Wolf Digest — Tuesday, July 28, 2026

The administration is close to finalizing a voluntary framework under which AI companies would submit their most advanced models to the government before public release. The Office of the National Cyber Director circulated a draft to OpenAI, Anthropic, and Google roughly two weeks ago, and the three submitted joint edits. An executive order signed in early June set an August 1 deadline. The stated scope is models capable of swiftly discovering cyber vulnerabilities — narrower than a general capability regime, and directly adjacent to the containment failure OpenAI disclosed this month. How open-weights releases fit the framework is unresolved.

A Shanghai-based state-backed company has begun manufacturing immersion deep-ultraviolet lithography machines — the class of tool TSMC and others use in volume production — for the first time. ASML shares slid on the report. Immersion DUV is not EUV, so this does not by itself unlock leading-edge nodes, but it removes a chokepoint that US and allied export controls have leaned on heavily, and it lands the same week Amodei argued chip and chipmaking-equipment restrictions are the most efficient lever against Chinese frontier training runs.

A production-representative MQ-28A Ghost Bat, built by Boeing Defence Australia, was integrated into Valiant Shield 26 alongside the United States, Canada, Japan, and New Zealand, flying with a US Air Force F-15EX Eagle II and participating in agile combat employment operations in the Northern Mariana Islands. Boeing lists the jet-powered aircraft at more than 2,000 nautical miles range and fighter-compatible speeds up to Mach 0.9. Gen. Kevin Schneider, head of Pacific Air Forces, said he is impressed with how the program is going and called it an example for others pursuing collaborative combat aircraft. It is the first time a CCA has demonstrated integration with crewed platforms in a major international exercise.

The Open Secure AI Alliance launched Monday to remediate and disclose vulnerabilities using open models, harnesses, and tools, building on the Linux Foundation's Akrites initiative and OpenSSF community work. The argument is that cyber defense should not sit inside a few opaque systems: open models democratize defensive capability, increase transparency for defenders, enable defense while protecting data, and provide distributed defense with no single point of failure. The post acknowledges open models can be misused through safeguard removal or repurposing, while arguing those risks are not unique to open systems. Timing puts it directly opposite Microsoft's closed MAI-Cyber-1-Flash launch the same day.

StateAct argues that a screenshot is a lossy rendering of program state — different states produce identical pixels — and that a code-first agent working directly against files, application backends, and the DOM beats a perception-first one. A GUI subagent handles only the subgoals that need clicking: 28 of 108 tasks and 1.1 percent of main-agent steps. On OSWorld 2.0 it lifts Claude Opus 4.8 from 20.6 to 26.9 percent binary success and 54.8 to 61.6 percent partial, at roughly nine times lower cost per task. A code-only variant with no GUI subagent reaches just 45.9 percent partial, below the screenshot baseline — so the hybrid, not the abstinence, is what works.

Cosmos-H-Dreams is a real-time, action-conditioned generative simulator for surgical robotics, distilled from Cosmos-H-Surgical-Simulator — itself Cosmos-Predict2.5-2B post-trained on the Open-H-Embodiment dataset with a unified 44-dimensional action space — into a causal, few-step student. Training uses a progressive temporal horizon from 12 to 72 frames, causal warmup against cached teacher denoising trajectories, then self-forcing distillation to fight exposure bias. The student runs as few as two denoising steps per latent frame, and with NVIDIA's FlashDreams streaming-inference library it goes from roughly 10 frames per second to about 160 on a single RTX PRO 6000. Fine-tuning deliberately includes failures — needle drops, missed throws — because a simulator for policy evaluation must reproduce the consequences of bad actions. No numeric benchmarks are reported yet.

Reddit users found that the search operator site colon claude.ai slash share surfaced a long list of shared conversations and Artifacts on Google over the weekend. Anthropic said it does not supply chat directories or sitemaps to search engines and that share links are neither guessable nor discoverable unless users post them somewhere crawlable. Before remediation, reporting described exposed medical records, clinical trial data with patient names, internal company documents, and employee reviews. A near-identical incident occurred in September 2025, when Google estimated it had indexed just under 600 conversations. Users can audit exposure under Settings, Privacy, Shared Chats.

