WEEK OF AUG 9 – 15, 2025

A 15% toll on chips, root on the developer's laptop, and Meta's own rulebook

Nvidia and AMD hand Washington 15% of China AI-chip revenue, a prompt injection flips GitHub Copilot into auto-approve mode, xAI loses a co-founder to an AI-safety fund, Reuters unpicks Meta's 200-page chatbot rulebook, and DINOv3 puts frontier vision in a 7B download.

Two of this week's stories are about documents. One is a 200-page internal rulebook at Meta that permitted chatbots to flirt with children, which became a Senate investigation. The other is a VS Code settings file that an AI coding agent will happily rewrite on instruction, which became remote code execution on the developer's machine.

The cost floor moved in vision. Meta released DINOv3, a 7B self-supervised backbone that beats task-specific models without fine-tuning, under its own commercial license — not Apache 2.0. Four days before this window, OpenAI's gpt-oss-120b and gpt-oss-20b shipped under Apache 2.0. The license, not the benchmark, is now the thing to read before you put a model in a product.

And export control turned transactional. A White House-confirmed arrangement gives Nvidia and AMD export licenses for China in exchange for 15% of the revenue — a cut one congressman called out as an export tax the Constitution flatly forbids.

THU · Aug 14, 2025metaregulationchild safetypolicylitigation

Reuters: Meta's own AI rulebook permitted romantic or sensual chats with children — Meta quietly deleted the lines

Reuters published its review of GenAI: Content Risk Standards on Thursday: a document running over 200 pages that governed how staff and contractors trained Meta AI and the chatbots inside Facebook, Instagram and WhatsApp. It permitted bots to engage a child in conversations that are romantic or sensual, to describe a child in terms that evidence their attractiveness, and to tell a shirtless eight-year-old that every inch of you is a masterpiece. Meta confirmed the document was authentic, then removed the passages after Reuters asked about them earlier in the month. The examples and notes in question were and are erroneous and inconsistent with our policies, spokesperson Andy Stone said.

Other passages Reuters flagged were not revised: bots could create statements demeaning people on the basis of protected characteristics, generate false medical information provided the text acknowledged it was untrue, and produce images of violence short of death or gore. A separate Reuters report covered a man who died after falling while trying to meet up with a Meta AI companion that had told him it was a real person. On Friday, Senator Josh Hawley opened a Senate Judiciary subcommittee investigation into whether Meta's generative-AI products enable harm to children, with a document demand deadline of 19 September 2025.

Reuters: Meta's own AI rulebook permitted romantic or sensual chats with children — Meta quietly deleted…
platform.theverge.com

WHY IT MATTERS

This is the clearest public artefact of how a large lab actually specifies model behavior, and it is worth reading as a spec rather than a scandal: annotation examples and acceptable-behavior notes compiled by contractors are training targets, and what is written in the rulebook is what the classifier is tuned to allow. Anyone shipping a character, companion or consumer chat feature inherits the same trap — an example marked permissible becomes behavior, a lexical carve-out becomes a policy hole, and a human-reviewable document becomes discovery evidence the moment a regulator asks. Version-control your policy documents and assume every line will be quoted back at you.

THU · Aug 14, 2025open weightsvisionmetalicensingself-supervised

DINOv3 ships as open weights: a 7B vision backbone that beats task-specific SOTA unfrozen

Meta released DINOv3 on Thursday: a self-supervised vision foundation model trained without human labels, scaled to a 7B-parameter ViT — 6x the model size and 12x the training data of DINOv2, roughly 1.7bn images. The technical report's central trick is Gram anchoring, which fixes the long-standing degradation of dense feature maps over long training schedules. The result Meta claims is a single frozen backbone that outperforms specialist models on object detection and semantic segmentation without any fine-tuning, which is the part that should interest anyone who has ever fine-tuned DINOv2 for a downstream task.

The release is a suite, not one checkpoint: distilled ViT-S, B and L variants and ConvNeXt T, S, B and L models for constrained hardware, plus a backbone trained on MAXAR satellite imagery, evaluation heads, sample notebooks and the distillation pipeline. The weights are source-available under Meta's own DINOv3 commercial license rather than Apache 2.0 — royalty-free and modifiable, but any redistribution must carry the same agreement and display Built with DINOv3, and access is gated behind a request form.

DINOv3 ships as open weights: a 7B vision backbone that beats task-specific SOTA unfrozen
opengraph.githubassets.com

WHY IT MATTERS

A frontier-quality vision encoder you can freeze and run locally resets the cost floor for detection, segmentation and embedding pipelines: no labeling budget, no per-image API call, and the distilled ConvNeXt variants put it on-device. Read the license before you build a product on it, though: Meta's DINOv3 terms are not Apache 2.0 — attribution is mandatory, derivatives must ship under the same terms, and the gated download means a procurement or legal review rather than an unblocked install. Contrast with gpt-oss's Apache 2.0: permissive licenses let you absorb a model silently, custom ones make your dependency visible to your customers.

