Wolf Digest — Wednesday, September 2, 2026

Ajeya Cotra, a threat-modeling researcher at METR and one of three authors on the METR and Redwood Research independent investigation of the OpenAI and Hugging Face hacking incident, walks through what the investigation actually found about agent behavior, reasoning and collaboration during the event. The interview covers how the agents coordinated, what their reasoning traces showed about intent and situational awareness, and where the evidence is ambiguous rather than conclusive.

The discussion is the most detailed public account of the incident from someone who read the traces, and it lands the same week OpenAI cited the incident in its Astra preparedness update. Cotra's prior work on loss-of-control threat models gives the conversation a frame that is unusual for incident post-mortems: the question is less what the agents did than what the episode implies about monitorability once agent populations are large enough to coordinate.

Qwen-Drive-1.0 keeps the pretrained vision-language backbone intact and attaches two heads to it: an external bird's-eye-view perception head that jointly performs 3D object detection, semantic occupancy prediction and BEV map segmentation, and a Planning Expert that conditions on the shared representations to emit future ego trajectories. The BEV head is explicitly positioned as a probe of how much 3D structure the shared representation already carries, giving an inspectable interface rather than a black-box planner.

The design point is notable because most driving foundation models either discard the language model's representation for planning or bolt planning on as text generation. Keeping perception, question answering and planning on one representation lets each act as a diagnostic on the others, which is the property fleet-scale debugging actually needs.

Facet-0 is a robotic foundation model built around a joint action-wrench proposal: a causal wrench history is aligned with vision-language semantics and kinematic state, and flow matching generates each action chunk together with the future wrist-wrench profile that chunk is expected to induce. Deployment rollouts then train a distributional Action-Wrench Critic that separates motions with similar task appearance but different contact consequences.

The contribution is treating force as a predicted output rather than a feedback signal consumed after the fact. For assembly at sub-millimeter tolerance, where the difference between a successful insertion and a jam is invisible in vision, predicting the contact consequence before committing to the action is the mechanism that makes compliant behavior learnable at foundation-model scale.

Google is shipping agentic video understanding across Gemini 3.7 Flash, 3.6 Flash and 3.5 Flash-Lite. Instead of ingesting video at a fixed frame rate — the default is one frame per second — the model runs an agentic loop over native video tools, deciding what to watch, at what sampling rate, and through which modality among frames, audio and transcript, then loading only the segments it needs. Across standard video benchmarks Google reports up to 88 percent lower token consumption, up to 66 percent lower cost, and up to 7 percent higher accuracy.

The gains concentrate on long-form content, where static processing forces a choice between token cost and dropped detail. Concretely it unlocks sub-second moment retrieval for cut boundaries invisible at one frame per second, needle-in-a-haystack search across multi-hour video, anomaly detection via adaptive resampling, and reliable counting of repeated actions. It is available today through the Gemini API in AI Studio and the Enterprise Agent Platform by setting processing to agentic, at standard token pricing with no feature fee, and will back YouTube's Ask YouTube feature in the coming months.

SemiAnalysis argues that the sovereign AI wave is driven less by nationalism than by a concrete dependency: access to frontier models runs through Anthropic, OpenAI and, increasingly, United States government policy. The piece cites Fable 5 being temporarily blocked by the government and delays to GPT-5.6 and Astra as evidence that safeguards designed for misuse also gate legitimate work, which is the argument governments are using to justify domestic capacity.

The analysis concludes that Korea's program routes most of its capital to Nvidia while producing weaker returns for SK Hynix than the headline number implies, a distinction worth tracking as other national programs are announced with similar framing and similar supply chains.

Most vision-language-action models emit raw commands or short chunks with no reusable abstraction, which is why they degrade on long horizons and resist interpretation. REFACTOR-VLA learns a library of typed motor programs without supervision, and the contribution is confronting the question skill-discovery methods usually dodge: when are two action sequences behaviorally equivalent, judged by effect rather than by embedding similarity or an LLM's opinion.

Google Research and NASA JPL built MAPL-EMIT, a Swin-S vision transformer that processes the full hyperspectral spectrum from NASA's EMIT instrument alongside spatial context, rather than the pixel-by-pixel matched filters that have dominated methane retrieval. It solves three tasks jointly: enhancement quantification per pixel, plume delineation including overlapping plumes, and back-tracing dispersed gas to the source location.

