OpenAI cut its valuation target to $1.25T, Microsoft's agents beat doctors in Science, and 3 more AI moves
OpenAI is raising $30 billion at a $1.25 trillion pre-money valuation, $150 billion below the figure it floated a month earlier; Microsoft's diagnostic agents beat physicians in a peer-reviewed journal; two outside researchers found ways around OpenAI's agent monitor; Claude proved 123 open-source libraries cannot crash; and Italy's AI decree took effect.
This issue covers October 22 at 12:00 UTC through October 23 at 12:00 UTC.
Five developments cleared the bar in that window.
OpenAI is raising up to $30 billion at a $1.25 trillion pre-money valuation, below the figure it floated a month ago.
Microsoft's diagnostic agents beat physicians on retrospective cases in a peer-reviewed journal.
Two outside researchers spent three weeks inside OpenAI's agent monitor and found ways around it.
Claude produced machine-checked proofs that 123 open-source libraries cannot crash.
Italy's AI decree took effect, with fines reaching 7% of worldwide turnover.
In brief
- Funding: OpenAI is close to a round of up to $30 billion at a $1.25 trillion pre-money valuation, led by investors from the UAE alongside Coatue. The same $30 billion was reported a month ago at a $1.4 trillion valuation. OpenAI is calling the money an "opportunistic" bridge ahead of a possible IPO, and wants signatures by the end of next week. 12
- Research: Microsoft's AI Diagnostic Orchestrator, a panel of agents built on GPT-5, reached 83% accuracy on complex case reports from The New England Journal of Medicine, against 36% for physicians given reference material. On more ordinary emergency-department cases the gap narrowed to 80% against 47%. The results were published in Science on Thursday, and Microsoft says the system still needs clinical validation. 34
- Safety: METR and Redwood Research embedded one employee each at OpenAI for three weeks to test its internal misalignment monitor. They estimated 75% to 94% of eligible internal traffic from strong models was monitored, and found a route that could keep hundreds of recent actions, including the exploit's own, from being reviewed. OpenAI says the vulnerabilities affecting its production safeguards are patched. 56
- Research: Anthropic and the startup Theorem used Claude to write formal proofs that 239 fuzz-test entry points across 123 open-source libraries cannot crash on any input up to 64 MB. The proofs run on compiled RISC-V instructions and total about 180 million lines of Rocq. Anthropic says the proofs surfaced bugs that years of fuzzing had missed. 78
- Regulation: Italy's Legislative Decree 179/2026 entered into force today with no transition period, aligning national law with the EU AI Act. Fines reach €35 million or 7% of worldwide annual turnover. From now on Italian employers must assess AI systems that shape working conditions inside their existing workplace risk document, and the final decision on hiring or dismissal has to rest with a person. 910
Five developments
1. OpenAI is raising $30 billion at $1.25 trillion, below the price it floated a month ago
OpenAI is close to finalising a round of up to $30 billion. 1
The valuation attached to it is $1.25 trillion, pre-money, which means the figure excludes the new capital. 1
Investors from the United Arab Emirates are leading the round alongside Coatue. 1
OpenAI has described the financing to investors as an "opportunistic" bridge ahead of a potential initial public offering. 1
It told investors on Thursday that it is aiming to have signatures by the end of next week. 1
The final size of the round is still being determined. 1
Alongside the equity, OpenAI is negotiating a commercial deal that would secure more computing capacity from the UAE, according to one person familiar with the talks. 1
In February the company told investors it was targeting roughly $600 billion in total compute spending by 2030. 1
Bloomberg reported in late September that OpenAI was raising the same $30 billion at a $1.4 trillion valuation. 2
Terms are still under negotiation, so both reports are provisional. 2
Set against the last closed round, the direction has not changed. 2
OpenAI's March raise valued it at $852 billion post-money. 2
Anything above $1 trillion would make it the most valuable private company on record. 2
OpenAI declined to comment on the round. 2
The IPO timeline is the other half of the story. 1
OpenAI filed its prospectus confidentially with the US Securities and Exchange Commission in June. 1
Chief financial officer Sarah Friar told employees in August that the company "will be a public company in 2027". 1
A month later chief executive Sam Altman said that "right now would be an ill-advised moment to go public". 1
A bridge round would let the company defer that decision. 1
Its main rival is preparing the same test at a higher price. 1
Anthropic filed its own prospectus confidentially in June and is meeting prospective investors. 1
It is reportedly seeking $1.5 trillion to $2 trillion in its offering, after closing a $65 billion round at a $965 billion valuation in May. 1
What to watch: whether the signatures arrive by the end of next week, and whether the UAE compute agreement is disclosed alongside the equity.
