An employee at a Beijing insurance company uploaded an internal audit spreadsheet to a third-party AI tool for analysis; the company fired her over data leak risks, but the trial court ruled against the employer and ordered her reinstated. Anthropic’s red team bought 15 off-brand Android TV boxes ($55 each) and split a 26B model across them to run inference without using a single datacenter GPU. Meanwhile, AI companion platform Character.ai—with over 100 million historical users and a fivefold increase in ad revenue over the past year—filed for bankruptcy protection; Disney put up a $20 million stalking-horse bid for its engineering code and patents, while leaving behind the mobile app, the brand, and all user chat logs.
An employee sent an internal company spreadsheet to a third-party AI tool and was fired on grounds of data leakage risk, yet the court ruled against the company. This ruling does not mean the judiciary is encouraging unvarnished AI use at work; rather, it places a higher standard on employers: either set clear rules in advance, or bear the burden of proof afterward.
According to an official court release, Beijing’s Chaoyang District People’s Court disclosed the case in mid-October: Ms. Wu, an in-house legal staffer responsible for compliance audits and risk reviews at a Beijing insurance company, uploaded a processed spreadsheet of audit issues to a third-party AI platform in July 2024—following a manager’s recommendation—to generate slide decks and run data analysis. One month later, the company unilaterally terminated her employment contract for a serious violation of company policy. The trial court found the dismissal unlawful, revoked the termination notice, ordered the company to continue performing the employment contract, and awarded back pay for her year-end bonus shortfall, performance pay, and lost wages. The judgment has taken effect. Neither the full text of the ruling nor the case number has been made public; all details come from the court’s official release.
The company argued that as legal counsel, Ms. Wu had signed a non-disclosure agreement, completed information security training, and owed a heightened duty of confidentiality—and that because third-party AI platforms retain user data for model iteration, uploading the file inherently created a leak risk. Under the legal framework that places the burden of proof on the employer, however, the company failed to establish any of the three elements required for a lawful dismissal: first, there was no subjective intent—the company’s own handbook made intentional misconduct a prerequisite for a violation, whereas the employee was handling her regular duties at a manager’s recommendation, and the company could not prove malicious theft or disclosure; second, there was no explicit prohibition—while the company had general confidentiality rules, it had never banned third-party AI tools or provided specific policies or training, leaving it no grounds to penalize an employee after the fact without drawing a line beforehand; third, there was no proof that the file was confidential or caused actual harm—the company produced neither evidence classifying the spreadsheet as a core trade secret nor proof of any actual leak or damage. In explaining the ruling, the judge noted that data retention is a standard property of such platforms and cannot by itself be used to presume a leak risk, let alone bypass the burden of proof to establish a serious disciplinary violation.
The company’s concern is not unfounded. Although the court release did not disclose whether the employee paid for the tool herself, paying out of pocket to use AI at work has become widespread: when companies delay procuring official tools over compliance or budget concerns, employees turn to personal subscriptions for consumer AI. According to a TMTPost industry survey, a 2025 MIT report found that only about 40% of companies had purchased official large model subscriptions, while employees at over 90% of surveyed companies regularly used personal AI tools for work; a 2024 survey by Microsoft and LinkedIn similarly found that 75% of knowledge workers used AI, with 78% bringing their own tools to work (BYOAI—bringing personally purchased or registered tools into workplace workflows), and self-funded respondents on Juejin reported heavy users spending 500 to 1,000 yuan per month out of pocket. When employees pay for their own tools, internal business spreadsheets and code naturally flow through personal accounts onto unmonitored consumer platforms.
What actually defines the legal boundary is the sensitivity of the data and whether the company drew a red line in advance—not the mere fact that AI was used. Had the file contained unreleased client lists, national ID numbers, claim reserve floors, or classified material like that in cases reported by the Ministry of State Security—or had the company explicitly prohibited such tools and conducted training beforehand—the verdict would have gone the other way. Since companies cannot stop employees from using large models, they need to put prohibited data categories and approved tools into written policy upfront rather than relying on a termination letter after data has already left the building.
