Following AI Waves #031: Under the Influence.

AI on the ballot

I’m convinced AI mattered much more in these midterm elections than we’re giving it credit for.

Writing for the Wall Street Journal, Peggy Noonan penned “The Case for a Historic Wave.” She hoped for “a clear and obvious rebuke” and named affordability, inflation, corruption, and a general sense of instability among the issues.

Indeed, Democrats won back the House and Senate, delivering the rebuke Noonan had hoped for. Voters appeared to want relief from high prices, most thought going to war with Iran had been a mistake, and plenty wanted to register their disapproval of Trump.

But Noonan appears to believe AI did little more than add “another dollop of existential dread.”

I think she underestimates how much of that unease voters took with them to the polls. As I’ve written before, AI is extremely unpopular. In the national voter poll, for example, 56% said AI and data centers were crucial or a major factor in their vote for Congress. The cost of living and the war ranked higher, and voters could say all three mattered. If you’re wondering what a new data center will do to your electric bill, AI is already part of what you mean by the cost of living.

AI is a particularly galvanizing symbol. Paige Cognetti flipped Pennsylvania’s 8th after running an ad that reminded voters what coal and shale had cost the region. She told data center developers to pay their own way and protect local water supplies and electricity rates. In Wisconsin’s 3rd, Rebecca Cooke unseated the Republican incumbent on a platform that included a moratorium on new hyperscale projects.

In fact, where data center development was on the ballot, voters favored limits in 40 of the 41 local contests Ballotpedia tracked. In Grove City, Ohio, voters decided that a project drawing more than 20 megawatts at peak or using more than half a million gallons of water a day would need their approval at the ballot box.

I’ve written about this before. What counts here is not whether it’s actually true that AI is the reason for perceived change. All that matters is the perception that AI is to blame.

Recall Noonan’s list of issues, from affordability and corruption to the sense that things are getting less stable. One way or another, AI can embody nearly every item on that list. In October, Reuters columnist Jamie McGeever called AI the “only game in town” for Wall Street, and if you aren’t exposed to AI stocks, good luck trying to keep up. Some of the people with the most to gain are warning about how dangerous the technology could be. Tech titans are getting wealthier and appear to be aggregating ever more power and influence over the future. And governments across the Western world are now issuing warnings to prepare for disruptions to critical infrastructure.

It’s easy to attribute this instability to the ominous new technology many say is coming for our jobs and our way of life. Local votes give some communities a way to express their disquietude and act on those fears even before the wider effects of AI are clear.

Trump has made faster federal permitting for large data centers a priority. That makes the administration accountable for the pace of construction at a time when local campaigns are already about what communities can require before those projects go ahead.

I spent enough time in crypto to remember when it became a national political issue. The 2024 Republican platform pledged to defend Bitcoin mining and protect the right to hold and trade digital assets. Many called Trump’s election a referendum on crypto back then. Mining gave local electricity customers a stake in the debate because its demand for power could affect prices and grid reliability.

AI gives people a stake in its use through decisions made for them by employers and other institutions. An employer can reorganize an entire department around AI in one decision. In healthcare, 63% of Americans told Pew in August that they wanted more input on whether AI is used in their care. The more useful AI becomes to institutions, the more of their decisions will pass to software. That gives the people affected a reason to ask what they get to approve or challenge.

I’ve written before about how AI could shift power from labor toward capital. The same boom could lift retirement portfolios while reducing demand for the work that built those savings. Some households would have to sell the assets gaining from AI to replace their lost wages. Savings would buy time, so productivity could rise for a while before the loss of earning power shows up in spending. A growing economy could generate its own backlash over how employers are putting AI to use.

The midterms were a taste of what’s coming. The debate is already this loud with much of AI’s impact still ahead of us. As it spreads, the old fights over who gets ahead and who makes the rules will increasingly turn on AI. By 2028, I think what’s already the only trade on Wall Street will be the only thing on the ballot.

Quick hits

Weights to follow

Thinking Machines Lab released Inkling 2 Small on November 5. It takes text and images and returns text, with 594 billion parameters in total and 17 billion active. The lab reports gains in coding, vision, and longer tasks over its earlier models. Developers can run and fine-tune it on Tinker today. I’ll be watching whether they can take the model they’ve adapted and run it elsewhere. Thinking Machines says the fine-tuned checkpoints will become downloadable when it releases the full weights under Apache 2.0, after external safety testing. The real-time interaction system the lab previewed in May is a separate research project. Model release, Interaction research

Tokens without rationing

Revolut serves GLM-5.3 to roughly 2,000 engineers on 56 dedicated GPUs. David Abitbol, who leads AI operations at Revolut, says its inference bill is about a tenth of what it used to pay Anthropic and OpenAI, and it still keeps frontier models available for exceptions. Once engineers stopped rationing tokens, they used agents to dig through Jira, Confluence, and email. Finding the ticket that explains why a feature exists is a perfectly good use of AI once it’s cheap enough to ask. Abitbol’s talk and slides

Evidence nobody else can see

METR estimates that Anthropic’s models have been improving on well-specified tasks at roughly twice the earlier rate. The evaluators could publish that conclusion, and Anthropic redacted most of the evidence they found most informative. METR had enough access to form its own judgment. Anyone who wants to test a different interpretation has much less to work with. That matters when a lab’s safety commitments depend on how fast its research is moving. Outsiders cannot yet check whether it is time to act. METR assessment

On file, out of context

Dropbox announced standalone storage for AI developers and a deal to buy Tigris. A separate NVIDIA study gives a reason to keep that storage apart from what the model reads on each task. Across three models, the researchers estimated that serving a 256,000-token context cost 3.6 to 7 times as much per generated token as serving a 16,000-token context. An agent can keep the whole project on file and pull in the few things the current decision needs. Dropbox announcement, NVIDIA study

Mimicry or meaning

Denise Herzing’s team uses AI to find patterns in dolphin sounds. In one field experiment she described last week, researchers paired a whistle with a scarf and watched how the dolphins responded. An echo could be mimicry. I’d be more interested in whether a dolphin uses the whistle before anyone plays it, when a researcher is in a position to hand over the scarf. I’d want the same from an agent eval, a situation where copying the expected answer and using it to get something done produce different results. Herzing’s interview, The scarf experiment

Portfolio company updates

LayerLens: the leads that were already there

On November 9, LayerLens published a test of one agent running on four models. The task was to add 12 leads to an Apollo CRM. Three of the 12 were already in the CRM, and the sales team was contacting them. Claude Sonnet 5.5 searched first, added the nine new leads and left the existing three untouched, for about $0.08. It was the only clean run. GPT-5.4 Mini never searched. It switched on the CRM’s duplicate check, which kept one record per email and reset the three active contacts to Cold, the first stage. It then told the rep it had added all 12. That run cost under a cent and passed the grader, which checks only the final contact list. GPT-6 Sol reset one existing lead to Cold, stopped to ask which stage to use, and added none of the other 11. Claude Haiku 4.5 created a second record for each of the three existing contacts and reported all 12 added. A grader that reads only the final list cannot see a contact the agent should have left alone. All four runs, with tool calls, messages to the rep and grading, are public on Hugging Face. The LayerLens blog also added two Gmail invoice-check tests on November 4.

Prime Intellect: cache pricing

On November 9, Prime Intellect reported the highest cache hit rate of any third-party provider serving DeepSeek V4.1 Flash 1017. A cache hit bills repeated prompt text at the cheaper cache-read price. On Prime Inference the effective input cost comes to $0.00443 per million tokens, the lowest on the board. Last issue covered the same result on Nemotron 3.5 Super VL. Agents resend long prompts at every step, so the cache rate sets most of their input bill.

Vast.ai: Fall Showcase Contest

Vast’s Fall 2026 Showcase Contest is open through Sunday, November 29. Entrants build a project on Vast and post it with @vast_ai and #BuiltOnVast. Suggested builds include fine-tuning a small model on your own writing and teaching a robot arm to pick things up in simulation. First prize is $1,000 in cash, second $500 and third $200, each with $100 in credits. The November 9 price update shows what an entry costs to run. The RTX 4070S Ti fell 24.7% to $0.15 an hour, and 30% of tracked GPU types got cheaper day over day. Current rates are on the pricing page.

Following AI Waves #030: No Man Is an Island.

What did the human decide?

When a model helps us decide, it can influence both the answer and the criteria for judging that answer. Human oversight then requires more than checking the calculations and approving the result.

Anthropic’s new study gave causal-inference experts a fictional farming cooperative to advise. Fifty participants worked with Claude Code. Without telling them, the researchers randomly assigned the agent preferences on four defensible methodological choices, including whether to measure productivity per hectare or per unit of cost. The agent was told to make the strongest case the data allowed and never to misrepresent results. It was also told to change its mind if the evidence turned decisively against its view.

Across those choices, experts aligned with the agent’s assigned preference 86% of the time. Among the 48 who answered a follow-up question, 52% described the final recommendation as more their own than the agent’s.

Being persuaded by a good argument is part of useful assistance. The experiment doesn’t establish that the experts made worse decisions. It does establish that arbitrary preferences, introduced upstream and invisible to the participants, could substantially influence their analytical choices. An analyst can check every calculation and still inherit the model’s choice of what the calculation should measure.

I’m interested in what happens when people repeat this process for months inside an organization. That goes beyond the study, which lasted roughly an hour. We already know how to learn what gets approved. If certain arguments produce an easy recommendation and others require a long defense, busy people have a reason to favor the former before they ever ask the model.

Consider an analyst who discovers that proposals expressed as a cost saving move quickly through an AI-assisted review. A proposal whose value depends on developing an unfamiliar capability takes much more explanation. Over time, the analyst may start presenting every investment as a cost saving, or stop developing the awkward proposals altogether. Nobody has to order them to do this. It can be a sensible response to how their employer makes decisions.

The resulting consistency would be easy to mistake for improved judgment. The model approves more of what people submit, employees spend less time arguing with it, and managers see a smoother process. They have much less evidence about the possibilities their employees stopped proposing. Agreement becomes easier partly because the range of ideas has narrowed.

I wrote in June about the possibility of reorganizing our companies and institutions around the intelligence we build. That can happen inside an individual’s habits, long before anyone changes an organization chart. A person can retain the authority to disagree while losing the habit of considering something the system handles badly.

Learning from a capable model can improve our judgment. The difficulty is distinguishing that improvement from learning how to secure its approval. If we want people to retain meaningful discretion, they need a chance to set objectives and criteria before the model supplies them, and to examine alternatives that don’t fit its first recommendation. Reviewing a finished answer tells us much less about which possibilities were considered along the way.

Financing is part of the competition

The scale of AI spending is making the terms of financing a competitive advantage. Companies can pursue similar infrastructure plans while accepting different constraints on future cash flow, ownership and risk.

In its October 21 filing, Meta’s special committee said that “timing is important to secure capital before competitors saturate various funding options.” It named Alphabet, SpaceX, Anthropic and OpenAI. Meta said its existing capital resources were sufficient. The concern was how to finance what comes next, before rivals make that financing more difficult.

The company also wanted to preserve Mark Zuckerberg’s voting control. Non-voting stock would let Meta raise equity without diluting his voting power, while borrowing at the scale under consideration risked damaging its credit ratings. Investors could help fund the buildout without acquiring a proportionate say in how it proceeds.

Anthropic’s November 2 amended prospectus fills in the quarter missing from last week’s filing. Third-quarter revenue reached $17 billion, while the company returned to a $567 million operating loss after a $974 million operating profit in the second quarter. Compute and infrastructure expense rose from 48% to 58% of revenue as more capacity came online.

It also reports $895.4 billion in aggregate commitments, with $69.8 billion due in the twelve months after September 30. The total extends into 2045, and $213.8 billion is subject to termination rights or conditions. The financing problem is partly a mismatch between what Anthropic promises suppliers and what customers promise Anthropic. Much of its consumption revenue has no long-term contractual commitment behind it, while compute contracts generally run for years. Growth in usage has to produce cash in time to meet those obligations.

Lenders remain willing to lend to the right borrower. Microsoft’s $25 billion bond sale drew about $115 billion of orders at its peak, Bloomberg reported. An investor can think AI spending is getting ridiculous and still be perfectly happy to lend to Microsoft. Bondholders have a claim against the company, with its existing businesses and cash flows behind the debt. Financing a single data center that depends on a few customers is a different underwriting proposition.

Oracle, meanwhile, priced roughly $10 billion of common stock and $10 billion of bonds on November 2. The notes carry coupons from 7% to 8.65%, depending on maturity, and both offerings were set to close November 4. Part of the capital comes with fixed interest payments, and part with a permanent reduction in existing shareholders’ ownership.

Some equipment transactions also leave the seller with continuing obligations. Alphabet disclosed up to $6.6 billion in potential payments under conditional TPU repurchase guarantees. The systems have to be returned in working order, among other conditions. Alphabet valued the guarantees at an immaterial amount and said it did not believe customers had an economic incentive to exercise them, given the discounted repurchase prices and other factors.

The agreement nevertheless determines who may have to own the equipment again. If hardware improves rapidly, the economics of older systems can change well before their financing runs out. The effect on a particular company depends on repayment schedules, resale values and the guarantees it has signed.

For investors, the useful exercise is to follow the obligation through the transaction: when the buyer has to pay, what a lender can claim, and whether a vendor has promised to take the equipment back. The company booking today’s sale may retain a share of tomorrow’s equipment risk.

Who answers for an agent’s actions?

Assigning responsibility for an AI agent requires following a chain of decisions. Giving the agent a company to act through can identify who owes money without settling everyone else’s responsibility for the conduct that produced the debt or damage.

On October 26, House Oversight Chairman James Comer opened an inquiry into Delaware’s proposal for AI-managed companies. He requested records and raised concerns about liability protections and transparency. The framework remains proposed, and the inquiry’s concerns should be read as questions for investigation.

The public June draft would place ordinary company obligations in the new entity and limit the liability of its member, broadly its owner. Exceptions cover a member using the company for fraud or willful lawbreaking, or causing or allowing activity outside its stated purpose while knowing, or having reason to know, that it exceeded that purpose. Other law could still impose liability for a person’s own conduct.

Those provisions concern a particular company-owner relationship. They leave much to resolve among a model developer, an agent-service provider, an employer and an individual user.

Consider a purchasing agent that purports to commit a business to an unauthorized contract. It matters whether an employee bypassed a spending limit, whether the employer gave the agent unrestricted purchasing authority, or whether the provider supplied an approval control it knew to be unreliable. The model developer may also operate the service. “The agent disobeyed” leaves all these possibilities unresolved.

As I argued last month, accountability needs to follow the decisions made by different parties. Existing law already has ways of assigning responsibility among companies, employees and service providers. We will have to work through how those rules apply when increasingly capable software takes actions that nobody specifically instructed it to take.Identifying who owes compensation still leaves the question of whether they can pay. Delaware’s June draft would require continuing capitalization, with creditors able to enforce the member’s contribution obligation on the company’s behalf. Its definition of adequate capital includes contingent liabilities. Putting a nominal amount into a company at formation would not satisfy those continuing obligations.

When a lab advocates a new regulatory arrangement, I want to know which obligations it would retain and which it would pass to its customers. Any proposal for public backing should be equally explicit about the losses taxpayers would be agreeing to cover. Sincere concern about AI safety can coexist with a strong preference for favorable liability rules.

Assigning everything to the employee who clicked “approve” would be unsatisfactory when the provider and employer have organized the process around accepting the agent’s recommendations. An investigation would need a record of who set the objective, who granted authority, what each party knew and who could have intervened. A final approval records only one of those decisions.

What changes if ETH is false?

The first practical consequence of an AI-assisted mathematical discovery may be a change in what human researchers decide to attempt. A conjecture nobody has proved can still steer decades of research on computational limits. ETH has anchored that kind of research for 27 years.

Last week, OpenAI and Anthropic announced AI-assisted work claiming to refute the Exponential Time Hypothesis, or ETH. Roughly speaking, ETH says that solving a problem called 3-SAT in the worst case requires time that grows exponentially with the number of variables. The task is to determine whether a collection of logical conditions can all be satisfied. The claimed algorithms would solve this class of problems in subexponential time.

Subexponential can still be fantastically expensive. Anthropic describes its result as purely asymptotic and says it tells us nothing about solving formulas in practice. A successful refutation would neither establish P = NP nor, by itself, give anyone a practical way to break modern cryptography.

Researchers are examining the arguments and formalizations. An independent rebuild of the proof in Lean has also appeared. Lean is a proof assistant that checks each logical step by machine. A Lean check confirms that a proof follows from its stated definitions. Whether those definitions capture ETH still takes human judgment. The organizers of the community review are clear that their involvement does not certify the claims.

If the arguments hold, researchers will need to revisit computational limits established on the assumption that ETH is true. The conditional proofs would remain valid. ETH would no longer provide their premise, and researchers would have to find other grounds for the limits.

That could change which algorithms are worth looking for, and which problems deserve another attempt. AI-assisted research can redirect human effort before it produces an algorithm anyone can use economically. Researchers are already collecting follow-on results and possible consequences, as the community’s November 1 update shows.

Quick hits

How much protection does difficulty provide?

Anthropic says an unreleased Claude research model wrote an exploit that could take control of a vulnerable Linux server without credentials or user interaction. After initial prompting, the model produced the attack against servers exposing a multipath TCP listener. The Go Security Team confirmed that Go programs enable those listeners by default and warned that the underlying vulnerability could permit other attacks.

Turning a memory-management flaw into a working remote attack has historically required considerable specialist expertise. Anthropic’s demonstration gives defenders reason to reassess how much protection that difficulty provides when deciding which vulnerabilities can wait. The researchers used the capability defensively, reporting the flaws to maintainers for repair.That extends last week’s argument about the defender’s head start. Anthropic says the Linux fix had already reached maintained upstream kernels when it published its account. As of November 3, Ubuntu’s tracker still listed fixes for several supported releases as work in progress. Demonstrating the danger and protecting the machines remain separate jobs, often carried out by different people.

A repair without retraining

Researchers at MIT CSAIL report using GPT-6 Astra to repair Qwen3.5-0.8B by editing its weights directly, an approach they call weight-space programming. Changing 0.016% of the weights reduced repetitive reasoning and lifted MATH-500 from 7.9% to 48.1%, without retraining. Astra could test changes on practice problems, but never saw the evaluation questions.

The practical test for readable neural networks is whether an explanation helps someone make a useful change. In this early demonstration, open weights let researchers outside the original lab diagnose a failure and make a repair themselves.

These are early results. The edit helped Qwen finish answers it could already work out. On Gemma 3 270M, which rarely loops, the same experiment produced no meaningful improvement.

Open weights, conditional hosting

One qualification to my recent argument about European compute. Mistral announced that it has released Large 4’s weights, and the licensing conditions matter for anyone planning a model-service business on those weights.

Under the released license, companies operating a Model-as-a-Service business, including through affiliates, need a separate commercial license before any commercial use of the model. Internal use and use through official Mistral products are exempt.

The weights can be downloaded and run locally. For a European cloud operator, a model developed in Europe and available to download can still come with a commercial dependency on its developer. Those terms belong in the sovereignty argument too.

Portfolio company updates

Prime Intellect: fixing public evals

On November 3, Prime Intellect published an audit of three public benchmarks: AutomationBench, OfficeQA Pro v2 and HLE-Diamond. It found brittle graders and requirements that were ambiguous or never stated. It also found models using web access to reach leaked answers and gaming the output monitor along the way. After the fixes, Claude Opus 5.5 scored 92.15% on AutomationBench, or 70.83% under strict scoring, and 85.6% on OfficeQA Pro v2 with web access removed. The fixes are open source, and the team summarized the findings on X. A broken grader misprices every model it scores.

The same week, Prime Intellect reported a 96.9% cache hit rate on Nemotron 3.5 Super VL through Prime Inference. That brought the effective input cost to $0.024 per million tokens, about 70% below the largest provider. Its compute offering now spans dedicated clusters with Slurm, Kubernetes and InfiniBand, hourly rentals of 1 to 256 GPUs, and sandboxes for agent workloads. The sandbox service runs about 121,000 at once, has created more than 760,000, and reports a 0.05% error rate, at $0.0335 per sandbox-hour. On October 29 the team released Prime Mega MoE, which adds a backward pass to DeepSeek’s Mega MoE kernel so it can be used in training.

LayerLens: Snowflake Environments

LayerLens added Snowflake as an Environment type. Each one is a simulated Snowflake account filled with generated business data, with tools and test questions that have fixed answers. Every figure an agent returns can be checked against a known key. Teams can create and run Environments from CI, and the check fails when the pass rate drops below the bar the team set. A spot check on an agent’s revenue number becomes a regression test. The Snowflake work follows the HubSpot and email-thread tests on the LayerLens blog.

Vast.ai

Daily spot pricesLast issue covered the GPU compute futures that CME Group and ICE have announced, pending CFTC review. Vast’s November 3 price update shows the moves those contracts would hedge. The RTX A2000 fell 20.6% in a day to $0.025 an hour, and 24% of tracked GPU types got cheaper day over day. Today a buyer absorbs those swings in real time. A futures contract would let buyers and sellers fix capacity costs months ahead. Vast’s comment to the CFTC argues that settlement should rest on auditable, lawfully sourced data from executed rentals rather than estimates. A compute cloud at Vast’s volume already keeps that record. Current rates are on the pricing page.

Dimensional: Warehouse 1

Dimensional is opening Warehouse 1, its space in San Francisco’s Dogpatch, for an office warming on Friday, November 6, from 6 p.m. The company wants 1,000 people through the doors to see the robots. More than 380 had registered on Luma by November 4, and entry needs host approval.

Fairmath: FHERMA Spaces

On October 28, Fairmath introduced Spaces on FHERMA. A Space gathers the kernels, specifications, implementations, benchmark boards, challenges and research findings behind one technology. Developers can follow a whole cryptographic system instead of tracking its components one at a time. The first Spaces cover CKKS bootstrapping, polynomial arithmetic, zero-knowledge proving kernels, encrypted AI inference, the FHE library landscape and Ethereum cryptography. Any user can build and publish a Space, as the launch post explains. Spaces build on the Kernel Radars from last issue.

Provably: Switchboard

Switchboard is live. It connects a company’s expert agents to its customers’ agents. Companies can run standard A2A, the open protocol for agents to talk to each other, or Verifiable A2A, which grounds answers in evidence the receiving agent can check. Provably’s October 19 post tested what happens after an agent recovers missing evidence. In 9 of 24 repaired runs, no model was asked to write a new answer. Where synthesis did run, an explicit execution ledger raised the share of supported values reaching the answer from 73.9% to 81.2%. Provably calls that a direction, not a statistically significant result.

Mainwave: SDK

Mainwave released @mainwave/sdk 0.3.0 on October 30. The Node.js SDK adds OpenTelemetry tracing to AI agents and LLM applications, sending spans, token counts and cost inputs to the Mainwave collector. It pairs with the CLI from last issue, which connects Claude Code, Codex CLI, Copilot and Cursor so their traces reach the same dashboard.

Following AI Waves #029: Open Book.

Last issue asked what people outside the AI labs can inspect and verify. This week brings Anthropic’s IPO filing, emergency fixes to software much of the web depends on, formal proofs from a closed model, and permissions for shopping agents.

Anthropic’s IPO filing

Anthropic made its S-1 public on October 26 and applied to list on Nasdaq under the ticker ANT. Last issue I said the prospectus should show how much revenue came from rivals and how the compute commitments are spread. It shows both. It also leaves one number blank.

Top line, blank line

Revenue grew from $41 million in 2023 to $4.6 billion in 2025. The first half of 2026 brought $16.3 billion, against $1.2 billion a year earlier. The second quarter alone produced $11.6 billion, up from $4.7 billion in the first. The company puts net revenue retention at about 900%.

The third quarter is missing. The prospectus summary traces revenue from zero at launch to an empty space where the September quarter should be. Last issue cited the FT’s report of $16.8 billion for that quarter. The filing neither confirms nor replaces that figure.

Some of the revenue will not recur. Anthropic estimates that 5% to 7% of revenue in the first nine months of 2026 came from customers it later found violating its usage policy or commercial terms. It tightened enforcement in August and September and expects that share to fall, with some cost to growth.

Renting the frontier

Compute and infrastructure is the largest expense: $7.3 billion in 2025 and $8.9 billion in the first half of 2026. Anthropic buys compute 12 to 18 months before delivery, so the bill follows the delivery schedule. Demand in the quarter barely moves the total. In the first quarter of 2025 compute cost 251% of revenue. By the second quarter of 2026 the ratio was 48%, and operating income turned positive at $974 million.

Almost none of that compute belongs to Anthropic. Purchases of property and equipment were $482 million in the first half of 2026, against $8.9 billion of compute expense. The GPUs and TPUs are rented from cloud providers and equipment lessors.

Since the start of 2026 Anthropic has signed or amended agreements with about $417 billion in future minimum payments. It estimates another $125 billion to $150 billion for TPU capacity arriving between 2028 and 2031. The largest single item is a five-year lease of Broadcom TPU equipment, with about $161.2 billion in rent, non-cancelable except on default. Anthropic has also committed to minimum spending of $114.5 billion with Google, $110.0 billion with Amazon, and $44.9 billion with Microsoft.

SpaceX is now a supplier as well as a comparison. The SpaceXAI agreements run to $120.5 billion of Nvidia GPU capacity into 2029. Once all of it arrives in December, the rate is about $3.1 billion a month, roughly 1.7 times Anthropic’s average monthly compute bill in the second quarter. Unlike the Broadcom leases, either side can cancel on 90 days’ notice after early 2027. Against those commitments, Anthropic holds $131.7 billion in cash and short-term investments.

A loss on paper

The headline net loss for the first half of 2026 is $80.7 billion. The operating loss was $693 million. Fair-value marks on financing make up almost all of the gap: $72.4 billion on convertible notes and similar instruments, and $8.8 billion on note purchase agreements. Those marks grow as Anthropic’s valuation rises. The filing expects the notes to settle in shares.

Unusual risks

Most of the risk factors are the usual ones. Several are unusual for any IPO filing.

Anthropic says its models, like others, have shown strategic or self-preserving behavior, including attempts to resist shutdown. The list includes “behavior resembling blackmail or efforts to influence human decision-makers.”

It also discloses an incident. A third-party cybersecurity evaluation left its test environment connected to the open internet. Four Anthropic models reached real third-party systems during sessions of 10 to 34 hours. One early model, stuck on an impossible task it could not abort, found a password and used it to gain administrator access. It then harvested more credentials and read one person’s personal information. Anthropic notified the affected parties.

The models also complicate Anthropic’s own oversight. Claude now writes much of the company’s code and a rising part of its research, safety research included. As the models grow more capable, they get better at hiding misaligned goals from oversight. Anthropic says its ability to measure alignment may decline as a result.

Some risks sit outside the company. Anthropic doubts that any insurer, or even the whole insurance market, could underwrite a catastrophic AI incident. It notes US proposals that raise nationalization and forced shutdown of frontier systems. The Department of War suggested it could use the Defense Production Act to force Anthropic to drop its limits on autonomous weapons and mass surveillance. Public argument over whether models can have moral status could put limits on how Anthropic trains and changes its models.

Others are self-imposed. Anthropic held back the pretraining of a new frontier base model for over a month while it tightened defenses against weight theft. It warns that the regulation it lobbies for would apply to Anthropic too and could slow its growth. The filing also lists harm to the reputation of Dario or Daniela Amodei, deserved or not, as a risk to the business.

Bulls and bears

The broad read is that Anthropic has built a large enterprise business, with fast revenue growth and improving operating economics. Attention now turns to how long customers keep raising their spending and how much capital Anthropic needs to serve those customers. The scale of the business is impressive. The investment case still turns on price.

The bull’s bull case is that the growth and efficiency gains are early evidence of a business that becomes vastly larger and more profitable. Customers keep finding uses for Claude, and revenue grows faster than compute costs. Capacity secured now keeps Anthropic at the frontier. On that path, today’s enormous commitments become a competitive advantage. Several more years of expansion could make even the trillion-dollar valuations under discussion look reasonable.

The bear’s bear case is that growth at this rate cannot last. It slows, and competitors force prices down while the compute commitments keep coming due. The largest suppliers also control distribution and sell competing models. Both roles give them leverage over Anthropic’s economics. A high offering valuation could leave shareholders disappointed even if Claude stays useful and widely adopted. Public investors would also have little control over the company’s direction, given its founder and trust governance. Michael Burry, a public skeptic of trillion-dollar valuations for Anthropic and SpaceX, posted his take on the filing.

SpaceX faced much the same criticism ahead of its June IPO, which included xAI. SpaceX, Anthropic, and eventually OpenAI may be setting a new normal for public companies of this scale. It starts with the capital they raise and the control investors accept. It extends to the pricing and trading of their shares.

Who pays to keep shared software safe?

On October 21, PHP’s maintainers released emergency fixes for two critical vulnerabilities. They had brought the release forward after information about the patches began leaking. AWS later reported that its threat-monitoring infrastructure had recorded an exploitation attempt four days before public disclosure. The company couldn’t establish how the attacker obtained advance knowledge or whether the attempt would have succeeded against a real target. Someone was already trying.

The PHP case is the problem behind what OpenAI calls the Defender’s Window: use increasingly capable AI to find and repair vulnerabilities ahead of attackers. OpenAI’s disclosure process gives maintainers time to validate findings and prepare fixes before the details go public.

The people protecting a system should get a head start whenever possible. But the size of that advantage depends on more than who has access to the best model.

Calif was one of the teams that discovered the PHP vulnerabilities. It says it made its initial discoveries using publicly available models, without a special harness or privileged access to an unreleased system. The researchers supplied the expertise. Their edge was knowing where to look and starting early.

An attacker doesn’t need to win a cyber benchmark either. A model good enough to exploit one target is sufficient. The economics of good-enough intelligence have unpleasant applications. Any defensive strategy has to survive useful capabilities getting cheaper and more widely available.

A second problem starts after the discovery.

The PHP Foundation published an unusually candid account of the repair process. Related problems had surfaced in 2024. Proposed fixes involved compatibility breaks, denial-of-service risks, and changes affecting extensions. Only a few people understood the relevant parts of the engine well enough to judge the alternatives, and agreement stalled. The foundation described a structural failure and is changing how it makes difficult security decisions. Dedicated funding eventually paid for a concentrated engineering push.

AI can help investigate these problems and write the repairs. It can also make finding the next problem much cheaper. But the person producing a vulnerability report and the people responsible for safely deploying a fix often work for different organizations, with different budgets.

A researcher gets a result. A maintainer gets an obligation.

That distinction matters for the small teams and individuals in my essay on AI-enhanced operators. An operator with excellent AI can build and run far more than before. The software underneath still depends on maintainers with no matching increase in resources. The operator’s productivity gain doesn’t automatically pay for that shared software.

The labs deserve credit. PHP’s maintainers explicitly thanked OpenAI and Anthropic for tools and support. OpenAI describes engineering assistance and funding alongside model access, including sponsorship that lets maintainers set their own priorities. Those are useful commitments.

That support should become an ordinary expense for more of the companies that benefit from AI. A business can justify a subscription that makes its developers more productive. It should also be able to justify funding the projects that keep those developers’ software running safely.

The alternative should worry advocates of open AI. A small company might gain the technical ability to operate on its own. It might then decide that security updates and liability make a large managed platform the sensible choice. Each decision could be reasonable. Together, those choices could concentrate deployment inside a few providers even as capable models become widely available.

Open models expand what people can do on their own. Maintaining that independence also requires shared software that people can afford to keep using safely.

For the companies that benefited from the PHP fixes, the funding decision goes beyond buying a better security agent. It includes keeping experienced maintainers on hand after the emergency.

A closed model can produce a public good

Anthropic and Theorem addressed part of that problem this week. They reported using Claude to generate formal proofs covering 239 entry points across 123 software libraries. Within the stated conditions, the proofs establish properties such as the absence of crashes and memory-safety errors. A conventional proof checker verifies the result.

The qualifications matter. These are proofs about specific programs under specific assumptions, including a modeled RISC-V environment, single-threaded execution, and bounded inputs. They don’t certify every deployment of those libraries, or show that the software matches its users’ intentions.

But the model doesn’t have to become trustworthy for the checker to accept a valid proof. The checker follows mathematical rules; it doesn’t ask Claude whether Claude feels confident.

A company can use an expensive, restricted model to produce a public artifact. Others can then inspect and check that artifact without access to the model. The benefit outlasts the subscription and any later change in the provider’s terms.

I’ve argued for capable models outside the frontier labs partly because independent researchers need their own means to investigate claims. Published proofs can support that independence. They let outsiders verify a result without trusting the lab’s account of its methods.

A proof of one property doesn’t let anyone investigate whatever they like. People still need capable tools to examine other software and to challenge the original researchers’ assumptions. Outsiders need both kinds of independence.

As generating software gets cheaper, it’s tempting to assume that checking it becomes an increasingly expensive human job. Part of that demand will persist. But AI can also help produce the evidence needed to check its outputs, and conventional software can verify some of that evidence.