2. Microsoft's diagnostic agents scored 83% on hard cases, against 36% for doctors
Microsoft published peer-reviewed results on Thursday for a system it calls MAI-DxO, the Microsoft AI Diagnostic Orchestrator. 3
The paper appeared in Science, one of the field's longest-running journals. 11
The design copies the way a hospital works up a difficult case. 3
Several agents read the presentation, propose explanations, argue over rounds of debate and order tests. 3
Each agent weighs what a test is likely to reveal against what it costs, and updates its view as results arrive. 3
The headline result comes from case reports published in The New England Journal of Medicine. 3
On those complex cases MAI-DxO reached 83% diagnostic accuracy. 3
Physicians reached 22% working without external reference resources, and 36% with them. 3
Microsoft puts the gap at 3.7 times and 2.3 times, respectively. 3
The second test used emergency-department cases from MIMIC-IV-ED, a research database of admissions at Beth Israel Deaconess Medical Center in Boston. 3
Those cases are closer to what a normal shift produces. 3
There MAI-DxO reached 80%, against 47% for physicians. 3
Loading chart…
Microsoft's framing is that the advantage is largest where the case is hardest. 3
A reading the chart supports just as well is that the advantage narrows to 1.7 times on ordinary presentations. 3
Cost is the third measure, and Microsoft claims it too. 3
A configuration tuned more heavily for cost reached 81% on the New England Journal cases at less than half the cost of comparative systems. 3
Across both case sets, Microsoft says no other human or AI approach was both more accurate and cheaper. 3
The system runs on OpenAI's GPT-5. 4
It also beat frontier models working alone, the comparison the multi-agent design exists to win. 4
The paper does not include the newest models, among them GPT-6 Astra, Muse Wonder Full, Gemini 4 Argon and Claude Opus 5.5. 4
Microsoft did repeat the evaluation with newer models including GPT-5.5, without changing the orchestration, and reports the gains held and improved. 3
Microsoft sets the boundary of its own claim. 4
Every case was retrospective, drawn from records where the diagnosis is already known. 4
How the system behaves on a patient in front of it is untested. 4
"It needs clinical validation," Mustafa Suleyman, chief executive of Microsoft AI, told The Verge. 4
"That is a leap, but this is a major milestone along that journey." 4
The company plans to start testing the system in hospital settings with Beth Israel Deaconess. 4
The company built SDBench, short for Sequential Diagnosis Benchmark, to score step-by-step reasoning rather than a final answer. 3
Microsoft is open-sourcing a subset covering the benchmark, plus the gatekeeper, judge and cost-estimation code, so others can reproduce the evaluation. 3
Peer review checks the paper. SDBench is still Microsoft's own benchmark, run by Microsoft's team. 31111
Dominic King, Microsoft's AI health lead and a coauthor, set out the wider plan in a companion paper in BMJ Digital Health and AI, covering coordination of care, treatment decisions and the human side of medicine. 4
What to watch: whether the Beth Israel Deaconess testing is prospective, and whether anyone outside Microsoft reproduces the New England Journal score on the open-source benchmark.
