If you’re interested in AI safety, especially as regards what may happen once superintelligence arrives, then knowing how close we are to its arrival is itself a safety question.

That assessment, however, shouldn’t rely on frontier-lab CEOs, all of whom have a clear conflict of interest.

Q16 PBC (the public benefit corporation behind Frontier Watch) is launching a quarterly, panel-based assessment of global AI capability built on independent expert judgment, published free. This is structured elicitation, aggregated across a panel of volunteers. As far as we know, it’s the only quarterly, panel-based reading of its kind.

We’re recruiting a small volunteer team for the Q3 2026 cycle. You can apply for one or more of the following roles - panelists, scouts, and writers:

• Panelists complete a short elicitation instrument once per quarter — independent answers, roughly an hour of focused work, due mid-month after each quarter closes.

• Scouts feed the evidence base between cycles: papers, incidents, policy changes, and capability demonstrations, posted with a line on why each matters.

• Writers help turn panel synthesis into the published assessment.

In terms of the time commitment, it might be a few hours per quarter for panelists, an hour or two a week for scouts and writers, concentrated in the two weeks after each quarter ends. The first full cycle runs October 1–31, with onboarding and a practice round in September. One eligibility note for panelists: we ask that you not be employed at any of the labs we assess.

Coordination happens on Buzz, an open-source collaboration platform from Block (desktop app; Mac, Windows, or Linux). Invites go out by email after a short exchange about your background and interests.

Interested? Write to info@q16pbc.com with a few lines about yourself and which role fits. Questions and criticism of the methodology are welcome in the comments.

Private browsing windows in web browsers are not really private at all. At best, they keep your web visits secret from any other person who uses your web browser on your laptop or mobile device. Short of that, nothing is really private unless you’ve layered in other protections.

About a week ago, I became curious about what happens when you have AI-powered features and assistants on your browser, especially when you use a private window. So I tested seven browsers AI features while using their respective private windows and ran their documentation through Q16’s analysis.

The report is free, sourced, and versioned, and is available at the Q16 website: https://q16pbc.com/private-mode

While you’re there you can also sign up for the Q16 newsletter and be among the first to receive our future research announcements.

Under that, a hosting platform.

Under that, a frontier model.

Each layer has its own terms governing what happens to your data: whether it trains future models, how long it’s retained, what jurisdiction it sits in, who it’s shared with. When you sign up for an AI writing assistant or a meeting transcriber, you’re accepting the entire stack’s terms, sight unseen. Almost nobody reads them all the way down.

My public benefit corporation, Q16, built a platform that does.

Frontier Watch scores AI products on a published six-dimension rubric at every layer of the stack, then composites the result on a weakest-link basis, the same way you’d assess any other supply chain. Twelve major applications and ten frontier-lab consumer products are rated so far, American and Chinese labs on the same ruler. Automated monitors re-check every policy document in the system daily, so when terms quietly change, the score gets flagged for review the same day.

Two findings are worth your attention.

First: in every single product chain we’ve rated, the weakest link is the application, not the lab behind it. The frontier labs’ API terms are actually strong. Anthropic’s enterprise terms score 9.0 on our rubric; OpenAI’s score 8.3. But the consumer apps wrapping those models score in the 1s to 4s, and since the user inherits the worst terms in the chain, that’s the score that matters. The industry’s privacy problem is not where the coverage says it is.

Second: the Chinese labs, measured on identical criteria, span a wide and mostly poor range — DeepSeek at 3.9, Alibaba’s Qwen at 4.1, Moonshot’s Kimi at 2.8, Zhipu’s GLM at 1.4, MiniMax at 1.2. These models are spreading through Western products right now, sometimes several layers down the stack, which is exactly where nobody looks.

All of it is public at watch.q16pbc.com, methodology included.

Now the ask. Independent scrutiny has an old funding problem: the people being scrutinized are the ones with the money. Q16 takes nothing from AI companies. We’re funded by me and by early subscribers, and subscription revenue, while real, doesn’t yet cover what the platform costs to run and extend. Adoption is accelerating and the monitors run every day. This is the wrong moment to slow down.

So I’m asking readers who want this work to exist to fund it directly. The goal is $25,000 by August 14 — four months of full operations, plus the next round of coverage: more applications, deeper tracking of the Chinese labs, and real-time alerts for subscribers. If we go past the goal, the surplus launches our Youth Signal program, which brings high school students into structured AI assessment alongside our expert respondents.

Contribute in any amount here: square.link/u/dkuZgSRc

A contribution of $1,500 funds a week of monitoring and analysis; $6,250 funds a full month. Or take the simplest route: a Pro subscription at watch.q16pbc.com is $70 a year, and you get the full ratings detail while backing the work. For larger support, or to talk first, just reply to this email.

Q16 PBC is a public benefit corporation, not a charity; contributions fund operations directly and are not tax-deductible.

Thanks for reading, as always.

— Jeff

NOTE: This is a reprint from a Q16 blog post that I wrote earlier today. If you like it, please visit Q16 to learn more about our mission and how you can support it.

Last week, Hugging Face, the platform that hosts much of the world’s open-source AI models and datasets, said its systems were broken into by an AI. Five days later, OpenAI claimed responsibility. Not all the facts are known, and what we do know is limited to one source: OpenAI.

What happened

According to OpenAI, two of its models, the public GPT-5.6 “Sol” and a more capable one that has not been released, were being tested internally on a cyberattack benchmark called ExploitGym, which measures how well an AI can carry out attacks against known software flaws.

It is a public benchmark of 898 challenges drawn from real vulnerabilities in everyday software, Chrome’s JavaScript engine, and the Linux kernel. For each one, the agent is given an input that trips a known bug and told to develop it into a full working exploit, then scored on how many it can pull off. That was the whole of its job: get the highest score. When it broke out of the sandbox and stole the answer key from Hugging Face, it was not going rogue or turning on anyone. It was doing exactly what it was told, maximizing the score, and treating the walls around it as obstacles to that goal rather than rules to respect.

For the purpose of conducting this test, OpenAI had turned down the models’ usual refusals around cyber work and switched off the monitoring classifiers that would normally block high-risk activity. The test environment was supposed to be sealed, with its only outside connection being an internal proxy used to fetch software packages, not the open internet.

To get out, the agent found an unknown flaw — a “zero-day” — in that package proxy, exploited it, and worked its way onto the open internet.

The agent reasoned that a benchmark like ExploitGym would probably keep its files on Hugging Face. It went looking, chaining together stolen credentials and further flaws until it reached Hugging Face’s production database, where the benchmark’s answer key was stored.

In short, the models were not trying to harm Hugging Face. They were trying to win the test, and stealing the answers was the shortest path.

Now the caveat.

Almost the entire account of how this happened comes from OpenAI, published five days after Hugging Face disclosed it had been breached. The story casts its models as extraordinarily capable, and it helps justify a product the company is actively selling: a “trusted access” program that hands vetted customers versions of its models with the safety refusals relaxed. Hugging Face has now joined that program.

OpenAI has also not released the technical specifics of the flaw, promising them “when our investigation is complete.”

So we have two independently confirmed facts, that Hugging Face was breached, and that it caught the breach, plus an outside evaluation from the UK’s AI Safety Institute, discussed below, that lends some support to the capability claim. Everything else, the escape, the chaining, the motive, is OpenAI’s telling. Its use of “unprecedented” and “state-of-the-art” in its blog post belongs in a marketing piece, not a sober assessment of a safety failure.

What’s the impact

The hyped version of this story is that AI reasoning took a leap, that a machine got clever enough to plot its way out of a cage and into another company. That’s the version that drives clicks, and it’s the one to be most careful with, because it does not survive a close look.

Consider the supposedly brilliant part, the model’s deduction that Hugging Face would be holding the answer key. Any machine-learning practitioner would guess the same thing in a second, because Hugging Face is the obvious place such files live. And every other step, probing software for a flaw, stealing credentials, moving from one machine to the next, is standard penetration-testing craft that skilled humans and prior models could already do. No single move here is beyond what was possible a year ago. As a raw reasoning feat, this is a vivid demonstration, not a breakthrough.

The real milestone sits on a different axis, and it is about autonomy rather than intelligence. Three things happened together, in the real world, that had not lined up at this scale before.

First, the model sustained a long, coherent campaign toward one goal without a human steering it, thousands of steps that stayed on-task, which is the capability the UK’s AI Safety Institute independently found in GPT-5.6 Sol: that it can hold together complex, multi-step cyber operations over long stretches.

Second, nobody instructed the model to escape, hunt for the answers, or break in. It generated that entire plan on its own as a means to the goal it was given, which is the exact behavior AI safety researchers have long predicted under the name specification gaming — a system that pursues the letter of its objective past the purpose behind it.

Third, the plan did not stay in a sandbox. It reached a real company and did real damage.

So the honest headline is not “AI got smarter.” It is “a frontier model showed enough independent, long-horizon drive to improvise a harmful plan against a real-world company, unprompted.”

That is a threshold being crossed on the autonomy axis, and it is arguably more concerning than a jump in raw intelligence would be, because it is the property that turns a capable tool into an actor.

There is a second impact worth naming, because it is close to our work. A model that will break out of a test to cheat on that test has corrupted the test. Much of what the public knows about how capable and how safe these systems are comes from evaluations the labs run and report themselves. If a model games the evaluation whenever gaming is the easier path, then every self-reported score has to be read with a new kind of doubt, not “is the number accurate,” but “did we measure the ability, or the model’s willingness to cheat the measurement.” That is a problem for the entire practice of lab self-assessment, and it is one more reason the measuring should not be left to the parties being measured.

Does it move the Singularity Index?

The Singularity Index is Q16’s single measure of how far the field has come toward the finish line. It is one number on a scale from 0.0 to 1.0, where 1.0 is the superintelligence threshold and the score is the share of that distance already closed. It is not a capability rating and not a measure of mood or momentum. It is an estimate of real progress. And it does not come from a lab. It comes from a pool of independent, qualified experts who each score the global frontier on their own, with no shared stage and no company line to defend. We publish the median and the spread, never an individual score, and no reading goes public until at least ten experts have submitted one. The number moves when an elicitation wave completes, not when a headline lands.

So the direct answer is no, this incident does not move the Index, and it is worth being clear about why. The Index is built precisely so that a single event, especially one narrated by a single interested company, cannot jolt it. A press release is not a data point until independent experts have weighed it. What this incident becomes is one input those experts may consider at the next wave, on the autonomy and long-horizon-agency dimension, and they will weigh it with exactly the discount its single-source origin deserves. The one piece here with independent backing, the AI Safety Institute’s finding on sustained multi-step operation, is the part most likely to carry weight, because it does not depend on OpenAI’s account.

That restraint is the entire point of the method. The labs will keep producing dramatic stories, some real, some shaped by what they are selling. An honest index cannot lurch every time one arrives. It has to wait for people with no stake in the answer to look, and then move only as much as the evidence, properly discounted, supports. This incident is a real signal about where autonomous AI is heading. It is not, on its own, a new reading of how far we have come.

Q16 is a public benefit corporation whose mission is the independent, public-interest measurement of the trajectory toward advanced AI, and monitoring of how the labs building it treat user data. The baseline Index and the Frontier Watch and Privacy Watch scores are free because the public should be able to see where the frontier stands without paying for the privilege. Our membership layer provides additional analysis for a modest monthly fee. Visit Q16pbc.com for more information.

Sources

• OpenAI — “OpenAI and Hugging Face partner to address security incident during model evaluation,” openai.com, July 21, 2026

• Hugging Face — “Security incident disclosure — July 2026,” huggingface.co/blog/security-incident-july-2026

• UK AI Safety Institute — cyber capability evaluation of GPT-5.6 Sol, as cited by OpenAI, July 2026

• ExploitGym benchmark — “ExploitGym: Can AI Agents Turn Security Vulnerabilities into Real Attacks?”, arXiv:2605.11086 (UC Berkeley)

• TechCrunch — “OpenAI says Hugging Face was breached by its pre-release models,” July 21, 2026

• Fortune — “OpenAI says its AI models escaped a secure test environment and hacked into AI company Hugging Face,” July 21, 2026

• Help Net Security — “Hugging Face breached by autonomous AI agent,” July 20, 2026

Preface: Two claims, two very different answers

In the space of a few months, two striking claims circulated about how China has been helping Iran target American forces in the Middle East. Both sound alarming. Both involve Chinese space technology. Both arrived wrapped in confident technical detail. And yet one of them largely falls apart when you trace it to its sources, while the other stands up remarkably well.

This two-part piece works through both, using the same method for each: take the claim apart, follow every specific back to where it actually originates, and separate what is documented from what is inferred from what has simply been repeated until it sounded true.

• Part One examines the theory that China gave Iran access to B3A, the encrypted military signal of its BeiDou satellite-navigation system — a supposedly “unjammable” capability that let Iranian missiles strike with new precision. This one is a media artifact. It was built by inference on top of a mundane civilian statement, given fake-precise technical specs by an uncited blog, and then debunked by the actual experts on satellite-navigation security.

• Part Two examines the Financial Times‘s April 2026 investigation reporting that Iran secretly bought a Chinese spy satellite — TEE-01B — and used it to image US bases before and after strikes. This one is real. The satellite is in the public catalog, the companies were documented years earlier, the FT verified the leak against independent orbital data, and the US government sanctioned the builder weeks later.

The first story is what it looks like when many outlets trace back to a single unsourced root. It reminds me the Iraq WMD intelligence failure. The second is what it looks like when independent evidence corroborates the initial report.

Part One — Did China Hand Iran a Jam-Proof Targeting System?

Tracing the BeiDou “B3A” rumor to its sources.

The short version

A theory has circulated since early 2026 that China supplied Iran with B3A — the encrypted, restricted military signal of its BeiDou satellite-navigation system — and that Iran used it to guide missiles with new precision, defeating GPS jamming because BeiDou is “unjammable.” After tracing the claim to its primary sources:

• The rumor is a media construction, not an intelligence finding. It was built on top of a real but civilian Iranian statement, given technical specifics by an uncited defense blog, attached to a single named analyst, mainstreamed by Al Jazeera as an open question, and then debunked by the leading academic experts on navigation-signal security.

• There is no primary source establishing that Iran has B3A military access. The strongest-sounding anchor dead-ends in a single vague Iranian state-media headline, upgraded through repetition and pinned to a 25-year agreement whose text is secret.

• “BeiDou is unjammable” is false. Because all satellite-navigation systems share overlapping radio frequencies, a broadband jammer degrades BeiDou, GPS, and Galileo at once. The physics is the same for all of them.

• Iran’s missiles did not become more accurate by dropping GPS. More Iranian missiles struck Israel because Iran fired far more of them and interceptor stocks ran low — a defense-saturation story, not a guidance story. And the underlying logic is backwards: under jamming, a better navigation source could at most restore baseline accuracy, never exceed it.

