The AI Brief

Vol. I · No. 135 · Wednesday, October 7, 2026

Today's brief:

  • OpenAI drops 722 AI-written math manuscripts claiming proofs of the quasi-Riemann hypothesis and the Unique Games Conjecture, none yet confirmed by outside mathematicians, sparking fury over academic norms.
  • $4.3B in nuclear investment now flows because PJM told data centers to bring their own power or get cut off, and Google just showed every operator what compliance looks like at scale.
  • Anthropic merges Project Glasswing into a three-tier Cyber Verification Program, opening Mythos-class models with reduced safety blocks to a broader pool of vetted defenders and red teams.
  • OpenAI is building the full stack of a digital ad business inside ChatGPT, which means Google and Meta now have a third major platform competing for the same brand budgets, not just the same users.
  • Meta and Sierra publish the Personal Agent Protocol, an OAuth-based standard for how AI agents authenticate with businesses, backed by Walmart, Shopify, and Stripe but not yet by a published specification.

OpenAI releases 722 AI-written math manuscripts, claims proofs of landmark open problems

Why it matters
OpenAI posted 722 mathematics manuscripts to a public GitHub repository on October 6, crediting an unnamed, unreleased internal model with claimed proofs of the quasi-Riemann hypothesis, the Unique Games Conjecture, the Hodge conjecture for CM abelian varieties, and the free group factor problem, if the results hold, the first three alone would reshape number theory, computational complexity, and algebraic geometry; the mathematics community's immediate response was fury over the unannounced, peer-review-bypassing release, not the depth of engagement the results warrant.
What's at stake
The verification gap is the story: three of the four headline results carry machine-checked Lean proofs, providing formal logical confirmation, but the Hodge result does not, and no outside mathematician has confirmed any of them, the question for institutions and operators leaning on AI math claims is whether a Lean proof plus an unreleased model card constitutes a standard of evidence they can rely on.
Decode
Lean proof = a mathematical argument encoded in the Lean proof-assistant language and verified mechanically by a software kernel, meaning a computer has checked that the logic is self-consistent given stated axioms. A Lean-verified result rules out most algebraic errors, but a human still has to confirm that the formal statement actually captures the intended mathematical claim.
Detail

OpenAI CEO Sam Altman posted a summary naming four results as the release's biggest: the quasi-Riemann hypothesis (a zero-free half-plane at real part above 7/8, accompanied by a Lean proof), the Unique Games Conjecture (also Lean-verified), the rational Hodge conjecture for CM abelian varieties (no Lean proof yet), and the free group factor isomorphism problem (Lean-verified). The 722 manuscripts are organized into 372 "result families" spanning 16 areas of mathematics, including number theory, theoretical computer science, operator algebras, and mathematical physics. OpenAI says the model was posed roughly 4,000 problems; the 722 manuscripts represent the subset the company judged worth publishing, an 18% yield. Each result used on average three hours of ChatGPT Pro thinking compute.

The release triggered immediate backlash. Multiple mathematicians accused OpenAI of ignoring a closed-door August meeting at which researchers asked the company to follow academic publication norms, and the release comes weeks after prior allegations that OpenAI's math program scooped collaborative work on the Navier-Stokes Millennium Prize problem. The Advisory Group on Mathematics and Artificial Intelligence at the Institute for Advanced Study was consulted on how to release the work, not on whether to. The model used has no name, no model card, and no API endpoint. Lean mathematician Levent Alpöge called the quasi-Riemann result "the most significant moment in mathematical history," while others pointed to conduct as disqualifying the reception.

Verification is uneven by design. Many manuscripts include Lean formalizations; others do not, and OpenAI warns that unformalized results may contain errors. Corrections will be recorded as new versions, with earlier versions preserved. OpenAI says it will fund workshops and conferences to help the community understand the results. The repository is licensed Apache 2.0 at github.com/openai/math.

OpenAI: openai/math GitHub repository (primary)/ Latent Space: AINews quasi-Riemann roundup/ Superpower Daily: OpenAI 722 manuscripts, verification uneven/ CaveatAll four headline claims are OpenAI's own and have not been independently confirmed by outside mathematicians as of publication.

