California's AI labeling law + a DeepSeek attack campaign

The California AI Transparency Act, Senate Bill 942, became operative on August 2 after Assembly Bill 853 moved its start date from January. Any generative AI system with more than one million monthly users in the state must now embed machine-readable provenance data in every image, video, and audio output, and must run a free public tool that reads it back. The metadata follows the Coalition for Content Provenance and Authenticity (C2PA) format and carries the provider name, system version, and a timestamp. Penalties are $5,000 per violation, and each day of non-compliance counts separately.

Palo Alto Networks' Unit 42 documented a Zhuhai-based operator who connected DeepSeek to the open-source Hermes Agent framework and drove it through Telegram. After a single command, the model enumerated targets across ten product families, pulled public exploit code from GitHub, ranked vulnerabilities by severity, and ran the exploitation cycles without further human input — compressing what Unit 42 calls hundreds of hours of manual targeting into minutes. Roughly 460 targets were attempted, with confirmed impact limited to data theft from three Citrix NetScaler systems and command execution on eleven Marimo notebooks. Unit 42 notes that OpenAI's provider-side controls refused the same requests and disabled a linked account.

US District Judge Donovan Frank denied xAI's request for a temporary restraining order on July 31, letting the first US state ban on apps that generate synthetic nude images start on schedule the next day. xAI argued the statute is overinclusive and that less restrictive alternatives would achieve the same ends. The judge observed that the company filed nearly three months after the law was signed and only three days before it took effect, which undercut the claim of immediate harm. The underlying challenge continues.

On July 25 Ramana Kumar published an AI-assisted "disproof" of the Collatz conjecture. Within three days Kiran Gopinathan had reduced it to a minimal proof of a contradiction and filed an issue, and Lean creator Leonardo de Moura shipped a fix in about an hour. His August 1 postmortem calls it an implementation bug in the kernel's handling of nested inductive types rather than a hole in Lean's underlying theory, and notes the exploit reached the kernel directly instead of through ordinary elaboration. He adds that he cannot rule out the AI run having surfaced the flaw by chance. Formal proof checkers are the field's proposed backstop for machine-generated mathematics, so their own soundness is load-bearing.

Google said on July 31 that it will not ship the standalone AI Studio app for Android and iOS, despite roughly 800,000 preorders taken since the company teased it at its May developer conference. In its own words, rather than "asking you to download yet another app," Google is taking an approach "where apps emerge naturally, in the course of your everyday conversations with Gemini," and is working with the Gemini app team to bring prototyping to mobile and desktop. The AI Studio website continues for people going from an idea to a prompt to a business.

ByteDance released Seedance 2.5 on July 31, extending a single generation to 30 seconds with multi-round extensions the company says can build multi-minute pieces that hold a consistent audiovisual language. The model accepts up to 30 reference images, ten video clips, and ten audio clips at once, and adds timestamp-level audio and video editing, green screen, and camera perspective control. It is live in Jimeng and Doubao Pro; the company lists programmatic access through BytePlus ModelArk as coming soon.

The inference company Wafer published benchmarks on July 31 putting Moonshot's Kimi K3, at 2.8 trillion parameters, at 952 tokens per second per node on AMD's MI355X against 1,568 on Nvidia's B300. The AMD part is slower in raw throughput but roughly 2.4-times cheaper per GPU, which works out to 48 tokens per second per dollar versus 33. Its 288 gigabytes of memory per GPU also lets the model fit in a single node where the Nvidia configuration needs two.