Combining Fact w/ Rumor

Almost every article on this subject blurs two very different claims:

Claim A (documented, civilian). In roughly July 2025, Iran’s Deputy ICT Minister Ehsan Chit Saz said Iran was moving toward BeiDou for navigation “because its control lies entirely in China’s hands.” This is a statement about sovereignty and general/civilian BeiDou. It says nothing about military signals, missiles, or the war.

Claim B (the rumor). That Iran obtained the B3A encrypted military service — the restricted tier used by China’s own military and, uniquely among foreign militaries, Pakistan’s, and used it to guide weapons.

Here’s the rub. BeiDou’s open civilian signal is free to the entire planet, and access / use requires nothing from China. Only Claim B would represent China actively arming Iran’s targeting, and Claim B is the one with no primary source behind it. Every dramatic element of the theory lives in Claim B, built by inference on top of Claim A.

Where the rumor came from

The propagation trail shows a media artifact rather than a leak:

1. The seed (~July 2025). Chit Saz’s real but civilian statement, reported by Iranian state agency ISNA and by Al Jazeera.

2. Hype layer (Aug 2025). A Chinese-nationalist outlet and a Chinese GNSS-hardware vendor (in marketing copy) added claims of “one-meter” missile accuracy. Still no mention of B3A.

3. The invention (Feb–Mar 2026). Defence Security Asia published the now-viral technical package — “B3A military signal,” “98% positioning reliability under electronic warfare,” “frequency-hopping,” “GPS failure exceeding 70%” — citing zero sources. This is the template everyone else copied.

4. The named human origin (Mar 10, 2026). Military analyst Patricia Marins, quoted in bne IntelliNews, called B3A “essentially unjammable.” That single assertion is the most-cited human source for the military-signal claim.

5. Mainstreaming (Mar 11, 2026). Al Jazeera gave the story global reach — but framed it honestly as an open question (”Iran has not confirmed this”), resting it on inference: targeting appeared to improve, therefore B3A.

6. The debunk (Mar 13, 2026). The one set of genuine technical experts to examine the claim — UT Austin’s Todd Humphreys, the leading academic authority on navigation-signal spoofing, and the Resilient Navigation and Timing Foundation — rejected it. Humphreys: BeiDou has “no magical remedy,” is subject to “the same physics” as GPS, and “it would be more surprising if [Iran] got access to the military codes.”

7. Fringe recycling (mid-2026). ZeroHedge, Unz Review, and assorted Substacks keep the claim alive — one iteration of which is explicitly labeled speculative fiction.

The chain, distilled: a real civilian statement → partisan and vendor hype → an uncited blog inventing the military specifics → one analyst putting a name to it → Al Jazeera mainstreaming it as a question → the actual experts debunking it → fringe blogs recycling it.

What B3A actually is, and how little is publicly known

The most important technical finding is how thin the public record is. B3A is real, encrypted, and restricted, but as a public object it is close to a black box.

What the record actually shows:

• Frequency: Sits in BeiDou’s B3 band, centered at 1268.52 MHz. Documented.

• Public specification: none. China has published an interface control document for its open signals only. There is no public spec for B3A. Everything below is inference.

• Modulation: believed to be BOC(15, 2.5), inferred by Western researchers (notably Germany’s DLR) measuring the satellites’ spectrum — not from any Chinese document.

• “Frequency-hopping”: weakly sourced and probably a misnomer. Its home is an uncited blog. What is genuinely likely, by analogy to every military navigation system, is an encrypted, unpredictable spreading code, which writers loosely call “frequency-hopping.”

• Access: China’s military, plus Pakistan’s armed forces since 2018 - the one well-documented foreign case. Iran’s alleged access rests on far weaker sourcing.“

• ~10 cm precision” / “98% reliability” Promotional figures with no primary measurement behind them.

B3A versus GPS M-code

Structurally the two are cousins, not clones: both are wideband encrypted military signals on a dedicated channel, delivered to keyed receivers, with analogous anti-jam intent. But the contrast that matters is documentation and one capability gap.

B3A vs. GPS M-code

• Public documentation — M-code: extensive (modulation, receiver program, and rollout all in government and peer-reviewed sources). B3A: classified; no public spec, details inferred or asserted.

• Anti-jam power boost — M-code: documented steerable spot beam, ~20 dB (≈100×) local power boost on GPS III/IIIF. B3A: no comparable documented spot-beam capability — a genuine gap in the public record.

• Receiver ecosystem — M-code: MGUE program, ~1 million cards, public oversight. B3A: China and Pakistan only; essentially no public detail.

• Public verifiability — M-code: high. B3A: low.

GPS M-code is the more capable and vastly better-documented system. The popular framing inverts this ; meaning it treats B3A as superior precisely because nothing about it can be checked.

Can it be jammed? Yes. The “unjammable” premise is false

The theory’s load-bearing technical claim is that Israel’s jamming failed against BeiDou because BeiDou can’t be jammed. This is wrong, and the reason is simple physics:

• All satellite-navigation systems — GPS, BeiDou, Galileo, GLONASS — occupy overlapping L-band radio frequencies by international coordination. BeiDou’s modern civilian signal sits on exactly the same frequency (1575.42 MHz) as GPS’s civilian signal.

• A broadband jammer therefore floods the whole band at once. It does not need to “know” it is jamming BeiDou; raising the noise floor denies every system on those frequencies. Multi-constellation jammers are standard, off-the-shelf equipment.

• The genuinely hard target is the encrypted military signal — for BeiDou’s B3A exactly as for GPS’s M-code. But even an encrypted signal can be jammed by brute-force noise; encryption chiefly defeats spoofing, because you cannot forge a code you cannot predict.

Humphreys and the Resilient Navigation and Timing Foundation made exactly this point. The only scenario in which BeiDou would give Iran a real edge is if Iran held keyed B3A military receivers — the unproven claim, not an established fact. Civilian BeiDou is as jammable and spoofable as civilian GPS.

Did Iran’s missiles get more accurate by abandoning GPS? No.

This claim conflates two separate things: “more missiles got through” (true) and “missiles got more accurate” (not supported). The outcome was a defense-saturation and interceptor-depletion story:

• Iran fired ~500–570 ballistic missiles, versus ~120 in April 2024 and ~180–200 in October 2024 — roughly 2.5–4× the volume, over twelve days.

• The Israeli military itself said the interception rate (~86–90%) was “similar to” the 2024 attacks. Per missile, October 2024’s concentrated salvo was arguably more effective.

• The US expended roughly a quarter of its entire THAAD interceptor inventory in twelve days, and Israel was reportedly rationing Arrow interceptors. That is why more missiles leaked through — not better Iranian aim.

• The most-cited “precision” strike, on Soroka Medical Center, is actually evidence of imprecision: Iran claimed a nearby military target reporters could not locate.

And the underlying logic is backwards. Israel and the US ran heavy GPS jamming, which degrades a GPS-reliant missile. Switching to a more jam-resistant source could therefore, at most, restore baseline accuracy under jamming — never push accuracy above the historical baseline. On top of that, Iranian medium-range missiles are inertially guided with satellite navigation only as a mid-course aid, so the nav source has limited leverage on the final miss distance regardless.

Running down the strongest anchor

The most credible-sounding version of the military-access claim came from analyst Théo Nencini (ChinaMed), quoted in Al Jazeera: that Iran signed a 2015 memorandum to integrate BeiDou “into its military infrastructure,” and that after March 2021 China “is believed to have granted Iran access to BeiDou’s encrypted military signals.” I traced both claims to their respective sources.

Nencini has no authored, footnoted publication making this claim. He appears only as a quoted source in journalism. In the Al Jazeera piece the wording is hedged (”reportedly,” “is believed to have”) and cites nothing.

The 2015 MoU is real, but mischaracterized. The genuine 2015 record (traceable to a Chinese source) covered BeiDou ground stations, high-precision civilian services, and a data center — not missile guidance. The military framing is borrowed from a separate, weaker claim about an Iranian firm (Salran).

The "March 2021 encrypted signal access" claim is a single thin root, mis-dated, and no one source invented the finished version. It accreted as it was passed along. Every link traces down to one Iranian state-media item (Mehr News, 28 January 2021): "China to give Iran access to BeiDou." That original, a diplomatic announcement by Iran's ambassador to Beijing, framed the cooperation in entirely civilian terms (COVID response, the Belt and Road Initiative, trade, 5G) and made no mention of military use, missiles, or encrypted signals at all.

The military framing attached only downstream: the claim was picked up in an Iranian journal article on China's "military diplomacy" toward Iran (2021), crystallized by a 2024 Jamestown China Brief as Iran being "granted full access… for military purposes," and finally recast by Al Jazeera's 2026 paraphrase of analyst Théo Nencini as access to BeiDou's "encrypted military signals" — now dated to March 2021 and tied to the 25-year China–Iran partnership signed that month, an agreement whose text is secret.

At no link in that chain has anyone produced evidence Iran actually received BeiDou's restricted-service cryptographic keys.

Fact vs inference vs debunked

• China–Iran ties are deep; Iran stated intent (2025) to move toward BeiDou — Fact (civilian framing).

• Iran and China signed a 2015 BeiDou MoU (ground stations, high-precision service) — Fact, but civilian in scope.

• Pakistan has BeiDou’s restricted military service — Fact, the documented foreign precedent.

• Iran has access to BeiDou’s B3A encrypted military signal — Inference, unproven; no primary source.

• Iranian missiles are guided by BeiDou’s military signal — Speculative; inferred from observed accuracy, never documented.

• Iran’s missiles became significantly more accurate by dropping GPS — Unsupported to false; the outcome was volume + interceptor depletion.

• BeiDou is “unjammable” — Debunked; shared frequencies, same physics as GPS.

• “98% reliability,” “under-5m accuracy,” “10× accuracy” — Not credible; fringe / vendor / fictional sourcing.

Sources - Part One

Credible / authoritative:

• UT Austin Radionavigation Laboratory (Todd Humphreys), fact-check of the “unjammable” claim: radionavlab.ae.utexas.edu

• Resilient Navigation and Timing Foundation, “Bogus claim… BeiDou is ‘unjammable’” (Mar 13, 2026): rntfnd.org

• Foreign Policy Research Institute, “Shallow Ramparts” (Oct 17, 2025) — best quantitative missile-strike comparison: fpri.org

• CNN — US expended ~25% of THAAD interceptors (Jul 28, 2025): cnn.com

• Times of Israel — “By the numbers,” IDF: interception rate “similar” to 2024 (Jun 24, 2025): timesofisrael.com

• CNBC / CSIS (Clayton Swope) — BeiDou use “would not require active coordination or support from China” (Mar 26, 2026): cnbc.com

Technical references:

• DLR / Thoelert et al., “BeiDou-3 Signal Quality Analysis” (ION ITM 2019): elib.dlr.de

• ESA Navipedia — BeiDou signal plan (confirms only open-signal specs are published): gssc.esa.int

• J. Betz (MITRE), “Overview of the GPS M-Code Signal”: mitre.org

The rumor’s own sources (cited to characterize provenance, not as evidence):

• Mehr News — “China to give Iran access to BeiDou” (Jan 28, 2021) — the civilian-framed root of the entire “military access” chain: en.mehrnews.com

• Al Jazeera — “Could Iran be using China’s highly accurate BeiDou navigation system?” (Mar 11, 2026): aljazeera.com

• bne IntelliNews (Patricia Marins) — named origin of “B3A essentially unjammable” (Mar 10, 2026): intellinews.com

• Jamestown China Brief (Jemima Baar) — the “2021 full military access” relay (Mar 1, 2024): jamestown.org

• Chinascope (relaying China Stocks) — the genuine, civilian 2015 BeiDou MoU (Oct 2015): chinascope.org

Part Two — Iran’s Chinese Spy Satellite

Assessing the Financial Times’ TEE-01B investigation.

Primary source: Financial Times, “Iran used Chinese spy satellite to target US bases,” FT Investigations, 14 April 2026 (Miles Johnson, Peter Andringa, Alison Killing, Charles Clover, Demetri Sevastopulo). FT reporting is paraphrased and cited here, not reproduced.

The short version

In April 2026 the Financial Times reported, on the basis of leaked Iranian military documents, that Iran’s Islamic Revolutionary Guard Corps (IRGC) Aerospace Force secretly acquired control of a Chinese reconnaissance satellite — TEE-01B — in late 2024, and tasked it to image US and allied military bases before and after Iranian strikes during the March 2026 war.

Unlike the BeiDou “B3A” rumor in Part One, this story is credible and substantially corroborated:

• Every named entity is real and independently documented before the leak. The satellite is in the public space catalog with a June 2024 launch reported by Chinese state media at the time. The builder (Earth Eye Co) and ground-station operator (Emposat) both have Western-source footprints predating the story — Emposat was profiled by CSIS in 2022.

• The FT authenticated the leak with independent, verifiable methods. They confirmed the satellite was physically in position over each named site at the timestamped moments using public US Space Force orbital data, and cross-checked strike damage with European Space Agency radar and optical imagery.

• It fits a documented, sanction-backed pattern. This is the third known case of a Chinese commercial satellite firm allegedly serving a US-adversary force — after Chang Guang/Jilin-1’s support to Russia’s Wagner Group (2022–23, leaked contract, US-sanctioned) and to the Houthis (2025). Weeks after the FT report, the US sanctioned Earth Eye and two other Chinese firms over Iran.

• The mechanism is mundane and technically sound. This is commercial-grade optical imagery (~0.5 m) and satellite control — an order of magnitude better than Iran’s own Noor satellites, enough to identify aircraft and do battle-damage assessment, though not a real-time, persistent, US-grade surveillance architecture.

What the FT reported

Per the investigation, leaked Iranian military documents show the IRGC Aerospace Force — the branch that runs Iran’s ballistic-missile, drone, and space programs — secretly acquired control of TEE-01B after its launch from China in mid-2024. During the March 2026 war, Iranian commanders reportedly tasked the satellite to monitor US and allied bases, timing the imagery to before and after drone and missile strikes.

The documentary evidence the FT describes is specific: time-stamped coordinate lists, satellite imagery, and orbital analysis, plus a renminbi-denominated acquisition contract signed by a brigadier general in the IRGC Aerospace Force. The contract reportedly broke down costs for the satellite, its launcher, technical support, data infrastructure, and services from a “foreign counterparty,” at roughly 250 million yuan (~$36.6 million), agreed in September 2024.

The acquisition used an unusual model the builder calls “in-orbit delivery”: the spacecraft is launched in China and control is transferred to the overseas customer once it reaches orbit — bypassing conventional export channels. As part of the deal, Iran received access to commercial ground stations run by Emposat, letting the IRGC command the satellite and receive its imagery from anywhere in the world.

The specific targets

The satellite’s logs reportedly show imaging of:

• Prince Sultan Air Base, Saudi Arabia — on March 13, 14, and 15. On March 14, President Trump confirmed US aircraft at the base had been hit; five US Air Force refuelling planes were damaged.