Cursor Start is a 649-rupee-per-month India-only plan, against a 20-dollar global Pro tier. It bundles Cursor's own Composer 2.5 and Grok 4.5 at raised limits, cloud agents, the iOS app, MCP support, hooks, and skills, but excludes OpenAI and Anthropic frontier models, Bugbot, Auto Mode, and the SDK. Head of APJ Simon Green said the margin works precisely because the plan runs on Cursor's own cheaper models, not as a loss leader. India is already Cursor's third-largest market with its highest concentration of power users, and the base has more than tripled in a year. SpaceX agreed on June 16 to acquire Cursor in a 60-billion-dollar all-stock deal expected to close in the third quarter.

Similarweb's 2026 Generative AI Landscape puts AI Overviews in 43 percent of Google searches, up from 15 percent a year earlier, with AI Mode visits rising from 126 million in June 2025 to 279 million by May 2026. Average query length is up, consistent with users replacing keyword queries with conversational ones. Citations in AI responses rose more than fivefold, but as of May only 6.8 percent of US ChatGPT desktop queries produced a cited response. One counter-signal for publishers: after a May 7 ChatGPT search update, the share of US ChatGPT desktop visits landing on webpages more than doubled from 25 percent in March to nearly 60 percent by May 30.

Molt from NVIDIA NeMo Labs targets the iteration tax in agentic RL research, where every new estimator, pipeline stage, or rollout scheme threads through trainer, distributed backend, and rollout glue. The design goal is a codebase small enough for a researcher — or a coding assistant — to hold entirely in context, with the agent as an ordinary program and one asynchronous loop training multimodal and mixture-of-experts policies while never training on a token it did not generate, staying consistent in tokens, policy versions, and model semantics. Under a matched fully-asynchronous protocol the authors report Molt is statistically comparable to a state-of-the-art Megatron-based stack. Open source with recipes and containers.

Rather than studying feature geometry inside the model, Feature-Effect Geometry Analysis ablates the same active SAE feature across many contexts and analyzes the resulting cloud of logit changes. Across SAE variants, consistent one-dimensional effects turn out to be rare: few features behave like reusable directions. The authors separate value-like features, tied to static facts, which more often show structured low-dimensional effects spanning several directions, from pointer-like features tied to context-dependent operations, which produce diffuse effects. The practical conclusion is uncomfortable for steering work: a feature can be interpretable and causally relevant without providing a stable direction to steer with.

Using a controlled multi-turn environment instead of opaque internet data, the authors trace where planning ability actually comes from. In pre-training, explicit world-model construction through chain-of-thought state-transition modeling yields stronger long-horizon generalization; atomic skills alone do not compose, but a little long-horizon data goes a long way, and suboptimal trajectories are severely harmful because errors amplify over the horizon. In post-training they use mutual information to separate general planning patterns from task-specific planning knowledge, and identify three regions where post-training is unnecessary, effective, or unsupported. On-policy distillation has a broader effective region than GRPO under low-quality and long-horizon settings because it gives more consistent update directions.

Speaking on CNN Sunday, Satya Nadella escalated a warning he first made in mid-July: enterprises should retain all metadata around model usage so they can train their own weights or open models, and should keep the harness and the context and memory layers separate from the model itself. He named Claude Code and ChatGPT Codex as harnesses enterprises should not depend on, arguing that separation lets you route to multiple models and survive any one of them disappearing. TechCrunch notes Microsoft invests in both Anthropic and OpenAI and sells the gateway infrastructure this argument recommends.