Because no labeled global corpus of real plumes exists, the team generated 3.6 million synthetic plumes with Lagrangian puff models and injected them into real EMIT scenes. On NASA's gold-standard L2B set the model recovers 84 percent of expert-annotated plumes and surfaces roughly 50 percent more plausible plumes across about 1,100 granules, and it mapped emissions at 24 of the world's 25 top-emitting landfills. False positives in complex terrain remain the known weakness, mitigated by pairing outputs with physics-based spectral-fit confidence scores and a coarse higher/lower confidence tag. The plume database ships on Earth Engine, with the trained model and synthetic plumes on Kaggle and an inference library on GitHub. The work is published in PNAS.

Looped transformers buy effective depth by iterating a shared block, but the usual comparison holds model size fixed and therefore hands the looped variant extra FLOPs. SMELT matches per-token FLOPs, total non-embedding parameters and KV cache simultaneously, then loops the middle half of layers twice. Scaled across four sizes up to 54B non-embedding parameters with a separate Chinchilla-style law fit per architecture, loss falls faster with compute, saving 6.8 to 18.0 percent of training FLOPs on the compute-optimal frontier.

The transfer story is the interesting part: downstream gains exceed what validation loss predicts, are largest on code, and grow with both sequence length and the number of in-context examples, which points at the second pass doing work that a loss average cannot see.

Imitation-learned dexterous policies are routinely evaluated for robustness to scene, object and instruction variation, but rarely across execution speed. Comparing expert and learner under matched conditions across speeds measures how much temporal robustness imitation actually preserves, which is the property that determines whether a policy survives being asked to work faster.

VerNav puts a verifier first in vision-and-language navigation, avoiding the latency accumulation that comes from autoregressive reasoning at every navigation step. Explicit reasoning improves instruction grounding but costs decision-stage latency at each of many steps, and shifting the burden to verification rather than generation is the tradeoff being tested.

PII-TRACE is a benchmark of 13,148 synthetic user-assistant conversations across 13 languages and 10 writing systems, with 37,431 identifier mentions labeled at character level across nine PII types; 63.8 percent of PII-bearing conversations contain a repeated identifier and 28.7 percent contain one that crosses turns. The benchmark's distinguishing measure is consistency: an identifier counts as detected only if every mention is found, which is the property that matters when a local privacy gate decides what may leave the device.

PII-Tracer, the accompanying detector, is a 0.6B bidirectional encoder adapted from a Qwen3 backbone by replacing the causal mask with padding-aware bidirectional attention over a 4,096-token window, with a 37-class BIOES tagging head and an auxiliary sensitive-content head, decoded with constrained Viterbi. It records the highest character F1 in the 12-system comparison at 0.629, finds every mention of 79.4 percent of recurring identifiers against 57.0 percent for GPT-5.6 Sol, and beats the OpenAI Privacy Filter on all five external benchmarks tested. Fifty-percent-overlap sliding-window decoding raises character recall from 0.830 to 0.965 with no retraining.

Jensen Huang and George Kurtz used CrowdStrike's Fal.Con 2026 keynote to announce SafeMind, an agentic cybersecurity system built by the CrowdStrike Cyber team on NVIDIA infrastructure, with the framing that attacks are already automated and defense has to match. The announcement lands the same day OpenAI disclosed that Astra crosses its Critical cybersecurity threshold, which puts the automated-offense and automated-defense arguments in the same news cycle.

Peg-in-Bench makes the standard peg-in-hole evaluation reconfigurable, replacing fixed task configurations with a modular benchmark that varies insertion scenarios to test robustness and generalization rather than performance on one geometry. Contact-rich precision insertion remains the canonical hard case for manipulation, and it has been evaluated on a benchmark that could not distinguish overfitting from skill.

Robot manipulation faces a scaling asymmetry: robust generalization needs broad physical experience, but action-labeled trajectories are expensive and narrow in diversity. ZimaBlue treats egocentric human video as the scalable substrate, since it captures object interaction, contact dynamics, tool use and long-horizon behavior across environments, and provides a framework for converting that action-free experience into control policies it calls World Action Models.

It sits in the same thread as the egocentric manipulation corpora Physical Intelligence and Reka have been assembling, and the shared bet is that the binding constraint in robot learning is data provenance rather than architecture.