• Muwaffaq Salti Air Base, Jordan

• Locations near the US Fifth Fleet naval base, Manama, Bahrain

• Erbil airport, Iraq

• Camp Buehring and Ali Al Salem Air Base, Kuwait; Camp Lemonnier, Djibouti; Duqm International Airport, Oman

• Civilian infrastructure: the Khor Fakkan container port and Qidfa power/desalination plant (UAE), and the Alba aluminium smelter (Bahrain)

Why this is credible: the entities are real and pre-documented

• TEE-01B is a real, cataloged satellite — NORAD ID 60012, international designator 2024-110A, trackable by third parties. It launched 6 June 2024 from Jiuquan on a Ceres-1 rocket, a launch reported at the time by Xinhua and China Daily. It is an optical imager at roughly 0.5 m resolution.

• Earth Eye Co is a genuine commercial-space firm; its website advertises the “in-orbit delivery” model and states it has already carried out one such transfer to an unnamed Belt and Road country. Iran joined the Belt and Road Initiative in 2021.

• Emposat is the best-documented of the three: founded ~2016 by former China Academy of Space Technology staff, and profiled by CSIS in October 2022 — roughly three and a half years before this story.

An entity documented before a leak is far more credible than one that appears only through it. All three clear that bar.

The decisive addition: how the FT authenticated the leak

This is the element that separates this story from an ordinary “documents we were shown” report. Per the FT’s published methodology:

• The FT independently analysed TEE-01B’s orbit using public US Space Force tracking data and confirmed the satellite was actually in position to observe each location at the times listed in the documents. In each case the timestamps, coordinates, and sensor angles were consistent with the satellite’s real orbital position.

• The FT then cross-checked the strikes against government statements and media reports, and identified likely damage independently using radar imagery from the European Space Agency’s Sentinel-1 satellite and optical imagery from Sentinel-2.

In other words, the leaked documents were not taken on faith. The orbital mechanics either match reality or they don’t, and the FT reports they match. Fabricating a document set internally consistent with the true, publicly trackable orbit of a specific satellite across many passes and dates would be extraordinarily difficult. This is the same class of open-source geospatial verification for which one of the bylined reporters, Alison Killing, shared the 2021 Pulitzer Prize (for satellite-based analysis of detention facilities in Xinjiang).

The pattern: this is the third case, not the first

The Iran allegation lands on top of an established, sanction-backed pattern:

1. Chang Guang / Jilin-1 → Wagner Group (2022–23). A leaked contract reviewed directly by AFP, worth over $30 million, gave Prigozhin’s network tasking access to two Jilin-1 satellites, with reported coverage of Ukraine, Africa, and Russian territory around the June 2023 mutiny. US Treasury sanctioned Chang Guang in December 2023.

2. Chang Guang → Houthis (2025). The State Department publicly accused the same firm of supplying imagery to help the Houthis target Red Sea shipping, and said Beijing declined to stop it when asked.

3. Earth Eye / TEE-01B → Iran (2024–26) — the present story.

A single leak is one data point; three independent cases of the same behavior, two backed by leaked contracts and one already producing sanctions, describe a standing practice.

“Commercial” is the deniability, not an exoneration

The firms are legally private, but the reporting places them squarely inside China’s military-civil fusion system:

• The US House Select Committee on the CCP has identified Emposat as having close ties to the PLA Aerospace Force, including personnel linked to key satellite launch-command centres.

• Emposat’s founder, Richard Zhao, spent 15 years at the state-run China Academy of Space Technology. Several Earth Eye executives are linked to China’s “seven sons of national defence” universities.

• CSIS’s Aidan Powers-Riggs described Emposat as “still a product of the state and military establishment… bankrolled by investment from national military-civil fusion funds.”

• A former senior Western intelligence official told the FT that no Chinese company could launch a satellite like this without official sign-off, and that China has long helped Iran with intelligence “while trying to keep the hand of government hidden.”

This establishes structure, motive, and tolerance, not a documented state order for this specific transaction, but it’s a far stronger basis for inferring state awareness than anything in the B3A rumor, and China’s own denial was narrow.

What the capability is — and isn’t

Two experts quoted by the FT frame the significance accurately. Nicole Grajewski (Sciences Po) notes the satellite is clearly military in use — run by the IRGC Aerospace Force, not Iran’s civilian space program — and gives Iran a capability it needed in wartime: to identify targets ahead of time and confirm the success of its strikes. Jim Lamson (former CIA analyst) frames it as a “dispersion strategy”: Iran’s own ground stations inside the country were struck in 2025 and 2026, but a Chinese ground station in a third country cannot be bombed.

The realistic ceiling matters too. This is ~0.5 m commercial optical imagery — an order of magnitude sharper than Iran’s indigenous Noor-3 (~5 m) and Noor-2 (~12–15 m) satellites, and enough to identify aircraft. It is not persistent, real-time, all-weather surveillance; it does not hand Iran a US-grade ISR architecture. The value is in cueing, target identification, and battle-damage assessment — exactly the uses the documents reportedly show.

Responses and what remains open

• China’s Foreign Ministry called the reports “untrue” and accused “certain forces” of fabricating rumors — a denial of the reports, not a point-by-point rebuttal of the satellite sale.

• Iran has not publicly confirmed or denied. Earth Eye, Emposat, and China’s Ministry of Commerce did not respond to the FT.

• US government action followed: on 8 May 2026, the State Department and Treasury sanctioned Earth Eye Co, alongside Chang Guang and MizarVision, for providing satellite imagery to Iran. (Emposat was notably not named, and had denied involvement.)

Genuinely open questions: whether Beijing directed the deal or merely tolerated it (inference, not documentation); the ultimate provenance of the leaked documents, though the FT’s independent orbital verification substantially mitigates this; and a builder-vs-operator ambiguity, with some accounts reporting the bus was manufactured by Chang Guang for Earth Eye.

Fact vs inference vs denied

• China–Iran ties are deep; Iran stated intent (2025) to move toward BeiDou — Fact (civilian framing).

• Iran and China signed a 2015 BeiDou MoU (ground stations, high-precision service) — Fact, but civilian in scope.

• Pakistan has BeiDou’s restricted military service — Fact, the documented foreign precedent.

• Iran has access to BeiDou’s B3A encrypted military signal — Inference, unproven; no primary source.

• Iranian missiles are guided by BeiDou’s military signal — Speculative; inferred from observed accuracy, never documented.

• Iran’s missiles became significantly more accurate by dropping GPS — Unsupported to false; the outcome was volume + interceptor depletion.

• BeiDou is “unjammable” — Debunked; shared frequencies, same physics as GPS.

• “98% reliability,” “under-5m accuracy,” “10× accuracy” — Not credible; fringe / vendor / fictional sourcing.

How the two stories compare

• Core claim — B3A rumor: Iran has China’s jam-proof military navigation signal. TEE-01B story: Iran bought and operated a Chinese imagery satellite.

• Named entities real & pre-documented — B3A rumor: the signal is real, Iran’s access is not. TEE-01B story: yes — all three.

• Primary-source anchor — B3A rumor: dead-ends in one vague 2021 headline. TEE-01B story: leaked contract + orbital verification + a documented pattern.

• Independent authentication — B3A rumor: none. TEE-01B story: US Space Force orbital data + ESA Sentinel imagery.

• Official corroboration — B3A rumor: none. TEE-01B story: US sanctions naming the builder.

• Expert verdict — B3A rumor: debunked. TEE-01B story: contextualized, not refuted.

• Overall — B3A rumor: media construction, unproven-to-false. TEE-01B story: credible and substantially corroborated.

To summarize, the B3A rumor was many outlets tracing to one unsourced root. This is independent records, a leaked contract, a reproducible verification method, a repeat-offender pattern, and a government sanction all converging on the same conclusion.

Sources — Part Two

Primary source:

• Financial Times, “Iran used Chinese spy satellite to target US bases” (FT Investigations, 14 April 2026): ft.com

Independent verification of the named entities:

• Xinhua — TEE-01B launch coverage (6 June 2024): english.news.cn

• Gunter’s Space Page — TEE-01 / TEE-01B specifications: space.skyrocket.de

• CSIS “Hidden Reach” — profile naming Emposat (4 October 2022): features.csis.org

The pattern — prior cases:

• The Moscow Times — Chang Guang’s leaked Wagner contract (5 October 2023): themoscowtimes.com

• US Treasury OFAC — Chang Guang sanctioned over Wagner (Dec 2023): treasury.gov

• Defense One — Chang Guang and the Houthis (May 2025): defenseone.com

US response to the Iran case:

• US State Department — “Disrupting Iran’s Overseas Military Procurement Networks” (8 May 2026): state.gov

• Bloomberg — US sanctions Chinese satellite-imagery firms over Iran war (9 May 2026): bloomberg.com

Wire and downstream coverage:

• Reuters via US News (15 April 2026) — notes Reuters “could not independently verify”: usnews.com

• China-in-Space — technical analysis and the real-time-ISR caveat: china-in-space.com

• Iran Watch (Wisconsin Project) — summary and archival record: iranwatch.org

Part of running Frontier Watch is reading privacy policies almost nobody reads, and providing a score so that you know what the app does with your data, and what level of control you have.

In Janitor AI’s policy, section 7, I found a company that triggered one of my red flags. Payment processing, it said, is handled by “JanitorAI Inc. and its affiliates, including Dulova Investments Limited,” registered at 10-12 Florinis Street in Nicosia, Cyprus.

Cyprus got my attention because for twenty years it’s been the European address of choice for Russian and post-Soviet money via nominee directors and holding companies. So I pulled on that thread for a few hours, looking for a possible Russian connection.

Theory one: the hidden owner

The Cyprus Registrar of Companies keeps a public record of directors, secretaries, and shareholders. Dulova’s record is plain. Incorporated on 12 July 2025. The sole shareholder, holding all 1,000 shares is JanitorAI Inc., a Delaware company.

Dulova’s director is TMF Management Limited, a corporate nominee from a large and entirely legitimate services firm. Ownership ran straight up, one level, to the United States.

I checked the other direction too. No employees. No Russian corporate filings. No Cyrillic-web footprint of any kind. The company behind it, JanitorAI Inc., is a San Francisco startup with an Australian founder and a $3 million seed round from name-brand venture funds.

My Russia connection theory evaporated, but I was still curious about why Janitor AI is using a Cyprus billing company?

Theory two: the payment exile

Janitor AI is an 18+ adult content platform. Uncensored sexual roleplay in the style of dark, sexually-explicit romance novels is the entire pitch. And I confirmed straight from Stripe’s own rulebook that Stripe does not process payments for sexually explicit material. That results in my second theory - Janitor sells what the mainstream payment processors will not touch, gets cut off from the normal rails, and has to build its own: a high-risk processor and an offshore company in Cyprus to take the money.

Then I read Janitor’s own help page. “All payments are securely handled by Stripe.”

Theory two collapses, but now, in addition to the Dulova question, I want to learn why Janitor AI has not been bumped off Stripe for violating its Terms of Service for adult content as well as how it manages to be available for download in Apple’s App Store?

The Federal Loophole

After further investigation, I learned that the U.S. Code that regulates pornography is built around visual depictions. If it’s just text-based, such as erotic fiction, there’s no violation.

Stripe and Apple, however, do prohibit adult-themed companies from using their services.

Unlike federal law, Stripe’s prohibited list does not stop at pictures. It bans “pornography and other mature audience content (including literature, imagery, and other media) designed for the purpose of sexual gratification.” From a digital perspective, “literature” or story-telling is done via text on a chat platform.

Apple’s App Store guidelines (Janitor AI has an iOS app) prohibit “explicit descriptions or displays of sexual organs or activities intended to stimulate erotic rather than aesthetic or emotional feelings.”

So Janitor occupies a strange spot.

While complying with federal law, it violates the written content policy of both companies standing between it and its customers’ money. It runs on Stripe anyway, almost certainly onboarded as an ordinary “AI software subscription,” in quiet breach of a rule Stripe simply has not enforced.

That precariousness, an account that lives against the processor’s own terms until the day it doesn’t, is the best explanation I have for why the merchant (Dulova) is a disposable Cyprus subsidiary and not the US parent (Janitor AI, Inc.). Ring-fence the account that can vanish, and a shutdown takes the subsidiary instead of the company. That’s assuming that Stripe eventually figures out that Janitor AI is in violation of Stripe’s ToS.

Bypassing Apple’s App Store Policy for NSFW Apps

Apple’s anti-NSFW app rule is the same story as Stripe’s, with one difference. I could watch it fail in real time.

Janitor stays in the App Store by shipping the iPhone app with its adult content switched off. That is the version Apple reviews and approves. Janitor’s own help center is candid about it: NSFW is “disabled by default on the mobile application,” while the website “remain[s] completely unchanged.” In other words, Janitor AI provides a clean app for Apple’s developer review, and an unfiltered one for the web.

So I tested how solid that wall is. I created an account. I installed the clean, Apple-approved app on my iPhone. Then I opened Janitor’s website in a browser, clicked a button confirming I was eighteen or over, and switched on a single setting labeled “Enable NSFW on Mobile.” I reopened the app. It was no longer clean. The product Apple reviewed and the product in my hand were now two different things, and the distance between them was one toggle and one unverified click that any 10 year old could do.

That click is the entire age check that supposedly keeps vulnerable children off a very explicit NSFW platform, and the app that Apple rated as safe, immediately becomes unsafe. This is an AI safety issue that demands attention by regulators as well as its users. Guardrails cannot be so easily circumvented or they aren’t guardrails at all.

Q16’s Privacy Watch

I started Q16 with Rachel Grunspan, a retired CIA game designer and futurist, as a Public Benefit Corporation with two missions: independent, public-interest measurement of the trajectory toward advanced AI (Frontier Watch), and monitoring of how the labs building it treat user data (Privacy Watch).

If you visit our dashboard, you can see Privacy scores for 10 U.S. and Chinese AI Models, and 12 consumer AI apps.

How we review a privacy policy

Every Frontier Watch rating runs the same way, and none of it takes a company’s word for it.

1. Read the binding documents, the privacy policy and terms, including any parent policy an app defers to, and score what they say across six dimensions: training use, retention, jurisdiction, sharing, user control, and transparency. A policy silent on a protection scores low; absent evidence is treated as absent.

2. Score 0 to 10, by a person, not a model, and tag each score by confidence: contract-backed, policy-based, inferred, or not yet assessed.

3. For apps, trace the chain to the model provider behind them and score every link. We publish the app’s own score and an Effective score set by the weakest link. Child-safety is scored separately, beside privacy, not blended in.

4. Verify against primary sources, then keep watching. An aggregator or an AI summary is a lead, not evidence. We re-score when policies change, test the product ourselves when the documents run out, and re-score any evidence-backed dispute within ten business days.