$4.3B
new Constellation Energy investment unlocked by Google's 3.6 GW power deal

Google answers PJM's bring-your-own-power ultimatum with the largest nuclear uprate contract in US tech history

Why it matters
The deal shows hyperscaler power strategy has moved from voluntary green pledges to contractually obligated grid self-sufficiency: PJM Interconnection, the 13-state grid covering Google's core US data center footprint, proposed that data centers either bring their own electricity supply or face being remotely disconnected at peak demand, and Google responded with a 3,590 MW commitment, roughly the output of three large conventional power plants.
What's at stake
For most operators, this is context, not a decision. For enterprises building or leasing data center capacity inside PJM, Google's move signals that power self-sufficiency is shifting from a premium feature to a table-stakes grid requirement, with uprate-based nuclear becoming the preferred compliance mechanism ahead of new reactor construction.
Detail

Google signed two contracts with Constellation Energy on October 6. The first is a 20-year power purchase agreement covering 890 MW of nuclear output from upgrades to 11 existing reactors in Illinois, Pennsylvania, and New Jersey, with electricity from the first upgraded plant expected in 2028. The second is a separate long-term supply agreement for 2,700 MW of additional Constellation capacity inside PJM. The two together total 3,590 MW. Constellation will invest more than $4.3 billion in the project, sustaining roughly 4,400 existing jobs and creating approximately 7,200 construction jobs during the build period. Both companies described the deal as a direct response to PJM's proposed "bring your own power" rules for data centers. Google and Constellation also expanded a technology alliance involving Google Cloud and Gemini Enterprise. The deal follows Constellation's earlier agreements with Microsoft (Three Mile Island restart) and Meta (Clinton Clean Energy Center).


Anthropic opens Mythos-class models to verified defenders and red teams, with measured unblock rates

Why it matters
Anthropic's decision to publish a concrete unblock benchmark, Claude Opus 5.5 completed 34 of 50 offensive scenarios at the Red Team tier, matching the model with no safeguards at all, versus zero completions for the general public, is the first time a frontier lab has quantified what its safety classifiers are actually suppressing, making the tradeoff between defensive utility and offensive risk legible for the first time instead of leaving CISOs to guess.
What's at stake
For most operators, this is context, not a decision. For security operations teams, red teams, and critical infrastructure operators evaluating whether AI can replace or augment existing tooling for vulnerability discovery, the three-tier structure and published unblock data give a concrete basis for procurement and compliance review that did not exist before October 6.
Decode
Blocking classifier = a real-time filter that intercepts model outputs and suppresses responses judged likely to enable attacks; the general Claude API runs these on all cybersecurity-adjacent requests. The CVP (Cyber Verification Program) turns them down or off for verified users, so the underlying model capability is accessible without the classifier layer filtering the output.
Detail

Anthropic announced the expanded CVP on October 6, folding Project Glasswing, the invite-only program that gave critical infrastructure organizations access to Claude Mythos, into a single three-tier structure alongside the earlier Cyber Verification Program. The three tiers are: Defense Access, for security operations center work, incident response, malware reverse-engineering, and vulnerability validation; Red Team Access, adding authorized penetration testing; and Specialized Access, the narrowest tier, reserved for organizations authorized to test safety-critical systems such as flight operating systems and power grids, with each Specialized applicant reviewed in coordination with the US government. All three tiers include Claude Opus 5.5, Claude Sonnet 5.5, and Claude Mythos 5.1, plus future models as they ship.

The scale data comes from the retired Glasswing program: partners verified at least 129,000 software vulnerabilities between April and July 2026, with more than 33,000 rated critical or high severity, plus 5,500 more from Anthropic's own open-source scanning through October. Of 5,674 true-positive findings, only 516 have been patched, highlighting the gap between AI-assisted discovery and remediation. On Anthropic's internal CyScenarioBench, Claude Opus 5.5 completed zero of 50 offensive tasks without the program, four at the Defense tier, and 34 at the Red Team tier. A data-retention requirement applies to all tiers; zero-retention enterprise options are described as shipping later this fall.

Disclosure: Claude, which generates this brief, is built by Anthropic.

Anthropic Newsroom (primary)/ Cybersecurity News: Anthropic opens CVP/ AI Weekly: Anthropic three-tier CVP/ CaveatUnblock and vulnerability counts are Anthropic's own; CyScenarioBench is a vendor-designed benchmark.