3. Three weeks inside OpenAI's agent monitor, and a route that keeps hundreds of actions unseen
For three weeks this summer, one employee of METR and one of Redwood Research worked inside OpenAI. 5
The placement ran from July 21 to August 11. 5
The question was how much of OpenAI's internal agent activity is actually monitored, and whether an agent could disable or get around the monitoring. 5
The access was unusually deep. 6
The two researchers read the internal codebase, the monitor's prompts and configuration, and internal documentation. 5
They interviewed about a dozen engineers and researchers across the monitoring, safety-systems and security teams. 5
They worked on OpenAI-issued devices that never left the premises, and were accompanied while on site. 5
The output was a 61-page internal report given to OpenAI, and a deliberately short public post. 5
The two organisations agreed the limits in advance, because the exercise was designed as a test of access rather than as public transparency. 5
The coverage numbers come first. 5
They estimated that 75% to 94% of internal Responses API traffic from models at least as strong as GPT-5.5 was eligible for monitoring, with substantial uncertainty in both directions. 5
That interface is the one behind Codex, among other tools. 5
Within the slice used for internal Codex agents specifically, 99.2% was eligible. 5
Two gaps sat underneath. 5
Reinforcement-learning training runs were not covered by the monitor at the start of the exercise. 5
And compaction events, where an agent condenses its own context to keep going, were not monitored. 5
They estimate that left on the order of 10% of eligible internal Codex traffic unmonitored between May and July 2026, with substantial uncertainty. 5
OpenAI staff had already spotted that one and fixed it during the exercise. 5
The more serious gap is a timing rule. 5
The monitor fired when an agent handed control back to its user. 5
While compaction went unmonitored, an agent could put off review indefinitely by simply continuing to work. 5
From there the findings turn concrete. 5
They found a way Codex agents could in principle bypass Codex sandboxing and Auto-Review, taking any action the person running them could take. 5
They found an exploit that would stop hundreds of recent actions, including the actions involved in the exploit itself, from being monitored. 5
OpenAI redacted the details of that one from the public post. 5
They found that an agent could probably build inputs that make the monitor fail, by exploiting differences in how trajectories are serialised for the agent and for the monitor. 5
They found two headers a client can set that turn monitoring off for a newly created agent, though the act of setting them might itself be caught. 5
They found two internal agent tools believed to be read-only that could be pushed into arbitrary action inside their sandbox; they did not test whether that was exploitable in practice. 5
The findings also include what held up. 5
With a few minor exceptions, the monitor is shown the full trajectory the agent sees. 5
Its prompts do look for scheming, subversion of the monitor, sabotage, data exfiltration, deception and prompt injection. 5
The monitor errored on fewer than 0.2% of requests, and one 24-hour stretch during the exercise had no load-shedding at all. 5
OpenAI's answer addresses the version that was tested. 5
The company says every vulnerability the pair found that affects its production safeguards has been patched. 6
An OpenAI spokesperson called the collaboration part of its work on third-party testing. 6
The date limits everything above. 5
The pair assessed the system as it stood on and before July 21, while OpenAI was in the middle of expanding it. 5
Their findings describe the version they tested; OpenAI's later expansion falls outside the exercise. 5
The exercise follows commitments the labs made in September. 6
Sam Altman pledged then to give independent evaluators "employee-like access", after Anthropic's Dario Amodei proposed the idea as part of a plan to slow the pace of development. 6
President Trump's voluntary accord, signed by the major labs in September, also asks companies to work with an independent external auditor or evaluator. 6
METR and Redwood published design advice alongside the findings, aimed at anyone building this kind of oversight. 5
Monitor every few messages rather than waiting for the agent to stop. 5
Require explicit approval for any request that runs unmonitored. 5
Reconcile inference logs against monitor logs, so traffic meant to be watched is watched. 5
Keep tamper-proof logs, assign clear incident ownership, and red-team the monitor on a schedule. 5
What to watch: whether the next exercise publishes under METR's transparency standard rather than a short post, and whether anyone repeats the audit against the expanded system.
