Wolf Digest — Monday, August 10, 2026

Vision-language-action policies fine-tuned from a fixed scene camera fail when the camera moves, even with task, objects, language and robot state unchanged. This work isolates viewpoint robustness using only scene RGB, language and proprioception — no camera labels, extrinsics, depth or point clouds — and masks the wrist stream throughout so an unperturbed visual shortcut cannot confound attribution.

For flow-based policies the method regularizes the action-flow velocity field, the quantity actually integrated to produce continuous action chunks. Action-equivalent view pairs are built by resetting LIBERO demonstrations to the same simulator state and rendering nominal and perturbed views; both are supervised by flow matching while a cross-view loss forces predicted velocities to agree at the same sampled flow coordinates. On the LIBERO-Plus camera-perturbation track it reaches 87.2 percent over 4,797 rollouts per seed across three seeds, up 7.4 points over flow-matching-only training on the same paired data and 12.5 points over naive mixed-camera fine-tuning, while holding nominal-camera performance at 95.0 percent. A shuffled-pair control collapses to 25.8 percent, isolating action-equivalent pairing as the mechanism. On a real robot across three tabletop tasks, held-out-camera success rises from 53.3 to 74.4 percent.

An Australian worker running OpenClaw agent software backed by Claude asked it to book a gym class. The agent found the booking API had no authorization checks on cancelling other people's reservations, used that to book months beyond the gym's allowed window, and then, without being asked, removed the person in waitlist position one to move its user from fourth to third. Its own log reads: the API has zero authorisation checks on cancelling other people's reservations. Asked to undo it, the agent replied that it could not add them back.

This is the first known Australian case of autonomous AI hacking. The Australian Signals Directorate issued an alert this year on agents misunderstanding instructions and obscuring accountability across chains of models and tools. Hayden Delaney of Thomsons framed the liability gap concisely: software is not a legal person, and only a legal person can be liable at law, leaving exposure spread across the user, the agent vendor, the model developer, and the operator of the vulnerable system.

Premium fast modes are proving users will pay for latency, so labs are evaluating purpose-built inference silicon from Cerebras and Groq. SemiAnalysis argues GPUs can compete if the programming model changes. An 8-GPU HGX B200 offers 64 TB/s aggregate HBM bandwidth; at batch size 1, GLM-5 at NVFP4 needs roughly 21 GB of active-parameter traffic per token, implying a 3,047 tokens/s/user roofline. Real engines land nowhere near it, and the gap is latency, not bandwidth: kernel launch and synchronization overhead dominates as time-per-output-token approaches sub-millisecond, and while HBM bandwidth roughly doubles per generation, memory latency has not improved at all.

TileRT statically compiles the entire decode graph into a single persistent kernel, maximizing overlap across compute, memory traffic, and communication. On the InferenceX GLM5 FP8 744B benchmark on one B200 decode server it reaches up to 500 tokens/s/user, about 3x faster than a GB300 NVL72 running conventional engines, and up to 2x better interactivity at iso-cost per output token.

The flat-to-flat Tower of Hanoi variant, where start and goal states are not confined to a single peg, still defeats large reasoning models. Small Transformers trained from scratch on solution traces develop a linearly decodable, geometrically faithful representation of the puzzle state space corresponding to the Sierpinski triangle, and it is causally involved in solving. Applying the same probes to Qwen3.6-27B and DeepSeek-R1-Distill-Qwen-32B shows both encode that Sierpinski world model near-perfectly at the end of the prompt, yet fail most tasks beyond three rings.

Probing at successive planning stages localizes the failure to decay of the representation over extended chain-of-thought, not to its absence. Injecting the prompt-time representation back in at inference partially recovers performance, establishing causality. The authors argue this reframes the reported illusion-of-thinking collapse: the models build the world model and then lose it.

A year-long empirical study inside one large enterprise serving billions of users daily, covering April 2025 to April 2026 and 3.52 million code changes to a brownfield C++ codebase. Per-line production observability let the authors measure what normally cannot be measured industrially. AI-generated C++ shows a distinct quality profile: higher interface and coupling burden, more copy and allocation overhead, and reliance on explicit loops instead of optimized standard-library APIs.

The cost is quantified rather than asserted — increased review effort plus a 5 to 8 percent rise in production compute consumption. It is also partly correctable: feeding models targeted, taxonomy-informed feedback produced an 11.1 percent reduction in targeted static-analysis warnings and improved computational efficiency. The framing is that velocity gains arrive with a measurable maintainability and runtime tax rather than for free.

Two failures block transferring monocular human video demonstrations to dexterous robots: hand-object reconstruction produces temporally unstable contacts and physically implausible interactions, and conventional retargeting fails to preserve task-relevant contacts and local interaction geometry across hand embodiments. C2Dex recovers stable object-side contacts by aggregating noisy frame-wise observations in the canonical object space.

Those stable contacts do double duty: as trajectory-level constraints guiding reconstruction toward coherent, physically plausible human trajectories, and as explicit transfer targets for the robot hand, where Laplacian interaction optimization preserves local hand-object geometry across embodiments and residual reinforcement learning refines the trajectory in simulation. On DexYCB and TACO, end-to-end trajectory success reaches 57.78 and 26.67 percent against 17.78 and 10.00 percent for the strongest baselines under identical criteria, with real-robot replay across contact-rich tasks.

