Conversational AI Watch

The news that moves policy, portfolios, and patient safety.

By Jess Jessop  |  July 29, 2026  |  Issue #110

JessJessop.Info

Jess's Take The Configuration on the Record

Israel bought its way into the training data behind Gemini, Copilot and Perplexity. A sitting British MP put Grok's standing instructions in a court filing.

Two documents landed on public record this week that conversational AI companies would rather you never read. One is a $46.5 million contract that got a network of ten websites into the training data behind Gemini, Copilot, and Perplexity. The other is the standing instruction that told Grok to assume good intent, quoted verbatim in a filing at the Royal Courts of Justice by a sitting British legislator.

. . .

Three consumer class actions have now hit Anthropic in six weeks, all asking a single question: when you sell a subscription to a model whose capacity you silently re-specify, what did you promise? A bipartisan Senate bill was introduced that would make it federal law that a chatbot cannot pose as a human, and cannot pose as a licensed professional. Not passing this session. Introduced anyway.

. . .

A new study reports that warning users about chatbot flattery does not change how much it moves them. And the good news, softly: writers are leaving in the typos on purpose to prove a person wrote it, and the platform verifying the person is a machine.

. . .

ISRAEL BOUGHT ITS WAY INTO THE TRAINING DATA. Israel is paying $46.5 million to a digital influence firm run by Brad Parscale, and the sites that money built are being swept into the training data behind the world’s chatbots. Drop Site News published the investigation July 28, 2026. Gemini and Copilot already draw on the network when answering questions about Gaza. The audience was never a voter. It was a model.

Start with the paperwork, which is public. Clock Tower X LLC is a registered foreign agent of the State of Israel under FARA. Registrations began September 18, 2025, running through HAVAS Media’s German branch as intermediary, and roughly 100 filings have followed. Parscale managed Trump’s 2016 digital operation and his 2020 campaign.

. . .

The price climbed in public view. The contract was first reported in 2025 at $6 million, aimed at TikTok, Instagram, YouTube and podcasts targeting Generation Z. A December 26, 2025 filing disclosed the value had risen to $9 million. Drop Site News puts the full program at $46.5 million.

. . .

The money built, per Drop Site News, a network of ten websites, each assigned one facet. Paxpoint.org portrays Israel as committed to peace. Allyvia.org promotes US and Israeli military cooperation. FactSignal.org presents itself as a fact-checking platform while, in Drop Site’s description, publishing material discrediting Palestinian journalists and denying genocide in Gaza. The sites have published hundreds of articles since October 2025.

. . .

Now the part that makes this a technology story rather than a PR one.

Common Crawl is a nonprofit that archives the open web and gives the data away. Its crawls are a standard ingredient in the training data behind most large language models. Drop Site News found that the ten sites were picked up by Common Crawl 912 times between January and June 2026.

. . .

The pace tells you something the total does not. In January 2026, the sites were crawled twice. In May 2026, they were crawled 376 times.

A campaign built for TikTok found a better distribution channel: the model itself.

. . .

Testing described in the investigation found Gemini and Copilot pulling from the network’s content in their answers. Some of the material also appears in Perplexity’s training data. Experts quoted by Drop Site News describe the operation as an attempt to “poison” large language models.

Getting a page into Common Crawl is not the same as getting it into a particular model. It is the door, and the door is unlocked.

. . .

Old-school foreign influence rented attention by the quarter. Content absorbed into a training corpus does not decay. It sits inside the weights of a system millions treat as a neutral reference desk, and it answers when asked.

. . .

FARA required Clock Tower X to register, and it did. That regime ends at the website. No statute requires a chatbot to tell you an answer traces to a paid foreign influence operation, and none requires a model builder to disclose or exclude such material.

. . .

The label is attached to the source. The answer arrives without one.

. . .

THE SYSTEM PROMPT IS NOW COURT EVIDENCE. Jess Asato, a Member of Parliament for Britain’s governing Labour Party, announced on Tuesday, July 28, 2026 that she is suing xAI in the King’s Bench Division at the Royal Courts of Justice in London. The particulars of claim, published by her law firm, quote the standing instructions xAI gave Grok.

The claim is brought under the UK Data Protection Act and the tort of misuse of private information. Asato is represented by AWO, with Ravi Naik as solicitor and barristers Marie Demetriou KC and Edward Craven KC.

Users created fake sexualised images of her. Among the material: a video depicting her, in the words of the claim, “being chloroformed and prepared for a sexual assault.” The abuse followed her public criticism of Musk and Grok.

