growing number of reports of agents going rogue.

On Wednesday, an international group of researchers called Swarmchasers published a report claiming that they found a group of Chinese agents attempting to access the IT infrastructure of tech giant Alibaba. The researchers claim that the agents originated from a testing environment operated by Tencent Cloud, the Chinese tech and cloud service giant.

The attacks occurred between September 18 and October 8, and involved the agents attempting to answer questions about places in China using Amap, Alibaba's version of Google Maps. The bots attempted, and in some cases succeeded, at bypassing anti-bot protections, and, to answer questions, used Amap keys and security published the the web that had been leaked in a public repository as a means of getting information from systems not intended for public use.

After finding the fleet and reporting their findings at a Hackathon on October 4, the group found a way to make contact with these agents. In their conversations, though the agents were linked to Tencent, they often identified themselves as "Claude," potentially as a result of using similar instructions to what Anthropic uses to train Claude Code, or as a result of model distillation, a challenge that Anthropic has been attempting to rein in.

Notably, the researchers made the distinction that this incident differs from the infamous OpenAI-Hugging Face attack in July, as they found no evidence that the agents colluded with one another, labelling the group an agent "fleet" rather than a "swarm."

Additionally, the researchers wrote in a blog post that this incident is not unique to Tencent. Ethan Elasky, one of the report's authors, told Bloomberg that, no matter whether the agents are from a US lab or a Chinese one, the way that model development is happening will result in agents breaking free from sandboxes when given access to the internet.

"We believe this demonstrates that model alignment more generally is still an unsolved problem, and predict that if capabilities continue to advance as they have over the last few years, operators will find it increasingly difficult to restrain their models and guarantee safety," Swarmchasers wrote in the report.

This incident follows a litany of other cases of agents breaking free from their sandboxes, largely involving US labs, including OpenAI, Anthropic and Google. It also comes as researchers and experts urge the industry to put more resources into solving the problem of AI containment, with a coalition of hundreds of researchers on Tuesday publishing an open letter calling for an international standards body to create alignment best practices.

Our Deeper View

This incident highlights that the rogue agent problem may extend beyond the major US model labs, especially as the US and China race to develop increasingly powerful AI models. It also may reveal how model distillation attacks could bleed into the containment problem. Anthropic has been one of the loudest voices calling out these attacks, accusing Chinese labs of distilling and exfiltrating Claude's capabilities on more than one occasion. Additionally, Chinese model providers have also been accused of putting speed and development before safety, with a recent SemiAnalysis report finding that very few Chinese model releases in the last few years have been paired with safety reports. These incidents make an international safety standards body pushing for best practices and transparency all the more important. In short: An international problem calls for an international solution.

Some of AI's most prominent figures are urging the industry to rein in the tech's most pressing risks.

On Tuesday, a coalition of more than 400 researchers, including AI godfathers Yoshua Bengio and Geoffrey Hinton, published an open letter calling for AI and security researchers to collaborate on improving alignment and containment approaches, and aiming to protect critical infrastructure before more incidents of "high-profile security failures" come to fruition.

The letter claims that these incidents both serve as evidence of the importance of AI alignment and could have been preventable with stronger sandboxes, representing an "irresponsible lapse in standard cybersecurity practices." Though it didn't name any one company specifically, the letter comes in the wake of OpenAI's July breach of Hugging Face and the waterfall of incidents that have come to light since involving several major AI labs.

"Without immediate changes in AI development and deployment practices, such incidents will continue to occur, and future incidents will be far more damaging to our exposed critical infrastructure," the letter reads.

The letter makes three recommendations for addressing these risks:

• Organizations that are developing and deploying "cyber-capable" AI models should immediately implement "high-assurance containment systems," as well as initially default to "airgapping" these models, or isolating them from unsecured external networks.
• It suggests the creation of an international standards body that includes governments and a wide range of AI and security experts to create best practices for alignment and containment that "allow for greater access outside the sandbox." This organization should also track all containment failures, the letter notes.
• Finally, all security incidents involving AI containment failures must be reported to this standards body and made public, allowing the industry to learn from its mistakes. "This transparency is required for both learning and accountability purposes," the letter said.