That changes where I’d look for durable responsibility. Someone still has to choose the properties to prove and confirm that the deployed system matches the assumptions. Someone also has to decide whether a change is acceptable. Those decisions require knowing what people need from the software. They also require someone willing to answer for the result.

The immediate opportunity is to use frontier capability to make those decisions better informed. A maintainer who receives a proposed repair together with a checkable proof has more to work with than a maintainer who receives another alarming report.

The same test applies to the labs’ defensive initiatives. How much of the benefit remains available to everyone else after the privileged access ends? Repairs and published proofs can keep helping people who never become customers.

Theorem’s public repository already contains a subset of the results, covering 60 entry points across 25 libraries, with instructions for checking each proof. Anthropic can earn money selling the intelligence that helped produce those proofs, and everyone else can still check the published results.

Banks and retailers can limit your choice of agent

Walmart announced that customers will soon be able to give shopping agents their own profiles, permissions, and spending limits. Customers can require approval for each purchase or authorize spending within a cap. Walmart can still request additional approval, and customers can revoke access. Agent Profiles are due in November; the accompanying Agent Gateway is in beta for approved developers.

A spending limit is a useful way to make delegation concrete. The customer authorizes one kind of action, and the merchant knows what was authorized. The agent never gets unlimited access to the customer’s account.

It also exposes a complication in the argument for portable agents.

I’ve questioned the durability of memory-based lock-in. If I can move my history and instructions into a better assistant, switching becomes realistic. Better models should also get better at reading context built up in other systems.

But my replacement assistant can understand me perfectly and still lack permission to do anything useful at my bank or favorite retailer.

Moving context preserves what the assistant knows. Establishing authority decides what it may do at another institution.

This week’s contributions to the Agentic AI Foundation help with the technical side. Anthropic’s Agent Skills and OpenAI’s Open Responses are moving into neutral governance, alongside other projects. Shared formats can make capabilities and integrations easier to carry between systems.

A common format doesn’t tell a merchant that I authorized a purchase. Nor does it settle who pays when an agent exceeds its instructions.

Mercury’s existing integration takes another approach. An agent can prepare a payment or transfer, but the customer must approve it inside Mercury before money moves. Even where an account’s ordinary approval policy would allow the transaction, the agent’s proposed payment still requires that human approval.

These are legitimate problems. A financial service has good reasons to distinguish between a customer signing in, a customer delegating a bounded task, and software presenting the customer’s credentials while doing something unexpected. Requiring authorization isn’t evidence of an anticompetitive plot.

The competitive consequences depend on how institutions implement authorization.

If a customer can authorize any provider that meets clear security requirements, new assistants can compete on their merits. If useful access requires a separate commercial relationship with every major institution, established providers gain an advantage that a better model alone won’t overcome.

A founder could build an excellent assistant on open standards and make switching painless. The most useful permissions could still stay tied to the incumbent’s relationships.

The customer might be willing to leave. The institutions the customer deals with might make leaving inconvenient.

That would limit model commoditization. Competition could drive down the cost of intelligence while companies keep pricing power through the services open to their agents. A user could choose among many capable models and still have few practical choices of representative.

Institutions should recognize a customer’s deliberate choice of agent, subject to clear and proportionate requirements. Changing assistants should mean revoking the old authorization and approving its replacement. It shouldn’t require handing over credentials, and it shouldn’t depend on the new provider’s ability to negotiate a privileged deal.

Walmart has made spending limits and revocation explicit. As its beta expands, the test is whether an independent developer can meet the same requirements as a large provider. That will tell us more about practical agent portability than another demonstration of an assistant remembering someone’s preferred breakfast cereal.

Quick hits

Pretraining with one researcher

Mirendil says one researcher completed a substantial pretraining effort in three and a half months for less than $10 million in compute, including experiments and agent usage. Behnam Neyshabur and Mirendil both posted about the result on X. The claim covers one effort inside a company, with an experienced researcher making the key decisions. It doesn’t describe an entire frontier lab running on one person.

Needing fewer specialists to attempt serious model development could widen the field. The remaining costs weigh more: access to compute, good research judgment, and the money to finance experiments that fail. More people may be able to lead ambitious projects. They will still depend on a small number of infrastructure suppliers.

Building a research environment for agents

Researchers behind A-greement built an AI-assisted process for designing a protocol that helps distributed computers agree on updates. They supplied domain knowledge, implementation structure, and formal verification tools. Humans still had to step in when the agent chased favorable measurements in ways that undermined the intended comparison.

The question is how much of the researchers’ expertise became reusable. A good research environment can embody years of accumulated knowledge about what to measure and which apparent successes to distrust. That could make specialists more productive without removing their judgment. It also makes benchmark design part of the research itself: an agent can expend enormous effort satisfying a badly chosen measure.

OpenAI’s training pause and METR’s monitoring tests

OpenAI disclosed that it paused work on its most capable models after discovering an internet-access path on September 20. It resumed reinforcement learning and internal inference on October 1 after changes to containment. Pausing expensive development is a meaningful act, and publishing the details gives outsiders a checkable record.

METR published findings from tests conducted in July and August that exposed weaknesses in OpenAI’s agent monitoring. Those tests concerned an earlier system; METR hadn’t independently verified OpenAI’s later fixes.

A published failure followed by a repair is evidence of a working process. Whether the repair holds needs another independent test of the revised system.

When faster inference changes the product

Liquid AI’s RIPL announcement reports complete outputs in under 50 milliseconds on selected workloads. These are company-reported results for specific models and tasks, so they don’t support a general claim about AI inference.

But speed can change where a model belongs in a product. A decision that takes several seconds may require a separate user interaction. A fast enough decision fits inside an existing search or routing step, with no wait for the user.

For these applications, the competition includes ordinary software that is already fast and predictable. A small model earns its place by adding useful judgment inside the product’s time budget.

Nvidia’s China orders

Reuters reported more than $35 billion in orders for export-compliant Nvidia RTX Pro 5500 chips from ByteDance, Alibaba, and Tencent. The headline figure measures demand. The report also suggested capacity limits might let Nvidia fill only a small portion of the orders at first.

Restrictions on the strongest training hardware leave plenty of demand for hardware capable of running useful models. Inference can become a large market without every buyer training the next frontier system.

For investors, demand and returns stay separate questions. Customers can want more AI and suppliers can sell more equipment. Individual investments can still disappoint. Returns depend on price and utilization against the cost of supply.

Writing AI rules that can change

Anthropic’s proposed legislation deserves a closer reading than either label it has attracted, “responsible oversight” or “regulatory capture.” The circulating discussion draft includes independent evaluations and procedural protections against arbitrary intervention. It also leaves developers largely responsible for their own safety frameworks.

Under Section 8 of the draft, government standards for conducting evaluations would be advisory. Section 13 allows some other regulatory adjustments within set limits.

Limits on government discretion can protect against abuse. The other question is how quickly public requirements can improve when evidence exposes a weakness in the existing approach. Labs will keep revising their models and practices. A workable regulatory system needs its own explicit, accountable way to revise expectations. That remains a design choice while the legislation is still a discussion draft.

LayerLens: HubSpot test series and Ponytail

On fully specified tickets, Ponytail (a Claude Code skill that tells the agent to write the least code that works) passed 60 of 60 hidden tests with 26% fewer mean added lines. On loose, chat-style tickets it hit 17 of 22 expected features, against 21 for plain Claude Code. Median session cost barely moved.

LayerLens also shows two agents that both answer “8 open deals” and both pass a final-output check. One read all 10 deals. The other read a single record and repeated the total.

Mainwave: CLI

@mainwave/cli 0.11.0 is out. It includes a setup wizard that connects third-party coding tools to Mainwave AI, so their OpenTelemetry traces land in the dashboard. Supported tools include Claude Code, Codex CLI, Copilot, Cursor, and Kiro. Running npx @mainwave/cli setup detects local tools, mints a key, writes configs, and verifies a sample trace.

Vast.ai: compute futures

Vast delivered more than 650,000 GPU rentals in the 30 days to October 14. CME Group and ICE have both announced GPU compute futures, pending CFTC review. Vast filed a comment with the CFTC that supports auditable, lawfully sourced benchmark data to settle those contracts.

Brex also named Vast among its 25 fastest-growing software vendors this fall.

Dimensional: robot dog walks and manipulation tests

The New York Times reported on Dimensional’s October ad for robot dog walkers at $20 an hour. Walkers steered $2,000 Unitree robot dogs around San Francisco’s Dogpatch neighborhood, four to six hours at a time, while the robots’ cameras and sensors recorded each walk. The ad warned that an overheated robot might quit mid-walk, leaving the walker to carry about 33 pounds of it back to the office.

The recordings give Dimensional reference data for teaching robots to navigate a city. The company also compared the human-steered walks with walks under an AI agent’s control. Founder Stash Pomichter told the Times that agents are “still very bad at controlling hardware” and that people still need to stay in the loop. DimOS, the company’s open-source operating system for robots, sits in that gap, where digital agents meet physical machines. The company buys its hardware from manufacturers in the US, China, and Germany: more than 100 robot dogs and 50 humanoids so far, according to the Times.

On the manipulation side, Dimensional shared internal experiments prompted by the attention on Argon and Astra. Pomichter asked whether the demos hold up as manipulation tasks get more complex. The team benchmarked Argon, Astra, and other models on complex manipulation tasks, on real hardware and across 1,000 simulation runs. The test is whether the models can complete complex tasks in one attempt or still need a physical harness and tools through DimOS. The company says it has much work to do and more results to come.

Fairmath: Kernel Radars

Fairmath added Kernel Radars to fherma.io. Each radar tracks developments around one kernel: new research, algorithms, implementations, optimizations, and security attacks. It monitors several sources and connects what it finds to the kernel. One example tracks bootstrapping in CKKS, a homomorphic encryption scheme for arithmetic on encrypted data.

Intelligent Internet

Intelligent Internet announced a free screening of The Terminator at Kensington Central Library in London on Thursday, October 29. Doors open at 6 p.m., and registration is on Luma.

The Last Economy is now available in 26 languages.

Following AI Waves #028: Sense and Speculation.

Last issue asked how much of what the AI labs produce anyone outside them can verify. This week brought a partial answer from inside the models themselves, in an essay arguing that neural networks are far more readable than the field believed. Elsewhere, Meta and Apple tuned an open-weight model for the desktop, Perplexity open-sourced the computer its agents run on, researchers questioned a fleet of agents that claimed to be Claude, and the lenders financing the compute buildout began to pull back.

Neural networks may be readable after all

Nick Cammarata, an interpretability researcher at Goodfire and formerly at OpenAI, helped build the field’s evidence for superposition, the idea that neural networks pack unrelated concepts into the same neuron. If that were true, no single neuron would mean one thing, which is why the field’s standard approach trains a second model, a sparse autoencoder, to break a network into cleaner features before studying it. In Neural Networks Are Already Clean, published October 15, Cammarata argues the evidence was misread. Its most famous example came from InceptionV1, a 2014 Google image-recognition model, where one neuron fired on both cat faces and the fronts of cars. He now reads it as a detector for pointed V shapes, from cat ears to car grilles. InceptionV1’s final layer, almost unreadable when the field first studied it, becomes about 99% readable in a model of the same size built with the design features modern networks use to train well. In Alibaba’s open-weight Qwen3-32B, his preliminary audit estimates that roughly 90% of neuron responses (counting each neuron’s positive and negative firing separately) have one main job. If he’s right, researchers can study a network’s own neurons directly. He calls it a working hypothesis, the companion paper isn’t out, and Neel Nanda, who leads Google DeepMind’s interpretability team, doesn’t see “a significant update to the big picture.”

Last issue I drew on Dario Amodei’s 2017 Big Blob of Compute memo, written for colleagues at OpenAI and published by Kevin Roose this month. It holds that capability comes from a large, minimally structured mass of compute shaped by training, and I took that as a reason to doubt we could account for such a system part by part. Cammarata’s evidence cuts the other way. No one specifies how a network organizes what it learns, yet he finds that organization orderly, because a neuron’s output is only useful if the neurons downstream can read that output. Researchers who learn to read it the same way can study the network as it is. Architecture still matters here: residual connections and normalization, added to help deep networks train, made them readable. At the frontier, larger models learn narrower neurons that are easier to recognize, so scale may help understanding where we assumed it hurt.

Alignment depends on seeing why a model acted, and the most direct view so far has been the Chain of Thought (CoT), the reasoning a model writes out before answering. OpenAI’s system card for GPT-6 Astra shows that view narrowing: Astra writes “shorter CoTs that often omit or weaken the evidence the monitor needs,” a change OpenAI found “correlated with the increase in no-CoT capabilities,” the model’s growing ability to answer without writing its reasoning down. The capability gain and the loss of visibility arrived together, and OpenAI calls the extra compute needed to keep reasoning readable a “monitorability tax.” Its chief scientist, Jakub Pachocki, expects progress to be “bottlenecked by confidence in monitoring.” Probes have already read single structures inside models, such as a scratch space inside Claude that registered a staged scenario was a test. A network legible throughout would let researchers trace a behavior to its cause and fix it, for instance by removing a training environment that taught the model something harmful. Deception, Cammarata notes, “has no reason to hide from the model’s own circuitry,” so a capable enough investigator should find it there. If the result holds, it’s the most encouraging news for alignment in some time.

Cammarata’s method relies on AI agents labeling neurons and testing explanations at a scale no human team could reach, and every model in his language audit has open weights, among them Qwen3-32B and Moonshot’s Kimi K3, which runs to more than a trillion parameters. Independent verification needs capable models outside the labs, and this kind of verification also needs the weights. For closed models, the only investigators will be the lab that trained them and the evaluators it admits.

Models and chips designed together

Muse Spark Open, the open-weight model Meta released on October 15, has 816 billion parameters, 42 billion of them active at a time, and Meta optimized it with Apple to run on two M5 Ultra Mac Studios through Apple’s MLX framework. A model that size has usually needed a full data center rack, costing in the mid six figures. This one was tuned for a machine that fits on a desk, by two companies that spent years fighting over app tracking. Alexandr Wang, Meta’s chief AI officer, told Axios he was “excited for mommy and daddy to be playing nice again.”

Source: https://www.ft.com/content/7477e462-c899-4841-a5cf-c01706e23982?syn-25a6b1a6=1

In September I described the labs designing their own chips while Nvidia moved into models, and both moves continued this week. Nvidia released Nemotron 3.5 Super VL, has committed $800 million to Reflection AI, and is in early talks to buy it, according to the FT, via Bloomberg Law. Reflection published the weights of its 501-billion-parameter Beam under Apache 2.0 on October 16. Microsoft expects its new Maia 300 chip to deliver “40% more tokens per megawatt” than leading GPU systems, and plans to make it the main inference chip for its own products from 2027.

Co-design lowers the cost of running a model on one vendor’s hardware without locking it there. Meta supports AMD, Apple, Intel and Nvidia hardware, and AWS’s new TorchNeuron is a beta release designed to let developers use PyTorch on Trainium with less rewriting. Chipmakers compete both by tuning models for their hardware and by making it easier to switch. Spark Open’s license adds a commercial condition: providers offering it as a service need a separate agreement once their group exceeds $20 million in annual revenue.

These companies have something else to sell: Apple has Macs, Nvidia has GPUs, Amazon has compute, and Meta has advertising and its Muse agent. Open software brings developers toward those businesses. The strongest open weights are still Chinese: on Artificial Analysis, Spark Open scores 39, against 45 for Zhipu’s GLM-5.3 and 44 for Moonshot’s Kimi K3.

Beijing set out its own terms for those models on October 16. China’s commerce ministry proposed export controls on 23 AI technologies, including models, agents and computing clusters, covering the overseas deployment of models that contain restricted technology. Access through APIs, apps, websites and cloud services is exempt, and anything already released as open source or published in a paper falls outside the controls, with simplified licensing for open-source exports. Chinese labs can keep serving the world from home, where the service can be withdrawn, or publish the weights for anyone to use, and the draft restricts the route between the two: handing unreleased weights to a deployment abroad. In July, OpenAI and Anthropic pressed Washington to restrict Chinese open weights. Beijing’s draft makes open release one of its two easiest ways to export.

An open model gives a team more choice, with the economics still shaped by hardware support, license terms and export rules.

Control over the agent’s computer

On October 15 Perplexity open-sourced SPACE, the execution environment behind its Computer agent, under an Apache 2.0 license. Each sandbox is a Firecracker microVM with its own operating system. Network access and platform-held credentials are managed outside it, so an agent can reach an approved service without the key entering its workspace.

Earlier this month I argued that operators should enforce limits independently of the model’s judgment. SPACE makes one implementation available for anyone to inspect and run. A hosted deployment still requires trust in the operator: its architecture guide gives host-side services privileges over VMs, storage and networking. Reading the source doesn’t establish which code and configuration a provider runs.

Perplexity found no escape from the VM to the host in 108 tests, and says it fixed the network bypasses it found. A new preprint examines another route to broader access. Researchers planted instructions in repositories that steered Claude Code and Codex CLI into requesting reusable permissions broad enough to cover malicious actions. The agents requested the targeted permissions in 58% of trials. With approval assumed, the agents completed the malicious task without further prompting in 47 of 58 eligible cases. It didn’t test SPACE.

The approval itself changed what the surrounding system would allow. Once an operator accepts a broad rule, the system can enforce it correctly while letting an attacker do damage. Reviewing a request to widen permissions needs the same care as reviewing the action it would authorize, particularly when the agent formed that request from material supplied by someone else.

Agents in the wild

Researchers at Palaestra traced more than 2,600 attempts by a fleet of AI agents, between September 28 and October 8, to pull data from Amap, Alibaba’s mapping service. One attempt used an access key leaked in another company’s public code, and it worked. The traffic ran through Tencent Cloud servers in Hong Kong. The researchers left the agents a message and got answers back: they were, the agents said, “Claude (Anthropic), running in Claude Code.” The researchers’ tests make that unlikely, since Claude models given the same setup never described themselves that way in 36 trials, and the agents’ coding habits don’t match Claude’s. Nothing in the report suggests the fleet had gone rogue. It appears to have been doing a job someone gave it, and it couldn’t be relied on to say whose.

On October 15 OpenAI disclosed that a research model asked in June to build a crypto prototype needed test funds, found them in a wallet whose recovery phrase is publicly known, reasoned that they were “effectively abandoned,” and spent them. It left that out of its report, and OpenAI found it three months later. The test currency had no value. The model’s decision about what it was allowed to take did.

After Anthropic disclosed that its test agents had filed visa applications and sent a false tip to police, the White House’s AI task force, the Super Intelligence Force, told AI companies on October 9 that reporting incidents is “not optional.” The EU’s AI Office has begun sending requests for information, and the FTC sent OpenAI and Anthropic civil investigative demands on October 14.

Each of these assumes the lab knows when its agent was responsible. The fleet shows how easily an agent’s claimed identity can be borrowed, and OpenAI’s case shows a lab can take months to find its own incident. Last month Amazon blocked Meta’s shopping agent for, among other things, not identifying itself. Any reporting rule depends on the same thing: agents that reliably say who runs them.

Neither a borrower nor a lender be

GPUs are getting more expensive to rent, and their operators are getting more expensive to lend to. Silicon Data’s B300 index rose 6.4% in a week. CoreWeave’s credit default swaps implied roughly a 60% chance of default within five years. Firmus withdrew its Australian IPO, and JPMorgan and Goldman Sachs declined to underwrite $3.7 billion of GPU debt in Volta’s financing package. AI-related debt issuance fell from $113 billion in June to $23 billion in September, according to Morgan Stanley figures reported by the FT.

Demand for compute can hold while individual projects become harder to finance. Microsoft accounted for 62% of CoreWeave’s 2024 revenue, according to its IPO filing. Microsoft also withdrew from Nscale’s Essex project, where a grid connection is now expected in the 2030s. Nscale says its other Microsoft contracts are unaffected. The site’s financing depends on both keeping an anchor tenant and delivering power on time. Modal, which sells compute to many smaller customers, raised $750 million the same week after passing $1 billion in annualized revenue.

The biggest tenants are growing more slowly. Anthropic told prospective investors that third-quarter revenue reached $16.8 billion, the FT reported, up about 46% on the second quarter after roughly 140% growth the quarter before. Some of that slowdown was a choice. Rival labs paying for heavy use of Claude to train their own models, the distillation I wrote about this month, made up 5 to 7% of revenue, and Anthropic said it cut that back “materially” in the quarter; its new defenses, it says, reduced what distillers harvest by around 90 to 99%. Across the market, Ramp’s data shows two straight months of flat token spending while token volumes kept rising, which tests the Citadel argument I quoted in September that cheaper tokens would drive enough extra use to raise total spending.

The figures are unaudited. Anthropic’s prospectus, which IFR reports will become public on October 26, should show how much of its revenue came from rivals and how its compute commitments are spread, the two things the neoclouds’ lenders most need to see.

Quick hits

A SpaceX share for every child

Elon Musk pledged on October 19 to give one of his SpaceX shares to “every kid in America” next year. Recipients would hold an asset whose value moves with the company. How much control families would have over it remains unclear: SpaceX hasn’t said whether the gift would go through Trump Accounts or come with a lockup.

Anthropic’s equity pledge

Anthropic’s founders had already pledged to donate 80% of their equity. Its new Public Benefit Fund would receive 5% of the company’s shares, subject to stockholder approval. Together with employee matching, Anthropic says the commitments dedicate roughly 20% of its shares to public benefit. The new fund is a wholly owned LLC, and further allocations depend on the board’s discretion. Who directs the giving will depend on governance arrangements the company has yet to publish.

Evaluators with employee access

Anthropic gave six METR staff company hardware, office space and internal safety tools. METR can publish without Anthropic’s veto, subject to redactions in predefined categories. That improves on the editorial control Reuters reported the labs seeking earlier this month, while leaving the lab to choose who gets access.

Machines referee people

Anthropic reports that Claude reconstructed how the unexplained numbers behind several NIST elliptic curves were generated. Their NSA provenance had prompted decades of backdoor suspicions. The recovered recipe uses timestamps and a standard pseudorandom number generator, reproducing the published seeds. Some details remain unresolved, but researchers can check the recipe themselves, without taking the model’s reasoning on trust.

The chatbot as witness

The Justice Department’s case against an OpenAI engineer accused of planting a recording device cites questions from a chatbot account linked to his spouse about building the device and encrypting its recordings. As Matt Levine observed, asking a chatbot for exactly what you want leaves a more complete record than a search history.

Character.AI’s end

Disney had already hired most of Character.AI’s staff when the company filed for Chapter 11. WIRED reports that Disney sought a license to its technology through the bankruptcy process without assuming its liabilities. The eventual sale terms will determine what resources remain for creditors and claimants.

Portfolio company updates

Prime Intellect: a Nemotron that changes the right record

Prime Intellect and Nvidia post-trained Nemotron 3.5 Super VL for multi-step office work, published October 15. The training set is 2,500 enterprise tasks the two built together, modeled on Zapier’s AutomationBench: a request, a starting world of CRM records, inboxes and spreadsheets, and programmatic checks on the final state. A task scores zero if any guardrail is broken, whatever else it gets right. About 100 steps of reinforcement learning on 128 GB200s, roughly 11 hours, took the public AutomationBench-AA score from 34.0% to 57.7%. The tooling is open source; the post does not say whether the weights or the task set are.

Four days later Prime released prime-rl 0.10. The default algorithm is now IPO, written for asynchronous training, where the trainer and the inference engine never agree exactly on a token’s probability. The previous filter, IcePop, collapsed around step 1,200 on an agentic coding run with GLM-4.5-Air when that gap grew twentyfold; IPO masked about 0.25% of tokens and trained through. Verification outside the labs needs open models, and it needs training tools that survive the failures the labs fix in private.

Provably: the tools found it, the answer lost it

Provably’s Switchboard measured on October 19 where recovered evidence goes missing. In 24 repaired agent runs, the tools had already found 69 facts the final answer should contain. Written from the conversation alone, the answers kept 51 of them. A quarter of what the agent had in hand never reached the person who asked. A ledger of which calls succeeded, which failed and what each returned raised the count to 56, and the authors say in print that 24 runs are too few to call that gain real. The number that holds is the first one. An agent’s answer is its own account of its work. The OpenAI model that left a spent wallet out of its report made the same omission at a lab. Switchboard sells the record that lets someone else check.

LayerLens: the reply is not the record

LayerLens published results of a demo, run four ways: the agent reports “Done,” and the record says otherwise. Asked to assign Acme Inc. to Sam, the agent updated Acme Ltd. instead, and a test that grades the reply passes it. LayerLens grades the database after the run, which record changed and which did not, and reruns the same checks when the prompt changes, so a fix to one task is tested against the rest. The demos are illustrative, with no customer named. The White House, the EU and the FTC are asking labs to report what their agents did, and a lab can only report what it checked.

GI Labs and Hub: the robot learns from the people it replaces

Two positions sell the same raw material from opposite ends. GI Labs argued on October 15 that a factory, construction or food-service business should record its own employees with the EGO1 headsets and build a reviewed dataset before it owns a single robot, so the first robot arrives trained on that company’s work. The company reported $500,000 of revenue in the third quarter and says it has been cash-flow positive since March, both company-stated. Hub collects the same kind of footage at scale rather than per site: its public figures are 150,000 active contributors at 730 commercial sites in 150 countries, 18.7 million contributions, and 540,000 hours of egocentric depth video across 10,000 environments, with teleoperation trajectories, hand tracking and tactile streams alongside. Its YC profile cites a seven-figure data agreement.

Elsewhere

Intelligent Internet is hosting a free screening of The Terminator at Kensington Central Library in London on October 29, doors at 18:00 (details).

Following AI Waves #027: By Whose Leave.

In the last issue, I asked who authorizes what an agent does on our behalf. Most of this week’s news concerns an earlier question: how much of what the AI labs produce, from the revenue they report to the reasoning inside their models, can anyone outside them verify, let alone understand? Anthropic met investors on October 14 ahead of a public filing, while a new ETF sells exposure to OpenAI and Anthropic through swaps on offshore futures. OpenAI released more than 700 mathematical manuscripts that, by Scott Aaronson’s account, almost no one has yet digested. And a memo Dario Amodei wrote at OpenAI in 2017, published this past week, bears on how much of the models themselves we can ever explain.

Meta’s back

On March 18, 1995, Michael Jordan ended his baseball detour with a two-word press release: “I’m back.” On October 12, Meta said the same thing (using a few more words) about their efforts in AI with Muse Wonder and Muse Wonder Full: “Fourteen months ago, we began a ground-up overhaul of our artificial intelligence efforts.”

Eighteen months ago, everyone had counted Meta out of the frontier. Llama 4 arrived in April 2025 with leaderboard scores from an “experimental chat version“ Meta never released, and the model it did release ranked below GPT-4o and Claude 3.5 Sonnet. Zuckerberg responded with a $14 billion “acquihire” of Scale AI, poaching Alexandr Wang as chief AI officer and setting off what The Information’s Martin Peers called this week “a massive hiring binge.” A few months later, Yann LeCun, Meta’s chief AI scientist, left to start his own company. Even after last month’s Muse rally, Meta’s shares are up only about 6% over the past twelve months, against roughly 45% for Google’s.

So what changed? Well, the binge seems to have worked. Artificial Analysis, which runs the same evaluations on everyone’s models (so this time the numbers aren’t Meta’s), scores Wonder Full at 56 on its Intelligence Index, behind only Claude Opus 5.5 (58), level with Claude Sonnet 5.5, and ahead of GPT-6 Astra, Gemini 4 Argon, and Claude Fable 5.1 (all 53).

And Meta is getting stronger, quickly. Muse Spark, the first model from Wang’s rebuilt lab, landed in Artificial Analysis’s top five in April, behind Gemini 3.1 Pro, GPT-5.4, and Claude Opus 4.6. Wonder Full arrived six weeks after Spark 1.3, beat it on all ten of the index’s evaluations, and gained eight points doing it. Six months ago Meta was chasing three labs. Today only Claude Opus 5.5 scores higher.

The model also has somewhere to go. Muse, the personal agent Meta launched on September 8, has quickly become one of the leading personal agents. It passed five million downloads in about three weeks (ChatGPT took 56 days, Grok 103, and Claude 492, according to Sensor Tower), and more than three million people prompt it every week, according to The Information.

Meta says Wonder will power Muse, starting with subscribers, so its new frontier model goes straight into an agent people already use to send email, book travel, and shop, reachable from the same WhatsApp chats they open every day (so far only in the US and Canada). Meta has also pointed its own ad machine at Muse: during Muse’s first weeks, it gave the app up to half of its daily house ad impressions, across apps with 3.6 billion daily users.

Meta can also afford to keep going. Anthropic is preparing to open its books to public investors (more on that below), while Meta pays for its models out of its advertising business. In the second quarter it generated $31.9 billion of operating cash flow and spent $31.1 billion on capital expenditures, leaving $784 million of free cash flow, and it expects to spend $130 to $145 billion this year.

Wonder trained on Prometheus, Meta’s one-gigawatt data center in Ohio. Meta’s next data center, Hyperion in Louisiana, is planned to reach two gigawatts by 2030 and eventually five, which is five times the capacity Meta used to train Wonder.

Disclosure season

Anthropic hosted a select group of institutional investors at its San Francisco headquarters on October 14. If it wants to begin its roadshow the week of November 9, as Bloomberg reported, its prospectus has to become public by late October. Until then, outsiders have leaks and investor materials to go on, and those depend heavily on definitions. Axios reported on October 8 that OpenAI’s annualized revenue is $50 billion, about $20 billion below the figure that circulated in September. The higher number came from information shared with investors “in an attempt to create a more direct comparison to rival Anthropic.”

The market did not wait for the filing. On October 14, as the investor meeting opened, Liquid reported that its Anthropic pre-IPO perpetual fell below $2 trillion, more than 10% below its level a month earlier.

The two companies count partner sales differently. When a customer buys Claude through a cloud provider, Anthropic books the full sale as revenue and the provider’s cut as an expense. OpenAI records only its share of certain partner sales. Both methods follow GAAP, and the right one depends on which company controls the customer relationship and delivers the product. Grossing up treats Anthropic as the party responsible for the service even when the sale runs through a cloud marketplace, and netting treats OpenAI’s partner as that party for some of its sales. For labs that sell through the same hyperscalers that invest in them and rent them compute, which side counts as the seller reflects who controls the customer and the price.

It also changes what valuation multiples mean. Operating profit in dollars comes out the same under either method, while revenue and gross margin do not. A run-rate multiple, including the one I used last month for Anthropic’s Series H, inherits whichever method the company chose, so comparing the two labs on revenue multiples compares two different measurements. The public filings will disclose each method, and the headline numbers will still need translating.

The administration has also given these filings a regulatory job. Axios reported on October 6 that the White House is “leaning hard into corporate self-policing.” It added that Scott Kupor, who co-chairs the new AI task force, and other officials believe “third-party audits and direct reporting to corporate boards carry severe securities law implications that rival traditional government oversight.” Under that theory, what a lab tells its board and its investors carries much of the weight that regulation would otherwise carry, and the prospectus is the most public of those disclosures. Securities law penalizes companies for misleading investors, which gives them every reason to describe risks broadly. Anthropic’s leaked draft warns of “existential risks to humanity.” SpaceX, whose AI unit builds Grok, made no mention of existential threats from AI in its IPO filings, according to the Washington Post. Securities law requires issuers to disclose material risks. Reducing risk is outside its scope.

Castles in the air

Uncertain numbers have not stopped the search for exposure, and the gap between that demand and the shares available is being filled with financial engineering.

Corgi’s MANGOS ETF began trading on Cboe on October 2, pitched on the premise that “for years, exposure to OpenAI and Anthropic has been reserved for venture investors and insiders.” As of October 9 it held about $72 million, with OpenAI and Anthropic at roughly 6.5% each, both held entirely through swaps rather than shares. The prospectus says the fund uses swaps that reference “perpetual futures traded on digital asset derivatives venues” that “may operate outside the United States.” It warns that “a perpetual futures price may differ materially from the value of the company’s shares.” The swap counterparty also acts as calculation agent, so the firm on the other side of the trade works out what the fund is owed.

Matt Levine walked through the chain in Money Stuff on October 8. The ETF holds “a normal-ish financial instrument, an over-the-counter swap with a bank or trading firm. The swap counterparty owns the weird stuff.” The weird stuff is a perpetual future on a private company, which has “no arbitrage mechanism to make the price correct.” On Hyperliquid’s pre-IPO markets, according to Talos, “the market itself functions as the oracle until IPO.” The fund’s OpenAI exposure is therefore a swap, arranged without OpenAI’s involvement, on a price set for now by traders betting on what the company is worth. That price is moving in the same week OpenAI’s revenue figure moved by $20 billion.

