As AI Scales, Safety and Infrastructure Must Keep Up – October 10 Daily Briefing

The more work AI can do, and the faster it can do it, the more we need reliable ways to check and support that work. Today I’m looking at safety disclosures, a hacking-tool follow-up, chipmaking plans, oversight rules, and the market’s response. My investment comments are personal observations, not recommendations to buy or sell.

Information cutoff: October 10, 2026, 8:30 a.m. Korea time. I am not repeating October 9’s coverage of Google ML Drift, Samsung’s preliminary results, the OpenAI revenue-accounting debate, or Fed and oil moves. The Korean bank attacks are a continuing story, so I include only new developments in the tool developer’s response and the investigation. The GitHub repository-infrastructure analysis in the supplied draft was published on October 6 and updated on October 7, so it falls outside the “new since October 9” window. GitHub’s original post and date

1. Safety results were public for 31 of 857 Chinese AI model releases

A study published by SemiAnalysis on October 8 reviewed 857 models released by nine major Chinese AI developers between 2021 and September 15, 2026. It found public safety-evaluation results tied to a specific model for 31 releases, or 3.6%. Only nine, or 1.1% of all releases, had results available at or before launch. The researchers found no result in the public materials they checked for 813 releases. SemiAnalysis study, Reuters report

That does not mean the other models were never tested. The study says it could not find public evidence; companies may have run private evaluations. It also covers Chinese developers, so it is not a direct comparison with U.S. companies. The useful distinction is between a claim that a model is safe and evidence outsiders can inspect.

If I were choosing a model for a product team, I would look for results tied to the exact model version, its tool permissions, and how it handles risky requests—not just a general statement that it was evaluated. An agent that can edit files or run code needs the same checks again when its model changes. In a market where benchmark scores are easy to find, version-specific safety records could become a meaningful signal of trust.

2. ARTEX AI developer ends public distribution and support

On October 9, the developer of ARTEX AI, a penetration-testing agent suspected of being used in attacks on South Korean financial firms, said the project would no longer be updated or supported and that no further public versions would be released. Reuters also confirmed that the developer’s GitHub repository was down. That does not establish that copied code or other means of access have disappeared. Reuters on the developer’s announcement

The investigation is also developing. Reuters said at least nine South Korean banks had disclosed attacks or were reported by local media as targets. CrowdStrike assessed that a China-based 26-year-old may have used ARTEX and Claude Code, but this is a cybersecurity firm’s assessment—not a confirmed identity or finding by law enforcement. In a separate data set cited by Reuters, TrendAI recorded 86 cyber incidents in Japan in September, about 18% more than in August. That describes incidents tracked by the company, not every attack in Japan. Reuters on cyber incidents in South Korea and Japan

What matters most to me is not whether AI invented a new kind of hacking. It can connect existing tools and repeat work quickly, lowering the time and expertise needed for an attack. Taking down a public repository may reduce official distribution, but it is not a complete defense. Exposed legacy services, missing authentication, and overly broad account permissions still need attention. I’ll keep suspicion and confirmed attribution separate and wait for updates from investigators and affected organizations.

3. SK hynix says it wants to accelerate its Gwangju chip project

On October 9, SK Group Chairman Chey Tae-won visited the proposed Gwangju semiconductor-cluster site and said the company wanted to move as quickly as possible to meet demand. He said the Yongin cluster’s overall completion target had already been brought forward from 2045 to 2033, but that Yongin alone might not provide enough capacity; SK could therefore build in Gwangju in parallel. The current plan is for a Gwangju site about two-thirds the size of Yongin, but no construction start date was given. SBS report from the site visit

Chey said the project schedule would have to be aligned with infrastructure such as water and electricity. The statement signals urgency, but it is not a groundbreaking date or a confirmed production schedule. A chip fab needs reliable power and water, equipment, workers, and a supporting packaging supply chain before it can turn into output.

I read this less as “HBM supply is about to surge” and more as a sign that Korea’s memory expansion plans are reaching further into the future and depend on basic infrastructure. Even strong AI-server demand does not turn a construction plan into near-term shipments. For investment decisions, I would not convert a headline investment amount directly into revenue or profit; I would watch for concrete milestones such as construction, equipment installation, and mass-production dates.

4. EU compromise would put only the largest cross-border crypto firms under direct ESMA supervision

On October 9, EU finance ministers agreed on the Council’s negotiating position for a package to deepen capital markets and change financial supervision. Rather than moving every crypto-asset service provider (CASP) under the European Securities and Markets Authority (ESMA), the Council position would initially put only the “most significant cross-border” providers under direct supervision. Much of the day-to-day oversight would remain with national regulators. EU Council announcement

This is a Council negotiating position, not final legislation; talks with the European Parliament still lie ahead. It is too early to say that crypto oversight in the EU has already been unified under one authority. Large cross-border firms may eventually face a simpler supervisory route, while others will still need to check national licensing and reporting rules for now.

For developers, that means it is more practical to keep compliance settings configurable by country and regulator than to hard-code one EU-wide rule. It is equally important not to treat a proposed rule as if it were already in force.

5. U.S. stocks rose, while the 10-year Treasury yield reached 5.24%

On October 9, the S&P 500 and Nasdaq each rose 0.6%, while the Dow gained 0.8%. The 10-year Treasury yield finished at 5.24% after moving around during the day. For the week, the S&P 500 was up 1.2% and the Nasdaq 0.6%. AP’s October 9 market close

Stocks can rise on a day when long-term yields rise too. One day of gains does not settle concerns about AI investment, and a high yield still matters for borrowing and data-center costs. The reverse is also true: a high yield alone does not guarantee every technology stock will fall. I would rather watch whether share prices and financing costs keep sending different signals than infer a new trend from one close.

6. Celsius founder settlement: the $35 million maximum is conditional

On October 9, the New York Attorney General’s Office announced a civil settlement with Alex Mashinsky. It permanently bars him from doing business in the securities, commodities, and cryptocurrency industries and provides for payments to New York of up to $35 million, depending on conditions. It would be misleading to say that he has simply paid a $35 million fine. Under the settlement, he owes New York $25 million if he fails to forfeit $10 million in ill-gotten gains to the federal government, and another $10 million if he does not serve his full federal prison sentence. New York Attorney General’s announcement and settlement terms

Mashinsky is serving a 12-year sentence in a separate federal criminal case, and the state settlement is distinct from that judgment. Celsius bankruptcy distributions are separate again; the Attorney General’s Office said more than $3.4 billion had been distributed to creditors by August 2026. I see this as an individual enforcement case about the gap between promises made to investors and the risks they actually bore—not as a market-wide change in crypto regulation.

My take today

Today’s stories show that wider AI use does not complete an industry by itself. Buyers need model-specific safety evidence; as attack automation becomes easier, basic security and accountable response matter more. A chip project needs power, water, and a real schedule before it becomes production. Crypto rules need to move from political agreement into final law and actual supervision.

I will keep watching evidence of execution rather than the size of announcements: whether safety results appear for each model version, whether construction schedules become concrete, whether the EU proposal becomes law, and whether companies can earn enough to carry their financing costs. A market rebound or an investment pledge is a starting point, not a conclusion.

This is a personal record for understanding markets and policy, not a recommendation to buy or sell any asset. Each reader is responsible for their own decisions.