Back to news
Sunday report

Sunday Signal Report: October 11, 2026

Fairfax County did not write a new AI rule this week. It wrote code, because its search vendor gave it no way to turn AI answers off on student Chromebooks. Across the week, the hard part of school AI policy was not the vote. It was the off switch, the retention log and the breach notice.

Rob here

The off switch is the policy

On Oct. 8, 2026, Matthew Berman posted "Reverse Engineer Anything" and "Software is done" in the post. It links to REA, a public repo that says it can use AI agents to reverse engineer software "from app behavior down to native binaries," which in plain words means pulling apart software other people built and own. When I checked on Oct. 11 the repo had about 95,000 stars, and Neil Wood replied that it was a "Napster moment, piracy in the wild." For a district, this doesn't belong on a school laptop or a student account, because reconstructing commercial software is an IP problem and a device-policy problem.

Fairfax County did not write a new AI rule this week. It wrote code, because its search vendor gave it no way to turn AI answers off on student Chromebooks. Across the week, the hard part of school AI policy was not the vote. It was the off switch, the retention log and the breach notice.

AI governance

Boards are voting. The work starts after the vote.

What changed: Civic IQ counted 755 AI items in K-12 board meetings across 46 states between Sept. 9 and Oct. 8. 432 were AI policies being discussed, read, adopted or revised, and 66 were adopted. Of the 56 items that said whether students may use AI, 47 allowed it with limits, 7 allowed it outright and 2 prohibited it. Privacy was named in 122 of the 169 items that raised a concern, and 63 items cited the same model policy number. One of the rare prohibitions came on Oct. 7, when the Frederick County, Md., board voted 6-1 to ban student AI use from pre-K through grade 12, weeks after starting a Gemini pilot for middle and high school. The policy keeps exceptions for lessons about AI and for students with disabilities, and FOX 5 reports district leaders are still working out how the ban will be enforced and how the exceptions will operate. In Orlando, Orange County staff walked their board through Florida's new rule, which takes effect July 1, 2027: parents must opt students in to each AI instructional tool, students who are not opted in get a comparable non-AI alternative, tools for pre-K to grade 5 get extra review, staff training must be documented, and districts must keep at least 30 days of student interactions with AI tools so parents can request them. Staff are still asking vendors how to retain that data and what it will cost. Why it matters now: the record says the typical board is allowing AI with limits and borrowing the language to do it. Florida shows what a limit costs once it is written into rule: a consent record for every tool, a split classroom when half the families opt out, and a storage contract. Frederick shows the other path still needs plumbing, because a ban with exceptions is an approval process too. Rob's take: model policy is a fine starting point. It is also how dozens of boards end up with the same sentences and none of the systems behind them. Every limit in an AI policy is a system somebody has to build and run. If nobody can name who builds it, the limit is a wish. Concrete implication for a district leader: before the next AI policy reading, attach a one-page implementation map. For each limit, list the system that enforces it, the owner, the vendor dependency and a cost estimate.

Screens and devices

The school Chromebook is now where AI policy lives

What changed: Fairfax County, Virginia's largest district, already blocks ChatGPT, Claude and Gemini through its filters. It could not turn off Google's AI Overviews, because, in the district's words, Google's admin controls do not provide a path to disable them. So its IT department built a Chrome extension, the FCPS Customizer, that hides AI Overviews, search summaries and some image search features on school-issued Chromebooks. It is piloting in 11 elementary and middle schools and is expected to reach all of them by November. The same week, Google kept adding AI to those devices. A Classroom connected app in Gemini lets teachers ask about assignments, student performance and past grades, and Gemini study tools are expanding to younger students. Google's own transition guide also sets the calendar for Gems, the custom assistants many teachers have built: skills arrive for education accounts Oct. 13, the Gems entry point moves into settings for education users Nov. 17, and education Gems migrate automatically and stop working on June 1, 2027 or later. On phones, no state law change or measured learning outcome cleared the bar this week. Why it matters now: restriction and instruction now run on the same device, and the vendor's admin console decides which choices a district can actually make. When the switch does not exist, a district accepts the default or writes software. Rob's take: Fairfax showed real institutional courage, and it came with a maintenance bill. A homegrown extension is now a product the district owns through every Chrome update. That is a fine way to put pressure on a vendor and a poor permanent architecture. Hiding AI summaries is also a restriction decision. It does not tell anyone whether students research better, so measure that separately before calling it a win. Concrete implication for a district leader: list every AI feature on school-issued devices and note whether the admin console can turn it off by grade or organizational unit. Every no becomes a written request to the vendor and a line item at renewal.