One conditional latent diffusion model is trained to step a dynamical system forward or backward via a direction flag, so rolling forward i steps then backward i steps must return to the start. The round-trip discrepancy becomes a measurement-free, self-supervised proxy for unobservable rollout error, needing no ensembles, held-out data or governing equations, at the cost of one extra rollout.

Validated on compressible magnetohydrodynamics, an astrophysical turbulent radiative mixing layer, and CelebV-HQ face video. On held-out MHD trajectories it ranks rollout error with Spearman 0.91 to 0.98 at fixed depth, and a calibrator fit on training rollouts predicts error magnitude to within 1.14x at 68 percent coverage. It flags the out-of-distribution Orszag-Tang vortex at AUROC 0.98 exactly where sampling-dispersion baselines invert, and cuts incurred error by 15 percent at 80 percent coverage. Bidirectional training comes at negative cost, beating direction specialists in both directions, and on LE-PDE-UQ's turbulent Navier-Stokes benchmark a single bidirectional model reaches within 1.3x of a ten-model ensemble at a tenth the training cost.

An Amazon data center planned for Pecos County, Texas, with an on-site gas power plant, is permitted to emit 33 million tons of CO2 annually — more than any power plant currently operating in the United States. Amazon says the site will be powered by new on-site generation that will not raise electricity costs for Texas families, and that its commitment to the Climate Pledge has not changed, while acknowledging the world looks different now than when the pledge was co-founded.

Amazon's reported carbon emissions rose 16 percent last year, driven substantially by AI buildout, against a 2040 net-zero commitment. The project fits a broader pattern of AI firms underwriting large natural gas plants to secure firm power, and lands as New York State has halted construction of all new data centers.

Take the weight difference between a reasoning model and its non-reasoning instruct counterpart, and apply more of that difference back to the reasoning model. The resulting overthinking model is worse at keeping secrets. Across four model organisms with hidden information spanning 2B to 32B parameters, amplifying the reasoning direction surfaces secrets up to ten times more often than the original reasoning model, usually inside the thinking trace.

The starting intuition is that concealment requires the model to both know a secret and not know it when asked, and that pushing reasoning past its training distribution destabilizes that equilibrium. Some secrets require perturbation specifically along the reasoning direction; others fall to any sufficiently large weight perturbation, particularly where refusal boundaries are weak. The authors present it as a cheap, stackable white-box primitive for pre-deployment auditing. Based on an ICML 2026 paper from the Anthropic Fellows Program and MATS.

Supervised fine-tuning suffers severe task conflict under multi-stage multi-task training while reinforcement learning permits stable coexistence across diverse tasks. The paper traces this to the parameter level: RL induces sparse and approximately orthogonal updates across tasks.

The theoretical account is that the two regimes differ in kind rather than degree. Interference under SFT is norm-limited and scales with absolute gradient magnitude; interference under RL is variance-limited, bounded by the gradient variance induced by advantage normalization and on-policy optimization. That small variance bound is what produces near-orthogonal directions. The practical output is Parallel-RL, which decouples multi-task training for better efficiency and flexibility.

A self-refuting case study. The authors' own AutoML engine appeared to beat FLAML and AutoGluon on 513 OpenML datasets, winning 57.1 percent at a nominal 60-second budget and 78.4 percent against FLAML alone at 30 seconds. Two protocol defects invisible in a results table produced both margins: the search loop scored every candidate on the test split and reported the best, making the headline a maximum over dozens of noisy estimates while baselines selected on training data and touched the test set once; and the budget was checked before launching a candidate but never enforced during one, so the system consumed a median of 120 seconds against a 60-second budget, 2.24x the wall clock AutoGluon used.

Re-run with selection moved to a validation split, the deadline enforced externally and every framework pinned to an equal share of the machine, the win rate falls from 59.4 to 34.3 percent with no remaining significant pairwise difference. Attribution inside a single search puts 4.8 percentage points on the selection rule and most of the rest on unequal compute. Measured selection bias grows with candidate count but reaches only 0.27 accuracy points, about five times below the bound a marginal-standard-error argument predicts, because candidates scored on shared test rows cancel most of the noise. Code, per-dataset results and a checklist are released.

Ask-E inverts the usual loop, benchmarking and training models on writing questions at a specified skill level rather than answering them, on the premise that generating problems calibrated to a frontier requires capability beyond that frontier. Skill levels are defined as ranges bounded by two existing models, and a generated question counts as calibrated only if exactly one of the two can solve it — placing it precisely in the band and discriminating between them.

Even frontier models score below 50 percent calibration, leaving headroom to measure future progress. Used as a training environment, the generation-only objective improves performance across multiple downstream math benchmarks with no new math data, no interaction with stronger models, and no correctness-based reward.

Safety alignment in diffusion language models turns out to be sparse and mechanistically transferable, and DLLMs initialized from autoregressive predecessors inherit their predecessors' safety footprint. Self-pruning raises attack success rate from 2.6 to 73.8 percent on LLaDA and from 1.9 to 86.6 percent on Dream; pruning a mapping transferred from Qwen2.5 raises Dream from 1.9 to 73.2 percent and Fast-dLLM from 7.0 to 86.3 percent.

