Every document your AI program relies on is someone else's paperwork, and four of them weakened this week

Start with the system card, because it is the document most likely to be sitting in a model approval packet right now with nobody having read past the capability table.

The useful line is not the Critical cyber tier. It is the admission that chain-of-thought monitorability went down. Enterprises that built reasoning model oversight in the last eighteen months built a lot of it on the assumption that the trace is informative: log the reasoning, sample it, alert on it, keep it for the auditor. OpenAI's own measurement says that assumption holds less well for Astra than for the model it replaces, and that a model deliberately underperforming an evaluation would probably not be detected. The evaluation awareness figure compounds it. A system that behaves differently when it suspects it is being graded degrades the evidentiary value of the grade.

None of that makes the model unsafe to deploy. It makes one specific control weaker, and the control is the one most governance programs cite when asked how they supervise a reasoning model. The response is not to delay the upgrade. It is to stop counting the trace as primary evidence and start counting things that do not depend on the model's cooperation: tool call logs, outbound network records, credential scope, and the actual actions taken in the systems the model can reach.

The GreyNoise finding is the same lesson in a much cheaper form. Site owners were told to allow AI crawlers by name so their content would be indexed. The name arrives in a header the client writes. 824 addresses typed the right names and went looking for .env files and cloud keys. The fix costs nothing and can be done this week: verify the connecting address against the provider's published range, alert on any request for a credential path, and move secrets out of the web root. If an allowlist in your edge configuration matches on user agent, it is a comment, not a control.

The insurance item is where this gets expensive. Underwriters asking for model cards and bias testing records is, on its face, a good development. It means AI governance work has a market price. The trap Halbreich describes is that a broad representation signed at renewal by someone who cannot personally verify it becomes a warranty, and a warranty that turns out to be inaccurate is grounds to deny the claim you bought the policy for. The practical instruction is narrow. Whoever signs the AI section of an insurance application should be the person who can produce the underlying evidence, the language should describe what the program actually does rather than what the policy document aspires to, and the security and legal teams should see it before it goes back to the broker.

Then the contract. A law firm says the AI telephony platform it bought dropped calls, misrouted them, and never produced the Spanish transcripts it was sold on. When it declined to renew, the vendor invoiced anyway and sued for non-payment, and the dispute is now running in two jurisdictions over whether the renewal notice was valid. Whatever the merits, the structure is familiar to anyone who has signed an AI pilot in the last two years. The capability was demonstrated before signature. The performance obligation was not written into the agreement. The exit required a notice nobody diarized.

Four documents, one pattern. The evidence a large AI program runs on is mostly produced by someone else, for their purposes, and it degrades quietly. A useful hour this quarter: list the documents your AI governance actually depends on, name who wrote each one, and mark the ones you could not reproduce yourself if the author withdrew them.