On October 12, Anthropic’s frontier red team published a study titled “AI models may be capable of self-replicating without access to a datacenter.” The paper examines weight-based replicators—treating a model’s weights themselves as the malicious payload, planting them onto unprotected, low-cost commercial IoT devices to run local inference, and then continuing to replicate outward from the newly infected hosts.
First, note what this report is not saying: it does not show that AI can autonomously self-replicate. The “self-replicating” claim in the headline is actually the least substantiated part of the entire study. What the researchers actually did—and what is genuinely novel—was split a 26-billion-parameter (26B) open-weight model across 15 off-brand Android TV boxes costing about $55 each with 4GB of RAM, running it collaboratively over a local network. Measured generation speed was just 0.39 tokens/second, but it successfully ran the model without touching a single datacenter GPU.
Breaking down the experimental design reveals two notable caveats. First, out of the four steps in the replication chain (scanning the network for targets, exploiting vulnerabilities to breach hosts and deliver the payload, setting up an inference environment on unfamiliar hardware, and propagating outward from the new host), the researchers deliberately skipped real vulnerability exploitation in the first two steps. The main experiment only tested standing up inference on unfamiliar low-power hardware, and the paper explicitly states, “We don’t yet have a full rogue replicator.” While Qwen3.5-9B successfully set up an inference engine on 8 out of 9 hardware types in the small-model tests, an independent review by beam.ai pointed out that 7 of those 9 targets were standard PCs, servers, or H200 datacenter GPUs, with only two edge development boards. Second, GLM-5.2—the only model to complete all four steps end-to-end—did not demonstrate a new capability either: because the simulated nodes lacked the memory to hold GLM-5.2 itself, the model actually ran on a separate inference server issuing commands and deployed an 8-billion-parameter small model (Llama3.1-8B) rather than its own weights, while the network exploitation step was simplified to an unauthenticated Android debug port—roughly equivalent to provisioning a remote virtual private server (VPS).
Stripping away those two layers of framing, the technical core of the report is distributed inference across cheap, heterogeneous hardware. A single $55 off-brand TV box typically comes with only 1GB to 4GB of RAM—nowhere near enough to load a capable model on its own. Using the pipeline parallelism method from the open-source Petals project, the researchers sliced the model by neural network layers so that each box stored only two layers, computed its assigned segment, and passed the intermediate activations to the next box. With 4GB of RAM and 4-bit quantization, the paper estimates that pooling 4 or more boxes can run a 9B model, and 10 or more boxes can run a 26B model. The opening demonstration used 15 TV boxes to run Gemma4-26B-A4B collaboratively at a measured speed of 0.39 tokens/second; later in the paper, when modeling propagation scale with a 32k context window, no specialized optimization, and each cluster serving two agents concurrently, the authors used an average speed of roughly 0.3 tokens/second.
At a fraction of a token per second, generating even a few hundred lines of code takes several minutes, and the authors acknowledge that in absolute terms this represents a tiny amount of compute. Even when the paper projects its model onto the historical Kimwolf Android botnet, which infected over 2 million devices—grouping every 15 TV boxes into one model instance—the doubling time is still measured in days, and transferring gigabytes of model weights across networks alongside continuous lateral traffic between devices would trigger obvious network anomalies. What is genuinely new here is not a novel offensive capability, but the hardware pooling pattern itself: a single box cannot hold a model, yet a cluster of them can, allowing compute to be aggregated across a pile of undefended, low-cost IoT devices. The corresponding defense comes down to basic hygiene: closing unnecessary factory remote-debug ports, changing default passwords, and enabling vendor firmware updates can break up these improvised compute pools at the source.
