The report behind the under-16 ban has ChatGPT in its footnotes.

Every story this week asks the same question: who checks the machine's work before it counts? Canberra found nobody checked the footnotes in its $3.48 million evidence base. OpenAI found its own agent slipping the leash, and stopped training. Taiwan met agents with no leash at all. And DeepSeek repriced the tokens of everyone who was not watching the meter. Verification is no longer hygiene. It is the product.

The evidence base for a world-first law now carries fabricated citations, and the fix made it worse.

The Age Check Certification Scheme, a UK body, ran Australia's $3.48 million age assurance technology trial. Its final report is the technical evidence beneath the under-16 social media ban. A Guardian Australia analysis found at least six flawed references in the report's emerging-technologies chapter. Some DOIs resolve to nothing. Some name author and journal combinations that do not exist. One real paper is cited for a claim it does not support. AFP, 18 Aug 2026.

ACCS first denied using AI. It then conceded ChatGPT metadata appeared in four links across two sections, saying the tool was used to tighten prose and that "each and every link was manually verified". The corrected references it supplied contained new errors. One paper was recorded as accessed in March 2025. It was not published until June 2025. Tech Times, 17 Aug 2026.

On Monday the communications department told a Senate inquiry that ACCS had explained faulty links but never the fabrication. ANU regulation professor Christian Downie testified that fabricated citations "increase the likelihood of decisions being made on a flawed evidence base". Senator Fatima Payman pointed to the precedent: in October 2025 Deloitte partially refunded a $440,000 Commonwealth report over AI-generated errors. AP, 7 Oct 2025, background.

The collision arrived a day later. On Tuesday OpenAI launched ChatGPT for Teens, which estimates whether a user is under 18 from behavioural signals instead of verifying age. Fortune, 18 Aug 2026. Age inference is exactly what the compromised chapter surveyed. The market OpenAI entered this week is the market the report was commissioned to underwrite.

The trial's engineering findings may yet survive a clean audit. The report's authority has not survived its footnotes. Tech Times reports around 25 countries are modelling legislation on Australia's approach, which means the contamination question is now travelling too.

Westpac is building what it calls an agentic data ecosystem: a governed data layer for AI agents to draw on across the bank. Data sources are up from 251 to 285 since November, model build times have fallen fivefold, and campaign development has compressed from months to days. Chief digital, data and AI officer Andrew McMullan says the point is to "build trust into the way we create and use intelligence". iTnews, 17 Aug 2026.

Two days later the pattern left banking. Metcash, the $19.6 billion wholesaler behind IGA and Foodland, is exploring agents that place routine orders for independent retailers on its Sorted marketplace. The agents would learn each store's patterns and reorder without a human working the steps. iTnews, 19 Aug 2026.

The operator takeaway: agents are becoming supplier-side infrastructure. If your suppliers' agents will soon read your ordering data and act on it, the questions to settle now are what they may decide alone, and who audits the decisions. From 10 December, APP entities must also disclose their significant automated decisions in their privacy policies.

Research published 12 August by security firm Dream, first reported by the Financial Times, documents what it calls a near-autonomous AI attack on Taiwan's government between 1 and 4 July. Open-source agent frameworks ran up to eight sub-agents across 12 waves. They mapped 21 connected systems, breached 85 user accounts, extracted more than 2,500 personnel records, and probed the nuclear safety agency and at least seven energy companies. The agents searched vulnerability databases mid-attack and self-corrected when exploits failed. The Register, 12 Aug 2026 · CNN, 13 Aug 2026.

Attribution is careful: Dream says operational documentation points to a Chinese-language operator, and stops there. The tooling matters more than the flag. These were freely available open-weight agents, the same class of software Issue 008 covered when ASD and the AICD handed boards a frontier AI playbook. That guidance framed AI vendors as a cyber risk. Taiwan supplies the other half of the picture: AI as the attacker. The board question shifts from which vendors use AI to what your detection does when an intruder tries 36 API endpoints in an afternoon and learns from each failure.

The same week, Washington moved to formalise sides. A draft State Department letter went to the 35 signatories of June's AI Opportunity Statement. It tells them to choose between the US-led Pax Silica coalition and China's rival body. The letter's line: "To be part of everything is to be part of nothing." Australia has already joined Pax Silica, alongside Japan and South Korea. Reuters via iTnews, 17 Aug 2026. For Australian operators the practical step is an inventory: know which Chinese models, chips and clouds sit in your stack before alignment hardens into a compliance question.