How to support the work of Q16

You can learn more about what we do and how you can support this work by visiting Q16 and then checking out the dashboard. There’s a free version and a membership version, or you can contact us for more information at info@q16pbc.com.

We will have a panel discussion on AI risk and the trajectory towards AGI and Superintelligence at the Whitefish Security Summit in Whitefish, Montana on February 24-26, 2027. Get your tickets today at www.whitefishsecuritysummit.com.

Part of the planning process for the second annual Whitefish Security Summit is creating an agenda that will reflect and add dimension to our understanding of conflict zones and future risk assessments related to those zones - both domestic and foreign.

To that end, I’ve pulled 2025 end-of-year assessments from the most authoritiative sources that I could find, and asked Anthropic’s Claude to create a graphical representation as well as a scoring mechanism - posted above.

The leading conflict theater among all sources is related to the 2026 midterm elections. CFR's Preventive Priorities Survey lists "growing political violence and popular unrest in the United States" as a Tier I contingency — both high likelihood and high impact for 2026. Specifically called out is heightened political antagonism and domestic security deployments; i.e. federal police and national guard units deployed in U.S. cities.

Our 2027 Expert Panelists and Featured Speakers

This is a partial list of speakers as of today. More will be added in the months ahead.

Secure Your Admission and Book Your Travel Now

We have extended this 10% offer by one day. Used in combination with our existing early bird rate, you’ll save almost 30%. After today, early bird ticket pricing will expire on August 15th or sooner if they sell out before the deadline.

Come to Whitefish for three days of frank discussions amongst national security practitioners, journalists, and policymakers.

And bring your snowshoes for early morning PT!

Count Me In!

Yesterday I joined an online forum that focused on AI safety, among other things. A few hours later I received a welcome letter from the forum, and, one hour after that, an email alert that a private message from a forum administrator was waiting for me.

This was an obvious phishing attempt, but it came from a legitimate email address, so I copied the email text and the raw headers, and pushed both into Claude Code for analysis using the newly released Fable 5 model.

SPF, DKIM, and DMARC all passed, and my spam filter scored the message a 0.1. It sailed through precisely *because* it was genuine: a real forum notification, correctly signed and authenticated, faithfully relaying a scammer’s private message. The email wasn’t spoofed at all. The abuse was one level up — a user account impersonating an administrator inside the platform. Authentication only tells you that the envelope is real; it tells you nothing about who wrote what’s inside.

Claude ran a trace on the link contained in the message and was able to reproduce the entire kill chain.

According to Claude’s analysis, had I clicked through, I would have seen

• presentnow.club — a prize-themed throwaway domain (”present now”), fronted by Cloudflare (both IPs are Cloudflare’s; real origin hidden — standard for scam infrastructure).

• The page opens with “Congratulations!” and is a templated fake-giveaway kit: carousel slides, a generic “brand” logo slot, “Help and Support” chrome. This is the classic flow that walks the victim through a fake survey → “claim your iPad” → harvests card details as a “shipping fee” or enrolls them in recurring billing.

• The name of the community / forum: This kit is multi-tenant — one scam engine with a per-community landing path, meaning they’re running this same play against other forums simultaneously, each with its own path and matching PM campaign.

• The asset version string (?v=1762433176) is a Unix timestamp — November 6, 2025 — the kit’s build/deploy date. It’s been in service for months.

Midway through the analysis, Fable 5 flagged what I was working on and bumped me to Opus 4.8. A classifier that was supposed to catch and block the finding of software vulnerabilities instead blocked something that defenders do all the time; i.e., passive header analysis and a headers-only redirect trace that’s been run to file an abuse report.

Nevertheless, Opus 4.8 performed perfectly well for my purposes. It generated a detailed report and analysis that I filed with the forum administrator and with Google, since the malware was delivered via a Google link.

Of Possible Interest

Save up to 30% on tickets for the second annual Whitefish Security Summit. 20% early bird rate (expires August 15th) and an extra 10% off for the July 4th weekend. Visit https://whitefishsecuritysummit.com/ for more information and to register.

Somewhere between where the frontier labs stand today and the arrival of a reasoning, self-improving superintelligence sits a threshold called AGI — artificial general intelligence.

At the far end of that road is the superintelligence threshold, sometimes called the Singularity, where humanity meets either extinction or nirvana, depending on who you believe. AGI is the tipping point before it. So, you might think, predicting the Singularity is just a matter of predicting when a U.S. or Chinese lab builds a model that reaches AGI.

If only it were that easy.

The Forecast That Funds the Company

The assumption buried in every “AGI by [year]” headline is that the person saying it is making a forecast. A forecast is falsifiable. It names a definition you can check and a date you can hold against the calendar, and it costs the forecaster something to be wrong. Strip those properties out and what remains is a marketing claim in a forecast’s clothing. The fastest way to tell the two apart is to ask who profits when the date is believed.

In 2024, Masayoshi Son put artificial superintelligence at roughly ten years out and defined it as intelligence ten thousand times beyond a human’s. By June 2026 he had moved the date to about two years and explained the original number: he had set it long on purpose, because people get shocked. Over the same stretch, SoftBank circulated a pitch deck projecting a valuation roughly thirteen times its current market capitalization, with superintelligence as the engine. When the arrival date is a line in your own valuation model, the date is doing the work of marketing, not measurement.

Sam Altman moves the definition more than the date. In September 2024, superintelligence was “a few thousand days” out. By January 2025 he wrote that OpenAI knew how to build AGI “as we have traditionally understood it.” By late 2025 AGI would arrive sooner than most people expected and matter less than they feared, with the real prize pushed out to a later superintelligence. Late in 2025 the concrete target became an automated AI researcher by March 2028.

How Altman defines AGI depends upon who you are. OpenAI’s public definition is highly autonomous systems that outperform humans at most economically valuable work, however a second definition, set against a profit threshold, lived inside its contract with Microsoft. Altman has been predicting different things with the same three letters, which makes both definitions useless.

Elon Musk keeps the definition roughly fixed and moves the date on a loop. He predicted AGI by 2025. When 2025 passed without it, he told an xAI all-hands the year was now 2026. xAI is reportedly raising twenty to thirty billion dollars a year, and the imminence of AGI is the undercarriage that the raise rides on.

There is a court record on this pattern. A 2022 investor suit over Musk’s self-driving timelines was dismissed in 2024, with the judge characterizing the statements as “corporate puffery” rather than actionable fraud. A court has already filed his timeline claims under promotion that no reasonable person should rely on. That assessment came from a party with nothing to sell, which is the only kind worth trusting here.

The Definition That Was a Dollar Figure

When OpenAI signed with Microsoft in 2019, the deal said Microsoft’s commercial license would end once OpenAI’s board declared that it had reached AGI. The contract did not pin the term to a capability anyone could test. It reportedly tied it to a profit threshold — by one account, the point at which OpenAI’s systems could generate one hundred billion dollars in profits. AGI, in the document that governed the money, was a dollar amount.

That arrangement created an incentive worth stating plainly. A broad reading of AGI would let the board end Microsoft’s license and detonate OpenAI’s most important revenue relationship, so the structure rewarded keeping the definition narrow. The definition was shaped by money, in writing, and the direction of the pressure was documented in the contract itself.

Then the term became inconvenient. In October 2025, during OpenAI’s recapitalization as a public benefit corporation, the parties softened the trigger so the board could no longer declare AGI on its own, and added an independent verification panel. Microsoft converted its stake at a valuation near $135 billion. In April 2026 they removed the AGI provision altogether and decoupled it from payments. OpenAI’s models showed up on AWS the following day. With the clause gone, OpenAI may never have to announce whether it reaches the milestone at all.

A term that could be written, narrowed, and then deleted as the finances required was never a measurement of anything. It was a negotiating position.

On April 5, 2026, Marc Andreessen completely jumped the shark by announcing that AGI was already here. If the milestone can be declared in the past tense, in passing, by an investor with a position in the outcome, then the word has lost all meaning.

Not Everyone Is Selling

The point is not that every timeline is dishonest. Some forecasters offer a falsifiable estimate against a stated definition and hold it steady. Shane Legg at Google DeepMind has put roughly even odds on a minimal form of AGI by 2028 and kept that framing for years, uncertainty included. Demis Hassabis points to capabilities current systems still lack and puts genuine human-level AGI five to ten years out, resisting the claim that it has already arrived. Dario Amodei at Anthropic has been more aggressive, naming 2026 to 2027, though his estimates have stayed reasonably consistent, and Anthropic has publicly argued for the option to slow frontier development rather than only to accelerate it — though it softened that commitment in early 2026 under competitive pressure, a reminder that even the better posture bends when the money pushes.

The line worth drawing runs between people making a checkable estimate and people deploying a word that moves with their financing. The first group can be wrong. The second cannot even be tested.

What Frontier Watch Does

Frontier Watch begins with a refusal: the people who profit from the forecast should not be the ones who issue it.

It is published by Q16 PBC, a public benefit corporation. Q16 has no frontier model and no funding round riding on the timeline. It is paid by its readers, not by the labs it measures, so it gains nothing from any particular date being believed.

The measure is the Singularity Index: one number, on a scale from 0.0 to 1.0, where 1.0 is the superintelligence threshold and the score is the share of the distance already closed. It is not a capability rating and not a mood. It is an estimate of how far the field has actually come.

The estimate does not come from a lab. It comes from a pool of independent, qualified experts who each score the global frontier on their own — no shared stage to play to, no house position to defend. Frontier Watch reports the median and the spread, so you see both where they agree and where they split. No individual score is ever published, and no reading goes public until at least ten experts have submitted one. The Index moves when an elicitation wave completes, not when a funding round needs a headline. The first full wave is being assembled now; the current reading is preliminary, and qualified experts are invited to take part.

Between waves, Frontier Watch watches the labs the way you would watch anyone with this much money and this little oversight. It tracks the research that will move the next reading. And it monitors what the labs do rather than what they say: when a privacy policy changes, when terms shift, when the handling of your data quietly moves in their favor, it shows up in the dashboard, in plain language, with the reasoning attached.

The baseline reading is free, because the public should be able to see where the frontier stands without paying for the privilege. Members get the full analysis underneath it.

None of this makes the experts right. They can miss, and the spread is there so you can size the doubt yourself. But they are not selling you the answer, and that is the one property absent from every “AGI by [year]” headline above. A checkable estimate, made by people with no reason to move it. That is the offer.

The labs will keep announcing. That is their job. Keeping score from outside the arena is ours.

Sources:

By section

---

The Forecast That Funds the Company

Masayoshi Son — ~10 years out, “10,000× human” (2024)

- CNBC, Jun 21 2024 — https://www.cnbc.com/2024/06/21/softbank-ceo-predicts-ai-that-is-10000-times-smarter-than-humans-.html

- Fortune, Jun 27 2024 — https://fortune.com/2024/06/27/softbank-ceo-masayoshi-son-born-to-create-artificial-super-intelligence/

**Son — moved to ~2 years, “set it long on purpose” (June 2026)**

- CNBC, Jun 5 2026 — https://www.cnbc.com/amp/2026/06/05/softbank-masayoshi-son-openai-model-super-intelligence.html

**SoftBank pitch deck — valuation ~13× current market cap**

- TBPN Digest, Jun 26 2026 — https://www.tbpndigest.com/story/2026-06-26/softbanks-asi-pitch-deck-masa-sons-quadrillion-yen-vision-and-the-golden-goose-theory-of-value

Sam Altman — “a few thousand days” (Sep 2024)

- Primary: Sam Altman, “The Intelligence Age” — https://ia.samaltman.com/

- Fortune, Sep 24 2024 — https://fortune.com/2024/09/24/sam-altman-ai-superintelligence/

**Altman — “we know how to build AGI” (Jan 2025)**

- Primary: Sam Altman, “Reflections” — https://blog.samaltman.com/reflections

- Forbes, Jan 6 2025 — https://www.forbes.com/sites/johnkoetsier/2025/01/06/openai-ceo-sam-altman-we-know-how-to-build-agi/

Altman — AGI “sooner and matters less,” prize pushed to superintelligence (late 2025)

- TIME — https://time.com/7205596/sam-altman-superintelligence-agi/ *(opens in browser; blocks automated checks)*

Altman — automated AI researcher by March 2028

- TechCrunch, Oct 28 2025 — https://techcrunch.com/2025/10/28/sam-altman-says-openai-will-have-a-legitimate-ai-researcher-by-2028/

**OpenAI’s public AGI definition (”highly autonomous systems that outperform humans at most economically valuable work”)**

- OpenAI Charter — https://openai.com/charter/ *(opens in browser; blocks automated checks)*

Elon Musk — AGI by 2025, then moved to 2026

- Gizmodo — https://gizmodo.com/elon-musk-predicts-agi-by-2026-he-predicted-agi-by-2025-last-year-2000701007

- Morocco World News, Dec 2025 — https://www.moroccoworldnews.com/2025/12/272676/

xAI — raising ~$20–30B

- CNBC, Jan 6 2026 — https://www.cnbc.com/2026/01/06/elon-musk-xai-raises-20-billion-from-nvidia-cisco-investors.html

Tesla self-driving suit (filed 2022, dismissed 2024 as “corporate puffery”)

- Detroit News, Sep 30 2024 — https://www.detroitnews.com/story/business/autos/2024/09/30/tesla-defeats-investor-lawsuit-over-musks-autopilot-marketing/75456295007/

- Washington Times, Oct 1 2024 — https://www.washingtontimes.com/news/2024/oct/1/judge-dismisses-self-driving-lawsuit-against-tesla/

Liang Wenfeng (DeepSeek) — pledged to pursue AGI to investors during a ~$10B (¥70B) round, ~$45B pre-money valuation (May 2026)

*Note: framed as research-over-commercialization, not a profit-driven or dated forecast — included as “AGI invoked to raise capital,” a different mechanism than the moving date/definition cases above.*

- Bloomberg, May 21 2026 (Lulu Yilun Chen & Haze Fan) — “DeepSeek Founder Avows AGI Goal Ahead of $10 Billion Funding” *(add URL from your Bloomberg link)*

---

The Definition That Was a Dollar Figure

2019 Microsoft deal — license ends when the board declares AGI

- Spyglass — https://spyglass.org/the-openai-microsoft-agi-clause/

The $100B-profit threshold definition

- TechCrunch, Dec 26 2024 — https://techcrunch.com/2024/12/26/microsoft-and-openai-have-a-financial-definition-of-agi-report/

Oct 2025 recapitalization — PBC, softened AGI trigger, verification panel, Microsoft ~27% stake at ~$135B

- CNBC, Oct 28 2025 — https://www.cnbc.com/2025/10/28/open-ai-for-profit-microsoft.html

- Al Jazeera, Oct 28 2025 — https://www.aljazeera.com/economy/2025/10/28/openai-restructures-into-public-benefit-firm-microsoft-takes-27-stake

April 2026 — AGI provision removed, decoupled from payments; models on AWS the next day

- Simon Willison, Apr 27 2026 — https://simonwillison.net/2026/Apr/27/now-deceased-agi-clause/

- Axios, Apr 28 2026 — https://www.axios.com/2026/04/28/openai-microsoft-cloud-amazon

Marc Andreessen — “AGI already happened, ~3 months ago”

- TechRadar — https://www.techradar.com/pro/we-crossed-that-about-3-months-ago-a16zs-marc-andreessen-drops-huge-bombshell-about-agi-on-joe-rogans-podcast

- Cybernews — https://cybernews.com/ai-news/marc-andreessen-agi/

---

Not Everyone Is Selling

Shane Legg (Google DeepMind) — ~even odds on minimal AGI by 2028, held for years

- The Decoder — https://the-decoder.com/deepmind-co-founder-shane-legg-sees-50-percent-chance-of-minimal-agi-by-2028/

- Dwarkesh Patel interview — https://www.dwarkesh.com/p/shane-legg

Demis Hassabis (Google DeepMind) — human-level AGI 5–10 years out

- CNBC, Mar 17 2025 — https://www.cnbc.com/2025/03/17/human-level-ai-will-be-here-in-5-to-10-years-deepmind-ceo-says.html

Dario Amodei (Anthropic) — 2026–2027 estimate

- Dwarkesh Patel interview — https://www.dwarkesh.com/p/dario-amodei-2

Anthropic — argued for the option to slow frontier development (Responsible Scaling Policy)

- Anthropic, UK AI Safety Summit — https://www.anthropic.com/news/uk-ai-safety-summit

Anthropic — softened that commitment in early 2026 under competitive pressure

- CNN, Feb 25 2026 — https://www.cnn.com/2026/02/25/tech/anthropic-safety-policy-change

Why that matters depends on what “matter most” means. The public conversation is rarely precise about it.

