Some days the AI news is a scattered pile of product launches. Thursday into Friday was not that. Read together, the day's biggest stories were all about the same question from different angles: who gets to set the limits on increasingly capable AI — and where those limits live.

A court draws one line: the government cannot punish a lab for its stance

The sharpest of them came from a US courtroom. A federal judge, Rita Lin of the Northern District of California, vacated the Pentagon's designation of Anthropic as a "supply chain risk," ruling it violated both the First Amendment and the Fifth Amendment's due process clause. The designation, she found, was driven "based on a desire to make a public example out" of the company after it refused to let its models be used without guardrails — specifically, in fully autonomous lethal weapons or for mass surveillance of Americans.

The line the ruling draws is narrow in law and wide in implication: a government cannot use its procurement power to punish an AI lab for the positions it takes. Every frontier lab now negotiating with a state over how its models get used just gained a constitutional floor to stand on. It is not a total win — a separate case in Washington DC is still live — but the principle is on the record. We covered the ruling in full here.

A lab draws another: safety limits written into the machine

On the same day, Anthropic pushed in the opposite direction — outward, into the physical world. Its new Model Hardware Standard is a specification that lets AI agents discover and operate real devices: microscopes, liquid handlers, robotic arms. The interesting part is where the safety limits sit. Rather than trusting a model to behave, the standard lets whoever builds or runs a device write hard operational constraints — speed and angle limits — directly into its specification, so an agent cannot move the machine outside safe parameters however it is prompted.

It is early — a research preview for labs and manufacturers — but the design choice matters. Putting the constraint in the specification rather than the prompt is a meaningfully different approach to safety, because a prompt can be argued with and a hard-coded limit cannot. More on what MHS is and why it matters.

One hundred companies draw a third: brace before the attacks land

Then came the collective alarm. OpenAI, Anthropic and more than 100 other companies — Google, Microsoft, Amazon Web Services, Cisco, CrowdStrike, and tellingly Visa, Mastercard and Capital One — signed a joint open letter warning that AI-powered cyberattacks are about to become far more common, and calling for a defensive surge before they arrive. Hospitals, water treatment plants and the internet's own backbone are named as at risk.

The signatory list is the message: when the card networks and the cloud giants co-sign the same warning as the AI labs, this has stopped being a niche safety debate. The uncomfortable part, unspoken in the letter, is the circularity — the companies best placed to arm defenders are the same ones whose models are arming attackers. The full story, and the tension inside it.

And quietly, the tools keep maturing

Underneath the governance drama, the capability curve did its usual work. Google made Gemini Omni 1.1 Flash generally available on its API — a developer release that adds the unglamorous things that turn AI video from a demo into a production tool: longer coherent clips, keyframe control, 4K, a cheap draft mode. Not a headline-grabber, which is rather the point. Why the boring release is the important one.

One story we are deliberately not calling done: the reported $12.9 billion Nvidia acquisition of Hugging Face. Multiple outlets say a deal is agreed, but as of Friday neither company has confirmed it and there is no signed agreement. We will cover it properly the moment it is real.

The thread

Put the four together and the shape of the day is clear. A court limiting what a government can do to a lab; a lab building limits into the machines its models touch; a hundred companies asking the world to raise its defences; and the underlying tools quietly getting more capable regardless. The capability is not waiting for anyone. The interesting fight of this phase is no longer whether these systems are powerful — it is who gets to draw the lines around them, and whether those lines hold.