AI governance now has a building — and it's in Shanghai

Scorekeeping on JadePuffer: the "fully autonomous" attack still needed a human, and that's cold comfort

A correction to last week's framing. A human operator pointed the JadePuffer agent at its target and set it running. The break-in itself ran start to finish without help, but a person chose the victim. The cost is the real story: an agent that can run a whole attack once aimed can be aimed at hundreds of targets at once for a fraction of what a human crew charges, and researchers expect the volume of these attacks to climb sharply through year-end.

The copycat window is open: public vulnerability, off-the-shelf agent, published playbook

Security vendors spent the week turning JadePuffer into defensive advice, while noting that every ingredient is already public and reproducible by unskilled attackers: the vulnerability it exploited, the agent frameworks it used, and the self-narrating payload pattern. No confirmed copycat surfaced this week.

54% of 2026 layoff events cite AI, and the fight over whether that's honest broke into the open

The 2026 count: 54% of layoff events name AI or automation, covering 168,770 workers across 164 companies, with Microsoft cutting another 4% and hotel-software firm Mews shedding 15% "proactively" this month. The counter-argument gathered force this week. Some firms appear to blame AI to dress up cuts actually driven by overhiring and investor pressure, and a Forbes analysis asked whether these layoffs will backfire on companies that fired the people who knew how things worked.

The Global South now has two capacity-building offers: the UN's national-centre network and China's 5,000 training places

Xi's WAIC pledges were aimed squarely at developing countries: 5,000 AI training opportunities over five years, a Chinese meteorological AI tool for 30 states, and WAICO membership open to the non-aligned. This lands ten days after the UN's capacity network signed up more than 20 national centres.

GPT-Live's first ten days: users say it's too eager, and OpenAI starts watching for emotional dependence

Early users complain the model over-does its listening noises, the engineered "mhmm"s meant to signal attention. Meanwhile OpenAI confirmed it is rolling out longer-term measurement and post-launch monitoring focused on emotional reliance. Note the timing: the study of whether this product is psychologically safe begins after it reaches hundreds of millions of people.

Downloadable AI hits trillion-parameter scale: Kimi K3 (2.8T) and Inkling (975B) land in the same week

Moonshot's Kimi K3 runs 2.8 trillion parameters with a one-million-token context window, the first downloadable model in its size class. Weights are promised by July 27, and Moonshot's own benchmarks beat Claude Opus 4.8 and GPT-5.5 while trailing Fable 5 and GPT-5.6. A day earlier, Thinking Machines released Inkling: 975B parameters, multimodal from the ground up, the largest downloadable US model, already on Hugging Face.

Gemini 3.5 Pro slips months behind, and Alphabet loses about $200B in a session

Bloomberg reported July 16 that Gemini 3.5 Pro is months behind Google's internal targets. The model was promised for June at I/O, then pointed at July 17. A late-June training-data update meant to fix its coding disappointed, and engineers reportedly scrapped the original model because it kept failing at chaining tool calls together — the one thing that matters most for the coding-agent market Google bet this generation on. Alphabet fell about 4.4%, erasing roughly $200B in a day. One angle matters for governance: Google is the only frontier lab that has never entered Washington's review process, so whenever 3.5 Pro ships, it tests whether the August 1 rules reach it at all.

86 cents of every US venture dollar now chases AI, and the chip factories can't keep up

US startups raised $412.7B in the first half of 2026, more than in any previous full year. Of that, $355.9B (86%) went to AI, and OpenAI ($122B) plus Anthropic ($95.6B) took 43% of all global startup funding between them. TSMC then posted its fifth straight record quarter with revenue up 36%, raised its 2026 growth guidance past 40%, and lifted spending to $60–64B. Two weeks after Nvidia shed about $1T, the factories say demand is real even where the stock market has doubts.

China launches the World AI Cooperation Organization: 29 founding states, a Shanghai headquarters, and a second centre of gravity for AI governance

Twenty-nine countries signed the treaty creating WAICO, an intergovernmental body headquartered in Shanghai, with Guterres attending the ceremony. The signatories include Russia, Brazil, Indonesia, Pakistan, ten African states and twelve Asian ones. Xi followed with his first in-person WAIC keynote since the event began, calling for a "symphony of global cooperation," warning against the overstretching of national security concerns, and pledging 5,000 AI training places for developing countries plus a weather-forecasting AI tool for 30 states. Nine days after the UN's Geneva dialogue produced a deadline and a training network, China produced a building.

The FLI Safety Index: nobody scores above C+, and the pause commitments are quietly gone

The Future of Life Institute's Summer 2026 index scored nine companies across 37 indicators. Anthropic came first at C+, OpenAI and Google DeepMind got C, Meta D+, and xAI, DeepSeek and Mistral all failed. The sharper finding sits underneath the grades: Anthropic, OpenAI, Google DeepMind and Meta have all weakened or dropped their earlier promises to pause development if a system approached a specified danger threshold, and all four softened their opposition to military uses.

The EU Omnibus was signed July 8 and still isn't published, two weeks before the rules it amends take effect

The final act was signed July 8 and takes effect three days after it appears in the Official Journal, which as of this writing hasn't happened. The August 2 deadlines hold regardless. Chatbot transparency and general-purpose AI rules become enforceable with fines up to €35M or 7% of turnover, and the delays pushing high-risk obligations to December 2027 and August 2028 are locked in.

Q3→Q4  AI governance now has the headquarters.

If you work in policy or international strategy, stop asking whether global AI governance will exist. Start asking whose standards your markets will end up following, and prepare for the answers.

Q3  One lab's delay now moves markets like a national credit event.

If you're betting that US rules will get teeth, August 1 is your tell. A process that doesn't reach Google, the one lab that has never entered it, isn't a rulebook. It's a sign-up sheet.

Q3  Frontier-grade AI is about to be permanently beyond recall.

If you run risk or security, plan for a world where near-frontier models are free, copyable, and outside every government's power to take back. That world starts this month.

Q2  The reason on the layoff letter is now disputed. The job losses aren't.

If you lead a workforce, check whether your own AI explanation is honest before your employees check it for you. Nothing burns trust faster than blaming a robot for a budget decision.

Q3→Q4  Someone finally graded the labs, and nobody passed.

If you buy frontier AI, that index is free due diligence. Put the weakened pause promises in your vendor-risk file, not just your news feed.

July 27 — Kimi K3's weights go public

August 1 and 2 — two deadlines in 36 hours