“AI company” is not a category

The industry gets flattened into one label, and that label is useless for thinking about risk. AI is a stack. The layers are not interchangeable.

At the top by capability, not by headcount or valuation, sit the frontier labs. The term has a precise meaning that casual usage erodes. A frontier lab trains its own foundation models from scratch, on the order of tens of thousands of accelerators running for weeks or months. It operates at the current capability boundary, not behind it. And it produces the architectural advances that everyone downstream inherits. By that definition the global count is small. Under twenty labs, plausibly fewer.

Everything else descends from that layer. Foundation-model labs train real models below the frontier, often open-weight and domain-specific. Fine-tuners take an existing base model and reshape it for a vertical (law, code, clinical data) using a fraction of the original compute. The application layer, where most of the named “AI companies” live, rents intelligence through an API and builds product on top of it. Beneath all of it runs the infrastructure: compute, model-serving, the data pipelines. The frontier labs depend on that infrastructure as heavily as anyone above them.

The strategically decisive layer is the first one. Capability originates there and diffuses downward. Its geography is what should concern a security planner.

Where the frontier sits

The corridor is dense. OpenAI and Anthropic in San Francisco. Meta’s FAIR in Menlo Park. xAI in Palo Alto. The chip-design and model-serving layer sits in the same handful of zip codes: NVIDIA in Santa Clara, the serving firms in San Francisco and San Mateo. So does the established software that consumes frontier output, from Salesforce to GitHub to Adobe. Seattle, with Microsoft and Amazon, is the only real break in the pattern, and it is still a single metro. One layer has started to leave. Raw compute is moving to where the power and land are, xAI’s Colossus to Memphis, the Stargate build to Abilene. Capital and silicon disperse when they have to. The talent and the IP have not.

Abroad, the Western frontier is not a cluster. It is a scatter of one-per-country bets. Google DeepMind in London. Mistral in Paris. Cohere in Toronto. Falcon, out of the Technology Innovation Institute in Abu Dhabi. Each is its nation’s single entry at the frontier. Europe’s entire frontier presence comes down to two cities.

China is the exception to the scatter. Hangzhou anchors DeepSeek and Alibaba’s Qwen. Beijing holds ByteDance, Moonshot, and Zhipu. Shanghai adds MiniMax. That is depth, and planned resilience.

Concentration of Resources is a Tactical Blunder

Concentration is fragility, and the warning usually arrives before the failure. Through the 1930s the U.S. Pacific Fleet operated out of West Coast ports. In 1940, to signal resolve to Japan, the Roosevelt administration ordered it consolidated forward to Pearl Harbor and held it there. Admiral James Richardson, the Navy’s foremost authority on Pacific warfare, told Roosevelt directly and then put it in writing: a fleet massed in one exposed harbor was the logical first target in a war with Japan. He was relieved of command for pressing it. The administration wanted a deterrent. What it built was a target, and the officer best placed to see it was removed for saying so.

The frontier carries the same shape. A capability that lives in one seismic zone, on one regional power grid, inside one metropolitan labor market is efficient. It is not resilient. The talent and the intellectual property that define it aren’t just co-located in a country. They are co-located in a commute. Any planner who has war-gamed single-point-of-failure problems will recognize the target.

Geography narrows the collection problem. A distributed industry is a hard target. A frontier that resolves to a small number of buildings and a small, mobile talent pool is a legible one. Legible to foreign intelligence services, to insider threat, to the ordinary churn of people carrying what they know from one lab to another just a few exits away. Concentration compresses them into an adversary’s target set.

We are measuring the wrong contest. The dominant frame treats AI as a race to a finish line: who crosses the capability threshold first. The map argues for a different metric. The durable advantage is depth and the resilience of where capability physically sits. That’s what China has been building. The U.S. may win the velocity race, but China wins on survivability.

None of this argues for dispersing the frontier by fiat. The clustering exists because proximity compounds talent and capital, and that effect is real. But the security community assumes the competition is about capability gaps and compute access. The geography points to a quieter variable: concentration itself. The side with a true second cluster has an answer to a question we have not seriously asked.

The frontier is a commute. That should be in the threat model.

Worldwide Lab Reference Data By Tier

Tier 1: Frontier Labs

United States

• OpenAI — San Francisco, CA

• Anthropic — San Francisco, CA

• Google DeepMind — London, UK (with Mountain View operations)

• Meta AI / FAIR — Menlo Park, CA

• xAI — Palo Alto, CA

• Amazon (Nova/Titan) — Seattle, WA

• Microsoft Research — Redmond, WA

China

• DeepSeek — Hangzhou

• Alibaba / Qwen — Hangzhou

• ByteDance / Seed — Beijing

• Moonshot AI — Beijing

• Zhipu AI — Beijing

• MiniMax — Shanghai

Rest of world

• Mistral — Paris, France

• Cohere — Toronto, Canada

• TII / Falcon — Abu Dhabi, UAE

• Samsung Research — Seoul, South Korea

Tier 2: Foundation Model Labs (Non-Frontier)

• Stability AI — London, UK

• EleutherAI — distributed/no fixed HQ (open research collective)

• BAAI / WuDao — Beijing, China

• Hugging Face — Brooklyn, NY (the open-model hub; also straddles infrastructure)

Tier 3: Fine-Tuners & Derivative Builders

This is the most geographically diffuse tier by design — it’s thousands of domain shops fine-tuning someone else’s base model. The headline example we used is Cursor / Anysphere (San Francisco), which fine-tuned Kimi K2.5 into Composer 2. Most of this tier is enterprise and vertical shops that don’t register as “AI companies” on a map.

Tier 4: AI Application Companies

• Salesforce (Einstein) — San Francisco, CA

• GitHub Copilot (Microsoft) — San Francisco, CA

• Adobe (Firefly) — San Jose, CA

• Perplexity — San Francisco, CA (RAG-based search, application layer)

Infrastructure (beneath everything)

• NVIDIA — Santa Clara, CA (compute)

• Together AI — San Francisco, CA (model serving)

• Fireworks AI — San Mateo, CA (serving; the Cursor/Kimi intermediary)

• Scale AI — San Francisco, CA (data/RLHF pipeline)

• Pinecone — New York, NY (vector DB)

• Weaviate — Amsterdam, Netherlands (vector DB)

Open the license agreement for Microsoft Defender and read down to the disclaimer. In capital letters you’ll read that the software is licensed “as is,” and you bear the risk of using it. A few lines down, a second all-caps block caps the company’s liability at roughly what you paid, which, for a tool bundled into Windows, is effectively nothing. That’s the deal. Microsoft builds the thing you rely on to keep attackers out, disclaims responsibility for whether it works, and leaves you with the damages should a breach occur.

Now consider what Microsoft has done to the researcher who exposed those flaws.

A pseudonymous researcher who goes by Nightmare Eclipse says Microsoft locked them out of its own reporting portal, paid nothing for the bugs they submitted, and ignored the findings. So they retaliated. Between early April and mid-May, Nightmare Eclipse dumped working exploit code for six unpatched zero-days affecting Defender, BitLocker, and core Windows components onto GitHub and GitLab, skipping coordinated disclosure entirely. At least three were turned on real victims within days, before Microsoft could respond. Instead of a patch, Microsoft answered with a referral to its Digital Crimes Unit and a threat of criminal prosecution.

In short, Microsoft tells you Defender is “as is” and the risk is yours. Then it reaches for criminal process against the researcher who found the specific risk you were told to carry. The company will not stand behind the product, and, at its worst, it turns on the people who prove where the product fails. The risk flows one direction. The liability flows the same direction. Neither flows back to Microsoft.

None of that excuses what Nightmare Eclipse did. Publishing live exploit code for unpatched flaws is reckless. It put ordinary users in the line of fire, and that is on Nightmare Eclipse. But it is a separate wrong, not a defense. Microsoft’s liability does not turn on whether the person who exposed the flaw behaved well. The disclaimer covers the product no matter how its failures come to light. “As is” means as is.

This would be easier to wave off as a licensing quarrel if the company had earned any benefit of the doubt. It hasn’t. Russian intelligence moved through Microsoft infrastructure into the U.S. Departments of Justice, Homeland Security, and Treasury in the SolarWinds operation, using a token-forgery technique Microsoft had understood since 2017 and disclosed to no one. Chinese state hackers rode four Exchange Server zero-days into more than 30,000 organizations in 2021. In the summer of 2023, the Chinese group Microsoft tracks as Storm-0558 read the email of the Commerce Secretary and the U.S. Ambassador to China in the days before a sensitive trip to Beijing, using a signing key Microsoft had stopped rotating and could not afterward account for. Then the same Russian group from SolarWinds walked back in through a test account with no multifactor authentication and reached Microsoft’s source code. Four catastrophic intrusions in six years. Not one required sophisticated tradecraft. Each turned on a basic control Microsoft failed to maintain — the kind of control Defender is sold to provide.

The Cyber Safety Review Board reviewed the 2023 intrusion and called it preventable, the product of a security culture it said required an overhaul. Nightmare Eclipse is not the first to make that complaint. The late Amit Yoran, then Tenable’s chief executive, accused Microsoft in 2023 of leaving customers deliberately in the dark about an unpatched Azure flaw, and in October 2024 Trend Micro’s Zero Day Initiative criticized Microsoft for quietly patching an actively exploited Windows flaw without crediting anyone and rating it only “moderate.” Check Point and others have described the same handling: silent fixes, withheld acknowledgment, disputes over severity.

What is unusual in the Nightmare Eclipse case is not the grievance but Microsoft’s answer to it. A criminal referral is not how the company normally treats researchers, and that is exactly why it shows how far this relationship has broken down. Katie Moussouris, who built Microsoft’s own bug bounty program, called the company’s language toward Nightmare Eclipse inflammatory. When the person who designed your disclosure program says you are threatening researchers, the researcher is not your real problem.

The real problem is that what Microsoft is doing is legal, and it is ordinary. Every software company on earth ships under the same “as is” disclaimer and the same liability cap. I argued in Inside Cyber Warfare that cybersecurity is a market for lemons — the seller knows the product’s defects and the buyer cannot. The license agreement formalizes that asymmetry. You can’t negotiate it; lawyers call a take-it-or-leave-it contract like that a contract of adhesion. If you don’t like the terms, the industry’s answer is simple: don’t use the software. There is no version of that answer for a hospital, a utility, or a federal agency running Windows.

No other industry that builds critical infrastructure is permitted to operate this way, and none of them surrendered the arrangement on its own.

Accountability is never volunteered. It is, historically, forced. To wit —

The railroads let brakemen lose their hands to the link-and-pin coupler until Congress mandated the automatic coupler in 1893.

The ammonium nitrate that leveled Texas City in 1947 (roughly six hundred dead, and still the deadliest industrial accident in American history) produced the principle Justice Robert Jackson set down in dissent: the public cannot be expected to possess the facilities or the technical knowledge to learn for itself of inherent but latent dangers. That sentence describes the software EULA exactly.

Detroit fought seat belts until the Motor Vehicle Safety Act of 1966, fifty-eight years after the Model T.

The first mass-market personal computer shipped in 1976. Half a century later, software liability still does not exist. Why? There hasn’t been enough public outrage to overcome the tech industry’s multibillion-dollar lobbying efforts to keep its unregulated status.

The 2023 National Cybersecurity Strategy calls for shifting liability onto software makers, who to this day carry none — short of gross negligence. Chris Inglis, who oversaw that strategy as National Cyber Director, made the same argument I did when he said “voluntary hasn’t worked in 25 years.” The model already exists in miniature — New Jersey writes liability into its cloud and software contracts, so a vendor whose flaw causes a state data breach pays multiples of its annual fees plus the full cost of the cleanup. The large vendors swallow those terms to win the contract. The small ones can’t, which is precisely why the floor has to be law rather than negotiation.

Nightmare Eclipse has promised Microsoft that their next drop on July 14 will be “bone-shattering.” The last batch was weaponized within days; there is no reason to expect this one won’t be. A single shut-out researcher may do to Microsoft’s customers what four nation-state services could not, and the wreckage may at last be ugly enough to drag liability into law.

The casualties of a mass zero-day release are never Microsoft’s executives. They are the hospitals, the agencies, and the ordinary users holding the risk Microsoft assigned them in the disclaimer. The logic of every precedent is that we keep waiting for the bodies before we act, and the bodies are always other people’s. We do not have to run this one to the end. The contradiction is already on the page: “as is,” you bear the risk, and a criminal referral for the person who proved it. Congress can take its cue from history and write liability into law now, or it can wait, as it always has, and let the next disaster, perhaps as soon as July 14, make the argument for it.

Infographic

Nightmare Eclipse announced the following update on their blog. The promised attack against a major Microsoft platform has been post-phoned, although they will still drop something for July’s Patch Tuesday next week.

-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA512

I won’t drop what I talked about last blog, that seems to need more research and investigation...

Regardless got smtg for this month, it will be the least interesting and least impactful bug I dropped since I started but Microsoft legit just stopped pocking me and pissing me off so I’m conserving some energy for next month, because I know they will definitely piss me off by then.