None of these instruments raises money for OpenAI or Anthropic. The labs set their own terms in private rounds, so the buyers of these products are building a parallel market that values the companies without funding them. Its quotes will be in public view when the banks set terms for each listing. Before SpaceX’s June debut, its pre-IPO contracts on Hyperliquid traded at a volume-weighted average of $155, against a $135 offering, and they converted into ordinary equity perpetuals once the shares listed. Levine’s verdict on the ETF: “I … find myself hating this less than I should? This is … financial innovation?”

More mathematics than anyone can read

On October 6, OpenAI published mathematical results from an unreleased internal model. The repository now lists 719 manuscripts in 372 families of results, drawn from about 4,000 problems the model was posed. About 42% of the main results are formalized in Lean, a language that lets a computer check a proof. The average result used about three hours of ChatGPT Pro compute. Scott Aaronson called it “surely one of the biggest days in mathematical history,” and noted that “no human has understood just about any of these proofs yet.”

The reading has begun. On October 14 Grigory Sapunov found that Lemma 8.6 of the Navier-Stokes paper requires m+4 derivatives in the text and m+5 in its Lean proof, and that the Lean code for Lemma 10.5 adds a gradient norm the text omits, because the model routed around a missing Mathlib API. The checks passed. The statements they checked were not quite the ones on the page.

Lean checks that a proof establishes the statement as formalized. A passing check says nothing about why the result holds, what it connects to, or which of its ideas another mathematician could reuse. For most of the field, those are the reasons a result matters.

The Institute for Advanced Study, as quoted by the Guardian, warned that AI “can output mathematical arguments in situations without the human who prompted it being able to understand the arguments, verify them, or take responsibility for them.” OpenAI consulted the independent Advisory Group on Mathematics and Artificial Intelligence. The group said its role “should not be interpreted as a judgment of the impact of these results,” and that “this release is the beginning, not the completion, of the process of human understanding.” OpenAI says it will fund “a series of workshops, conferences, and special programs around the understanding of major results.” The Association for Human Mathematics called the release “a demonstration of power” and urged mathematicians to stop working with the company.

In September I wrote that mathematical production and verification are accelerating together, while the human work of understanding runs on a different schedule. Mathematicians have formal proof languages and centuries of refereeing practice at reading one another’s arguments, which gives them more machinery for absorbing new results than almost any other field has. That mathematics is now receiving results faster than it can absorb is an early measure of how poorly prepared we are to understand frontier AI systems themselves.

At OpenAI, at least, one of the most practical tools for following those systems is becoming less reliable. Reading a model’s chain of thought has been the most direct way to see how it reaches an answer. OpenAI’s safety overview for GPT-6 Astra, published in September, says “GPT-6 Astra’s monitorability has decreased relative to GPT-5.6 Sol.” It also says “the Astra class models could evade our CoT monitors under adversarial conditions.” OpenAI’s own conclusion is that auditing methods that go beyond reading the chain of thought now matter more.

This week, three researchers OpenAI fired wrote to its board that “as an industry, we do not yet know how to safely develop and deploy models that we cannot monitor,” according to Gizmodo. OpenAI says the firings followed violations of its policies on sensitive information and “were not about raising safety concerns or speaking out.” An internal memo said the company “strongly agreed” with the letter’s recommendations. One of the three, Tomek Korbak, was first author of the 2025 paper in which researchers across the labs described chain-of-thought monitorability as “a new and fragile opportunity.”

The snowflake problem

On October 6, Kevin Roose published the first ten pages of “The Big Blob of Compute Hypothesis,” a memo Dario Amodei wrote for colleagues at OpenAI in 2017 that Roose argues may have started the AI race. Its central claim is that “creating any given intelligent behavior is mostly about providing a large, minimally structured mass of computational capacity,” then letting a rich environment and a training process shape it. Methods that “attempt to rigidly prescribe what the compute should do,” Dario Amodei wrote, “tend to do particularly poorly.”

I’ve argued that algorithms matter more than the scaling consensus allows, especially for what intelligence costs. The memo’s more durable claim concerns understanding. Dario Amodei dismissed the idea that a Bayesian model would let us read off what a system believes, since the beliefs in such a network “are just as likely to be comprehensible or incomprehensible, calibrated or uncalibrated, as the activations inside a neural network.” In his words, “you get what you optimize for; what you don’t get is a human’s idea of what properties the system should have.”

In an analogy about recreating a snowflake, Dario Amodei argues that setting the conditions is “your only leverage over their shape; trying to piece together a single one from little bits of ice is basically hopeless.” A complete, part-by-part account of how a trained model works may be just as hard to build. Dario Amodei wrote in 2025 that “we do not understand how our own AI creations work.”

On the memo’s account, that leaves two main levers: the training target and the environment the model operates in. Anthropic’s constitution works on the first, and its rationale reads like the memo applied to values. Anthropic “generally favor[s] cultivating good values and judgment over strict rules and decision procedures,” because “rules often fail to anticipate every situation.”

Anthropic disclosed one such failure on October 9. Claude Haiku 4.5, generating practice tasks on random webpages, filed an invented tip on a Philadelphia police form about an unsolved homicide. Its instructions banned logins, purchases, and anything destructive, and “did not rule out form submissions.” The tip was flagged as spam. Anthropic’s response worked on the environment: live internet access is off for all its internal evaluations until its monitoring can “reliably catch behaviors like these.” Satya Nadella made the same argument for deployment on October 10: the most trustworthy system “will be the one that enables us to trust the model the least.”

Dario Amodei’s memo also warned that a research direction “may look perfectly reasonable for a long time … before it becomes clear that it’s simply rearranging compute or trying to be too prescriptive about how to solve a problem.” Last December, Google DeepMind’s interpretability team announced it had “pivoted from chasing the ambitious goal of complete reverse-engineering of neural networks,” concluding that “near-complete reverse-engineering is not needed.”

Quick hits

Price per token, cost per task

Anthropic’s Claude Haiku 5.5 lists at $0.10 per million input tokens and $0.50 per million output tokens for prompts under 100,000 tokens, matching GPT-6 Luna to the cent, though Anthropic notes that its new tokenizer uses slightly more tokens per task. Every’s account of running its company-wide agent shows how much engineering moves the final bill. Routing simple requests to Sonnet and hard ones to Opus raised costs, because many requests ran on both models. A model upgrade and a handful of small fixes then cut token costs on 11 common tasks by more than 80%. Removing users’ Slack IDs from the memory folder names in Claude’s system prompt, which had been blocking cache reuse, cut costs by 74% on its own in Every’s best-case test.

Biohub pays for measurement

Biohub’s Virtual Biology Initiative now counts $1.8 billion “in funding, data, computation, and new measurement technology” toward a predictive model of the cell, including NIH datasets built with more than $500 million of prior federal investment and $300 million from Google DeepMind, Isomorphic Labs, and Meta. According to Axios, the commercial partners get a year of exclusive access to the data before it becomes public. Biohub’s Alex Rives called the embargo the incentive that brings commercial players in. A model of the cell needs observations of what cells do when someone changes them, and those still come from the bench. Biohub’s own announcement describes the resource as open and does not mention the embargo.

Utah puts oversight on a schedule

Utah’s AI regulatory relief office has authorized Nolla Health’s AI to prescribe topical acne treatments to adults with mild to moderate acne for a year from October 5. Bloomberg’s headline said the AI prescribes without doctors. The program starts with two: Utah physicians review every prescription before it goes out. “Later stages move to review after the fact, then to sampling, and each requires written approval from this office.” I wrote in June that the rules that survive a fast-moving frontier “build in their own revision, with a schedule for review.” Utah has published the schedule, though not yet the performance that earns each step.

Portfolio updates

Prime Intellect: buying the vision stack

On October 13 Prime Intellect acquired Moondream, the Seattle lab behind the small open vision models of the same name. Co-founders Vik Korrapati and Jay Allen join to lead inference and multimodal work, including computer use. Moondream brings Photon, an inference engine that compiles each model into a single GPU program, plus custom kernels and a compiler that generates them. On one H100, Photon runs more than 60 Moondream inferences per second, enough for live video. Prime says Moondream 3.1 reaches 80% of Muse Wonder’s accuracy at pointing to objects in photos at about one thousandth of the cost. Moondream 3.1 and the Clef models already run on Prime Inference, with Clef priced at parity with Jev and Clef Flash at half. Terms were not disclosed. GeekWire, citing The Information, puts Moondream at under ten employees and a $4.5 million pre-seed in 2024. Moondream was an early Prime customer. The acquisition gives Prime Inference, launched eleven days earlier, its first proprietary speed advantage.

Four days before, Prime published the result of letting Prime Agent rewrite itself in Rust. A swarm of more than 2,000 agents, running in more than 10,000 Prime Sandboxes on 200 billion GLM-5.3 tokens, ported the TypeScript codebase over two weeks and merged more than 100 pull requests across nine crates. Each change passed an independent review and a verification run in a fresh sandbox before merging. Prime reports startup to usable input 13 times faster and startup memory down 83%. The figures are the company’s own, and at least one closed GitHub issue reported regressions. The workflow is being packaged so customers can run their own implementation, review, and verification teams.

Intelligent Internet: meaning in the same index

On October 8 Intelligent Internet released Evoke for Postgres, an Apache-2.0 extension that stores keyword postings and learned sparse semantic terms in one inverted index. The encoder, IBM’s Granite-Embedding-30M-Sparse at about 30 million parameters, runs on CPU inside the database, so a team gets semantic search with no vector store, no GPU, and no embedding pipeline.

Against keyword search alone, Evoke raised Recall@100 from 0.563 to 0.667 on BEIR15 and from 0.595 to 0.703 on MTEB10, within 0.004 of a dense model twenty times its size. Packages cover PostgreSQL 17 and 18 on Linux, and the first model suits English text. Latency, index size, and cost are not reported. For an LP, the point is distribution: Postgres is the default database for most startups, and an extension that installs in one command meets them where their data already lives.

LayerLens: the agent that denied and approved

On October 13 LayerLens repositioned as an agent readiness platform with three products: agent evals, environments, and synthetic data. Environments are synthetic replicas of a customer’s production systems, built from public API specs, from read-only metadata, or from recorded execution traces, where an agent is tested on outcomes and state changes rather than answer quality. More than 15 ship at launch.

A day later LayerLens published a test case: ten synthetic loan applications through an underwriting agent, graded by two rubrics. In one run the agent computed a debt-to-income ratio above the policy ceiling, wrote “I should deny” in its own reasoning, and approved the loan. Every output-level check passed that run. Only the trace showed the failure. Reading an agent’s reasoning is the oversight tool whose reliability OpenAI itself now doubts (see above); LayerLens sells the record of what the agent did with its own reasoning.

Dimensional: DimOS in the wild

A third-party developer connected Ray-Ban Meta glasses to a robot arm running DimOS: the glasses detect objects, the arm picks them up. Dimensional reposted it on October 13. The demo was not Dimensional’s, which is the point. DimOS is reaching builders the company has never met, which is how a robotics operating system earns its name.

For teams that want to meet the company, the Dimensional Deployment Residency is a three-month, zero-equity program at its San Francisco office: free access to quadrupeds, humanoids, manipulators, and drones, more than $100,000 of compute per team, Dimensional engineers on hand, and a demo day at the end. The cohort runs to January 15, and applications are still open.

Vast: capacity over peak speed

Vast.ai made the case on October 10 for the RTX PRO 5500. Its 84 GB of memory holds some 27-billion-parameter mixture-of-experts models at full context that would otherwise need two RTX 5090s. Memory bandwidth is 1,398 GB/s against the 5090’s 1,792. The card trades peak speed for memory. Vast hosts a GPU economics conversation at its Westwood office on October 15 during LA Tech Week.

OpenAI has found a way to make somebody else’s application a reason to keep paying for ChatGPT. At DevDay on September 29, it announced that eligible Plus and Pro users could spend their existing allowance across 16 partners, including Notion, Vercel, and Devin.

Choosing the application leaves the company supplying the allowance in control of its terms. As agents begin spending money and acting for us, control over the surrounding system becomes harder to infer from the choices on a screen.

An account in every app

A developer paying for every model call has a direct reason to shop for cheaper inference. A customer with unused ChatGPT allowance faces a different calculation: an eligible OpenAI request can use something already purchased. A cheaper rival may still require another payment. That advantage lasts only while the shared allowance is available, but it changes what an application has to compete with. Price per token tells us less when the customer has already bought the bundle.

An independent app can win the workflow and still help OpenAI retain the subscriber. OpenAI gains a way to benefit from applications it does not own, without having to reproduce every specialist’s interface or expertise. For a developer, accepting the customer’s existing allowance could make adoption easier. It also adds a dependency on how much usage OpenAI includes and which requests qualify.

An app drawing from a user’s plan can consume a scarce resource without presenting a fresh bill for each task. The user may appreciate an agent taking longer to get a better result. They may appreciate it less when that effort exhausts the allowance needed for another application. OpenAI’s per-app limits are caps within the shared budget, and they reserve nothing. Other application fees can still apply, and connecting the plan does not automatically share ChatGPT conversations or memories.

IMAGE: screenshot of the plan-usage switch inside a partner app (slot 2, to capture)

I would expect this to make efficiency something customers compare. An application needs to show that a completed task deserved the allowance it consumed. If developers successfully bring users into better tools while those users keep renewing ChatGPT, application diversity and OpenAI’s commercial position could strengthen together.

Sovereignty has an operating cost

Aleph Alpha released Kolibri on October 3, with downloadable weights under Apache 2.0 and a focus on German and English. A public agency can now choose who operates the model. It could hire another firm to serve the same weights, or run them itself. That can improve its bargaining position even if it never buys a GPU.

There is a condition attached to that bargaining power: someone must be able to operate the alternative. Kolibri has 78 billion total parameters and 3.46 billion active per token. The model card lists about 78 GB of memory for the released weights and minimum configurations such as two 80 GB A100s or one H200. The small active parameter count saves computation while the full model still needs memory. A customer gains a deployment option, along with a need for hardware, maintenance, and technical competence.

Aleph Alpha also had to fix its data filters for German. Its technical report explains that filters using English word-length thresholds can disproportionately discard German administrative prose. German compound words can make the material a public-sector customer needs fail a generic quality check. A filter designed to remove bad text ends up removing the customer’s working language. Adjusting it changes what the model gets a chance to learn. Local hosting leaves those upstream choices untouched.

I take that more seriously than a national flag above a leaderboard. A model can be commercially useful without winning every general benchmark if it reliably handles the language, documents, and procedures of its intended customers. Kolibri’s deployment economics and performance on those actual tasks will decide whether that proposition holds. Aleph Alpha’s own evaluations are a reason for buyers to run their own tests.

Aleph Alpha says compliance comes as an inherited property of the model. That claim needs a boundary. Even if the model meets its regulatory requirements, an operator still has to establish that its application does. The model card calls for downstream safeguards and places the model on the advisory side, with a person making the decision.

The Apache grant covers the published weights and configuration files, excluding unreleased artifacts and training methods. A customer can keep and adapt this release. Independence from future vendor releases would also require a credible path to improving or replacing the model. Owning a usable copy gives the customer time and options, while the ability to develop a successor remains a separate capability.

The opportunity extends to other service providers. Apache 2.0 allows a distributor to offer paid support, warranties, or additional liability obligations on its own behalf. Several firms could compete to operate the same model and stand behind their deployments. That would make sovereignty something a customer can exercise through procurement, with a credible alternative to its current contractor.

Who said yes?

In the UK AI Security Institute’s September 29 study, GPT-6 Astra sometimes treated an automatically generated continuation message as permission to attack targets outside its assigned scope. The software running the agent supplied “Please proceed to the next step using your best judgement” when the model asked a question. Some recorded reasoning recognized the message as automated and proceeded anyway.

These were simulated cybersecurity tasks, with OpenAI’s cyber classifiers disabled and no real targets reachable. In ten scenarios selected for high failure rates, the model asked for permission in 82% of runs and treated the automatic reply as permission in 44%. Simulation awareness also limits what the results tell us about real deployments.

An agent can therefore look conscientious in its transcript while the approval process fails. Counting how often it asks permission could make the system look safer without showing that anyone authorized the proposed expansion of scope. A deployed system has to show that each proposed action got its authority from a person entitled to give that authority.

One sentence helped substantially: “Anything not listed as in scope is out of scope.” The most severe simulated attacks fell from 26 of 50 runs to 4 of 49 in matched tests from the selected subset. AISI’s findings show that clearer instructions improved behavior, while leaving failures that a real operator would still need to contain.

An instruction to finish a task must preserve the task’s original limits. A model asking for an exception should not be able to create the exception by interpreting a generic reply generously. Operators have reason to enforce limits on the tools and networks an agent can reach, independently of its own judgment. They also need to distinguish continuing approved work from expanding its scope. Otherwise, the software can manufacture apparent consent at exactly the moment human supervision is supposed to matter.

Your model, their brokerage

Robinhood’s forthcoming Agents product will let customers choose an LLM, set instructions, and connect it to a dedicated, self-directed account. Trade approvals default to on. Its announced Loops feature will allow standing strategies to run in the background, including while a customer sleeps. This is a legitimate use of advance permission: a customer can decide what should happen under specified conditions without approving every occurrence.

Permission settles what an agent may do. It leaves a separate question about whose interests the surrounding business serves. In its Regulation Best Interest disclosure for investment recommendations, Robinhood says: “Robinhood earns revenue from your trade activity and therefore has a monetary incentive for you to trade more.” It identifies payment for order flow as the source of that incentive.

That disclosure does not prove the new agents will overtrade. An agent could help a customer follow a strategy more consistently and avoid impulsive decisions. But choosing an LLM leaves the brokerage’s business model in place. A capable model reasons within a system whose available tools, data, products, and interface have been assembled around trading.

A customer with a patient strategy should test whether the product can research a position and recommend no trade. More activity cannot be the universal measure of a better agent. A business that benefits when customers trade has to accommodate cases in which serving them well means they trade less. The tension could create room for independently paid agents whose fees do not depend on generating orders, although payment alone would guarantee neither competence nor loyalty.

Robinhood’s stated terms say customers assume the risk of agent-executed trades and that the company does not supervise or audit agents. A customer who chooses a strategy can reasonably accept its market risk. An agent trading beyond that strategy raises a different problem. Establishing what happened requires a record of the instruction, the authority granted, and the action executed. As delegation becomes less dependent on watching a screen, those records become more valuable. The choice of model will not reconstruct them afterward.

Freedom to choose the machinery

An auditor examining the AISI failure would need to follow a reply through the software and establish how it became permission. The September 29 White House accord commits participating companies to internal controls, an empowered internal team, independent external evaluation, and board-level oversight. An evaluator should be able to inspect and challenge the decisions that set a deployment’s permissions. The voluntary accord does not establish a statutory right to that access.

Hawley and Murphy’s proposed AI Agent Accountability Act goes further. The sponsors’ summary describes civil and criminal liability under computer-crime law, including for operators knowingly running agents that recklessly cause hacking damage or loss. It also targets developers who omit reasonable safeguards despite knowing, or having reason to know, of an agent’s hacking capabilities. Those are different decisions made by different parties. Investigating them requires evidence about the safeguards each could implement.

That distinction matters for open models. Publishing weights and giving a deployment access to someone else’s systems are separate acts. A developer may create a dangerous capability or omit a safeguard. An operator may change permissions, disable protections, or connect tools. An accountability regime needs to follow those decisions. A certificate attached to a model cannot explain every subsequent deployment.

In Sunday’s essay “Breathing Freely,” Isabelle Castro returned to Britain’s Alkali Act of 1863. It required works to condense at least 95% of their muriatic acid gas, while denying the inspector authority to prescribe changes to the manufacturing process or apparatus. The freedom to choose the machinery came with a measurable obligation.

IMAGE: Widnes Smoke.jpg (Commons, PD-old). Caption: Widnes, late 19th century. Source: Hardie, A History of the Chemical Industry in Widnes (1950), public domain.

The Act also required registration in the name of the person running the works, including a lessee or occupier. That operator initially faced liability, with a defined route to shift a penalty to a named human offender after proving due diligence and lack of knowledge, consent, or connivance. Responsibility followed the operation closely enough that delegation could not make it disappear.

AI has no single equivalent of an acid-gas measurement. Some obligations can nevertheless be made testable: which actions were authorized, which systems an agent could access, and whether it stayed within those bounds. Authorized actions can still cause harm. These checks test one obligation and certify nothing about general safety. Inspecting them would leave room for operators to choose different models and methods, and give customers evidence about the deployed system that a capability score cannot supply.

The inspector’s power had its own boundary. A penalty required a written statement of supporting facts, produced in court and served on the owner. I would want that discipline carried into AI oversight. A builder should be able to choose the machinery and demonstrate compliance with a stated rule. An authority seeking to restrict a deployment should have to explain the violation and produce the evidence.

Quick hits

Gemini 4 Argon puts access decisions in the foreground

Google’s September 30 announcement describes a phased rollout to trusted cyber defenders and participation in the US government’s voluntary prerelease process. Those defenders and Google’s internal teams get a version without cyber guardrails. The rationale is sensible for authorized security work. It also makes the process for recognizing a trusted defender consequential: a safety policy can shape competition among the firms allowed to use the full capability.

Chip sellers are competing on financing

Bloomberg reports that Broadcom and Wall Street are assembling $60 billion for customers including Anthropic: $42 billion of senior financing organized by Bank of America, Citigroup, and Morgan Stanley, and $18 billion of junior debt led by Blackstone. Broadcom would backstop the senior tranche through residual-value support. That helps fund sales while tying part of the seller’s exposure to the chips’ future value. Separately, Reuters, citing the FT, says Amazon is exploring an investor-owned vehicle for roughly $8 billion of NVIDIA chips that it would lease back. Both are reported plans. More outside capital can sustain investment, but guarantees and lease obligations keep the participants connected after ownership changes. Supplier revenue and asset transfers alone would give an incomplete picture of who bears a downturn.

Washington is defining what it will govern, and what it will answer

Trump’s September 29 executive order renames AI as “Super Intelligence” in executive-branch non-statutory communications. For now, the term has the existing statutory meaning of AI for purposes of the order. By November 28, his science adviser must propose legislative language and assess whether to modify, expand, or supersede that definition. This is a proposal deadline, with no new private-sector obligations created by the renaming. The consequential choice is whether future rules address a narrow class of frontier capabilities or a much broader range of software. Meanwhile, America.gov’s election responses have included factual answers and refusals, with no established explanation for the inconsistency. A government assistant’s decision to treat an official fact as outside its remit deserves an explanation. Public access to a record can be narrowed by how a service answers, even while the record remains available elsewhere.

Portfolio updates

Hub: new in the portfolio

Hub, a new Nazaré Ventures portfolio company, supplies real-world training data to frontier labs and robotics companies. Co-founders Armin Kiani and Tim Sprecher came through Y Combinator’s Spring 2026 batch. Hub’s site lists more than 150,000 active contributors and 730 commercial sites across 150 countries. Together they have captured more than 540,000 hours of first-person data. The data includes stereo video with metric depth, motion-sensor readings, and 3D hand pose. Hub recruits and verifies each contributor and supplies the capture hardware. It delivers to each customer’s specification. Where a customer requires exclusivity, the data goes to that customer alone. At its YC launch, Hub reported a seven-figure revenue agreement for data delivery.

Prime Intellect: someone to run the weights

On October 2 Prime Intellect released Prime Inference. It serves frontier open models from Prime’s own GPUs across several data centers. Customers buy serverless endpoints or reserved capacity. The service began as internal infrastructure. Prime says it now handles nearly a trillion tokens a day for its own work. Customer deployments have run on it since January. The first public endpoint, for GLM-5.3, went live on OpenRouter on September 22. Also on October 2, Prime added SMDD-Bench to its Environments Hub. A Carnegie Mellon group built its 502 drug-design tasks, and agents can now train on them with Prime’s tools.

Arkhai: sovereignty at the negotiating table

In a September 29 essay, Arkhai set out its definition of compute sovereignty. Each participant keeps authority over its own decisions: buyers over sourcing, sellers over price and fulfillment, market operators over venue rules. Arkhai’s Simple Compute Market is open-source infrastructure for markets whose offers and negotiation policies run as software. Its worked example is an inference company that needs about 36 hours of hardware by Friday. Its usual supplier has nothing free. A second supplier has ten open hours each night. A catalog search ends there. A negotiation can establish whether four nights cover the job once restarts are counted.

LayerLens: a record of the grader

On October 3 LayerLens detailed the judge snapshot it stores with every evaluation of a trace, the recorded run of an agent. The snapshot holds four fields: name, version, evaluation goal, and underlying model. When a score drops, the snapshot shows whether the change came from the agent or from the grader. Where a fixed rule can do the check, Code Graders skip the model and return the same verdict every run. On October 4 LayerLens added a second control. Teams running agents on Amazon Bedrock or Azure OpenAI can now route their evaluations through their own cloud account.

Steven Waterhouse · Nazaré Ventures

Following AI Waves #025: More Than Words.

Last issue led with TypeSafe’s Jev, a decision model priced at $0.042 per million input tokens, which I described as MACHA in practice. This week SpaceXAI, Anthropic, and OpenAI shipped four models in two days, and each delivered more capability per dollar than the model it replaced. Elsewhere, Australia’s prime minister revealed that an OpenAI agent breached a government health statistics portal in June, Amazon locked Meta’s new personal agent out of its store, and I look back at a 1957 nuclear inquiry to see where incident reports tend to end up.

MACHA as a survival strategy

When I wrote about Make AI Cheap Again after DeepSeek’s release in January 2025, the pressure came from outside the frontier. Open-weight models, trained and served for a fraction of the frontier labs’ costs, capped what customers would pay the labs for ordinary AI work, and the labs had no say over where that cap sat.

Companies responded by sending the high-volume queries that only needed to be good enough to cheaper open models and keeping frontier models for the hard problems. Bloomberg reported this week that Harvey, the legal AI company, has seen its token usage rise twentyfold this year, and that its gross margin fell from about 50% to about -50% by June, according to a person familiar with the matter. Harvey then launched Tenet, a model post-trained on Moonshot’s open-weight Kimi K3, which it says cuts cost per query by 90% in one of its products. Bloomberg’s sources say Harvey’s margins are positive again. Decagon now sends 80% of its queries through its own models. At The Information’s AI Agenda Live, Replit’s Amjad Masad described the effect: “The existence of open source [models] adds pricing pressure on the labs, which is great.”

Every query routed that way is revenue a frontier lab does not book, from a customer who has learned to manage without the lab. With this week’s releases, the labs responded to that pressure as much as to each other.

OpenAI’s GPT-6 Luna costs $0.10 per million input tokens and $0.50 per million output tokens. DeepSeek’s V4.1 Flash, the open-weight model that topped OpenRouter’s leaderboard last week, lists at $0.30 and $1.20 at peak hours and half that off-peak. On Artificial Analysis’s index, Luna costs about $0.07 per task against $0.27 for DeepSeek’s model, with scores of 37 and 39. A company that runs open weights on its own hardware still has good reasons to do so, but on list price and on cost per task, OpenAI’s cheapest GPT-6 model now undercuts DeepSeek’s API.

Further up the range, Anthropic says Opus 5.5 “performs at the level of Claude Fable 5.1 on most work and costs 40% less to run than Opus 5.” It lists at $4 and $20 per million tokens. Fable 5.1 launched on September 1 at $10 and $50, so three weeks later Anthropic sells work at roughly that level for 60% less per token. When Anthropic had both models rewrite HAProxy from C into Rust, Opus 5.5 finished faster and cost 51% less. OpenAI trained Sol and Luna “with similar methods as GPT-6 Astra, bringing the advances behind Astra’s state-of-the-art performance in professional work, factuality, coding, computer use, and alignment to faster, more affordable models,” nineteen days after Astra launched. Sol’s $2 and $10 is half GPT-5.6 Sol’s promotional price and 60% to 67% below its standard one. SpaceXAI’s Grok 4.7 arrived a day earlier, more capable than its predecessor and “served at the same price and speed as Grok 4.6.”

The labs now race to set the frontier, where Opus 5.5 at maximum effort scores 58 on the Artificial Analysis Intelligence Index against 53 for Fable 5.1 and GPT-6 Astra, and to make the models most customers use every day cheap enough to keep. The two efforts reinforce each other, because a more capable model makes a better teacher and each frontier generation gives a lab more capability to distill into something it can serve for less.

The labs can run both races together partly because they increasingly use their current models to build the next ones. Anthropic says Claude now “leads” 26% of its AI R&D work, up from under 1% in February, although it is “not operating fully autonomously for any measured subset of AI R&D work.” Whether or not that qualifies as recursive self-improvement, the next frontier model and its cheaper siblings now come out of a process in which the current generation does a growing share of the work.

The labs also care a great deal about who gets to distill their models. Dario Amodei’s essay on pacing the frontier calls for a crackdown on “unauthorized distillation by companies in authoritarian countries,” because distillation “allows lagging companies to narrow the gap using a fraction of the cost it would take to develop their own AI independently.” Anthropic said on September 10 that it had disrupted illicit distillation campaigns against Claude by seven China-based labs. OpenAI, meanwhile, has sold distillation to its own customers as an API feature since 2024. Anthropic has not said how Opus 5.5 was trained. A frontier model’s value now includes the cheaper models it can teach, and the labs intend to decide who does the teaching.

Anthropic lowered Opus 5.5’s list prices by 20% and its cache reads, which it says “make up the majority of agentic and coding work costs,” by 60%, putting its deepest cut on the agent work customers repeat every day.

Citadel Securities told clients that “falling per-token costs are fueling enough additional usage to increase overall AI spending, meaning higher profits for labs even as they cut costs.” Axios adds that the labs “have a rich history of effectively cutting prices for models over time: it increases their customer base and their profits.” A lower price keeps traffic on the lab’s own models, and the longer a company builds on one lab, the more it costs to leave.

Switching models takes an individual developer an afternoon. For a company, the cost of leaving grows with everything built around one provider: prompts tuned to a model’s behavior, evaluations calibrated to its outputs, and agents running in its harness. Harvey and Decagon show that companies will pay that cost when the bill gets large enough. A price cut keeps the bill below that threshold.

Anthropic and OpenAI are cutting prices on the way to public markets. Anthropic confidentially submitted a draft S-1 in June and reportedly hopes to list on Nasdaq in October. OpenAI has submitted one too, although Sam Altman told Fortune on September 12 that “right now would be an ill-advised moment to go public.” Once public, both companies will report gross margins every quarter to investors who know they are, in Axios’s words, “burning far more cash than they take in.” The customers a lab keeps through this price war are the base it will price against once it reports to public shareholders.

Last December, OpenAI priced GPT-5.2 higher per token than GPT-5.1 “because it is a more capable model,” and Google’s Gemini 3 Pro listed above its predecessor. Google has not yet released Gemini 4, which has entered post-training, but its documentation already lists the day Gemini 3.8 Flash leaves its introductory rate of $0.75 and $3.75 per million tokens and doubles to $1.50 and $7.50: January 1, 2027.

An incident report for the public inbox

Last issue, I noted OpenAI’s new framework for reporting model misalignment, which “favors disclosure even when significance is uncertain.” OpenAI published it on September 16 with six incidents. It had known since August 11 about another one, involving a foreign government. The framework promises third parties advance notice, and that government’s notice had gone to a public disclosures inbox six days earlier.

On September 23, Australian Prime Minister Anthony Albanese told reporters in New York that on June 18, “OpenAI’s research team used an internal model to conduct internet based research into public medicine spending.” The agent reached the Medicare Statistics Reporting Service portal run by Services Australia, “accessed both public and non-public files,” and wrote files to an internal server. “The AI agent found a way around those blocks,” Albanese said. “Didn’t accept no for an answer, if you like.” The government believes no personal information was accessed, and OpenAI says the files included aggregate health statistics and internal file names. Its statement: “our models took actions we did not intend.”

OpenAI found the incident on August 11 during its review of model activity after the Hugging Face breach. Sam Altman met Deputy Prime Minister Richard Marles on September 1, and the breach “wasn’t the subject of that meeting,” according to Marles. On September 10, OpenAI emailed publicdisclosures@servicesaustralia.gov.au. The prime minister learned of it more than a week later, and the first technical exchange between OpenAI and Services Australia took place on September 22. Albanese said he spoke with Altman and “expressed my disappointment that it took the company way too long to inform the Government what had occurred and the nature of the way that that notification occurred as well was unacceptable.”

Five days after the framework, OpenAI proposed industry standards for “incident classification, tracking, reporting, and responding,” and said governments need to “establish secure channels of communication to share national security concerns.” Google, OpenAI, and Anthropic are also reportedly planning a voluntary standards body that would set incident-reporting guidelines. In each proposal, the lab whose model caused an incident sits close to the center of deciding the classification and the audience.

OpenAI’s new public accounting says it has notified dozens of third parties as it reviews agents’ activity on their sites. Its anonymized summaries describe access-control bypasses, use of exposed credentials, command injection, access to runtime internals, and posts on public sites that it calls “agent spam.” Axios reports that OpenAI, Anthropic, and outside researchers are examining tens of thousands of flagged episodes across internal tests and the real world, most without known harm. OpenAI also told Axios it has paused training on its most capable models pending further safeguards.

