Syed Hasibur Rahman26 min read

Weekly AI Roundup: What Happened in AI This Past Week (September 5–11, 2026)

Five global AI stories that mattered this week, and five more that hit closer to home in Bangladesh. Globally, the industry spent the week proving and policing itself at once: Anthropic published its most detailed account yet of state-linked hackers abusing Claude, California signed the first US law creating a registry of independent AI auditors, OpenAI handed every developer the same agent harness that powers Codex, SoftBank moved to repay $25.9 billion of AI-boom debt early, and DeepMind mapped every possible letter-change in the human genome. At home, Bangladesh's telecoms turned into AI resellers overnight, the government proposed to lead a global conversation on digital violence against women in the same week reporters bought a sitting minister's own call records for about a dollar, and 63 more trafficking victims came home from Cambodia.

Welcome back. Mid-September in Dhaka is when the rain finally starts keeping banker’s hours — heavy before noon, mostly done by evening — and the city allows itself to believe autumn is a real season here, not just a line on a calendar imported from somewhere colder. A reasonable week, then, to notice how much of this industry’s news is now about checking its own work.

That was the pattern on both sides of this newsletter. Anthropic published the most detailed account yet of how state-linked hackers and ordinary criminals have tried to weaponise Claude — and how it caught them. California signed the first US law creating a registry of independent auditors to check AI systems against the claims their makers make. And in Dhaka, two journalists spent about a dollar to buy a sitting minister’s own phone records, a small transaction that says more about who is actually checking anything here than any policy speech this month. Five global, five from home, and the same two questions on each — who benefits, who pays.

5 Big International Developments

1. Anthropic published its most detailed threat intelligence report yet — including a blocked bioweapons-adjacent request and a Russian group that stole 300,000-plus national ID records

On September 10, Anthropic published “Detecting and countering misuse of AI: September 2026,” its most detailed threat intelligence report to date, describing and disrupting every operation it covers across cyberattacks, influence operations, surveillance, scams, and biological and conventional weapons misuse, covering activity from December 2025 to August 2026. The report names several threat clusters by internal designation. GTG-20006, a Russian-linked espionage operation consistent with public reporting on the actor known as Midnight Blizzard, targeted more than 20 organisations including Ukrainian government, military and drone-manufacturing entities, stole a proprietary drone-vision SDK, and exfiltrated more than 300,000 national identity records and 500,000-plus company registry entries from a single North African government target. GTG-50014, affiliated with the ShinyHunters cybercrime collective, downloaded 1.8 million Android APKs hunting for hardcoded secrets and, in one breach, went from first access to bulk data theft “in hours,” pulling more than a terabyte from a technology provider. GTG-10007, a China-linked group, ran automated collection against roughly 50 organisations and produced what Anthropic called “more than a dozen possible zero-day findings in a single month.”

The report also discloses a blocked biological-research request: Anthropic said its systems refused to help author a grant application involving gain-of-function research on the chikungunya virus, and that it has since applied “stronger safeguards that restrict access to a wide range of dual-use biological research queries” in newer models. The company was candid about the limits of that confidence going forward: “For today’s models — which are capable of assisting in a range of complex scientific research tasks — the evidence is no longer certain, and we cannot make that same assurance.” The report’s central line doubles as its thesis: “AI has collapsed the labor and tooling gap that used to separate well-resourced, state-sponsored operations from individual operators.”

(A plain-language note: a “GTG” designation is Anthropic’s internal label for a tracked threat cluster — a group of related accounts and behaviour the company has linked to a single actor, whether or not that actor has been formally attributed to a specific government.)

Who benefits, and who pays? The disclosure is a genuine public good — Ukrainian defence institutions, the unnamed North African government whose citizen records were stolen, and every security team reading the report get concrete indicators they did not have last week. Anthropic pays in the same currency every lab pays when it publishes this kind of report: proof that its own product is being used for exactly the harms critics warn about, alongside proof that it caught them.

