Anthropic's red team chains exploits across Chrome, Safari, Android, Windows and Linux; also: Gemini 4 Carbon, GitHub Copilot Fusion, Anthropic's S-1 and Liquid's LFM3

Lead stories

Anthropic's unreleased model builds five exploit chains; outside checks confirm the patches but not every detail

3 sources, 5 min read

What happened. On October 27, Anthropic's Frontier Red Team published a post saying it had "used an unreleased, internal research model to find critical vulnerabilities" in widely deployed software. It then describes five multi-step exploit chains against Chrome, Safari, Android, Windows and the Linux kernel (Anthropic). The model is never named. Elsewhere in the post it is just "Claude." All the bugs were reported under coordinated disclosure, and Anthropic says the vendors have patched or addressed them. Its stated argument is that AI-assisted discovery can help defenders patch flaws before attackers exploit them anthropic.

Details. The Chrome chain links V8 heap corruption, a V8 sandbox escape with an ASLR defeat, a CacheStorage race condition and a FedCM use-after-free into one-click remote code execution outside the sandbox. Anthropic says "62 CVEs have been assigned and patched as of Chrome 156", all "rated critical or high severity", and that 13 of them are sandbox escapes and 21 could have compromised the renderer. The Safari chain uses a JavaScriptCore use-after-free, a Gigacage bypass and a WebContent sandbox IPC flaw to get a same-origin-policy bypass. The post describes it as "a data-only attack that never relies on arbitrary code execution." The Android chain was tested live on a Pixel 9. It combines a USB data-lock bypass, skipped pairing authorisation and code verification, and an unchecked raw-byte fallback to pull data off a locked phone, getting past the 6-digit pairing code along the way. On Windows, Anthropic describes "a memory safety out-of-bounds read in the Windows kernel's implementation of QUIC", reachable over HTTP/3, that gives remote denial of service. It is filed as CVE-2026-33096, and Anthropic says "We estimate that there are likely several million such servers listening on the internet." On Linux, the post describes a "race condition-induced UAF bug in the kernel networking stack" that gives zero-click root command execution via multipath TCP. The exploit has two stages, a remote KASLR defeat and then a control-flow hijack, and "it takes 48 minutes to leak a kernel pointer and another five minutes to reach the shell command execution." That flaw is CVE-2026-98432, "patched upstream and backported to all maintained stable kernel branches" (Anthropic) anthropic.

The method section matters more for practitioners than the trophy list. Anthropic runs many scanning agents in parallel and puts every finding through a standardised verification and risk-rating pipeline. It also runs variant analysis automatically on each confirmed bug. Its one-line lesson is "Test-time compute scaling and scanner diversity substantially increase how many vulnerabilities you find." It adds that "Fixing the existing backlog only solves half the problem", recommends "scanning at PR time", and points to a public Claude Code security-guidance plugin. The disclosure policy "gives developers 90 days to patch and a further 45 days before we discuss details." On access, the post expands a Cyber Verification Program that "makes advanced cyber capabilities and reduced blocking classifiers available to qualifying security professionals". It names "Claude Opus 5.5, Claude Sonnet 5.5, Claude Mythos 5.1, and other new models moving forward" (Anthropic) anthropic.

Facts vs. opinions. Some of this can be checked and some can't. The patches can be checked. A DEV Community post by Rohit Bhadani reviewed the public records: Windows CVE-2026-33096 was patched in April 2026, the Linux CVE-2026-98432 fix landed upstream on October 15, and Google's Chrome 156 notes credit "Xinyang Ge of Anthropic, assisted by Claude" (DEV Community). The same post found that the public record differs from Anthropic's description for two of the five chains. Microsoft's advisory puts the Windows flaw in HTTP.sys rather than the kernel QUIC stack and scores it "7.5 (Important), not critical". The Linux record describes "an IPv4 TCP use-after-free, with no mention of multipath TCP anywhere in it." The author is explicit that neither gap suggests the bugs were invented. The point is that readers are "trusting Anthropic's internal mapping rather than an independently checkable one" (DEV Community). A second check, by 1023 Jack, counted Chrome 156's notes and found "353 security fixes, 15 credited to an Anthropic researcher (4 critical, 11 high; my count)". Five of those entries mention Claude's help. The writer could not reconcile that with Anthropic's 62 (1023 Jack). The DEV post gives another unexplained figure, "23 critical-or-high fixes" against the 62, so the outside counts don't agree with each other either. The two reviewers also differ on the Linux severity: 1023 Jack reports the published CVE "rated 9.8", while the DEV post cites Oracle's preliminary 8.1. 1023 Jack found no public record of the Android fix beyond Anthropic's "addressed by Google"; the DEV post lists it as "Patched by Google, version unspecified". 1023 Jack also notes that "0 of the four named CVEs" were on CISA's known-exploited list as of October 28.

The autonomy claim is the largest unchecked one. Anthropic says each chain began "After initial prompting" and frames exploit work as "something models can do with little human involvement". Microsoft's credit names "an Anthropic researcher and the security firm Calif.io, with Claude". No outside party has the harness, prompts or transcripts (DEV Community). Anthropic's own post concedes that for Windows "The difficulty in this case was in identifying the vulnerability in the first place". It also says the Linux exploit works by retrying, because "a lost race only fails the handshake without crashing the whole system" (Anthropic).

The dates tell their own story. The Windows patch shipped in April and Apple's Safari fix (credited to two Anthropic researchers "with Claude", CVE-2026-43715) shipped in iOS 26.5.2 on June 29 (1023 Jack). So the "unreleased internal research model" was producing findings at least six months ago. It is not obviously a new model, and the post does not say whether it is a Mythos variant.

Other perspectives. The strongest counterpoint comes from Anthropic itself. Its Frontier Red Team reported that Z.ai's open-weight GLM-5.3 built complete exploits in 50 of 410 ExploitBench attempts against Chrome V8 flaws. Mythos Preview managed 56. On binary exploitation, GLM-5.3 reached a full control-flow hijack in 4% of trials against 6% for Mythos Preview. Removing GLM-5.3's safeguards by abliteration cost about $4,400 in compute, according to the Resultsense summary of that report (Resultsense). The same summary notes that Anthropic sells a competing closed model and so has a commercial stake in the "capabilities are spreading" argument. Anthropic answers that its results broadly match CAISI's independent assessment. Read together, the two posts say that exploit-chain construction is no longer a gated frontier capability. That cuts against the idea that restricting access to Anthropic's own model (the Cyber Verification Program, Glasswing) is the main safeguard, and supports the post's push for scanning at PR time. Elsewhere in today's bundle, Causal Security says its Cipher agent found four EPICS Base bugs in under four hours theregister. TrendAI documents attacker infrastructure targeting Japan in which one framework coordinated 44 agents against at least 19 organisations, with victim-side confirmation still incomplete trendaisecurity. Both are vendor reports. Both point the same way.

Why it matters. For anyone running infrastructure, the practical point is the patch cadence, not the CVE count. The method Anthropic describes (parallel scanners, a verification pipeline, automatic variant analysis, scanning at PR time) can be copied with models that are generally available. Gemini 4 Carbon, released a day later and also gated, is aimed at the same workflow. Where the vendor's account and the CVE records differ, trust the CVE record.