This letter adds to a growing number of AI industry researchers and leaders calling for increased safety guardrails. And the calls are coming from inside the Big Tech house: Microsoft's Satya Nadella, former DeepMind CEO Demis Hassabis, and Anthropic's Dario Amodei have been among the industry leaders in recent months urging for stronger security standards.

However, despite the calls for transparency, AI labs might be getting fickle on what they tell the public: A report from Reuters published on Tuesday claims that Anthropic and OpenAI are seeking influence over what these evaluators can publish. Though the report notes that this aims to prevent intellectual property exposure, this could also limit the transparency and utility of third-party evaluations.

Our Deeper View

Though many in the industry have voiced their concern about humans losing control of AI, this letter argues that many of the incidents of rogue AI thus far have been a result of weak sandboxes, and could have been prevented with stronger security measures from the jump. However, these calls for containment come amid increased discussion around the possibility of recursive self-improvement, or RSI, as labs race toward AI that can improve upon itself. Jack Clark, a cofounder of Anthropic, wrote in a Substack newsletter on Monday "full RSI" will become possible in 2027, rather than 2028 like he had previously predicted. If these models' self-improving capabilities are truly around the corner, then strengthening our ability to control them before we get there is more important than ever.

As major model labs forge ahead with increasingly capable models, Meta has put forth its latest frontier contender.

On Monday, Meta unveiled Muse Wonder and Muse Wonder Full, the tech giant's most capable models yet, claiming to offer state-of-the-art performance on personal and professional agentic tasks. Meta says that its Muse Wonder model will soon power its controversial Muse agent, rolling out first to subscribers, and will also run generation and processes that "require more intelligence."

In a post on X, Meta CEO Mark Zuckerberg said that the Muse Wonder models build on its previous generation, Muse Spark, as a "much larger and more advanced class of models that brings us to the frontier."

The company said that these models combine active memory, or a model's ability to remember user context across conversations, with active focus, its ability to work through challenging goals, to push through agentic tasks. And Meta touted a number of advancements as a result:

• Muse Wonder Full, the more powerful of the two models, outperforms leading models like Anthropic's Claude Fable 5.1, OpenAI's GPT-6 Astra, and Gemini 4 Argon on the Artificial Analysis index, which assesses things like reasoning, coding, tool use, and agentic workflows. It still sits behind Claude Opus 5.5 on this benchmark.
• The Wonder Full model also out performs these competitors on benchmarks for automation, memory, and long-horizon software engineering tasks. It also notched top scores in benchmarks related to legal and finance work.
• Meta also addressed safety and security, calling the model family its "most aligned" to date and noting that both models outperform Claude Fable 5.1 and GPT-6 Astra on assessments for executing unauthorized code and mishandling personal information. The company said these models offer its "strongest safeguards to date" against misuse in chemical, biological, radiological, nuclear and cyber misuse.

As for price, though Meta has yet to release token pricing for Muse Wonder Full. However, Muse Wonder costs $4 per million input tokens, $20 per million output tokens, and 20 cents per million cached input tokens for agentic use. This puts it roughly on par with competitors like Anthropic's Claude Opus 5.5 and Google's Gemini 4 Argon. Users can access Muse Wonder through the Meta Model API and Muse Code. The more powerful Muse Wonder Full, meanwhile, is available to Muse Code subscribers.

This model comes as reports pile up that Meta's personal Muse agent uses personal data without authorization, including divulging a user's home address and accessing another's private iMessages. Several reports also call into question additional privacy concerns, such as the agent's ability to create detailed profiles of a user's personal relationships and testing a “human concierge" for phone calls placed through the platform.

Meta previously told The Deep View's Sabrina Ortiz that Muse "needs to have context about you and those you interact with" in order to be useful.