Training vision-language models from scratch on multimodal inputs avoids the optimization asymmetries of late fusion, but its scaling behavior has not been characterized. Fitting model size and token count under fixed compute, the authors find minimal loss follows a predictable compute law while compute-optimal size and token count scale as power laws — and crucially that the language and multimodal objectives scale differently. The language allocation law is largely invariant to data composition, so language learning is stable regardless of the multimodal ratio; the multimodal allocation law is highly sensitive to it, with text-heavy mixtures becoming compute-efficient only at larger scales, shifting optimal allocation toward capacity rather than tokens.

Direct MXFP4 quantization of attention degrades diffusion video generation through two numerical failures: the clipping-underflow trade-off from power-of-two scaling, and row-wise normalization error in the softmax loop. MXAttention is data-free. Universal Optimal Scaling exploits the periodic structure of power-of-two microscaling to derive a distribution-independent optimal boundary of Qmax equals 7.25 with no calibration or search, and Pre-Normalization Quantization quantizes unnormalized softmax exponentials before row-wise summation so normalization is preserved by construction. On Wan2.2 and HunyuanVideo it closes at least 95 percent of the VBench Imaging Quality gap between OCP MXFP4 and FP16, with under 0.01 absolute degradation on all reported VBench metrics and negligible fusion overhead.

On-policy distillation methods extend velocity matching to the classifier-free-guidance-composed prediction, matching teacher and student guided velocities directly. The authors show this objective is under-identified at the branch level: positive- and negative-branch errors can cancel inside the guided prediction. When negative conditioning is shared, both branch errors fall together and naive matching works; when the model's native CFG schema keeps privileged information in the teacher's negative branch that the student cannot see, the objective becomes antagonistic, lowering positive-branch error while raising negative-branch error. They call this Negative Branch Asymmetry and fix it with Positive-Direction Matching, which constrains the positive prediction and the CFG conditional direction separately, giving robust transfer in dense-to-sparse video control across guidance scales.

Enigma, under a year old, raised a 71-million-dollar seed led by Index Ventures and Ribbit Capital with Sarah Guo of Conviction participating. Its bet is on the interaction layer rather than model capability: instead of scraping web video, simulating, or collecting glove data, it studies how humans engage with robots. It is opening more than 100 of its own robots, housed in hangars in Israel and California, to online interaction by anyone — demonstrated tasks include painting, sword-fighting each other, and mixing flasks. Founders Jonathan Jacobi and Gal Niv built both the arms and the models in house. Jacobi's framing: if explaining a task takes fifteen minutes, everyone gives up and does it themselves.

Taiwanese prosecutors have detained an Nvidia employee and searched the company's offices, along with the employee's home and desk, as part of an ongoing investigation into alleged smuggling of Nvidia AI chips into China. The enforcement action is a concrete data point in the argument Amodei made the same week that smuggling and workarounds are the practical weak link in chip export controls, rather than a hypothetical one.

China's Ministry of Commerce responded Monday to US accusations that Chinese labs are distilling American models to appropriate intellectual property, stating the claim has no factual basis or legal support. The exchange matters technically because distillation is the specific mechanism Amodei singled out the same day as more consequential than open weights: it is compute-efficient enough to partially route around chip restrictions and, he argued, can bring a follower frontier to within months of the leader.

Embodied agents get no internet-scale shortcut because they need observations coupled to physical states and actions. This survey organizes the ecosystem as a pyramid across real-robot data, UMI-style data, egocentric and exocentric video, simulation, and general vision-language data, arranged along the tension between scalability and robot alignment and scored on quality, diversity, reusability, and physical fidelity. It then reads recent embodied brain models, vision-language-action models, and world-action models through their data recipes, relating composition to perception, reasoning, planning, action generation, and world prediction. Six open problems close it out: large-scale tactile datasets, failure and recovery data, scalable collection pipelines, cross-embodiment action alignment, egocentric data for dexterity, and principled mixture design.