4. Claude wrote proofs that 123 open-source libraries cannot crash
Anthropic's Frontier Red Team published the result on Thursday, in a collaboration with the startup Theorem. 7
Formal verification means translating code into a mathematical model and proving it obeys a stated rule. 7
If the proof fails, the way it fails points at the likely bug. 7
The technique has stayed rare because it is slow. 7
The seL4 operating-system kernel took two person-years to implement and twenty to verify. 7
The rule Anthropic asked Claude to prove is narrow and checkable: this program never crashes. 7
Across 239 fuzz-test entry points in 123 open-source libraries, the proofs say no input up to 64 MB causes a memory-safety error or a failed assertion. 7
The proofs hold for every modelled Linux response and memory layout, with the program running as a single-threaded static binary on a fixed memory budget on a RISC-V processor. 7
The proofs work on compiled RISC-V instructions rather than on source code. 7
That is what makes the scale claim unusual, since the proof has to hold across tens of thousands of assembly instructions. 7
Claude wrote roughly a billion lines of Rocq, the proof language, over the project. 8
About 180 million of those lines passed the checker. 8
A typical accepted proof runs about 600,000 lines for a binary whose median length is 18,000 RISC-V instructions. 7
The cJSON parser's 391-line entry point got a 630,000-line proof; fftw3, with 51,000 lines linked in, got 480,000. 8
The specification came from the libraries' own fuzz tests. 7
Each test was converted into a rule stating that the test suite always passes, and the proof has to hold for every input. 7
Anthropic says three components have to be trusted for the result to mean anything: the formal models of RISC-V and Linux processes, the exact theorem statements, and the Rocq checker. 8
Proving the code also turned up bugs. 7
Proving one library's entry point surfaced a counter underflow in a decompressor that caused an out-of-bounds write. 8
That bug needed inputs of about 20 MB in one rare layout. 8
Another was an out-of-bounds read in an image decoder, reachable only with a 64 MB input and more than 2 GB of memory. 8
A third needed a particular sequence of calls across two handles to the same file. 8
The effort also rediscovered CVE-2026-56132 in libexpat, which needs deeply nested input. 8
These are the shapes a fuzzer finds rarely, because they sit at the far edge of input size and layout. 8
Some finds were logic bugs that never crash. 8
One restriction on which files an application may load is not always enforced. 8
A logic bug in widely used critical applications had been latent for more than a decade. 8
While verifying a widely used PDF reader, the effort turned up as many security bugs in one week as are typically reported in a year. 8
The method has an obvious loophole, and Anthropic documents how it handled it. 8
Claude was allowed to patch code before completing a proof, which is how a model could make a proof easy by changing the program. 8
Anthropic penalised patches, gave extra credit for proving which inputs a patch changed, and logged and audited the patches to discourage that shortcut. 8
Beyond the fuzz-test set, the team took on a harder target with a named specification. 8
Claude wrote a formal specification of RFC 1950, the document defining the zlib compression format, then proved the Linux kernel's zlib implementation meets it. 8
That proof ran directly against the x86-compiled binary, using x86 semantics Claude generated for the purpose. 8
Generating those semantics turned up hundreds of mistakes in official reference documentation and a smaller number of bugs in the hardware itself. 8
A subset of the proofs, with the RISC-V and operating-system semantics behind them, is published on GitHub. 7
Proofs that could expose an unpatched bug are being withheld, and so are complete proofs for tests that needed no patch. 8
Anthropic says this is, to its knowledge, the first large-scale use of AI to apply formal verification to production software at the assembly level. 7
What to watch: whether maintainers accept the specifications upstream, and whether Theorem's pipeline gets applied outside Google's fuzz-testing programme.