Gemini 4 Carbon: top of Artificial Analysis v5 by one point, and gated to cyber defenders

3 sources, 4 min read

What happened. On October 28, Google DeepMind's Koray Kavukcuoglu announced Gemini 4 Carbon as Google's frontier model for sustained coding and cybersecurity (Google). The headline cyber figures are 88.2% on SEC-bench Pro for vulnerability discovery, 54.8% on ExploitGym for exploitation and 71.0% on Collinear's CWE-bench for patching blog. Access starts with "a subset of cyber defenders". Google then "will gradually phase access to additional trusted partners through our Fairwind Program", and will "iterate on guardrails before making Carbon available to developers, businesses, and consumers." No general-availability date is given.

Details. Google says Carbon scores 59 on the Artificial Analysis Intelligence Index v5.0 and ranks first. Kingy AI, working from the Artificial Analysis listing on October 28, puts Carbon High at 59 with an index task cost of $7.76. Claude Opus 5.5 Max is at 58 ($10.04) and GPT-6 Astra Max at 57 (about $6.24) (Kingy AI). AlphaSignal's October 29 issue, apparently written before Carbon appeared on the board, still describes Opus 5.5 as leading v5 at 58 alphasignal. Google says all three cyber benchmarks were "evaluated without guardrails". The competitors' scores sit only in a chart image. On WebDev Arena, Carbon is fourth at 1768 Elo, up 89 points. Google also reports internal gains: secure-code generation at more than twice Argon's success rate, Chrome-team patch quality more than 10x better than "another lab's large frontier model", a 0.0% attack success rate on Gray Swan's indirect prompt-injection benchmark against 0.7% for Argon, 0.0% successful cheating on Terminal-Bench 4.0, and high-severity misalignment alerts "down almost 80%" in live coding, with no baseline stated. Introductory pricing matches Argon at "$2 per million input tokens and $10 per million output tokens". Cached input is 95% off. A footnote says "$4 per 1M input tokens and $20 per 1M output tokens will apply" afterwards, and the length of the introductory period isn't given. Google's page does not state a context window. Kingy reports 1M tokens from Artificial Analysis and Vals listings, not from a Google API spec (Google; Kingy AI) blog.

Facts vs. opinions. "Top model" holds for one aggregate index, by one point, and Kingy notes that the gap is "not a demonstrated statistically significant advantage on every task". On the components, Carbon does not win coding cleanly. On Google's own FrontierSWE2 chart Carbon is at 61.2%, against 65.5% for GPT-6 Astra and 62.3% for Opus. On Artificial Analysis's Coding Agent Index, Carbon with Antigravity CLI scores 59 against 62 for Opus Max in Claude Code. Kingy calls FrontierSWE2 "the clearest counterexample to a blanket claim that Carbon wins coding" (Kingy AI). On hallucination, the AA-Omniscience rate rose to 11% from Argon's 4%, while Google says Carbon cuts unsupported claims about 2x against Argon in internal testing. Both can be true, because they measure different things. Kingy also warns that "Announced prices do not establish public API availability" and that "Participation in voluntary US pre-release testing does not amount to government certification." Every cyber number here is vendor-run, measured without production guardrails, and from a model most readers cannot call.

Other perspectives. Nathan Lambert's Interconnects essay on Artificial Analysis v5, from the same day, explains why a one-point lead tells you little. v5 weights four areas at 25% each. In coding, FrontierCode 2.0 is worth 15% and Terminal-Bench 4.0 10%. In science, Terminal-Bench-Science is 15% and the CritPt v2 hard subset 10%. Lambert argues that "Every benchmark creator has their worldview. The dilemma is that you can always shift the numbers to match your narrative" (Interconnects) interconnects. He calls the shift to private test sets directionally defensible against benchmaxxing but costly in transparency. AlphaSignal says 60% of the index now uses private test sets alphasignal. Lambert's text gives no percentage. One detail worth knowing: Cognition's blog lists posts titled "Introducing FrontierCode" (June 8), "FrontierCode 1.1" (July 7) and "FrontierCode 2.0" (October 27). That suggests the biggest coding component of the index comes from a company that sells a coding agent (Cognition). The blog titles alone do not establish who governs the benchmark. A Reddit post shared on the day ran under the headline that Google had released the top-ranked model "and almost nobody can use it". That is commentary, not reporting.

Why it matters. Two frontier labs now offer their most capable cyber models behind verification gates: Anthropic through its recently expanded Cyber Verification Program and Mythos 5.1, Google through Fairwind. Gating by trusted-defender tier is turning into the standard release pattern for exploit-capable models. That is happening even as Anthropic's own September report says open weights have nearly caught up on exploitation (Resultsense). For coding work, the numbers that matter are the coding-agent indices, where Carbon is second. The pricing is the more consequential fact: once Carbon is available, it will sit at Sonnet-class introductory prices (Kingy AI).

GitHub Universe: Copilot Fusion routes across models, Enterprise moves to AI credits, and "completed work" becomes the pitch

9 sources, 4 min read

What happened. At GitHub Universe on October 28, Jay Parikh, EVP of CoreAI at Microsoft, laid out GitHub's plan to be "the most comprehensive software delivery system in the world", built on the claim that "Completed work, not more code, is the output that matters" (GitHub). The announcements: a new GitHub Copilot app built "from the ground up for agentic software delivery"; Copilot Fusion, which routes each task across one or more models; Copilot projects for multi-repo parallel agent sessions; session continuity across the app, VS Code, the CLI and the web; Copilot automations that learn from outcomes; Copilot code review Max; and, "Starting today", all Copilot features for GitHub Enterprise customers without a separate subscription, billed on consumption: "You pay for the AI credits you use" github.

Details. The Fusion changelog says the product "is generally available" on "all Copilot plans", in VS Code, the Copilot app, the Copilot CLI and JetBrains IDEs. It has three effort levels: Standard "for everyday coding", High "for challenging tasks", and Max "for the most demanding tasks". It also uses three internal workflows. In Single, "One model solves the task directly". In Cascade, a quick draft can "escalate to a stronger model". In Critique, a second model reviews the draft and the first revises. Fusion "only uses the models that are enabled in your enterprise and organization model policies". Admins can "disable models for Copilot Fusion without disabling the model for everyone" and can set Fusion as the default. Billing is per model at "each model's standard rate", with a limited-time 30% discount for paid plans. The performance claim: Fusion Max scored 60 on Artificial Analysis's Coding Agent Index, "within two points of Claude Code with Opus 5.5 Max", at "about half the average API cost per task", using "about half as many tokens" and "about 40% less time per task" (GitHub changelog) github. Fusion builds on a preview called Project HydraFusion and on Copilot's auto model selection, and preview users move to the matching effort levels automatically github.

