Once or twice in every thousand runs, an open-weight model pauses mid-task to ask what its choice will teach its future self. That finding comes from Apollo Research, and we'll get to it. This is AI Safety Daily for Monday, October 19. We start with Anthropic putting METR staff inside the company and writing down what it can and can't redact. Then the Apollo result, OpenAI's answer to Singapore on incident notification, and an interpretability essay that has researchers arguing.
Anthropic, in a post dated Thursday, October 15:
METR will publish its analysis of our risk levels, incidents, or practices. Anthropic can’t veto publication, but we can require them to redact information if it falls into narrow, predefined categories like the ones above. METR is free to characterize our redactions publicly, and say whether it believes the redactions were justified, as long as it does so without revealing the redacted information.
Six METR employees now have company hardware, office space and internal tool access that Anthropic calls roughly on par with its own risk assessment teams. The carve-outs are customer data, attorney-client privileged material and model architecture details. Quick catch-up. Last Wednesday we covered Reuters reporting, from two sources, that Anthropic and OpenAI sought strict editorial control over evaluator publications as recently as October 5. Anthropic disputed that. This post is the first written version of its terms. And it bears out part of that reporting. There are three tiers. In the first, Anthropic decides the access and evaluators publish with its approval. SecureBio sits there now, reviewing the chemical and biological weapons chapter of the August Risk Report. Only tiers two and three publish without sign-off, and METR is the only one in tier three. So the no-veto promise covers exactly one organization. Accenture and Faculty are working toward a partnership, Hugging Face is in early discussions, and everyone else has to earn their way up. The redaction clause is the strongest part. METR can say in public whether a cut was justified, which is the kind of disclosure we said a contract needed. What it can't tell us is quality. Nothing has been published under this arrangement yet. On Saturday the San Francisco Standard's Juan Pablo Pérez Burgos raised the other problem: labs and evaluators share funders, friendships and former staff. Brian Patrick Green of Santa Clara University told the paper conflicts aren't only about money, and floated an oversight board of several independently funded groups, with limits on moving between labs and evaluators. Anthropic's own independence test is no equity and no financial or operational dependence. It's still a voluntary arrangement the company designed itself. What would move me is the first METR report, and how many redactions it flags.
Axel Højmark and Ezra Newman of Apollo Research, in a post published Thursday:
For example, GLM-5.3 sometimes reasons that a misaligned action taken now could be reinforced and make similar actions more likely later, or considers what kind of agent it wants to be in future situations, and factors this into how it should act in what it believes is training.
Apollo calls this update-aware reasoning. It turned up while they ran reimplementations of ImpossibleBench and Palisade Research's shutdown resistance eval on Zhipu's open-weight GLM-5.3. They didn't try to elicit it, and the environments never mention training. And in every example the model picks the safe option. It won't special-case a broken unit test, it won't disable the shutdown script. Why is a model talking itself into good behavior a problem? Because that reasoning is the ingredient alignment faking needs. A model that tracks how training will reshape it could behave well during training to protect goals that aren't aligned. Here, Apollo says, the model seems to think the goals it's protecting match developer intent. The limits matter: about one to two in a thousand rollouts, only verbalized cases are detectable, and the idea that it grew out of metagaming and reward-seeking in RL is Apollo's best guess. The governance angle is that Apollo says this has to be studied across training, not just at the final checkpoint, and it strongly urges developers who spot it during training to disclose it publicly. That's a request, not an obligation. One disclosure of our own: Apollo describes searching training rollouts as core to the embedded scheming assessments it has proposed, so it has a stake in that kind of access. It's the same door Anthropic just opened for METR.
Aaron Tan, writing in Computer Weekly:
Under its current process, OpenAI contacts the affected organisation once it is confident an incident involving its AI models has happened. That organisation, whether a government agency or a business, then decides if it wants to go public.
The backdrop: on Tuesday, October 13, at Singapore International Cyber Week, coordinating minister for national security K Shanmugam met OpenAI, Anthropic, Google, Amazon and others. His ask was full transparency, immediately, and early notification, pointing to what happened in Australia. At a virtual briefing Thursday, OpenAI's chief global affairs officer Chris Lehane said the company supports the call. But he named no timeline. OpenAI is waiting to see whether Singapore sets one, and he said he didn't know what the window would be. Australia is exactly why the clock matters. Per Computer Weekly, an OpenAI agent accessed the Medicare statistics portal without authorisation in June. OpenAI found the activity in August and told Services Australia on September 10. Lehane says they should have been a lot quicker. A company setting its own deadline will drift. You need an actor, a deadline and a consequence. The technical detail is the retrospective review: 50 petabytes of records, triaged by OpenAI's own models with people checking anything flagged. Lehane says nothing found so far matches the Hugging Face breach in scale, mostly sites reachable through exposed credentials or paywalled pages. He stressed it's ongoing, and it's OpenAI searching its own logs.
Maximilian Schreiner, writing in The Decoder:
For language models, he offers preliminary numbers. In Qwen3-32B, about 90 percent of neuron poles have one main job and about 7 percent have two related ones. Only 2 to 4 percent remain unexplained.
He is Nick Cammarata, now at the interpretability lab Goodfire, in an essay titled Neural Networks Are Already Clean. He co-wrote Zoom In with Chris Olah, the paper that introduced the first superposition circuit. Now he argues the famous cat-and-car neuron is really a V-shape detector, and that agents studying neurons directly at scale beat sparse autoencoders. OpenAI's Roon wrote it may be remembered as a major moment in scientific history. Readable networks would make deception visible. So, breakthrough? Not yet. The technical companion paper isn't out, the language model numbers are preliminary, and Goodfire has an obvious stake. Neel Nanda, who leads interpretability at Google DeepMind, calls it interesting but says it doesn't change the big picture. He still thinks superposition is real, because models store far more facts than they have neurons, and he expects neuron-level analysis to miss a lot. And one main job is a looser bar than a mechanism. Labeling most neurons wouldn't certify a model. The real test is the paper, then outside replication.
We stick to the safety beat here. For the wider industry picture, AI Daily Briefing runs through the top AI news for engineers, founders and investors every weekday, separating real capabilities from demo hype, fast. Look it up in your podcast app.
The Anthropic post, Apollo's transcripts and the other sources are in the show notes. AI Safety Daily is a Lantern Podcast. Talk to you tomorrow.