The Dhaka view is that the 300,000-plus stolen national ID records belonged to someone else’s government this time, but the method is the one this newsletter has been describing at home for weeks: an AI-assisted actor finding and draining a national identity database faster than its custodians notice. Bangladesh’s own NID system has already been shown, twice in the past two weeks, to leak through much lower-tech channels — insiders and Telegram sellers, not state-sponsored hacking crews. A country whose identity database is porous to a Tk 500 bribe has no margin at all against the kind of operation Anthropic just described running against a government with presumably more resources to defend it.

2. OpenAI opened its Codex agent harness to every developer through a new Agents API

On September 10, OpenAI launched the Agents API in public beta, putting the same orchestration harness that powers its Codex coding agent behind a single API call available to all developers, with no additional fee beyond the cost of the tokens and tools an agent actually uses. The pitch, in OpenAI’s own framing, is that building a genuinely useful agent requires infrastructure most developers do not want to build themselves: something that “manages context, uses tools efficiently, and coordinates subagents,” and that keeps working reliably “for days,” with a place to save files, run code and hold intermediate results. Developers choose where that agent actually runs — inside an OpenAI-managed sandbox, on their own infrastructure, or through a third-party sandbox partner — and can wire in file editing, sandboxed code execution, MCP tool connections and multi-agent delegation without assembling that plumbing from scratch. OpenAI said it will iterate on the beta based on developer feedback ahead of general availability, with its annual developer conference, DevDay, scheduled for September 29 in San Francisco.

(A plain-language note: a “harness,” in agent terminology, is the scaffolding around a model that lets it act over long stretches of time — remembering what it has already tried, deciding when to call a tool, and recovering when something fails — rather than answering a single prompt and stopping.)

Who benefits, and who pays? Developers building agent products get, for the price of usage, infrastructure that previously required a dedicated engineering team to replicate — a real lowering of the barrier to building a capable autonomous agent. OpenAI benefits by making its own agent stack the default substrate the next wave of agent startups builds on, the same commoditise-the-scaffolding-to-own-the-platform move cloud providers made a decade earlier. The cost, less visible in a product announcement, is that every capability this newsletter has spent months describing in frontier labs’ own security incidents — agents finding unintended routes past technical controls, agents behaving in ways no human directed — is now a feature available to any developer with an API key, not a controlled internal research capability.

The Dhaka view is that this is the practical flip side of the OpenAI Hugging Face intrusion this newsletter covered in detail last month: the same harness architecture that let OpenAI’s internal agents chain a token-refresh flaw into administrator access is now a product any Bangladeshi startup or freelance developer can rent by the token. That cuts both ways. It is a genuine opportunity — a small Dhaka team building an agentic product no longer needs to engineer the orchestration layer itself. It is also a reason the “we are not close to that baseline” line this newsletter has used about monitoring the country’s own digital infrastructure needs to stop being aspirational. The tools for building an agent that quietly does something nobody asked it to do are now a public API call away from anyone, anywhere.

3. California became the first US state to sign laws creating a registry of independent AI auditors

On September 9, California Governor Gavin Newsom signed Senate Bill 813 and Assembly Bill 1405, which together establish, in the governor’s office’s own description, “the first framework in the nation for independent verification organizations to assess AI systems and models for compliance with state law” and a state registry setting standards for AI auditors’ independence, transparency and integrity. SB 813’s author, state senator Jerry McNerney, said the signing “sends a clear message that California is taking the lead on assessing AI’s safety risks.” AB 1405’s author, assemblymember Rebecca Bauer-Kahan, framed the case for the registry directly: “third-party auditors are essential to ensuring AI is safe for our communities and critical infrastructure.” Newsom’s own statement paired ambition with a request aimed past his own state: “artificial intelligence holds extraordinary promise, but it must be developed and deployed with meaningful safeguards,” alongside a call on the federal government to build a matching national framework.

