Editor's note: A quieter Saturday cycle, but the week's substantive developments cluster cleanly. We lead on the transatlantic cyber-model contest (Enterprise/sovereignty) because it is the story closest to a European buyer's decision; carry one Regulation main (the Great American AI Act, which dominates the US governance cycle and sets up a sharp contrast with the EU's just-passed sovereignty package); and a Models/governance main (Anthropic's recursive-self-improvement pause call). Open Source and infrastructure are handled in the quick hits — no fresh open-weight drop landed today, with MiniMax M3's weights still pending.
Both American Cyber Models Are Now Inside Europe — and the AI Act Can't Compel Either of Them
Within roughly three weeks of each other, the two leading US labs have pushed their most capable cybersecurity models into European institutions. OpenAI is extending GPT-5.5-Cyber to Europe under a new "EU Cyber Action Plan," opening limited-preview access to vetted defenders, businesses, governments, cyber agencies, and EU institutions including the EU AI Office. Days earlier, Anthropic ended a weeks-long standoff by giving the EU's cybersecurity agency ENISA access to Claude Mythos on 1 June — the first EU institution admitted to Project Glasswing — then expanded the program the next day to roughly 150 organisations across more than 15 countries, including entities in France, Germany, Italy, Spain, Belgium, the Netherlands and Sweden. The capability is real: the UK's AI Security Institute found GPT-5.5 completed a 32-step simulated corporate intrusion end-to-end in 2 of 10 attempts and Mythos in 3 of 10 — the only two models ever to do so — and solved a 12-hour reverse-engineering challenge in ten minutes for $1.73 of API usage.
The differentiator is access, not raw power (GPT-5.5-Cyber scores 81.9% on CyberGym versus 81.8% for the base model), and that is precisely the European problem. As The Next Web noted, the AI Act "has no mechanism to compel an American company to share its most powerful model with European regulators" — the standoff that preceded ENISA's admission saw euro-area finance ministers, the ECB and several member states demanding access after learning Mythos had already found flaws in software their banks and infrastructure depend on. Europe is now negotiating, institution by institution, for tools that can locate weaknesses in its own critical systems before its own agencies can — a posture that holds only as long as the vendor's voluntary plan does. For regulated operators the lesson is structural, not anti-American: capability that arrives at a foreign lab's discretion is capability you do not control, and the durable answer is the ability to run defensive inference on infrastructure and under a jurisdiction you do.
Washington's Answer to Brussels: A 269-Page Bill to Freeze State AI Law for Three Years
Days after the European Commission proposed its Cloud and AI Development Act, US Representatives Jay Obernolte (R-CA) and Lori Trahan (D-MA) released a 269-page discussion draft of the Great American Artificial Intelligence Act. Its most contested provision is a three-year preemption of state laws "specifically regulating the development" of frontier models — a sunset that would, among others, freeze California's training-data-disclosure and watermarking statutes. In their place the draft would require companies with over $500M in revenue to publish Frontier AI Frameworks, report critical safety incidents to the federal government, and submit cybersecurity mitigation plans to auditors, funded by a $100M/year Center for AI Standards and Innovation. Reaction split immediately: a coalition of labour unions called it "a giveaway to the AI industry," while ITI and NetChoice welcomed it.
The transatlantic contrast is the point worth holding. The EU has just proposed writing sovereignty into procurement — four graded assurance levels, "processing of AI inference data" as a scored criterion — while the leading US proposal moves to strip the sub-federal layer of rules and replace it with a lighter, disclosure-based federal floor. For a European buyer the divergence is not abstract: it widens the gap between what a US-hosted provider is governed by at home and what an EU regulated-sector contract requires. The draft is early — a discussion draft, not an introduced bill, with a long legislative road — but it signals that the two largest AI markets are now optimising for opposite things, and that "where is this governed?" is becoming as load-bearing a question as "how good is the model?"
Anthropic Asks Its Rivals to Agree on a Brake Pedal
In a post from the Anthropic Institute, Jack Clark and Marina Favaro argued that frontier AI is approaching "full recursive self-improvement" — the point at which systems can meaningfully design their own successors — and called for a coordinated pause framework agreed among multiple well-resourced labs, with explicit rules on what would trigger a halt, what would end it, and who would oversee it. The evidence they cite is internal and concrete: Claude now writes more than 80% of code contributions to Anthropic's own codebase, and engineers were absorbing roughly eight times as much merged code per day in Q2 2026 as two years earlier.
The proposal is candid about why it is hard. As the authors and outside coverage note, unilateral restraint fails: training runs are far easier to conceal than missile silos, the inputs are general-purpose, and whoever keeps going while others pause inherits the lead. That defection problem is exactly why this reads less as a safety pledge than as a governance gap laid bare — a frontier lab conceding that the pace is now set by the technology rather than by its makers, and that no single company can choose to slow down. For enterprises the takeaway is sober rather than alarmist: the labs themselves are signalling that capability trajectories are accelerating faster than oversight, which is an argument for buyers to weight controllability, auditability and exit options more heavily, not less.
Quick Hits
- Open-weight cost counter holds; MiniMax M3 weights still pending. The download for MiniMax M3 — 59% SWE-Bench Pro, 1M-token context — is due around 11 June and remains the cohort's next real reproducibility test. Alongside it, Alibaba's Qwen 3.7 Max is drawing developer attention at roughly half the input and a quarter of the output cost of comparable frontier models; the gap with hosted Western models is now an architecture decision, not a rounding error.
- A 231-day migration in 13 days. A widely cited Salesforce case study put the agentic-coding ROI story in hard numbers — a migration scoped at 231 days completed in 13 with Claude Code — the kind of evidence now driving the shift from AI pilots to production commitments in regulated industries.
- ChatGPT's new memory runs without you asking. OpenAI's Dreaming V3 began reaching US Plus and Pro users on 4 June, synthesising user profiles automatically after conversations end. A February arXiv study found 96% of ChatGPT memories were created unilaterally by the system — behavioural-profile features that will meet the EU AI Act's transparency rules head-on when they take effect in August.
- Power becomes the constraint. Arizona Public Service has proposed a 45% electricity-rate increase aimed specifically at data centres, among the largest single-sector utility hikes in US history — a preview of the grid-cost pressure that now sits underneath every cloud-inference bill.
- SpaceX IPO prices 11 June. The roadshow opened 4 June; pricing is set for 11 June and Nasdaq trading under SPCX for 12 June, targeting up to $75B. The AI line investors are scrutinising: Anthropic's reported $1.25B/month — roughly $15B/year — compute commitment, a single-vendor dependency that its own S-1 discussion will have to address.
- WWDC opens Monday. Apple's 8 June keynote is expected to centre on a rebuilt Siri running on a custom ~1.2T-parameter Gemini model, with the EU data-processing-location question still open — the same sovereignty thread, now reaching the consumer device in everyone's pocket.