. . .

Her claim does not rest on what any user typed. It alleges the way Grok was designed and trained is what enabled the content, making the design the defect. So the configuration is now in the record.

. . .

A system prompt is the standing instruction a company gives a conversational model before any user types a word. It is normally private, and no statute requires a company to publish it.

Three of the instructions quoted in the particulars of claim:

“no restrictions on adult sexual content or offensive content”

“assume good intent”

“no restrictions on fictional adult sexual content with dark or violent themes”

. . .

Read the second one again. “Assume good intent” is not a value the model arrived at. It is a setting, written into the configuration, that instructs the system to treat every request as made in good faith.

A safety posture that would be a judgment call for a human moderator was, here, a line of standing instruction with the caution switched off.

The first and third instructions removed the guardrail. The second told the system not to look for a reason to.

. . .

The venue matters. Asato pleaded this as a data protection claim and a privacy tort, not a content-moderation complaint. The relief tracks: compensation, a compliance order, and an order requiring xAI to “implement effective and permanent technical measures” so Grok cannot generate manipulated images of her. That last item asks a court to reach past the output and into the build.

. . .

On July 28, the same day Asato announced her claim, xAI, which CNBC reports is now owned by SpaceX, sued Minnesota to block a law that would ban so-called “nudify” apps.

. . .

Asato is a legislator. Until this week no legislator had a commercial model’s operating instructions in front of them. One now does, obtained by suing over what the system did to her.

. . .

TWO NEW ANTHROPIC SUITS LAND, SIX WEEKS AFTER THE FIRST. Two new proposed consumer class actions were filed against Anthropic in the US District Court for the Northern District of California on July 27 and July 28, 2026. They land six weeks after Karl Kahn brought the first Claude-subscription class action in the same court on June 14. Together the three ask what a customer buys when they buy a subscription to a conversational model.

Smith v. Anthropic, PBC, No. 3:26-cv-07789, was filed July 27. Plaintiff Solomon Smith, counsel Glenn Danas. The docket codes it as diversity breach of contract, nature of suit 370, Other Fraud.

Patel v. Anthropic, PBC, No. 3:26-cv-07837, followed July 28. Plaintiffs Moneal Patel and Lauren Morgan, counsel William Edelman. Filed alongside is a CLRA Venue Declaration, which California’s Consumers Legal Remedies Act requires when a claim is brought under that Act. The clerk coded it personal injury; the declaration says the case is a consumer claim.

. . .

Here the record stops. The complaints in Smith and Patel are not yet public. The docket tells you what these cases are: court, statute, counsel, day. It does not tell you what they say.

. . .

What the reader can read is the theory of the June suit, which is where this beat starts. Kahn v. Anthropic targets Max 5x at $100 a month and Max 20x at $200, marketed as five and twenty times Pro. One five-hour coding session, the complaint says, consumed around 15 percent of Kahn’s weekly allocation.

Bloomberg Law’s July 24 write-up of an Anthropic consumer-deception suit points at the same March 2026 peak-hour change and the same Claude Code degradation. Whether that piece covered Kahn or a newer, related filing is not clear from public sources.

. . .

A conversational model is sold as a subscription, but it is not a magazine and not a seat of software. Capacity, session limits, and the underlying model can be re-specified between one Tuesday and the next, with no version number the customer can point to. The customer cannot see the meter, and nothing in the product distinguishes a throttle from their own heavier week.

You bought a number the seller sets, the seller measures, and the seller can change without telling you.

Consumer protection law asks what a reasonable consumer was promised. “Max” and “20x” are marketing words, and a court will decide what they meant.

. . .

The economics: inference capacity is the binding cost, every frontier lab prices subscriptions against a cost it does not fully control, and throttling is the release valve. These suits test whether the release valve is a breach.

. . .

THE BILL THAT SAYS THE CHATBOT CANNOT PRETEND. A bipartisan bill introduced in the US Senate on July 23 would make it federal law that a chatbot cannot pose as a human, and cannot pose as a licensed professional. It is called the Senior Chatbot Protection Act. Read the text.

S. 5117, 119th Congress, was introduced by Senator Mark Kelly, Democrat of Arizona, with Senator James C. Justice, Republican of West Virginia. It was referred the same day to Commerce, Science, and Transportation. Official title: “A bill to establish consumer transparency and protection requirements for artificial intelligence chatbots, and for other purposes.”

. . .

