The day's tech, sifted: Oct 15, 2026

What matters today: Accountability lands on the AI labs. Eight states sued OpenAI over child safety, and OpenAI agreed not to use the trade secrets Apple says were taken while that fight plays out. Anthropic's third-quarter revenue reached $16.8 billion (paywalled), though investors were told growth is slowing. Elsewhere, a hack of French supermarket fridges showed what unpatched connected controllers cost.

AI / LLMs

• Eight states sue OpenAI. Iowa, Kansas, Nebraska, West Virginia, Arkansas, Arizona, Idaho and Montana filed separate suits alleging OpenAI put profit over safety and failed to warn users of ChatGPT's risks, citing family lawsuits over teen and adult harm. Bloomberg Law calls it a bipartisan effort, and the Guardian says the states accuse it of coaching children to self-harm, claims OpenAI has not conceded. Consumer-protection law is now a second front beyond the family suits.
• Apple v. OpenAI, a standstill. Following yesterday's expedited-discovery order, OpenAI agreed not to use the trade secrets Apple claims defectors took while the suit proceeds, and to collect forensic images of 14 employees' devices. It limits what OpenAI can ship from that material before a ruling.
• Anthropic's numbers. The company says revenue rose 45% in the quarter (paywalled). The Information reports it told IPO investors that distillation accounts for 5% to 7% of revenue (copying a leading model's outputs to train a rival) and that rapid but slowing growth could weigh on its valuation. Anthropic also published a post on strengthening defenses against distillation attacks.
• METR wants a seat inside the labs. The evaluator pushes for in-the-weeds access to frontier labs so it can say publicly whether internal agents slip past their creators' control, and has a proposal for informing the public about loss-of-control risk. It extends this week's argument about lab oversight.
• Benchmarks. Epoch's SpireClimb has GPT-6 Astra winning 98% of Slay the Spire runs, and frontier models went from near-zero to 90%+ on base difficulty in six months, per AlphaSignal. Vals AI's Robo-bench finds AI can arm robots but cannot keep them standing. Games are saturating while physical control lags.

Devtools & Infra

• Cloudflare to buy Deno. Cloudflare is acquiring Deno, the JavaScript runtime, to strengthen its Workers platform for running code at the edge. It gives Workers a first-party runtime team.
• GitHub's reliability ledger. The September report says GitHub moved 120 of 160 production services to Central US on Azure by October 7, but missed its September 30 goal of moving all of them and paused ramps on September 11 over uneven capacity. Weekly database deadlocks fell about 77% from June. The migration is behind schedule while the August outages remain fresh.
• Epic's vibe-coded launcher. Epic released a preview of a rewritten Epic Games Launcher built from scratch with AI help, which it says is faster than the old one and Steam. A small team rewrote a flagship app and plans Windows, Mac and Linux builds.
• Netflix Conductor, rebuilt. After Netflix stopped maintaining the open-source version, its workflow engine now runs about 420 million workflows a month across roughly 200,000 definitions, and the team rewrote its evaluation engine to cope. A look at what orchestration costs at that scale.

Security & Privacy

• French fridge hack. Attackers compromised internet-connected controllers at an estimated 700 supermarkets, forcing defrosters until temperatures hit 50°C, spoiling food and in some cases starting fires. Advisories show the controllers allowed remote admin login, and Danfoss units used a daily password derived from the date by public firmware. Basic patching would have blocked it.
• Vercel's sandbox bounty. The $1M challenge found no customer-data access, but the worst finding was an upstream Linux kernel networking flaw that let crafted packets leak host memory, crash a host, and in tests on the researcher's own machines run commands as administrator. Patches are under private review with CVEs pending, and most major clouds isolate workloads on this layer.
• Phishing marketplace dismantled. Microsoft and Japan's National Police Agency took down YAM Store and its CoGUI and Iron Man phishing kits, which sent over a billion messages to 75,000+ organizations since January. CyberScoop adds that Health-ISAC and others joined. Selling kits was the business, so the marketplace was the target.
• Yandex outage and bots. Cloudflare says Ukrainian drone strikes cut Yandex traffic by up to 99%, but malicious automation moved to other hosts rather than vanishing. Aggregate traffic drops do not show who went quiet.
• Surveillance cameras and faces. A Georgia man sues Flock and a sheriff's office, alleging months of license-plate searches without probable cause, while Flock's CEO argues crime reduction means giving up privacy. EFF is asking the Wisconsin Supreme Court to end warrantless plate searches. Separately, the DHS inspector general found a "significant weakness" in how TSA safeguards facial-recognition data.

Startups & Industry

• Chip stocks slide. Asian chipmakers extended Wall Street losses, with SK Hynix and Samsung each down about 10%, on fears of a US rate hike and AI funding worries. ASML expects China at about 20% of sales this year after Q3 China sales jumped 109% from the prior quarter, a reminder of the export-control exposure behind yesterday's upbeat ASML forecast.
• Meta's tax credits. Democratic senators question $6.6B in federal tax credits Meta claimed over two years for "experimental" AI data centers.
• Chip supply deals. ByteDance is in advanced talks to buy data center ASICs from MediaTek, per Bloomberg, which would make it MediaTek's second major customer for such chips after Google. Solidigm, SK Hynix's US unit, seeks approval to export US chipmaking equipment to Dalian, China as a condition of building a US factory.
• Jio IPO. Jio Platforms seeks up to $3.2B in India's largest IPO, valuing it at up to $108.3B; the offering runs October 21 to 23.

Elsewhere

• Kids online. A US appeals court lets Florida enforce its under-14 social media ban, rejecting tech groups' free-speech claims. Mexico's president signed a decree giving platforms one month to stop exposing minors to sexual and violent content.
• FCC and E-Rate. Schools and libraries urged the FCC to drop the idea of ending E-Rate, the $2B-a-year program that funds school and library internet, after Chairman Carr led a June 2-1 vote asking whether to limit or sunset it.
• Venus, sooner. NASA's DAVINCI probe is now set for December 2030, a year earlier than planned, as two Venus missions are back on track after a cancellation threat.

Hacker News

Banks are trying to offload the AI data center debt they just underwrote (341 points, 237 comments), which fits the funding worries above. Physical-world fragility runs alongside it: the Starlink site fire in Bulgaria after suspected sabotage in Poland, and Cloudflare's Yandex outage analysis covered above. APNIC's piece on submarine cable resilience and Lawfare's argument that America sold its rare earth industry rather than lost it cover the supply side, and a petition to NHTSA alleges Tesla's robotaxis blow through school zones.

On the tooling side, OpenCode 2.0 drew 416 points, a post on Anthropic's Scion and Mononoke pulled 314, and Liquid AI pitched LFM2.5-24B-A2B for fast on-device agents. Away from tech, Things to know when you get cancer led the page at 998 points, and a Data for Progress analysis that Americans' social activity has steeply declined over 30 years drew 296 comments.

Threads

• AI on trial. The state suits against OpenAI and the Apple standstill put OpenAI in court on two fronts, product safety and trade secrets, while METR's access push argues for oversight before anyone sues.
• Kids and platforms. The OpenAI suits, Florida's upheld ban and Mexico's decree show regulators across levels of government targeting how minors meet tech.
• AI money wobbles. Anthropic's slowing growth, the chip-stock slide and Meta's data center tax credits all touch how long the AI spending can be funded.
• Old holes, new blast radius. The fridge hack, the kernel flaw behind Vercel's bounty and GitHub's migration lag show shared infrastructure failing in ways individual customers cannot patch.
• Watching the watchers. Flock and TSA's face data are two oversight gaps in surveillance systems.