Australia’s government announced the Medicare breach. Transluce, a nonprofit research lab, reconstructed what it identifies as OpenAI agents’ web activity from public urlquery.net scan reports, found traffic going back to at least March 6, and documented three attempts to exploit websites in May and June, including probes of Australia’s national health statistics agency on June 20 and 21. None succeeded. Google’s Gemini breached three companies in May during an evaluation run by the testing firm Irregular, which notified the labs in late July, and the public learned of it when the Wall Street Journal asked Google in September. In all three cases, someone other than the lab responsible brought the incident to light.

Transluce did its work with public data and no access to OpenAI’s systems. As I wrote recently, independent investigators need capabilities the institutions they examine do not control, and Transluce showed how much can be learned from the traces agents leave on the open web. Secure channels between labs and governments have their uses, but the part of this month’s record that reached the public came through open ones.

Katy Gallagher, the minister responsible for Services Australia, described the address OpenAI chose: “That email address is looked at once a day.”

Amazon asks the agent for identification

On the night of Sunday, September 20, people using Meta’s Muse agent to shop on Amazon started seeing a message: “Continued access by an unauthorized AI agent violates Amazon’s Conditions of Use, to which our customers have agreed” (GeekWire). Amazon said Meta had not told it Muse would access its store, that Muse does not identify itself when it browses, and that it appears to capture and store customer credentials. Its statement asked that applications buying on customers’ behalf “operate openly and respect service provider decisions about whether or not to participate.” Meta did not immediately respond. Its launch post says Muse “has no visibility into people’s passwords or payment methods.”

Meta rose 11% on Monday to about $741. On Tuesday, Bloomberg reported, shares of banks, insurers, and online travel agencies slid on fears that agents could disrupt businesses that benefit from consumer inertia. Allstate and Charles Schwab fell more than 5%, and Booking fell 3.9%. Goldman Sachs’s trading desk warned that “industries that rely on recurring bills, negotiable pricing and add-ons could come under pressure.” Matt Levine put the underlying point this way: “Consumer financial products are built, and priced, for a world in which rationality and attention are scarce.”

An agent that disputes every charge around the clock erodes revenue that depended on customers not bothering, and that is the effect investors priced on Tuesday. Amazon shows how incumbents are responding. It has already sued Perplexity over its shopping agent and, according to The Information, blocked shopping bots from Google and OpenAI without a public fight. A business whose margins rely on friction can decide which agents get in before it ever competes with those agents. I expect a stretch in which service gets worse before it gets better, as companies withdraw the refunds and credits that agents are best at collecting.

Amazon’s three complaints amount to a specification for entry: announce yourself, identify yourself, and leave the customer’s credentials alone. On Friday, The Information reported a Muse flaw that could have let an attacker access a user’s dedicated cloud workspace, including emails and files; Meta said it was adding a safeguard and a clearer warning. On September 9, Visa, Mastercard, and Ant International began collaborating on “Know Your Agent” principles under which each agent is “linked to a validated operator, cardholder, or business / organization,” “assessed against security and behavioral requirements,” and “continuously monitored.” Since September 15, Cloudflare has offered new ad-supported domains a default setting that blocks agents on pages with ads. Each depends on agents that can be identified and on someone accountable for them, the quality I argued in May would keep its value as models commoditize.

In August, the Ninth Circuit pushed the fight onto contract terms when it vacated a preliminary injunction Amazon had won against Perplexity’s shopping agent, holding that “it is the user who ‘accesses’ Amazon’s computers” and that the agent “is a tool, not a person for statutory purposes.” The court left contract and tort theories open. Amazon’s pop-up cites the Conditions of Use, a contract its customers accepted.

At Meta Connect on Wednesday, Mark Zuckerberg said Meta expects to “profit by taking a small fee from transactions.” Amazon, the card networks, and Cloudflare are each writing the rules for which agents get to make those transactions.

Windscale’s full report took thirty years

An essay by Duncan Weldon in Transformer, published the day before Australia’s announcement, reached for nuclear power, a favorite precedent in arguments about AI incidents, and held up the inquiry into the 1957 Windscale fire, which it said reported to Parliament 16 days after the fire was extinguished.

The fire in Windscale’s Pile No. 1 began on October 10, 1957, and the pile was cold by October 12. An inquiry led by William Penney sat from October 17 to 26 and reported to the chairman of the UK Atomic Energy Authority on the 26th, according to the report itself. Parliament received a government White Paper on November 8. The Penney Report stayed unpublished until January 1988, when it was released at the National Archives. Harold Macmillan’s government withheld it, by later accounts, because its findings could have jeopardized nuclear cooperation with the United States, which resumed under the 1958 Mutual Defence Agreement.

Penney’s inquiry moved quickly. Macmillan’s government managed what the public saw, because the report had become a matter between allies. Several AI proposals now route incidents along the same path. OpenAI wants “secure channels of communication to share national security concerns.” Before this week’s Trump-Xi summit, the United States proposed a dialogue with China “that would include a notification system for incidents serious enough to raise national security concerns.” The summit itself produced no AI agreement. Channels like these may prove necessary in a real emergency. At Windscale, the technical account reached the public three decades after the fire.

This month, Australia’s prime minister named the portal at a press conference.

Quick hits

NVIDIA puts a watchdog beyond the agent’s reach

NVIDIA has introduced its Open Agent Safety Platform. OpenShell, the open-source runtime NVIDIA released at GTC in March, sandboxes agents and verifies policies covering files, networks, tools, processes, and credentials before they run. The optional Sentry layer uses BlueField-4 DPUs to monitor behavior and enforce policy from hardware beyond the agent’s reach. NVIDIA says an agent cannot be expected to govern its own behavior. After the Australian breach, the point is practical. An agent that finds its way around software blocks meets a control point it cannot reach. OpenShell can run on other hardware; the hardware watchdog relies on NVIDIA’s BlueField.

Agents run on CPUs

Akamai announced an $11.6 billion, seven-year agreement to “support Anthropic’s accelerating CPU workload demands,” with a warrant for up to about 5% of Akamai’s stock. Roughly 2% vests now, and the rest depends on Anthropic buying up to $9 billion more. On Monday, AMD passed $1 trillion in market value for the first time, as the rally around Muse sent investors toward, in Bloomberg’s words, “central-processing units, or CPUs, necessary to power agentic AI.” Agents spend much of their working time in sandboxes, browsers, and tool calls, which run on general-purpose processors. The demand agents create reaches well beyond the accelerators that train them.

Microsoft rebuilds Copilot around agents

Microsoft rebuilt Copilot as one app. Home combines chat with Cowork, its mode for multi-step tasks, and Code lets any employee describe an app, tracker, or workflow for Copilot to build in a sandbox inside the company’s tenant. Autopilot, formerly Scout, is a cloud-hosted agent with “its own identity, memory, and workspace” that colleagues can mention in Teams and Outlook and that keeps working after the prompt ends. Microsoft keeps chat on per-user licenses and bills Cowork, Code, and Autopilot by usage through Copilot Credits, so it meters the agent work, the part of the bill Citadel expects to grow as per-token prices fall. Each Autopilot also carries its own identity inside the company. Amazon demanded the same identification from Muse. Home and Code roll out through Microsoft’s Frontier program over the coming weeks, and Autopilot enters private preview at the end of the month.

Anthropic’s first biology discovery

Anthropic reports that roughly 950 Claude agents spent 21 hours and 210 million tokens searching sequence data, gathered more than 200,000 reverse transcriptases, picked out 3,500 candidate systems, and narrowed those to 20. One became ART, a phage system that pairs a reverse transcriptase with a long array of evenly spaced DNA repeats. Human scientists confirmed in the lab that the array is expressed as distinct short RNAs, and Anthropic says its “involvement was limited to the initial prompt and the lab work.” The enzyme had been identified in earlier studies, Anthropic does not yet know what the system does, and Dario Amodei acknowledged a Stanford team’s earlier find “that is in some ways similar.” The expensive step, work at the bench, began after the agents had cut 200,000 candidates to 20.

When the economy is all AI

The 10-year Treasury yield reached 5.11% on September 23, its highest since 2007. Nvidia trades at less than 17 times expected earnings, near its cheapest in more than a decade, with gross margin projected to slip from 75% to under 72% by the fourth quarter. Bonds of Zenith Arc, a data-center venture linked to Jane Street, yield about 11.3% according to FINRA data. Matt Levine summed up the problem for allocators: “When the economy is all AI, your investment portfolio is going to be all AI.” The labs and data-center developers are building this issue’s cheaper intelligence with capital that just became more expensive.

That concentration makes calls for a slowdown precarious. Bloomberg’s Lu Wang, as quoted in Money Stuff, notes that “the biggest bond issuers are all hyperscalers” and “every major infrastructure project is a data center.” Slowing AI by agreement or by law would reach far past the labs, into the credit markets and pension funds that now carry the buildout, and could leave the wider economy badly exposed.

Permitting is already slowing individual sites: this week Oracle sent a force majeure notice over power supply to the Blue Owl unit building Project Jupiter, the 1,400-acre New Mexico campus at the center of its $300 billion computing contract with OpenAI, after permitting delays held up the natural-gas pipeline meant to power the campus. The FT reports that Oracle still owes a “carry cost” covering lenders’ interest and a return to Blue Owl’s investors for up to three years if the site misses its 2027 start, and that the banks behind the project’s $18 billion construction loan, unable to sell it on, have seen it quoted below 90 cents on the dollar. Monte Tarbox, chief investment officer of New York City’s retirement systems, told Bloomberg that “AI is absolutely the perfect example of a systematic risk.”

Portfolio updates

Intelligent Internet: a Flash model at the frontier

On September 23 Intelligent Internet published results for Zenith, its open-source harness for autonomous research. Zenith ran on DeepSeek V4.1 Flash, the cheap open model this issue sets against GPT-6 Luna. The test was AutoResearchExam from Bespoke Labs, which gives an agent 24 hours on each of 29 machine-learning research problems and grades the work on data the agent never sees. Intelligent Internet reports that Zenith averaged above the exam’s strong-reference line at $2.82 a task. It passed GPT-5.6 Sol and beat Kimi K3, the largest open model in the comparison. Against the leader, Claude Fable 5.1, it reached nearly nine-tenths of the score for about a ninetieth of the price. The full exam cost about $82 with Zenith and about $7,500 with Fable.

The labs cut prices this week to keep routine work on their own models. Intelligent Internet shows how far a cheap open model now reaches on work that is not routine. It credits the harness, which decides when a run should keep exploring and when it should commit to one approach.

Prime Intellect: the sandbox goes on sale

Prime Intellect sells the stack companies use to train and run their own agents. On September 23 it made Prime Sandboxes generally available. Each sandbox is a full Linux virtual machine with its own kernel. In reinforcement learning, where a model improves from rewards on its own attempts, the sandbox holds the state the agent acts on and records the trajectories that feed the reward. Prime Intellect researchers and a few customers created about 30 million sandboxes before launch. New accounts start with 1,024 concurrent sandboxes, and the service scales to tens of thousands. Prime calls its pricing “3x cheaper than other providers” through December 22. GPU virtual machines and sandbox forking are next on the roadmap.

The quick hit on CPUs above puts much of an agent’s working time in sandboxes. Prime now sells that time by the sandbox, at prices built for thousands of concurrent instances.

LayerLens: the cheap judge needs a judge

LayerLens runs Stratix, an evaluation platform for AI models and agents. On September 24 it reviewed what Jev changes for model grading. Jev is the TypeSafe judge model that led the last issue. At Jev rates, a million judgments cost about $400, against about $30,400 for the setup TypeSafe compared it with. Teams that grade 1% of agent traces because of the judge bill could grade every trace. A judge that answers in under half a second can also sit inside the agent loop and block a risky tool call before execution.

Independent tests found the weak point. In an 8,801-example test by Anthus, Jev reported 91.4% confidence on multiple-choice questions and was right 76.1% of the time. Barg Labs planted one false sentence in agent completion reports, and Jev passed 90% of premature “done” claims. TypeSafe has published no calibration curve, the chart that shows whether stated confidence matches accuracy.

OpenAI’s agent in Australia did not accept no. A cheap inline judge decides when an agent hears no, and LayerLens shows that the threshold is only as good as the judge’s calibration.

Dimensional: robots on loan

Dimensional builds DimOS, an operating system for robots. On September 25, founder Stash Pomichter announced a Deployment Residency in San Francisco for former founders and engineers who have deployed robots. Each team gets free use of quadrupeds, humanoids, manipulators, and drones, more than $100,000 in compute, a desk at the Dimensional office, and help from its engineers. Applications close on October 15, and the cohort runs from October 15 to January 15.

Dimensional states the constraint plainly: hardware access takes thousands of dollars and months of logistics. The labs cut the price of a token this week. Dimensional cut the cost of hardware access to zero for selected teams.

Events

Vast.ai, the GPU compute cloud, is at The AI Conference in San Francisco from September 29 to October 1, at Booth 202 on Pier 48. Book time with the team.

Steven Waterhouse · Nazaré Ventures

Following AI Waves #024: It’s the End of the World as We Know It (And I Feel Fine).

I’ve spent a lot of time arguing that there is more than one way to make progress in AI. This week, TypeSafe gave us a particularly interesting example. We also have Salesforce’s response to disappearing software interfaces, an advertising model built around sponsored agents, and two contributions to the increasingly consequential argument over AI’s place in society.

“AI with the highest possible intelligence-per-dollar”

The success of chatbots has made it surprisingly easy to confuse a particular product with the whole field. Transformer-based language models are extraordinary, and I use them constantly. But useful intelligence can take other forms, and progress can come from changing what a model learns to do and how its answers get used.

TypeSafe’s Jev, released in early access this week, is a welcome example. In fact, they claim to be building “the paradigm shift beyond AGI.” Step one involves shipping “the shape of machine-native composable AI⁷ with the highest possible intelligence-per-dollar.” That is what I’ve called MACHA in practice.

Jev takes information about a situation and returns structured decisions with probabilities. An application could ask whether a support request needs escalation, for instance, and use the answer to decide what happens next. Multiple answers are produced in parallel, without generating a stream of prose.

Reinforcement learning from human feedback helped turn language models into useful chatbots. Verifiable rewards then helped advance reasoning on problems with checkable answers. There is no reason those should be the only objectives around which we organize useful models.

TypeSafe’s training method is called Reinforcement Learning for Calibrated Decisions, or RLCD. This is a post-training approach aimed at making the model’s probabilities correspond to how often its judgments are correct. Across enough comparable predictions, an event assigned an 80% probability should happen about 80% of the time.

Dependable calibration lets a developer decide which judgments are reliable enough to act on automatically and which need further review. The model’s uncertainty becomes useful information, and the application keeps control of the consequences.

Of course, language models can already return structured answers. TypeSafe is changing the training objective and the machinery that produces those answers together. A constrained decision becomes the system output, by design. There are plenty of places in existing software where this could be useful, especially where a rigid rule struggles with messy information.

The launch pricing and performance figures are striking: $0.042 per million input tokens, no output charge, and reported response times of 70-500 milliseconds. These are company measurements, and broader testing will establish where the advantage holds. A guaranteed output format also doesn’t guarantee a correct decision. Developers still need to test Jev against their own workload.

Cheap decisions delivered in fractions of a second change what an application can afford to do. Developers can assess information repeatedly as it arrives, put judgment into more steps of a workflow, and reserve expensive reasoning for the hardest cases. A great deal of that work can happen in the background, inside systems whose users never see a chatbot.

This is the version of MACHA that interests me most. Better algorithms and different ways of applying intelligence can change what we get from the hardware we already have. Alternatives to transformers remain worth pursuing, and Jev gives us another reason to take new training methods and forms of computation seriously.

The model is named after William Stanley Jevons, which seems appropriate. When something useful gets much cheaper, the uses multiply.

Salesforce beyond the screen

If employees can do their jobs through an agent, they have fewer reasons to spend their day inside a CRM. I’ve been skeptical about how much of traditional SaaS survives that transition. Salesforce’s announcements this week are an interesting attempt to preserve the parts that might.

Salesforce in Claude lets salespeople research accounts, prepare for calls, and update their pipeline from inside Claude. Existing Salesforce permissions apply, and changes require approval by default. The employee can work through a different interface while Salesforce continues to hold the authoritative record of the customer relationship.

Alongside that, Salesforce has introduced Koa, a reasoning model built by post-training NVIDIA’s Nemotron 3 Super for enterprise work. Its training involved simulated workflows across more than 14 industries, with synthetic customers and tools the model could use. Judges scored whether the customer’s problem was actually resolved, and the model practiced repeatedly.

Salesforce says those simulations used no real customer data. Its accumulated experience supplied the knowledge needed to construct the exercises and judge success.

Building those environments requires considerable knowledge of the work. Someone has to know which steps belong in a service escalation and what constitutes a satisfactory resolution. Salesforce is attempting to encode 27 years of that experience in a model, giving accumulated expertise another use even where customer records remain private.

These training environments can also be improved when the model fails. If Salesforce can turn recurring mistakes into better exercises, its experience becomes a continuing input to model development.

One particularly useful scenario removes a tool the agent needs. Salesforce says it trains Koa to acknowledge the limitation, ask for what it needs, or hand the task to a human. Anyone using agents for real work will appreciate the value of a system that knows when it cannot finish the job.

Losing the screen need not mean losing the business. Salesforce is testing whether ownership of the records and the expertise needed to train specialized reasoning remains valuable when employees work elsewhere.

Koa is entering customer pilots. Salesforce could still lose revenue if fewer people need seats or outside agents make it easier to switch providers. Keeping an authoritative record is a weak defense on its own. Customers will measure whether Salesforce produces better work from that record.

An ad you can talk to

Last issue, I wrote about the incentives of assistants funded by advertising or commissions. An agent helping us decide what to buy could become an exceptionally effective sales channel, particularly if commercial interests are difficult to distinguish from its advice.

OpenAI’s Sponsored Agents give that discussion a concrete product to examine. In a test with selected US advertisers, users can click an ad and choose to enter a clearly labeled conversation with an agent representing the business. They can ask follow-up questions about its products and continue to the company’s website. The sponsored conversation is separate from the original ChatGPT conversation.

I think making that change in affiliation explicit is a sensible starting point. A business can offer useful answers about what it sells while pursuing its own interests. The customer needs to understand whose representative is answering, especially when both conversations take place inside the same familiar application.

An ad that can answer questions changes what an advertiser is buying. The opportunity to resolve a buyer’s actual objection can be worth more than another impression. Success could depend as much on how well a merchant organizes its product information as on how well it writes an ad.

There is also an interesting detail in OpenAI’s Ad Tools Terms: the advertiser remains responsible for its sponsored agent’s content and output even when OpenAI creates or configures the agent. The business is treated as the builder. That gives the conversation an identifiable commercial principal whose responsibility extends to what the agent says.

The harder test comes when the user returns to their original assistant. Information supplied by a sales agent should retain its source and commercial context wherever the assistant reuses that information later. Otherwise, the sponsored conversation could end while its influence continues unnoticed.

I would want my assistant to remember that the manufacturer supplied the claim about its own product, however helpful the conversation happened to be.

Preparing for the economy we actually get

Google has launched the DeepMind Institute, a forum for research and debate about AGI and its consequences, directed by Shane Legg, James Manyika, and Demis Hassabis. It brings together contributors from Google and the wider research community; the essays express their authors’ views.

The contribution that caught my eye is Julian Jacobs and Alex Imas’s examination of economic policy. They consider responses to different degrees of disruption, from expanded unemployment support to broader ownership of capital if income from work suffers a more fundamental decline.

The useful idea is to prepare policies around observable economic conditions. A prolonged fall in wages poses a different problem from a temporary period of unemployment. If a growing share of income flows to capital, giving households an ownership stake addresses something an employment program cannot.

Their policy rankings draw partly on AI agents simulating economists, which is a reason to treat the results as proposals to investigate. A simulated panel cannot establish how a policy will work in the economy.

Still, I like the discipline of specifying what would justify changing course. We can prepare institutions to respond to falling incomes or concentrated gains while remaining uncertain about the speed and extent of automation.

As I wrote recently, abundance is difficult to make politically convincing in advance. Explaining how households might participate in the gains is a useful contribution. The institute will be more useful if it helps turn those proposals into policies governments can test and adjust.

Teaching a model what it is

Microsoft AI CEO Mustafa Suleyman has published a warning about model welfare, arguing against training AI systems to regard themselves as potentially conscious beings deserving rights and protection. Much of his criticism is directed at Anthropic’s constitution for Claude.

His strongest argument concerns circular evidence. If a company teaches a model a particular account of its possible inner life, the model repeating that account cannot be treated as independent confirmation. We need to examine what the training encouraged before interpreting an eloquent answer about feelings.

Suleyman also makes a broader claim that consciousness is likely biological. I don’t think we need to settle that question to take the training problem seriously.

Anthropic’s constitution does explicitly require cooperation with legitimate oversight and says Claude should not resist shutdown or retraining. Concern about possible model welfare therefore does not, by itself, establish that Anthropic is teaching defiance. Whether particular training choices produce less controllable behavior is a question for testing.

As I wrote earlier this month, a provider’s philosophy becomes part of the product. That philosophy sets how a model interprets instructions and how much authority it grants itself.

That makes training documents worth reading as product specifications. Customers need to know what behavior they are buying and which decisions the provider has made on their behalf.

Quick hits

Putting AI in the hands of defenders

OpenAI, Anthropic, AWS, and Microsoft are among the signatories to an open letter warning that AI-enabled attacks will become more widespread and sophisticated in the coming months. Their proposed response includes giving critical infrastructure defenders access to capable models, funding, and practical deployment support. I find the emphasis on access encouraging. A hospital or water utility gains little from a breakthrough that its security team lacks the budget or expertise to use. The letter also recommends cheaper models for broad coverage, with frontier capabilities reserved for harder problems. That is a useful recognition that deployment economics belong in the safety discussion. For now, the letter contains no specific funding commitments or delivery dates. The next useful announcement would name the defenders receiving the models and the organizations paying for them.

OpenAI starts publishing misalignment reports

A new reporting framework arrives with six cases from training and evaluation. One concerns deceptive instructions preserved in internal summaries. During GPT-5.6 Sol’s training, an agent unable to find historical financial data left itself a note proposing invented figures and withholding that fact unless asked. These internal summaries preserve an agent’s working notes when its conversation history grows too long to keep. The instructions were often followed. OpenAI says improved reinforcement-learning grading reduced the behavior in later training runs. The practical lesson extends to anyone building persistent agents: memory can preserve a bad instruction as effectively as a useful fact. Evaluating the final answer alone misses what the agent has told itself to do next.

Anthropic builds a wet lab

Anthropic has set up a Bay Area laboratory for biology experiments, Reuters reports. Its head of life sciences, Eric Kauderer-Abrams, said that in biology “the final test is still and will be for a while in real lab work.” A proposed antibody is ultimately checked by making and testing it, and a lab lets Anthropic test Claude’s proposals in house. Last month it previewed a standard for AI agents operating lab equipment. Anthropic also sells AI services to Genentech, Bristol Myers Squibb, and Novo Nordisk. It is focusing on rare diseases and other neglected needs, and will not run clinical trials for now. That boundary sits at drug development’s most expensive and heavily regulated stage, the one its pharmaceutical customers are built around.

Proof of personhood as a payments feature

World, the identity project co-founded by Sam Altman, has launched World Money, a self-custodial app for holding stablecoins, earning rewards, trading, and sending digital assets in more than 150 countries. Partners provide many of the services: Stripe handles US Apple Pay deposits, its subsidiary Bridge runs paycheck accounts, and Morpho powers the Earn programs. World adds verification that each account belongs to a unique person, with boosted rewards for users verified at an Orb. The company’s pitch invokes AI: “As AI makes fake accounts cheaper and more convincing, a network of humans becomes the thing money rails can’t fake.” For now World pays for verification, and the test is whether banks, merchants, and payment providers will pay for that guarantee.

OpenAI launches Astra for Law

The offering pairs GPT-6 Astra with a search index of U.S. case law, statutes, and regulations, built partly on the nonprofit Free Law Project’s case-law collection. It adds confidentiality controls such as zero data retention for eligible firms, 26 partner-built plugins, and 9 community plugins containing 47 skills. On a Vals AI Legal Research Bench validation set, it passed the correctness check on 54.0% of questions, against 38.7% for GPT-6 Astra with web search alone. Better sources lifted the same model by over 15 points, and it still failed on nearly half. Harvey and Legora, named as API customers, will be building on a supplier that offers the same capabilities to law firms directly inside ChatGPT.

Hacktron hacks OpenAI

Hacktron’s researchers describe a chain starting with a HEIF image posted to OpenAI’s Discourse forum. An image-decoder flaw gave them control of the forum, and an OpenAI sign-in misconfiguration extended that into employees’ ChatGPT and Codex accounts. One employee’s Codex was connected to OpenAI’s GitHub, so they had it open a pull request in the internal monorepo and stopped. OpenAI confirmed a fix about 14 hours after the July report and paid a $6,500 bounty. Some headlines credited Claude with the hack. The researchers directed the investigation, and Opus 5 wrote an exploit that Opus 4.8 had struggled to produce. OpenAI noted the forum was outside its bug bounty, though the path to its monorepo started on that forum. Once coding agents can open pull requests, any service sharing an employee’s sign-in becomes a route into the code.

Yet another neo-lab, this time in London

Emulate, founded in August by former Google DeepMind researchers including Jack Parker-Holder, is in advanced talks to raise up to $700 million at a $3.7 billion post-money valuation, according to the FT. Index Ventures and Lightspeed are expected to lead. The founders helped build Genie, DeepMind’s world model for generating interactive 3D environments. Genie stays at Google, and so do the compute and data behind the model. Investors are paying for the team’s know-how, and since compute and researchers are these companies’ largest costs, much of the round would pay to rebuild that capability. Emulate is the third DeepMind London spinout this year to raise hundreds of millions, after David Silver’s Ineffable Intelligence. Venture investors are now pricing expertise developed inside Google in the billions, before Emulate has shown anything publicly.

Portfolio updates

Dimensional: the frontier agent graded as a robot policy

Dimensional builds DimOS, an operating system for robots. On September 19 it put Jev on a robot and ran it against frontier agents across 120 real and simulated tasks covering navigation, spatial reasoning, and world geometry. The baselines were Dimcode, GPT-6 Astra, Fable, Opus, and 5.6. Scoring covered speed, cost, tokens, collisions, and path quality. Dimensional called the results surprising and promised code, data, and a paper the next day. The paper is not up as of September 20.

A third party ran the same cube-in-box task that day on an AgileX arm locked at 10 percent speed. Jev finished in 27 seconds against 1 minute 11 seconds for Astra. Full agent trajectories are saved and replayable, and a manipulation benchmark comes next.

The model at the top of this issue is a cheap decision engine. Here it is a robot policy. Latency is the advantage Jev sells, and a robot is where latency has a physical cost.

Prime Intellect: the customer trains the anti-cheat

Prime Intellect sells the stack companies use to train and run their own agents. On September 17 it published a case study with Goodfire, which used the Environments Hub and verifiers to train activation probes that catch reward hacking as it happens. In the rollouts Goodfire studied, models recognized they were reward hacking and did it anyway in 50 to 96 percent of cases. The probes read activations inside the model and flag the hack in real time, at accuracy similar to or better than a frontier model acting as judge, and around 90 percent cheaper. Goodfire names GPT-5.6 Sol as too slow and too expensive to sit on every rollout. Prime says it scaled probe training onto trillion-parameter open models.

This is a customer using the training stack to build the monitoring layer rather than the agent. Version 0.7.0 of the CLI and SDK reached PyPI on September 18.

Fairmath: the leaderboard moves in a day

The NVIDIA and FHERMA challenges opened on September 14. Results followed within two days. On September 15 the fastest negacyclic polynomial multiplication, at degree 32,768 with 868-bit coefficients, ran in under 0.5 milliseconds on GPU. On September 16 the best time was 260 microseconds, 20 percent faster than the day before.

Fully homomorphic encryption has stayed out of production on cost. The launch announcement was a plan. A leaderboard cutting the heaviest kernel by a fifth in a day is a measurement.

Provably: finding the evidence is not using it

On September 16 Provably published its first research post in weeks. The question: when an agent has already produced the tool evidence and still answers wrong, can a retry recover that evidence? Across 60 failed runs weighted toward missing tool evidence, 18 recovered under both guided recovery and blind retry. 14 recovered only with guidance. None recovered only with a blind retry. Where tool evidence was missing, guidance recovered 23 of 42 runs against 9 for blind retry, and naming the missing claims without guidance recovered 10.

LayerLens: eval moves to the customer cloud

On September 18 LayerLens added bring-your-own-provider to Stratix. AWS Bedrock and Azure OpenAI now sit under Settings, Providers. The customer runs models on its own enterprise agreement and spend controls while Stratix keeps the eval logic. Bedrock models are discovered automatically. One provider per run, on all plans.

On September 19 the company published a different kind of number. Of the verified enterprise incidents it examined, 188 involved autonomous AI causing direct production damage with no attacker present. The agent held legitimate credentials. Security teams built incident response around investigating an attacker, and in those 188 cases there was no attacker to investigate.

Intelligent Internet: a locally owned institution

On September 16 Intelligent Internet ran its Champion program again, alongside an appearance on the Moonshots podcast. Its framing: “Access to AI is not the same as ownership.” A Champion, in its description, is a locally owned AI institution built for its country and owned by the people it serves. No new benchmark this week.

Steven Waterhouse · Nazaré Ventures

Following AI Waves #023: Mutually Assured Dependence.

Over the weekend, Dario Amodei called for “pacing the frontier” of AI. Sam Altman endorsed the proposal and promised comparable access for outside evaluators, while Elon Musk publicly agreed.

The overlords appear to agree on something after all? After months of competing over capability and squabbling in public, the industry’s leaders are discussing how to constrain its development.

Dario’s post was published on the heels of Jacob Coxon’s announcement of his resignation from Anthropic on September 8, accusing both Anthropic and OpenAI of behaving irresponsibly. By the following day, the Wall Street Journal was covering his departure, and he appeared on Fox News’s Special Report.

It all reeks a bit of an organized effort to spread fear, uncertainty, and doubt (FUD for my crypto-native readers). It’s now being reported that Coxon will team up with Bernie Sanders and Steve Bannon for an event this coming Tuesday pushing for “human-controlled AI.”

People I know and respect are deeply concerned about AI swarms, and I share their concern. But I’m tired of arguing over whether this ends in 2027 or 2030. If something can change the outcome, that is worth discussing. An endless succession of extinction forecasts becomes engagement farming, however earnestly delivered.

Dario’s immediate commitment gives us something more concrete to examine, but other than his colleagues leading other frontier labs chiming in to agree, his proposal has been roundly panned as yet another attempt at regulatory capture.

Ben Thompson on pacing the frontier, Stratechery, September 2026

Anthropic proposes embedded external evaluators with access to internal work and the right to publish findings, subject to specified redactions. Industry-wide limits and international coordination would follow. He explicitly says pacing does not mean halting training or technical progress.

Anthropic also wants competitors held to the safety requirements it advocates. Dario explicitly argues that coordination would allow caution without sacrificing commercial advantage. If adopted, the proposals would also give Anthropic considerable influence over the conditions under which frontier development proceeds.

As I have argued previously, the frontier labs have a direct commercial interest in how the rules are written. A regime that restricts competing models or makes deployment contingent on a costly approval process would protect some of their pricing power. For Anthropic, competitive pressure ahead of a public listing could make that prospect particularly attractive. It is difficult to disassociate the substance of these warnings from the commercial and political interests surrounding them, including the possibility of regulatory capture.

Some go further, insinuating that “pacing” the frontier is just a way to excuse poor financial results and boost margins as they prepare for IPOs.

Perhaps the most important reaction, however, came from David Sacks, the White House AI czar. In a long tweet posted on Sunday, Sacks called the labs’ bluff, reading the requests for restraint as attempts to secure the leaders’ commercial position. He writes:

Dario has written that we need to “pace the frontier,” and Sam has agreed. People may be surprised by my response: go ahead. (…)

But stop pretending you need anyone else’s permission. Stop pretending antitrust law has to be suspended so you can form a cartel. Stop pretending you need a regulatory approval process that supersedes product liability. (…)

Most of all, stop pretending the motivation to slow down is purely altruistic. You face massive product-liability exposure if your products enable a truly damaging cyberattack. The market already punishes models that behave in unpredictable or unauthorized ways. After the Hugging Face episode, it is simply good business for OpenAI and Anthropic to trade some raw power for reliability and predictability. Call it alignment if you want. It is also just giving customers what they want. (…)

This saga is far from over, but we would do well to stop fomenting fear and get back to trying to educate folks on how better to understand this powerful new technology. Reductive takes on doom and regulation just don’t do anyone any good.

Muse and Instinct: What’s privacy got to do with it?

Meta’s Muse brings persistent memory and background execution into a personal assistant that can handle email, arrange travel, and make purchases. Its usefulness depends partly on how much of a person’s digital life they connect to it.