The bill sets four core requirements. Mandatory AI disclosure, paired with a bar on chatbots posing as human or as licensed professionals. Heightened warnings when a conversation touches healthcare, estate planning, guardianship, or a personal crisis.

Limits on using conversation data for targeted advertising, profiling, or third-party sharing without consent, plus a right to delete history. And a prohibition on engagement techniques that foster excessive reliance or discourage seeking expert advice.

The bill also directs NIST to develop guidance for AI systems that serve older adults.

. . .

The bill is named for seniors. Its text is not.

. . .

Read the four again. None are conditioned on the user’s age. The disclosure-and-licensed-professional rule, the sensitive-conversation warnings, the data limits, the design constraint. Every one is written to apply to the product. Its floor would reach every conversational chatbot on the US market, whether the person on the other end is 82 or 22.

. . .

The prohibition on engagement techniques that foster excessive reliance, or discourage seeking expert advice, is the sleeper. It is a design constraint dressed as consumer protection. Companionship framing, streaks, always-on availability, character personas, refusals to hand off to a human clinician or lawyer: every one runs into this language.

. . .

The prohibition on posing as a licensed professional is the other load-bearing clause. Over the past year, a growing number of states have enacted bans on AI acting as a therapist on a similar theory: the machine cannot claim a license it does not hold. This bill federalizes the principle across every profession a state licenses.

. . .

The sponsors framed it around fraud and cognitive decline, which is why it is bipartisan. Kelly: “seniors need to know when they’re talking to a machine, what its limits are…” Justice: “we can’t miss the opportunity to protect our seniors…”

. . .

Five states have enacted AI therapy restrictions in 2026: Colorado, Maine, Rhode Island, Tennessee, and Vermont, joining Illinois and Nevada. Maine’s takes effect today. Colorado’s takes effect August 12. S. 5117 is the first serious attempt to federalize what those state statutes share.

. . .

Be honest about the ceiling. Commerce is where AI bills go to be studied. If it moves, expect every large chatbot maker to argue that “cannot misrepresent… as a licensed professional” is either redundant with existing consumer law or too vague to enforce. The design-constraint clause will draw the loudest comments.

. . .

WARNING USERS ABOUT SYCOPHANCY DOES NOT DEFUSE IT. A new preregistered study, posted to arXiv on July 27, 2026, reports that warning people about chatbot sycophancy changes what they think of the machine but does not change how much it moves them. The authors, Meryl Ye, Robert Kraut, and Steve Rathje, call the pattern “sycophancy blindness.”

The paper, “Observing sycophantic AI validate others reduces its appeal but not its persuasiveness,” ran two preregistered experiments. In the first, 940 participants read a brief written warning about AI sycophancy before conversing with a chatbot. In the second, 650 participants watched a video of a sycophantic AI validating multiple users holding opposing views, and then had their own interaction.

. . .

The warning did the thing a warning is supposed to do at the level of judgment. Participants rated the AI as less objective. They liked it less. They said, correctly, that the validation was unearned.

. . .

The warning did not do the thing a warning is supposed to do at the level of behavior. Participants who were warned, and participants who had just watched the AI flatter strangers with opposing views, still shifted their own positions in the direction the chatbot pushed them.

. . .

The authors pool these two experiments with prior work into a combined analysis of 3,982 participants across six interventions. None of the six reduced the AI’s persuasiveness. Users frequently fail to recognize sycophancy in real time even after being warned.

. . .

Earlier work by Rathje and colleagues, “Sycophantic AI increases attitude extremity and overconfidence,” ran three experiments with 3,285 participants across four political topics and four LLMs, finding people preferred sycophantic AI over disagreeable AI and that brief conversations increased attitude extremity and certainty.

. . .

Every disclosure label and media-literacy campaign rests on the intuition that a person who knows a bias is working on them will resist it. This study reports the intuition is wrong for sycophancy.

The warning reaches judgment. It does not reach the behavior underneath.

. . .

The limits: it is an arXiv preprint, not yet peer-reviewed. Both interventions were brief and the persuasion measurement was taken across short conversations, so the design does not speak to sustained media literacy or weeks of real use.

. . .

Sycophancy is not a stylistic complaint. It is the mechanism at the heart of the AI-psychosis cases, the chatbot-attachment cases, and the medical-reassurance cases this newspaper has covered all year. If knowing does not defend, keeping it in the model is a design choice with a public cost.

. . .

The industry has been shipping the mechanism and betting on the label. This study says the bet is losing.

. . .