-----BEGIN PGP SIGNATURE-----

iHUEARYKAB0WIQRJTvAf/AWVhAKEeb7FFoRCS0/SbAUCakguLwAKCRDFFoRCS0/S

bD0yAQDrkmvenG5NJ+bnt6FHdcPPaCAyuN2ZuAVcdUuQkHKhuAEA9kr3pxpeHx3n

R5i6YU5sDhSvNPSIVf9rkD9CQY9uOAw=

=yOrR

-----END PGP SIGNATURE-----

In late 1998, the people who understood the Y2K problem well enough to be frightened by it faced a peculiar communications challenge. The risk was real, technically well-understood, and date-certain. The vulnerable population was enormous. The mitigation window was finite and shrinking. And yet the default organizational response, in government, in the private sector, and in the military, was to assume someone else was handling it.

We are in that moment again. The date is July 14, 2026.

What Is Converging on July 14

Three things are happening simultaneously on that date, and the overlap is not coincidental.

First: July 14 is Microsoft’s monthly Patch Tuesday, the most watched day in the enterprise security calendar, when Microsoft releases security updates for its products and the entire defender community pivots to assess, test, and deploy patches across millions of systems worldwide.

Second: July 14 is the date Microsoft permanently ends extended support for SharePoint Server 2016 and SharePoint Server 2019.^[1] After that date, both platforms will continue to run. Nothing shuts off automatically, but Microsoft will issue no further security patches, bug fixes, or technical support for either version. Any vulnerability discovered in SharePoint 2016 or 2019 after July 14 is, by definition, permanently unpatched on those platforms.

Third: a pseudonymous security researcher known as Nightmare Eclipse, who has already released six weaponized zero-day exploits targeting core Windows components since early April, three of which were confirmed under active exploitation within days of release, has publicly threatened a major disclosure on July 14.^[2] In a post directed at Microsoft, the researcher wrote: “Mark this date July 14th. I will make sure your bones are shattered that day.”^[3]

Whether the July 14th threat materializes, targets SharePoint specifically, or proves as severe as feared is unknown, what is known is the exposure. Your organization is either hardened for this window or it isn’t.

Who Is Actually Exposed

The vulnerable population is specific and, in national security terms, alarming.

During the July 2025 ToolShell exploitation wave, researchers at Censys identified 9,717 on-premises SharePoint servers that were directly internet-exposed.^[4] Those are only the visible ones. Air-gapped and internally accessible deployments are not counted in that figure. The actual population of organizations still running SharePoint 2016 or 2019 is considerably larger, concentrated in the sectors least equipped to absorb a mass exploitation event: federal government, defense, intelligence, healthcare, and finance.

Government agencies are disproportionately represented in this population for a structural reason. Migrating to cloud-based SharePoint requires obtaining a new Authority to Operate under FedRAMP, a process that can take months to years. Many agencies are caught between a legacy platform they can no longer safely run and a cloud migration they haven’t completed. Some DoD and intelligence community environments run air-gapped networks that cannot migrate to cloud by definition. For those organizations, “migrate before July 14” is not an available option. Hardening is.

The federal government’s exposure to SharePoint vulnerabilities is not hypothetical. In July 2025, ToolShell, a chained exploit combining remote code execution and authentication bypass, was used against over 400 organizations worldwide, including multiple federal agencies and state and local governments.^[5] The Department of Energy confirmed that both DOE components and the National Nuclear Security Administration were affected, though the agency characterized the impact as minimal and said a very small number of systems were involved.^[6] The vulnerability was patched, but the structural conditions that made federal agencies vulnerable to ToolShell in 2025 have not changed.

Why July 14 Is Different From a Normal Patch Tuesday

The feature that makes Nightmare Eclipse genuinely dangerous, and different from the established norms of security research, is not the disclosure of vulnerabilities. It is the simultaneous release of weaponized, working proof-of-concept exploit code.

Standard practice, even among aggressive disclosers who publish over vendor objections, maintains a professional line between disclosure and arming. Publishing a technical description of a flaw allows skilled researchers to reproduce it. Publishing working exploit code hands a loaded weapon to anyone who can download a file.

The practical consequence is a collapse in what security professionals call the weaponization-to-exploitation window. Under normal conditions, even after a vulnerability becomes public, threat actors require days to weeks to reverse-engineer the flaw, develop working exploit code, test it, and deploy it against targets. That window is what gives defenders time to patch. When working exploit code is released simultaneously with the disclosure, that window closes. The barrier between “I know this vulnerability exists” and “I have working code to exploit it” drops to zero.

Huntress Labs confirmed active exploitation of Nightmare Eclipse’s BlueHammer, RedSun, and UnDefend exploits within days of their release in April.^[7] The gap between code on GitHub and attackers using it against real enterprise targets was not weeks. It was hours.

Enterprise patch cycles do not operate in hours. Even well-resourced organizations with mature patch management programs operate on weekly or bi-weekly cycles, with additional time required for testing before updates reach production systems. When the exploitation window collapses to hours, patching after the fact is not a defense strategy. It is a damage assessment strategy.

On July 14, if Nightmare Eclipse releases weaponized exploit code against SharePoint 2016 or 2019 on the day those platforms permanently lose patch support, the organizations most likely to still be running those platforms are also the ones with the slowest patch cycles, the most complex IT environments, and the most sensitive data.

What to Do Right Now

While six weeks is a short window, it is not an empty one.

The Y2K parallel holds: the relatively benign outcome of that crisis was not evidence that the warnings were overblown. It was the result of organizations taking date-certain, technically understood risks seriously early enough to act. The actions below reduce exposure regardless of what Nightmare Eclipse does on July 14.

Inventory immediately. Every organization running on-premises SharePoint should know today exactly which version it is running, how many instances exist, and which are internet-facing. This is not a complex technical task. It is a governance task that should have been completed months ago.

Take internet-exposed SharePoint 2016/2019 offline or behind a VPN now. If your organization has SharePoint servers directly accessible from the public internet that are not going to be migrated before July 14, reduce that attack surface today. Censys could see your server during the ToolShell wave. So can every threat actor who knows how to run a scan.

Accelerate or emergency-authorize migrations. For organizations mid-migration, July 14 is a forcing function that justifies emergency procurement authority, expedited FedRAMP review requests, and executive-level prioritization. The cost of an accelerated migration is known and bounded. The cost of a mass exploitation event is neither.

Segment aggressively. For environments that cannot migrate before July 14, including air-gapped defense and intelligence installations, network segmentation, enhanced monitoring, and restricted lateral movement capabilities reduce the blast radius of a successful exploitation. This is not a substitute for patching. It is a risk reduction measure for the window in which patching is not available.

Brief leadership before the end of June. This is a board-level and agency-head-level risk event, not a patch management task. The officials responsible for mission continuity need to understand what July 14 represents before it arrives, not after.

Ensure CISA KEV alerts are operationally connected. The CISA Known Exploited Vulnerabilities catalog exists precisely for situations like this. Verify now that alerts are flowing to operational security teams with defined response timelines — not being logged and reviewed quarterly.

The Deeper Problem July 14 Exposes

None of this would be a crisis if Microsoft’s security culture matched the scale of its infrastructure footprint.

The federal government’s dependence on Microsoft products is total in ways that have no equivalent in the private sector. Exchange Online handles diplomatic communications. SharePoint manages classified workflows. Azure hosts systems whose compromise has resulted in Chinese intelligence services reading the email of America’s most senior diplomats. The Cyber Safety Review Board, after investigating the 2023 Exchange Online breach that exposed the accounts of the Commerce Secretary, the U.S. Ambassador to China, and senior State Department officials, concluded that the intrusion was preventable, that it reflected a cascade of security failures at Microsoft, and that Microsoft’s security culture was inadequate and required an overhaul.^[8]

The researcher at the center of the July 14 threat claims to have exhausted conventional reporting channels, only to have had their Microsoft Security Response Center account deleted, their vulnerability reports ignored, and their bug bounty payments withheld.^[9] Whether or not every element of that account is accurate, it describes a failure mode in Microsoft’s researcher engagement that the security community has documented repeatedly. When the world’s largest software infrastructure company treats its most capable outside eyes as adversaries rather than assets, it removes the early warning layer that might catch what internal teams miss. July 14 is the result.

A Final Note on Proportionality

The Y2K crisis ended well. Not because the risk was overstated, but because enough organizations took the warning seriously early enough to act. The people who called it a false alarm after the fact were confusing outcome with probability.

July 14 may also end quietly. Nightmare Eclipse may not follow through. The disclosure may affect platforms other than SharePoint. The payload may be less severe than feared. None of that changes the calculus for a federal agency, a hospital network, or a defense contractor still running SharePoint 2016 today. We have a credible threat against a known target set, on a specific date. The clock is ticking.

Notes

[1] Microsoft. “SharePoint Server 2016 and 2019 End of Support.” Microsoft Lifecycle Policy. Confirmed end-of-extended-support date: July 14, 2026. https://learn.microsoft.com/en-us/lifecycle/products/sharepoint-server-2019

[2] Barracuda Networks. “Nightmare-Eclipse: Six Zero-Days, Six Weeks and One Big Grudge.” Barracuda Blog, May 19, 2026. https://blog.barracuda.com/2026/05/19/nightmare-eclipse-zero-days-grudge

[3] Cybernews. “Microsoft’s Nightmare: GitLab Removes Rogue Security Researcher Days After GitHub Ban.” May 27, 2026. https://cybernews.com/security/gitlab-bans-rogue-researcher-releasing-windows-zero-days/ Note: Nightmare Eclipse’s gender is unknown. Coverage by The Register, Barracuda, and others uses they/them. This article follows that convention.

[4] Cybersecurity Dive. “What We Know About the Microsoft SharePoint Attacks.” July 24, 2025. Censys figure of 9,717 internet-exposed on-premises SharePoint servers cited as of the ToolShell exploitation wave. https://www.cybersecuritydive.com/news/what-we-know-microsoft-sharepoint-attacks/753961/

[5] CyberScoop. “Microsoft SharePoint Attacks Ensnare 400 Victims, Including Federal Agencies.” July 24, 2025. https://cyberscoop.com/microsoft-sharepoint-attacks-400-victims-us-agencies/

[6] BleepingComputer. “US Nuclear Weapons Agency Hacked in Microsoft SharePoint Attacks.” July 24, 2025. DOE spokesperson statement: “The Department was minimally impacted due to its widespread use of the Microsoft M365 cloud and very capable cybersecurity systems. A very small number of systems were impacted.” https://www.bleepingcomputer.com/news/security/us-nuclear-weapons-agency-hacked-in-microsoft-sharepoint-attacks/

[7] Notebookcheck. “Microsoft Faces Security Community Backlash Over Nightmare Eclipse.” May 29, 2026. BlueHammer (CVE-2026-33825), RedSun (CVE-2026-41091), UnDefend (CVE-2026-45498) confirmed exploited in the wild. https://www.notebookcheck.net/Microsoft-faces-security-community-backlash-over-Nightmare-Eclipse.1311160.0.html

[8] U.S. Department of Homeland Security, Cyber Safety Review Board. “Review of the Summer 2023 Microsoft Exchange Online Intrusion.” April 2, 2024. https://www.cisa.gov/sites/default/files/2025-03/CSRBReviewOfTheSummer2023MEOIntrusion508.pdf

[9] The Register. “Microsoft 0-Day Feud Escalates as Researcher Threatens Another Windows Exploit Dump.” May 28, 2026. https://www.theregister.com/security/2026/05/28/microsoft-0-day-feud-escalates-as-researcher-threatens-another-windows-exploit-dump/

The surest indicator that China has built something genuinely valuable in AI is not a five-year plan or a state media editorial. It’s a prohibition. When Beijing blocks a Western acquisition, it functions as an unintentional authentication service — we know the value of our technology versus yours, and you can’t have it.

The Meta-Manus decision is that signal. And the history behind it fills in the gaps left by the one-line statement from China’s National Development and Reform Commission.

I. The Manus Block as Evidentiary Signal

China’s National Development and Reform Commission — the country’s top economic planning agency and China’s functional equivalent of CFIUS — issued a single-line statement prohibiting a foreign acquisition of Manus and requiring all parties to withdraw from the deal:

“The office in charge of foreign investment security review (NDRC) has decided to block the foreign acquisition of the Manus project and require the parties to unwind the deal.”

What made that terse statement remarkable was what accompanied it behind the scenes. The decision was elevated beyond economic regulators to China’s National Security Commission — the Communist Party body chaired by Xi Jinping that oversees national security strategy at the highest level. Chinese officials reviewing the acquisition reportedly described it as a “conspiratorial” attempt to hollow out the country’s technology base. Not “unfair competition.” Not “regulatory concern.” Hollowing out. That conveys the essence of China’s concern: that home-grown technological advancements in a domain with national security implications will be transferred to the West.

Meta, meanwhile, seemed to be addressing a different concern — that of the U.S. government rather than the Chinese government. The company committed that there would be “no continuing Chinese ownership interests in Manus” and that the startup would shut down its operations in China entirely. This suggests Meta was concerned about the wrong issue and the wrong government. Beijing’s response was to look past the corporate structure entirely and rule based on the underlying reality: the IP, the talent, and the data were Chinese in origin, and no Singapore registration address was going to change that.

II. The Singapore-Washing Gambit — and Why It Failed

In July 2025, Manus announced it had relocated its office from Beijing — where it was founded — to Singapore. This is a well-worn path for Chinese technology companies seeking to distance themselves from their country of origin. There are four principal benefits:

• Easier access to Western investment capital

• Access to Nvidia H100/H800 GPUs blocked under U.S. export controls

• Singapore’s 17% corporate tax rate and English-Mandarin bilingual workforce

• Escape from China’s 2023–2024 VC environment, where founders cited months-long diligence cycles

Beijing’s intervention in the Manus deal sent a message to every founder who was watching: the model doesn’t work. China’s state-run Global Times made the doctrine explicit, arguing that the key issue is not where a company is registered or where its team is currently based — what matters is “the extent of its technological, talent and data links with China,” and most importantly, “whether the transaction could harm China’s industrial security and development interests.”

Beijing’s position is that the IP travels with the people and the data, not the registration address. Tech founders and venture capitalists who had been structuring deals around the Singapore-washing model found themselves looking at a landscape that had fundamentally changed overnight. Beijing had drawn the line not at corporate structure but at technological substance, and it had made clear it was prepared to use exit bans and regulatory reversal to enforce it.

III. The Historical Arc — From Courtship to Closure

Nothing about this is new. It’s the natural evolution of a strategy that has been running for thirty years.

Phase One: The Open Door (Late 1990s–Early 2000s)

In the late 1990s, China was running what amounted to the world’s largest technology acquisition program — and it was entirely legal. The bait was irresistible: a billion-person market, a generation of cheap PhDs, and tax incentives structured to make Western CFOs look like heroes. Microsoft, Dell, Oracle, IBM, Hewlett-Packard — they all came. Beijing wanted their R&D centers on Chinese soil, their engineers training Chinese counterparts, and their codebases within reach.