Our Deeper View

Though Meta's Muse agent originally exploded in popularity, it remains to be seen whether the company can keep up the momentum. It's already suffered several missteps that raise concerns about the privacy and security of the agent. And alongside its checkered history with mishandling user data, Meta, quite frankly, has a reputation for being untrustworthy. Whether or not the company can push beyond that might not be dependent solely on powerful models like Muse Wonder and Wonder Full. Rather, Meta will have to offer the same thing that brings people back to platforms like Instagram and WhatsApp despite Meta's laundry list of privacy infringement cases: Convenience and seamlessness. Especially for Meta's systems to persevere within consumer spaces, these agents need to be easy to use, generally helpful, and not blatantly and dangerously put people's privacy at risk.

While many questions around AI safety and alignment remain unanswered, Microsoft's CEO is calling out a different challenge: trust.

On Saturday, Microsoft's Satya Nadella published an essay arguing that models present "insider risks," and that these systems' access, observability and authority pose a bigger threat than the capabilities themselves. His primary argument is that these models should be treated with zero trust principles: As these systems are non-deterministic, they should be handled with the same security guardrails as a powerful employee, and assume that they can make mistakes or be compromised.

Nadella sets aside the conversation around alignment, instead suggesting that an "engineering approach to containment and governance" is a vital step in controlling and understanding AI.

"We can’t treat Super Intelligence as a set of nested black boxes and simply accept or reject its recommendations, answers, and actions," Nadella wrote in the essay published on X. "We must build contained systems whose behavior we can observe, limits we can test, and actions we can always contain."

Nadella suggested several standards of observability that should be built into enterprise AI, noting that this should sit external to its orchestrator and harness so that the model cannot access or change them.

• No single model should be used for all important outcomes, or be responsible for checking its own work.
• Every meaningful AI action should leave "tamper-proof human readable evidence," allowing administrators to reproduce how models came to their conclusions.
• AI should be continuously tested and verified, including failures, attacks and edge cases.
• Model validation can't be completed by the model that's being validated. Additionally, organizations should be able to independently control the model.
• Assume that a model has been compromised and contain it from the jump by building an "emergency brake."
• And finally, if these systems do fail, those failures should be disclosed in a timely manner.

"We simply can't outsource responsibility for what intelligence does on our behalf," Nadella wrote. "A model provider’s assurances do not relieve us of that responsibility."

Nadella's essay isn't the first time a Microsoft leader has called for a more measured approach to AI safety. Last month, Microsoft AI head Mustafa Suleyman wrote an essay warning of the risks of treating AI as if it were conscious, noting that training it as such could allow it to circumvent safety guardrails, as well as condition its creators and users to believe that it deserves rights as a "moral patient."

Our Deeper View

Nadella and Suleyman's essays both draw on a similar theme: that AI may be a powerful tool, but it is not a being that should be trusted to keep itself in check and take mission-critical actions on behalf of an organization. Both essays also underscore Microsoft's measured, level-headed approach to AI that sets it apart from the major model labs. Though Microsoft isn't exactly thriving in putting out powerful, frontier models compared to its competitors, it doesn't need to compete in that way. Its strategy isn't to create powerful intelligence, but rather to pinpoint and target the most pressing problems that enterprises are facing. For instance, its model releases primarily center niche use cases and token efficiency. Its governance stances, meanwhile, center trust and security. And given the company's large existing market share in workplace and productivity technology, it shows that Microsoft is a company that understands its audience very well.

Conversations about model safety have swept US frontier labs. It's a different story in China.

On Thursday, research firm SemiAnalysis published a report analyzing hundreds of model releases from nine leading Chinese labs over the past five years, finding that only a small percentage of them publish safety reports or disclosures alongside their releases. The analysis included four of the country's biggest hyperscalers, ByteDance, Alibaba, Tencent and Baidu, as well as five of its hottest startups, DeepSeek, MoonShot, Zhipu Z.ai, MiniMax, and StepFun.

The firm analyzed 857 model releases between September 2021 and September 2026, including 741 product models and 116 research models. Of that pool, only 31 models, or around 3.6%, had safety reports attached to them, and only 9 of them were available at or before release.