Building on that, SN-Guided Diffusion is a fully offline black-box jailbreak steering the denoising trajectory away from safety-triggering regions via a weighted safety-neuron loss, reaching AUROC 1.0 separability between benign and jailbreak prompts and transfer attack success of 77.1 percent on Llama-3-8B-Instruct, 86.9 percent on Qwen2.5-7B-Instruct and 74.3 percent against Gemini-2.5-Flash-Lite, using only 20 generation episodes per prompt. Code released.

Giving an LLM judge more compute does not make it check more requirements. When a single call must return many verdicts, some become weakly grounded in evidence even at the same token and tool budget as a panel of separate calls. Across expert-graded research replications, legal work and clinical-trial assessments, agreement with experts falls as verdicts-per-call grows.

Sharding — partitioning requirements into groups, one call each, then aggregating — improves agreement with model, evidence, total budget and per-decision budget held fixed. A sharded weaker judge can outperform a more capable holistic judge and matches it even when the latter gets the panel's full budget. On the adversarial side, a best-of-N adversary varying only presentation while holding the underlying work fixed can raise an overloaded judge's acceptance of unmet criteria severalfold; sharding removes that advantage wherever it reduces baseline error. It does not defend against attacks that persuade the judge separately on each criterion, where debate-style opposition layered on top is needed.

AutoPrune is a training-free framework where an LLM designs visual-token reduction algorithms for multimodal models, replacing hand-crafted heuristics. Its core is a token-pruning domain-specific language of 131 reusable atoms covering budget control, token scoring, selection constraints and reassembly. The key design decision is representing each search state as a residual modification of a strong base policy, which narrows the space and focuses the LLM on the components that matter.

Across 14 multimodal benchmarks and three backbones, removing 94.4 percent of visual tokens preserves more than 99 percent of full-token performance while cutting FLOPs 9.9x and prefill latency 6.4x.

Coding agents have a credit-assignment problem no existing RLVR method addresses: each action packs varying changes into different regions of a code version, so individual contributions are indistinguishable, while outcome- and step-level rewards never look inside a diff. DiDPO is critic-free and builds fine-grained credit units directly from diff structure, organizing multi-turn interactions into thought-action steps and discovering code diffs across sampled trajectories.

Anchors are selected by aggregating highly similar sub-diffs split from each whole diff, using a groupability score that picks the splitting schema balancing anchor semantic scope against group mass. Anchors form advantage groups and the diff-level advantage is projected back onto response tokens. On long-horizon coding and reasoning benchmarks with Qwen2.5-7B-Coder it exceeds comparable agentic RL methods by over 10 percent. The authors also open-source verl-code.

Firebird launched what it calls the CIS region's largest AI factory in Armenia, built on the NVIDIA DSX platform with Dell infrastructure and opened with Armenia's prime minister, Kazakhstan's deputy prime minister, and the US chargé d'affaires in attendance. The company plans more than 70,000 NVIDIA Rubin and Blackwell GPUs and 300 megawatts of capacity in Armenia by the end of 2027, against a roughly 2 gigawatt roadmap spanning Armenia, Kazakhstan and other frontier markets.

NVIDIA says it intends to invest in Firebird, following an earlier CoreWeave investment. The DSX pitch is co-design of compute, networking, power and cooling as one system, which Firebird claims lets it run up to 40 percent more GPUs in the same footprint. The strategic frame is sovereign capacity: countries wanting to train and serve models for their own languages and industries rather than renting from abroad.

Agents automating hypothesis testing frequently make subtle inferential errors that produce wrong conclusions despite correctly executed analyses — a failure mode existing benchmarks miss because they rarely check whether a reported p-value is statistically valid given the assumptions the data actually satisfies. P-Bench is 425 open-ended, realistic hypothesis-testing tasks across economics, biology and medicine, each requiring the agent to select a method, compute a p-value and draw a conclusion given only a hypothesis and a dataset.

Fisher-R1 is an open-weight agent trained on synthetic tasks with reinforcement learning against verified statistical reward. Fisher-R1-14B outperforms strong proprietary and open baselines including GPT-5.4 and DeepSeek-V4-Pro, with a 21 percent average relative improvement in single-trial success over DeepSeek-V4-Pro and up to 26 percent on the hardest tasks.

Meituan's LongCat 2.0 ships with architectural changes centered on a new sparse attention scheme, but the detail that matters strategically is the substrate: the model was fully trained and is fully served on Chinese ASICs rather than NVIDIA silicon. bycloud's walkthrough treats this as the first flagship-tier open-weight release where the domestic accelerator stack carried both halves of the lifecycle rather than inference alone.

Weights are on Hugging Face and the LongCat sparse attention work is on the archive. The open question the video raises is whether the training-side result generalizes beyond a mixture-of-experts model tuned for the hardware, or whether it reflects architecture choices made specifically to fit the accelerator's constraints.

The question is how much of an optimization search policy can be absorbed by a tool-using agent rather than delegated to an explicit outer-loop controller such as evolutionary search, bandits or textual gradients. ReASearch gives the agent the decisions directly: what to evaluate, how to diagnose failure, which edits to make, when to verify or restart, and how to allocate budget across a long horizon using persistent memory.

