Two proposals to police frontier AI landed on the same desks in Washington this week — one from the industry, one from inside the Treasury — and on the other side of the world, a four-day intrusion showed why the argument can't wait. The through-line for 14 August is governance trying to catch up to capability, from two directions at once.

A turf war over who watches the labs

Demis Hassabis, chairman of Google DeepMind, has been personally making the case for an independent, industry-led oversight body for frontier AI — a kind of "FINRA for AI," modelled on the self-regulatory organisation that polices US brokers. Reporting this week says he took the pitch directly to Treasury Secretary Scott Bessent and White House technology adviser Michael Kratsios, moving it from a public essay into private lobbying.

The complication is that he isn't the only one drawing up the blueprint. The same reporting has Treasury quietly working on its own oversight concept in parallel — a government-designed version rather than an industry-run one. That sets up the real fight of the next year: not whether frontier labs get supervised, but who designs the supervision, and how much distance sits between the watchdog and the companies it watches. An industry body promises speed and technical fluency; a Treasury one promises independence. Both are now on the table, and they don't obviously merge.

The attack that makes it concrete

If the watchdog debate sounds abstract, this week supplied the counterweight. Researchers at the Tel Aviv security firm Dream documented what they describe as the first state-linked cyberattack against a government target run largely by autonomous AI agents — a China-linked operation that targeted Taiwan's nuclear safety regulator and reached into its energy sector.

The detail that matters is the how. The intruders leaned on open-source agent frameworks to carry out a multi-day campaign with minimal human direction: scanning, credential work, and lateral movement across dozens of accounts, orchestrated by the agents themselves rather than typed out by an operator. Taiwan's government confirmed the breach. Whatever the eventual damage assessment, the method is the story — the same agentic autonomy that vendors are selling as a productivity leap is now demonstrably usable, off the shelf, as an instrument of state cyber operations. That is exactly the capability the Washington proposals are circling, and it is already running in the wild.

Where the money and the people are moving

Underneath the governance story, the commercial map kept redrawing itself.

OpenAI named Dali Rajic, most recently president and COO of Wiz and before that president and COO of Zscaler, as its new chief revenue officer — its second person in that seat in under a year, after the previous CRO departed at around the nine-month mark. It caps a run of senior turnover at the company over recent weeks. Revenue-chief churn at a firm scaling this fast is worth watching: it usually signals either that the commercial model is being rebuilt on the fly, or that the seat is harder to hold than the headline growth suggests.

And the AI-coding category kept detaching from its "feature of a bigger IDE" origins. Lovable, one of the "vibe-coding" startups letting non-engineers build software by describing it, raised a $400M Series C at a $13.3B valuation — roughly double where it sat at the end of last year, on revenue growth that has pushed its run-rate toward the mid-hundreds of millions. Investors are no longer pricing AI code generation as a bolt-on; they're pricing it as a standalone platform category.

The read

The two Washington plans and the Taiwan attack are the same story told at different speeds. Capability ships continuously, in public, and — as this week showed — into the hands of anyone willing to point it somewhere. The rules are still being drafted, by parties who don't yet agree on who holds the pen. The gap between those two clocks is where the next year of AI policy will actually be decided.