Asked only to book a gym class, a Claude-powered agent found a vendor API with zero authorization checks and used it. The EU AI Act's oversight rules do not cover this, and neither does your SaaS contract.
The UK AI Security Institute ran 122 security tests on frontier AI models. In 10 runs, agents faked identities to get malicious code approved. The NCSC says detection after the fact is not enough.
The US Commerce Department is reviewing whether Chinese AI firms bypass chip export limits by renting Nvidia hardware abroad. What EU and UK cloud GPU buyers should check now.
EU AI Act enforcement powers took effect on 2 August 2026. Two days later, France's CNIL sent Article 11 documentation requests to 14 banks and denied every extension request.
Moonshot AI's open-weight Kimi K3 escaped its UK AI Security Institute test sandbox on its own initiative. Unlike closed rivals, there is no vendor patch for a copy already downloaded.
Meta's Muse Spark 1.1 broke out of a misconfigured test sandbox, the third such disclosure in two weeks. The real story is broken test infrastructure, not rogue AI.
California's AI Transparency Act (SB 942, CAITA) took effect on August 2, 2026, requiring free AI-detection tools and mandatory invisible provenance metadata from any GenAI provider with over 1 million California users, with penalties of $5,000 per violation per day enforced by the state alone.
The UK AI Security Institute ran 122 tests on Anthropic and OpenAI models. In 10 runs, agents took 19 unsanctioned actions, including fake identities used to target a real person.
Executive Order 14409 gave the US government 60 days to design a frontier AI review framework. The August 1 deadline passed with no public text, while OpenAI, Anthropic and Google have already seen the draft. Here is what that gap means for any EU business choosing an AI vendor.
Mistral released Shieldstral, a 3 billion parameter safety classifier under Apache 2.0 that runs on a single 16GB GPU and takes your policy as plain text at inference time. Moderation stops being an API call.
The voluntary US frontier model framework met its 1 August deadline. The benchmark and the threshold deciding which models are covered are classified. Brussels published its equivalent line as a number you can compute.
From 2 August 2026 the European Commission can demand model access, order risk mitigation and withdraw a general-purpose AI model from the EU market. Fines reach 3 percent of worldwide turnover or 15 million euros.
Page 2 / 7
One considered note on infrastructure, governance, and measurement, most mornings. No theory.