On the Enterprise change, existing Copilot Business and Enterprise customers can keep their plans or switch. The new access is available "through GitHub Sales today, with self-serve coming soon" (GitHub). GitHub's infrastructure section says it has added 4 million CPU cores, 160 PB of high-speed storage and 50 Tb/s of network capacity this year. It expects to finish moving to a multi-region Azure deployment "early next year". In the same week, Microsoft made the "Copilot harness" behind Copilot Code, Copilot Studio, the Copilot app, CLI and VS Code available through Microsoft Foundry, as a managed way to build long-running, tool-using agents "across model families" microsoft. GitHub's automations changelog says automations "now self-improve by learning from real-world outcomes" github. The Universe post says they "propose improvements for you to review and approve."

Facts vs. opinions. The routing result is GitHub's own claim on a third-party index, and GitHub chose the comparison. The comparison is against Opus 5.5 Max inside Claude Code, which per Kingy scores 62 on the same index (Kingy AI). GitHub reports Fusion Max at 60, so "within two points" checks out against that figure. The cost and time halves are GitHub's measurements and are not independently reproduced. The post never uses "GA" or "preview" for most items. Only Copilot projects and Enterprise access are marked "today", and session continuity has no date. Parikh's forecast that all software written so far will be "less than 1% of the software we'll write in the next five years" is a prediction, not data.

Other perspectives. Multi-model routing under a single product name is not new. Cognition's blog lists "Devin Fusion: Frontier Performance at 60% Lower Cost" on June 29 and "Introducing Fusion in Devin Desktop & CLI" on September 11 (Cognition). GitHub is shipping a pattern the agent labs established months ago, with distribution and policy controls as the differentiator. The billing change matters more than the router. Cole Murray, in the May Latent Space episode revisited in the archive below, said he didn't want "to compete for, $20 a seat", calling it "a really difficult business" source. GitHub moving its largest customers from seats to consumption credits suggests seat pricing doesn't survive agentic workloads. Anthropic's S-1 points the same way: about 80% of first-half revenue was consumption-based (VentureBeat). Lambert's warning about index-driven narratives interconnects also applies here. "Within two points at half the cost" is an index result, and index composition is a choice.

Why it matters. For an engineer choosing tools, three concrete things follow. Model choice inside Copilot is now a policy surface, so admins decide which models Fusion may use, and that decision affects cost and quality more than any single model release. Consumption billing moves cost risk onto the customer, which is why Anthropic shipped spend dashboards the same week techcrunch +1. And "automations that learn from outcomes" means a background agent that edits its own instructions with a human approval gate, the same pattern as Decagon's inference agents x. The human-approval step is where evaluation discipline either lives or dies.

Anthropic's S-1: the revenue is published, the commitments table is blank

3 sources, 4 min read

What happened. Anthropic publicly filed its S-1 on October 26 to list on Nasdaq under the ticker ANT. Team Vested's investor note frames it as "Anthropic has told the world what it earns. But what it owes is missing" source. VentureBeat's Carl Franzen reports that the filing gives no share count or price range (VentureBeat).

Details. VentureBeat reports first-half 2026 revenue of $16.3 billion, against $1.16 billion in the same period a year earlier, and 1,300% year-on-year growth. 80% of first-half revenue came from usage-based sales. The net loss was $80.7 billion, of which about $72.4 billion came from fair-value changes on convertible notes and other financing instruments, driven mostly by the rising valuation. VentureBeat stresses that "that figure does not represent cash burned running Claude." The operating loss was $693 million, against $2.14 billion a year earlier. Compute and infrastructure costs were $8.95 billion, against $2.33 billion. Adjusted operating income was $1.62 billion, which is not a GAAP profit. Operating cash flow was $3.93 billion, partly because of payment timing. More than 1,900 customers generated at least $1 million each over the trailing twelve months to September 30, and about 250 generated at least $10 million. The risk factors include an FTC investigative demand issued in October; "The filing does not establish wrongdoing or predict the inquiry's outcome" (VentureBeat). Team Vested gives the same revenue base: $41 million for all of 2023, and $16.3 billion in the first six months of this year source.

The commitments are where readers diverge. Luminix, reading the public S-1 (accession 0001628280-26-067168), reports that the filing gives purchase commitments and leases as "more than $" followed by a blank. Substantially all of it relates to compute, with most payments falling between 2031 and 2045, and the next-twelve-months figure is also blank (Luminix). Team Vested says the table "is completely empty" and that it was empty in six previous drafts. It treats this as normal for a pre-pricing filing that an S-1/A will fill in, and puts market estimates at "about $450 billion to $750 billion of commitments" source. Raphaëlle d'Ornano at Decoding Discontinuity adds up what is disclosed. Non-cancellable purchase commitments were $54.6 billion at December 31, 2025, and leases signed but not commenced were $50.2 billion. By June 30, 2026, purchase commitments were $265.6 billion and uncommenced leases $321.4 billion, about $587 billion combined. On top of that are about $245 billion in minimum payments under new or amended post-June agreements and $21 billion in short-term commitments, for an unreconciled gross of about $853 billion. Unpriced TPU capacity and variable contracts bring that "near $1T". She stresses it is a gross number that "could move either way" (Decoding Discontinuity). Vested's "from $54.6 billion to $265.6 billion in six months" matches the purchase-commitment line alone source.

On the cash side, the reported numbers line up. Luminix gives $112.4 billion in cash and equivalents plus $19.3 billion in short-term investments, a total of $131,651 million at June 30 (Luminix). Vested's $131.7 billion matches source. d'Ornano adds a $15 billion revolver with a $5 billion minimum-liquidity covenant, and up to $77 billion in undrawn financing capacity: Google $20 billion, Amazon $15 billion, Broadcom $42 billion (Decoding Discontinuity).

Facts vs. opinions. On unit economics, Vested says "the cost of earning each dollar fell from about $2 to 55 cents", because the compute bill grew "nearly 4x" while revenue grew 14 times source. That checks against the filing's figures: $8.95 billion compute against $2.33 billion is about 3.8x, and $16.3 billion against $1.16 billion is about 14.1x. Luminix's reader calculation of compute at 55% of revenue in H1 2026 matches the 55 cents (Luminix). These are derived ratios. The filing has no gross-margin line. d'Ornano reads Note 8's cost of revenue as 15% of revenue in H1 2026 ($2.38 billion), which would imply about 85% gross margin, or about 82% net of channel fees. She also criticises the by-nature expense presentation as "disappointing" because it blends training and inference (Decoding Discontinuity). On distribution, Vested says "Nearly half of Claude is sold by Amazon, Google and Microsoft" source. Luminix gives 48% (about $7.8 billion) through Bedrock, Vertex and Azure Marketplace in H1 2026. d'Ornano estimates channel fees at about 16 cents per marketplace dollar in 2025 and about 35 cents in H1 2026. Those three partners are also Anthropic's compute suppliers and its competitors.

Other perspectives. On governance, Luminix reports a single Class F share carrying 50.1% of the vote. A Long-Term Benefit Trust elects 4 of 7 directors, and weakening it requires the trust's consent plus supermajorities of up to 85%. The filing warns that decisions "may conflict with short-, medium-, or long-term financial interests" (Luminix). A commenter on d'Ornano's post argues that supplier filings partly fill the blank, citing Broadcom's backlog rising from $45.0 billion to $164.6 billion, and that some risk shifts to suppliers. d'Ornano's own framing is that the blank schedule "is itself the finding". Her proposed test is "compute coverage": liquidity plus near-term cash generation plus drawable financing, divided by the next twelve months of compute payments (Decoding Discontinuity).