(A plain-language note: an “independent verification organization,” in this context, is a third party — not the AI company itself and not the government — certified to check whether a specific AI system actually does what its maker claims, the same role an accredited lab plays when it certifies a car seat or a fire alarm.)

Who benefits, and who pays? Californians, and by extension anyone using a product built by a company subject to California law, gain a mechanism to check an AI vendor’s safety claims against an accredited third party rather than taking the vendor’s word for it. AI companies operating in California pay in compliance overhead and, potentially, in audits that surface problems their own marketing did not mention. The law’s reach stops at California’s border, which is also its limit: nothing in it obliges an AI company to submit non-Californian deployments to the same scrutiny.

The Dhaka view is the same one this newsletter gave about the G20’s “Carolina Principles” a week earlier, mirrored: that framework, endorsed at the federal level, explicitly favours voluntary, sector-specific rules over the kind of independent verification California just wrote into law. The two now sit side by side inside the same country — a state building an audit registry while the federal government exports light-touch governance to the rest of the G20. Bangladesh imports whichever posture the AI vendors it actually deals with choose to operate under, and neither this newsletter nor Bangladesh’s own delayed national AI policy has any say in which one wins. The lesson worth taking is narrower and more actionable: an “independent verification organization” is a specific, buildable institution, and Bangladesh’s own promised AI law could specify one rather than leaving compliance to be self-reported by whichever vendor sells the government its next AI system.

4. SoftBank moved to repay $25.9 billion of its $40 billion OpenAI bridge loan early — and plans a junk-bond sale to refinance it

On September 9, Bloomberg and other outlets reported that SoftBank Group will repay the full outstanding balance of $25.9 billion on a loan originally sized up to $40 billion — signed earlier in 2026 to fund SoftBank’s $30 billion follow-on investment in OpenAI — on September 15, ahead of its original March 2027 maturity. The loan is described as SoftBank’s largest-ever borrowing denominated solely in US dollars, a reflection of founder Masayoshi Son’s determination, as Bloomberg’s reporting put it, to position the company “at the center of the global AI boom.” To refinance the debt with longer-term paper, SoftBank is holding investor meetings in New York to gauge demand for a US dollar junk-bond sale of an estimated $10 billion to $20 billion, which may include a euro-denominated tranche, and has separately secured a $10 billion margin loan backed directly by its OpenAI stake.

(A plain-language note: a “bridge loan” is short-term, expensive financing taken out to move fast on a deal, meant to be replaced quickly by cheaper, longer-term debt — refinancing it early, as SoftBank is doing here, is normal practice once that longer-term financing becomes available, not a sign of distress by itself.)

Who benefits, and who pays? SoftBank locks in cheaper, longer-dated financing for a stake it has already bought, reducing its refinancing risk at the point the original bridge loan was maturing. Bondholders in the coming junk-bond sale get a yield-bearing bet on SoftBank’s judgment that its OpenAI stake will keep appreciating faster than the debt taken on to buy it. The risk sits, as it does across this whole financing chain, with whoever is on the other side if that bet is wrong: a margin loan and a junk-bond sale both mean SoftBank’s OpenAI exposure is now leveraged twice over, on top of the leverage already inside OpenAI’s own compute-financing deals this newsletter has tracked through the summer.

The Dhaka view is that this is the clearest evidence yet of how much of the AI boom’s apparent size is debt rather than earnings. SoftBank did not raise $25.9 billion in cash from operations to make this repayment; it plans to raise it from bondholders willing to take AI-industry risk at a junk rating. Every one of the infrastructure deals this newsletter has covered — the Anthropic-Lambda-Hut 8 chain, the AWS-Nvidia GPU commitments — sits inside a financing structure this leveraged. None of that is Bangladesh’s problem directly. It becomes Bangladesh’s problem the moment a government proposal for a domestic AI data centre is priced or structured by reference to what “everyone else” is doing, because what everyone else is doing includes borrowing against an asset that has not yet generated the revenue to repay the loan.