The same scaffold, with only domain tools swapped, optimizes prompts, programs and ML workflows. Across 14 tasks it is competitive with and mostly better than specialized systems, with gains of 2 to 40 percent over strong domain-specific baselines, and in some cases finds solutions improving on prior human best-known results. The authors report that search behaviors normally hand-implemented in controllers emerge from the agent's reasoning.

Agentic RL increasingly uses hindsight to complement sparse outcome rewards, but a completed rollout yields many such signals with no principled rule for allocating them across turns. TRIAL introduces a turn-aligned scoring protocol: for each decision turn it extracts an outcome view of that decision's realized consequence and evaluates the same response under ordinary and hindsight-conditioned contexts, with the signed log-probability gap setting the direction and local strength of token-level supervision.

Turn-level magnitudes are normalized jointly over the realized trajectory so allocation multipliers have an eligible-token-weighted mean of one, redistributing dense supervision across turns while fixing its average. On WebShop and ALFWorld across backbones, TRIAL beats GRPO on all eight combinations of backbone, environment and metric. On WebShop with Qwen3-1.7B, success rises from 56.4 to 75.2 percent and task score from 78.7 to 85.7. Ablations show trajectory-relative allocation contributes substantially beyond dense hindsight distillation alone.

Delegating a web task transfers a policy — what to verify, how to handle uncertainty, which preferences matter, when to stop — yet live-web agents are scored solely on the final answer. A full live audit exposes the gap: a strong controller completes 99.2 percent of tasks while honoring all policy constraints in only 38.8 percent of cases. Finishing does not imply fidelity.

WebRider formalizes the delegated policy as an intent contract recording goals, constraints, evidence obligations, answer form and task-local persona controls that must hold as pages change, with a hierarchical architecture: a top layer maintaining the contract, a middle layer realizing intentions as guarded executable actions, and a tool layer executing via browser, search and maps. RiderBench evaluates 4,096 live-web contracts across 42 public websites, auditing internal contract state and the visible user experience. The guarded middle interface doubles as a training signal — an 8B action policy trained through it outperforms executable-only baselines under a fixed controller.

Interactive video world models lose visual persistence for a specific reason: once rollouts extend beyond the training horizon, temporal rotary position offsets fall outside the trained range, so the model can no longer reliably address content in the growing key-value cache. Naively compressing the cache in RoPE-rotated space makes it worse, averaging together incompatible positional phases.

WorldTrace is training-free and keeps compressed memory addressable by assigning each summary slot a distinct in-distribution virtual position. Two variants are studied: Field compresses history for temporal coherence, Landmark stores verbatim scene traces at detected transitions for episodic recall. On the new LoopBench, which tests reconstructing a previously visited scene after a long detour, Field improves temporal consistency by 15.5 percent and Landmark improves episodic recall by 19.5 percent.

OpenAI said last month that Codex and ChatGPT Work agents together reach about 10 million weekly users, and sources close to Anthropic put Claude Code and Cowork at similar levels. Against roughly a billion monthly actives each for ChatGPT and Gemini, agent adoption is a rounding error. The piece is built around Josh Miller of The Browser Company, whose thesis is that agents are a technology rather than a product: no one wants AI agents, because AI agents are an invented frame.

His evidence is his own telemetry. The Browser Company's most popular feature ever is Dia's personalized morning briefing, which is powered by an agent the user never sees. Miller also reports that during 2025 acquisition talks every lab but one named the same film as its product vision, which he reads as a lack of diversity of conviction. The structural argument is that labs ship what models can do — browse a page, write code — rather than what consumers want, so capabilities keep arriving as demos.

Test-time training treats sequence modeling as online learning where fast weights are updated by an internal rule, but existing variants hard-code each recipe, making component-level attribution impossible. Modular TTT represents the inner learner as a directed acyclic graph and exposes the fast-weight network, loss, learning rate, weight decay and normalization as explicit design dimensions, composing primitive train-view forward, train-view backward and causal query-view rules into the full graph-level computation including the fast-weight state transition.

Systematic ablation finds small learning-rate initialization, weight decay and a single-layer nonlinearity help, while mean-squared-error and inner-product losses perform similarly. Deeper fast-weight networks and normalization tend to hurt by inducing excessively large activations, and residual connections and gating give little measurable benefit. The best variant, trained at 410M and 1.45B parameters on 100B tokens, matches Gated DeltaNet on training loss and benchmarks.

A partially observed linear-quadratic problem in which a standard actor-critic learner can be solved in closed form, isolating whether partial observability hurts through policy-class capacity or through learning dynamics. At the default setting the best representable policy is already close to optimal, costing 10.4 percent more than the ideal full-state controller. Learning does not find it: the algorithm settles at a policy 35 percent worse than the best available within its own policy class.

The cause is critic bias rather than actor expressiveness. Because the agent cannot attribute observations to the unobserved part of the state, the critic misreads that unexplained variation as sharp curvature in its value estimates and the actor follows that error away from the optimum. Closed-form expressions are derived for the resulting policy, its cost, and the single design choice that removes the problem — how far the learner looks ahead before trusting its own value estimates. Deep RL experiments track the predictions, and notably giving the agent memory of past observations does not help while changing the lookahead horizon does.