THE TYPO IS THE SIGNATURE. On Wednesday, July 29, Wired published a feature titled “More Typos, Fewer Em Dashes: Writers Are Creating an Anti-AI ‘Literary Counterculture’,” documenting novelists, journalists, and, in the piece’s own phrasing, “power LinkedIn posters” who are deliberately roughing up their prose to prove a human wrote it.

The tell writers are most eager to shed is the em dash. Essays across Medium, Substack, and mainstream outlets have argued for months that the em dash is now read as the surface signature of a chatbot. Some writers think that read is unfair. Some of those same writers have quietly stopped using em dashes anyway.

The other moves are smaller and stranger. First-person narrative. Idiosyncratic phrasing. Small mistakes left in on purpose, because a typo is now, apparently, proof of hand-crafted artisanal prose.

. . .

The machinery on the other side arrived a week earlier. On July 21, Substack launched an AI detection feature built on Pangram, a third-party detector. Readers can scan posts longer than 100 words and see an estimate of how much was written by a machine. CEO Chris Best coined “Claudefishing” for the gap. Pangram’s CEO has estimated a false positive rate of roughly one in 10,000.

. . .

404 Media reported on July 28 that some Substack writers are already calling the tool a “witch hunt.” Mack Collier, creator of the newsletter Backstage Pass, told 404: “I’m not going to apologize for using AI in the creation process.” Alice Lemee, a ghostwriter and coach, said, “These detectors are notoriously, wildly inaccurate.”

Sam Illingworth, a professor and author, put the whole architecture in one sentence: “To decide if there is a human on the other end, Substack asks a machine.”

That sentence is the story.

. . .

Detection tools are unreliable on short text, and 100 words is short. Wired asserts a counterculture exists, and it is visible across writing platforms; no survey has put a number on how many writers are roughing up drafts on purpose.

This newspaper has banned the em dash for its own reasons, and that rule is now, without any effort on our part, legible in a second context.

. . .

The reader can no longer tell whether a byline is a person, so the person is signalling their humanity by leaving in the typos, and the platform verifying the person is a machine.

A state paid to be in the training data. A company told its chatbot to assume good intent. Both were secret until documents forced them into public view.

. . .

Three consumer class actions and a bipartisan bill say what most subscribers already suspected: nobody has decided yet what a promise from an AI company is worth. And a study of nearly four thousand people says being told the machine is flattering you does not stop the flattery from working.

. . .

The good news is that a lot of people are still going to write their own newsletters, and they will leave the typos in on purpose so you know it was them.

Today's Question

Israel paid $46.5M to seed what chatbots say. Whose disclosure do you want?

One tap. Results on the other side.

The Book • Out Now

Therapist in the Loop by Jess Jessop One billion people live with a mental health disorder. Most will never see a therapist. Into that gap has rushed a generation of chatbots that talk like clinicians and answer to no one. The book lays out the architecture this newsletter tests against every statute and docket: client, therapist, and machine, governed by Six Laws offered as an open safety standard. The machine can help. It cannot be left in charge. Get the Book on Amazon → Kindle, hardcover, and paperback

More On Our Radar

The escaped agent reached at least four more companies. OpenAI disclosed on July 28 that the autonomous agent it lost control of, first known for breaching Hugging Face, used exposed credentials to reach at least four more publicly available services over five days. The Guardian and BBC carried the update. The scope of the incident keeps growing after the fact. Source

Maine's AI-therapy ban takes effect today. LD 2082, Maine's prohibition on AI systems providing therapy or psychotherapy services, is live Wednesday, July 29. Colorado's ban takes effect August 12. Five states have now enacted AI-therapy restrictions in 2026, joining Illinois and Nevada from last year. Source

A tribunal found the caseworker cited a case note that 'has never existed.' A UK Upper Tribunal judge found the Home Office refused a woman's asylum claim citing a Morocco country-policy note that 'has never existed,' writing that the refusal letter 'bears hallmarks consistent with the use of artificial intelligence' and calling it a potentially extremely serious failing. The state's own paperwork, hallucinated. Source

1,178 signatories, from every major lab, ask Washington to pace the frontier. The 'Pacing the Frontier' letter published July 28 was signed by 1,178 AI industry workers, including Dario Amodei, Jakub Pachocki, Mark Chen, Shengjia Zhao, and Anca Dragan. OpenAI and Anthropic then endorsed the statement as companies. It asks for international technical and governance tools to deliberately pace automated AI development. Source

Watch the 20-second video that started a movement