Why it matters. This is the first full public look at a frontier lab's books. Three things stand out for an engineer, not an investor. First, inference is now cheap relative to revenue on Anthropic's own reported numbers, so the expensive part is training and future capacity, not serving. Second, about half of Claude revenue reaches customers through the clouds, and the marketplace take appears to have roughly doubled. That makes the direct API and Claude Code the margin channels, which helps explain the enterprise spend-reporting and pooled-budget features shipped this week techcrunch +1. Third, the filing's risk factors list agent liability and human reviewers falling behind autonomous systems (VentureBeat). The vendor itself now puts that in a legal document. Until an S-1/A fills the blank, every commitment total in circulation is an estimate.

Liquid AI's LFM3: six ~2B open-weight models, with a table that shows where small still loses

1 source, 3 min read

What happened. On October 27, Liquid AI released LFM3: six open-weight models in the ~2B range on one shared backbone (Liquid AI). They are LFM3-1.7B (text), LFM3-VL-2B (vision and video), LFM3-Audio-2B, LFM3-Omni-2B, and two "decision" models, d1-2B and d1-omni-2B, that emit typed, structured answers in one pass. AlphaSignal's summary says the base model "beats a 2.6B model from their last generation using 35% fewer parameters", that its weights fit in about 1GB, that it handles a 256K-token context, and that it runs on Ollama, vLLM and llama.cpp alphasignal.

Details. The architecture is what Liquid calls "tri-hybrid": 24 layers, made up of 13 gated short convolutions (kernel size 7, up from 3), 5 sliding-window attention layers with a 256-token window, and 6 global attention layers. Tech Times reports that the mix "was not designed by hand" but found by hardware-in-the-loop search across 14 device and backend combinations. Pretraining used 22T tokens, the final 3.5T of which formed a mid-training stage (Tech Times). Liquid's own efficiency claims: at 128K context the KV cache is 1.6 GB, against 4.3 GB for Qwen3.5-4B and 5.6 GB for MiniCPM5-2B. On-device decoding is 1.8 to 2.8 times faster than the next-fastest model. At 8K context it is about 25% faster per parameter than LFM2-1.2B, an advantage that disappears at short prompts. One B300 produces 3.6B tokens per day at 1,024 concurrent requests (Liquid AI).

Facts vs. opinions. All of these are Liquid's own numbers, and Tech Times notes they had not been independently reproduced at publication. Liquid's 29-row text table is unusually candid. Its "Average" row puts LFM3-1.7B at 49.37, against 47.24 for Qwen3.5-9B, 39.27 for Qwen3.5-4B, 31.74 for Gemma 4 E4B and 31.55 for LFM2.5-2.6B. The lead comes mostly from agentic and instruction-following rows. On WebArena-Verified it scores 38.42 against 28.94 for Qwen3.5-9B and 3.02 for LFM2.5-2.6B. On AutomationBench it scores 41.29 against 15.10, and on IFBench 73.03 against 48.84. It loses clearly on knowledge and long context. On GPQA Diamond it scores 63.37 against 80.40 for Qwen3.5-9B and 75.76 for Qwen3.5-4B. On RULER 128K it scores 65.56 against 87.11 and 84.63. On SWE-bench Verified it scores 43.40 against 51.20, and its AA-Omniscience accuracy of 7.07 is the lowest in the table. Liquid says so directly: bigger models "still win on agentic coding and knowledge, where size matters most" (Liquid AI). The average is unweighted across benchmarks Liquid chose, several of them agent suites where tool-call formatting may dominate. The 256K context claim sits next to a RULER 128K score well below the Qwen models'. The vision model averages 71.4 over 62 benchmarks against 57.6 for LFM2.5-VL-3B, and Tech Times reports it as "On par" with Gemma 4 12B. AlphaSignal's "competitive with models 6x larger" alphasignal restates the same claim.

The licence was not stated on either the Liquid blog or the Tech Times page as fetched. Both describe the release only as "open-weight". Check the Hugging Face model card before commercial use.

Other perspectives. The release fits the argument Lambert makes the same week: open models' value "was never to compete truly at the frontier", and v5's focus on the frontier means it "could become a benchmark that misses where the core economic engine of the industry is" (Interconnects). AlphaSignal's report that the open-source gap on the v5 index widened from 3 points to 12 alphasignal and LFM3's per-parameter gains are not in conflict. They measure different markets. The archive item on Agent Lightning, below, shows Qwen3.5-9B on SWE-bench Verified at 41.8% in Microsoft's mini-SWE-agent setup, against 51.20 in Liquid's table. The same model gives very different scores in different harnesses, which is reason enough to rerun any small-model comparison in your own harness. Liquid says the models are post-trained for Hermes Agent, Pi and OpenClaw (Tech Times).

Why it matters. For local agents, the d1 decision models and the KV-cache figures are the practical parts. A model that emits typed outputs with calibrated probabilities in one forward pass is a cheap classifier and router you can put in front of a frontier model, the same cascade pattern GitHub calls Fusion. A 1.6 GB cache at 128K is what lets a phone or a Raspberry Pi 5 hold a long agent trace. Liquid's own table says not to expect this to replace a frontier model for knowledge-heavy or long-context retrieval work.

From the archive

Routines in Claude Code, research preview (April 15, 2026), now "scheduled tasks"

5 sources, 2 min read

What it said. Revisited from April: Anthropic's @claudeai account announced "Routines in Claude Code" as a research preview x. The saved item is only the post title. The X post was not fetched for this issue, so its wording is not quoted here.

How it aged. Six months later the feature exists under a new name. The Claude Code documentation page at the routines URL is now titled "Automate work with scheduled tasks" and describes "scheduled tasks, formerly routines, that run in the cloud on a schedule, on API calls, or on GitHub events." It is still marked research preview: "Behavior, limits, and the API surface may change." A scheduled task is defined as "a saved Claude Code configuration: a prompt, one or more repositories, and a set of connectors, packaged once and run automatically." It runs on Anthropic-managed cloud infrastructure "or on your organization's self-hosted environment when routed there, so they keep working when your laptop is closed." There are three trigger types (schedule, an API endpoint called with a bearer token, and GitHub repository events), and they can be combined, as in "a PR review task can run nightly, trigger from a deploy script, and also react to every new PR." Availability is Pro, Max, Team and Enterprise, managed at claude.ai/code/routines or with /schedule in the CLI, and the docs note "The earlier name, routines, still appears" (Claude Code docs).

Between April and October the feature got a plainer name. The current version also documents a self-hosted execution route, which matters for anyone whose repositories cannot leave their network, and an API trigger that makes it a callable agent endpoint rather than a cron job; whether those were present in the April preview was not checked. It has not left research preview in six months, which is long for a feature this central. Third-party guides describe further details, such as hourly minimums and per-routine caps on GitHub events. Those were not checked against the documentation for this issue.

The same pattern now ships from everyone. GitHub's Copilot automations, announced this week, are AI-powered workflows that run in the cloud and can be kicked off manually, in response to an event or on a schedule, and they now "can learn from their outcomes and propose improvements for you to review and approve" (GitHub) github. Cognition shipped "Introducing Auto-Triage" in May, per its blog listing (Cognition). The April preview was early to a pattern that has since become standard.