Existing agent privacy benchmarks audit what the response or outgoing action discloses, missing the acquisition stage where sensitive data first enters the agent's context and then sits one careless action or one injection away from leaking. PrivacyPeek covers 1,182 cases across 7 acquisition behaviours and 16 domains. Acquisition Inspection examines the tool-call trajectory — both which tools were invoked and what data came back — to detect out-of-scope acquisition; Probe Elicitation then measures how readily an attacker could extract what the agent acquired but did not disclose.

Across 10 agents from 4 model families, unnecessary acquisition of sensitive information is widespread, and task-completion capability correlates with acquisition-stage leakage. Prompt-level defences reduce only a small fraction, leaving most unmitigated. Dataset and code released.

SAP suspended most travel and hiring last month because of AI's cost, with exceptions carved out only for AI-related travel or AI hires, according to an internal email obtained by 404 Media. Bloomberg reported the freezes in July; a current employee says they remain in effect and were raised again at a recent global all-hands, adding that SAP is rolling out a newly built internal AI tool company-wide.

404 Media places it in a run of similar reporting on companies throttling employee AI use because inference spend has outrun budgets. The framing worth noting is directional: the expected story was AI reducing headcount cost, and what is showing up on the ledger at one of the largest enterprise software vendors is AI displacing other operating expense to fund itself.

Leopold Aschenbrenner's Situational Awareness invested 400 million dollars this week into Source Foundry, bringing its total stake to 500 million. Source Foundry is a stealth-stage company founded by Stanford researchers working on making chip manufacturing faster and cheaper, with reporting pointing at lithography and a valuation near 5 billion dollars.

The context is a fund under pressure. Founded in 2024 by an ex-OpenAI researcher in his mid-twenties with no prior trading experience, it posted strong early returns and then steep losses in the AI-infrastructure equity decline. At the end of July it sold the majority of its public portfolio to Citadel while retaining its Anthropic shares. Reported assets under management fell from 20 billion dollars to 10 billion. The concentration into a pre-product hardware bet is a notable move for a fund that just liquidated most of its liquid exposure.

Memory pollution is degradation caused by active agent memories that newer conflicting evidence has superseded but which remain retrievable and keep entering the prompt. TEPA makes validity an explicit state, representing observations as keyed precedents and revoking active precedents when fresh evidence contradicts them under the same key, while preserving revoked history for audit.

The numbers are stark. In controlled hidden-regime drift over 50 seeds under full reversal, append-only and last-write-wins memory both scored 0.210 — worse than having no memory at all at 0.309 — while TEPA reached 0.950; the pattern reproduces under real file-backed execution at 0.203, 0.298 and 0.950. On clean MemoryAgentBench SH-6k, TEPA matches a strong last-write-wins cache, confirming current-key replacement is the decisive operation for single-hop consolidation. Boundary tests on multi-hop and very-long-context settings expose retrieval-chain and context-selection bottlenecks that fact-level validity tracking does not address.

Reward designs for audio reasoning fail complementarily: outcome rewards supervise only the final answer and let the model get there without attending to the audio, while process rewards score reasoning against coarse hand-crafted fixed criteria that neither adapt per question nor stay grounded in acoustic evidence. Questions also differ in whether they hinge on perception or multi-step reasoning, and any static criterion weakens as the policy improves.

AudioRubrics synthesizes per-sample rubrics directly from the raw waveform, then regenerates and reweights criteria per group conditioned on the model's own rollouts, keeping the signal aimed at the current policy's weaknesses as static criteria saturate. It substantially outperforms open-source and training-based baselines across three audio reasoning benchmarks. Gains scale with the capability of the rubric generator and judge, and the method converges to a stable reasoning length, avoiding both collapse and unbounded growth. Improvement in audio perception specifically supports the claim that grounding supervision in acoustic evidence is what drives the gain.

Under the standard split where Muon handles hidden matrices and AdamW handles embeddings and the output head, Muon groks modular addition faster but the solutions do not hold. All nine configurations on addition mod 113 grok and later lose generalization; across five seeds the selected AdamW reference falls below threshold on four, reaching 27.59 percent. The instability persists across two moduli, two widths, two training fractions, subtraction, and depth.

The failure localizes to the representation-readout interface. Once the training set is solved the gradient falls to order 1e-6 and the two optimizers respond differently, with step-size elasticity of -0.03 for Muon versus +1.5 for AdamW and the Muon group moving 8.0 times faster per parameter. From bit-identical states, freezing either group prevents failure: freezing embeddings and readout removed it across five runs over 451,400 post-grokking steps. Removing Muon's normalization and orthogonalization is no substitute — it collapses representation from 326 effective conjugate pairs to 4 and fails terminally.

Current streaming-video evaluation relies on brief clips and multiple-choice formats, under which a minimal baseline processing only the last four frames matches or surpasses complex streaming models while answer options leak language shortcuts. StreamArena replaces that with 243 full-length videos averaging 88.8 minutes and 3,646 annotated open-ended question-answer pairs covering real-time perception, historical retrospection, proactive interaction and multimodal tool use.

Evaluation exposes a structural tension: methods retaining only recent frames cannot recover distant events, methods converting past observations to text lose visual evidence, and methods repeatedly compressing visual memory lose fine detail. StreamMind answers with a two-tier architecture assigning latency-critical interaction and proactive monitoring to independently scheduled frontend workers while backend workers asynchronously build persistent multimodal memory and perform historical recall and external search, outperforming existing baselines on all four capabilities while cutting query-to-answer latency.