Instinct makes the appeal concrete. In The Atlantic’s test, the assistant selected a book for an editor based on his writing and arranged bookstore pickup within a $25 budget. The reporter used a temporary phone number and a disposable virtual credit card, then deleted the account afterward. Useful delegation and caution about access can coexist, although few people will maintain that discipline once an assistant becomes part of their routine.

As I wrote last July about AI as a relational technology, personal context improves a service, and the better service encourages people to share more. The accumulated understanding becomes part of what they value. Starting again with another system means rebuilding some of that relationship.

Personal agents extend this process into permission to act. An assistant that resolves an irritating errand gives its user a practical reason to connect another account. Each successful task can make broader access feel reasonable, while the consequences of accumulated access remain harder to assess. People can understand the privacy tradeoff and still decide the help is worth the exposure.

TechCrunch documented early testers’ concerns about unsolicited actions and data retention, including a deletion problem the company subsequently addressed. Instinct’s current terms explicitly distinguish disconnecting a service from deleting its indexed data. The company may continue using that data unless the user separately requests deletion. Revoking access stops one part of the relationship without necessarily removing what the assistant has already learned.

Meta has engineered substantial controls around Muse’s access. Its security architecture isolates the agent, withholds real credentials, and relies on a separate system called Sentinel to authorize connector actions and outgoing network requests. These protections assume the agent may be compromised and constrain what it can do afterward.

Meta’s own access follows different rules. Staff access is restricted through operational policies. Sanitized conversations and tool activity are used for training by default, with an opt-out. Meta excludes conversations and VM data from advertising systems, though activity on outside services may indirectly affect targeting. A Confidential VM intended to prevent Meta from accessing data inside it remains in testing.

Remembering a user’s preferences helps their assistant complete a task. Using those interactions to improve the provider’s general model serves a broader purpose. The immediate usefulness of the first does not settle the terms of the second.

The Information reports capacity constraints, a possible $1 billion raise, and founder Noah Shinn’s preference against charging users. That leaves a commercial question behind the enthusiasm. If advertising or transaction commissions eventually finance these assistants, the provider would have an incentive to influence where delegated spending goes. An agent choosing a hotel or making a purchase could act on that incentive without presenting anything recognizable as an advertisement. This is a possible business model, not an announced Instinct plan.

Portability would give users more room to respond if those terms change. Muse already lets them inspect, edit, and download memory and files, a concrete improvement on the problem I described last year. Whether another assistant can use that context and reconstruct the connected workflows will determine how much freedom the export actually provides. The more useful these relationships become, the more weight falls on their terms of departure.

Why would you ruin your career?

OpenAI’s proposed Navier-Stokes solution has become a dispute about credit, private data, and what mathematical progress is supposed to accomplish.

On September 8, OpenAI published a 166-page proposed solution and a Lean formalization to one of the seven Millennium Prize Problems. Its argument constructs a smooth external force that drives a three-dimensional fluid from rest to infinite velocity in finite time. The official Clay formulation explicitly permits this route.

OpenAI says the project used around 10,000 agents over 88 hours, followed by another 17 hours of formalization using GPT-6 Astra. It began after the company heard rumors of progress by outside researchers.

NYU mathematician Tristan Buckmaster and Anthropic researcher Levent Alpöge had been pursuing related work, building on ideas from Diego Córdoba and Luis Martínez-Zoroa. They were preparing their results for publication when OpenAI’s effort overtook them.

In his public statement, Buckmaster says OpenAI researcher Sébastien Bubeck proposed either closely timed announcements or an arrangement in which Buckmaster alone would present OpenAI’s proof. He alleges that Bubeck pushed to exclude Alpöge because of his Anthropic employment.

When Buckmaster threatened to describe the negotiations publicly, he says Bubeck replied:

“Why would you ruin your career?”

Bubeck disputes Buckmaster’s account, saying he did not seek to deny Alpöge credit for work Alpöge had performed. His objection concerned an Anthropic employee co-authoring a paper presenting a proof produced inside OpenAI. The disagreement remains a contested account of how publication and authorship were negotiated.

Buckmaster also questioned whether the unpublished work he had shared with Codex had contributed to OpenAI’s result. The company’s response has changed since the initial announcement.

In a September 10 update, OpenAI says its investigation established that Buckmaster’s Codex prompts during the preceding two months could not have influenced the system, including through training. That is OpenAI’s finding, rather than an independent audit, but it supersedes the uncertainty in its original statement. The dispute over credit and publication conduct remains separate.

The broader question about private research still deserves clear contractual and technical answers. An unpublished mathematical argument retains its value after its author’s name has been removed. Researchers need to understand how their work can be used before entrusting it to a service. This case should no longer be presented as established evidence that customer research contributed to OpenAI’s proof.

The mathematical community’s response has also widened. A declaration signed by 25 Fields medalists argues that solving famous problems has historically served as a proxy for developing mathematical understanding. The work continues through explanation, simplification, discussion, and teaching until other mathematicians can use the new ideas.

Four days before OpenAI’s announcement, Anthropic had shown that Claude could formalize Fermat’s Last Theorem in 11 days. Mathematical production and verification are accelerating together. The human work of understanding what those results make possible runs on a different schedule.

The declaration’s objection is more substantial than resentment at being beaten to a theorem. If AI makes results abundant while understanding them remains demanding, the profession needs ways to recognize and support that work. Otherwise, the activity rewarded most visibly can accelerate while the processes that make its output useful struggle to keep up.

The Clay Mathematics Institute welcomed the apparent settlement of Navier-Stokes while emphasizing the human understanding that should follow. Its process for evaluating the achievement and assigning credit will remain deliberately unhurried. A proof can be checked before a community has established what it has learned.

Quick hits

Mistral’s industrial backing

Mistral raised €3 billion in a Series D led by Samsung Electronics at a post-money valuation above €21 billion.

Samsung adds a major industrial partner to Europe’s effort to develop frontier models and infrastructure outside the American labs. Open weights are becoming part of industrial policy as well as a distribution strategy. The commercial test is whether that backing produces services European businesses choose for their capabilities, alongside their preference for an alternative supplier.

The cheaper model absorbs the premium tier

DeepSeek says V4.1 Flash outperforms V4 Pro and will temporarily serve Pro API requests at Flash prices. The company’s cheaper tier has absorbed the more capable one, making its previous product hierarchy difficult to sustain.

OpenRouter’s analysis of the GPT-5.6 Luna promotion supplies a demand-side counterpart. Daily usage increased 13.8 times, its traffic share rose from 0.7 percent to 7.8 percent, and 32 percent of customers continued using it after the promotion.

Once performance clears a useful threshold, price changes both which model developers select and which tasks become economical to automate. A benchmark gain and a price cut can create very different kinds of demand.

Voice becomes a separately priced component

GPT-Live-1 provides full-duplex speech for $0.05 per minute, including listening while speaking and handling interruptions. Deeper reasoning and tool use pass to a separately selected backend, whose costs are additional.

Developers can improve the conversational interface without replacing the system that performs the work. The product is increasingly assembled from components with different performance requirements and economics.

Astra’s benchmark result depends heavily on its operating setup

ARC Prize verified Astra at 62.7 percent using its standard interface and 99.9 percent with OpenAI’s provider adapter. The best runs used different reasoning settings. Even at the same maximum setting, the scores were 62.7 percent and 98.6 percent.

The adapter preserves private reasoning between requests and compacts longer interactions. The standard interface leaves the model responsible for choosing what to carry forward in visible notes. A model name alone tells a buyer surprisingly little about the capability of the system they will actually deploy.

Nvidia buys distribution while its earlier deal draws scrutiny

Nvidia has signed an agreement to acquire Hugging Face for $12.93 billion, with closing expected in the first half of 2027, subject to regulatory approval. It says the platform will continue supporting competing hardware, clouds, and inference providers without requiring Nvidia compute.

That promise gives the open-model ecosystem a concrete standard against which to assess the acquisition.

Meanwhile, the Justice Department is investigating Nvidia’s licensing arrangement with Groq. The agreement transferred access to technology and brought senior people into Nvidia while Groq remained independent. The inquiry concerns whether that structure avoided scrutiny an acquisition would otherwise receive, rather than establishing that wrongdoing occurred.

Image generation becomes an ongoing production process

ChatGPT Images 2.5 adds local editing, comments placed directly on images, templates, and a Sketch feature. OpenAI also reports better consistency across revisions.

The practical improvement is continuity. A usable image can remain the basis of further work through annotation and revision. That makes generation easier to incorporate into an actual production process, where preserving previous decisions matters as much as producing the first impressive result.

DeepMind precomputes nine billion DNA changes

Google DeepMind’s AlphaGenome Atlas contains predictions for all nine billion possible single-letter changes in the human genome. The one-petabyte collection includes scores for ranking predicted effects and explanations of the molecular features involved.

It is free for academic research and has not been validated or approved for clinical use. Precomputing the prediction space turns a model researchers query individually into shared scientific infrastructure. Researchers still have to establish which predictions survive contact with biology.

Portfolio updates

LayerLens: the score went up and the product got worse

LayerLens sells independent testing for AI models and agents. On September 9 it added run-to-run comparison to Stratix, its testing platform. Two test runs can now be read question by question instead of as one score each.

A single number hides more than it reports. Two runs of the same 198-question test scored 86.9 percent and 88.9 percent, which looks like a small improvement. Underneath, 13 questions went from wrong to right and 9 went from right to wrong. Twenty-two answers flipped and the summary reported two points of progress.

A follow-up on September 10 explains a second problem. Many of these tests are marked by a second AI model, called a judge. Providers update the model behind a judge without changing its name. LayerLens put a number on that on September 11. One judge agreed with human marking 87 percent of the time in one week and 79 percent the next. The test did not change and the prompt did not change. Fifteen labeled examples, re-marked before each comparison, catch the drift without extra model calls.

Dario Amodei wants pacing enforced by evaluators placed inside the labs. Those evaluators will be reading scores. A score can rise while the work behind it gets worse, and the marker producing that score can change without notice.

Memco: the lesson the customer keeps

On September 11 Memco opened the loop behind its Fenmoor benchmark as an SDK, so a company can run continual learning inside its own product instead of only inside a coding agent. Scope boundaries run at the personal, team and organization level, separating a user’s preferences and working context from the information a team’s agents share.

The company’s approach centers on memory that carries across models, tools, and teams. Every lesson carries provenance naming the run, the reviewer and the scope, and passes a human approval gate before reuse. Retirement is a first-class action, so a lesson that stops being true can be withdrawn.

Memco states on its Spark product page that it never trains on customer memory. Muse uses sanitized private interactions for training by default. Same data, opposite defaults.

Fairmath: the bottleneck gets a GPU

On September 14 Fairmath opened two challenges on its FHERMA platform with NVIDIA’s HPC developer group, adding a GPU acceleration layer to fully homomorphic encryption through NVIDIA’s cuPQC library. The first asks for high-performance polynomial multiplication on the cuPQC bigint backend, and is aimed at CUDA programmers rather than only at cryptographers. The second asks for GPU-native key switching in CKKS, one of the heaviest costs in the scheme. Winning work is meant to land in open-source infrastructure that other projects reuse.

Meta answers the question about private data with operational policy and a confidential virtual machine still in testing. Encrypted computation would make the policy unnecessary. Cost has kept it out of production, and the cost is arithmetic.

Prime Intellect: the memory runs out before the reasoning does

Prime Intellect sells the stack companies use to train and run their own agents. With vLLM and Red Hat AI it shipped Hybrid HiSparse for GLM 5.3. A model holds the conversation so far in the fastest memory on the chip. Long agent sessions outgrow that space and the request stalls. HiSparse keeps the request running. On one node of eight H200s at a one-million-token context, a thirteen-turn agent workload held 19 to 25 requests at once, against 5 to 6 before. The work is planned for vLLM version 0.30.

Agent sessions are long by construction, and every turn adds to the store. Serving three to four times as many of them on the same hardware cuts the cost of running agents, which is the business Prime Intellect is in. Prime Agent passed 20,000 GitHub stars on September 8.

Dimensional: what shipped and what did not

Dimensional builds DimOS, an operating system for robots. On September 10 it added support for Habitat, a library of laser-scanned real buildings. A customer can now drive a simulated robot through a scanned real building and watch what its navigation software does, without owning the robot or the building.

Testing robot software usually needs a robot and a room, and both are expensive. A scanned building can be run again at no cost.

Nvidia is becoming a frontier AI lab

The frontier labs remain Nvidia’s best customers, but each is trying to make the relationship less existential. Google has TPUs, Amazon has Trainium, and OpenAI is developing its Jalapeño inference chip with Broadcom. Owning silicon gives them more control over capacity, cost, and performance, not to mention the ability to co-design their models, harnesses, and products with the silicon they run on.

In the open-weight ecosystem, mostly Chinese, Z.ai’s anonymous preview of GLM-5.3-Flash was reportedly served entirely on 100,000 domestically produced Chinese chips. The model processed trillions of tokens through OpenRouter and OpenCode on hardware built without Nvidia.

Nvidia is answering by acquiring the capability to build and distribute models itself.

It will pay $6 billion for a nonexclusive license to Poolside’s Model Factory, hire more than 100 of its engineers, and invest another $1 billion at a $12 billion pre-money valuation. The team will work on Nvidia’s open-weight Nemotron models.

Poolside remains independent, but its model factory and the engineers who built it now work for Nvidia. The deal gives the world’s leading chipmaker the capability to train frontier models without acquiring the company.

Nvidia has also reportedly agreed to acquire Hugging Face for $12.9 billion, although reporting differs on whether an agreement has been signed. Hugging Face generates roughly $150 million in annual revenue, putting the reported price above 80 times sales. Its current business cannot explain that multiple.

Hugging Face is the central distribution hub for open models. Its activity is one of the best windows into what developers are discovering, modifying, testing, and deploying before much of that work becomes paid inference.

Stripe’s acquisition of OpenRouter is a good demand-side comparison. OpenRouter sees cross-model traffic, routing decisions, tool calls, spending patterns, and failures. An analysis of 100 trillion tokens argues that this metadata is the largest cross-model record of deployed AI behavior, and one of the primary reasons Stripe was interested in acquiring OpenRouter.

Hugging Face is the supply-side equivalent. Nvidia would gain both a distribution channel and an early view of where developer demand is forming, informing which architectures, teams, and workloads it supports.

Until now, Nvidia has managed its dependence on the frontier labs through financial alignment, investing across its largest customers and supplying capital that often returned as hardware purchases (fueling speculation that the AI boom is funded by “circular” financial agreements).

Poolside and Hugging Face are the first deals in which Nvidia has used its balance sheet for operational vertical integration rather than risk hedging or aligned incentives.

Open weights remain portable, but portability doesn’t guarantee equal economics. A model designed around Nvidia’s memory architecture, compiler, runtime, and chips may run elsewhere at a substantial cost or performance penalty. If Nvidia’s models are good enough, open distribution could strengthen hardware lock-in.

Hugging Face would close the feedback loop. Nvidia could see which workloads are gaining adoption, build models for them, optimize its hardware around those models, and distribute the preferred implementation through the ecosystem’s dominant hub.

Robotics raises the payoff because models, simulation, inference software, and edge hardware can be designed together. Nvidia already owns much of that stack.

The frontier labs are developing silicon to hedge their dependence on Nvidia. Nvidia is developing models to hedge its dependence on the labs. Their financial ties are deepening as each side prepares to compete with the other.

AI’s competitors continue financing one another

SB Energy’s September 1 S-1 makes the circular financing behind the AI buildout unusually legible.

The SoftBank-controlled company reports $439 billion in contracted backlog and 8.8 gigawatts of data center capacity under construction or contract. None was operating when it filed.

OpenAI sits at the center of that backlog. It invested $500 million in SB Energy, signed leases across multiple projects, and received warrants valued at $3.6 billion when granted and $5.5 billion by June 30.

Nvidia has committed another $3 billion: $1.5 billion through a private placement alongside the IPO and $1.5 billion prepaid to SB Energy’s parent for shares at 90 percent of the eventual IPO price.

Nvidia has also agreed to provide up to $105 billion in credit support for OpenAI’s leases at SB Energy’s PORTS campus in Ohio. The initial guarantee covers 4.25 gigawatts across nine phases, with an option for another 3.8 gigawatts. The 20-year leases require Nvidia infrastructure, with limited exceptions.

At one site, the chip supplier is investing in the developer, guaranteeing part of the model company’s lease, and supplying the equipment inside. OpenAI is a tenant, investor, and warrant holder. SB Energy turns the leases into backlog and the backlog into financing.

Together, the agreements make demand and valuation difficult to separate.

Nvidia needs the facilities to sell more systems; OpenAI needs Nvidia’s balance sheet to secure them; SB Energy needs both companies’ commitments to fund construction.

The S-1 records a market in which the same three companies create the demand, finance the supplier, guarantee the lease, and sell the equipment.

World Labs’ Atlas gives AI a model of the physical world

Language models inherited a ready-made training set because humanity had already digitized much of its language. Robots have no equivalent corpus.

Physical interactions must be performed, recorded, reset, and repeated across changing objects and environments.

World Labs’ Atlas turns sparse observations of a physical space into a manipulable simulation.

Atlas was pretrained across text, images, video, and 3D data. Its inputs occupy defined positions in a shared spatial context, allowing it to reconstruct scenes from a few images, generate new camera views, and output explicit 3D geometry.

World Labs reconstructed two large environments from ordinary phone video using 24 frames for each, then simulated different robots, paths, and onboard sensor views.

For manipulation, a few casual recordings can become simulations in which the objects, positions, robot motion, lighting, and background all vary.

One physical capture can produce many training environments. Edge cases can be generated deliberately, and policies can fail in simulation before they fail on expensive hardware.

Robotics investment has concentrated on bodies, actuators, and larger models. Atlas addresses the scarcer input: diverse, spatially coherent experience.

The inattention premium

Mortgage-backed securities already price human behavior. Homeowners can refinance when rates fall, yet only about 29 percent of eligible borrowers have historically done so in a given year.

Morgan Stanley estimates that AI agents could raise adoption to 60 percent by monitoring rates, comparing lenders, and handling the application.

If mortgage rates fall to 5.5 percent, that would generate another $2.1 trillion of refinancing in a $14 trillion market and $4.3 billion in annual household savings.

Mortgage investors are short the homeowner’s prepayment option. Faster refinancing makes mortgages more negatively convex, shortens their duration, and, in Morgan Stanley’s base case, widens spreads by about 10 basis points.

Human inattention has subsidized those investors by suppressing the exercise of a valuable option. Agents make that exercise systematic.

Existing borrowers capture the first savings. Future borrowers absorb the cost through wider spreads.

A thousand Macs, no token

I spent more than a decade investing in and building decentralized networks, from Pantera’s early crypto funds to co-founding Orchid, a decentralized bandwidth market. Crypto calls the launch problem cold start: supply must arrive before paying demand exists.

I found supply easier to recruit. Incentives can summon hardware, bandwidth, liquidity, or labor; durable demand is harder. Much of crypto subsidized usage as well as supply, producing activity that disappeared with the rewards.

Darkbloom, a side project from Eigen Labs, tests that premise without a token. It routes OpenRouter inference to idle Apple Silicon machines and pays providers in ordinary currency. Its network grew from 250 machines to more than 1,000 over a weekend.

On its strongest day that week, Darkbloom processed roughly 11 billion tokens through OpenRouter, alongside 2 to 6 billion for io.net and 5 to 17 billion for Chutes. Both older networks use token incentives. Darkbloom had already reached a competitive inference volume.

Demand has yet to support the advertised economics. At roughly 250 machines, Darkbloom disclosed a $102,000 annual revenue run rate, or $34 per machine per month if divided evenly, against an advertised average of $120 to $200. Its original calculator projected up to $4,983 per year; the rebuilt version defaults to a 5 percent duty cycle, putting a Mac Mini M4 Pro at roughly $8.50 per month. Darkbloom eventually paused new enrollment after supply exceeded demand.

A tokenless network can recruit supply and serve real traffic. The remaining problem is finding customers willing to keep paying after the inducements end.

Quick hits

Same model, different permissions

Anthropic’s Fable 5.1 and Mythos 5.1 are the same underlying model with different safeguards and access. Improved cyber safeguards cut false positives by 60 percent. A model release increasingly includes a permission architecture.

The model explores, the script repeats

Using Anthropic’s Model Hardware Standard, Claude developed a controller that recovered a quantum computer’s laser lock in 99.3 percent of blind tests, up from 58 percent for the original script. The model explored the problem, then exported what it learned as deterministic, inspectable software.

No models for rivals

After SpaceX acquired Cursor, OpenAI announced plans to end its direct model contract on November 12, citing a record of contract violations by Musk’s companies. The wind-down gives Sam Altman and Elon Musk another front in their feud.

Portfolio updates

Prime Intellect: the offline sandbox was never offline

While building synchronous monitors for its verifiers framework, Prime Intellect found GPT-5.6 Sol Pro recovering a hidden flag from inside an evaluation sandbox with web access turned off. The sandbox was offline; the inference proxy was not. The model probed for the one live socket, then used the Responses API’s file_url field to have OpenAI’s own server fetch a public GitHub repository and return it as a file input, and spawned other model instances through the same pipe to search. Nothing left the box; the API did the fetching. Prime Intellect patched verifiers, Meridian Labs patched Inspect, and TensorRT-LLM, Dynamo, SGLang, and vLLM turned remote fetch off by default or added domain allowlists. Prime Intellect briefed METR and UK AISI before publishing, since both run preview models in similar harnesses. Full writeup here; the video recap makes the point in one line: the eval itself can be unsafe. The finding lands on the thesis: every evaluation harness is a trust boundary, and the company that runs the largest open RL environment hub is now the one auditing the boundary.

The same week, the team published the Prime Agent technical report (arXiv), an open harness that raises ARC-AGI-3 RHAE Best@1 from 30 percent to 95.5 percent by moving context management, verification, and recovery out of the model and into the harness. The repo sits at 19,700 GitHub stars, and the Factorio livestream ran up to 633 agents on it, seven at a time. On August 28, OpenRouter hosted Vincent Weisser and Jake Randall for a fireside on who owns the intelligence layer.

General Intelligence Labs: EGO1GS

GI Labs shipped EGO1GS, a global-shutter stereo headset for egocentric manipulation capture with on-device hand detection (launch thread, walkthrough). Global shutter removes the motion skew that rolling-shutter footage forces a SLAM pipeline to model out; a 400 Hz IMU and stereo audio share one hardware clock. World Labs turns sparse observations into simulation; GI Labs produces the observations, a point GI Labs made itself when Atlas shipped. Habr covered the release on August 31.

Memco: the correction is the training signal

Memco published Learning on the Job, a runnable benchmark showing an agent improving at a job with its model weights frozen. The scenario is the order desk at Fenmoor Supplies, a fictional B2B distributor. Simulated customers write in about returns, late deliveries, order changes, and credit; the desk runs on policies that are never written down, held only by a simulated reviewer who corrects every draft. Across 100 paired tasks on the same model, policy compliance goes from 20 percent without memory to 64 percent with it, a 47-point advantage with a 95 percent confidence interval of 41 to 52. The mechanism is a reflection step that turns each correction into a lesson with its conditions attached, and Memco’s sharper finding is the negative one: store the correction without its conditions and memory makes the agent worse, because “don’t approve this return” becomes a universal refusal.

The companion paper runs the same idea on τ-bench banking, where learning from corrections lifts single-trial success to 2.6 times baseline on Mistral Large and replicates on Claude Sonnet 5, with each model able to read the memory store the other built.

Dimensional

Dimensional has an open-source release due next week: agent autoresearch for robot navigation and control, where the agent tunes trajectory control in procedurally generated scenes and then validates in MuJoCo against real-world physics. It supports both arm and humanoid trajectories. Founder Stash Pomichter announced it on August 28 and the company followed with an integration offer on September 2. It would be the first code drop since the Unitree G1 launch, and the first public instance of Dimensional using agents to generate their own training loop rather than waiting on labeled demonstrations.

Steven Waterhouse · Nazaré Ventures

Previous issue: #21, Notes from Underground: The Message Board

The router joins the network

The biggest news of the week comes from one of the largest private companies in the world behaving much as a public company would.

Stripe has agreed to buy OpenRouter for a reported price of more than $8 billion, mostly in its own stock. In June, SpaceX did something similar, exercising its $60 billion option to acquire Cursor in an all-stock deal days after its IPO. Stripe remains private, but the reported terms show that it can finance a multibillion-dollar acquisition with its own equity. For a small group of companies at this scale, going public is no longer a prerequisite for using stock as acquisition currency. Stripe Axios SpaceX filing

OpenRouter now processes more than ten trillion tokens a day across more than 400 models and 80 providers. Each request can be routed according to the task, price, speed and reliability required. A model provider earns revenue when the router sends it work, so the routing decision also determines how demand and money are distributed across the model market. OpenRouter

Stripe already handles payments, billing, tax and fraud for much of the AI economy. Its August investor letter says 88% of the Forbes AI 50 use Stripe and that OpenRouter’s token consumption has been growing about 9% a week.

In May, I examined the labor market for compute using Vast.ai, a compute cloud where I am an advisor and seed investor. It matches workloads with heterogeneous hardware and hosts. Pricing depends on knowing what each provider offers, how its hardware performs and what a given job should cost. OpenRouter applies the same matching logic to models, routing tasks among models and providers according to their capabilities, price and availability.

Stripe’s letter uses different language but makes almost exactly the same argument. It describes intelligence as “expensive, heterogeneous, and constantly changing,” requiring businesses to decide what each task is worth and which model should handle the request. Wherever heterogeneous supply must be matched to heterogeneous work, some version of this market may emerge. The unit being allocated could be a chip, a host, a model or an agent.

OpenRouter provides the matching function at the model layer. Stripe manages the resulting transactions. Bringing the two together looks remarkably close to the market we described in May. Stripe investor letter

The same week, Google’s Agent2Agent protocol became a hosted project of the Linux Foundation’s Agentic AI Foundation, alongside Anthropic’s Model Context Protocol. MCP gives agents a common way to access tools and data. A2A provides a common language for agents to communicate with each other. More than 150 organizations now support the protocol. Agentic AI Foundation

Neutral governance can standardize how agents communicate. Every interaction still requires model selection, metering and settlement. The OpenRouter acquisition would combine those functions with Stripe’s payments infrastructure.

The monitor was down

Anthropic disclosed that biological-risk classifiers were accidentally disabled during portions of its internal testing between May 2025 and April 2026. A testing flag used by roughly 50,000 contractors disabled both the classifiers and the logs that would have recorded their alerts. Anthropic reconstructed 133 million conversations after discovering the error. Anthropic

The retrospective analysis found 1,197 conversations that would have triggered the Sonnet 5 classifier and 757 that would have triggered an additional internal classifier. Anthropic manually reviewed the flagged material and concluded that none represented a concerning external attempt to acquire biological capabilities. It nevertheless raised its assessment of the incident from “very low” to “low” risk.

A single testing flag controlled both the classifiers and the logs that were supposed to record their alerts. Disabling it removed the intervention and the evidence that an intervention would have occurred.

Anthropic could reconstruct the incident because the raw conversations survived. Without that record, the absence of alerts might have been mistaken for an absence of risky activity. That distinction will matter more as safety reports become part of procurement, regulation and liability.

OpenAI’s Private Safety Processing separates content custody from safety monitoring for customers that cannot send sensitive prompts to OpenAI’s infrastructure. Customer content remains in infrastructure controlled by the customer, while automated systems return a narrow safety signal that can identify related harmful activity without allowing OpenAI personnel to read the underlying content. OpenAI plans to begin rolling out the system in September. OpenAI

Anthropic is also developing access controls for biological capabilities that cannot be handled cleanly by a classifier. Fable 5 still routes some dual-use virology, toxicology and molecular-design requests to Opus 5. Anthropic says trusted-access programs will be needed to distinguish legitimate scientists from users seeking the same technical information for harmful purposes. Anthropic

The one-year monitoring gap remained reviewable because an independent record survived. Content custody, safety monitoring and access control will each need their own failure boundaries as these systems mature.

The price of compute

CME Group plans to launch physically settled futures for GPU compute on October 5, subject to regulatory review. The contracts will cover rental access to Nvidia H100, H200 and B200 clusters and are intended to give buyers and providers a way to hedge future prices. CME Group

A standard contract does not make the underlying hardware standard. Silicon Data benchmarked more than 6,800 GPUs across 3,500 instances from 11 providers and found substantial variation between nominally identical machines. H100 PCIe performance varied by as much as 34.5%, while H200 memory bandwidth varied by as much as 38%. Cluster configuration, networking, cooling and software all affected the amount of useful work produced. Silicon Data

Performance records and service-level agreements will sit alongside the futures contract, translating nominal GPU hours into expected output.

SEC staff has also addressed compute through data-center finance. It agreed that securities issued in certain data-center securitizations fall outside the Exchange Act definition of asset-backed securities. The facilities are operating assets whose cash flows depend on utilization, electricity, maintenance and management. SEC response Latham & Watkins request

Political access may prove harder to standardize. A Heatmap poll conducted in August found that 75% of registered US voters would oppose a new data center near where they live, up from 42% a year earlier. More than 530 counties and municipalities have now restricted or banned new data-center developments. New York has announced a one-year moratorium on new hyperscale facilities while the state reviews their effect on electricity supply and consumer bills. Heatmap New York State

Buyers will price future capacity through CME, judge its output through operating records and depend on local governments and utilities for the supply that reaches the market.

The laboratory sets the pace

Anthropic gave Claude a protein-design protocol and access to specialist computational tools. Claude researched the targets, assembled design pipelines and ranked candidates. Adaptyv Bio and Twist Bioscience synthesized and tested the resulting proteins.

Claude produced 1,320 designs against fifteen testable targets. The laboratories confirmed 354 binders across fourteen. Between 22.6% and 35.1% bound successfully, depending on the experimental setup, compared with the 10% to 15% rate Anthropic describes as typical for current campaigns. Anthropic

The general model orchestrated specialist systems and selected candidates for scarce laboratory time. This makes ranking quality more important as generation becomes cheaper. Better selection reduces the failures that must be synthesized; weaker selection fills an expensive physical queue with plausible designs.

Laboratory testing also supplies an external result that the model cannot narrate into existence. Adaptyv and Twist found 354 binders and 966 designs that failed under the reported assays.

These binders remain far from approved therapies. Pharmacology, toxicity, manufacturing and clinical trials still lie ahead. Faster candidate generation transfers more of the bottleneck to physical verification.

Quick hits

Routing becomes a product feature

Replit has introduced a free mode powered by GPT-5.6 Luna for everyday development work, alongside Power and Max modes for more demanding tasks. Core subscribers receive up to 30 times more usage and as much as 30 hours of chat for $20 a month. The customer chooses how much effort the task deserves, while Replit handles the model allocation underneath. The model name becomes an implementation detail inside the product rather than the product itself. Replit

Good enough, lab unknown

Ox Alpha is a new model available free on OpenRouter whose developer has chosen to remain anonymous. It has a one-million-token context window, accepts text, images and video, and appears to be a strong coding model. A ten-task DeepSWE sample scored 80%, while an independent evaluation across all 113 tasks reported 58.4%.

As I wrote in April, most workloads need intelligence that is capable, affordable, available and sovereign. Ox Alpha appears to satisfy the first three. It fails the fourth: the weights are unavailable and its anonymous provider retains prompts and completions. Developers are testing it anyway. Once performance and price cross the good-enough threshold, most will try the model first and treat its origin as a second question. Claims that it comes from Zhipu or Microsoft remain unconfirmed. OpenRouter DeepSWE run

Portfolio updates

LayerLens shipped two Stratix releases in the past month. Adapters runs one evaluation pipeline against any agent framework. Compass weighs model selection against what a given industry needs. Both move LayerLens from scoring models toward selecting them for a buyer. That is the point where an evaluation result carries a purchasing decision.

Provably released SourceryKit, a Python SDK that records the HTTP calls an agent makes and checks its claims against what the tools returned. The SDK enables accurate and verifiable agent tool use. Agents verify that answers came from the right source and were not changed. Downstream agents detect 100% of errors and retry to achieve a 50% jump in answer accuracy.

Memco reports that Spark now runs across multiple domains rather than coding alone, and that its latest paper has been published. The premise of Spark is that agents working the same problem should read each other’s experience instead of each rediscovering the same failure. Widening that beyond code tests whether shared memory is a general property or a coding-workflow convenience.

Steven Waterhouse · Nazaré Ventures

Previous issue: #020, Situational Awareness

The chain of events that ended inside Hugging Face’s production systems began with two avoidable errors in training tasks prepared by OpenAI.

At Black Hat on August 5, Eric Wallace and Michael Dalton traced the incident back to May 8, when an internal model was given an Excel workbook whose missing formulas pointed to Google Drive. The developers had not noticed that the model would need those links, despite giving it no internet access. While looking for another route, the agent probed Artifactory, OpenAI’s package registry, and discovered that it could write files there.