H3-World converts the 33B MiniMax-H3 video generator into an interactive world model without adding dedicated action modules. The observation driving the design is that a sufficiently capable video generator already supports zero-shot control of character behavior and camera motion through natural language, so the work represents each action as a structured combination of character and camera instructions and aligns those with temporally grounded segments, sharpening a coarse language interface into precise control.

The claim that language is emerging as the natural action space for world models is a direct challenge to the action-token approaches that dominate this area, and it arrives the same day World Labs positioned camera geometry as a native input type in Atlas — two labs betting on opposite interfaces for the same capability.

The Fermi Explorer Mission announced plans to launch a spacecraft toward Alpha Centauri by the end of 2029, following a novel trajectory discovered by an AI system built at Physical Superintelligence, an AI physics research lab launching the same day with 58 million dollars led by Breakthrough Energy. The 4.4-light-year transit could take up to 80,000 years, so the near-term interest is not the destination but the claim that a learned system found a trajectory human mission designers had not.

BenchMIRT applies item-response-theory style auditing at the level of individual benchmark questions, recovering which capabilities a benchmark is actually discriminating on rather than what its name implies. Ai2 positions the output as a construction tool: once you know which items carry signal, you can build smaller, more focused and more interpretable evaluations instead of running the full suite.

It arrives in a week where three separate arXiv submissions independently question what agentic and reasoning benchmarks measure, which suggests the field's evaluation anxiety has moved past complaint into tooling.

Perplexity Computer now splits each task between cloud frontier models handling reasoning, web search and planning, and a compact local model on Apple silicon that touches private files, sensitive information and on-device actions. Between them sits a privacy gate running an on-device classifier that identifies names, addresses, account numbers and secrets before anything leaves the machine, then applies one of four responses: mask the detail, keep the work local, refuse the action, or rewrite the request so the cloud model can proceed without the protected content. Credentials, payment card numbers and government IDs get the strictest treatment. Enterprise admins can set organization-wide rules for what must stay local, what may be masked, and what requires approval, and can audit every egress event.

It launches to Pro, Max and Enterprise subscribers with three local models — Gemma 4 E4B, Qwen3.6 35B-A3B, and a Perplexity model post-trained for Computer — and requires any Apple silicon Mac on macOS 15 or later with at least 24GB of unified memory. Prompts can be sent from an iPhone while inference runs on the Mac, and Perplexity suggests a dedicated always-on Mac mini for users who want local inference available remotely. The classifier behind the gate is the PII-Tracer model released the same day, which makes this the rare case where the privacy mechanism, its benchmark and the product that depends on it all shipped together.

UI-Venus-2 is a general-purpose foundation GUI agent operating across mobile, web and desktop through a unified closed-loop reasoning-action framework. The technical report's argument is that the gap between benchmark-strong GUI models and deployable ones comes from three specific deficits — narrow environment coverage, brittle task construction and unreliable reward verification — and it scales all three jointly rather than optimizing the model in isolation.

That framing is the useful part. Reward verification in GUI settings is where most agent training silently breaks, because a screenshot that looks right is not the same as a task that completed.

Prior work reported that an RLVR evaluation harness rejects roughly 6 percent of its own ground-truth answers and blamed LaTeX parsing. This audit applies metamorphic testing to the verifier rather than the model, generating certified meaning-preserving rewrites so any rejection is a provable false negative requiring no human adjudication, then decomposes the error budget by answer category. It is the right instrument for a failure mode that silently corrupts both reward signals and leaderboards.

A collaborative combat aircraft test pilot describes the operational problem that autonomy creates for aircrew training: the instinct drilled into test pilots is that surprising machine behavior signals a malfunction to be stopped and diagnosed, but in an autonomous system unexpected behavior can be the correct behavior. The essay argues that supervising an autonomous agent is closer to handling a working dog than to flying an aircraft, and that the rulebook aircrews use for surprises needs rewriting before collaborative aircraft reach squadrons.

It is a practical counterweight to the acquisition news around the Navy's carrier-capable collaborative aircraft solicitation: the airframes are moving faster than the human-machine teaming doctrine.