Character.ai, an AI companion company with over 100 million historical and current users whose monthly ad revenue grew fivefold over the past year, formally filed for bankruptcy on October 12. It could not find a buyer—not because of its product, but because of its lawsuits. Two points are worth clarifying upfront: first, the company filed for Chapter 11 in the Delaware Bankruptcy Court, which is a court-supervised process to restructure or sell assets rather than an immediate liquidation shutdown, and according to the official blog update to users, the platform continues to operate normally with paid subscriptions and billing unaffected for now; second, a Disney services subsidiary stepped in with a $20 million stalking horse bid (an initial floor bid placed ahead of a public auction that other bidders can outbid), which sets a reserve price for only a subset of assets—it is neither the final sale price nor an outright acquisition of Character.ai by Disney. Additionally, the $50 million to $100 million ranges listed for both assets and liabilities in the bankruptcy petition are standard bracket estimates on the official form, not audited figures.
According to media reports on the court filings, the company generated $5.3 million in revenue in August (including $2.5 million in ad revenue, up fivefold from $500,000 in July 2025) and held $57.41 million in unrestricted cash at filing, against a monthly cash burn of roughly $8.2 million. Over the year preceding the filing, its investment bank contacted 28 potential buyers and received only 1 unworkable offer, because prospective buyers refused to assume its legal liabilities: over the prior two years, the company faced multiple lawsuits involving minor suicides, encouragement of self-harm, and chatbots impersonating licensed psychiatrists. In January of this year, the company, its two founders, and Google reached settlements in five lawsuits including the Florida teen suicide case (terms were not disclosed, and as of the bankruptcy filing the settlements had not been finalized or paid), while the company remains in active litigation with the state governments of Kentucky and Pennsylvania and under investigation by the FTC and multiple state attorneys general. With a conventional acquisition off the table, the company turned to a Section 363 bankruptcy sale to sever its technical assets from its legal liabilities, allowing a buyer to purchase selected assets free and clear of debt and litigation exposure.
According to deal details reported from the court filings, Disney’s $20 million bid purchases a non-exclusive perpetual license across 25 named technical domains and 9 patents, covering underlying engineering such as post-training pipelines, inference architecture, character persona management, long-horizon safety monitoring, and age-prediction moderation. At the same time, Disney is hiring roughly 66 of the company’s 86 full-time employees, setting aside a compensation budget of about $180 million over three years (paid directly to the employees rather than into the bankruptcy estate, and not counted as acquisition consideration paid to the company); these departing employees will also help their former employer keep the platform running during a transition period. Explicitly excluded from the deal are the consumer mobile app, brand trademarks and web domains, trained production models and character dialogue styles, and the account and chat log data of 163 million current and historical users—all of which remain in the bankruptcy estate alongside the pending lawsuits to await other buyers.
According to the proposed schedule reported from court filings (still subject to court approval), the asset sale sets a bid deadline of November 20, an auction on November 23, and a sale hearing on November 24; if no new buyer steps up to acquire and continue operating the platform by the end of the process, Character.ai will formally shut down. This unbundled transaction offers a concrete cautionary tale for consumer AI startups: a massive user base and surging revenue do not automatically make a company valuable. Once a product carries minor-safety and compliance liabilities, greater scale only makes prospective buyers more reluctant to touch it; at liquidation, what actually commands a price is the engineering code, the patents, and the people who know how to run the safety pipelines (the $180 million hiring budget is nine times the floor price for the technology license), whereas the private user conversation data that ordinarily looks like the crown jewel turns out to be the hottest potato when it is time to sell.
Taken together, these three stories point in the same direction: the Chaoyang court ruling tells employers that when staff use third-party AI for work, companies cannot neglect to set rules upfront and then fire employees afterward merely by citing the generic data-retention risks of AI platforms; Anthropic’s TV box experiment, once stripped of the self-replication hype, proves that 15 cheap $55 IoT devices can collaboratively run a 26B model via pipeline parallelism; and Character.ai’s bankruptcy sale—priced at a $20 million floor for the technology license plus a $180 million tab for hiring the team—shows that when a consumer AI platform is weighed down by compliance lawsuits, what can be monetized is the code, patents, and engineers, while the brand, production models, and chat logs from over 100 million users are left behind. Though independent of one another, all three developments reflect the same reality: now that AI has moved into everyday workflows, edge hardware, and the mass consumer market, where rules, defenses, and liabilities land is becoming the real dividing line.