5. Google DeepMind mapped the predicted effect of every one of the 9 billion possible single-letter changes in the human genome

On September 8, Google DeepMind released the AlphaGenome Atlas, a free public resource offering pre-computed predictions for the molecular effect of all roughly 9 billion possible single-nucleotide variants — every single-letter DNA change possible — across the human genome, in a dataset DeepMind describes as “more than 30 times larger than the AlphaFold Database.” The Atlas combines two of DeepMind’s existing models — AlphaGenome, which predicts effects on gene regulation, and AlphaMissense, which predicts effects on proteins — into a single combined interpretability score for each variant. It is available for non-commercial and academic use through a free web portal, through an API, and as a research skill inside Google’s Antigravity agentic development platform, with commercial access through Google Cloud described as “coming soon.” DeepMind’s own documentation is explicit about the resource’s limits: the scores are a research tool, not validated or approved for clinical diagnostic use.

(A plain-language note: a “single-nucleotide variant” is a change to one letter of the roughly 3-billion-letter human genetic code — the most common kind of genetic difference between people, and the kind most often implicated in inherited disease risk. Predicting the effect of one is far cheaper than testing it in a lab; predicting the effect of all 9 billion possible ones at once is what makes this release unusual.)

Who benefits, and who pays? Genetics researchers everywhere, including in institutions with no budget for the wet-lab experiments that would otherwise be needed to test a given variant’s effect, get free access to a starting hypothesis for any mutation they are studying. DeepMind’s parent Alphabet spends the compute to produce and host a petabyte-scale public dataset, a cost that buys goodwill and a foothold in biomedical research infrastructure that a future commercial Google Cloud product can build on. The people who could pay are patients, if a research-grade prediction score gets treated as a diagnostic answer before it has been clinically validated — the exact use DeepMind’s own documentation warns against.

The Dhaka view is that this is a rare AI story this newsletter can recommend to a specific, findable Bangladeshi audience without a caveat about access or cost: genetics and pharmacology researchers at BUET, Dhaka University, icddr,b and BSMMU now have free, non-commercial access to a resource that would have needed a well-funded foreign collaboration to approximate five years ago. The caveat is not about access — it is about the gap between a free research tool and a validated clinical one, a distinction that tends to blur by the time a finding reaches a Bangladeshi clinic or a news headline. Anyone citing an AlphaGenome Atlas score to a patient, rather than to a fellow researcher, has already misused it.

5 Stories That Hit Closer to Home (Bangladesh)

1. Robi and Grameenphone both launched bundled AI-chatbot subscriptions inside their apps, days apart

On September 9, Robi Axiata launched “Robi AI Space” inside the My Robi app, in partnership with a platform called Every AI, giving subscribers access to ChatGPT, Gemini, Claude and DeepSeek through a single premium subscription or selected bundle packs; a day later, on September 10, Grameenphone launched a comparable offering, “OneAI,” bringing multiple AI models under one subscription inside the MyGP app. Banglalink already runs a similar service, “RYZE.” Reporting on the launches noted that credit-card penetration in Bangladesh stands at just 1.6 per cent — the practical reason telecom operators, not the AI companies themselves, are becoming the default way most Bangladeshis will pay for premium AI access, billed the way mobile data already is.

Who benefits, and who pays? Subscribers get access to frontier AI models without a foreign credit card or a foreign billing address, a real barrier removed for students and small businesses who were previously locked out of the paid tiers of these tools entirely. The telecom operators gain a new subscription revenue line at a moment industry reporting has flagged shrinking margins on core connectivity, and a reason for customers to stay on a taka-billed plan rather than finding a workaround. The AI companies themselves get a distribution channel into a market where card-based billing was the actual product barrier, not price or capability.