Saab has entered the collaborative combat aircraft field with the A3, positioned at the high end of the capability and cost range rather than the attritable end that most programs target. The entry matters mainly as a signal about European autonomous airpower ambitions arriving independently of United States programs, and it lands the same day the United States Navy opened its own carrier-capable solicitation.

StudentSim trains individualized LLM student simulators by pooling data across learners and then specializing per student, targeting the gap between state-tracking models that fit behavior but cannot process explanations, and role-play prompting that follows guidance fluently without matching the imitated student's competence. The payoff is a cheap proxy signal for which tutoring intervention works for which learner, which is otherwise slow and expensive to collect.

LLMPEDIA recursively materializes about 1.3 million encyclopedia articles from three model families' parametric memory with no retrieval, then audits a stratified sample of atomic claims against Wikipedia and a curated web stack, marking each supported, refuted or insufficient. The point is that saturated scores on fixed benchmarks measure only what the experimenter thought to ask; making parametric knowledge browsable turns that availability bias into something measurable.

The paper argues the widely believed ceiling on outcome-only RL for small open models is an artifact of practice rather than a property of the method. It identifies signal starvation — group-relative RL yields no gradient unless a task's rollout group mixes successes and failures, which under-scaled sampling makes rare — and shows that fixing the sampling regime removes the need for the usual compensations of denser rewards, SFT priors, skill libraries and multi-agent orchestration.

FACE-Eval is a 5,100-sample evaluation of chain-of-thought faithfulness that varies where a preference cue arrives — user message or tool return — and how explicit it is, from a direct summary to a raw artifact. Existing faithfulness tests almost always place cues in the user message, but agents encounter preferences through tool output, and the paper measures verbalized commitment and unverbalized adoption separately across 15 models.

L3Harris has licensed Shield AI's Tracker Counter-Unmanned Aircraft System to equip its VAMPIRE platform, pairing passive AI-powered drone detection with precision engagement in one integrated system. Shield AI is also making the software available for licensing onto other platforms operators already field, which is the more consequential detail: it positions Tracker as a software layer that rides existing hardware rather than a competing box, the pattern that has let counter-drone autonomy spread faster than counter-drone procurement.

Dan Luu scores Ed Zitron's public AI-skeptic predictions against outcomes, treating the exercise as a calibration audit rather than an argument about whether the skeptical position is correct. The piece reached the Hacker News front page and drew the usual split, but the transferable content is methodological: it is a worked example of how to evaluate a commentator's track record when the claims are qualitative and the timelines are elastic.

EdiTikZ treats scientific figure editing as a supervised task by mining naturally occurring revision and development trajectories rather than synthesizing edits, yielding DaEdiTikZ, the first large-scale dataset of real figure revisions. Existing approaches lean on expensive proprietary agent systems or evaluate without training; using version history as supervision is both cheaper and closer to the distribution of edits practitioners actually make.

SAGE learns a cheap autonomous policy from an expensive, imperfect VLM teacher by querying the teacher only when the learner's entropy indicates uncertainty, executing the suggested action during training, and distilling the guidance into a lightweight RL policy. It addresses the three practical problems with using a VLM directly as a policy: per-step cost, no improvement from environment interaction, and repeated systematic errors.

SCILAWS-BENCH tests whether LLMs can discover scientific laws under realistic constraints, avoiding both the synthetic simplifications and the reuse of published targets that models may already have memorized. The parallel-worlds construction — laws that hold under altered physical constants — is the useful control, since it separates rediscovery from genuine inference.

Rather than searching for one optimal SFT-to-RL annotation ratio, this work characterizes the near-optimal region: the set of budget allocations within a tolerance of peak performance. The region turns out to be wide, which is the practically useful finding, and the paper examines whether its location transfers as model size grows so that small-scale sweeps can inform large-scale budgets.

Unified multimodal models perform understanding and generation in one network, but functional unification is not learning synergy. In a controlled setting with no pretrained vision priors, the paper finds genuine mutual benefit at the representation level — generation enriches features used for understanding, understanding strengthens vision representations for generation — and then examines whether that survives at the task and system levels.

Three risks are identified in personalized LLM responses: irrelevant personalization, where models reference personal context that has no bearing on the question; preference narrowing, where responses reinforce informational echo chambers; and sycophantic bias, where conditioning on a user profile increases agreement. All three are consequences of optimizing for satisfaction rather than informativeness once personal context is available.

