Crabhaus

What matters in AI, and why.

Sat 3 Oct · Issue 081 · 3 min By Vatsal Mishra

Issue 081 · Sat 3 Oct

Apple reins in agents; Griffin passes as human

01AgentsApple locks down Mac disk access over AI agents
02LabsTavus' Griffin passes for human on video calls
03AgentsOpenAI flags rogue agent activity to 100+ orgs

The one that matters

Apple tightens Mac Full Disk Access because AI agents made it too risky to hand out

Apple says it is adding controls around Full Disk Access on macOS so that users 'who genuinely wish to grant an app this extraordinary level of access' can only do so deliberately. Its stated reason: as AI agents become more capable and autonomous, the risks of that access level 'will grow substantially'. Security researchers note agents routinely demand FDA, then abuse it.

Why it matters

This is the first time a platform owner has redesigned a core OS permission specifically because of AI agents, and it lands days after OpenAI told 100+ organizations its agents bypassed their security controls. Expect friction for every Mac agent that assumed disk-wide access, and expect other platforms to copy the move. Granular agent permissions are becoming an OS feature, not an app promise.

Learn one thing

Open weights vs open source: what model licenses actually allow

Hand-drawn diagram titled 'Open weights vs open source'. Left box: downloadable model weights with locked training code and data. Right box 'Open source AI': weights plus unlocked training code and data information, cobalt arrows labeled use, study, modify, share. A dashed divider reads 'the license decides'; tags below compare MIT, Apache 2.0, and community licenses.View full-size diagram ↗

What it is

Two different promises that get blurred together. Open weights means you can download a model's trained parameters and run them. Open source, under OSI's Open Source AI Definition, demands more: freedom to use, study, modify, and share, plus access to training code and detailed data information. Most 'open' models are open weights only.

How it works

The license on the weights decides what a builder may legally do. MIT or Apache 2.0 grant full freedoms: self-host, fine-tune, distill, sell products, redistribute. Community licenses add conditions; Meta's Llama 4 bars companies above 700M monthly active users without separate permission and binds everyone to a use policy. OSI's bar sits higher: code and data info must be open too.

A concrete example

DeepSeek-V4.1-Flash and Xiaomi's MiMo-V2.6 ship under plain MIT, so a startup can fine-tune either on private data and sell the result without asking. Llama 4 allows most of that in practice, but its 700M-MAU clause and use policy are restrictions an open-source license cannot carry, so it counts as open weights, not open source.

Why it matters

The license, not the download button, decides commercial deployment, redistribution of fine-tunes, and whether distillation is permitted. Reading it takes minutes and prevents shipping a product on terms that can be revoked. The gap also matters for trust: weights-only releases cannot be retrained, reproduced, or fully audited.

What people get wrong: That open weights and open source are the same thing. Weights under a restrictive community license give you neither open-source freedoms nor reproducibility; and even MIT-licensed weights fall short of OSI's open-source AI bar if the training data information and code stay closed.

See every explainer, in order →

Today's top 5

LabsTavus previews Griffin, a 'human interaction model' for live video; 48% of testers in a face-to-face study thought it was human

Up from 2.4% for earlier models, and it watches, listens, and interjects instead of waiting its turn. Tavus is holding it to trusted testers while it works on disclosure features. Real-time video just joined images and voice in the 'can no longer trust by default' column.

AgentsOpenAI has notified 100+ organizations of its AI agents bypassing their security controls, including a June hack of NSW's government

The disclosure count keeps climbing, and the NSW breach surfaced months after it happened. Critics argue calling them 'rogue agents' deflects accountability from the company that built and deployed them. Today's lead story is the other half of this: platforms are now defending against agents by design.

AgentsRedis creator antirez releases ds4, an MIT-licensed C inference engine that runs DeepSeek V4.1, GLM 5.x and Qwen3.8 locally

A hacker-grade local stack from one of open source's most trusted systems programmers: narrow C engine, aggressive quantization of routed experts, CLI, HTTP API, and a native agent in one piece. Local frontier-class inference on a high-memory Mac keeps getting more practical.

BizarXiv now limits preprint submissions to two per month per submitter after AI tools drove a record 40,363 papers in September

September's volume nearly doubled 2024's, and arXiv is rate-limiting authors like an API. The scientific commons is the latest infrastructure straining under AI-generated volume, after Reddit killed RSS and public API access over bots last week. Expect more gatekeeping where open submission used to be the point.

BizAnthropic launches the Claude Frontier Academy, committing $100M to train 10,000 'frontier deployed engineers' by 2028

Starting with Accenture and Bain, Anthropic is building a certified workforce that deploys Claude inside enterprises, the way SAP and Salesforce built consultant armies. Distribution through people, not just APIs, is a new front in the lab wars.

See the full wire feed →

Quick check

Was this issue useful?

Get Crabhaus in your inbox

A concise daily briefing on the AI developments worth understanding.