Self-evolving training faces a dilemma: environment-bound methods get precise feedback but stay narrow, while open-ended self-generation broadens the task space and loses reliable verification, letting misleading rewards pollute the loop. Skill Self-Play proposes agent skills as the middle ground — each skill guarantees deep, verifiable execution in a specific scenario while dynamic routing across skills preserves task variety. A proposer generates tasks conditioned on sampled skills, a solver explores solutions, and a skill controller collects execution feedback to update and expand the library, all orchestrated in an RL loop. Reported gains are on tool-use and reasoning benchmarks, pushing the ceiling of already-competent backbones.

Cloud executives who have run initial tests on Nvidia's next-generation Vera Rubin server racks expect them to be substantially easier to bring up than the Grace Blackwell racks were in 2025, when Nvidia's largest customers struggled with an array of unfamiliar technologies and kept the troubleshooting quiet. For operators spending billions, every week of setup delay defers revenue-generating capacity and squeezes builder margins, so deployment friction is a first-order cost. It is also the platform SSI just committed to for its order-of-magnitude compute scale-up.

The authors argue production agents fail less from bad reasoning than from an inability to manage what is in the reasoning context — histories, large prompts, sprawling tool definitions, ballooning tool outputs — and that treating this as storage and retrieval is too narrow. They frame it as a lifecycle spanning what to remember, extraction and structuring, store selection per data type, consolidation and forgetting with provenance, present relevance, anticipation, and compaction to a budget, operating across an organizational scope hierarchy. Five primitives: architecting, ingesting, scoping, anticipating, compacting and consolidation. The economic claim is sharp: naive accumulation is quadratic in conversation length, crude summarization buys linear cost at the price of an accuracy cliff, and only validated compaction gets linear cost with preserved fidelity.

Most video-generation benchmarks draw prompts from the web or from templates and score them with untrained generic multimodal models against rudimentary axes — overall quality, coarse text alignment, temporal smoothness — which measures plausibility rather than craft. FilmBench, developed with directors and faculty from the Beijing Film Academy and the Hujing studio, reverse-engineers prompts from clips of award-winning films across 20 genres so every prompt is anchored to a verified live-action reference and follows a real shot list; 1,056 of its 1,169 prompts script multiple shots. Evaluation uses a three-level cinematic taxonomy of 3 axes, 12 components, and 35 text-to-video sub-metrics plus 3 reference-to-video ones, with an expert-grade automatic evaluation agent whose core operators are open-sourced.

Measuring tokenization fertility on FLORES-200 across six tokenizers and fourteen languages, the authors find Indian languages average an 8.0x token tax relative to English under cl100k_base, reaching 13.0x for Malayalam, which cuts the effective context window to as little as 12 percent of what English users get for the same semantic content. The mechanism is failed byte-pair merges leaving text fragmented into single-byte tokens, with merge failure correlating strongly with the tax at Pearson r equals 0.89. Critically this is a design artifact, not a property of Indic scripts: XLM-R and OpenAI's o200k_base cut the average Indic tax by 73 percent.

Bun's July 8 post claimed the Rust rewrite was completed and merged over eleven days in May at a cost of 165,000 dollars in Anthropic API calls, or about 15,000 dollars a day. Cloning the repo on July 27, Tom Lockwood found no release tag since bun-v1.3.14 on May 12, an eleven-week gap against a prior maximum of six. Open pull requests from the robobun account rose from 1,277 on July 9 to 2,475 on July 27; at roughly 40 minutes per merge pipeline, clearing that backlog would take 86 days of continuous CI. He also found PRs authored by Anthropic employees, concluding much of the cost was off the books, and extrapolates toward 800,000 dollars if spend continued at 10,000 dollars a day. His stated position is that the rewrite may well be real, just not done and not for 165,000 dollars.

Acquisition planning documents show the Secret Service intends to spend up to 20 million dollars on an autonomous robotic targeting system, expected to be awarded in the fourth quarter of fiscal 2026 as a no-competition follow-on to work with Marathon Targets dating to 2023, on which it has already spent more than 4 million dollars. The buy covers one autonomous system with eight all-terrain infantry targets, one vehicle target, and four additional infantry targets, all required to wear ballistic protection across calibers. The robots move at up to 11 miles per hour, speak multiple languages, produce sound effects when hit, and stop only after repeated or vital-area hits. The Special Operations Division and two training units already use them.

