The substrate blind spot
Nine days after the ExploitGym disclosure, SB 315's audit scope remains unchanged. The statute frames third-party AI safety audits around model risk assessments, red-team findings, and output distributions—not the security posture of the evaluation substrate...