OpenAI's "Reverse Federalism": Building AI Regulation from State Law Up to Federal Law

On July 15, OpenAI published an article rounding up state and federal developments on AI safety in the United States. The company introduces an approach it calls "reverse federalism": rather than enacting federal law first, the idea is to build a nationwide AI governance framework by stacking up state-level laws.

With comprehensive federal AI legislation looking unlikely anytime soon, treating state-level regulations as testing grounds and rolling out successful cases nationwide may look like a detour, but it's arguably a practical approach. That said, rules that differ from state to state will increase the compliance burden on companies. How to design coordination between state and federal law looks set to be the key to this vision.

Microsoft Patches a Record 570 Vulnerabilities in Its Monthly Update — A Win for AI

Microsoft's monthly security update (Patch Tuesday) shipped fixes for 570 security vulnerabilities — an all-time high for the company. What's noteworthy is that AI played a role behind this record-breaking number of discoveries.

By systematically building AI into vulnerability detection, a large number of bugs that would previously have slipped through were uncovered. AI in security is often discussed as an attacker's tool, but this shows it is also extremely effective on the defensive side. That said, human judgment continues to play a critical role in prioritizing fixes for the discovered vulnerabilities and weeding out false positives.

Spotify Expands AI Voice Chat for Premium Plans

Spotify is rolling out an AI-based voice and text interface inside its app for Premium subscribers. Users can control music playback by speaking or typing.

This signals that AI in music streaming is shifting from the era when recommendation algorithms took center stage to one of conversational interfaces. Speaking and getting a voice response is already commonplace in the smart speaker context, but the distinguishing feature of Spotify's approach is that everything happens within the mobile app. Whether voice UI becomes a new gateway to music discovery or remains a niche feature for a subset of users is a question that awaits future usage data.

Whatnot Acquires AI Recommendation Startup Shaped

Whatnot, a live shopping platform, has acquired Shaped, a machine learning startup specializing in real-time recommendations and search. With the acquisition, Whatnot says it will strengthen its personalization and discovery capabilities and accelerate its expansion into new product categories.

In live commerce, recommendation accuracy directly affects viewer retention and purchase conversion. The ability to capture user interests in real time and surface the right products is especially critical in the time-constrained format of live streams. The race to acquire AI recommendation technology is also intensifying across e-commerce as a whole.

RL Post-Training Completed on 14 Consumer Macs Across 4 Countries

Pluralis Research has announced that it completed reinforcement learning (RL) post-training using 14 Macs distributed across 4 countries. The code has been released as open source.

The setup is intriguing. Each Mac performs inference (rollout generation) using MLX with int8 quantization, while a single B200 on another continent handles gradient updates at bf16 precision. Cloudflare R2 is used for synchronization, and each Mac was connected over an ordinary home internet connection. No data center interconnect was required.

The key point is that in agentic RL, rollout generation accounts for roughly 80% of total compute. If this portion can be distributed across consumer hardware, the barrier to entry for RL training drops dramatically. The technical crux, however, is how to absorb the "staleness" of weights and the quantization gap that arises between int8 inference on the Macs and bf16 training on the B200 — the paper explains those techniques in detail.

In the context of open source AI, this is a significant experiment, showing that organizations without data centers can still do RL training.

---