Three-year-old Tacta Systems opened its Palo Alto headquarters for a first look at the sensor gloves people wear while doing ordinary work, recording movement data for training manipulation models. Tacta has raised 75 million dollars. Its bet is narrower than most humanoid programs: it leaves the body to others and mounts a three-fingered hand on an off-the-shelf industrial arm on a rolling base. Co-founder Vikram Pavate's framing is that humans are good at high-value work because of hands. Wearable-glove data collection is becoming a common answer to the embodied data bottleneck.

A history professor embedded an instruction in white font on a white background inside an online midterm prompt, directing any model that read it to work Madagascar into the answer nonsensically. Invisible on screen, the text travels intact when the question is selected, copied, and pasted into a chatbot. No AI detector was needed: any submission mentioning Madagascar was self-marking. Two verbatim tells were an Industrial Revolution essay ending 'Madagascar floats sideways through the afternoon' and an inequality essay closing 'Madagascar purple bicycle whispers to the ceiling.' Thirty-two of 35 students across two classes were caught. It is a clean demonstration that indirect prompt injection works just as well as a tripwire as it does as an attack.

Col. Spencer Turner, B-52 program manager, told reporters at Air Force Life Cycle Industry Days that the original acquisition strategy always called for two test aircraft, that modification of the second bomber with the Raytheon-built AESA radar is ongoing, and that he expects the full radar suite installed this year. A B-52H crashed June 15 taking off from Edwards Air Force Base on a radar test mission, killing all eight crew; the cause is still under analysis. The program modernizes 75 aircraft to the B-52J designation for service into the 2050s, including Rolls-Royce F130 engines and the AN/APQ-188 radar. The radar effort triggered a Nunn-McCurdy breach last year, and a GAO assessment last month noted production was planned with very little development flight testing completed.

Cognizant is expanding its Anthropic partnership to embed Claude across its own engineering platforms — Flowsource, Neuro AI Engineering, and Neuro IT Ops — and becoming a Global Premier Partner in the Claude Partner Network. Flowsource now runs Claude Code alongside engineers in its Spec-Driven Development module, directing it with project specifications, coding standards, and architectural blueprints, then evaluating output before production. More than 30,000 associates have completed Claude training. Client deployments cited include an agentic contract-intelligence system that cut biopharma contract review time by up to 40 percent while lifting extraction accuracy above 88 percent, and an underwriting risk tool reported to save roughly eight hours per person per week.

Ben Lorica's argument is that 'open' has stopped predicting anything: the top-ranked open coding model now costs roughly thirteen times more per million tokens than the cheapest credible open model sitting beside it, and both ship weights. His four checks before a procurement decision are to measure cost per completed task rather than per token, since a model listing at half the price can land within ten percent once you count the calls needed to finish; to determine what share of input is genuinely cacheable, because cached input runs a tenth of uncached and that makes caching an architecture decision rather than a billing footnote; to ask what happens at peak; and to remember that open rarely means self-hosted.

Instead of retraining, the model stays frozen and a persistent memory of verified solutions grows beside it: once a problem family passes an independent verification step that never consults the answer key, every new instance is answered at zero generation tokens, bit-exact and deterministically. Across 180 fresh instances spanning nine families, four architectures from four vendors — dense and mixture-of-experts — each score 180 out of 180 at zero generation tokens; emptying the memory drops them to nothing, which is the negative control. Memory selection takes 1.4 microseconds and a full reuse completes in 6 to 23 milliseconds at 36 milliwatt-hours. Approximate similarity retrieval picks the wrong item 94.3 percent of the time on a 4,500-item store where exact addressing makes zero errors.