Frontier and open-weight AI

The free tier is where students meet the frontier

What changed: OpenAI moved GPT-6 to every ChatGPT plan on Oct. 7, with GPT-6 Luna reaching the Free and Go tiers, and added Intelligent UI, which builds answers out of charts, buttons, forms and small tools. Its October system card rates both models High capability in cybersecurity and in biological and chemical risk. Compared with the August GPT-5.6 models, it also reports statistically significant regressions on its under-18 evaluations for age-restricted content, sexual content and emotional reliance, plus gore for Luna. OpenAI says an extra classifier block, not captured in those results, filters self-harm, sexual content and gore. It also says the emotional reliance test overreacts to nicknames like bestie. On Oct. 5 OpenAI described its text watermark: invisible marks on ChatGPT and Codex text in the European Union over the coming weeks, an opt-in for API customers that is off by default, and a detector open only to approved researchers. Anthropic released Claude Haiku 5.5 on Oct. 7, priced 90% below Haiku 4.5 for requests up to 100,000 tokens, and halved cache-read prices for Sonnet 5.5. On the open side, Mistral opened a preview API for Mistral Large 4, a 1 trillion parameter model with 52 billion active, and promised the weights by the end of the month. That is a promise, not a release. Google did ship EmbeddingGemma 2 weights under Apache 2.0. Every benchmark here is the vendor's own. Why it matters now: most students will meet these models on the free tier, on personal phones, outside every district control, and the vendor's own card says the new free model did worse on its teen safety tests. Separately, a watermark detector will get pitched to schools as a cheating detector. It is not one, and OpenAI says so: swapping a tenth of the words for synonyms cuts detection from about 92% to about 66%. Rob's take: read the system card, not the launch video. The most useful line this week was a regression table OpenAI chose to publish, and it deserves credit for that. But a safeguard the vendor did not measure is not evidence yet. Track Mistral's weights when they land, not its benchmark chart. Concrete implication for a district leader: add two lines to AI guidance now. Watermark detection is not an academic integrity tool. And when a vendor changes the model behind a student-facing tool, the district expects notice and the new system card before the change reaches students.

Agentic AI checkpoint

Approval gates turned into product features

What changed: GitHub put computer use for Copilot into public preview on Oct. 1. Copilot can click, type and move through desktop apps that have no API, it asks for approval before controlling an app, users can review or reset the apps they chose to always allow, and organization settings can turn the feature off. On Oct. 2, Apple told developers it will add controls so that Full Disk Access, which largely sidesteps macOS privacy protections, can only be granted with very explicit user action. Its stated reason: as AI agents become more capable and autonomous, the risks of that access will grow substantially. No date yet. Anthropic's usage policy update, effective Nov. 12, adds controls for when Claude autonomously takes physical actions. Release status, from canonical GitHub releases: OpenClaw stable 2026.10.1 shipped Oct. 10. Agents can search installed skills within their current read permission, and reading a skill grants no permission to install or run it. Opt-in MCP Apps show approval controls inside the app pane, and full backups can live on external storage or Cloudflare R2 and restore into a fresh staging directory before activation. Stable 2026.9.9 on Oct. 8 improved recovery after failed updates. The 2026.10.5-beta.1 tag published today is a prerelease. Hermes Agent stable v0.21.6 shipped Oct. 8 as a patch release that rolls up about 2,100 merged pull requests for Docker and Hermes Cloud. It fixes four dashboard sign-in flaws reported by Tenable Research, including one that allowed session takeover, and hardens automatic git calls. Curated notes wait for v0.22.0. Nous Research also announced a $90 million raise and business plans for Hermes, which is an announcement, not a release. Why it matters now: the control surface for agents is settling into recognizable parts: approve each app, keep an always-allow list, give admins a switch, and make the operating system ask first. A district can write those into policy and check them. Rob's take: always allow is where good governance falls asleep. An approval prompt is only a control if somebody reviews what got approved. Restoring into a staging directory is what recovery should look like, and security patches are a reason to update, not a reason to expand what an agent may do. Concrete implication for a district leader: for any agent pilot, require three things in writing: an admin-level off switch, an always-allow list with a named reviewer and a review date, and a restore test before go-live.

Cybersecurity and recovery

Seven weeks is too long for a family to find out

What changed: Frontline Education's breach came through a vulnerability in third-party software. South Carolina's Department of Education says the intrusion was detected Aug. 14, and notices to districts and employees began Oct. 1. Frontline's incident page says it is notifying affected individuals in cooperation with districts and that TransUnion data files for individuals are delayed. BleepingComputer reported exposed Social Security numbers, emails and home addresses, one district notice covering 1,210 employees, and an Oct. 16 deadline for districts that want to handle notification themselves, which gives up the vendor's notification services and cost reimbursement. In South Carolina, WYFF reports the affected modules include a health services product holding student medical and billing records, and one district says it still has not received a list of which students were affected. In Massachusetts, Springfield said its September attack exposed Social Security numbers of staff hired before 2008. And CISA added five flaws used by the China-linked group Flax Typhoon to its exploited list, with a federal deadline of Oct. 11. They sit in ProFTPD, BIND, Apache Struts, ONLYOFFICE and Strapi, and some date to 2015. Why it matters now: the vendor's clock and the family's clock are different clocks. And the exposure this week sat in old places: HR records nobody had reason to open, and server software nobody remembered owning. Rob's take: the breach is the vendor's, but the letter carries the district's name. Notice deadlines belong in the contract in days, along with a duty to tell the district which students and which fields were touched. Old data is all risk and no benefit. Concrete implication for a district leader: pull your HR and student health vendor contracts this week and check whether they set a breach notice deadline in days and require a per-student list of affected records. Then ask records staff what the retention schedule says about personnel files from before 2008.