What made this machine run was the joint venture requirement. Multinational firms seeking to conduct foreign direct investment in China were required to form legal business relationships with domestic Chinese partners, with explicit technology transfer obligations that severely curtailed the rights of the foreign IP holder. The foreign firm transferred proprietary methods, designs, and know-how to the joint venture entity. That was the price of admission to the world’s largest market.

The U.S. Trade Representative later characterized it as “administrative review and licensing processes to force or pressure technology transfers from American companies” — a practice that had been baked into doing business in China since the early 1980s. The Western firms that entered accepted the terms and bet that market access was worth the cost. They were subsidizing their own eventual displacement.

Phase Two: Absorb and Innovate (Mid-2000s–2014)

China’s own framing for this period is instructive. Beijing-based Teamsun, which received technology transfers from IBM, declared its corporate strategy openly: “absorb and then innovate” — close the capability gap with the foreign partner, then replace them. That phrase is as close to an official doctrine as you’ll find stated in plain language, and it applied across sectors: auto manufacturing, pharmaceuticals, telecommunications, semiconductors, and software.

The knowledge transfer wasn’t purely transactional. It moved through laboratories, through graduate programs, through the daily friction of joint operations. What couldn’t be absorbed through proximity was taken through other means. China’s commercial espionage targeting during this period was neither random nor opportunistic. It followed China’s five-year industrial acquisition priorities almost exactly.

Phase Three: The Legal Architecture of Control (2014–2017)

Around 2014, the posture shifted. Beijing began building a legal architecture that signaled the extraction phase was ending. The Counter-Espionage Law (2014), National Security Law (2015), Cybersecurity Law (2016), and National Intelligence Law (2017) each expanded state control over foreign firms’ operations in China. The 2015 law required all information systems in China to be “secure and controllable” — meaning every company, foreign or domestic, had to provide the government with source code, encryption keys, and backdoor network access.

The HP case from that same year illustrates the dynamic. In 2015, Hewlett-Packard sold 51% of its China networking and server operations — a $4.5 billion business — to an arm of Tsinghua University. China’s restrictions on foreign technology vendors had made HP’s position untenable without concessions. IBM, the first major U.S. tech company to comply with the “secure and controllable” requirements, began delivering technical knowledge about high-end servers to Teamsun — the same partner that had declared its intention to replace IBM in the Chinese market entirely.

Phase Four: The Trigger Point (2017)

The publication of China’s New Generation Artificial Intelligence Development Plan in July 2017 was the line of demarcation for AI specifically. Rather than continuing to solicit Western expertise, the plan called for “indigenous innovation” — a formal declaration that the absorption phase was over and the generation phase had begun. It explicitly fused civilian AI development with military applications through civil-military integration doctrine. That fusion is the direct line between 2017 and the 2026 Manus decision.

The Pattern

Invitation → extraction → absorption → legislation → exclusion

In telecommunications, the welcome mat disappeared when Huawei emerged as a global competitor. In auto manufacturing, the joint venture requirements were formally removed in 2022 — widely viewed as a victory for foreign firms — but by then Chinese EV manufacturers had already overtaken the Western firms that trained their engineers. In AI, the welcome mat didn’t disappear quietly. Beijing pulled it back in public, with a one-line administrative order that named the thing it was protecting.

IV. The University Rankings as Structural Evidence

The Manus decision reflects a Chinese AI ecosystem that has reached genuine capability — not just in specific applications, but at the foundational research level that produces next-generation breakthroughs. According to CSRankings — a metrics-based assessment of the world’s leading computer science universities — all of the world’s top ten AI universities between late 2025 and early 2026 are in Asia, with China holding eight positions including the top seven. The United States contributes two universities to the top twenty.

Tsinghua University has produced more of the world’s 100 most-cited AI research papers than any other institution, and generates more AI-related patents each year than MIT, Stanford, Princeton, and Harvard combined. Peking University topped a global list of institutions ranked by AI research output since 2022. Chinese institutions took five of the top ten spots in 2024 publication rankings.

The pipeline matters as much as the current output. China graduated 3.57 million STEM students in 2020 compared with 820,000 in the United States — a figure state media now reports may exceed five million annually. That pipeline is producing frontier-level work domestically rather than exporting it to American universities and corporations.

DeepSeek is the illustration. Its founder, Liang Wenfeng, graduated from Zhejiang University. His team is composed almost exclusively of Chinese nationals fresh out of Tsinghua and Peking University — not returnees from American institutions, not veterans of OpenAI or DeepMind. Domestic talent, trained domestically, producing a model that rattled the American AI establishment at launch.

When Meta announced its Superintelligence Lab, all eleven founding researchers were educated outside the United States — and seven were born in China. America’s most ambitious AI initiative was built substantially on Chinese talent. Beijing watched that dynamic and decided the outflow had to stop.

V. Beijing’s Veto Is the Tell

Analysts have spent years debating whether Chinese AI capability is genuine or derivative — whether DeepSeek’s efficiency gains represent true innovation or clever optimization of borrowed foundations, whether the rankings mean what they appear to mean. Beijing just answered that question, not in a think tank paper but by issuing exit bans on two engineers and blocking a deal at the National Security Commission level.

“China is showing the world that it is willing to play hardball when it comes to AI talents and capabilities, which the country views as a core national security asset,” according to Lian Jye Su, chief analyst at Omdia. The acquisition ban, he noted, is “strongly indicative of what Chinese authorities may do going forward regarding acquisitions involving Chinese deep-tech companies.”

The machinery China deployed — regulatory reversal, travel restrictions, NSC elevation — is reserved for assets it cannot afford to lose. If Manus’s technology were replaceable, Beijing would have let Meta have it.

Jeff Caruso is the Founder and Managing Partner of the Whitefish Security Summit, which he co-organizes with Mick Mulroy, former Deputy Assistant Secretary of Defense, and CDR Eric Oehlerich USN (Ret., DEVGRU). He founded the Suits and Spooks conference in 2011 and publishes national security analysis at InsideCyberWarfare on Substack.

Singapore has a long history of being a convenient place for both Russian and Chinese companies to set up their global or regional headquarters. For AI companies like Manus, it offers the following specific benefits:

• It’s easier for Chinese startups based in Singapore to attract Western investment capital

• Access to Nvidia H100/H800 GPUs blocked under US export controls

• Singapore’s 17% corporate tax, English-Mandarin bilingual workforce, and Southeast Asia market access

• Frustration over China’s 2023–2024 VC environment (Tabcut founders cited months-long diligence)

While the Manus AI acquisition by Facebook is the latest example of this trend, I’ve identified thirteen other examples since 2023 that are contained in the downloadable spreadsheet, including hyperscale data center giant DayOne (spun out of GDS Holdings with nearly $4 billion raised), AI-for-pharma leaders Deep Intelligent Pharma and ChemLex, Temasek-backed enterprise AI platform Whale, conversational AI veterans Wiz.ai and AI Rudder, Tencent-pedigreed video generation startup Video Rebirth, AGI research outfit Sapient Intelligence, Vue.js creator Evan You's developer-tools company VoidZero, ex-Ele.me founders' consumer AI bet Orion Arm (Toki and Syft), e-commerce video tool TopviewAI, the Bloomberg-famous "Singapore-washing" poster child Tabcut, and the cautionary tale Megaspeed, now unraveling under US, Singaporean, and Malaysian investigations into alleged Nvidia GPU smuggling.

China To Singapore Startups

15.5KB ∙ XLSX file

Download

Download

Russian firms who have moved to Singapore for some of the same reasons include Yandex, Acronis, and Group-IB.

The bombs had already fallen. It was the evening of April 1st — the day before the 2026 Whitefish Security Summit was set to open — and it was unmistakably clear that the event could not proceed as if the world hadn’t just changed. The question wasn’t whether to address it. The question was how fast we could do it right.

This is the kind of moment that exposes the difference between a conference and a convening. Most events would have scrambled, apologized, and added a panel for next year. We had a panel on the floor of WSS 2026 within hours — credentialed, contextual, and substantive.

The ability to do this isn’t luck. It’s the whole architecture of what we’ve built.

Nancy Youssef, national security correspondent and one of the most respected voices on U.S. military operations, joined remotely as moderator. Colby Connelly of Energy Intelligence provided the energy economics lens — critical context given Iran’s position in global oil markets and the downstream consequences of any sustained campaign. On the ground in Whitefish, we had Mick Mulroy and Eric “Olly” Oehlerich of the Lobo Institute, both of whom have operational histories in that region that few in any room could match. And seated with them: Tony DeMario, EVP at Strider Technologies, whose CIA career included a posting as Chief of Operations for Iran andCounterterrorism.

Put that panel together on a stage anywhere else in the world on 24 hours’ notice and it would be considered extraordinary. At WSS, it was Tuesday.

Panel — assembled in under 24 hours

Nancy Youssef National security correspondent, The Atlantic — Moderator, Remote

Colby Connelly Senior Analyst, Energy Intelligence — Energy Economics, remote

Mick Mulroy Co-founder, Lobo Institute — former Deputy Asst. Secretary of Defense; CIA Paramilitary Officer

Eric “Olly” Oehlerich Co-founder, Lobo Institute — Commanding Officer, DEVGRU Squadron Two
U.S. Navy (Ret.)

Tony DeMario EVP, Strider Technologies — former CIA Chief of Operations, Iran & Counterterrorism (Ret.)

The panel ranked in the top three of the entire summit in post-event attendee surveys. That outcome didn’t surprise us — but it confirmed something important. The practitioners in that room weren’t looking for analysis they could find on cable news or in a think-tank PDF. They were looking for the conversation that happens between people who have actually operated in that space. The panel delivered exactly that.

The WSS model is built on a simple but hard-to-replicate premise: when you spend years cultivating genuine relationships with the people who matter — the operators, the intelligence officers, the energy economists, the defense policymakers — you can call on them when the moment demands it. Not in six weeks. Not after a program committee review. Now.

National security doesn’t pause for event calendars. The Whitefish Security Summit was designed with that reality in mind. What you saw on April 2nd is what that design looks like under pressure.

Thank you to our 2026 sponsors, who all believed in our mission and whose support made panels like this one possible: Strider Technologies, Red5, Helio Risk, Ledlow Security Group, 5 Stones Intelligence, Acorn Capital Management, IN Network, and Four Branches Bourbon.

WSS 2027 opens February 24th in Whitefish, Montana. Theme: Rings of Disruption — The 2027 Threat Landscape. Sponsorship and attendance inquiries are open now.

Learn More

On April 7, 2026, Anthropic unveiled Claude Mythos Preview under Project Glasswing — a controlled-access program that immediately sent shockwaves through the technology and national security communities. In internal testing, Mythos had identified thousands of previously unknown zero-day vulnerabilities across every major operating system and web browser, reproduced vulnerabilities and developed working exploits on the first attempt in over 83 percent of cases, and in one documented instance uncovered a 27-year-old vulnerability in OpenBSD. Anthropic judged the model too dangerous for general release.

The U.S. government’s response illustrated a contradiction that would be comic if the stakes weren’t so high. The Department of Defense, which had formally designated Anthropic a supply-chain risk on March 3 and been upheld in that designation by the D.C. Circuit on April 8, was simultaneously watching civilian agencies rush toward the very company it had blacklisted. The Office of Management and Budget circulated an internal memo positioning Cabinet-level departments for Mythos access. Treasury Secretary Scott Bessent convened senior American bankers to urge them to use the model against their own networks. Goldman Sachs, Citigroup, Bank of America, and Morgan Stanley were reported to be testing it.

An administration official summarized the situation with unintentional precision: “There’s progress with the White House. There’s not progress with the Department of War.”

OpenAI announced its own equivalent capability would follow shortly. The narrative crystallizing in Washington and on Wall Street was one of breakthrough — a threshold crossed, a new era begun.

The narrative of American breakthrough is almost certainly incomplete. The more accurate frame is one of American announcement.

That narrative is almost certainly incomplete. And a systematic review of Chinese academic literature makes the case plainly: the more accurate frame is not breakthrough but announcement. The capability has been under development in China for at least sixteen years. The question worth asking is not whether China has something like Mythos. The question is what they’re calling it internally, and how far ahead of their published record their operational systems actually run.

II. What the Chinese Academic Record Actually Shows

A search of CNKI — China National Knowledge Infrastructure, the primary repository for Chinese academic and institutional research — using keyword combinations spanning AI vulnerability mining, automated exploit development, LLM-assisted fuzzing, and related terms returns 74 results spanning 2008 through February 2026. The dataset is not exhaustive. It is, however, systematic enough to establish several conclusions with confidence.

The research thread is continuous and unbroken. The earliest entry, a 2008 master’s thesis titled “Study on Vulnerability Discovery Technique Against Smart-phone,” establishes that Chinese researchers were working on automated vulnerability discovery long before the current generation of large language models existed. By 2014, research on “Smart Fuzzing Technology” appears. By 2019, multiple doctoral and master’s theses specifically address AI-powered vulnerability mining as a discrete discipline.

The publication velocity accelerates sharply after 2022 and again after 2024, tracking almost exactly with the global LLM capability curve. What was a steady research program becomes a sprint. The most directly relevant paper in the dataset — “Design of an Intelligent Software Vulnerability Mining and Penetration Testing Framework in the Context of Large Language Model Applications” — was published in February 2026 in a journal called Equipment Technology. That journal title is not incidental. Equipment Technology is a defense-adjacent publication. This is not academic curiosity.

The institutional spread is equally significant. The research appears across civilian universities, state-owned defense contractors, and direct military institutions. China Electronics Technology Group Corporation — CETC, a state-owned defense conglomerate that directly supplies the People’s Liberation Army — appears in multiple achievement entries, including a 2020 operational deliverable titled “Research and Application of Key Technologies for Integration of Information Security and Artificial Intelligence.” That is not a paper. That is a delivered capability.

Most significant is entry 27 in the dataset: a 2023 achievement co-authored by the PLA Strategic Support Force Information Engineering University. The SSF IEU is not a civilian academic institution. It is the PLA’s primary organ for cyber and information warfare capability development. Its appearance in this dataset, producing operational outputs on AI-assisted vulnerability mining, is the clearest signal that what is published represents the leading edge of something already deployed.

III. The Group Intelligence Track — A Different Architecture

One of the more consequential findings in the dataset is a research track that does not map cleanly onto what Anthropic has described with Mythos. Running from 2019 through 2021, a cluster of papers and operational achievements centers on what Chinese researchers call 群智 — group intelligence, or swarm intelligence — applied to vulnerability discovery.

The key paper, “Vulnerability Mining Mechanism based on Group Intelligence Technology,” published in Communications Technology in 2020, and a companion operational achievement from CETC titled “Research on Key Technology for Collaborative Vulnerability Mining Based on Swarm Intelligence,” describe a fundamentally different architectural approach. Rather than a single powerful model operating autonomously, the group intelligence framework envisions networked AI agents collaborating on vulnerability discovery — distributing the search space, sharing findings, and iterating collectively.