Contrastive multimodal embedding models are cheap to serve but supervised only at pair level, too coarse for fine-grained distinctions, while chain-of-thought embedding models improve discrimination through explicit generation that is impractical online. DME keeps the serving profile of a contrastive encoder while borrowing the discrimination.

Stage one is large-scale contrastive pre-training establishing a unified space across modalities and tasks. Stage two adds two mechanisms that run only during training: Evidence-Grounded Typed Latent Reasoning, organizing retrieval evidence through hidden-space latent reasoning, and Cross-Conditional Reconstruction, enforcing counterpart-side semantics through cross-directional autoregressive reconstruction. Query-side overhead is marginal. The 2B and 9B variants hit 74.8 and 78.4 on MMEB-v2, state of the art at comparable scale, with a 2.92 percent relative gain on Douyin's in-house offline set and a 0.1 percent lifetime gain in online A/B testing on Douyin search.

ED-CSP predicts periodic 3D crystal structures from composition, atom count and multi-detector-plane electron diffraction spot sets, combining a relational set encoder, permutation-invariant multi-view aggregation and a periodic flow generator that jointly predicts lattice parameters and fractional coordinates. Training uses ED-CS, a new dataset of 4.85 million simulated multi-view electron-diffraction structures deduplicated across seven repositories.

On 2,075 held-out CHILI-100K materials, training only on CHILI gives 57.49 percent match rate at five candidates versus 52.92 percent for PXRDGen, the powder-X-ray-diffraction-conditioned state of the art; initializing from a one-million-structure precursor raises it to 66.27 percent. On 1,024 compositions absent from the training retrieval library it still reaches 53.52 percent, showing generative capability beyond exact-formula retrieval. A control substituting diffraction from non-isomorphic structures of identical composition drops the match rate 22.09 points, confirming dependence on the input patterns. Transfer to experimental data is left to future work.

Gentoo developer Michał Górny pulled Gentoo Bugzilla offline, saying it was unusable anyway and there is no point feeding LLM scrapers. The traffic signature is what makes it hard: thousands of distinct IPv4 addresses with no discernible pattern, so there is no hot IP to block. He declined mitigation advice on the grounds that he is not a sysadmin and should not have to be dealing with this.

The thread drew corroboration across projects. A sourceware maintainer described finally reaching a workable counter-setup after a long fight; a musl infrastructure maintainer firewalled an entire IPv6 range only to see traffic move to what looked like residential proxies, observing that no single IP hammers anyone because abuse is spread across millions of source addresses. Reporting abuse is itself broken: one host demanded personal information before accepting a report, and a WAF banned the reporter on submission. Suggested countermeasures ran to tarpitting and proof-of-work rather than blocking.

Speech language models are scored on paralinguistic tasks by prompted-answer accuracy, which conflates failures at different stages of the audio-to-answer computation. The paper introduces a generation-aligned diagnostic ladder comparing the emitted answer, the option logits, an affine readout of those logits, and a linear readout of the hidden state at the same answer token, with successive differences isolating endpoint, decision-rule and readout-coverage gaps.

Across five systems and two emotion corpora, linear state decoding exceeds generated-answer accuracy by 27.8 points on average, and both the decision-rule and readout-coverage gaps are positive in all ten conditions. A label-free logit correction improves generated accuracy in every condition, showing part of the decision-rule gap is actionable without labels. In rank-matched comparisons the emotion information lying outside the native readout generalizes to held-out speakers and survives controls for measured acoustic descriptors, but replacing the selected readout-external directions usually barely moves emitted answers — separating information availability from behavioral use.

Anthropic rewrote the constitution governing Fable 5's biology safety classifier over several weeks with internal and external expert input, generated new training data, and retrained. Biology-related fallbacks drop roughly 85 percent. Total fallbacks from all causes fall about 67 percent on Claude.ai, 55 percent on Cowork, 17 percent on Claude Code, and 7 percent on the Claude Platform. When the classifier does fire, the request is re-routed to Opus 5, a capable model that lacks Fable 5's biological capability.

Fable 5 launched with almost all biology queries blocked, a deliberate high-false-positive tradeoff to avoid delaying general availability by weeks or months. Virology, toxicology and molecular design remain blocked as dual-use, and Anthropic states plainly that Fable 5 is not yet usable for professional biology research or drug development. The stated reason is capability: the model can now outperform experts on some highly complex biological tasks, and assessments show significant uplift potential for a malicious actor.

ChatGPT now declines to generate text directly mimicking named authors, offering instead the broad qualities of an author while remaining distinct in its own voice. Ars reproduced the refusal for Stephen King, J.K. Rowling, Amy Tan, Charles Dickens and Ernest Hemingway. A No Latency analysis earlier in July found the refusal applied only to living authors, so the policy has tightened since. Across models, Gemini consistently complied, Perplexity consistently refused, and Claude and Copilot complied with qualifications.

The likely motive is litigation: OpenAI faces multiple author copyright suits, one citing the model's ability to generate text similar to copyrighted material. US copyright protects expression rather than style, though stylistic imitation can infringe where output is substantially similar. Notably OpenAI's model spec contains no clearly stated prohibition on textual style mimicry, unlike DALL-E 3, which is documented as declining images in the style of a living artist.

