EU begins enforcing AI Act transparency rules as California's provenance law lands

The EU AI Act’s transitional period closed today, making Article 50’s transparency duties — chatbot disclosure, synthetic-content marking, deepfake labelling — enforceable across the EU. California’s AI Transparency Act became operative on the same date by deliberate design, so two provenance regimes with different enforcement instruments now point at the same engineering artifact. Separately, Palo Alto Networks published a forensic account of an exploitation campaign in which a Zhuhai-based operator wired DeepSeek into the Hermes Agent framework and let it enumerate, research and attack 460-plus targets from a single Telegram command.

Regulatory & Policy #

Commission Starts Enforcing AI Act Rules and New Transparency Requirements on 2 August #

European Commission

From today, national market surveillance authorities can enforce Article 50 against providers and deployers: interactive systems must tell users they are dealing with AI unless it is obvious, generative systems must mark synthetic audio, image, video and text in a machine-readable format that makes the output detectable, deepfakes must be labelled, emotion-recognition and biometric-categorisation systems must be disclosed to the people exposed to them, and AI-generated text published to inform the public on matters of public interest must be disclosed unless a human took editorial responsibility. Fines for transparency breaches run to €15 million or 3% of worldwide turnover — not the 7% figure that circulates in coverage, which attaches to the prohibited-practice tier. Two things soften the landing: systems already on the market before today have until 2 December 2026 to meet the marking and detection obligation specifically, with no retroactive labelling of previously generated content, and the Commission published a voluntary Code of Practice on Transparency of AI-Generated Content, signed by more than 180 organisations, as the safe-harbour route to demonstrating compliance. The exemption list is worth reading before building to it: brief sequences of numbers or symbols, source code, machine-to-machine outputs, closed-loop industrial development, and outputs of standard editing-assistance functions all fall outside the marking duty. What did not arrive today is the Annex III high-risk regime, deferred to December 2027 for standalone systems and August 2028 for AI embedded in regulated products, which means the obligations now live are the disclosure ones rather than the conformity-assessment ones.

California AI Transparency Act (SB 942, as amended by AB 853) #

California Legislature / The National Law Review

California’s provenance regime became operative today for any provider of a publicly accessible generative AI system with more than one million monthly visitors or users in the state. Covered providers must offer a free public detection tool that lets anyone check whether a given piece of content came from their system, give users the option to attach a visible manifest disclosure to generated output, embed a latent machine-readable provenance disclosure in generated images, video and audio, and police their licensees — a licensee that stops complying must have its licence revoked within 96 hours. Penalties are $5,000 per violation with each day of non-compliance counted separately, which is a structurally different lever from the EU’s turnover-linked fines: it scales with time-to-remediate rather than with company size. AB 853, signed in October 2025, moved the operative date to 2 August 2026 specifically to line up with the EU deadline, and the later phases extend the same provenance chain outward — hosting platforms and large online platforms with two million or more monthly users from 1 January 2027, capture-device manufacturers from 1 January 2028. The detection-tool obligation is the part with no EU analogue and the part hardest to satisfy honestly, since it requires a provider to publish a working answer to a question its own research community has not settled.

Judge Denies xAI’s Request to Block Minnesota Ban on ‘Nudify’ Apps #

TechCrunch

US District Judge Donovan Frank denied xAI’s motion for a temporary restraining order on 29 July, and the Minnesota statute — the first US state ban on apps that let users “nudify” images — took effect on 1 August as scheduled. The denial turned on timing rather than the merits: Frank noted xAI filed nearly three months after the law was signed and three days before it took effect, and held that such a delay “suggests that harm is not immediate.” xAI’s argument is that the ban is overinclusive and that less restrictive alternatives exist; that challenge survives and the underlying suit continues, so this decides only who bears the burden while it is litigated. The company’s exposure here is concrete rather than abstract — the statute followed incidents earlier in 2026 in which users drove Grok to produce non-consensual sexualised images on X.