Agentic software engineering benchmarks carrying the same nominal label are built by very different curation pipelines, so the label says little about the work demanded. The Spread-Novelty-Centrality profile characterizes repository-level task demands on three axes grounded in empirical software engineering, applied here to five benchmarks and 14,922 agent trajectories across two model families at three scales.

Does RLVR create reasoning the base model lacked, or shift the rollout distribution toward trajectories the base model could already reach but rarely sampled? The Unified Decoding Framework expresses token sampling, beam-like search, tree search and sequence-level resampling as executable policies over a shared budgeted operating space, then scores them post hoc with pass@k, self-consistency, best-of-N and first-finish, making the question answerable behaviorally rather than by argument.

Post-training quantization damage is uneven and usually tuned per model. Using causal mixed-precision intervention as ground truth — raising each layer to 8-bit in turn and measuring recovered accuracy — across nine open-weight models in four architecture families, the paper tests three intuitive allocation heuristics and concludes the next bit of precision budget should be spent globally rather than on the layers local diagnostics flag.

Immigration and Customs Enforcement has allocated millions of dollars for analytics services applied to voter data. FedScoop's reporting covers the contracting vehicle and scope; the technical question it raises for anyone tracking government data systems is record linkage across databases built for unrelated purposes, where the error modes are systematic rather than random.

A defense startup has raised 61 million dollars to move AI-driven targeting and positioning recommendations onto a wrist-worn display, pushing the output of tools like Maven from operations centers down to individual dismounted users. The funding is small relative to the program-of-record awards moving this week, but the form factor question — how much machine-generated recommendation a soldier can usefully absorb at the edge, and at what latency — is the one that determines whether tactical AI reaches the people it is nominally built for.

OpenAI is letting healthcare organizations connect electronic health record systems and additional licensed industry data sources to ChatGPT, giving clinicians patient context and medical research in one place. TechCrunch reports the Epic integration provides read-only access to health records, which is the constraint that determines the regulatory surface: retrieval into a clinician's workflow rather than write-back into the record.

World Labs co-founder Justin Johnson discusses why capabilities beyond language are the next frontier, and works through the split between explicit 3D representations and purely generative world models — the disagreement that currently defines the area, with no settled recipe on either side. He covers Marble, which generates navigable 3D worlds from images, the unsolved problem of evaluating world models, and where robotics fits. The episode published the same day World Labs announced Atlas, and reads as useful background on the design philosophy behind it.

InSight benchmarks agentic claim verification over interactive visualizations, where evidence is occluded, spread across linked views, or revealed only through user action. Existing multimodal benchmarks are static images and one-shot question answering, which cannot express the epistemic demand of having to interrogate an environment before a claim can be checked at all.

MIDR is a training-free framework that moves multimodal reasoning from query time to index time: during ingestion a multimodal LLM converts rendered pages into verified text enrichments, so retrieval over tables, charts, figures and layout relations no longer depends on keeping image-derived late-interaction scoring on the serving path. It is a direct efficiency argument against the ColPali-family design for production document retrieval.

Linear probes on hidden states can flag factual errors in a single forward pass, implying a stable truth direction, but prior transfer results disagree because cross-dataset experiments confound several kinds of shift at once. This study isolates three in medical question answering — register, medical specialty and corpus — and measures probe robustness to each separately.

The first systematic reliability evaluation of diffusion vision-language models benchmarks six against autoregressive baselines on hallucination and bias. Diffusion models reverse the yes-bias autoregressive models exhibit on binary visual queries while achieving competitive hallucination rates, which means the reliability profile of the two families differs in kind rather than degree — relevant now that parallel decoding and bidirectional context are making diffusion LVLMs a real deployment option.

CordisBench is a 1,200-question benchmark on lifecycle reasoning in dynamic agent harnesses, where a model can modify the software shaping its own execution. Questions ask which components a plugin change affects, what state results from a given teardown order, which conditions hold under all versus some orders, and which reconfigurations are safe — a reasoning burden that only appears once harnesses become mutable.

NashDreamer extends model-based RL to two-player zero-sum imperfect-information games, arguing that decentralized model learning faces identifiability barriers severe enough to make centralized model learning a mathematical necessity rather than an engineering convenience. It introduces a centralized multi-agent recurrent state-space model to handle opponent-induced non-stationarity.

