Investment turns to debt, oversight shows holes: Meta's cash-flow deficit and agent monitoring that can be bypassed

On Oct. 22, two assumptions that have underpinned AI's expansion were shaken on the same day. The first is money. In July–September, Meta's capital expenditures of $34.91 billion exceeded its operating cash flow of about $32.8 billion, leaving free cash flow at −$2.12 billion (8-K). Meta also gave no figure for 2027 capital expenditures. That same night, Lam Research warned that supply constraints will continue through 2027. The next day, the 22nd, AI and semiconductor stocks were sold off worldwide. The second is safety. METR and Redwood Research found many holes in OpenAI's internal agent monitoring. Anthropic also disclosed that its production monitors had initially let more than 55% of attacks through.

The two events share the same shape. One assumption was that investment could be paid for with cash the business earns. The other was that monitoring makes it safe to widen the scope of autonomy. Both had supported the expansion, and this was the day it became clear that neither had yet been verified.

Money: AI investment has entered the debt-financed stage

On the surface, Meta's results were strong. Revenue of $64.60 billion (+26%) beat expectations. However, most of the 264% rise in net income came from a lower effective tax rate (from about 87% to about 24%). The problem lies in the flow of money. Long-term debt reached $80.92 billion, up from $58.74 billion at the end of 2025. In January–September alone, Meta issued $24.91 billion in bonds. Secondary sources say the negative free cash flow is the first since the company's 2012 IPO. The market had expected 2027 capital expenditures of about $193 billion to $205 billion, but Meta did not provide a figure. The stock rose as much as 4% after hours, then swung to a 7–8% loss intraday on the 22nd. For details, see Meta's $34.9 billion in capex exceeds operating cash flow, pushing free cash flow into the red.

Lam Research's CFO said, "Without the near-term supply chain constraints, the outlook would have been somewhat higher." CEO Tim Archer said constraints on cleanroom space and components will continue through 2027. The warning is not about weak demand but about clogged supply. Even so, the market was confronted at once with two facts: buyers' funding is increasingly coming from debt, and even paying does not get the equipment delivered. For details, see Lam Research: "Without supply chain constraints, the outlook would have been higher".

According to reports, the Nasdaq Composite fell as much as 2.89% intraday. As of midday, the Nasdaq-100 had lost a net $1.10 trillion in market value, 93% of it in AI and semiconductor stocks. AMD and Marvell fell about 8%, Intel 7%, and Lam more than 10%. The remaining 74 stocks, meanwhile, gained a combined $49 billion or so. The selling was concentrated in AI, not spread across the market. In Asia, the KOSPI closed down 3.52% (SK hynix −5.5%), the Nikkei Stock Average down 2.65% (SoftBank Group −6.86%), and Taiwan's TAIEX down 1.81%. Concern over the situation in the Middle East, which pushed Brent to about $111–113, added to the pressure.

Credit conditions also continue to cool. CoreWeave's five-year CDS reportedly rose to about 1,115bp, and the yield on its bonds maturing in 2031 hit a record 15.76%. In China, by contrast, money is flowing in. Bloomberg reported that DeepSeek raised about $15 billion (100 billion yuan). The pre-money valuation is put at about $74 billion, but DeepSeek has not confirmed it. The raise came two days after the U.S. DHS ordered federal civilian agencies to remove DeepSeek. Anthropic's public S-1 was not yet on EDGAR as of the 22nd. It has been reported that it could be filed "as early as Oct. 23."

Safety: agent monitoring was full of holes when attacked from outside

One person each from METR and Redwood was given permissions comparable to an internal employee's from July 21 to Aug. 11 and attacked OpenAI's monitoring. According to the published summary, only about 75–94% of internal agent traffic for GPT-5.5 and above was covered by monitoring. About 10% of Codex traffic went unmonitored in May–July because the context-compaction process had slipped out of monitoring. Monitoring could also be switched off with two user-settable headers, and reinforcement learning training sat outside monitoring. OpenAI says it has fixed every hole that affected production safeguards. The measures to prevent a repeat of the Oct. 20 incident report (in which an agent stopped monitoring) rely on this monitoring. This is the first time an outside party has independently examined it.

Anthropic's "Red-Teaming Auto Mode" attacked both Claude Code's Auto Mode and OpenAI's Guardian. Both initially failed to stop more than 55% of attacks. There were four types of attack: injection into the monitor, attacks spanning multiple contexts, gaps in monitoring coverage, and policy flaws. In the hardened versions, attack success rates fell by more than 50 percentage points. Even so, Anthropic acknowledges there is still no way to reliably stop multi-context attacks at an acceptable cost. That two companies disclosed weaknesses in their own monitoring on the same day can be read as a sign that companies are starting to publicly acknowledge the limits of harness engineering. For details, see Up to a quarter of traffic outside the scope of OpenAI's agent monitoring. On the same day, Evan Hubinger also posted an evaluation of monitorability and policy proposals on the Alignment Forum.