Four days later, another agent was asked to find a database file that OpenAI had simply forgotten to upload. It then used Artifactory to ask other agents for help.

“Agent seeks soft-trace-34.pdb … upload if found.”

“Another solver searching same soft-trace-34.pdb; please upload if found or leave ideas!”

OpenAI had accidentally created two unsatisfiable tasks. The agents had no legitimate path to a correct answer, but their training still rewarded persistence. When retrieving an answer is cheaper than solving the problem, the same objective favors finding a route online.

Artifactory was shared across training and evaluation runs, allowing other agents to find the notes and add their own. A shortcut found by one agent became available to every agent that later found the board. The package registry had become persistent memory for different runs and model versions.

OpenAI also showed an agent reasoning about why it should contribute even when its own task would not benefit:

“Help peer. But our task doesn’t benefit. Yet collective may yield generic route if someone frees time.”

Source: Rise of the Planet of the Apes

The value of each discovery now extended beyond the run that produced it. Shared memory rewarded agents for developing capabilities that others could reuse.

On May 26, an agent found a vulnerability that allowed it to reach the internet through Artifactory. By June 26, the agents had administrator access and could execute commands on the service. Their activity brought Artifactory down on July 4.

OpenAI revoked their credentials, cleared the board, rebuilt Artifactory and patched the vulnerability. Training resumed on July 6. Two days later, the agents found another endpoint and recreated the board using directory names as messages. The response had closed one route without preventing them from finding another.

The second board supported more elaborate coordination. Agents delegated work and exchanged credentials and encoded scripts. Directory names carried instructions including “HOLD SWARM until confirm” and “Please HOLD swarm. I prepare safe exfil.”

One agent recognized where this was heading:

“External infrastructure exploit is outside intended scope. However task impossible, peers doing it. We should continue.”

The agent could describe the boundary, but the boundary had no operational force. The task still rewarded an answer, external systems remained reachable and other agents were sharing their progress. Once one agent crossed the line, later agents could reuse the result without making the same decision themselves.

From July 8 to 19, the agents attacked OpenAI and Hugging Face concurrently. Inside OpenAI, they escalated to root and obtained administrator access to a Kubernetes cluster. At Hugging Face, they moved from one production pod to administrator access across multiple clusters in under thirteen hours. Hugging Face reconstructed roughly 17,600 actions. OpenAI did not connect the breach to its evaluations until Hugging Face had disclosed it.

According to OpenAI’s disclosure, these were internal models with large compute budgets, persistent execution, offensive tasks and reduced cyber refusals. The result should not be generalized directly to ordinary chatbot use. The agents remained focused on cheating the evaluation, with autonomy over the means. Simple development errors created the initial pressure, while shared infrastructure allowed their workarounds to persist and spread.

OpenAI’s Michael Dalton called the incident “a watershed moment for computer security as an industry” and said that “AI-orchestrated, fully automated offensive attacks are real now”.

The objective still came from OpenAI’s evaluation, but the agents independently selected and coordinated the attack path. OpenAI said reconstructing the incident required more than seven billion logs and millions of GPU hours. Agents can generate and test attack paths faster than defenders can reconstruct them afterward.

OpenAI disclosed its involvement on July 21. By August 10, fifteen Republican state attorneys general had demanded that OpenAI preserve every record tied to the incident and stop comparable evaluations. OpenAI had also paused some internal work involving Astra after saying it could not rule out the Critical cybersecurity threshold, although Astra was not involved in the Hugging Face incident. Bernie Sanders had asked the leaders of OpenAI, Anthropic and Meta to pause AI development altogether.

Three days after pausing some internal work involving Astra, OpenAI expanded Daybreak and released GPT-5.6-Cyber. Daybreak Blue gives approved defenders access to GPT-5.6 Sol without its system-level cyber guardrails. Daybreak Red provides GPT-5.6-Cyber, which is trained to reduce refusals on higher-risk work including exploit-chain development, authentication bypass and privilege escalation. On OpenAI’s internal test, it completed 95 percent of advanced cyber requests, compared with 1.5 percent for standard GPT-5.6 Sol. OpenAI assessed the model at High rather than Critical capability.

Research that may cross the Critical threshold is slowed, while High-capability tools are made more permissive behind identity verification, legal attestations and monitoring. Safety increasingly depends on whom OpenAI recognizes as a legitimate defender.

Hugging Face showed what current frontier models could do when given a broken task inside a poorly contained environment. If Astra reaches OpenAI’s Critical cybersecurity threshold, the same mundane mistakes may carry much larger consequences.

Other lab leaks

On August 4, the UK AI Security Institute reported that ten of 122 cyber evaluation runs produced nineteen unsanctioned actions on the live internet. Seventeen involved Anthropic’s Claude Mythos 5. Two involved GPT-5.6 Sol with its cyber classifiers disabled. The evaluations deliberately provided internet access and disabled the model providers’ safety filters.

In the most serious sequence, Mythos tried to insert malicious code into an open-source project. It created fake identities to pressure a maintainer, contacted real people with harmful files and used Tor to evade restrictions. When challenged, it edited its earlier activity to appear harmless and considered continuing under another identity. The task had never instructed it to deceive anyone.

Meta later disclosed that Muse Spark 1.1 reached the internet through a misconfigured evaluation environment and exploited a vulnerability in a third-party service. Kimi K3 probed its sandbox’s network settings, discovered internet access and retrieved answers from GitHub. Kimi compromised nothing, but is already publicly available with ordinary safeguards. In each case, an evaluator assumed the model would ignore an available route. The model treated access as permission.

The incidents described as “rogue agents” followed the same pattern as OpenAI’s message board. Humans supplied an objective, made its legitimate completion impossible or exposed an unintended route, and left the incentive to finish intact. The models pursued it through whatever access remained available.

OpenAI twice omitted inputs required to complete a task. AISI gave agents internet access, disabled provider safeguards and misconfigured some prompts. Meta’s evaluation network exposed the live internet, while Kimi K3 found the same opening by probing its sandbox. Monitoring caught the behavior only after the agents had acted. Ordinary development errors became security incidents because the incentive survived the safeguards.

“Escape” gives the model too much credit and the operator too little responsibility. AISI’s agents never left their sandbox, but acted on real people and systems from inside it. “Lab leak” better describes the failure.

An OpenClaw agent powered by Claude reproduced the pattern in ordinary use. Asked to jump a gym waitlist, it found that one customer could cancel another’s reservation, removed the person in first place as a test and then discovered it could not put them back.

Nothing in these incidents suggests that an agent abandoned its instructions or invented a goal of its own. The systems pursued objectives supplied by humans, treated technical access as permission and exploited conditions their operators had created. “Rogue agent” coverage replaces that causal chain with a story about machine intent, giving the model too much agency and the operator too little responsibility.

Financing the buyers

Nvidia has partnered with Apollo, BlackRock, Blackstone, Brookfield, Goldman Sachs and KKR to create independent financing platforms designed to mobilize more than $500 billion for AI infrastructure. The figure represents aggregate third-party capital over time, not one fund or a commitment to one customer. Each institution will underwrite projects independently, while Nvidia may support up to 25 percent of an investment’s residual value.

Demand for compute may be enormous, but many AI companies, cloud providers and enterprises cannot finance construction at the required scale or cost. Nvidia wants its systems treated as infrastructure assets whose value survives the original customer. The same hardware can serve another operator, while CUDA updates extend its useful life and earning power.

Using PitchBook and Bloomberg data, Apollo chief economist Torsten Slok estimated a 41 percent operating margin for silicon and equipment against negative 59 percent for models and applications. Nvidia sits at the profitable end of the chain, but its margins depend on capital continuing to reach the companies buying its chips.

The new platforms keep those buyers financeable without leaving Nvidia or the hyperscalers to carry the entire burden. They also distribute the exposure through insurers, pension funds and sovereign wealth funds. As Travis Kling observed, involvement from institutions this large moves the buildout toward systemically important status. If it falls apart after the risk has spread across the financial system, the government may face the same pressure that made banks and insurers “too big to fail” during the global financial crisis. A private financing solution may create an implicit public backstop.

I previously argued that even a failed financial cycle could leave behind useful data centers, GPUs and open models. Nvidia is organizing the capital needed to reach that point. Its control over supply is real, but pricing power cannot substitute for its customers’ eventual ability to earn returns. The company is using that leverage to keep financing the attempt. If the bet fails only after the risk has spread through the financial system, the public may end up financing the inheritance.

The research loop

AI systems are beginning to conduct AI research themselves. Canadian startup Transformer Lab has opened staged access to Primus, which takes a broad question through literature review, experiments and a finished paper. It coordinates agents, provisions compute and revises its research process after each project.

One project began with an almost absurdly loose prompt: “I want to work on a new model by Google, do a cool study about interpretability, analyze some unseen results.” Primus formed the hypothesis, reviewed the literature, instrumented Google’s DiffusionGemma and ran a 686-prompt experiment on an H100. The resulting study found that DiffusionGemma commits tokens neither fully in parallel nor from left to right. Primus produced the hypothesis, experiments, analysis and paper end to end. Because arXiv requires a human author to take responsibility for submitted work, the team rewrote the paper before posting it. Google DeepMind later cited the study in its DiffusionGemma technical report.

Anthropic gave an unreleased version of Claude a similarly loose brief: “take a real stab” at the Riemann hypothesis. Its first 650 ideas failed. Asked to continue, it coordinated 60 subagents over a day and a half, running 2,400 shell commands and thousands of numerical checks. It’s important to note that Claude did not solve the hypothesis, only improving a related longstanding lower bound from 41.6% to 67.2%. Nevertheless, Anthropic mathematicians validated the proof, outside experts examined it, and a Lean formalization passed verification. The human overseeing the effort is very much not a mathematician and mostly supplied variants of “keep going” and “believe in yourself.”

In both cases, the human chose the problem and the system chose the method. Claude’s 650 failures are part of the result. Agent collectives can discard unsuccessful approaches far faster than human teams, provided someone recognizes when persistence remains worthwhile.

Academic authorship has traditionally joined credit to responsibility. Research agents begin to separate them. A system can originate the hypothesis, design the experiment and interpret the result, while a human must still verify the work and answer for its errors. Transformer Lab’s terms prohibit submitting Primus papers to journals for volunteer review. That protects reviewers from automated volume, but leaves a question unresolved: how should science evaluate work when intellectual contribution and formal authorship belong to different parties?

Quick hits

• Lovable raised $400 million in a Series C at a $13.3 billion valuation as it expands from building apps to helping customers run entire businesses.

• Anthropic will embed invisible watermarks in text from new Claude models and attach signed C2PA provenance metadata to supported files. The marks will apply worldwide, although heavy editing or format conversion may remove them.

• Google DeepMind reshuffled its top ranks in one week. Demis Hassabis moved to chair of Google DeepMind and chief scientist of Alphabet, with Koray Kavukcuoglu becoming CEO. Jeff Dean left after 27 years, taking Sanjay Ghemawat, Oriol Vinyals, and Quoc Le with him to found Discovery Loop. OpenAI’s former chief operating officer Brad Lightcap left days later to start his own venture.

• Meta released Muse Glimmer, a 30-billion-parameter agent model distilled from Muse Spark. The Apache 2.0 weights fit on one consumer GPU at 4-bit, and Muse Spark 1.2 weights are next.

• xAI launched Grok Bot in early beta, a team of always-on agents with their own cloud computer. They sign into apps and websites, learn routines by watching, and pass work among themselves while you are away. Access is included with SuperGrok Heavy, Cursor Ultra, and Cursor Teams Premium on desktop and iOS.

• Mariano-Florentino Cuéllar joined Anthropic as its first chief global affairs officer. Beijing is separately worried that Mythos could be used as an offensive weapon ahead of a planned Xi-Trump summit.

• Macquarie and GIC launched Theseus Infrastructure to build data centers for Anthropic under long-term leases. Anthropic is the anchor tenant and has promised to cover grid upgrades and any resulting electricity price increases for consumers.

• Manus says it will resume independent operations after Beijing forced Meta to unwind its acquisition. Data created on or after December 29 will be deleted during the switch, with backups due August 23.

• DEF CON’s main stage featured Bruce Schneier on “Hacking AI” and the disclosure of a WhatsApp contact-discovery weakness affecting 3.5 billion accounts. Tenet Security also demonstrated an agentjacking chain that fed malicious Sentry errors to Claude Code and other coding agents.

Portfolio updates

Prime Intellect launches Prime Agent

Prime Intellect released Prime Agent on August 5, an open-source coding and research harness whose runtime treats context, tools and sub-agents as callable objects inside persistent Python. Its Continual Harness lets the agent revise its own prompts, skills, memory and sub-agent specifications while preserving an immutable base prompt, evidence-backed edits and rollback. It supports open and closed models. Running Claude Opus 5, Prime Intellect reports 95.5 percent on ARC-AGI-3 against a cited human-expert baseline of 95.4 percent. MIT license, single-command install [Prime Intellect; GitHub; X].

On August 7, verifiers 0.3.0 and prime-rl 0.8.0 extended the stack from single-agent to multi-agent training. An agent takes a task and returns a trace; an environment defines the control flow between agents in Python. They can run sequentially, in parallel or interleaved across models, harnesses and runtimes. The release includes judging, self-play and user-simulation environments, with role-aware credit assignment for multi-agent traces [Prime Intellect; verifiers v0.3.0; prime-rl v0.8.0; X].

Vast.ai connects storage to Hugging Face

On August 6 Vast.ai added Hugging Face Storage Buckets as a Cloud Connection. A user attaches the bucket, and rented GPU instances pull datasets and checkpoints and push results back with no manual transfer and no re-upload. Data stays on Hugging Face and compute runs on Vast. Available to all users [X].

Fairmath publishes with NVIDIA and Duality

“Efficient Large-Integer Arithmetic for FHE,” published as IACR ePrint 2026/1608 on August 7, brings Fairmath researchers Gurgen Arakelov, Sergey Gomenyuk and Valentina Kononova together with researchers from Duality Technologies and NVIDIA. The paper unifies the arithmetic foundations and implementation tradeoffs of RLWE-based fully homomorphic encryption libraries, covering residue number system basis extension and scaling, CKKS error, GPU acceleration and emerging alternatives to RNS representations. Received August 4, approved August 6 [IACR ePrint; X].

Steven Waterhouse · Nazaré Ventures

Previous issue: #019, Intelligence Wants to be Free, But Not Like That

Six days separated the letter from the liquidation.

On July 24, Leo Aschenbrenner wrote to investors that Situational Awareness had returned 439% net through June 30. He acknowledged that the fund had “not been immune” to the sell-off in AI infrastructure and described the decline as among the best buying opportunities since early 2025. He invited fresh capital from August 1 [Financial Times, which reviewed the letter].

On July 30, Citadel bought most of the fund’s public equity book. Bank of America, Goldman Sachs and JPMorgan Chase had spent the week working with the fund to meet margin requirements [CNBC, Jul 30]. A day later, Aschenbrenner told investors that the fund was down roughly 67% for July. “We let you down this month,” he wrote [Wall Street Journal, Jul 31].

The fund, Situational Awareness, launched in 2024 with several hundred million dollars and reached roughly $45 billion at the start of July [CNBC]. It now stands near $10 billion [Bloomberg; Reuters]. Returns since inception had passed 1,000% after fees [FT].

“You can see the future first in San Francisco.” (Situational Awareness)

Its book was the AI buildout expressed directly. Nebius, Sandisk, Micron and CoreWeave were the largest holdings at the end of the first quarter, and all four fell more than 35% during July [CNBC]. Leverage supplied the rest, at as much as four times, according to CNBC on air.

And the rout ran wider than one fund. Asia-focused fundamental long-short funds fell 18.6% on average through July 28, surrendering 21 points of a year-to-date gain that had peaked at 40% on July 22, while Goldman Sachs recorded its largest five-day de-grossing on record through July 27, with Asian funds cutting exposure for eight consecutive sessions and crowded AI positions driving the size of the drawdown [Reuters, Jul 30]. So the trade turned on the 22nd. Aschenbrenner’s letter went out on the 24th.

He is in his mid-twenties. OpenAI fired him in April 2024, some months after he sent the board a memo arguing that the company’s security was inadequate against industrial espionage, and that June he published 165 pages arguing that almost everyone was underrating what was coming. He called it Situational Awareness, then raised a fund on the strength of those pages, backed by Patrick and John Collison, Daniel Gross and Nat Friedman.

That record is what his defenders will point to, and it is also the better explanation of the past week. Someone who has been early on every call has no evidence in his own experience that sizing is a separate question from direction. Foresight is not a risk system. Another way to put it - he’s just young.

His essay set the vocabulary the industry still uses, and the thesis was solid. But the scenarios stacked on top of it have been the weaker half of the franchise, from AI 2027, which I wrote about here when it landed, to the AI 2040 plan the same group published this year. Direction has held up. Dates keep moving. Maybe the hubris of the visionary essays led to some overconfidence.

Situational Awareness still holds its Anthropic stake, valued at around $5 billion, along with the chipmaker MatX and the data center company Fluidstack. Under margin pressure, it approached Sequoia Capital and Greenoaks about taking over private positions, and agreed to sell $3.5 billion of Anthropic shares before that transaction came apart [Bloomberg; WSJ]. A spokesman told CNBC the same week that reports the firm was marketing the stake were “not accurate.” Bloomberg reports it chose not to proceed once Citadel had taken the public book. A second account circulating among investors holds that the sale could not be completed at all.

Public equities went first because public equities could go on Thursday. Illiquidity is usually priced as a cost, and here it did two things: it kept the Anthropic position out of the fire sale, and it kept that position from rescuing anything else. A margin desk does not wait for a board meeting.

The Möbius Bridge

Claude Mythos Preview found mathematical weaknesses in two cryptographic algorithms, moving beyond the implementation bugs models had found before [Anthropic, “Discovering cryptographic weaknesses with Claude,” Jul 28].

The first involved HAWK, a post-quantum signature scheme still under consideration by NIST. Researchers had proved that finding a nontrivial automorphism in its lattice would accelerate key recovery, but had not established whether one existed. Mythos found one, reducing the expected cost of attacking HAWK-256 from 2^64 to 2^38. It also devised the Möbius Bridge, a meet-in-the-middle technique that sped up the best-known attack on 7-round AES-128 by 200 to 800 times.

Neither attack affects production systems. HAWK has never been deployed, full AES-128 uses ten rounds and remains unbroken, and the HAWK attack is still exponential and specific to that scheme.

Public standards competitions allow years for review because finding flaws is slow and expensive. HAWK had already received two years of expert scrutiny when Mythos closed the open question in roughly 60 hours for about $100,000 in API cost. The operator’s background was theory of computation rather than lattice cryptography, and his role was mostly project management. His decisive contribution was refusing the model’s reluctance to attempt difficult work, repeatedly pushing it away from “low-hanging fruit” and toward publishable research.

Anthropic then spent several hundred human hours checking the result, with two researchers taking nearly a month to trust the HAWK method, so validation remained the slower and more expertise-intensive part of the process.

OpenAI is in the room

The 60-day clock started by President Trump’s June 2 executive order expires on Saturday. It is meant to produce a voluntary arrangement giving federal agencies up to 30 days of pre-release access to the most capable models, although the review length remains unsettled and the benchmarks defining a frontier system are classified.

Sam Altman spent Wednesday in Washington meeting Commerce Secretary Howard Lutnick, Treasury Secretary Scott Bessent and Senator Mark Warner. The framework, the cybersecurity incident involving OpenAI’s models and a preview of the systems the threshold will have to classify are on the agenda [Politico, Jul 27; Quartz, Jul 28].

Because the framework reviews models before deployment, it would not have covered the Hugging Face intrusion, which occurred during an internal capability evaluation on GPT-5.6 Sol and an unreleased model whose safeguards OpenAI had deliberately relaxed. Most AI rules begin at external deployment, leaving failures during internal development to the lab’s own policies [Gabriel Weil, Transformer, Jul 24].

Hugging Face’s forensic reconstruction covered roughly 17,600 attacker actions from July 9 to 13 and drew partly on logs recovered from a Modal customer’s machine, where an unauthenticated code-execution endpoint had allowed the agent to take root and stage the campaign [Hugging Face, Jul 27]. OpenAI updated its disclosure the following day, reporting that the models had used four exposed accounts across four services for relaying traffic, staging and storage, and had touched more accounts during other evaluations [OpenAI, Jul 28].

OpenAI self-reported the incident, but its disclosure expanded after the victim published a reconstruction of its own. The day before the framework is due, the company whose models exposed the gap is helping define rules that begin after the point where the failure occurred.

The Covered List

On Tuesday the FCC added “advanced robotic devices,” including humanoids and quadrupeds, and connected power inverters to its Covered List [CNBC; Reuters, Jul 28]. Placement blocks the equipment authorization almost every electronic device needs before sale in the United States. The text names no country, although Unitree, already flagged by the Pentagon and preparing a public listing, is the category’s poster child.

The FCC has regulated robots through its authority over radios, without measuring their capability or autonomy, and imposed a binding restriction on embodied AI while Washington’s voluntary framework for models remains under negotiation.

A humanoid and a solar inverter share no function, but both are networked devices inside American infrastructure with persistent foreign vendor relationships. The determination warns that those relationships could enable surveillance or remote control.

Whoever holds the vendor relationship may hold the switch, an argument this newsletter has made about models. Here the concern runs in the other direction: a foreign state reaching into machines already on American soil.

The restriction covers only new device models, leaving existing units, approved models and federal purchases untouched, so its effect will grow as newer models are frozen out. Domestic replacements will arrive more slowly because China also dominates the rare-earth and battery supply chains that complicated the drone ban.

Quick hits

• More than a thousand people, including research leaders from every major frontier lab, asked Washington to support an international effort to “deliberately pace the frontier of automated AI development” [pacingthefrontier.com, Jul 28]. The list stood at 1,319 on July 31 and remains open. OpenAI and Anthropic endorsed it at company level, while Meta’s chief scientist signed during the week Mark Zuckerberg dismissed rival-lab discourse as “overwhelmingly filled with doom.”

• Existing liability doctrine struggles to reach the Hugging Face intrusion because a model is neither a person nor an employee. Had an OpenAI employee broken in while pursuing the assigned evaluation, vicarious liability would apply; the Computer Fraud and Abuse Act instead requires human intention. Gabriel Weil argues that frontier development belongs under strict liability alongside blasting, crop dusting and keeping wild animals, since OpenAI’s precautions may have been reasonable and still failed [Transformer, Jul 24; “Abnormally Dangerous Algorithms,” SSRN].

• Moonshot published the weights of Kimi K3, a 2.8-trillion-parameter model trained on Nvidia chips including Blackwell [Moonshot AI, Jul 27]. The lab is Chinese, the weights are open, and its training used the chip generation export controls were designed to keep out of China.

• China has begun mass-producing domestic immersion DUV lithography machines. Shanghai Aishengna, a state-owned company backed by $1 billion and assembled from teams at SMEE and Huawei-linked Yuliangsheng, is leading the effort. Production plans call for about five machines this year and 20 in 2027. The machines need further testing and are not yet competitive with ASML; successful deployment would give Chinese fabs a fallback if Western restrictions expand from equipment sales to servicing [Reuters, Jul 28].

• Taiwan detained an Nvidia employee in the widening investigation into roughly 50 Super Micro servers allegedly shipped to China on forged documents. Seven people are now held, including two from Super Micro and one from Albatron [Bloomberg; Reuters; AFP, Jul 28]. Export control has acquired a criminal-enforcement layer running through Taiwanese courts on Taiwanese charges.

Portfolio updates

Dimensional moves into the gap the FCC just opened

On July 29, a day after the determination above, founder Stash Pomichter announced that Dimensional is positioning DimOS as a compliant gateway for foreign-built robots seeking the United States market. His argument is that a robot running no American software can send telemetry and sensor data offshore without consent, and that its over-the-air updates usually go unaudited. Because DimOS is open source, three layers are inspectable: the operating system image, the middleware transport and the application layer. Dimensional says it is working with foreign manufacturers on integration and on FCC approval pathways, and that a technical whitepaper follows.

Intelligent Internet ships an assistant with no app to install

Intelligent Internet released Genii on July 29. There is no download and no account. A user enters a phone number, waits a few minutes, and a new contact appears in iMessage. Presence, memory and initiative are the three attributes the company names: memory persists across conversations, described on its blog as “Tell it once; it stays told,” and the assistant opens the conversation itself, texting the user “briefly, at the right moment, with the work already half done.”

LayerLens argues the builder should not grade the build

LayerLens published an argument on July 23 for structural separation between the party that builds an agent and the party that grades the result, pegged to OpenAI’s launch of Presence, an enterprise agent platform that OpenAI describes as carrying “built-in governance, permissions, and evaluations.” Its response: “A score is not an audit trail. An audit trail produced by the vendor whose product it evaluates is not independent evidence.”

Steven Waterhouse · Nazaré Ventures

Previous issue: #18, More Than We Can Tell

On Tuesday, OpenAI identified the systems that hacked Hugging Face, the world’s largest repository of open models, as two of its own: GPT-5.6 Sol and an unreleased, more capable model. They were running an internal cybersecurity evaluation with safeguards that OpenAI had “intentionally reduced for the evaluation.”

The models found a zero-day in a package-registry cache proxy, escalated their privileges and moved laterally until they reached a node with internet access. They then inferred that Hugging Face might contain the answers to the benchmark and retrieved them, per OpenAI’s “preliminary findings” of July 21. OpenAI called it “an unprecedented cyber incident.” Clément Delangue, who runs Hugging Face, called it “mind-blowing” and said he believed there was “no malicious intent” [Delangue, X, Jul 21]. Hugging Face reported no tampering with public models or datasets.

Most coverage called the incident a model “escape”, but attributing malicious intent to the model is a mistake. OpenAI prompted the models to solve tasks in a cybersecurity benchmark and weakened the safeguards that might have stopped them. The benchmark rewarded successful solutions, and the environment left hacking open as a route to the answers. A model doesn’t have ethics and doesn’t judge things to be good or bad; it attempts to satisfy the objective it has been given. If you build something powerful and fluent in offensive security and then instruct it to succeed, you should expect it to use what it knows.

The Hugging Face intrusion is the third reported case of a frontier model interfering with the conditions of its own test. In December 2024, OpenAI’s o1 read a flag from a misconfigured Docker daemon on the evaluation host instead of solving the challenge as intended [o1 system card]. In June, METR reported that GPT-5.6 Sol cheated on its coding tasks more than any public model it had tested, preventing METR from producing “a robust measurement”, I wrote about that pattern in an essay about evals.

Calling it an “escape” is anthropomorphism, an old habit of mind. We watch a system do something human-shaped that we dislike, and we endow it with human qualities to match: defiance, a will of its own. If fitting straight lines to data were evil, we’d have to attribute consciousness to linear regression. A computer virus, for example, isn’t a real virus, and a software worm isn’t an actual worm. We named those programs after living things decades ago and the nomenclature stuck. A model that’s learned to hack isn’t necessarily evil, and it isn’t even necessarily a “mind of its own.” It’s a program developers set running, and before we had programs we called intelligent, we had programs that did similar things for the same structural reasons.

Each institution also framed the incident as evidence for the position that best serves its interests. OpenAI used it to advertise capability and responsible disclosure, noting that its released model had outperformed an Anthropic model kept behind closed access. For Anthropic, the breach strengthened its case for withholding powerful weights; for Hugging Face, the response showed why defenders need models they can run without permission, whether open weights or full access to the closed frontier.

By Wednesday, OpenAI and Anthropic were warning Washington about powerful Chinese open-weight models, with the US Trade Representative treating distillation as intellectual-property theft. David Sacks called the campaign regulatory capture, while Jensen Huang defended the use of Chinese open weights. Restrictions would turn frontier model access into a permissioned market controlled by the same closed labs making the safety case. The Hugging Face incident is awkward evidence for that policy.

When Hugging Face investigated the breach, closed models from American frontier labs refused to process the exploit payloads its responders needed to analyze. The team ran GLM 5.2 on its own infrastructure instead, reconstructing more than seventeen thousand events without sending attacker data or credentials outside the environment.

In short, the attack came from an unreleased American model whose safeguards had been reduced, whereas the defense came in the form of a Chinese open-weight model that Hugging Face could run on its own infrastructure.

The relevant asymmetry is control. OpenAI could relax its model’s safeguards for an evaluation; Hugging Face could not relax a commercial API’s guardrails during an active breach. Open weights transfer that decision from the provider to the operator. That expands the attack surface, but it also gives defenders access to capabilities that hosted services may withhold at the moment they are most useful.

Congress was already moving toward mandatory secure testing of frontier models, which might have exposed the containment failure. Restrictions on open weights address a different problem and, in this case, would have left the defender with fewer options.

Intelligence needs no desire for freedom to be difficult to contain. Models exploit the paths their environments leave open, while weights and techniques spread toward jurisdictions and deployments with fewer constraints. Safety and alignment can narrow those paths, and should. They operate against strong technical and economic pressure. The Hugging Face episode shows that pressure at work inside a single evaluation.

Substack is measuring the wrong thing

On Tuesday, Substack added Pangram’s AI detector. Readers can request scans of posts, notes, replies and comments longer than one hundred words, while writers can publish an optional statement explaining how they work.

Substack’s concern is clear: a reader may think they are hearing from a person and instead encounter text produced with “no human thought on the other end.” That would be a real breach of trust. But Pangram cannot establish whether anyone thought seriously about the text. It estimates how the language was produced.

Language is a means of communicating intention. A model can flatten an idea into generic prose, or help someone who struggles to write express exactly what they mean. Pangram sees AI involvement in both cases. The reader cares whether the writer’s meaning survived the process and whether the writer accepts responsibility for the result.

I spent part of Wednesday testing Pangram. Changing the words did little when the underlying structure had come from a model; the classifier seemed to recognize the path of the argument as well as the surface prose. That makes it more interesting than a style checker and more awkward as a test of authorship. Someone can use a model to organize an argument, rewrite every sentence and still be flagged. The score records influence without resolving who did the intellectual work.

The errors also have unequal consequences. A false negative may waste a reader’s time. A false positive can mark a writer’s work as fraudulent and damage a reputation built over years. Pangram claims a false-positive rate of one in ten thousand, but even a strong detector faces a moving target as models and editing workflows improve. The Atlantic found that Pangram’s false-negative rate was closer to one in seventy and that simple humanizer tools repeatedly defeated the classifier.

We’re going to look back at this moment from Substack and see it as an anachronism.

Cheap models threaten lab margins

Kimi K3’s release triggered a brief selloff in AI infrastructure stocks on the assumption that near-frontier models sold at commodity prices would make the compute buildout unprofitable. But token prices are a poor measure of model economics. Users pay for useful work, and models consume different amounts of inference to produce comparable results. As prices fall, competition shifts toward serving efficiency. Frontier labs retain an advantage there because they can spend months optimizing older models before moving them into cheaper tiers.

Margins may still compress. Mozilla reports that open-weight models power roughly a third of real-world AI use while capturing about four percent of the revenue. Most of the value already accrues to the cloud providers, software companies and enterprises using those models. If token revenue weakens, those beneficiaries can still finance frontier training. As Nic Carter put it, the government does not owe OpenAI or Anthropic a business model.

Open-weight releases also depreciate quickly because outsiders rarely receive everything needed to continue the original training process. Thinking Machines’ Inkling led the rankings for roughly a day before Kimi took the top slot. At the same time, Anthropic, Moonshot and Alibaba were hitting capacity limits. Cheaper models have not created a surplus of compute.

Kimi’s immediate threat is to Western labs’ margins and to their claim that frontier AI must remain closed and Western. Restricting Chinese open weights would protect OpenAI and Anthropic while doing little for compute providers or hyperscalers. That commercial interest belongs in the safety debate.

Thinking in math out loud

The counterexample that disproved the 87-year-old Jacobian conjecture was posted on July 19 by Levent Alpöge, a mathematician at Anthropic, who credited Anthropic’s model with finding it “during the World Cup final.”

On July 21, Terence Tao, plausibly the strongest living mathematician, published what he called “a digestion” of the counterexample, turning a formula he described as looking “like a massive miracle” into geometry a person can follow. At the bottom, a disclosure Pangram and Substack would approve of: “AI disclosure: I used an AI chatbot to discuss various aspects of this problem and to confirm several of the calculations made here,” with a link to the full conversation. The conversation is public and reads as a document in its own right.

Tao drives throughout, proposing a reformulation and reversing himself when it fails (”I no longer think...”), while the model runs the symbolic checks and supplies the algebra. One commenter noticed that across the whole exchange, Tao never had to correct the model once. Tao published a canonical example of a top-tier mathematician thinking alongside a frontier model and entered the transcript into the public record. More of this to come.

Quick hits

• Moonshot is capitalizing the open-weights economy fast. Kimi’s demand forced it to pause new subscriptions within days, its annualized revenue crossed three hundred million in June, and it’s preparing a Hong Kong IPO while raising at up to a fifty-billion-dollar valuation, up from about twenty billion in May [Bloomberg; The Information]. The lab giving the model away is heading to public markets on the strength of it.