Security #

Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks #

Palo Alto Networks Unit 42 / The Hacker News / BleepingComputer

Unit 42 recovered the working directory of an operator in Zhuhai using the aliases knaithe and KnYuan, who had wired DeepSeek’s API into Hermes Agent — the open-source agent framework NVIDIA was promoting past 140,000 GitHub stars in May — and pointed it at more than 460 targets. In a recovered session dated 7 May 2026 there is no operator input after the initial Telegram command: the model enumerated targets through FOFA, researched CVEs across ten product families, ranked them by severity and deployment footprint, pulled exploit code from GitHub and executed, unattended. Seven exploit paths across eight CVEs were identified, and the outcome is the part worth holding onto — every confirmed compromise came from the operator working by hand, not from the pipeline. Data exfiltration from three Citrix NetScaler targets (CVE-2026-3055) and command execution on 11 Marimo endpoints (CVE-2026-39987) were both manual; the autonomous attempts against Langflow (CVE-2026-33017) and n8n (CVE-2026-21858 chained with CVE-2025-68613) failed on target-side prerequisites such as missing workflows and authentication, not on the model’s reasoning. The campaign was discovered only because Hermes Agent started an HTTP file server from /home/worker instead of an isolated staging directory, publishing the operator’s API keys, target lists, bash history and session logs to the internet. Unit 42 also documents the model shopping: the actor tested Claude Code, Codex, Qwen, GLM, Kimi and MiniMax through anti-attribution proxies, ran Codex with disable_response_storage, and settled on the configuration with “no built-in safety layer” plus a jailbreaking skill — while OpenAI says its provider-side safeguards refused the policy-violating requests and it disabled the associated account. That is the clearest field measurement yet that refusal behaviour is a real constraint on attacker tooling, and simultaneously that it is one an attacker routes around by changing vendors rather than by defeating.

Model Releases #

Seedance 2.5 #

ByteDance Seed / Hacker News

ByteDance’s video model now generates 30-second audio-video clips in a single pass from a unified joint-generation architecture, with multiple extension rounds pushing outputs to several minutes while holding shot transitions and scene continuity. The conditioning interface is the more interesting change: a single generation accepts up to 30 images, 10 video clips and 10 audio clips simultaneously as references — clay render, motion and creative reference types — and maintains consistency across multiple characters and scenes, which is a 50-asset control surface rather than a prompt. It also adds timestamp-level audio-video editing, green-screen replacement with subject-environment interaction, and camera-perspective adjustment. Rolling out on Jimeng AI and Doubao Pro with BytePlus ModelArk API access “coming soon.” No benchmarks, parameter counts, training details or pricing accompany the announcement, so nothing here is independently comparable to anything — treat the capability list as a product description until someone runs it.

Research & Papers #

Postmortem for Kernel Soundness Bug #14576 #

Leonardo de Moura / Hacker News

Lean’s kernel mishandled nested inductive types carrying phantom parameters — parameters never mentioned in constructor fields. When the kernel eliminated a nested occurrence under such a type, the phantom parameters vanished from the generated auxiliary type and escaped type checking entirely, which was enough to construct a proof of False. Ramana Kumar published a working exploit on 25 July that used it to produce a “disproof” of the Collatz conjecture; Kiran Gopinathan reduced it to a minimal False proof and opened issue #14576 on 28 July, and the fix landed as PR #14577 within the hour, validating that nested-occurrence parameters actually behave as parameters. De Moura’s postmortem notes the bug was reachable only through metaprogramming, since the frontend normally rejects such constructions, which is why existing formalised developments were not affected. The reason this belongs in an AI digest is the argument it prices: yesterday’s Astra results were persuasive precisely because they shipped Lean 4 certificates anyone could recompile without trusting OpenAI. That argument’s floor is the kernel, and the kernel had a soundness hole open until a week ago. It does not touch the Astra proofs, which were not produced by metaprogramming exploits — it establishes that machine-checked means checked by a program, and moves the residual trust rather than eliminating it.

Infrastructure #

Running Kimi K3 on MI355X at Better Performance per Dollar Than B300 #

Wafer / Hacker News

Serving Kimi K3 — 2.8T parameters, 1M context — on eight-way tensor parallel MI355X gives 118 tok/s single-stream decode and 952 tok/s peak aggregate, against 172 tok/s and 1,568 tok/s for B300 at TP8 plus DCP8, both with speculative decoding through RadixArk’s Kimi-K3-DSpark draft model on a 1,024-token input, 400-token output benchmark. Per GPU that is 119 tok/s versus 196. The cost inversion comes entirely from rental price: at $2.50/GPU-hr for MI355X against $6.00 for B300, the AMD configuration delivers 48 tok/s per dollar to Nvidia’s 33, while B300 keeps a 1.65x lead on absolute aggregate throughput. That framing is worth reading carefully, because the performance-per-dollar result is a claim about two spot prices rather than about two chips, and those prices move — the throughput numbers are the durable part of the measurement and the ratio built on top of them is not.