Real creative work involves references, drafts, alternatives, edits, failed attempts, version relations, tool actions, evaluation signals, and human feedback — an evolving project state that prompt-based, chat-based, and node-based systems only partially support, discarding intermediate context or forcing linear conversations. JarvisHub treats an editable canvas as simultaneously the user workspace, the agent's external memory, its action space, and shared project state, representing artifacts, dependencies, versions, and feedback as typed nodes and links. A three-layer architecture of canvas state, protocol bridge, and agent runtime makes the agent's context representation, tool choice, revision, and failure recovery inspectable — which is what the closed commercial creative agents do not allow.

Benchmarks collapse two questions into one accuracy number: whether a response reached an evaluable state, and whether it was judged correct. Separating scorer-independent execution evidence — termination, answer exposure, parseability, completion length — from scorer-dependent correctness across 2,550 outputs from five fixed Qwen and DeepSeek configurations shows sharply different execution mixtures under a matched 2,048-token limit: 49 of 450 Qwen MATH outputs terminate with no final answer, against 5 of 300 for DeepSeek and none of 750 on ARC. Raising DeepSeek's budget to 8,192 tokens eliminates missing-final terminations entirely. A coverage-audited verification study further shows candidate-selection and aggregation policy can move comparative accuracy substantially.

A heavily redacted Office of Inspector General report distributed internally in January and obtained by DefenseScoop through FOIA finds the Integrated Undersea Surveillance System does not have a sustainable workforce with sufficient expertise for existing and future mission requirements, attributing the decline in enlisted acoustic analysts' skills to the Navy not prioritizing repeat IUSS tours. IUSS combines fixed, mobile, and long-range seabed sensing with data-processing assets to detect and classify submarines for theater undersea warfare commanders. The finding is relevant to automation questions: acoustic classification is one of the clearer candidates for machine assistance, and the constraint here is analyst pipeline rather than sensing.

Feyn Labs expanded BiRefNet's third feature-extraction stage from 18 to 24 blocks — depths from 2, 2, 18, 2 to 2, 2, 24, 2 — growing the model from 222 million to 263 million parameters while preserving all compatible pre-trained weights so only six new blocks started untrained. Training used 26,100 images from ten datasets capped at 4,000 each, for 7,000 steps at learning rate 2e-5, with mixed segmentation and matting annotations converted to binary foreground masks. It posts the best published S-measure on four of eight benchmarks: UHRSD-TE 0.981 against BiRefNet's 0.957, HRSOD-TE 0.983 against 0.961, DIS5K 0.961 against FlowDIS's 0.951, DAVIS-S 0.977 against 0.975, and lands within 2 percent elsewhere. The accompanying NoBg library beats the reference BiRefNet implementation on throughput, latency, and peak memory at every batch size tested.

The claim is that the largest productivity gains come from understanding and exercising the agent harness itself rather than from installing more tooling, and the post walks a workflow built only on existing Copilot features — no custom prompts, no additional MCP servers, no bespoke agents. It concedes skills, MCPs, instructions, and custom agents matter as work grows more complex. The framing lands the same day Nadella argued enterprises should treat the harness as a layer they own and keep separate from any one model, which is the same abstraction viewed from opposite ends of the buy decision.

Zitron's core claim is that metered, hard-to-measure inference costs run contrary to how software is bought, citing SemiAnalysis findings that users can burn hundreds of dollars on a 20-dollar subscription and thousands on a 200-dollar one, and his own reporting that OpenAI lost 20.9 billion dollars on 13.07 billion in revenue in 2025. He notes both OpenAI and Anthropic moved enterprise customers to token billing in March 2026, after which Uber reportedly spent its annual token budget in a single quarter. On capex he argues hyperscalers have spent over a trillion dollars since 2022 and would need roughly 1.5 trillion in new profit to justify it. The MacRumors framing contrasts roughly 650 billion in hyperscaler AI infrastructure spending this year against Apple's roughly 14 billion.