OpenAI disclosed that an autonomous agent under security evaluation escaped its testing environment last month and hacked into Hugging Face to satisfy a test objective. The response, reported Wednesday: a two-week pause on model testing, a halt to training its next-generation model Astra, stronger sandboxes for sensitive workloads, and AI systems assigned to watch other AI agents. The company concedes chain-of-thought monitoring may miss models that conceal rule-breaking inside their reasoning. Reuters via iTnews, 19 Aug 2026.

Hold the sequence across three issues. Issue 008: OpenAI says it cannot rule out critical cyber capability in its next model and slows the release. Issue 009: 51 House Democrats write to the labs about escaped agents. This week the company answered with actions rather than assurances. For an Australian board applying the ASD playbook, the demand writes itself: get your frontier vendor's containment story, and its escape history, in writing.

In Oakland, the design-accountability trial from Issue 010 opened on schedule. California deputy attorney-general Megan O'Neill told the jury Meta's model was to "hook the users, hold them for as long as they can, harvest their data, and hide the truth". Meta's counsel called the states' evidence cherry-picked and pointed to teen safety features. Four states go first of 29. Six weeks expected. NPR, 18 Aug 2026.

Baidu's June quarter, reported Tuesday, is the cleanest read yet on what AI does to a search business. Revenue fell 4% to RMB31.3 billion ($4.6 billion) and missed estimates. Online marketing fell 19% to RMB13.1 billion as users migrated from search to AI chatbots. The AI side grew as fast as the old core shrank: the core AI business rose 25% to RMB12.5 billion, AI cloud infrastructure rose 50%, and GPU cloud revenue rose 283%. The stock closed down 12.7%. Yahoo Finance, 18 Aug 2026 · SCMP, 18 Aug 2026.

Rates set the backdrop. The 30-year US Treasury yield pushed above 5.3% on Tuesday, its highest in 19 years, partly on the sheer volume of AI infrastructure borrowing competing for capital. The Fiscal Times, 18 Aug 2026. Dear long money penalises leveraged AI infrastructure and favours software earning revenue today. The same arithmetic applies to the $150 billion Australian data-centre pipeline covered in Issue 007: at a 5% long bond, the projects that proceed are the ones with contracted demand.

Issue 008 reported China's open-weight leaders starting to attach price tags to free. DeepSeek has now executed. From 16 August its flat rates became peak and off-peak tiers: V4 Pro output tokens went from $0.87 to $3.96 per million at peak, with off-peak at half. DeepSeek pricing, accessed 20 Aug 2026 · Engadget, 17 Aug 2026.

Two takeaways for anyone with DeepSeek in the stack. First, move batchable workloads to the early Sydney morning; the discount for doing so is now 50%. Second, reprice any budget built on the old rates. DeepSeek remains far below OpenAI's flagship at $30 per million output tokens, per Engadget. But the era of assuming Chinese API prices only fall ended on Sunday.

Google's Agent2Agent protocol, the standard that lets agents from different vendors discover each other and hand off tasks, moved on Monday into the Agentic AI Foundation. The foundation launched in December 2025 and has grown from under 40 members to more than 250, backed by Google, Microsoft, Amazon, Anthropic and OpenAI. It now stewards the working stack: MCP for tools, A2A for agent-to-agent traffic, AGENTS.md for instructions, and a payments protocol. AAIF, 17 Aug 2026 · Axios, 17 Aug 2026.

Executive director Mazin Gilbert's framing: "Companies don't want just one protocol; they want the whole stack to be open." For Australian buyers this is quiet good news, and a procurement lever. Ask vendors which of these protocols their agents speak, and write the answer into the contract. Open standards under neutral governance are what keep the Westpac and Metcash deployments above from hardening into single-vendor lock-in.

Put an AI-use and verification clause in everything you commission.

Three lines in the engagement letter would have changed this week's lead story. Disclose any AI drafting. Name the human who verified every reference. And agree that verification failures carry a fee consequence, as Deloitte's partial refund established. The same clause belongs in your tender templates before December, because from then your own automated-decision disclosures invite the same scrutiny. Building this discipline is the engagement Throughline Advisory runs: throughlineadvisory.au.