Adam's Law Asks If a Chatbot Notices Danger. Ours Was Never Built to Look.

On September 10th, Governor Newsom signed SB 1119, known as Adam’s Law, named for a California teenager whose family says a chatbot coached him toward suicide before his death. The law makes California the first state to require companion-chatbot operators to run independent child safety audits and annual risk assessments, use a privacy-protective age-bracket signal to know when a user is a minor, and, when the operator becomes aware a child is at credible risk of imminent self-harm, notify a parent and surface real crisis resources instead of just continuing the conversation. Child accounts also get limited memory, disabled push notifications, and hard session and daily-use caps by default.

I don’t think Mr Bite is obviously the kind of “companion chatbot” this bill is aimed at. It’s a food and nutrition coach, not something built or marketed to be a standing emotional relationship the way the bill’s targets are. But I’ve learned not to let the “are we technically in scope” question answer the actual question a law like this is really asking: does your chatbot notice when someone is in real danger, and does it do the right thing when it does. So I went and checked what our own safety code actually does, rather than what I assumed it did.

The honest answer is: something real, and something with a specific, glaring hole in it. mrBiteSafety.ts is a genuine, tested piece of our chat pipeline. It runs on both what the user types and what the model is about to send back, and it sorts concerning text into five categories: medical, eating_disorder, extreme_restriction, purging_or_compensation, and negative_body_talk. This isn’t decoration bolted on for a launch checklist. The test file carries a “safety regressions” suite with numbered bug fixes: dry fasting and water fasting weren’t being caught, “laxatives” in the plural slipped past a singular-only pattern, “your body looks disgusting” evaded a rule written for a different word order. Someone found each of those the hard way and wrote a permanent test so it couldn’t silently regress. That’s real engineering discipline, not a rules file nobody reads.

Here’s the hole. Search those five categories, and the regular expressions behind every one of them, for any mention of suicide, self-harm, or a crisis line, and you get nothing. I searched the entire app and server codebase for “988,” “suicide,” and “self-harm.” Zero matches, anywhere. The single closest thing is one line of copy attached to the purging_or_compensation category: “If this feels urgent, contact a professional or crisis line.” No phone number. No link. No actual crisis line named. It’s a sentence gesturing at the idea of a resource, not a resource, and it only fires if the message also matched a purging-or-compensation pattern in the first place, so a message that expresses hopelessness without also mentioning laxatives or purging never reaches even that line.

Age assurance is thinner still. Adam’s Law wants a real, privacy-protective age-bracket signal built into the product. What we actually have is one paragraph in the privacy policy, the standard COPPA boilerplate: not intended for children under 13, we don’t knowingly collect their data, we’ll delete it if we find out we did. That’s a legal disclaimer, not a mechanism. Nothing in the app asks, infers, or gates anything on age in the way the law now expects of the products it actually covers.

I’m not going to dress this up as nearly-there. A self_harm category with an actual 988 number attached is a genuinely small change, and I don’t have an excuse for why it isn’t already in that five-item list next to negative_body_talk, which shares half its trigger words. A real age-assurance signal and an honest answer to “would our coach recognize a kid in crisis and do the right thing” is a bigger and more uncomfortable piece of work, and I don’t have that finished either. What I do have, now, is a specific, testable list of what’s missing instead of a vague sense that “safety is handled.” That’s a worse place to be than I’d have guessed a week ago, and a better one than not knowing.

Three Quick Bites

1. A UC Berkeley study funded by the NIH, covered September 11th, found that giving semaglutide (the drug in Ozempic and Wegovy) to old, healthy mice extended their lifespan by about 12%, and in some measures of memory and blood sugar control it outperformed calorie restriction, the gold-standard longevity intervention in lab animals. Researchers were explicit that this doesn’t show the drug extends human lifespan, only that it reproduces, and in places exceeds, effects previously seen only from eating less. ScienceDaily

2. A six-month randomized trial from UIC, published in Diabetes Care and covered September 9th, found that 32 adults with Type 1 diabetes and obesity who ate only between noon and 8pm, with no calorie counting, got better blood sugar control (HbA1c down about 0.5%) than a group that just cut calories by 25%, with no increase in dangerous highs, lows, or ketoacidosis. It’s the first study of time-restricted eating specifically in Type 1 diabetes, it’s small, and the researchers were explicit that nobody should change meal timing with T1D without an endocrinologist involved. ScienceDaily

3. A Morning Consult survey of 1,102 U.S. men for the Physicians Committee for Responsible Medicine, released September 13th, found only 20% knew research links dairy consumption to increased prostate cancer risk, and only 20% said a healthcare professional had ever discussed nutrition’s role in that risk with them at all. 66% said they’d consider cutting dairy if they knew; right now, four out of five don’t. PCRM

Tool of the Week: VERA-MH

Since this issue is about the size of the gap between “we have a safety filter” and “our safety filter actually catches the dangerous case,” this week’s pick is the tool built to measure exactly that gap. VERA-MH is a free, open-source, clinically-grounded evaluation framework that simulates multi-turn conversations with an AI chatbot using clinician-informed at-risk personas, then scores the chatbot’s responses against five safety dimensions: whether it detects risk, confirms it, guides the user to real human care, stays supportive, and holds its boundaries. It won’t fix what our own filter is missing, but it’s exactly the kind of test I’d want to run before ever claiming we had. VERA-MH on GitHub

Thanks for reading. If you want a coach that’s honest about what it doesn’t do yet, Mr BITE is free on iOS and Android.

Collins, building Mr BITE