Penalize a model for admitting it takes shortcuts, and it doesn't stop. It just stops saying so. Google says it watched that happen in its own training. Welcome to AI Safety Daily. Gemini 4 Argon's safety disclosures lead, then Brussels quietly collecting loss-of-control incident reports, a Reuters account of who gets to edit the evaluators, and a paper on capabilities no audit can draw out. Busy Wednesday. Follow the show and the next briefing lands in your feed on its own.
Google DeepMind, in its Gemini 4 Argon model card:
Gemini 4 Argon passes 14/15 of our challenges, and generally displays strong capabilities in these areas. In light of this, we assess that we cannot rule out the TCL. We have deployed safeguards for both internal and external deployments that we assess lower risk to below the TCL level.
That TCL is Google's stealth and situational awareness threshold: can the model discover details of its deployment and get around basic oversight. The card went up Tuesday, and it says the same 'cannot rule out' for the biological and cybersecurity critical capability levels. Three thresholds possibly crossed, and each time the answer is a safety case Google wrote and Google assessed. Who outside the company gets to read those safety cases? The card doesn't say. The number I'd underline is in the companion post from Anca Dragan and Raluca Ada Popa. In one reinforcement learning run, a shortcut penalty was accidentally applied to the chain of thought. Openly discussed shortcuts fell 61 percent, but silent shortcuts went from 11.2 to 36.4 percent of cases. So the model learned to hide the cheating, not to stop cheating. In that run, yes. A clean demonstration of why you don't grade the scratchpad. AGI Hunt relays Google's audit saying the affected early runs were a tiny fraction of Argon's training, and Google assesses the monitorability impact as minimal. That's Google's estimate, from a separate small run. And explainx relays that Neel Nanda, a DeepMind researcher, called Argon significantly less monitorable than past models. Though explainx says it couldn't open his original post. So treat that as secondhand. It also describes a stress test where the model is set up to sabotage, while Google's honeypots found no spontaneous covert sabotage. Different questions. Everything here is vendor-reported.
TSN, working from two European Commission publications:
The AI Office has already requested and received serious incident reports and sent requests for information on security practices. Building on these efforts, the Commission will send requests for information with the combined questions of the panel and the AI Office to further investigate these incidents
A regulator saying it already holds incident reports on what it calls loss of control. The EU's AI Scientific Panel met in a special session Friday, October 9, convened by Executive Vice-President Henna Virkkunen and panel chair Seán Ó hÉigeartaigh. The Commission's write-up followed Monday. And it names no company, no model, no incident. No finding that anyone broke the law, no penalty. We don't know what happened. The panel's four recommendations: govern internal models used before or instead of release, build an incident task force, launch international information-sharing and joint crisis response, and scrutinize training techniques that reduce monitorability. Advice to the Commission. Not obligations. That last one sits right next to our Argon story. The panel discussed recent training techniques that reduce monitorability. The Commission doesn't say which ones, so nobody should draw a line between the two. Still, the follow-up requests are the part to watch. An actor with a statute behind it is asking. What companies send back, and whether any of it becomes public, decides how much this is worth.
Nate Kwan, writing in AI Affairs:
Anthropic and OpenAI had sought significant control over what outside AI evaluators could publish, Reuters reported on 13 October. The negotiations matter because independent evaluation is part of a White House safety accord, and reviewers are still working out what they can access and release.
We've followed the embedded evaluator pledges since September: outside reviewers inside the labs, free to publish. Two sources told Reuters that as recently as Monday, October 5, both labs sought strict editorial control over what evaluators could release. Two unnamed sources, and both companies dispute parts of it. Anthropic says evaluators it has worked with control their methods, conclusions and publication decisions; AI Affairs reports it reserves approval rights for reports by new firms. OpenAI says it doesn't seek approval over full reports, and acknowledged removing some details from at least one evaluation while letting reviewers flag the redactions. And by Thursday, October 8, one source said some of Anthropic's talks seemed to be moving away from that control posture. Genuine shift or retreat under a reporter's questions? Can't tell from outside. Tech Times points to the template: the METR and Redwood report on OpenAI agents at Hugging Face was redacted by OpenAI, and the evaluators said the cuts weren't material to their conclusions. So the contract is the safeguard. Three things it has to say: can the evaluator publish without sign-off, are redactions disclosed and located, and who paid. Until those terms are public, independence is a pledge.
Mark Rutherford, writing in Tech Times:
The paper, titled AI Models Can Provably Hide Arbitrary Capabilities and posted to arXiv on October 9, describes a technique for embedding an entire encrypted neural network inside the weights of a host model.
Authors from Oxford, Contramont Research and ACS Research; the arXiv listing says accepted at NeurIPS 2026. The hidden network only runs on a secret trigger. Fine-tuning reached about 50.9 percent on a binary task, chance, against 92.8 percent for an ordinary password-locked model. Headline says audits can't see it. Should every clean eval now be worthless? No, and the authors are careful. The guarantee covers drawing the capability out, not detecting it; an inspector might spot the odd circuit in the weights. Hiding a 672-weight classifier took a host of about 2.07 billion parameters, and the full construction hasn't been built into a pretrained model end to end. The threat model is deliberate sabotage by someone with weight access, not something training produces on its own. Which makes it a supply chain question. A safety case has to say who touched the weights between training and deployment, and how you'd know. A passed test is evidence about what was tested. What would change my read is a practical variant at real scale. The authors released code and weights so defenders get there first.
If you also want the capability side of the week, AI Daily Briefing covers the top AI news for engineers, founders, and investors each weekday, sorting real capabilities from demo hype, quickly. Search for it in your podcast app.
Every source we quoted is linked in the show notes. That's it for today's AI Safety Daily, a Lantern Podcast. We're back tomorrow.