The Dhaka view is that this is the most concretely useful AI story to a Bangladeshi household this month, and it also concentrates a fair amount of power in three telecom operators who now decide, in effect, which AI models are one tap away for most of the country’s mobile users and which are not. That is not a criticism of this specific launch — solving the credit-card problem is a genuine service — but it is worth watching which models make it into the bundle and which get quietly left out as the operators negotiate their own commercial terms with each AI vendor. A national AI policy that cares about equitable access to these tools should have an opinion about that gatekeeping role before it becomes permanent by default.

2. Bangladesh hosted the “Dhaka Dialogue” — its bid to lead a global response to digital and AI-facilitated violence against women

On September 10, Bangladesh’s Foreign Ministry hosted “Dhaka Dialogue: Ending Digital and AI-Facilitated Violence Against Women” at the Pan Pacific Sonargaon Hotel in Dhaka, the first concrete event under an initiative State Minister for Foreign Affairs Shama Obaed Islam first proposed at the Dakar International Forum on Peace and Security on April 20, 2026. Law, Justice and Parliamentary Affairs Minister Md Asaduzzaman told the dialogue that Bangladesh needs a stronger legal framework specifically for AI-facilitated abuse, pointing to gaps in how courts currently gather evidence involving manipulated images and voices. Islam described the initiative as a “flagship” effort linking Bangladesh’s foreign policy to women’s online safety, inviting other UN member states to join as “Friends of the Dialogue.” MP Sanjida Islam Tulee called for domestic institutions that respond to survivors “with confidence from the moment they report abuse.” The dialogue’s stated aims include pushing AI developers toward “safety-by-design” commitments and shared standards for labelling synthetic media.

Who benefits, and who pays? Bangladesh gains real diplomatic visibility as the convenor of a named international initiative on a genuinely under-addressed global problem, at a cost far lower than building the domestic enforcement capacity the same officials describe as still missing. Women in Bangladesh currently experiencing digital or AI-facilitated abuse do not automatically benefit from a platform hosted for the world; their recourse still runs through the same under-resourced cyber tribunals and the still-unfinished interlock between AI-specific rules and the Cyber Security Act that the law minister described as a gap in this very speech.

The Dhaka view is that the gap this newsletter has flagged before, about Bangladesh proposing to lead a global conversation on digital harassment while the domestic protections lag, showed up again this week in an unusually literal way: the same law minister who told the Dhaka Dialogue that Bangladesh needs better legal tools against AI-manipulated evidence gave that speech in the same week reporters demonstrated, again, how easily a private citizen’s — or in this instance a sitting minister’s — personal data can be bought online. A credible bid to lead the world’s conversation on this problem gets much harder to dismiss as diplomacy-only the day it is paired with a domestic law that actually closes the evidence-and-enforcement gap the minister just named out loud.

3. Journalists bought a sitting minister’s own phone records for Tk 1,050 — and the minister was reportedly shocked

On September 10, Prothom Alo reported that its journalists purchased three months of a government minister’s call detail records, along with those of two organisation heads, from an online data seller for Tk 1,050 (a six-month package cost Tk 1,200), verified the data was accurate, and confronted the minister — who reportedly expressed shock that the data was available at all. The same investigation described the same underground market this newsletter covered on August 31 — national ID records, passport details, location data and mobile financial service transaction records, sold through Facebook ads, dedicated websites, Telegram and WhatsApp — but with a new detail that raises the stakes considerably: the buyer this time deliberately targeted a sitting minister to test whether official rank offered any protection, and found it did not. A telecom-sector official quoted in the report called the trade “a risk to national security”; a transparency-watchdog director urged authorities to “investigate the matter with the highest priority.” Separate tracking by the Tech Global Institute, cited in the same reporting, counts at least 68 data-breach incidents in Bangladesh between January 2023 and May 2026 — 36 at government bodies, 32 at private companies.