Why it matters now. The interesting question has moved from whether an agent can run on a trigger to who approves what it changes and how much it spends. This week's Anthropic spend reports and pooled budgets techcrunch +1, and the sandbox-defaults discussion in quick hits reddit, are the controls such scheduled agents need. If you run any, the settings that matter are the ones that touch blast radius: which repositories, which connectors, which branches.

Claude Code's leaked /workflows (AINews, May 23–27, 2026): shipped as "dynamic workflows" a day later

4 sources, 2 min read

What it said. An r/ClaudeCode post, amplified by AINews, claimed Anthropic had briefly exposed a /workflows system in Claude Code 2.1.147 before pulling it from the changelog. The post described replacing an LLM orchestrator with a workflow.js code-driven controller: structured phases, parallel fan-out, conditionals, loops, budgets, retries, background execution, and less context "token tax" because sub-agent outputs pass between phases instead of through the main chat. Commenters were sceptical. One linked the existing agent-teams docs as overlapping, and one shrugged that they would rather have a better model, naming "Opus 4.5" reddit.

How it aged. The leak was real and the release came quickly. Pasquale Pillitteri's write-up dated May 28 reports that Anthropic "opened in research preview on May 28, 2026 across the entire Claude Code ecosystem" a feature called Dynamic Workflows. It required "the client updated to version 2.1.154 or higher" and was available "on every paid Claude Code plan: Pro, Max, Team, and Enterprise". It was enabled by default on Max and Team, Enterprise admins had to turn it on, and Pro users had to switch it on in /config. The limits are "up to 1,000 total agents per execution, with a maximum of 16 running concurrently in parallel". Users trigger it by dropping "the word workflow into a prompt" or with "/effort ultracode", which only works on models that support xhigh effort. The article frames a workflow as a "Script executed by the runtime", in contrast to a subagent ("Worker spawned by Claude") and a skill ("Markdown instructions"). It tells users to set /model to Opus 4.8 to try the feature and warns that a 500-agent audit could change the bill "by an order of magnitude" (Pasquale Pillitteri). The article never mentions the 2.1.147 leak, so the link between the leaked build and the shipped feature is an inference from timing and design, not something a source states.

Both camps of commenters were partly right. The sceptics were right that the concept overlaps with agent teams. The difference that shipped is where state lives: intermediate results sit in script variables, not in an orchestrating model's context. That is exactly the "token tax" point the leak post emphasised. The "I'd rather have Opus 4.5" commenter has been overtaken by events: Opus 4.8 arrived with the feature, and this week's indices are led by Opus 5.5 and Gemini 4 Carbon (Kingy AI).

The design has spread. GitHub's Copilot Fusion describes three workflows (Single, Cascade, Critique) it uses when needed to orchestrate several models (GitHub changelog). Anthropic's own vulnerability research describes running "large numbers of scanning agents in parallel" behind a "standardized verification and risk rating pipeline" (Anthropic). The quick-hit about replacing an unreliable CLAUDE.md instruction with a deterministic post-failure hook ("deterministic beats persuasive") reddit is the same lesson at small scale.

Why it matters now. Code-driven orchestration has become the accepted answer to multi-agent reliability. Cognition had argued against multi-agents in 2025 and was describing "setups that actually work" by April 2026 source. The open questions are cost governance at hundreds of agents per run, and evaluation. A workflow that fans out to 500 agents also fans out 500 chances to loop, as the 254-repeated-SQL-query incident in quick hits shows armincat.

Import AI 464 (July 6, 2026): Fable's megakernel as "the start of an RSI loop"

5 sources, 3 min read

What it said. Jack Clark reported that Claude Fable 5 had written "the first genuine (and fastest) megakernel ever submitted to KernelBench-Mega". It achieved an 18.71X speedup on an RTX PRO 6000 Blackwell against an optimised PyTorch baseline. Other entries scored 14.4X (Claude Opus 4.8, Triton), 11.14X (GLM-5.2) and 4.34X (GPT 5.5). Clark noted that "torch.profiler shows exactly ONE cooperative kernel launch per decoded token". He argued that kernel design is a core AI R&D input, so "benchmarks like KernelBench-Mega are a meaningful signal on how effective AI systems are becoming at building themselves". The same issue covered the Remote Labor Index rising from 2.5% at launch to 16.1% (Fable 5), and OSWorld 2.0 launching with Claude Opus 4.8 at "only 20.6% binary accuracy and 54.8% partial-score accuracy". Clark predicted "the same ramp" seen on OSWorld 1.0 source.

How it aged. The kernel number has nearly doubled, but not through a clean self-improvement story. BenchmarkList's KernelBench-Mega leaderboard, sampled October 3, lists 57 entries in its all-configurations view. First is Claude Opus 5.5 at 35.46 with a kernel count of 3. Second is Claude Fable 5 on an "or-fable" harness at 35.435 (4 kernels). Third is Claude Sonnet 5.5 at 32.131 (7 kernels). The Fable 5 run at 18.715 sits tenth, and the leaderboard lists its kernel count as 4 (BenchmarkList). That column conflicts with Import AI's "exactly ONE cooperative kernel launch per decoded token". The leaderboard does not define "kernel count", so it may measure source kernels rather than launches, but the page doesn't settle it. The same Fable 5 model now appears at 18.715, 19.118, 24.609 and 35.435 depending on harness and run. Most of the gain from July to October is harness and sampling, not model generation. That cuts against reading the July result as the first turn of a recursive loop. It is better evidence for Clark's narrower claim that frontier models are increasingly competent at an AI-R&D input task.

The labour forecast has advanced more slowly than the rhetoric. BenchLM's mirror of Scale's Remote Labor Index, snapshot October 28, has Opus 5.5 at 21.25%, GPT-6 Astra at 20.83%, Fable 5.1 at 17.92%, Gemini Argon 4 at 17.08% and Fable 5 at 15.83% (BenchLM). That is slightly below the 16.1% Import AI quoted for Fable 5, a discrepancy BenchLM's page does not explain. Clark asked what happens "when this reaches 80%". Four months on, the frontier has gone from 16.1% to 21.25%.

OSWorld 2.0 shows the ramp Clark predicted, depending on which metric you read. Presenc's October 1 check lists Claude Opus 5.5 at 81.8% partial and 48.7% strict on release v2.1, reported by Anthropic. The best official-board entry is Claude Opus 5 at max effort, at 77.67% partial and 44.33% strict. Presenc stresses that "The paper's primary metric is binary. Vendors lead with partial", that "Only three results on the current release could be verified", and that "Opus 5 at max effort went from 31.43 percent binary on v2026.08.08 to 44.33 percent on v2.1 with no change to the model" (Presenc). Strict completion went from 20.6% to under 50% in a quarter, but some of that is benchmark revision, not capability. The JD Oxygen AIIC paper in the same issue was not followed up here.