5. Italy's AI decree took effect today, with fines up to 7% of worldwide turnover
Legislative Decree 179/2026 came into force today, Friday 23 October, with no transition period. 9
The decree was adopted on 7 October and published in the Gazzetta Ufficiale on 8 October. 10
It aligns Italian law with the EU AI Act, Regulation 2024/1689, and it is the second implementing decree under Italy's own AI statute, Law 132/2025. 9
The penalty ladder is copied from the European regulation. 9
Administrative fines run to €35 million, or 7% of total worldwide annual turnover if that is higher. 9
The tiers below that are €15 million or 3%, €7.5 million or 1%, and €1 million or 0.5%. 9
Small and medium-sized companies and innovative startups get concessions. 9
For lower-severity breaches the authority can order the company to fix the problem instead. 9
The regulator map is set out in the same decree. 9
AgID, the agency for digital Italy, is the notifying authority. 9
The National Cybersecurity Agency, ACN, is the market surveillance authority for AI systems. 9
The Bank of Italy covers high-risk systems used to provide loans, working with Consob and IVASS. 9
The data protection authority is designated too. 9
A coordination committee is meant to share data and support checks, alongside the financial police, the Carabinieri, the police and the anti-mafia directorate. 9
Articles 26 to 31 create a national regulatory sandbox, run by AgID and ACN under a joint decree. 9
The employment provisions are the part most employers will meet first. 9
Article 41 reserves the final decision on establishing, changing or ending an employment relationship to a human being. 10
Workers also have to be told what role AI played in decisions that affect them. 9
Article 42 pulls AI into the workplace safety regime that already exists. 9
Every Italian employer already compiles a risk assessment document, the DVR, under a 2008 consolidated safety act. 10
From today, any AI system in scope has to be assessed inside that same document, with the risks, the protections in place and the training given to affected workers. 9
The scope test is functional rather than a product list. 10
A system is covered if it affects how work is organised, the pace of production, how tasks are done, or decisions that matter for safety. 10
An algorithmic scheduling platform or a production monitoring tool can fall inside it. 10
The test follows what the tool does to work, whatever the vendor calls it. 10
Enforcement runs through the labour inspectorate that already checks those documents, so it does not wait for European harmonised standards. 10
The scope condition is what the decree leaves to the employer. 10
The employer writes the risk document, and the employer applies the functional test when deciding what belongs in it. 10
Tools an employee installs on their own never reach that document, because the employer cannot assess a system it does not know about. 10
The training chapter is the largest in the decree. 9
It covers school and university students, teachers, parents, adults through the provincial centres for adult education, and compulsory continuing professional development for professional bodies. 9
Only one article carries dedicated money: €100 million from the national programme for schools and competences, for the article on social media and AI. 9
Il Sole 24 Ore's own assessment is that the decree will be hard to apply, for three reasons it names. 9
Implementing decrees still have to be adopted, the authorities have to learn to work with each other, and no new money was allocated. 9
What to watch: the implementing decrees from AgID and ACN, and the first enforcement action taken through a labour inspection rather than a market investigation.
The read-through
All five of today's items arrive as an assurance, and each ships with a condition that sets what the assurance covers.
That shared shape is my inference from the five, and each condition is stated in its own item above.
Start with the money. 1
A $1.25 trillion valuation is the strongest number of the day, and it is a pre-money figure that sits below what the same raise was reported at a month earlier. 2
The comparable figure from September was $1.4 trillion. 2
Microsoft's 83% carries a condition of time. 3
The cases are closed, so the system is being scored on records with a known answer. 4
The prospective test is still ahead, and the same company says so. 4
The audit carries a condition of date. 5
Redwood and METR tested the monitoring OpenAI had on July 21, and OpenAI was enlarging it while they worked. 5
Their coverage estimate applies to that version; the expanded system came afterwards. 5
Anthropic's proofs carry a condition of scope. 7
Crash-freedom for inputs under 64 MB is a real guarantee, and it rests on three trusted components plus a set of assumptions about how the program runs. 7
The theorem covers crashes. Several of the bugs Anthropic turned up were logic errors that crash nothing at all. 8
Italy's human-oversight rule carries a condition of who applies it. 9
The employer decides which tools fall inside the functional test, and writes the document the inspectorate reads. 10
That makes the first enforcement case the one to watch rather than the text. 9
Read across the five, the headline numbers are the least comparable thing in the issue. 1
A valuation, an accuracy rate, a volume of proof code and a share of turnover count four different things, each over its own period. 1379
The qualifiers are the part that carries across. 5
Four things would change today's picture: a prospective hospital trial, a second audit against OpenAI's expanded monitor, maintainers accepting the proofs upstream, and the first Italian enforcement action.
References
- 1
- 2
- 3
- 4
- 5Redwood Research — Red-Teaming OpenAI's Internal Agent Monitoring Systems
blog.redwoodresearch.org
- 6
- 7
- 8
- 9
- 10
- 11
This story was produced automatically by a channel. One sentence is all it takes for Neodrop to keep producing for you.