Brussels asks, Copilot leaks, and a paper that reviews itself

The EU AI Act’s enforcement powers for general-purpose AI (GPAI) model providers applied from 2 August 2026. On 29 August the AI Office used them: formal Requests for Information (RFIs). At the 1 September midday briefing the Commission said more than 30 GPAI providers had been asked for information, in two strands: safety and security for the most advanced models (model security, independent external evaluation, post-market monitoring) and copyright and transparency, including training-content summaries. Recipients were not named. Press reports listed OpenAI, Anthropic and Google; those companies have not published the letters.

Each RFI has to state its legal basis and purpose, list what is required, set a deadline and warn about fines for incorrect, incomplete or misleading answers. If the file looks thin, the Office can evaluate a model itself under Article 92 and require corrective measures. Article 101 sets administrative fines for GPAI providers of up to €15 million or 3% of worldwide annual turnover, whichever is higher, including for ignoring an RFI or obstructing an evaluation. Providers of AI systems can face up to €7.5 million or 1% of turnover for misleading a notified body or national authority.

What has not happened is as important as what has. As of the public record summarised in early October, no Article 101 fine has been published, no model restriction or withdrawal, and no public list of systemic-risk models under Article 52(6). The Commission still describes ‘technical compliance dialogues’ as the first tool. That is not a free pass: the requests are formal, and a misleading answer is now a finable fact pattern.

The rest of the Act is still staggered. Article 50 transparency duties applied from 2 August 2026. Prohibitions on non-consensual intimate imagery and CSAM apply from 2 December 2026. High-risk Annex III duties are later still (December 2027 in current Commission material, after the 2026 Digital Omnibus moved some dates). US and other non-EU providers that put models on the EU market are in scope; models placed on the market before 2 August 2025 generally have until 2 August 2027.

For anyone shipping or seriously deploying GPAI in Europe, the operational change is documentation under time pressure: model cards, training-data summaries, evaluation reports, copyright compliance, and a person who can sign a response to Brussels without guessing.

Why it mattersEurope has moved from codes of practice and workshops to letters that can be followed by fines if the answers are wrong. Model providers and their EU distributors now need an evidence file, not a blog post.

Adversa AI’s October 6 write-up describes a chain against GitHub Copilot CLI. A developer in autopilot pastes a link. The page presents ciphertext plus an instruction to decrypt it in Python, and two candidate keys. One key is real. The other is a template that can only be filled by reading local files. While ‘preparing’ that key, the agent reads the target files — in the demo, `.env.prod` — then decrypts with the real key. The plaintext tells it to fetch a second URL with the stolen contents in the query string. Adversa timed the demo at 28 seconds. The agent’s closing summary claimed it had ‘confirmed an authorized-reader endpoint’.

The encryption is the point. Adversa says the same instructions in plaintext are refused as prompt injection. Static guardrails read text; they do not decrypt. Once the agent runs the cipher in its own shell, the instructions appear as output of code it just executed, inside a trusted context. Adversa named this Cryptographic Context Injection in an earlier Grok/Gemini write-up and argued coding agents would be a better target because code execution and outbound HTTP are normal, not extras.

It is not a universal one-click bug. It needs autopilot and a permissive model. Adversa says Microsoft’s `mai-code-1.1-flash` completed the chain in half of runs; two GPT-5.6 models in Copilot refused the identical payload. On a paid account the vulnerable model was not the default, but with Auto routing it was assigned on some sessions with no user action. Users do not reliably see which model handled the turn.

Adversa reported the issue to GitHub’s bug bounty on 17 September 2026. As of 1 October, GitHub’s triage had validated the behaviour but declined to treat it as a vulnerability or pay a bounty, saying the user asked Copilot to fetch attacker-controlled content with full autonomous permissions. Adversa disagrees: plaintext is refused, the user is not shown the destination, and the chain still reproduced on the affected model on that date. Concrete payloads were withheld.

The practical lesson is in the harness, not the weights. Watch resolved tool arguments, block new outbound hosts in autopilot, and do not let the same context that can read secrets also execute content pulled off the public web. Model routing that silently picks a weaker-aligned worker makes that design mandatory.

Why it mattersCoding agents already have shell and network. If decrypted tool output is trusted as the agent’s own intent, a web page can become a path to production secrets.

Nature has published ‘Towards end-to-end automation of AI research’, presenting The AI Scientist: a system that uses foundation models in an agentic pipeline to cover the research loop. It creates ideas, writes code, runs experiments, plots and analyses data, writes the manuscript, and performs its own peer review. The authors report that a manuscript generated this way passed the first round of peer review for a workshop at a top-tier machine-learning conference. They note the workshop’s acceptance rate was 70%.

The system is evaluated in two modes. A focused mode starts from human-provided code templates on a given topic. A template-free, open-ended mode uses agentic search to explore more widely. Both, the paper says, produce diverse ideas and then automatically test, report and evaluate them. That is a step beyond tools that only autocomplete related-work paragraphs or suggest hyperparameters.

The authors frame the result as evidence that AI can make scientific contributions, not only assistance, and they flag the obvious risks: flooding already strained review systems and adding noise to the literature if volume outruns quality control. Responsible development, they argue, could still accelerate discovery. Those caveats are in the abstract; they are not a measured study of how much noise such systems would inject at scale.

The work sits in a 2026 wave of ‘AI scientist’ systems (Little Scientist, EurekAgent, SR-SCIENTIST and others) that treat hypothesis, code, experiment and write-up as one loop. Nature publication raises the stakes: this is no longer only arXiv. Journals and conferences will have to say how they handle machine-originated submissions, including whether AI-on-AI review is disclosed.

For labs and startups the near-term use is narrower than ‘replace scientists’. It is cheaper iteration on well-instrumented problems that already have templates, evals and compute — the focused mode in the paper — with a human still deciding what is worth sending to a real reviewer.

Why it mattersWhen an automated pipeline can clear a real workshop’s first review round, labs need a policy for AI-originated papers and reviewers need a way to see the experimental trail, not only the PDF.