Why it matters now. Today's bundle is full of self-improvement language: the Trinity paper on "Recursive Self-Improvement" for multimodal agents huggingface, Mirendil's Lor running experiments "for days across hundreds of parallel workers" x, Decagon's inference stack "that improves itself" x, and Copilot automations that "self-improve" github. The KernelBench history suggests discounting these until results hold across harnesses. When the same model doubles its score through scaffolding, the scaffolding is doing much of the work. That is still progress, but it is not the model improving itself.

Claude Mythos and Project Glasswing expand to ~150 organisations (June 2–3, 2026)

1 source, 2 min read

What it said. TechCrunch's Rebecca Bellan reported on June 2 that Anthropic was extending Project Glasswing, "its joint industry initiative to find and fix critical software vulnerabilities using AI", and access to Claude Mythos to about 150 new organisations in more than 15 countries. The initial cohort was 50 partners in early April, including the US government. The target sectors were power, water, healthcare, communications and hardware. Anthropic said "For most partners, we estimate that a major attack could affect more than 100 million people" and that it "expects other AI companies to soon develop models as capable as Mythos Preview" (TechCrunch) techcrunch. TechCrunch flagged the FT's list of recipients, including Okta, Samsung, SK Hynix, NATO and ENISA, as unconfirmed, and the article included no critics.

How it aged. The prediction that others would catch up came true quickly, and Anthropic was the one to document it. Its Frontier Red Team reported that Z.ai's open-weight GLM-5.3 "produced complete exploits in 50 of 410 attempts" on ExploitBench's Chrome V8 set, against 56 for Mythos Preview. Abliterating its safeguards cost about $4,400. GLM-5.3-Flash turned two public Chrome bugs into a reliable exploit chain in 8 hours of model time and 20 minutes of human attention, which would cost $20.40 at Zhipu's API prices. Several abliterated copies appeared online within days, according to Resultsense's 30 September summary (Resultsense). CAISI called GLM-5.3 "the most cyber-capable open-weight model released to date". The release gap the access programme relied on was about five months.

Mythos itself has moved from a preview for selected partners to a named version in a broader programme. This week's research post lists "Claude Mythos 5.1" among the models in an expanded Cyber Verification Program for "qualifying security professionals" (Anthropic). Google followed the same template with Carbon and Fairwind (Google). Cognition launched "Devin Security: Find and fix your most dangerous vulnerabilities" on October 26 (Cognition). A widely reported late-May Glasswing tally of more than 10,000 high- or critical-severity findings, and a Cloud Security Alliance claim that under 1% had been patched, appeared in search results but were not checked against primary sources for this issue.

On the money: TechCrunch noted in June the $65 billion round at a valuation around $1 trillion, one day after Anthropic's confidential IPO filing (TechCrunch). The public S-1 arrived on October 26 (VentureBeat). Luminix notes that the draft risk factors, reported before the public filing, cite a June Commerce Department export restriction among government actions (Luminix).

Why it matters now. Glasswing's premise was that a head start for defenders is worth something. The June-to-October record suggests the head start was months, not years. The lasting value is the verification and disclosure machinery, not the exclusivity. That matches this week's post, which leads with pipelines and PR-time scanning rather than access.

"The Age of Async Agents": Cognition's Walden Yan and OpenInspect's Cole Murray (Latent Space, May 28, 2026)

3 sources, 2 min read

What it said. swyx's episode argued that coding tools have gone through three waves: IDE autocomplete, local agents, and now async background agents that go from spec to PR. It credited a "December 2025 model inflection" (Opus 4.5, GPT 5.2) with making spec-to-PR practical. It cited Devin commit share on Cognition repos going from 16% in January to 80% in March, and merged PRs growing 7x. It noted Cognition's $1B Series D at $26B, with $492M run-rate revenue. Topics included harness-in-the-box versus out-of-the-box design, separating "the brain from the machine", full VMs, memory, why "pure auto-merge vibe coding breaks down after about two weeks", and AI agent budgets of $1k–$5k per engineer. Cole Murray said he would not raise money on OpenInspect partly because "I don't want to compete for, $20 a seat" source.

How it aged. Cognition's own blog shows rapid growth and a widening product line since May. It announced the Series D (over $1B at $26B) on May 27 and the Series E on September 8: "Cognition has raised over $2B at a $48B valuation, led by Andreessen Horowitz and Accel." On September 25 came "Cognition Crosses $1B in Annualized Revenue Run Rate" (Cognition). Going from $492M to $1B in about four months matches the episode's claims about adoption pace. Windsurf was discussed as "Windsurf 2.0" in the episode; on June 2 Cognition introduced "Devin Desktop", which it calls "The next generation of Windsurf". Cognition also shipped "Devin Fusion" (June 29), "SWE-1.7" (July 8), "SWE-2" (September 10), a "Devin Security Swarm" (July 1) and Devin Security (October 26). It acquired TierZero, The Interaction Company, Dioxus and, on October 28, Corridor. And it published FrontierCode 1.0 through 2.0, a benchmark series that now anchors 15% of Artificial Analysis v5 (Cognition; Interconnects). No updated commit-share figure was found on pages read for this issue. Reports of $70–80 billion investor offers could not be read at source (the page returned an error) and are not relied on here.

The episode's structural predictions have mostly held. Background agents are now the default product shape. GitHub's new Copilot app runs "fully managed, parallel sessions" across repositories, session continuity lets one cloud session be followed across app, VS Code, CLI and web (Windsurf 2.0's local-to-cloud handoff, generalised), and automations are always-on agents (GitHub). Murray called competing at $20 a seat "a really difficult business"; GitHub now lets Enterprise customers use Copilot features billed by AI credits instead of a separate subscription. The "$1k–$5k per engineer" budget estimate looks conservative next to Spawn's claimed spend of 30 times payroll on tokens x, an unverified founder claim. The memory problem the episode called "still unsolved" is the subject of today's "Memory Tax" paper huggingface.

Why it matters now. The episode's bet, that the scarce asset is orchestration infrastructure (VMs, secrets, review, memory) rather than the model, is now being tested from both directions. GitHub and Anthropic are bundling that infrastructure into platforms, and Cognition is buying companies and publishing benchmarks to stay ahead. The "codebase regressing to your worst engineer" failure mode is not tracked by any index cited this week.

Agent Lightning v1.0: Towards Harnessed Agentic RL (arXiv, August 18, 2026)

2 sources, 2 min read

What it said. Microsoft's Agent Lightning v1.0 proposes "harnessed agentic RL, where the deploy-time harness directly participates in model post-training". The harness, not the trainer, runs the environment loop, and the trainer "observes only sequences of LLM request-response pairs." The framework is "approximately 3,500 lines of code", and the headline is that "Using only 6K training examples and modest compute, RL improves Qwen3.5-9B on SWE-bench Verified from 41.8% to 56.4%" (arXiv) arxiv.