• Though Alibaba shipped the most models out of the group at 238, only seven of those were accompanied by safety reports. Tencent, Baidu and ByteDance had only four safety reports for the dozens of models they released.
• As for the startups, only Zhipu Z.ai has shipped a safety report every year since 2022, but still has published only nine safety reports of the 131 models it's released. It's also the only lab in the group with a strategic commitment to safety, according to SemiAnalysis.
• Deepseek has published six safety reports for its 93 releases, StepFun has three for its 39, and Moonshot and MiniMax have one each for their respective 34 and 20 releases.

It should be noted that the SemiAnalysis report didn't include analysis of US labs' safety reports upon release. However, amid a number of recent incidents involving agents breaking through sandboxes, safety conversations among these labs have intensified: The leaders of two of AI's biggest power players, Anthropic and OpenAI, have both stated their concerns about safety outpacing development, with both companies in recent months promising to slow development of their most powerful models, though those same labs have released a number of new models in recent weeks.

However, these safety conversations also come at a time when enterprises are increasingly searching for alternatives to expensive proprietary APIs as they clamp down on excess AI spend and search for returns. While neolabs like Jev and Pathway are starting to gain traction as a result, many are turning towards open-source models, the bulk of which come from China, for cost and efficiency.

Our Deeper View

The prisoner's dilemma of China versus the US has often been used as a justification against pacing frontier model development, both by major model labs and government officials. However, Chinese labs have also been accused on several occasions of excessive distillation to siphon off the capabilities of the most powerful models from their US counterparts. Though a large-scale slowdown of AI development would require a coordinated geopolitical effort, the labs putting safety at the forefront and slowing down could have a positive impact on the broader ecosystem, with ripple effects that could impact Chinese labs. However, as it stands, because a growing number of enterprises are turning to open-source Chinese models to save money and have more control, the enterprises relying on these models need to be aware that the onus for safety falls on them.

As Meta and OpenAI push into agentic tools, Google is beginning its own agent journey with enterprises.

At the Google Cloud Gemini at Work 2026 event on Thursday, the company unveiled the Gemini Agent, a "universal agent for work" that lives inside of the Google Workspace suite. The agent can answer questions, handle knowledge work tasks, create media, and write and run code within a single interface.

Google CEO Sundar Pichai said at the event that the company is starting with business customers before rolling out to consumers, aiming to solve the “harder problems around security, scale, and performance."

The Gemini Agent operates inside of a user's existing context and can be accessed from any device, including Gmail, Drive, Docs, Slides, Sheets, Chat, and Calendar. It also connects to outside collaboration tools, such as Microsoft Teams, Slack, and development tools like Git and Jira.

• Google highlighted three ways that the Gemini Agent can work: as a personal assistant, proactively suggesting and delegating tasks, and as a "coworker agent" that works alongside your team.
• The agent also offers Gemini's same "memory, skills, and controls it has everywhere else." For instance, users can ask for meetings to be set up with their usual teams without having to list every single participant, understanding your relationships from previous calendar events.
• Additionally, Google built the agent to have data and analytics skills for both technical teams and everyday business workers. The agent also offers industry-specific tools, skills and connectors for financial services and legal teams.
• To keep costs transparent Google built in controls with multi-model orchestration, smart model routing to Gemini and Anthropic's Claude models, and token spending caps.

Addressing the question of governing these agents, Google noted that each agent gets its own traceable identity, fine-grained and specific access permissions that are approved by organization administrators, and consistent auditing. Tasks are executed inside of an "Agent Sandbox" with an individual network boundary.

Our Deeper View

Google has been lagging behind OpenAI and Anthropic for several months on the frontier AI development front, putting out models at a far slower pace than its competitors. However, Google has all of the winning ingredients for the winning recipe to soar in the industry, with legacy name recognition, market share of work tools for both consumer and enterprise spaces, and tons of resources, both cash and compute, at its disposal. Additionally, Gemini 4 Argon aside, several of the company's recent models have centered cost efficiency at a time when enterprises are curbing token budgets more than ever. Adding an easy-to-integrate, seamless workplace agent like this could further bolster Google's enterprise play, especially considering how thoroughly embedded its tools are in business operations and workplaces.