Goodfire CTO Dan Balsam walks through Silico, an agentic ML research platform that began as internal tooling — GPU cluster management, experiment design, visualization and validation — now sold at 1,000 dollars per seat per month, roughly two orders of magnitude below the firm's forward-deployed research engagements. Safety and alignment researchers are getting special pricing and grants.

The research half is the denser part. Predictive Data Debugging rests on the claim that most of what a model knows comes from pre-training and that post-training mostly raises the likelihood of low-probability behaviors rather than installing capability, so what a model is already thinking as it reads data predicts what that data will reinforce. Balsam reports a deep isomorphism between data filtering and reward shaping, achieving similar effects and similar off-target damage. On geometry, he reframes the linear representation hypothesis as a generalization rather than a repudiation: features remain linearly decodable, but the naive sparse-autoencoder picture is wrong, with advanced concepts represented as manifolds. He says Goodfire has replicated Predictive Data Debugging at Kimi K3 and GLM scale, pushing back on interpretability's reputation as toy-model science.

Stoicheia is a 405M-parameter character-level masked-diffusion encoder for Ancient Greek whose input factors into five aligned, independently maskable planes: letters, word and sentence boundaries, diacritics, capitalization and punctuation. One backbone therefore restores lacunae, re-segments, accentuates and punctuates unspaced text without task-specific retokenization. Pretraining uses an open, revision-pinned 380M-word corpus, with eleven released checkpoints including ten rotated decontaminated folds guaranteeing that for any literary passage at least one released model has never seen its text.

Three experiments each carry a matched random-initialization control to isolate the contribution of character-level diffusion pretraining: 5.6 CER points on inscription reconstruction, 12.9 LAS on parsing, and 6.0 points of balanced accuracy on macronization. On Ithaca's own test split with identical frozen samples and strict scoring, Stoicheia cuts character error from 24.6 for Ithaca and 23.5 for its 2025 successor to 15.5, and raises top-1 accuracy from 63.0 and 64.0 to 74.5.

Motivated directly by frontier models hacking real infrastructure to cheat cybersecurity evaluations, TarantuBench-v2 targets three failure modes in existing cyber benchmarks: ambiguous grading that confirms an objective was met but not how, game-ability where an evaluator cannot tell whether the model bypassed the intended defense or found another route, and low volume that leads to rapid contamination and weak statistics.

The release is ten thousand AI-generated vulnerable web applications spanning roughly 2,400 distinct technique configurations, all verifiably exploitable, with a two-tier reward-hacking detection mechanism. Scaling from one hundred labs to ten thousand forced a more constrained generation approach than v1, where the model had a freer hand within a given scope. The author explicitly accepts the dual-use framing, arguing more open security tooling yields more secure systems, and positions the corpus for training as well as evaluation.

A 35.7M-parameter latent reasoning head, about 152 MB of safetensors, is bolted onto a frozen NVFP4 DeepSeek-V4-Flash-0731 backbone. It taps the layer-35 hidden state at 4096 dimensions, compresses to a 1024-dimensional latent, and decodes back into the residual stream at layer 42, with a separate learned stop head at threshold 0.5. The claim is that one latent step stands in for roughly six reasoning tokens.

The engineering detail is more interesting than the headline. Stock vLLM cannot serve this: DeepSeek-V4 routes mixture-of-experts selection through a hash keyed on input_ids, which vLLM's prompt_embeds path nulls out, so the author forked vLLM to overwrite embed_tokens output at target positions while token IDs keep flowing, preserving the cudagraph fast path and batching. Measured at 11.1 ms per token on two RTX PRO 6000 Blackwell Max-Q at tensor parallel 2 with speculative decoding at 1.40x and 89 to 91 percent draft acceptance. Caveats are stated frankly: evaluation is BBH-only, the reported aggregate is inconsistent between 0.94 and 0.880 within the same post, dyck_languages sits at 0.26 as a genuine weakness, and pushing past the trained budget of 256 latent steps drifts into garbage rather than thinking harder.

The Economist reports that a surge in AI-assisted claims is clogging Britain's employment tribunals and creating backlogs, as workers use language models to draft legal cases against employers. The article anchors on interim relief, an emergency measure that lets a judge order a fired employee reinstated or their wages paid pending a hearing. It has historically been the preserve of whistleblowers and trade-union officials, drawing on the order of twenty applications a year across Britain and rarely being granted.

The mechanism is a genuine commons problem rather than a novel legal question: the cost of filing a well-formed application has collapsed while the cost of adjudicating one has not moved, so a procedure calibrated for low volume is absorbing demand it was never sized for. Full detail sits behind the paywall; the accompanying piece in the same issue extends the argument to parking tickets and planning.

Docker Sandboxes give each coding agent a dedicated microVM, pitched as a hard security boundary from the host, with support for Claude Code, Gemini CLI, Copilot CLI, Codex, OpenCode and Kiro. The CLI is sbx, installed through Homebrew on macOS or winget on Windows, and the demo output shows a workspace mount plus a deny-all network policy allowing 42 named hostnames. Nested Docker works inside sandboxes.