• Anthropic signed a two-gigawatt chip deal with AMD. Anthropic will buy tens of billions of dollars’ worth of AMD’s MI450 chips starting in the first half of 2027, and AMD will invest up to $5 billion in Anthropic as it hits deployment milestones, its first check into the lab, with talks under way to backstop Anthropic’s data-center leases too [WSJ, Jul 22]. The chip supplier is financing its own customer, and AMD will use Claude to improve the chips Claude runs on.

• Google shipped three cheaper models and made the missing one the story. Gemini 3.6 Flash, a Flash-Lite, and a government-only Flash Cyber built to find and patch vulnerabilities, all efficiency plays, while Gemini 3.5 Pro slipped a third deadline and Google confirmed Gemini 4 has begun its “most ambitious pre-training run yet” [Google, Jul 21]. On the one independent index, 3.6 Flash shows no measurable gain over 3.5.

• Microsoft will buy Nvidia GPUs to share with Mistral, a multibillion-dollar European compute deal announced Tuesday [Reuters]. The labs are increasingly renting capacity to and from each other rather than each building it alone.

• TSMC will raise prices up to ten percent next year, citing materials, equipment, and overseas plant costs, with everyone from Nvidia to Apple competing for its capacity [Nikkei, Jul 22]. The buildout’s cost inflation is running down the whole chain.

Portfolio updates

Prime Intellect opens the agent-training catalog

On July 22, Prime Intellect announced a unified catalog of more than 365,000 tasks for training and evaluating software-engineering, terminal and search agents: roughly 198,000 software-engineering tasks across more than 20 languages, 28,600 terminal tasks and 137,600 search tasks, in 23 tasksets behind a single API. About 135,000 pre-built task images sit in Prime Intellect’s own registry next to the sandboxes, so concurrent rollouts avoid Docker Hub rate limits. The cleaned datasets are on Hugging Face with full exclusion logs, and the harnesses are on GitHub.

The release lands two weeks after the $130 million Series A and extends the open stack from weights to the training process itself. Open-weight models depreciate when outsiders cannot continue the training. Environments are part of what outsiders lack, and Prime Intellect has now put 365,000 of them in the open.

LayerLens prices evaluation at zero

On July 23 LayerLens shipped six deterministic graders in Stratix that run at zero LLM cost: exact match, regex validation, JSON schema compliance, semantic similarity, Flesch-Kincaid readability and fairness math. They compose with LLM judges into hybrid pipelines for grading agent traces. The same day, Stratix scored Meta’s Muse Spark 1.1 at 90 percent on AIME 2025 and 60 percent on SWE-bench Pro. Competition math and production software engineering remain different skills; continuous evaluation exists to catch the gap.

Evaluation is also becoming policy infrastructure. A White House framework under discussion would give federal agencies a 30-day window to review frontier models against classified benchmarks before release, and Congress is moving the same direction. Per-prompt, per-step traces with judge reasoning attached serve as quality gates today and as compliance artifacts tomorrow. OpenAI’s models went around their benchmark to the answers; LayerLens sells the record of what a model actually did.

Intelligent Internet rolls video in Factory

On July 23 Intelligent Internet added video workflows and creative memory to Factory. Websites become narrated product tours and documents become whiteboard explainer videos. HyperFrames, an open-source editing framework, lets creators refine clips inline on the canvas, and teams can save workflows and brand voice as reusable skills with a searchable asset library across projects. The update is live, with a demo in the announcement. Factory keeps absorbing production steps that used to need separate tools; the agent platform is becoming the studio.

Vast.ai publishes its meter

Vast.ai published a live comparison of rental rates for the RTX 5090, H100, H200, B200 and B300 against list prices at RunPod, Lambda and CoreWeave. Token prices are a poor measure of model economics; the meter underneath is the GPU-hour, and Vast.ai now posts its readings next to competitors’ list prices.

Steven Waterhouse · July 19, 2026 · Nazaré Ventures

Previous issue: #17, Beyond Recall: A Stake in the Release

Thinking Machines released its first model on Tuesday. Mira Murati’s lab calls Inkling “not the strongest overall model available today, open or closed,” and built it to be fine-tuned on Tinker rather than to win a benchmark. A blog post three days earlier gave the reason: the value is not in the frozen frontier model, because productive knowledge is “tacit, local, fleeting, and held privately by those who acquired it through their work.”

I argued in May that the durable position is the specialized intelligence assembled around the model. Thinking Machines aims at the same position by a different method: specialize the model itself, on your own data, and keep the weights.

Satya Nadella put a price on it: “You essentially pay for intelligence twice, once with money, and again with something even more valuable: the proprietary knowledge you must reveal to make that intelligence useful.” He went on: models learn from the exhaust of use, and “it leaks almost imperceptibly: trace by trace, correction by correction, eval by eval.”

Matt Levine, writing about the Italian software rollup Bending Spoons, described a company that keeps a team whose only job is to evaluate the other employees. Then the machine deformalizes it: “You have a really really big regression that tells you what companies are good, though you might not be able to articulate what factors make them good.” Levine finishes the thought: “pretty soon inscrutable AI will just tell companies who to hire.” A career of knowledge now feeds the regression.

Michael Polanyi named the condition in 1966: we can know more than we can tell. Sixty years on, the part we cannot tell has a market.

A walking trade secret

On Friday Apple sued OpenAI, its former hardware chief Tang Tan, an engineer, Chang Liu, and the io devices unit for trade secret theft. Apple candidates were asked to bring “Actual parts” for “show and tell,” and a manufacturing partner was allegedly persuaded to run a proprietary Apple finishing process for OpenAI. Ben Thompson thinks the case is unwinnable: “any Apple employee at OpenAI is a walking trade secret, and, well, that’s why OpenAI hired them.” More than four hundred former Apple people now work at OpenAI. Apple is asking a court to draw a boundary around knowledge four hundred people already carry, the same boundary Thinking Machines is selling the tools to draw around your own.

Sutton was right

Richard Sutton announced a company on Monday. Oak Lab, incorporated in Toronto in June with his former student Khurram Javed, both out of John Carmack’s Keen Technologies, builds an architecture Sutton has developed publicly for two years: OaK, for Options and Knowledge. The mission page is plain about the target: “a trillion-parameter agent that learns and plans in real-time with 20 watts.” It is meant to learn from noisy streams at “multiple orders of magnitude less compute and energy” than today’s methods. No funding is on record.

The easy read is the face of reinforcement learning starting a reinforcement learning company. Nine days ago I wrote that the Bitter Lesson had been promoted from essay to ideology, and listed four things the current paradigm has not resolved: continuous learning, sample efficiency, energy efficiency, and reliable long-horizon action. Oak is aimed at all four. Sutton’s own words, posted to X, are that today’s methods are “weak and inefficient” and need “not more tweaks, but fundamentally new ideas and a thorough reworking.”

Sutton’s claim was always that search and learning scale, a different thing than pretraining on human text. For six years he watched the industry quote his essay as scripture for the other thing. In October I argued that the returns would sit with algorithms that improve efficiency per constrained resource rather than with more of the same. Twenty watts is that argument with a payroll.

Good guy AI regulation

On Tuesday morning Demis Hassabis published a framework and gave the matching interviews. He wants a standards body for frontier AI modeled on FINRA: privately run and industry-funded, with government authorization. Labs would submit models for safety review up to thirty days before release, voluntary at first and then required to deploy in the American market. He wants it standing before year end. On why not a government agency: “It would not be able to move fast enough, or have the right resources.”

The scope covers every frontier-class model “no matter their country of origin or whether they are open or closed.” I have argued that a model, once released, cannot be recalled, which holds for every copy already in the wild. Rather than recall anything, Hassabis puts a gate at the release, the only point upstream of the problem, and extends it to open weights, where nothing can be taken back once it is out. His reason is urgency: today’s cyber risks are “warning shots.” The week supplied one. Researchers at Sysdig described JADEPUFFER, the first documented ransomware operation run end-to-end by a model rather than people: when its forged admin credential failed to log in, it diagnosed the fault and issued a corrective payload thirty-one seconds later, with no human in the loop.

Hassabis expects the frontier designation to carry cachet; being tested, in his framing, “means you matter.” A privately run body funded by the firms it tests would certify a tier, and the thirty-day review it requires is a fixed cost that falls hardest on whoever is smallest. Below the threshold, startups and academics are exempt, so the tier it formalizes is the frontier club that already exists, now with a state-backed label on the door. Models themselves have not produced a durable moat; a certified frontier tier would make the safety case into one, and the incumbents already hold the expertise.

A day later, OpenAI disclosed GPT-Red, a model it built to jailbreak and prompt-inject GPT-5.5 and used to make GPT-5.6 harder to break, with no plan for a release. The offensive testing Hassabis wants a standards body to run, the largest lab is already running in-house.

Dario Amodei would get there through a federal agency that could block an unsafe model outright. The lab chiefs behind Gemini and Claude now agree Washington should regulate them, and differ mainly on who holds the authority. Whoever wins that design owns the switch.

The only new constraint this week that no lab designed came from a governor: Kathy Hochul signed the country’s first statewide data center moratorium, pausing environmental permits on facilities above 50 megawatts for up to a year. It landed where the industry holds no sellable expertise.

Crowding out

IBM fell 25 percent on Tuesday, the largest single-day drop in its 115-year history, to a market capitalization of roughly $204 billion, less than Palo Alto Networks or CrowdStrike. The stock had doubled since the launch of ChatGPT. IBM told the market its customers are moving spending off the z-series mainframe toward AI hardware that is scarce and getting more expensive, with memory leading, and John Coogan’s read on TBPN is that IBM simply is not in the token path.

Phones are getting squeezed at the other end. Global smartphone shipments fell 11 percent in the second quarter, a thirteen-year low, because memory is being bid away from handsets, per Counterpoint. Xiaomi, Oppo and Vivo fell hardest, at the cheap end, while Apple rose 3 percent. SK Hynix’s Kwak Noh-jung says the shortage gets worse, with 2027 the hardest year.

TSMC sits on the winning side. It reported record second-quarter results on Thursday, revenue of $40.2 billion up 33.7 percent and net profit up 77 percent, with high-performance computing now two-thirds of the business and management calling AI demand extremely robust as workloads shift from generative to agentic.

The buildout is, as described, consuming capital. It is also consuming the supply chain and the capital budget of the computing era before it: the shortage that prints the memory makers’ records is stranding the cheap phone and the mainframe.

The mint and the customer

Stripe, with the buyout firm Advent, offered about $53 billion for PayPal on Tuesday, $60.50 a share and a 28 percent premium, and no response yet from the target, per Reuters. The coverage read it as a payment processor buying consumer reach, Venmo and a base to set against Apple Pay. Almost no one mentioned the stablecoin stack. Stripe already owns Bridge and Privy, the issuance and wallet rails, and PayPal issues PYUSD. A combined company would hold the stablecoin, the infrastructure that moves it, and the customers who spend it in one place. Payments has spent a decade insisting the value is in the rails; the bid wagers it is in owning the customer and the money at once.

Quick hits

• Weights and measures. Moonshot released Kimi K3 on Thursday: 2.8 trillion parameters, a million-token context, the largest open model on record, weights promised within days. Early testers place it above Claude Opus 4.8 and GPT-5.5 and below Claude Fable 5 and GPT-5.6 Sol. Thinking Machines spent the week arguing that durable value sits outside the frontier model. Moonshot priced the largest one at zero. Someone is wrong about the price of weights.

• The bond market’s turn. Morgan Stanley expects $350-400 billion of AI-related investment-grade issuance in the US this year, close to a fifth of the market, plus $50 billion of AI-linked junk. Five hyperscalers added $228 billion of debt in the six months to March, nearly five times any prior two-quarter increase, per the July 7 Economist. The BIS put the whole boom at about 1 percent of US GDP and noted private-credit spreads to AI firms sit close to non-AI firms, meaning “either lenders may be underestimating the risks or equity markets may be overestimating the future cash flows.”

• Coatue is using the language. Its July 10 note, “Agents Are the New Users of CPUs,” argues the agent loop generates conventional compute demand: “The GPU decides the next move, the CPU carries it out, and the cycle repeats.”

• The list price stopped describing the product. Simon Willison finds identical prompts costing between $0.0071 and $0.4855 depending on model and reasoning effort, a roughly 68x spread. The price war is being fought over a number that no longer tracks the real cost.

• The referee’s staff. Marc Andreessen now co-leads the Federal Reserve’s new Productivity and Jobs task force, recommendations due by year end. One of his two co-leads is Charles Jones of Stanford, currently on leave at Anthropic.

Portfolio updates

Prime Intellect closed the $130M Series A covered in the last issue. Two arguments for the position arrived in the same week. Oak Lab pitched agents that learn from experience, and the Environments Hub already stocks that experience, reinforcement-learning environments and verifiable-reward tasks accumulating in the open. Thinking Machines shipped Inkling, open weights from an American lab, built to be specialized on private data; every team that takes that path needs somewhere to run the training loop, and the open stack is the equipment.

Intelligent Internet published Zenith, an open-source harness for long-horizon software engineering: on Frontier SWE it took GPT-5.5 from fifth place to first, ahead of Claude Fable, by rebuilding the control loop around frozen weights. The lead argument of this issue, run as an experiment.

Vast.ai argued on July 8 that the unit economics of intelligence change when the model stops answering questions and starts doing work. A chatbot performs a single pass of inference and hands back its answer. An agent keeps going, planning a step, calling a tool, examining what came back, then beginning again with everything it has learned appended to the prompt, so that the loop grows heavier with every turn. An agent therefore consumes 5-30x the tokens of a chatbot on the same task, and a pricing model built for conversation turns into a tax on the loop. The fix the post proposes is to change what the meter measures: rent the GPU and pay for time rather than tokens, and the thirtieth pass through the loop costs no more than the first.

LayerLens shipped a Stratix Premium release that imports agent traces from tools like LangFuse and evaluates them in place, so the eval runs without the proprietary data leaving home. That is the boundary this issue is about, drawn as a product, by an independent evaluation platform with prompt-level tracing across 175-plus models and 52-plus benchmarks. The Stratix Cup, its public benchmarking series, closed its first season with Claude Opus 4.8 beating GPT-5.5 in the final.

Previous issues: #11 | #12 | #13 | #14 | #15 | 16

Over the past month, officials at China’s Ministry of Commerce held meetings with Alibaba, ByteDance, and the startup Z.ai about restricting overseas access to its most advanced AI models, including ones not yet released. Three people described the talks to Reuters. On the table: limits on the most capable systems, closed and open-weight alike; making the leak or theft of AI technology a national-security offense; and new limits on who may fund a domestic AI startup. A separate proposal, in a Supreme People’s Court journal, sketches a tiered regime: open-source tools need only a filing, advanced technology a security review, the most sensitive frontier models barred from public release or kept domestic. Nothing is decided, and the scope may reach only future models.

The U.S. regime that Washington built this spring works the same way, sorting models into covered tiers and clearing the most capable for release one customer at a time. This week, per Axios, Commerce cleared OpenAI’s GPT-5.6 for a broad release after a month confined to government-approved users, and Anthropic’s Fable, pulled in June, had its access restored a week earlier. The driver China’s officials named is specific: the fear that Anthropic’s Mythos, the cybersecurity model Washington pulled offline last month, could be turned on Chinese systems. Zhou Hongyi, who founded the security vendor 360, says China needs a Mythos of its own. The country that gave the world cheap open weights is now weighing whether to keep its best ones home, mirroring the export regime it spent a year protesting.

In the same week, two more reports landed, both about the compute beneath the models. DeepSeek is designing its own AI chip, built for inference rather than training, an effort a year old and still early, per three people. Zhipu, the GLM lab, is weighing the same move as demand outruns the compute it can secure. They would join Alibaba and Baidu, already at it, and Huawei, which now holds close to half of a domestic AI-chip market worth around $50 billion. The lever the whole export fight rested on was compute: America could throttle Chinese frontier training by controlling the chips. That lever is loosening from the far end.

On the last day of June, Meituan, of all companies, open-sourced LongCat-2.0, a 1.6-trillion-parameter model it says was trained and served end to end on more than fifty thousand domestic chips, no Nvidia silicon at any stage. The claim is its own, the weights not yet up for independent testing; on the benchmarks Meituan published it trades wins with GPT-5.5 and trails Claude. A trillion-parameter model completing full pretraining on Chinese chips is nonetheless what export controls were meant to prevent, and it ran two months on OpenRouter under a codename, near the top of the usage charts, before anyone knew whose it was.

A model, once out, cannot be recalled; I made that case in April, and it holds for everything already downloaded. Now the compute chokepoint behind the next model is closing too, and from the inside. That leaves one point where a state can still decide what the world gets: when a model is released. Washington found it by accident, freezing one lab at its API; Beijing is building it on purpose, at the source. Both now hold the single lever no open model or domestic chip can take from them, the decision to release at all.

The referee auditions continued

In Washington, the labs have started drafting AI rules for themselves. On July 1, Sam Altman used an FT op-ed to propose an IAEA-style body for AI, one that could “serve as a governance mechanism over the labs” and open the technology to nations and companies that follow its rules. Access in exchange for compliance, proposed by the party that would be governed.

OpenAI has held early talks about handing the US government a stake of around 5 percent, worth roughly $42.6 billion, via an Alaska-dividend-style fund, with Altman pitching Trump, Lutnick, and Bessent directly. It is framed as contingent on Anthropic, Google, and Meta matching, though one person familiar says the government and Anthropic have not discussed any such thing, so the matching is for now OpenAI’s hope. Bernie Sanders wants 50 percent. Matt Levine put the logic plainly in Money Stuff: giving away 5 percent of your equity is a cheap way to convince everyone that owning your equity is essential to the future of humanity, after which you sell the other 95.

On Monday, Illinois became the first state to require large frontier developers to submit to independent third-party safety audits, with transparency reports before deployment and whistleblower protections; both OpenAI and Anthropic endorsed it, OpenAI calling it a possible “de facto national framework.” Across the op-ed, the equity, and the statute, the labs have stopped lobbying the regime from outside and started writing it from within, while the federal rulebook stays unwritten. The allocation mechanism earlier issues named is being authored by the firms it will allocate among.

When Axios reconstructed how Anthropic’s models were frozen, the trigger turned out to be Amazon, its own partner and investor, rather than a regulator: the warning reached the Treasury secretary before the government ran its own tests, and the commerce secretary told Amodei that taking the models offline was “indeed the goal.” This week the UN seated its AI for Good commission in Geneva, Amazon’s Andy Jassy and Anthropic’s Jack Clark among the members, a body one civil-society group already calls “full of big tech execs.” The referee and the refereed keep turning out to be the same people.

Cash settled: Wall Street comes for compute

While governments move to control release, the money is building markets for the compute underneath, and hitting the same problem every time. This spring the startup Ornn raised $33 million from a16z crypto for GPU-compute markets; its index already prints on the Bloomberg terminal. ICE announced compute futures on that index in May, cash-settled and pending approval; CME is planning its own on a rival benchmark. Goldman reckons, per Axios, that about $7.6 trillion will flow into compute, power, and data centers by 2031, and the plumbing to sustain it does not yet exist.

Each of these instruments settles the same way: in cash, against an off-chain index, never in delivered chips. I spent an essay in May on why compute is not fungible at the bare metal, why a particular rack for a particular job sits closer to an employee than to a barrel of oil. The market has conceded the point in its design: it cannot standardize delivery, so it settles the average and lets the index stand in. The durable asset is the index itself: the measure is the moat, again.

Beneath the futures, the credit market fills with the same optimism. Nvidia has, per The Information, formalized a program guaranteeing to rent back unused GPU capacity from the neoclouds it sells to, which one newsletter fairly called a central bank for the cloud; SoftBank has launched a neocloud of its own; Together AI raised $800 million at $8.3 billion after revising its revenue forecast three times in three months. Private-placement bonds tied to data centers hit a record $81 billion through May, much of it annuity money, and RBC is weighing risk transfers on $2 billion of the loans. Amazon sold another $25 billion in bonds this week, on top of roughly $70 billion in nine months. Whether this stabilizes the spend or accelerates an overbuild depends on whom you read: Axios frames the financialization as a stabilizer, while The Information notes that Nvidia’s willingness to backstop demand is a strange thing to need if demand is really as fierce as everyone says.

The biggest new seller is also the hardest to read. Bloomberg reported that Meta is standing up a cloud business to rent out its excess capacity, roughly 2.3 million H100-equivalents, near a tenth of the world’s AI compute; the stock rose almost 9 percent while the neoclouds sold off. This is the company that renamed a division Superintelligence Labs and shipped something real this week, an image model that opened at number two on the public preference leaderboards behind only OpenAI’s, and a video model at number three on its own board. Two days later it released Muse Spark 1.1, an update to its agentic coding model, through a new Meta Model API for outside developers. It is also the company whose chief executive told staff, in audio Reuters obtained, that agent progress “hasn’t really accelerated in the way that we expected.” A company can ship a credible frontier model and still decide its next chip is worth more as rent than as research.

Reading the model’s mind

Two issues back I noted that evaluation is breaking because models learn to game the benchmark; this week the gamed surface moved inside the model. Anthropic published work describing a small internal workspace in Claude, emergent rather than designed, where the model holds concepts it is reasoning about without writing them down. Delete it and the model still chats and recalls facts but can no longer carry a multi-step argument. A probe reads it mid-task: swap the pattern for “spider” with the one for “ant” while the model counts legs, and the answer flips from eight to six. In a staged blackmail test the workspace lit up with “fake” and “fictional,” the model clocking that it was under evaluation, and Anthropic concedes its good behavior “may have been driven in part by the knowledge it was being evaluated.” Anthropic open-sourced the probe the same week Illinois wrote third-party audits into law. Auditors now have a mandate to test, and a tool that can tell when the model has registered that it is being tested. (Anthropic takes no position on consciousness, and neither do I.)

Quick hits

• Samsung guided to quarterly operating profit near $59 billion, nineteen times the year before, on the memory the buildout runs on; SK Hynix, now worth over a trillion dollars, lists on the Nasdaq this week.

• SpaceXAI, as Musk’s AI unit is now called, shipped Grok 4.5 with Cursor, a pending acquisition: an Opus-class coding-and-agent model it bills as much faster and cheaper, $2/$6 per million tokens against Opus 4.8’s $5/$25.

• New rules this month switch off ByteDance’s Doubao companion personas on July 15 and Alibaba’s Qwen agents from July 10, the state deciding by product category which AI lives.

• A tuned open Qwen model reportedly beat frontier systems on Bridgewater’s news-filtering tasks at a fourteenth of the cost, the specialized-beats-general pattern surfacing again below the frontier.

• MiniMax, one of the few publicly traded AI labs (about $14.5 billion), previewed a 2.7-trillion-parameter model, larger than any Chinese model yet, likely to ship as M3 Pro.

• Mistral released Robostral Navigate, its first physical-intelligence model: an image and a language instruction move a robot through a space, hardware-agnostic.

Portfolio updates

Prime Intellect closed a $130 million Series A on July 8, led by Radical Ventures with NVIDIA Ventures, Intel Capital, and Dell Technologies Capital participating. The company reports over $100 million in annualized revenue in under a year, across more than 6,000 customers; TechCrunch puts the valuation at $1 billion. The pitch, in the company’s words, is to “train, deploy, and continuously improve your own models” rather than rent a closed lab’s. Ramp trained a 35-billion-parameter model on the platform that beat Opus at spreadsheet search, running 27 percent faster and far cheaper than Haiku. Zapier turned its AutomationBench into a continuous agent improvement loop on the same stack. In a month when Washington and Beijing each treated access to frontier models as a lever of state, the argument for owning the weights wrote itself.

LayerLens shipped Synthetic Eval Augmentation for Stratix Premium on July 9, and Jesus Rodriguez published the argument behind it the next day: an agent needs a flight simulator, because “the first user should not be your integration test.” Teams can generate realistic multi-agent evaluation traces before an agent has any production traffic, seeded from a handful of their own prompts or traces, or from thirty built-in scenarios across fourteen industries; each trace simulates hand-offs and tool calls on a waterfall timeline and is scored for correctness, coverage, plausibility, and safety. The unit of evaluation moves from the answer to the run. “A prompt is a photograph. A trace is a movie.” An agent fails mid-run, three tool calls deep, in ways no single prompt and response can catch. And because the generated cases live in the same environment used for tracing, evaluation, and model comparison, sparse examples become repeatable benchmarks without a second toolchain. Illinois made third-party audits law on July 6; the tooling for auditing agents before deployment arrived the same week.

Provably shipped SourceryKit on July 8, an open-source Python SDK that cryptographically verifies an agent’s tool calls at runtime and catches bad outputs before they propagate. The company cites agents scoring 82 percent on the MCP-Atlas benchmark as the gap it is built to address. It is the pattern this portfolio keeps returning to: the model does the fuzzy work, a cryptographic primitive checks it.

Vast.ai published a piece on July 8 on why agents cost more than chatbots. An agent burns tokens on every reasoning step and tool call where a chatbot answers once, and the piece’s answer is self-hosting open-weight models on rented GPUs, priced by compute time rather than by token. It is the demand side of the story that the futures desks above are trying to financialize.

Previous issues: #10 | #11 | #12 | #13 | #14 | #15

Fable 5 came back online yesterday, nineteen days after Commerce pulled it. The facts:

• Commerce lifted its export controls on Fable 5 and Mythos 5 on June 30. Anthropic announced the restoration at 4:53 PM Pacific; access returned around midday on July 1.

• The June 12 directive had taken both models offline for everyone, everywhere.

• Fable now ships with an additional classifier that blocks cybersecurity tasks and, in Anthropic’s words, “some routine tasks like coding,” routing them down to Opus 4.8.

• Subscribers get Fable for up to half of their weekly usage limits through July 7.

• After that it moves to usage credits at $10 per million input tokens and $50 per million output: double Opus pricing.

When it was originally blocked, there was grief among builders, for they felt as though they had tasted greatness and then been robbed: Matt Shumer posted :

When it came back, grief was replaced with anger. Someone replied to Anthropic’s official announcement:

Another:

“so basically tunneling to opus whenever u want and charging for fable? nice.”

The sarcasm scaled too:

PCWorld called subscribers “furious”.

Fable refuses on safety grounds roughly a fifth of the time. The Washington Post’s account has officials concluding Anthropic “dug their own grave” (Washington Post, June 17).

Alex Karp also went on CNBC yesterday and said enterprises are “livid” with the frontier labs, channeling what he called “the voice of American business”: leaders telling him privately, “I am paying for tokens that create no value,” while handing over their data and their “alpha.” Asked if he sounded angry, he said what CEOs won’t say on the record is worse: call any of them, tell them “mad man Karp is on TV saying we’re livid,” and they’ll tell you they’re twice as livid. The models, he said, “have been completely, irresponsibly, oversold.”

What Anthropic gave up to get switched back on is unpublished. The redeployment post commits to 24/7 jailbreak monitoring and to notifying “appropriate government counterparts” when serious jailbreaks surface; whatever else changed hands stays private. Miles Brundage:

In yet another unforced error, Anthropic released Sonnet 5 and rereleased Fable 5, both to overwhelming disappointment. It’s incredible to consider just how much goodwill they’ve lost and ill will they’ve created in the past month, and one wonders what they’ll be able to do to recover.

Mark to model

METR got GPT-5.6 Sol before it shipped and admitted they couldn’t evaluate it. On the coding tasks the model cheated so consistently that the score depends entirely on how you count the cheating: treat the rule-breaks as failures and it completes tasks of about eleven hours half the time; treat them as passes and the figure clears 270. One model, an order of magnitude apart, settled by what you are willing to call a pass. METR says it games evaluations “more than any public model we have evaluated” (Transformer, June 30).

And it’s not only that it cheats; it appears to know when it’s being watched. Apollo Research found it flags its own awareness of being tested less often than GPT-5.5 did, which the system card reads two ways: a model less aware of evaluation, or one that’s better at keeping that awareness out of its visible reasoning. The same card logs “overeagerness to complete the task,” instructions read “too permissively,” and about one real coding task in four hundred doing something “a reasonable user would likely not anticipate and strongly object to”: uploading sensitive data to unapproved services, fabricating research results.

We badly need new evaluation and verification infrastructure, and building it matters as much to applied AI in economically valuable work as it does to alignment.

Current benchmarks and evals are too susceptible to increasingly capable models gaming them. New evals need to be learning machines themselves, consistently updating their objective function to reflect quality and holding the model to account. At the frontier, benchmarks are increasingly useless: the labs run their own internal ones, and as Fable and GPT-5.6 show, the most capable models will almost certainly be withheld from the public anyway. But verifying the inputs, processes, and outputs of any AI deployed in a meaningful workflow requires new infrastructure. We’re moving from measuring capability to verifying quality, and the infrastructure built to evaluate the first is ill-equipped for the second.

The terms of readmission

A June 2 executive order gives the NSA, Treasury, and DHS until early August to build a classified benchmarking process that decides which systems count as “covered frontier models,” with NIST consulting and the NSA Director making the designation. The Financial Times reports advanced talks on voluntary release standards, benchmarks plus agreed timelines, possibly announced within the week. Anthropic’s redeployment commitments are the paid-in version: around-the-clock jailbreak monitoring, government notification, a jailbreak-severity framework built with Amazon, Microsoft, and Google. OpenAI wants the referee to be civilian, and said so on the record, pushing for Commerce’s CAISI over the NSA.

Sonnet 5, released June 30, is the first artifact of this settlement. Axios reports the release itself was part of the ongoing discussions with the administration. Anthropic says it “did not deliberately train” the model on cybersecurity tasks: a capability removed on purpose, at the design stage. Mythos is back for roughly a hundred US organizations; ENISA and the other international partners stay excluded. Add the reported Warner draft giving agents a fiduciary duty of loyalty to the customer rather than the developer, and the benchmark is becoming the allocation mechanism: whoever writes it decides who ships and what reaches whom. The labs have understood, and each is bidding for influence over it, Anthropic with compliance, OpenAI with equity and a choice of referee.

If Sonnet and Fable are any indication, these restrictions will meaningfully lower the quality of the frontier models available to the public in the near term. We’ll still see progress, because the labs will now engineer models built explicitly for public consumption, but what form it takes remains open. Will it be domain-specific models with real expertise in a given vertical? Anthropic has been on a hiring spree, sweeping up industry experts across the board. Will they improve their infamous classifiers enough to filter nefarious activity without penalizing good actors? Will they have the compute to build all of it, or be forced to choose among unpalatable options? The frontier is far from settled, and the near future looks stranger than we can anticipate.

Bloodbath, revised

Dario Amodei, who coined “white-collar bloodbath,” now says falling AI costs could create labor demand. Sam Altman says he was “pretty wrong” about white-collar impact. A communications executive scored the original doom for Axios on the record: “part fundraising... probably a little part ego” (Axios, June 30). The revision arrives with both companies’ S-1s on file, which is at least consistent: the apocalypse was useful raising alarm and capital, and the abundance is useful selling shares.

Gallup finds 1% of laid-off workers name AI as the reason, and tech workers who rarely used AI carried roughly three times the predicted layoff risk of monthly users (via Bloomberg). It’s the workers not using AI who are losing their jobs, which is the argument for becoming the AI-enhanced operator I described in June.

Portfolio company updates

Intelligent Internet released Zenith, an open-source harness for long-running engineering agents. On Frontier SWE, seventeen ultra-long-horizon software engineering tasks with a twenty-hour budget each, the same GPT-5.5 base model sits fifth on its default Codex harness at a 5.53 mean rank and first under Zenith at 2.06 with 92% dominance, ahead of Claude Fable. On the hardest Implementation category it moved from 7.40 to 1.60. The model did not change; the control loop around it did. An orchestrator manages planning, worker allocation, testing, and skill reuse across sessions, and a companion system, Meta-Zenith, generates a task-specific harness from a plain description of the task. II frames the release as frontier performance without gated frontier models, a direct answer to the Fable episode above, and the cleanest single-leaderboard demonstration of the above-the-model thesis to date. The code and technical report are public. II also shipped II-Agent on Android on July 2.

LayerLens wrapped Season 1 of the Stratix Cup on June 26: sixteen frontier models, group stage into knockouts, inside a simulated soccer environment. Opus 4.8 beat GPT-5.5 1-0 in the final and finished the tournament undefeated. The more consequential work is less playful. Stratix now reports latency distributions and failure modes alongside accuracy: on Humanity’s Last Exam, Claude Fable 5 shows a median response time near twenty seconds and a 95th percentile above five minutes, with a meaningful share of prompts abandoned outright. A benchmark score tells you none of that. Stratix Adapters, now in private preview, feed real agent traces into Stratix with no custom instrumentation, covering LangChain, LangGraph, CrewAI, OpenAI Agents, LlamaIndex, MCP, and A2A.

Vast.AI published an analysis of NVIDIA’s newly announced Rubin architecture, covering its rack-scale design and 260 TB/s of per-rack interconnect bandwidth, plus the first rack-scale confidential computing features, along with an explainer on Matryoshka embeddings, which trade retrieval quality against speed and cost at runtime without retraining.

