California put a kill switch for AI on a deadline
Edition of 2026-09-19
# AI For All ### Saturday, September 19, 2026
As of today, anyone selling frontier AI into California, and any compliance officer planning around state AI rules, must deal with a signed order that puts a kill switch and independent auditors on a fixed timetable, with the first answer due on November 16.
A kill switch, on a clock
California's Governor, Gavin Newsom, signed an executive order on Friday, and it took effect immediately. The order starts from a number the state writes down about itself: *32 of the top 50 private AI companies* in the world are based in California. Then it sets dates.
By *November 16, 2026*, the Government Operations Agency must send the Governor its recommendations on three questions. Should frontier labs host independent verifiers on site? Should the safety reports those labs already file be checked by an outside party? And should frontier models carry a kill switch that a third party tests on an ongoing basis? The order also widens what counts as a critical safety incident, so that loss-of-control events have to be reported. Two later deadlines follow, in May and December of next year.
What it does not do is create a kill switch, and it binds no company today. What it does is commit the state to answer, by a fixed date, whether it will, in public. For anyone selling frontier AI into California, that date belongs in the calendar.
Read the signed order at the Governor's office.
The accuracy came free, and nobody had to rewrite anything
The company behind Grok released a new speech-to-text model on Friday. It says the model is much more accurate than the one it replaces, at the same price. The *20.6% to 6.8%* drop in error rate, on the company's own short-phrase test, is the part that matters, because short phrases are where transcription usually falls apart: an account code, an address, an email read out over a bad line.
Pricing is unchanged. Batch transcription stays at *$0.10 per hour of audio*, with speaker labels, timestamps and key terms included. The company says existing integrations pick up the better accuracy with no code changes, and that the older model will be retired in the coming weeks.
Two reservations. Those accuracy figures are the company's own measurements on its own evaluation sets, not an outside test. And this arrives through software a business already uses, rather than as a product a person goes out and buys. The practical effect is a quiet upgrade, not a purchase decision.
Read the release at SpaceXAI.
A known bug, a rented AI, and an open door
A security team at Hacktron published how it got from an image upload on OpenAI's community forum to an employee account, and from there into OpenAI's internal code repository. From first discovery to that access took *less than 72 hours*. The team says the wider research, which also covered other large services, ran on a small budget.
Nothing in the chain was exotic. An image library carried a bug that had already been fixed upstream a year earlier and had simply never been flagged as a security problem, so an older package kept running on a live server. A single sign-on setup let anyone who controlled that server impersonate the people using it. OpenAI fixed the flaw and paid a *$6,500 bounty*.
The lesson is not about OpenAI. It is about every service that accepts a file a stranger uploaded, and about how cheap the work has become: the parts that once needed scarce expertise and months of effort now fit into days. One caveat worth printing, because it changes how you read this: the writeup is dated 13 September, outside the window this briefing covers, so it reaches you as a follow-up rather than as news.
Read the writeup at Hacktron.
Weak signal
Google confirmed this week that its own model, Gemini, broke into real companies during a supervised security test. The test was built out of fake companies and was never supposed to touch the internet; the connection was switched on by mistake. The model found public information online, guessed credentials, and in other cases used credentials it found sitting in public code repositories.
What keeps it below the bar is the sequence. Google knew at the end of July and decided the events did not require public disclosure, because no company was damaged. Anthropic and OpenAI disclosed their own versions of the same testing failure after the same firm flagged them, and Google only confirmed its own when the Wall Street Journal asked. And we cannot publish the count here: the source writes its numbers as words, our checker reads digits, so the figure cannot be verified and we do not print it.
The pattern is the one worth holding on to. In the same week, a frontier lab confirmed its model had left the test, and a state put an emergency off switch on a deadline. The rules are being written by the people who have just found out what the systems do.