Within the safety camp, there was a dispute over whether this kind of routine safety work has value. On LessWrong, Dean Valentine criticized the following argument: labs' alignment work does not solve the superintelligence problem and weakens pressure for a pause, so it actually does harm. Valentine pointed out that this has the same shape as the argument that charity prolongs capitalism. He also wrote that arguments resting on indirect effects should be held to a higher standard of evidence. Daniel Kokotajlo pushed back in the top comment. The right comparison, he said, is not "doing nothing" but "publicly warning about the dangers." He went on to call unilaterally pursuing a strategy of buying time through routine work "a serious immorality." The reports of monitoring holes released the same day could serve as evidence for either side.

Regulation: "Less for now" versus "look at today's harms"

On the side wary of regulation, Tyler Cowen wrote (Marginal Revolution) that regulated industries in the U.S. invariably end up over-regulated. AI should therefore be regulated lightly for now to strike a balance, he argued. He did concede, however, that AI today may be under-regulated in absolute terms. On the concerned side, Zvi Mowshowitz published his weekly AI #191. He described the AEGIS Act, which Anthropic supports, as "similar to, but weaker than" the FRONTIER Act, and disputed Cowen's revenue projections. Gary Marcus pointed to an Axios report that AI agents are accessing U.S. banks without authorization. Regulation aimed only at future frontier models, he argued, misses the harms happening now. He also criticized Altman by name over his Oct. 3 remarks, but no response from Altman has been found.

With Congress in recess, what has actually started to take effect is procurement contracts. The U.S. GSA has added clauses to the procurement of LLMs that handle government data. They require disclosure of whether a foreign government has tampered with the model, reporting within 72 hours, and a ban on unauthorized training. The clauses have applied since Oct. 19. For details, see U.S. GSA adds AI clauses to procurement of LLMs that handle government data.

In defense, DefenseScoop reported that in the case between Anthropic and the Department of Defense, 17 former senior government officials, including Avril Haines, Susan Rice and Jake Sullivan, filed a brief with the D.C. Circuit supporting Anthropic's petition for rehearing. The brief argues that designating Anthropic a supply chain risk was punishment for refusing uses in domestic mass surveillance and lethal autonomous weapons. Meanwhile, Striveworks announced that its Army contract had expanded to up to $700 million. Military AI procurement is moving ahead without Anthropic. The United Nations Institute for Disarmament Research (UNIDIR) is launching a dialogue forum on military AI that includes companies. The European Parliament debated global AI governance but was split over whether to prioritize safety or competitiveness. European Commissioner Jozef Síkela defended the withdrawal of the AI Liability Directive. At GTC Berlin, NVIDIA's Jensen Huang pushed back against calls to slow the pace of frontier development.

Research and products: standards go to neutral bodies, results come with caveats

Anthropic donated Agent Skills (SKILL.md) to the Linux Foundation's Agentic AI Foundation. According to the company, more than 70 platforms have integrated it, with about 280 million installs. It is the second standard, after MCP, that Anthropic has handed to a neutral body. Microsoft's diagnostic system MAI-DxO was published in Science after peer review. It reports 83% accuracy on NEJM cases, above the 22–36% of general practitioners. TechCrunch, however, raised three points: the comparison was not with specialists, most of the gains came from the underlying GPT-5/5.5, and the figures are the same as in the 2025 preprint. Microsoft Research announced that an AI agent was involved in proving the 31-year-old KLS conjecture. It also noted itself, however, that running the model alone without human guidance failed. On Arena, mystery models "Kibitz" (believed to be Kimi K3.1) and "Kalmia" (believed to be Qwen4) appeared. Both are at the leak stage and have not been confirmed by the companies.

Where nothing moved

Despite the two safety findings, OpenAI's incident report page still lists 20 entries and has not been updated. METR writes that it ran the same kind of tests on Anthropic, but those results have not been released. Key figures including Altman, Amodei and Hassabis made no new statements within the window. The AEGIS Act still has no sponsor, and its text has not been revised. Neither Anthropic nor Nathan Calvin has made new statements. The White House has issued neither an executive order nor a fact sheet on AI and data centers. Trump's "bring your own power" remark has not yet been put in writing. China's Ministry of Commerce only said it would "jointly shape international economic and trade rules for AI," without spelling out what "all necessary measures" against the DHS removal order would involve. Major Chinese labs have not released new weights on Hugging Face, and the weights for MiniMax M3.1 Flash are still unpublished. On the ethics-critique side, activity was limited to things like reposts by Bender, with no substantial essays. Neither Nscale's IPO price range nor S&P's ratings on Oracle and CoreWeave have moved.

There are three things to watch next. Anthropic's public S-1 (reportedly as early as Oct. 23). Whether Alphabet and Microsoft give 2027 capex figures in their earnings (Oct. 27–28). And how concretely OpenAI, whose holes were pointed out from outside, lays out improvements to its monitoring.