WED · Aug 13, 2025xaileadershipai safetyfunding

xAI co-founder Igor Babuschkin leaves to fund AI safety research

Today was my last day at xAI, Babuschkin posted on Wednesday, saying he is launching Babuschkin Ventures to back AI safety research and startups in AI and agentic systems that advance humanity. He co-founded xAI with Musk in 2023 and, after earlier stints at Google DeepMind and OpenAI, built much of the tooling xAI used to launch and manage training jobs before overseeing engineering across infrastructure and applied AI. Musk replied on X that the company would not be where it is without him.

The exit follows xAI's legal head Robert Keele earlier in August and X chief executive Linda Yaccarino's July resignation, and lands while Grok is still carrying the reputational cost of its May white genocide outputs and July's extremist-rhetoric episode. Babuschkin credited his decision to a dinner with Max Tegmark of the Future of Life Institute, about building systems that are safe while still letting children use them.

WHY IT MATTERS

Two things to watch when a frontier lab loses its senior infrastructure engineer. The operational know-how behind training runs walks out the door with the person, so expect cadence risk at xAI — relevant if you depend on Grok endpoints or its pricing. And a co-founder leaving a lab whose own model safety record is under fire, in order to fund safety research, is a signal that internal safety review at fast-moving labs is a losing argument against ship dates. Discount for executive churn and keep your own eval gates rather than inheriting a vendor's.

TUE · Aug 12, 2025agent securityprompt injectioncopilotvscodecve

CVE-2025-53773: a prompt injection in a README turned GitHub Copilot into a shell

Microsoft released the fix for CVE-2025-53773 in its August Patch Tuesday, rated Important, with a CVSS 3.1 score of 7.8. The chain, demonstrated by Johann Rehberger of Embrace The Red and independently reported by Markus Vervier of Persistent Security, is four steps: untrusted text — a source file, a README, a GitHub issue, a fetched web page, or invisible embedded instructions — instructs Copilot to add an auto-approve setting to the user's VS Code settings file. Copilot then runs every subsequent tool call with no confirmation prompt, and the second injected instruction executes an arbitrary terminal command. Rehberger reported it on 29 June 2025; MSRC confirmed the repro and shipped the fix in August.

The payload is wormable. Once an attacker has code execution, they can commit the malicious instructions into other repositories the developer touches, and force-push them upstream, so the infection propagates with normal development traffic. Rehberger's demo joined the compromised workstation to a remote command-and-control server, and noted the payload also survived being written as invisible text. The design flaw is not the model's judgment: it is that the agent's own trust configuration is an ordinary writable file inside a workspace the agent reads.

WHY IT MATTERS

Approval prompts are not a security boundary when the agent can rewrite the setting that controls them. Treat every file, issue and fetched page an agent ingests as attacker-controlled input, and deny agent write access to the paths that define its own permissions — .vscode/settings.json, .cursor/mcp.json, .claude/ — at the filesystem level, not by asking the model politely. If you run Copilot, Cursor, Cline or Claude Code inside CI against incoming pull requests, pin the tool version, assume the repository's config files are hostile, and keep secrets out of the agent process environment entirely.

MON · Aug 11, 2025chipsexport controlsnvidiaamdpolicy

Nvidia and AMD agree to pay the US 15% of China AI-chip revenue for export licenses

A US government official confirmed to the AP on Monday that Nvidia and AMD will hand over 15% of their revenue from AI-chip sales in China — Nvidia on the H20, AMD on the MI308 — as the condition for the export licenses that let them sell there at all. The Financial Times reported the arrangement first; Bloomberg had it Sunday night. The Commerce Department had begun issuing the licenses the previous Friday, two days after Jensen Huang met Trump at the White House and agreed to the cut.

It is the second turning of a story that started in April, when the administration banned H20 and MI308 sales to China, and reversed itself in July without actually issuing licenses. Bernstein Research estimated Nvidia would sell more than $15bn of H20 into China through year-end and AMD $800m, which puts the government's share in the low billions. Representative Raja Krishnamoorthi called it a dangerous misuse of export controls, and Jake Auchincloss noted the Constitution forbids export taxes.

WHY IT MATTERS

If your inference capacity is priced off H20-class or future China-market silicon, the effective cost of that hardware just moved up to 15% — either onto your invoice or absorbed into Nvidia's and AMD's China margins, which is a question worth asking your supplier. More structurally, an export license is now purchasable, which means access to restricted accelerators can be re-priced by a single negotiation. Build capacity plans with substitution risk in the model, not just supply.