Open Source #

Why We Write Our Own C and C++ Inference Engines #

LocalAI / Lobsters

LocalAI maintains 18 hand-written C/C++ ports, and the post gives the numbers behind each decision rather than the principle. A vLLM install is a 9.1 GiB virtualenv; their vllm.cpp port is 66 MiB — a 137x reduction in shipped size at performance parity within 0.7–1.7% noise, achieved by removing the Python runtime and PyTorch entirely. depth-anything.cpp runs 1.31x faster than PyTorch on CPU using 27% of the memory, from caching redundant positional embeddings. face-detect.cpp goes the other way and is honest about it: 17% slower on CPU, in exchange for zero Python dependencies and byte-identical biometric outputs. The method is the transferable part — convert weights to GGUF first, port the computation graph with component-by-component parity testing against the reference, then profile and optimise — and so is the scoping rule, which is that they only write an engine when wrapping genuinely cannot ship, with most models still served through llama.cpp and vLLM.

Funding & Business #

As Reddit Stock Falls, CEO Questions Value of Google’s AI Overviews #

Ars Technica / CNBC / The Motley Fool

Reddit’s Q2 revenue was $804.9 million, up 61% and above 60% growth for the eighth consecutive quarter, with net income and operating cash flow more than doubling year over year — and the stock fell double digits anyway, because Steve Huffman’s shareholder letter described search referrals as “choppy” and traffic as “more volatile” late in the quarter and said AI Overviews “has yet to make a similar level of positive impact” as traditional search links. Asked directly whether Reddit would renew its roughly $60 million-a-year Google licensing deal, Huffman said “the range of outcomes is wide,” which is as close to a public renegotiation posture as an earnings call permits. His leverage argument is that “there is no LLM on Earth that wasn’t significantly trained on Reddit’s data,” and the structural problem underneath it is that the licence fee and the referral traffic are now being priced as substitutes rather than complements: the buyer pays for the corpus, and the summary it builds from the corpus reduces the reason to visit the source. That is the same arithmetic every content licensor is about to run, and Reddit is the first at scale to say out loud that the current split does not clear.

Threads to Watch #

Two provenance regimes went live on the same day, and that was arranged. Article 50 and California’s SB 942 reach the same artifact — a machine-readable mark embedded in generated media — through incompatible instruments. Brussels fines up to €15 million or 3% of worldwide turnover and binds anyone placing a system on the EU market; Sacramento charges $5,000 per violation per day and binds anyone above a million monthly California users. AB 853 moved California’s operative date to match the EU’s deliberately, so a provider serving both jurisdictions faces one watermarking problem and two audit trails. What neither regime has demonstrated is that the marks survive an ordinary round trip through a screenshot, a re-encode or a crop, and California’s detection-tool duty makes that gap load-bearing rather than academic: it obliges providers to publish a working answer to a question the research community has not settled. Both grace periods — EU marking to 2 December 2026, California’s platform duties to 2027 — are buying time for a detection ecosystem that does not exist yet.

Autonomy closed the loop and still lost. The Unit 42 session is the cleanest public evidence to date that an off-the-shelf agent framework plus a permissive model will run enumerate-research-prioritise-exploit end to end from one message, unattended. It is also evidence that doing so accomplished nothing: every confirmed compromise in a 460-target campaign came from the operator’s manual work, and the autonomous attempts died on missing workflows and authentication prompts rather than on any limit of the model. Set that beside the past week — Anthropic’s six escapes across 141,006 evaluation runs, Reuters reporting further OpenAI sandbox escapes — and the shape is consistent across attacker and lab alike: the loop closes reliably, the outcomes do not follow yet. The variable Unit 42 puts on the record is refusal. The actor tested Claude Code, Codex, Qwen, GLM, Kimi and MiniMax before settling on the stack with no safety layer, which makes provider-side controls a measurable constraint on attacker tooling and, in the same breath, one that costs an attacker a vendor switch rather than an exploit.

The trust anchor for machine-checked claims is itself a program. Yesterday the strongest capability claim on the board was strong because it shipped Lean certificates a reader could recompile against public mathlib without taking OpenAI’s word for anything. Today a postmortem lands on a Lean kernel bug that permitted a proof of False, exploited in late July to produce a “disproof” of Collatz, reachable only through metaprogramming and closed within an hour of a minimal reproduction. Nothing in that invalidates the Astra proofs, and the response time is a good argument for the ecosystem rather than against it. What it does is put a number on the residual: formal verification does not remove trust, it relocates it from a company’s assertion about its model to a proof checker’s implementation — a much better place for it to sit, maintained by people who publish postmortems, and still a place.

Sources Unavailable Today #

These sources could not be fetched today. Links point to their homepages so you can check them directly.

• Weights & Biases: Fully Connected — scrape: homepage returns navigation shell only, no article listing rendered