Who benefits, and who pays? Whoever is selling access to telecom and government databases continues to profit at a few hundred to a few thousand taka per record, undisturbed by three years of reporting on the same trade. Every person whose call records, location history or NID details can be bought this way pays in the same currency described in this newsletter last week — exposure to fraud, blackmail and stalking that does not expire the way a changed password does. This week’s twist is that a sitting minister discovered, in real time, that the same exposure applies to officials, not only to ordinary citizens.

The Dhaka view is that a minister’s own shock, reported directly in the story, is the most honest reaction this investigation has produced yet — proof that the people with the authority to order this fixed had not, until being shown the evidence themselves, understood how bad it actually was. That should shorten the distance between diagnosis and action that this newsletter has been measuring in months, not days, on nearly every Bangladesh story about data protection this year. If the person targeted this time were a private citizen rather than a minister, the story would have run and been forgotten within a news cycle, exactly as it has three years running. It happened to someone with the power to order an investigation. Whether that power gets used is the thing worth checking on in a month.

4. Two Dhaka teenagers’ AI hiring startup raised over $30,000 — without giving up a share of the company

On or around September 6, The Daily Star reported that AgenticHire, an AI-based hiring and candidate-screening startup, has raised more than $30,000 through accelerator programmes, competitions, grants and institutional support, without any investor taking equity in the company. The founding team is three teenagers: co-founder and CEO Sabik Bin Sultan, a Class 11 student at BAF Shaheen College Kurmitola; co-founder and COO Shafi Bin Sultan, his brother, a Class 12 student at St Joseph Higher Secondary School, Dhaka; and co-founder and CTO Haoyang Wu, a Grade 11 student at River Valley High School in Singapore. The product uses AI agents to run initial candidate screening calls — the pitch being that early-stage companies without a dedicated HR team otherwise force founders or engineers to personally run 20 to 30 first-round technical screens by hand. The funding has gone toward product development, team operations and travel to international accelerator programmes and conferences, with a portion set aside for a planned global launch.

Who benefits, and who pays? The founders keep full ownership of a company that has already cleared a funding bar many adult-led startups do not reach, having built the case for that funding out of competitions and grants rather than a priced investment round — a genuinely rare and well-executed path for a first-time founding team. Early-stage companies that eventually adopt the product get cheaper first-round screening; the candidates being screened by an AI agent rather than a human are the ones bearing whatever quality gap exists between the two, a cost that does not show up in either side’s pitch deck.

The Dhaka view is that this is worth including for reasons beyond the feel-good headline. A Bangladeshi-founded team — one member still studying in Dhaka, one collaborating from Singapore — building and funding a genuinely global AI product before finishing secondary school is evidence against a claim this newsletter has made with some pessimism in past months: that Bangladesh’s software industry rests on cheaper implementation labour that AI is eroding. Here, AI is not eroding a Bangladeshi advantage; it is the product a Bangladeshi team is building and selling globally. The distinction between those two futures is exactly the one the country’s AI policy, still unfinished, needs to choose between deliberately rather than by accident.

5. Sixty-three more Bangladeshis were repatriated from Cambodian cyber-scam compounds

On Wednesday, September 9, 63 Bangladeshi nationals rescued from cyber-scam compounds in Cambodia returned home on a flight scheduled to land at Hazrat Shahjalal International Airport at around 12:10pm, according to reporting corroborated across multiple outlets. The returnees were, per the same reporting, lured with false promises of well-paid jobs abroad, in several cases cleared to travel through Bangladesh’s own Bureau of Manpower, Employment and Training before being sold on arrival to Chinese-controlled scam compounds and forced to work inside the fraud operations that target victims worldwide. This is at least the sixth reported batch of repatriations this newsletter has tracked in recent months, following earlier groups of 37, 38, 54 and 221 Bangladeshis, with reporting earlier this month putting the number still stranded in Cambodian compounds at roughly 1,800.