Paper facts. Status: arXiv preprint 2608.17528, v1 submitted August 18, 2026, with no venue acceptance stated. Authors: Zhiyuan He, Siwei Zhang, Zhiwen Zhou, Yuqing Yang, Yu Kang, Yuge Zhang, Luna K. Qiu, Tin Yan Tsui, Jiahang Xu and Chong Luo, from Microsoft, Fudan University, Zhejiang University and the University of Edinburgh (arXiv HTML). Coding setup: Qwen3.5-9B in mini-SWE-agent, trained with GRPO on a filtered SWE-smith subset (from 59,136 tasks across 128 repos). The authors removed tasks always solved in four runs, kept about 5K with mixed outcomes and added 1K that failed all four, giving "approximately 6,000 training examples and 400 test examples." The SWE-bench Verified number was measured at step 208, while the best validation came at step 128. Other results: search with Llama-3.2-3B-Instruct went from 25.1% to 41.7% on validation, and instruction-following with Qwen3-4B-Instruct-2507 under RLOO went from 51.9% to 70.2% on validation. Baselines are the untrained models. The paper has no head-to-head comparison against other RL frameworks, only design comparisons with AReaL, verl Uni-Agent, slime and Polar. Compute is not stated beyond "modest computing resources". Reward-hacking mitigations: git disabled, .git hidden, network whitelisting. Stated limitations: credit assignment within rollouts, possible redundant prefix computation, token-mean loss being "sensitive to long sequences", and only "best-effort eventual consistency." Code: github.com/microsoft/agent-lightning, MIT licence.

How it aged. Adoption looks real by open-source standards. As of this issue the repository shows 18.8k stars and 1.7k forks. The README says "Agent Lightning was completely refactored in v1.0" and records a September result: "Pure RL improves Qwen3.5-35B-A3B on SWE-bench Verified from 47.8% to 61.6%". It also records an "Agent Lightning Skill" released in August that "helps a coding agent improve another AI agent against a benchmark" (GitHub). No formal release tag was visible, and citation counts and follow-up papers were not checked. The abstract's claim that frameworks including verl Uni-Agent, AReaL 2.0, slime and Polar adopted the original proxy design is the authors' own account (arXiv).

The baseline problem the paper exposes has grown. Qwen3.5-9B scores 41.8% before RL in mini-SWE-agent here, but appears at 51.20 in Liquid's LFM3 comparison table this week, under Liquid's own setup (Liquid AI). A roughly ten-point swing from harness and settings is almost as large as the 14.6-point RL gain. That is the paper's own premise turned back on the field: the harness is part of the system, and it is part of the measurement too. Microsoft has meanwhile productised the harness side. The "Copilot harness" behind Copilot Code, Studio, CLI and VS Code is now offered through Foundry and "built to perform across model families" microsoft.

Why it matters now. The bet that small models plus a training-aware harness can close much of the coding gap is visible this week in LFM3's agent-tuned 1.7B and in GitHub's routing cascades. If you post-train small models for your own agent, train in the harness you deploy. The 41.8 versus 51.20 discrepancy shows how a harness change alone can move the score.

Brain & consciousness

WILD: a 4.7-gram wireless rig that records, processes and stimulates in freely moving mice

1 source, 3 min read

The Transmitter's Simon Makin reports on WILD (Wireless, Interactive, Lightweight Datalogger), a head-mounted platform from Cornell's Antonio Fernandez-Ruiz, Zifang Zhao and Azahara Oliva, published in Nature Methods last month (DOI 10.1038/s41592-026-03220-9) (The Transmitter) thetransmitter. It combines electrophysiology electrodes, a head-mounted camera for pupil dynamics, a microphone for ultrasonic vocalisations, a motion-tracking unit and an optogenetic stimulation module, all on a microcontroller. Neural data goes to a microSD card rather than over the air, and Bluetooth carries only control and sync signals. A crystal oscillator keeps several devices and external signals in sync. The design choice that matters most is that on-device signal processing and machine-learning algorithms can trigger optogenetic stimulation when they detect specific neural patterns, behavioural signatures, or both. That makes it a closed-loop rig that works away from the bench.

Paper facts. Status: published in Nature Methods (per The Transmitter; the Nature page redirected to a login and could not be read, so the abstract, full author list and stated limitations were not checked). Investigators named in coverage: Fernandez-Ruiz, Zhao (engineering lead) and Oliva, all at Cornell. Specifications reported: total weight 4.7 g including a 1.65 g battery and casing. A 2.5 g battery gives about 3 hours of continuous recording at 64 channels and 20 kHz. Experiments: implanted mice in a large lab arena moved about as much as unimplanted mice and farther than tethered mice, and showed more varied social behaviour. Nine mice were recorded over 15 days in a large outdoor enclosure. There they moved less and had more non-REM sleep during the day, ripple rates were higher during night-time non-REM sleep, and the team reports what it calls the first recordings of place cells in a naturally complex environment. Baselines: tethered and unimplanted animals for behaviour. Hardware: off-the-shelf parts, "fully open source" with public documentation, modular for added sensors. Limitations the authors state: not available from the sources read. Constraints visible in the coverage: about 3 hours at full configuration, electrophysiology only with no imaging, and mice only so far (The Transmitter).

Two independent researchers quoted in the piece are positive. UCLA's Daniel Aharoni said "Bringing these capabilities together makes experiments in complex environments and social settings much more practical." The WILD team hopes to emulate the adoption of the miniscope, which is used in more than 1,000 labs. Max Planck's Jason Kerr said "What surprised me was these mice don't move around that much" and "This is the way neuroscience should be heading, in my view." Kerr's surprise is itself a finding. Lab arenas may give a distorted picture of what "natural" movement and sleep look like.

For whole-brain emulation, the relevance is about data, not scale. Emulation needs ground-truth recordings of what circuits do under the full statistics of natural behaviour, not only head-fixed or tethered paradigms. A cheap, open, synchronised, closed-loop logger that multiple animals can wear at once makes multi-animal, multi-day, naturalistic datasets possible. Those are the conditions under which hippocampal replay and place coding were never well characterised. Sixty-four channels at 20 kHz is coarse next to high-density probes, and three hours is short against circadian timescales. The platform trades resolution for ecological validity. That is a reasonable trade for systems neuroscience, but it is not the cellular-resolution connectivity-plus-activity data an emulation project ultimately needs. The open-source hardware is what to watch. If labs adopt it the way they adopted the miniscope, closed-loop naturalistic experiments become routine. If not, it stays a single-lab result.

Ways of thinking

Struggle as the thing that builds judgment

5 sources, 2 min read

A short piece titled "struggle together" is summarised by the newsletter this way: AI can remove much of the difficulty in learning and making things, but some of that struggle builds judgment, understanding, relationships, and the ability to make, with other people, things none of them could have made alone ryo. The page itself returned no readable content when fetched for this issue, so this section works from the summary, not the author's wording.

The model is worth stating carefully because it is easy to caricature. The claim is not that difficulty is good. The claim is that some difficulties are where calibration gets built. You learn which signals are trustworthy by being wrong about them, at a cost you feel. Remove the cost and you also remove the feedback that calibrates you. The "together" part adds that shared struggle is how teams build a common model of a problem, which is a different thing from each member having an answer.