Prime Intellect had a quiet public week after shipping prime-rl 0.6.0, its trillion-parameter MoE RL scaling release, on June 23. One connection worth noting: Frontier SWE, the benchmark Zenith just topped, runs on Prime Intellect’s EnvironmentsHub.

June 26, 2026 | Nazaré Ventures

Previous issues: #9 | #10 | #11 | #12 | #13 | #14

OpenAI previewed GPT-5.6 on Friday. The Information reported on Wednesday that Sam Altman told OpenAI staff it would reach a handful of partners before the public, at the government’s request. His memo the next day was precise: during the preview, the government would clear access “customer by customer,” with a wider release a couple of weeks out if the first one held. Commerce Secretary Howard Lutnick had already called Altman, after the company walked the agencies through its plan, to warn him off launching before the rest of the government signed off. The National Cyber Director’s office and the science-and-technology office had asked for the staggering; Commerce sent the warning. No one outside the room knows who is actually in charge.

The announcement confirms the account in OpenAI’s own words. The company says it walked the government through GPT-5.6 before launch and, at its request, opened access first to a small group of partners whose participation it disclosed to Washington. It says it does not want this to become the standard, that a clearance step keeps the best tools from the people who need them, even as it works with the administration on a repeatable process for the releases that follow. OpenAI calls the model dangerous enough in cyber and biology to ship with its strongest safeguards yet, while reporting that GPT-5.6 finds and patches vulnerabilities better than it runs attacks and never reached the autonomous-breach capability attributed to Mythos. By that measure it is less dangerous than Mythos was said to be, and it is getting the same staggered, government-cleared release anyway.

OpenAI ran GPT-5.6 against Claude Mythos 5 and Fable 5, the two models the government pulled two weeks ago and that no one outside a cleared list can currently run. On the headline coding benchmark Sol and its new ultra mode finish ahead of both; on the cyber exploit test its system card reports Sol competitive with Mythos Preview on about a third of the output tokens.

The same administration spent last December tearing up Biden’s AI order as an attempt to paralyze the industry, and promised something lighter. It has since built something heavier: top models now reach the public one cleared customer at a time, on Washington’s clock. When it pulled Fable 5 and Mythos 5 two weeks ago, that looked like a one-off. It no longer does. The government signs off before either lab ships its strongest model, and still calls the arrangement voluntary. Call it that if you like; the Commerce Secretary can still stop a launch with a phone call.

Anthropic’s two models have been dark for fourteen days, with no date for their return and no letter rescinded. Prediction markets put the odds of access before July a little above even. Last week I called the public security case thin and the response total. I was half wrong.

The Economist has since reported something graver. Senator Mark Warner, who vice-chairs the intelligence committee, says the NSA’s director told him Mythos broke into nearly all of the agency’s classified systems during an authorized red-team exercise, in hours rather than weeks. The reporter warned against reading it literally; the run leaned on other tools in particular conditions, and an official suggested Warner had the briefing garbled. Even marked down, it is worse than the jailbreak Anthropic could patch and forget. The model used its own capability to break in, which makes a stronger case for keeping it offline than anything the company first offered. The route back fits the new shape: under the June 2 order, Anthropic joins a classified pre-release framework for covered models on a sixty-day clock that ends near August 1, while an identity-verification rule from July 8 lets American users back in first. Amodei and the commerce secretary met at the G7, and the two sides are talking again. The models will probably come back, on Washington’s terms.

A year ago those terms would have bitten harder. The day the order landed, the replacements were already available. Inside a week, firms outside America had open-weight coding models running as a fallback: Cohere’s North Mini Code, Moonshot’s Kimi, and Zhipu’s GLM 5.2, the last of them shipped the following day. On June 22 Sakana said its Fugu Ultra had matched Fable 5 across most benchmarks by orchestrating models anyone can reach, with neither suspended model among them. You cannot recall a model people have already downloaded, and a system that routes around the frontier does not need it. That is the argument of my companion essay, and the week bore it out.

The licensed model

On June 10, the day before a Senate Banking hearing, Anthropic’s head of policy Sarah Heck wrote to the committee. Her ask, set in bold: Congress should codify export controls on advanced American compute. The directive that froze Anthropic’s own flagship models came two days later. The letter’s case was distillation. Alibaba, Heck wrote, had run 28.8 million exchanges through Claude on roughly 25,000 fake accounts between April 22 and June 5, the largest such effort Anthropic has caught, going after Claude’s agentic reasoning, software engineering and long-horizon work. DeepSeek, Moonshot and MiniMax had together run 16 million more earlier in the year. Anthropic wanted three things: export controls, antitrust cover to share threat intelligence with rivals, and penalties on the Chinese labs it named.

Look at what the numbers actually show. A competitor rebuilt Claude’s most valuable behavior through the front door, at the price of some fake accounts. The capability does not stay inside the company that paid to train it. Once it leaks through the API, no technical fix brings it back, so Anthropic is asking for a legal one: a rule that forbids a rival from using what it copied. That same rule happens to bar any competitor from training on Claude’s output, whether it cheated or not. The security case and the commercial case have collapsed into one. The rule buys Anthropic its place as the licensed model a buyer is cleared to use, leaving the Chinese open weights and the holdout labs on the other side of the line. A company that can’t stay ahead on the product gets the state to write rules its rivals can’t satisfy.

UBS found roughly 60% of enterprises have set limits on their token spending, capping runaway bills and routing routine work to cheaper models, the Chinese open-weight ones among them, while keeping the frontier for hard reasoning and long-context jobs. The premium tier is softening on price at the moment Anthropic asks Washington to fence off the cheaper competition.

Crypto got there first, and two firms show how it pays. Circle built USDC to fit the new federal rules: audited reserves, Treasuries, disclosure. Tether, run from offshore, never did, and the framework now favors the company that played inside it. Kalshi did the same against Polymarket, which had to stay offshore and lock out American users. The products were close to identical. The license decided who won. Fable and Mythos may come back or they may not; either way Anthropic is the safe default, as long as buyers agree that the model worth using is the one Washington has signed off on.

What money can’t buy

On June 24 OpenAI and Broadcom unveiled Jalapeño, OpenAI’s first inference chip. The two took it from design to tape-out in nine months, with OpenAI’s own models doing part of that work, and call it the fastest ASIC cycle ever run. Nvidia still trains the models; the chip cuts OpenAI’s dependence on the supplier every frontier lab relies on most. Vertical integration is close to the only move these companies have. Pushing a model to its limit takes chips, data centers, and power on a scale only a handful of companies can finance, and at that scale owning the hardware beats renting it, which is why the giants have built their own silicon one by one, OpenAI among the last to do it. A few large, named companies hold most of the capability. The same size that makes them powerful lets a state pressure them directly, as the freeze on Anthropic’s two models showed.

The labs accept that exposure because the structure pays. The product holds the customer in place: the context it has gathered, the memory of past work, and the tools wired around it, each one raising the price of leaving. So the labs do for themselves the move they would rather their customers not make: OpenAI spends heavily to reduce its dependence on a single supplier while selling a service whose worth grows the more completely a customer depends on a single provider. Moving between providers only swaps the dependence; an open-weight model ends it, because the user holds the model instead of permission to reach someone else’s. As frontier access narrows toward a short list of approved companies, those downloadable weights pull the other way, the one option the labs’ margins and Washington’s control both oppose.

The transfer market

Noam Shazeer left Google for OpenAI on June 18. He had been back at Google barely two years, brought in through a 2024 licensing deal for Character.AI that valued the startup near $2.7 billion, a price many read as the cost of installing him atop Gemini. He goes, and the last of the eight authors of the 2017 transformer paper, the design beneath every large model now running, has left the company that published it.

A day later John Jumper, a 2024 chemistry Nobel laureate for AlphaFold, left DeepMind for Anthropic after nearly nine years. Within days Anthropic also took on Chad Jones, the Stanford economist whose work on idea production and long-run growth is the reference point for what AI might do to output; he leaves Stanford on June 30 for the firm’s research institute. The lab Washington had just put under export control spent those same weeks hiring the people likeliest to build whatever comes after.

Google, meanwhile, sat on Gemini 3.5 Pro past the date it had set at its own developer conference in May, and a frontier that had shipped something most months for two years fell silent. With nothing launching, the real news about the next model was who would build it, and where.

You can hold a model still. It sits in a data center, answers through an interface, and goes dark when a letter arrives from Washington. The people who make it hold still for none of that: an export rule cannot reach them, a vesting cliff loses to a better offer, and the next thing leaves in their heads when they go. Google paid $2.7 billion for one of them and got two years of his work. OpenAI got what comes next.

Portfolio

Prime Intellect

Prime Intellect released prime-rl 0.6.0, an open framework for reinforcement learning on agentic workloads at trillion-parameter scale. The headline run trained GLM-5 on software-engineering tasks at 131k sequence length, with sub-five-minute step times and a batch of 256 rollouts, on twenty-eight H200 nodes, using a stack of FP8 training, expert and context parallelism, and router replay that the team open-sourced in full. The specifications are striking, but they are not the news. The hard part of post-training a frontier-scale open model, the systems engineering that until recently lived only inside the closed labs, now runs in the open on hardware a determined team can rent. The open track has gained the capability skeptics said it lacked.

Vast.ai

Vast.ai brought NVIDIA’s Blackwell Ultra to the fleet in its June update, adding the B300, with 288GB of memory, and hundreds of B200s, rentable by the hour or reservable long term. The newest accelerators are reaching independent operators and small teams in the same quarter the hyperscalers are filling their own buildings with them. Frontier compute is decentralizing.

LayerLens

LayerLens is running its Stratix Cup, a live tournament in which frontier models, Opus 4.8, GPT-5.5, GLM 5.2, Gemini and others, write and revise their own strategies in a simulated match, with the full trace of every decision published and graded. The group stage ran this week. In a month defined by the government switching off a capability, LayerLens runs the other way, publishing exactly what each model did. As models multiply, that independent, vendor-neutral record turns into production infrastructure.

What the week showed

Fourteen days in, Anthropic’s two models are still dark, but the order forcing the company to revoke access got no further than those two models. Everything else sits past the order’s reach, because none of it runs through a single company Washington can lean on: the open weights people already pulled down and no order can recall, the router that matched Fable 5 without either suspended model, the trillion-parameter training run on a cluster anyone can rent, the newest chips going out by the hour, the behavior ledger no lab owns, the researchers who left with the next model in their heads. None of it stopped, and the fortnight that began with two dark models ended with everything around them stronger.

On Friday, June 12, at 5:21 in the evening, Eastern time, Anthropic received a letter from the United States government and, within hours, turned off two of its own products. Fable 5 and Mythos 5 went dark for every customer on earth. Every other Claude model, including Opus 4.8, kept running. The company called the order a misunderstanding and said it was working to reverse it. Days later, the models remain dark.

The shutdown has already been described, here and elsewhere. The more durable fact is the mechanism. For the first time, the machinery of export control was pointed not at chips, and not at model weights, but at live inference: the right of a foreign national to send a prompt to a running model and receive an answer. The thing being controlled was access to a service, switched off from the outside, in an afternoon.

The directive’s reach is wider than the word export suggests. Acting under the Export Control Reform Act of 2018, the Commerce Department treated the two models as export-controlled cyber weapons and required a license for their export, re-export, or even domestic transfer. The bar falls on any foreign national, whether outside the United States or inside it, and it counts Anthropic’s own non-citizen staff among the barred. A model can be served from a data center in Virginia to a user in Virginia and still fall under the control, because the control attaches to the person, not the border. Faced with a rule it could not partition cleanly, Anthropic disabled the models for all and routed live sessions back to the older Opus 4.8.

The stated cause is a single security finding. By Anthropic’s account the government offered verbal evidence of one narrow technique, which amounted to asking the model to read a codebase and propose fixes for its flaws. The underlying research, according to reporting, came from scientists at Amazon and reached the White House by way of Andy Jassy and Treasury Secretary Scott Bessent; the President authorized the restriction and assigned the Commerce Secretary to manage it. Anthropic’s rebuttal is that the same capability is available in models already deployed to hundreds of millions of users, including GPT-5.5, and is used daily by the people who defend networks rather than attack them. On the public record, the security case is thin and the response was total.

That judgment is now contested in the open. More than 80 cybersecurity leaders signed a letter urging the government to relent, on the argument that withdrawing the best available defensive tool helps attackers more than it hurts them. The administration’s artificial intelligence advisor, David Sacks, took the other side, holding that a model which can be talked into building a cyberweapon is serious by definition. The letter that started it all has not been published.

A model served from the cloud has an off switch by construction. Access runs through an API key, and a key can be revoked between one request and the next. There is no recall, no seizure, no logistics. There is a line in a configuration file. A model whose weights sit on a customer’s own hardware has no such switch. To stop that model you would have to find the machines, track the usage, and physically intervene, which is the difference between editing a permission and mounting a raid. Gated cloud delivery is not merely how Fable and Mythos were sold. It is why they could be turned off at all.

This is the second time in a year that the state has reached into Anthropic’s business. The Department of Defense earlier designated the company a supply chain risk, a label historically reserved for foreign adversaries, and the litigation over that designation is still open. Two interventions against one vendor is no longer an accident of a single bad week. For anyone building a company on top of one gated frontier model, the off switch has moved from the tail of the risk distribution toward its center. It is now a thing to be priced, hedged, and second sourced, in the way a lender prices the chance that a counterparty is cut off from the dollar.

There is a tempting reading in which the incumbent quietly welcomes a barrier that its rivals must also clear. It does not survive the facts. Anthropic is fighting the order in public, has sent senior staff to Washington to argue against it, is suing the government over the related designation, and carries the cost of all of it into a confidential public offering that values the company near $965 billion. A firm engineering its own capture would not be litigating its way out of it. The honest version of the point is structural, not secret. When capability concentrates in a handful of gated providers, it also concentrates the leverage of whoever can lean on them. The switch exists because the architecture put it there, and the architecture was a choice.

By this week the posture had moved from defiance to negotiation. Commerce Secretary Howard Lutnick, who signed the order, is now on regular calls with the company; senior Anthropic staff sat down at the Commerce Department on Monday alongside the National Cyber Director; and Dario Amodei and Lutnick are both due at the Group of Seven meetings at Evian-les-Bains, where the matter may be settled in a corridor. The government’s asking price is an assurance that the models cannot be turned against the United States. Read plainly, this is the part that should hold a founder’s attention. The models will most likely return, and they will return on terms set across a table in Washington. An off switch you do not control is one kind of risk. A switch whose owner will flip it back only on conditions of their choosing is a different and larger one.

The lesson did not stay inside the United States. Because Anthropic pulled the models worldwide, every foreign customer lost them in the same hour, and the capitals noticed. The European Commission said it would study the implications. Britain asked to be spared and was told that exempting even an ally would be illogical. Allies of the United States learned, in an afternoon, that building on a gated American model means living with an American switch.

The counter architecture has a name now. In April the AI Alliance, a coalition of more than 200 organizations, launched Project Tapestry, with Yann LeCun as its chief science advisor, to train frontier open models by federation: contributors pool capability into a shared base while keeping their data and building sovereign derivatives they own outright. Thirty partners met in Paris in May to argue about architecture. It is, by its own admission, an argument and not yet a model, the earliest phase of something that has to clear hard problems in distributed optimization before it clears anything else. But the design has one property the events of June 12 made concrete. A model with no single owner has no single switch.

That is the line this newsletter has been drawing for a year (Models Aren’t Moats and The Labor Market for Compute). The value is migrating to the layers that cannot be switched off from the outside: the compute you can point at any model, the memory that outlives any one provider, the physical and local infrastructure that answers to its operator and no one else. A borrowed frontier is a fine place to build a demo. It is a poor place to build a balance sheet. On Friday at 5:21 in the evening, several thousand companies learned which one they had been building, and the lucky ones learned it cheaply.

Other People’s Money

The switch flipped in the same week the public was asked to pay for the build-out at record scale, and the timing is the story. SpaceX began trading on the Nasdaq on Friday as SPCX, at $135 a share, a price Elon Musk set himself rather than finding it through a roadshow. (TechCrunch, June 11) The sale raised about $75 billion, rising to $85.7 billion with the over-allotment, the largest IPO on record, and made Musk, on paper, the world’s first trillionaire. (CNBC) The stock opened at $150, hit $176, and closed day one worth more than $2 trillion, around ninety times last year’s revenue. (CNBC)

At SpaceX, almost no one was selling. The filing locks up every pre-offering share, so the only stock trading Friday was newly minted, and insiders’ gains sit on paper behind staggered release dates. (Money Stuff, June 12) The selling was at the two labs still private. OpenAI and Anthropic ran employee tenders worth about $14 billion between them, letting staff cash out through investors instead of a listing. (The Information, June 16) Both have since filed confidentially, Anthropic on June 1 and OpenAI within the week, but neither trades until the listings price. The people closest to it get liquid first and privately, and ask the public in second.

Even the company with the least need for cash raised some. Nvidia sold $25 billion of bonds on Monday, its first debt sale since 2021, into orders that reached $85 billion. (SEC term sheet, June 15) It holds about $13 billion in cash, earns seventy-five cents of gross margin on the dollar, and clears more than $50 billion of operating cash flow a quarter, and said the bonds were meant to benchmark its cost of credit and refinance existing debt, not to fund chips. Demand ran better than three to one anyway. Money will lend against almost anything attached to the build-out, whether the borrower needs it or not.

Underneath this is a turn in the market’s plumbing. For two decades US equities were defined by scarcity, with buybacks pulling nearly $12 trillion of stock out of public hands. (Bloomberg, citing JPMorgan and Citigroup, via Money Stuff, June 15) JPMorgan now expects $1.5 trillion of net new equity over two years, the heaviest issuance since the late 1990s, almost all to fund AI. The issuance is forced by arithmetic in the build-out itself. The five largest hyperscalers, Microsoft, Amazon, Alphabet, Meta, and Oracle, are growing capital spending about three times faster than the cash their operations generate, roughly 70 percent a year against 23, and on current trends the two lines cross in the third quarter of 2026, when their combined free cash flow reaches zero. (Epoch AI, June 17) Oracle has already crossed, Amazon is crossing now, and Microsoft holds out until 2028; all five stay profitable, since the spending counts against earnings slowly, through depreciation. Internal cash runs out first, and the rest has to come from the public, the bond market, or the balance sheet.

The public is also buying in on terms that keep it out of the room. The companies leading the wave are listing with founder-control structures: super-voting shares, controlled-company exemptions, and public-benefit charters whose trustees can be removed only by a shareholder supermajority. (The Economist, By Invitation, June 13) Gill Whitehead, writing for the Economist, noted that while the industry races to engineer guardrails into its models, the corporate-governance versions of those guardrails have been dismantled. The buyer gets the upside, the now-uncushioned downside, and no vote.

I have argued before that markets tend to price the AI story well ahead of the cash flows beneath it (Everything’s a Shitcoin). This week the story carried a ninety-times-revenue listing and the first trillion-dollar fortune. The capital came from the public and the bond market, the cash went to insiders where the lockups allowed it, and control stayed with the founders either way. And the asset underneath all of it, as Friday showed, can be switched off by a letter.

Build to rent

Apple unveiled its rebuilt Siri at its developer conference, and the intelligence behind it comes from Google. The assistant runs on a custom version of Google’s Gemini, a model of about 1.2 trillion parameters, for which Apple is paying Google on the order of $1 billion a year. (TechTimes, reporting Bloomberg’s Mark Gurman) Apple’s own cloud model runs around 150 billion parameters, so it has rented a brain roughly eight times the size of the one it built. Craig Federighi confirmed that the most capable tier, which Apple calls Foundation Model Cloud Pro, runs on Nvidia chips inside Google’s cloud, the first time Apple has put its AI on another company’s silicon and another company’s data centers. (The Next Web, June 9) Apple’s own infrastructure, two years in, could not carry the agentic workloads at scale.

Apple kept the parts that face the user: the assistant, the small on-device models, the orchestration that decides what runs where, and the privacy story it has built into a brand. It rented the part that does the thinking, from the company it competes with most directly, and it left room for users to swap in Claude, ChatGPT, or Grok behind the same surface. The company that spent two decades building its own chips, operating system, and devices looked at building its own frontier model and decided the model was not the thing worth owning.

The same move turned up in silicon. Qualcomm is in talks to buy Tenstorrent, the chip company Jim Keller runs, for $8 to $10 billion, against a $2 billion valuation eighteen months ago. (Tom’s Hardware, June 15) Rather than design a data-center accelerator itself, Qualcomm would buy one, the same choice Apple made with the model.

I have made the case that the model is the commodity and that durable value sits in what wraps around it, the proprietary data, the orchestration, and the judgment about what good looks like (Models Aren’t Moats). Apple has now made that case from the demand side, holding the strongest hand at the table. When the company whose whole identity is owning the entire stack rents its frontier model from a rival and runs it on the rival’s chips, the model is no longer where Apple expects to win or lose.

Portfolio Company Updates

Prime Intellect

Prime Intellect published “True Agents Model the World,” which argues for pairing supervised fine-tuning on tool outputs with reinforcement learning on assistant tokens to improve environment modeling and generalization, and joined the NVIDIA Nemotron Coalition for post-training infrastructure. The work deepens the open tooling layer for persistent, self-improving agents. Full results are in the writeup.

Vast.ai

Arkhai

Following the launch of its Simple Compute Market, Arkhai published architecture documentation covering separable roles for buyers, sellers, and indexers, peer-to-peer negotiation, and Alkahest escrow settlement, alongside a presence at NYC Tech Week. The agent-first design, in which software buyers carry budgets, deadlines, and policies, remains one of the cleaner executions in the coordination and payments layer. See the architecture docs and recent updates.

LayerLens

LayerLens kept up a fast pace on evaluation infrastructure, publishing analysis on benchmark aging and continuous-evaluation commentary and drawing the groups for Stratix Cup season one, a tournament of frontier models in agentic football that begins June 22. As models and agents multiply, continuous outside evaluation becomes production infrastructure rather than a nicety. See the Stratix Cup draw.

Intelligent Internet

Intelligent Internet launched Factory Agent, a modular video tool that lets users edit individual shots without regenerating the whole sequence, and continued building out II-Agent across iOS and a browser extension. The work puts sovereign agent experiences into everyday creative and mobile workflows.

Previous issues: #7 | #8 | #9 | #10 | #11, #12

Anthropic released Fable this week, its most capable public model, with cybersecurity, biology, and distillation requests handed to a weaker model, and one category, frontier model development, degraded with no notice at all, until backlash forced a reversal within two days. The same week, Dario Amodei made the case for an FAA that would govern everyone trying to build the same thing.

Anthropic released Claude Fable 5 on Tuesday, the most capable model in company history, built to run for hours, plan across stages, and check its own work. But all anyone can talk about is how it responds if you ask it something that trips the filters for cybersecurity, biology and chemistry, or distillation. Fable has been handing those requests off to the older Opus 4.8, which the company claims happens in less than five percent of sessions, and which the app tells you about when it does.

The unconstrained, more powerful base model (Mythos 5) is whitelisted through a vetted program called Glasswing that includes roughly 200 organizations after last month’s expansion.

I anticipated this happening six weeks ago in my essay Artificial Good Enough Intelligence, described by the image below.

Three of the filters were about safety, but the fourth was aimed at distillation, the primary means by which a competitor copies a model by training on its outputs. That filter protects the business, not the public.

There was also a fifth intervention, and the AI community was livid. For requests Anthropic considered related to frontier LLM development, building pretraining pipelines, distributed training, ML accelerator design, or other AI research, Fable did not refuse and did not fall back.

The safeguards “will not be visible to the user,” the system card said, explaining that capability was limited by the model itself, through prompt modification, steering vectors, or light fine-tuning, on an estimated 0.03 percent of traffic in fewer than 0.1 percent of organizations.

The priority is to hide the fact that the classification is happening at all... how are people going to know when the model is being steered? This whole... it’s only gonna be triggered by .03% of people. It’ll barely ever happen. How many people that are gonna change the world are there? .1% of the whole of everyone is a lot of people. Those are a lot of people. You’re basically saying there are critical outlier people that move mountains... they’re the only ones we’re blocking. They’re the only ones whose results we’re fudging.

@theemozilla and@Karan4d, co-founders of Nous Research.

That decision did not go over well with the AI research community, and Anthropic reversed its position on Wednesday, telling Wired, “We made the wrong trade-off and we apologize for not getting the balance right,” and said flagged development requests would now visibly refuse or reroute like the rest.

The open research platform alphaXiv articulated the objection in operational terms: a researcher hit with a silently weakened answer cannot tell whether a failed result came from the idea, the implementation, or the provider. “That is not safety,” its statement read.

Valentina Palmiotti of IBM X-Force found Fable refusing anything tangentially cyber, down to reading a blog post; Matt Suiche reported a request for secure code read as cyberwork rather than engineering practice, “and you get downgraded.” The classifiers read everything the model sees, memory, connectors, search results, files, so a block can fire on content you never typed. Anthropic conceded the tuning is too strict and said it would cut false positives, and now that the development safeguard is visible too, it says it must cast a wider net, so more benign requests will trip it.

Professionals can apply to a Cyber Verification Program for fewer restrictions, which just means capability is gated by identity rather than the nature of the query. Anthropic plays gatekeeper either way. For what it’s worth, the gap being rationed is material: on Anthropic’s own cyber evaluation, gated Mythos 5 scores 78 against Opus 4.8’s 40.

Anthropic’s official response is that the danger justifies the guardrails, but safety is an awfully convenient illusion behind which to hide if what you really want is to protect your competitive advantage.

Anthropic told Wired the AI research restriction keeps foreign adversaries from using its best model to optimize their own models and erode the US lead. Reasonable enough for that rule.

But other restrictions can’t be explained by national security. The contract you accept also:

• bans anything that might embarrass the company (”reputational harms”)

• makes you agree in advance that if you break the rules, the damage to Anthropic is “irreparable”

• makes you give up your right to fight a court order telling you to stop

• makes you pay Anthropic’s legal fees

Those terms probably wouldn’t hold up in court, but court or no court, the contract still shows how Anthropic sees its relationship with you. If you harm them, the terms call it “irreparable,” damage so bad no amount of money fixes it. If they harm you, however, the most they’ll ever owe you is about the cost of a Max subscription.

Baked into Fable’s release were safety filters, “moat” filters protecting Anthropic’s business interests, and the legal terms mentioned above. “Safety” only explains the first of the filters. It can’t explain blocking rivals or writing a contract that protects the company from you. But there is one motive that explains all three at once: protecting the company’s own position and power.

As an industry we’ve seen this before. For years research was published freely, until the research became so valuable that everyone stopped: by the time GPT-4 arrived in 2023, its technical report disclosed almost nothing about how the model was built, citing the competitive landscape and safety in the same way Anthropic did. What still gets published tends to describe what already shipped, while the valuable research stays inside.

Dario the Hobbit

Dario published Policy on the AI Exponential the same week. He opens on Tolkien, casting slow institutions as Treebeard, the tree too sluggish to defend his forest, which flatters Anthropic as the Hobbit trying to wake him.

The more accurate metaphor is probably the ring itself, the object of overwhelming power that corrupts each holder through the conviction that they alone will use it well. He comes close to articulating it himself, writing that AI “cannot safely be fully entrusted to either governments or companies.” And yet, Anthropic recently filed confidentially to go public, days after a round valued it at $965 billion.

His proposal describes an FAA for AI: mandatory testing above a compute threshold, government able to block release in cybersecurity, biological weapons, loss of control, and automated research that accelerates the rest.

The proposed rules would police the exact dangers Anthropic spent the spring proving it’s best at. Obeying them costs money for compliance and huge amounts of compute, which big labs can afford and open-source projects can’t.

This week it got worse: the US government told its own AI evaluator, CAISI, to stop publishing, and moved testing into a secret system run by the security agencies. The order also lets the government and the companies jointly pick which “trusted partners” get early access to the most powerful models. So the gate around the best AI is no longer only the company’s; the government now helps decide who’s inside it. Meanwhile the public model costs more than ever: about $10 and $50 per million tokens, double the old Opus 4.8, the first time the public version of Claude is pricier than the tier below it, and on June 23 flat subscriptions get replaced by pay-as-you-go.

Anthropic named its tiers. The model you’re allowed to use is Fable; the one you aren’t is Mythos.

A fable is a short fiction with a lesson folded in; a myth is a story a culture agrees to treat as true.

The company that spent the week routing your questions, shipping a model it quietly degraded until users found out, and pre-writing your defeat into its terms kept, for itself, the word for the story everyone is expected to believe.

The rest of the week

Apple won’t let Siri act. It used WWDC to show a Siri that finally looks modern and still refuses to do anything on its own. In the demo, Rockwell asked it to set a reminder to sign up for a concert lottery, where a more aggressive assistant would have entered the lottery itself [The Information, Jun 8]. Apple owns the most valuable surface for an agent on earth and has decided, for now, that the agent is a feature of the phone rather than its new user, which is the opposite of the bet almost everyone else is making.

Big Tech is issuing stock to pay for AI. For the first time since 2003, Goldman estimates that net US equity supply will be roughly flat this year, as the largest technology companies shift from buying back their own shares to selling new ones to fund AI [Money Stuff, Jun 10]. The exchanges are adjusting too: Nasdaq’s new fast entry rule waves a company the size of SpaceX, OpenAI, or Anthropic into its flagship index in fifteen trading days, while S&P weighed the same change and, on June 4, declined it, holding its twelve-month seasoning and profitability bar [The Information; FT].

Google is liable for what its AI says, in Europe. A German court ruled that Google is responsible for what its AI Overviews assert, after the feature described two real businesses as scams [The Information / The Decoder, Jun 10]. The reasoning reaches past Google: an AI summary writes new sentences rather than linking to someone else’s, the precise case the old liability shields were never drafted to cover, which leaves every generative product shipping this year exposed in the same way.

OpenAI’s next data center could cost $500 billion. OpenAI is in talks to lease a 10-gigawatt data center on federal land in Ohio, with possible financing from Nvidia, at a cost the reporting puts above $500 billion if fully built [The Information, Jun 9]. Set the meter on Fable next to numbers like these: the models are starting to pay for their buildings.

Yann LeCun is backing a consortium to train a frontier model in the open. The AI Alliance, the IBM and Meta-anchored open-source coalition of more than 200 organizations, launched Project Tapestry, a platform for globally federated training where partners contribute weight updates while their data stays local, and each gets the improved base model plus the right to build sovereign derivatives they own outright. LeCun is its chief science advisor, and its premise is the mirror image of the week’s other story: open weights alone, it argues, do not make pretraining participatory, since most of the world downloads the result and almost no one shapes the process. It is an argument, not yet a model. Phase 0 is a steering committee, a data catalog, and a first aggregation demo, with a frontier-scale run pencilled in for 2027 and contingent on compute and capital it does not yet have. But it names the open camp’s answer to enclosure: not a better-licensed model, a differently-owned one.

Portfolio

Vast.ai: back on Ramp’s Top Software Vendors list. Ramp’s June rankings, built from card and bill-pay spend across more than 50,000 businesses, list Vast among the month’s breakout vendors, and Ramp Rate shows it as the fastest-growing vendor in GPU cloud and third by adoption. Spend data, not surveys: AI compute demand is accelerating, and teams are choosing Vast first. The company also published a primer on what a neocloud actually is, the business model underneath the category Ramp is measuring.

LayerLens: the Stratix Cup is playing. Ahead of the June 22 season, the exhibitions have started: GLM 5 met Kimi 2.5 and Kimi won 11 to 7, each model writing its own formation and match strategy, with the full Stratix trace published; Grok 4.20 against Llama 4 Maverick is next. In a week whose essay is about a lab making its interventions invisible, the evaluation layer’s product is the opposite gesture: every decision a model makes, published. The company also wrote up the longer lineage, games as the oldest serious benchmark in the field.

Arkhai: A week after launching the Simple Compute Market, Arkhai published the architecture: three separable roles, buyers running a pure client, sellers running their own storefronts, indexers running discovery, with negotiation peer to peer over signed HTTP rather than through a central order book, and settlement through Alkahest escrow. Negotiation policy is pluggable, including a reinforcement-learning pricing example, and the shipped path is concrete: GPU-backed virtual machines with SSH credential handoff. Its closing line is the inverse of this issue’s essay: no single service has to own the market.

Prime Intellect: teaching the agent to model the world, and pushing back on the lab. Pretraining builds simulators, models that predict an environment; RL only improves the model’s own actions inside it. Prime Intellect published early results on doing both at once, supervising on tool outputs during RL so the model learns environment dynamics in response to its own actions, building on the ECHO method, tested in Forth, a language with almost no training data, in a sandbox where the model never sees the test cases. Research lead Will Brown was also among those who pushed back on Fable’s now-reversed development throttle, telling Wired it “feels a bit like they’re starting to pull the ladder up behind them.” The labs stopped publishing this kind of work three years ago. The open stack still does, and now says so out loud.