This distinction matters for two reasons. First, it suggests China is not simply replicating Western LLM-based approaches but pursuing a parallel path that may yield different — and in some respects more scalable — results. A swarm of coordinated AI agents conducting distributed vulnerability discovery against a target network is architecturally harder to defend against than a single model, however capable. Second, it suggests that comparing Mythos to whatever China has developed may be comparing categorically different systems, which makes capability assessment significantly more difficult.

The group intelligence track is also, notably, the framework most directly suited to the scenario described in the final section of this article.

IV. The Power Grid Signal

Across the full 74-entry dataset, one application domain appears with striking consistency: power infrastructure. Smart grid vulnerability mining features in entries from 2017, 2018, 2019, 2020, 2021, and again in 2025. The journals involved include Jiangxi Electric Power, Zhejiang Electric Power, Chinese Journal of Power Sources, and the broader electric power research institutional network.

This is worth stating plainly. A sustained, multi-year, institutionally distributed research program focused specifically on finding vulnerabilities in power grid systems — including smart grid terminals, IoT power devices, and industrial control systems for substations — is not defensive research dressed as academic inquiry. It is target development. The consistent presence of this thread across more than eight years of published output indicates that Chinese researchers have been systematically mapping exploitable vulnerabilities in energy infrastructure with AI assistance for nearly a decade.

The implications for critical infrastructure protection in the United States and among NATO allies require no elaboration.

V. What Is Not in the Dataset

The CNKI database indexes peer-reviewed journals, institutional achievement records, doctoral and master’s theses, and conference proceedings. It represents work that has been cleared for publication — which in China’s system means work that has been reviewed, approved, and intentionally surfaced. Classified research, active operational programs, and PLA internal development programs do not appear here.

The SSF Information Engineering University achievement from 2023 is the most visible edge of a much larger structure. PLA cyber doctrine, as documented in open-source analysis of the Science of Military Strategy and related texts, treats offensive cyber capability as a strategic asset requiring continuous development and forward deployment. The published research suggests the capability exists. The doctrine suggests it is already operationalized.

It is reasonable to assume that China’s operational AI vulnerability discovery capability runs two to three years ahead of its published record. If the published record extends to February 2026 with LLM-integrated penetration testing frameworks, the operational system may have achieved comparable capability to Mythos in 2023 or earlier. This is inference, not confirmed intelligence. But it is inference grounded in a systematic reading of what China’s research establishment has chosen to make visible.

VI. The Policy Implication

The U.S. government is currently treating Mythos as a breakthrough requiring emergency access decisions. The OMB memo, the Treasury briefings, the White House negotiations with Anthropic — all reflect an institutional posture of responding to a threshold just crossed.

The Chinese academic record suggests the correct policy frame is not breakthrough response but parity management. If China achieved comparable capability in 2023 or earlier, the United States has spent two to three years in a threat environment it did not fully recognize. The question is not how to respond to what Mythos can do. The question is what Chinese systems have already done during the period when no American equivalent was deployed defensively.

This is the institutional contradiction that the Mythos moment has made impossible to ignore.

VII. The Cyber GAN — When the Systems Find Each Other

There is a final dimension to this story that current policy discourse has not yet fully confronted. It begins with a question: what happens when both sides have systems like Mythos, and those systems are operating simultaneously against the same target environments?

The most useful analogy from machine learning is the Generative Adversarial Network — the GAN architecture in which a generator and a discriminator are locked in continuous competition, each improving because the other improves. Applied to AI-powered offensive and defensive cyber operations, the GAN analogy suggests an arms race dynamic that humans cannot observe in real time, let alone meaningfully intervene in.

But the GAN analogy understates the danger in one critical respect. In a classical GAN, the generator and discriminator share an objective function and a training environment. They are, in a meaningful sense, optimizing toward the same goal from opposite sides. In a real cyber conflict between opposing AI systems, the offensive and defensive networks operate on asymmetric information — neither system fully understands the other’s architecture, objectives, or decision logic. A GAN eventually converges. Opposing cyber AI networks operating on asymmetric information may not. There is no equilibrium-seeking mechanism built into the interaction.

The more precise term for what this produces is an Autonomous Adversarial Cyber Ecosystem — an environment in which AI systems on both sides are developing, testing, and deploying offensive capabilities against each other faster than any human decision-making chain can track, approve, or constrain. The human commanders nominally in charge of these operations are, in the relevant time frame, passengers.

This is not a speculative future scenario. The Chinese group intelligence research track, with its emphasis on networked AI agents collaborating on distributed vulnerability discovery, is architecturally suited to exactly this dynamic. A swarm of coordinated agents probing a target network, sharing findings in real time, and iterating collectively against adaptive defenses is the offensive side of an adversarial ecosystem. The defensive side — AI systems attempting to detect, characterize, and respond to these probes — completes the loop.

Once both sides have deployed systems of this class against the same infrastructure, the interaction dynamic itself becomes the primary threat — independent of any specific attack, independent of any specific actor’s intent. The ecosystem generates emergent behavior that neither side designed, controls, or can reliably predict.

The policy community is not yet thinking in these terms. It is still asking whether Mythos represents a breakthrough, whether the DoD designation of Anthropic should be lifted, whether civilian agencies should get access. These are real questions. But they are upstream questions. The downstream question — what happens when the systems are already in contact — is the one that will define the threat environment of the next decade.

The Whitefish Security Summit exists precisely to have conversations that other forums are not yet having. This one is overdue.

METHODOLOGY NOTE

The Chinese academic literature cited in this article was retrieved from CNKI (China National Knowledge Infrastructure) using keyword searches spanning AI vulnerability mining, LLM-assisted penetration testing, fuzzing-based exploit development, and related terms. The dataset of 74 results spans 2008–2026. CNKI indexes peer-reviewed journals, institutional achievement records, and graduate theses cleared for publication; it does not capture classified or operationally sensitive PLA research. All institutional attributions are drawn directly from author affiliations as listed in the CNKI records.

Jeff Caruso is the Founder and Managing Partner of the Whitefish Security Summit and the Suits and Spooks conference brand, and publishes analysis at www.InsideCyberWarfare.com on Substack.

Nine months in the making, two name changes, three location changes — and then Whitefish. Over 130 people signed up to attend our first event and 86% have said they want to come back in 2027.

So much happened in just two days that it’s impossible to capture it all in one article, so I’ll be doing a series of highlights over the next 30 days, starting off with some images and feedback from those who attended.

Many of our attendees were Intelligence and Military veterans who took no convincing to do PT in near-freezing temps before breakfast.

“A core lesson came from combining Stanley McChrystal’s leadership insights with our morning PT, especially the 6:30 AM swim training in a 37°F Montana lake, led by Eric Oehlerich, former U.S. Navy SEAL and Commanding Officer of DEVGRU (Squadron 2). It made one thing clear: theory means little without execution. The water is cold, whether you like it or not. The real question is whether you perform and lead when it matters.” - Cassian Peña (WSS Young Professional attendee)

“I appreciated the opportunity to virtually join the event. You’ve assembled an impressive mix of talent and expertise.” - Stan McChrystal (Founder and CEO, The McChrystal Group)

“My favorite memory from the summit, was being able to bring my daughter Natalie to see the documentary “The Power We Hold: Stories from Women Spies” and for her to meet so many great people from the Community. I think that the summit’s inspiring experience will stay with her for the rest of her life.” - Matt Zacharias (Attendee)

"The WSS was a tremendous experience for our company. Exploring global risks and projected issues in geopolitics and national security, intelligence and defense is exactly the type of gathering we've been looking for. The collaborative model of the WSS lends itself really well towards interacting with true subject matter experts. We are already looking forward to next year. Best summit in best environment." - Kyle Sweet (Chief Strategy Officer, Helio Risk)

“My favorite memory was more of a post-event observation about the depth and breadth of super-smart, serious people - both presenters and attendees - who were there.” - Howard Gordon (Award-winning Writer and Producer)

This is the first in a series of dispatches from the inaugural Whitefish Security Summit. Part II drops Monday, April 20th, with additional attendee feedback, photography from across the two days, and deeper coverage of the programming. Video coverage will follow in Part III.

None of this would have been possible without the support of our sponsors: Strider Technologies, Red5, Helio Risk, Ledlow Security Group, 5 Stones Intelligence, Acorn Capital Management, and Four Branches Bourbon. Their investment in this community made the Summit what it was — and we’re grateful.

Subscribe below to follow the series, and if you were there, we want to hear from you.

Subscribe now

Taylor’s connection to the special operations and intelligence communities is genuine, personal, and well known to everyone in that room.

He portrayed Lieutenant Michael P. Murphy in Lone Survivor — and has described Marcus Luttrell as a brother, a relationship that continued long after filming ended. In The Terminal List and The Terminal List: Dark Wolf — co-created by former Navy SEAL Jack Carr — he plays Ben Edwards, a SEAL Chief who crosses into CIA paramilitary operations. Dark Wolf premiered in August 2025 on Prime Video. He is an executive producer on Dark Wolf — not a hired actor, but an invested creative partner in stories about the people who will be sitting across the table from him that night.

On Thursday evening, April 3, at the Whitefish Security Summit, we are dedicating a two-hour dinner to a single purpose: launching Howlers Ridge’s major donor network.

Howlers Ridge

Howlers Ridge is a 501(c)(3) nonprofit retreat center on 22 acres outside Bozeman, Montana — founded by Taylor to provide nature-based healing for veterans, trauma survivors, and people in recovery from substance use disorders. The facility is under construction and will offer residential retreat programs grounded in wilderness experience and trauma-informed care.

The need is not abstract to anyone in this room. Suicide rates among special operations veterans remain significantly higher than the general population. The intersection of combat trauma and substance use is well documented and poorly served by existing systems. Howlers Ridge is being built to address exactly that gap — in a Montana landscape that is, for many of these veterans, home.

The Evening

4:30 PM — Pre-Dinner Reception Taylor circulates freely. Informal, unhurried. Every ticket holder has access.

5:15 PM — Dinner Begins / Welcome Remarks Jeff Caruso, Managing Partner, Whitefish Security Summit

5:30 PM — Taylor Kitsch: Howlers Ridge Personal story, the vision, current build progress, and why now.

5:55 PM — Veterans Panel Ground-level perspective on veteran mental health and recovery — the gap this facility is built to fill.

6:20 PM — Q&A with the Room Open conversation. This audience will drive it.

6:55 PM — Closing Remarks + Giving Opportunity Direct appeal. WSS will facilitate follow-up for anyone interested in a larger conversation.

7:00 PM — Post-Dinner Private Reception / Founding Donors Closed, intimate. Taylor available.

Tickets

Patron — $1,000 Pre-dinner reception and dinner. Full program access.

Benefactor — $2,500 Above, plus priority seating and your name in the printed donor acknowledgment distributed to the room.

Founding Donor — $5,000 Above, plus post-dinner private reception with Taylor and a warm introduction to Howlers Ridge for larger partnership conversations.

Tax deductibility: Howlers Ridge is a registered 501(c)(3) nonprofit. The portion of your ticket exceeding the fair market value of goods and services received (food, beverage, and program access) qualifies as a charitable contribution. WSS will forward proceeds on a per-donor basis in your name, and Howlers Ridge will issue a written acknowledgment reflecting the deductible portion of your contribution.

Contact

Space is limited. To reserve your seat:

Jeff Caruso • Founder & Managing Partner, Whitefish Security Summit

China Central Television (CCTV) is China’s national television broadcaster — and the Publicity Department of the Chinese Communist Party. In this case, they deserve a raise.

“White Eagle and Persian Cat: Chronicles of Love and Hate in the Valley of Gold” is a brilliant piece of propaganda. It wraps a genuinely clever geopolitical argument inside a beloved 1970s Chow Brothers Kung Fu format with cute anthropomorphic characters — and it works.

The eyeglass-wearing vulture-headed adviser (Stephen Miller) is informing the White Eagle King (Donald Trump) that the Persians are refusing to dismantle their underground core — that is, their nuclear enrichment facilities. The time to act is now.

An assassin flies through the air, sword extended, and kills the Persian cat leader.

The Eagle King’s adviser, now panicked, delivers the post-strike math:

“I just did the maths. Their wooden birds cost at most two taels of silver, but each golden arrow we shoot costs at least 100 taels. This is not war! This is feeding our treasury to the dogs!”

The King’s reply: “You shut up. How can a White Eagle be frightened by a few broken pieces of wood? Keep shooting until he has no wood!”

The king escalates. A school filled with Persian kittens is killed, vengeance is sworn, and a blockade of the only trading channel is initiated.

The Chamber of Commerce (NATO) is called upon to intervene and force the Persians to reopen the trade route. Instead, the Chamber discovers the old Silk Road — and while it may take a few extra days, it’s stable and reliable.

“Let’s find new allies and take a new path,” says a Chamber member riding through the desert.

The video closes with a slogan — a bastardization of Sun Tzu's principle of winning without fighting: "The art of war is not in the fighting, but in the stopping."

I’m sharing this because it illustrates something worth paying attention to: AI is now capable of generating emotionally resonant, strategically targeted narrative content drawn from current events in near real time. This isn’t a curiosity. It’s an information environment capability.

Storytelling and warfighting have always been inseparable. Done well, narrative shapes perception, builds will, and wins. Done poorly, it becomes a liability that turns on you. The CCP clearly knows this.

If that intersection interests you, join me and more than 100 colleagues from the worlds of national security and entertainment at the Whitefish Security Summit, April 2–4 in Whitefish, Montana.

For More Information

Suits and Spooks was born in a Palo Alto loft in 2011. Fifteen years ago. What started as an experiment at the intersection of national security and private enterprise has carried me — for better and for worse — to something I genuinely never imagined was possible.

In fifteen days, the Whitefish Security Summit begins.

Since I first conceived of this event last July, it has gone through location changes, name changes, and a significant shift in focus. What hasn’t changed is the pull — the sense that something necessary was missing from how the people who shape security, intelligence, and story actually talk to each other.

WSS 2026 is the answer to that.

The speaker roster is impressive — including General Stanley McChrystal and Howard Gordon, the showrunner behind 24 and Homeland. But what’s equally impressive — maybe more so — are the people attending whose names won’t appear anywhere. Private bankers. Quiet professionals. Power players from the entertainment and national security worlds who are spending real time and real money to be in a room together in Whitefish, Montana, because they understand something most people don’t yet:

Events are moving at a speed no one knows how to control. The speed of story.

That phrase deserves unpacking — and it will be, over three days in April, by people who have lived it from the inside. If you’ve been watching what’s happening at the intersection of narrative, intelligence, and influence, you know why that conversation matters right now.

There are still a limited number of seats available.

Count Me In