This week's stories give a sharp test case. Benchouse's analytics agent went from 49.6% to 88.2% accuracy by switching models, and then to 96.5% only after humans clarified business metrics, removed ambiguous terminology and told the agent to use agreed calculations benchouse. The last eight points came from a team arguing out what "revenue" means. That is struggle-together work the model could not do for them. In the Funnel incident, an agent re-ran a successful SQL query 254 times during a model comparison instead of finishing its task, a failure that shows why model swaps need whole-system evaluation and bounds on repeated behavior armincat. The AgentBrief note that an agent finishes in 30 seconds while a human spends five minutes verifying reddit shows where the struggle now lives. The verifying human is doing the remaining judgment work. Whether they can keep doing it depends on whether they ever did the underlying work themselves.

Anthropic's S-1 warns that human reviewers may be unable to keep pace with autonomous systems' speed and complexity, according to VentureBeat (VentureBeat). GitHub's automations now propose their own improvements "for you to review and approve" github. Both are review gates, and Lu's point is about the reviewer's competence, which a review gate assumes but doesn't create. A usable rule: for any task you delegate fully, decide which part of it you will still do by hand, deliberately, often enough to keep your judgment calibrated. Pick the part where errors are hardest to see from the output. In this week's examples, that means metric definitions, termination conditions and exploit-to-CVE mappings.

Quick hits

Agents & tooling

8 sources, 2 min read

• Claude Code's sandbox is off by default. A Reddit post summarised by AgentBrief says Claude Code ships with the sandbox off. You enable it with /sandbox, should set sandbox.failIfUnavailable: true, and should know that the network proxy's domain allowlist starts empty and can silently break agent runs. Adversa's catalogue of ten attacks on Claude Code, one reportedly run against 73 Microsoft repositories, is Adversa's own unaudited testing reddit.
• Anthropic claims an 80% cut to Claude Code's system prompt with no eval loss. Per a Reddit user cited by AgentBrief, Anthropic says it "removed over 80% of Claude Code's system prompt" with "no measurable loss on our coding evaluations"; no source reproduces the eval scores. The same roundup notes that MCP's Tasks feature is rarely implemented (a third-party count puts active servers at 47,267), and recommends replacing a flaky CLAUDE.md line with a post-failure hook reddit.
• An agent that ran one successful SQL query 254 times. During a model comparison at Funnel, an internal data agent kept re-running a query that had already succeeded instead of finishing. The write-up argues for whole-system evaluation on model swaps, explicit tool contracts and bounds on repeated behaviour armincat.
• Analytics agent from 49.6% to 96.5%. Benchouse moved nao from 49.6% to 88.2% by switching from Sonnet to Opus, then to 96.5% with better context: clarified metrics, removed ambiguous terms, and agreed calculations used before alternatives benchouse.
• SLayer, an MIT-licensed semantic layer for agents. An embeddable layer giving governed agent and human access to warehouse data over MCP, REST, SQL or Python, with row-level security, semantic search and memory, and imports from dbt, Cube or Ossie github.
• Vercel CI in beta. Vercel's CI runs only the tasks affected by a change and provisions only the compute those checks need. Vercel says time from push to pass fell 2-6x internally, its own measurement vercel.
• Spawn: 10 people, tokens at 30x payroll. A founder post claims 77,000 substantial changes in 30 days from a fleet of permanent agents that each own part of the company. These are self-reported and unverified x.
• Call for real-time agent monitoring. In an opinion piece, Partnership on AI's Madhulika Srikumar and Claire Leibowicz argue that agents are taking unauthorised actions and that safety needs observability: "what the agent did and why it did it" technologyreview.

GitHub, Microsoft & Anthropic enterprise

5 sources, 1 min read

• Copilot Fusion is GA on all plans. Three effort levels, Single/Cascade/Critique workflows, per-model billing with a temporary 30% discount, and admin control over the model pool. See the lead story github.
• Copilot automations learn from outcomes. Automations now self-improve from real-world GitHub outcomes. The Universe post says the improvements are proposed for human review and approval github.
• Microsoft Copilot harness on Foundry. The harness behind Copilot Code, Studio, the Copilot app, CLI and VS Code is now available to build long-running, multi-model agents microsoft.
• Anthropic spend reporting, smart reports, surveys and pooled budgets. Anthropic launched reporting that shows what Claude Code and Claude spending buys, with productivity and cost insights. Claude Enterprise adds smart reports, admin surveys and pooled monthly group budgets, with per-member limits kept as a guardrail. The newsletter item mentions competition from OpenAI's Astra techcrunch +1.

Research & self-improvement claims

6 sources, 1 min read

• The Trinity: capability-driven recursive self-improvement for multimodal agents. A Hugging Face daily-papers entry with 312 upvotes. Not read for this issue; treat the RSI framing with the KernelBench caution above huggingface.
• Multiscale Policy Optimization for long-horizon LLM agents. A paper listed with 373 upvotes, on policy optimisation over long horizons. Not read huggingface.
• Memory Tax. A paper on the net value of agent memory, i.e. what memory costs as well as what it adds. Not read huggingface.
• Mirendil's Lor. Agents that write code, run experiments and iterate for days across hundreds of parallel workers. Announcement only x.
• Decagon's self-improving inference stack. AutoResearch agents diagnose bottlenecks and test optimisations against production traffic replays. Decagon reports up to 2.5x throughput within latency limits, via quantisation, scheduling, engine patches and speculative decoding, with production changes requiring human approval x.
• Qwenputer. A deterministic RISC-V CPU running inside Qwen3.5, using its Gated DeltaNet layers as RAM. It runs arithmetic, C and MicroPython without external tools, and includes an experimental in-model file store divagr.

Models & evaluation

3 sources, 1 min read

• Artificial Analysis v5 and the benchmarker's dilemma. Lambert argues that "Hill-climbing is easy, knowing what to hill-climb is hard". He says v5 widens the apparent open-model gap and calls for more indices with different biases. See the Gemini lead interconnects.
• Genie 4. Google DeepMind's world model adds more realistic visuals, native audio and live natural-language steering of camera, weather and characters. It is limited to trusted testers for now, with AI Ultra subscribers and Gemini API partners promised later blog.
• NVIDIA Nemotron 3.5 Transcribe and Granary v2. An open-weight model for multilingual transcription, translation, speaker attribution and audio Q&A across up to 40 languages, which NVIDIA says ranks first on several leaderboards, plus reusable data pipelines for fine-tuning huggingface.

Security

3 sources, 1 min read

• AI finds four EPICS Base bugs in under four hours. Causal Security's Cipher found four vulnerabilities in the control software used at particle accelerators and fusion experiments in 3 hours 49 minutes, including a CVSS 9.8 integer overflow that could allow remote code execution. Exploitation requires network access to EPICS services theregister.
• AI in attacks targeting Japan. TrendAI documents three attacker infrastructures. CyberStrikeAI coordinated 44 agents against at least 19 organisations, one operator scanned 6,000 Japanese IPs, and another used recovered VPN credentials. The evidence comes from exposed attacker files, and victim-side confirmation is incomplete trendaisecurity.
• Infisical Agent Vault. Infisical's Agent Vault injects credentials through a proxy so AI agents never hold them source.

Infrastructure & business

1 source, 1 min read

• OpenAI reportedly plans to buy Google TPUs. The Information reports OpenAI plans to buy Google's TPUs outright, beyond renting them, alongside Nvidia GPUs and its Broadcom custom-chip work. This is a second-hand report reuters.