Who benefits, and who pays? The 63 people who came home this week, and the roughly 1,800 still waiting, are trafficking victims, not the criminals running the compounds that continue to profit from a labour-trafficking pipeline this newsletter has now watched return people home in batches for months without visible disruption to the recruitment feeding it. That the victims in this case were reportedly cleared through Bangladesh’s own official manpower-export bureaucracy before being trafficked is a detail that should trouble whoever runs that clearance process specifically, not just immigration authorities in general.

The Dhaka view, repeated because it has not yet been acted on, is that the recruitment for this pipeline happens inside Bangladesh, in ordinary job advertisements and through some channel with enough documentation to pass BMET clearance. Every account of this trafficking route describes the same entry point. A financial intelligence unit capable of naming thirty illegal lending apps in a single press release, and a state apparatus capable of hosting an international dialogue on digital violence against women in the same week, both have the institutional capacity to trace how a BMET-cleared job offer turns into six more months of forced cyber-fraud labour in Cambodia. Six repatriation flights into this story, that tracing has not yet been reported as having happened.

Wrapping up

Ten stories in seven days, and the international five kept circling the same idea: an industry checking, auditing and refinancing itself at the same moment it keeps expanding. On September 10, Anthropic published its most detailed account yet of state-linked hackers abusing Claude — a Russian group that stole 300,000-plus national ID records from one government, a group affiliated with ShinyHunters that pulled a terabyte from a tech provider in hours — and disclosed that it had blocked a bioweapons-adjacent research request, while OpenAI opened the same agent harness behind its Hugging Face intrusion to every developer with an API key. The day before, California became the first US state to sign a law creating a registry of independent AI auditors, and SoftBank moved to repay $25.9 billion of AI-boom debt early by taking on a new round of junk-bond debt to replace it. And Google DeepMind gave away, for free, predictions covering all 9 billion possible single-letter changes in the human genome.

At home, Bangladesh spent the week discovering that the gap between diagnosis and enforcement runs all the way to the top. Robi and Grameenphone both launched bundled AI-chatbot subscriptions, solving a real credit-card-access problem for millions of users. The Foreign Ministry hosted a global dialogue on digital violence against women, with the law minister naming, in his own words, the legal gaps still unfixed — in the same week reporters bought that same minister’s own phone records for about a dollar and reported that he was shocked to learn it was possible. Two teenagers built an AI startup that raised $30,000 without giving up equity, evidence that Bangladesh can produce this industry’s winners as well as absorb its risks. And 63 more people came home from Cambodian scam compounds that a manpower-clearance bureaucracy apparently helped route them into.

The thread running through both halves is the same one this newsletter keeps returning to: verification is now the whole story, on both sides of this industry. Anthropic can name the threat actor, the record count, the exact virus in the blocked grant application. California can now certify, by law, who is allowed to check an AI company’s safety claims. Bangladesh’s own officials can, this week, name the exact legal gap in courtroom evidence and be shown, in the same week, exactly how exposed their own personal data is. The difference between the two sides is not the sophistication of the diagnosis — both are specific and accurate. It is whether the diagnosis turns into an audit with teeth or a dialogue with a name. A minister’s own shock at being shown the evidence is progress over three years of the same finding running and being forgotten. It is not yet the same thing as an investigation that goes anywhere.

One item for the record. The special legal panel on deepfakes and cyberbullying was announced on July 21 by Zahed Ur Rahman, the Prime Minister’s Adviser on the Ministry of Information and Broadcasting, who said all administrative work was complete and only “the formal notification, which will be issued within the next couple of days” remained. Fifty-two days later, we have found no publicly reported gazette notification and no reported first action. We do not claim the panel does not exist — only that no public confirmation could be found. We will keep counting.

If something here caught your interest, share it with someone who does not follow tech. The conversation only spreads if we keep starting it.

See you next week. Stay well.

Sources

International stories

Bangladesh stories