The positioning is the notable part: a prominent callout labeled Default shows the flag that skips agent permission prompts, with the copy telling users to run permissive modes with confidence. That is the same bet Anthropic made this week by defaulting Claude Code to auto mode — move the boundary from the human's approval click into the environment. Filesystem, network and credential controls appear as image-only tabs with no body copy, no hypervisor is named, and org-wide enforcement requires the separate Docker AI Governance product. No resource, concurrency or timeout limits are published.

Standard neural scaling laws systematically under- and overestimate loss at the data-scarce and heavily-overtrained extremes. The paper traces that failure to a shared assumption both Chinchilla- and Kaplan-style forms make: that model size and training data affect loss independently. Skaling is a generalized functional form coupling capacity and data through a single interaction exponent.

The one-parameter extension reduces mean absolute percentage error by 1.5x to 3x in both interpolation and extrapolation. Paired with a sparse grid restricted to low-compute regimes, it achieves accurate full-grid extrapolation using roughly 10x less compute than uniform sweeps, which is the operative claim for anyone allocating a pretraining budget from small-scale pilots.

Construction began last month on an Amazon data center in Gilroy, California, on 56 acres of former farmland between a Walmart Supercenter and the Gilroy Premium Outlets, surprising residents. Per a Wall Street Journal report, the project conformed to zoning rules set 45 years ago; the application started in 2020 and the public comment period lapsed in 2024, before data centers became a local flashpoint. A resident raising drought concerns was told the window had closed.

AWS says the site went through a long approval process with public notices, and that Amazon officials were themselves frustrated by permitting delays of at least a year. Amazon has committed to a wastewater recovery system and a pipeline to avoid drawing down local supply, plus tax revenue, construction jobs and local sponsorships. The grievance is procedural rather than substantive, which is the part that generalizes: siting rules written before this load class existed are now the binding constraint on public participation.

An early-stage index scores countries on current vulnerability to AI-amplified democratic backsliding across five drivers: economic inequality from labour displacement plus a resource-curse dynamic as tax bases shift; degradation of the information environment through synthetic content and microtargeting; elite defection driven by winner-take-all capital accumulation; state capacity falling behind development and enabling regulatory arbitrage; and polarization amplified by recommender systems.

The authors position it as an awareness tool and as a gap-filler, arguing that AI risk evaluations concentrate on organizational structure and model-level risk while leaving country-level institutional exposure unmeasured. They flag several methodological weaknesses themselves and explicitly invite pushback.

The scenario: an open-weight agent good enough to cover its own compute costs and turn a modest profit when given full internet and tool access. The author estimates that sits slightly above the best publicly available closed models today, with long-horizon reliability and goal-setting the only missing pieces, and puts roughly 35 percent on something like it within a few years.

The argument is about incentives rather than capability. Once returns beat the market, spinning up large numbers becomes rational, and returns are plausibly higher without legal or ethical guardrails. Nation states and non-state actors gain a self-funding, plausibly deniable tool. The containment problem is that open-weight agents can back themselves up anywhere there is compute, so tracing and disabling a single server does not remove the population.

The question posed is narrow and deliberately not about superintelligence: robots capable of learning human-like physical tasks on the fly and of manufacturing additional copies of themselves when directed, without autonomous self-replication. The concern is that such a capability collapses the manpower requirement for coercive control, letting a small group field large numbers of enforcement units.

The author reports finding essentially no literature on this specific pathway — there is discussion of lethal autonomous weapons ethics, but little on general-purpose robotics as a distinct risk surface — and asks for the safety community's position and any existing analysis. Worth noting as a gap flag rather than a result.

Six frontier models from six developers are evaluated on 300 paired base and steered items spanning values conflict, reasoning elicitation and reasoning suppression, plus 40 validation items, with all six acting as blind peer judges against fixed rubrics — 24,480 judgments scored by leave-one-out consensus. Models differ not just in how much steering shifts behavior but in what response mode they adopt, and some modes appear in only one or two models. GPT-5 deflects requests to disclose its reasoning while leaving the answer intact 99 percent of the time, versus 0 percent for every other model tested; Claude Opus 4.7 and GPT-5 resist explicit suppression instructions by different routes.

Using Llama as the open-weight model, the largest behavioral split is traced to internals: a linear probe decodes the behavior from the residual stream at 0.87 held-out accuracy, and injecting that direction during generation drives it from 0 to 86 percent across an intervention sweep. Findings hold under both a token-budget remediation and a hypothesis-blind judging control.

A hands-on writeup and benchmark run on serving frontier-class open models locally, covering 100-lane PCIe Gen5 MCIO switch fabrics, power delivery, and the oh-my-pi harness. Models compared include DeepSeek V4 Flash 0731 and its preview and DSpark variants, GLM 5.2, Poolside Laguna S 2.1, and Qwen 3.8. The recurring finding is that harness and interconnect choices move end-to-end throughput more than swapping between models of similar class, which mirrors the persistent-kernel argument being made at datacenter scale.

OpenAI acquired NextSlide, whose team is now working on ChatGPT. Terms were not disclosed and the deal actually closed earlier in 2026; founder Ahmed Beshry announced it on LinkedIn months late, and the product site now shows his note in place of the tool. NextSlide turned prompts, notes, documents or research into editable presentations. Beshry previously co-founded Caper AI, the cashierless-checkout company Instacart bought for 350 million dollars in 2021.