OpenAI puts display ads inside ChatGPT image generation, targeting 1.2 billion weekly users

Why it matters
ChatGPT is assembling the structural components of a conventional digital advertising business, CPM/CPC auction buying, conversion measurement integrations with Hightouch, Tealium, and LiveRamp, brand-safety pilots with DoubleVerify and Integral Ad Science, and now a visual image format, which means it is competing for the same ad budgets as Google Search and Meta, not just for AI assistant mindshare.
What's at stake
For marketing and media-buying teams, the question is not whether to experiment with ChatGPT ads but when, given that the platform reaches 1.2 billion weekly users and the initial US test group is small enough that early entrants will have disproportionate access to attribution data before the format scales globally.
Detail

OpenAI announced on October 5 that it will test a new visual ad format in ChatGPT during image generation, beginning later in October in the US with an initial group of advertisers. The ads display labeled visual content alongside, not inside, the image being generated, and OpenAI states they will not influence ChatGPT's responses. Example screenshots published by the company show a grocery brand's product images with a "Learn more" button appearing while an image request is processed. The format targets the moment when a user is already engaged in a creative task, giving advertisers a "product inspiration" surface. Placement guardrails assess whether a conversation is appropriate for advertising before serving an ad.

The infrastructure buildout alongside the format announcement is notable: OpenAI expanded its measurement partnerships to include Haus, Measured, and WorkMagic for geo-lift experiments, and is developing incrementality testing tools. The company introduced ads earlier in 2026 to support free and low-cost subscription tiers, expanded to India in August, and has now added Sponsored Agents (launched September 17 with Wayfair and Angi as partners). The visual format is the first placement tied to a specific creative workflow rather than a conversational response. OpenAI has not disclosed which ChatGPT subscription plans will see the ads during the US test.


Meta and Sierra propose a shared authentication standard for AI agents shopping on users' behalf

Why it matters
The Personal Agent Protocol (PAP) is the first commerce-layer standard to explicitly address how a consumer's AI agent signs in to a merchant, declares its intent, and completes a task under customer-controlled permissions, but its commercial significance hinges entirely on adoption, and OpenAI, Anthropic, and Amazon are currently absent from the founding coalition, leaving the protocol competing against OpenAI's Agentic Commerce Protocol and Google's Universal Commerce Protocol for the same authentication layer.
What's at stake
For most operators, this is context, not a decision. For retailers, banks, and insurers evaluating which agent-commerce standard to build toward, the coalition gap, Walmart and Shopify in, Amazon and OpenAI out, is the signal worth tracking before committing integration resources ahead of the v0.1 specification expected in late October.
Decode
OAuth = an open authorization framework that lets a user delegate specific, revocable permissions to a third-party application without sharing their password. PAP uses OAuth so a consumer's AI agent can be granted read-only or write access to a merchant account, with the scope of that access set by the consumer and the merchant independently.
Detail

Meta and Sierra co-announced the Personal Agent Protocol on October 6 at Sierra Summit in San Francisco. Sierra co-founders Bret Taylor and Clay Bavor published the announcement; Meta's engineering lead David Singleton posted in parallel on X with a partly different partner list, a detail that reflects the protocol's early governance state. The v0.1 specification has not been published and is expected later in October, followed by design workshops and a reference implementation. Founding partners named by Sierra include Walmart, Shopify, Stripe, Rocket, Genesys, and Instinct. Neither a governing body nor a license has been disclosed.

The protocol sits at the session and authentication layer: an agent discovers what a merchant offers, starts a guest session or signs in to the customer's existing account over OAuth, and the merchant controls whether the agent reaches it via website, MCP or OpenAPI, or the merchant's own agent system. The standard is designed to carry context across channels. Payments and finer-grained permissions are listed as planned extensions. The protocol enters a crowded field: OpenAI and Stripe launched the Agentic Commerce Protocol in September 2025; Visa and Cloudflare launched the Trusted Agent Protocol in October 2025; and Google's Universal Commerce Protocol added Meta, Amazon, Microsoft, and Salesforce to its council in January 2026. PAP governs the identity and authentication step that sits above all of them.

Forkast: Sierra and Meta's Personal Agent Protocol analysis (primary)/ CellCog: Personal Agent Protocol explained/ Beri: PAP vs UCP, ACP, TAP comparison/ NotePrimary source is Sierra's blog post "Introducing Personal Agent Protocol" by Bret Taylor and Clay Bavor, sierra.ai, October 6, 2026; Sierra's site was not directly accessible at publication time. Figures and partner lists cited from Forkast and CellCog coverage of the primary announcement.