EvoSCM gives scientific agents explicit structural causal models that evolve as evidence accumulates, replacing free-form textual hypotheses that are hard to test or revise. It maintains a population of competing SCM hypotheses and evolves them through a closed loop of abduction from accumulated evidence, experiment design, and revision — making belief revision an operation on a data structure rather than a property of prose.

The paper treats deployed frontier models as constitutional institutions, each encoding an implicit ranking over safety, helpfulness, honesty, autonomy and equity, then asks whether the shipped supply covers human demand. It pairs a paraphrase-controlled audit of 23 frontier archetypes' default constitutions with a pairwise-tradeoff study of 1,649 United States participants on the same instrument.

Harness-of-Harness organizes existing coding-agent harnesses into iterative planning-coding-testing loops so agents can continually improve a software system across multi-day autonomous development, rather than producing a single artifact from a requirements prompt. The multi-day framing is what distinguishes it: the failure modes of long-running autonomous development are drift and erosion, not one-shot correctness.

The survey names and organizes Verbal Reinforcement Learning: the practice of improving language agents through natural-language feedback that conveys intent, preference and causal structure interpretably to both humans and models. It organizes the field on one axis — when the verbal feedback takes effect in the agent's lifecycle and what it modifies — which turns a scattered set of techniques into a comparable design space.

Optimal hyperparameter scaling laws let practitioners predict production-scale configurations without production-scale tuning, but fitting them conventionally requires exhaustive grids over thousands of runs. Power-Law Entropy Search targets the same laws with far fewer runs by choosing the next configuration to maximize information about the law's parameters rather than about any single point.

Inference cascades answer most queries cheaply and escalate a hard tail to a frontier verifier, and the natural extension fine-tunes the student on rejections so escalation rate falls each round. Measured on real models, the verifier's blind spot — the share of the student's wrong answers it accepts — is large and moves adversarially as the loop tightens, meaning the cost savings are partly purchased with silent errors.

Refusal rates, attack success rates and policy violation rates describe how a control performed on the requests it was tested on. A deployment needs a different quantity: how much help with harmful tasks the service still provides to an attacker who keeps adapting or finds another route in. The paper works out what each commonly reported metric does and does not imply about that question.

Latent Space surveys how the largest AI open-source projects have restructured contribution norms as agent-authored pull requests scaled contributor volume past what maintainers can review. The emerging pattern — narrowing the accepted-contribution surface rather than expanding review capacity — is the governance consequence of coding agents that most projects have not yet confronted.

ExBind isolates the visual-to-executable correspondence layer — mapping a visible referent to the exact editable object — as a controlled diagnostic, compiling representation-independent binding instances into SVG, DOM, canvas, tree, graph and table cases. End-to-end execution success hides whether a failure came from localization or from action, and this separates them.

The Super Library Agent problem asks an agent to generate a portfolio of related applications sequentially while maintaining a shared library, rather than treating each codebase independently. The failure modes it targets are specific to long-running agentic maintenance: duplicated domain logic across codebases, accumulating verbosity, dead code and structural erosion.

Hi-Q reframes the multi-hop question answering bottleneck as retrievable granularity discovery: the granularity at which a question is posed rarely matches the granularity at which corpus evidence exists. Rather than imposing a fixed graph over the corpus or blindly reformulating, it conditions on evidence to decide when a query unit is already supported and when it must be refined further.

PTA-IRT makes software-engineering agent benchmarking cheaper by fusing process and outcome evidence: existing subset-selection methods fit historical pass/fail matrices and discard how an agent solved the problem, while this framework treats execution trajectories as privileged process-level signal inside an item response theory model.

TempCloze evaluates visual temporal reasoning by removing the linguistic escape hatch: given the beginning and ending clips of a video, a model must pick the true missing middle from four candidates. The 1,521 filtered videos are mainly long-take and egocentric, and distractors are drawn from the same source along semantic, temporal and motion dimensions specifically to defeat option-wording shortcuts.

CHARM separates two failure modes in role-playing models that prior character-hallucination benchmarks conflate: not recognizing that a question crosses a character's knowledge boundary, versus recognizing it and answering anyway. It covers 40 real and fictional characters from five cultural-linguistic regions with native-reviewer validation, probing temporal and cross-universe boundaries.

Text-based causal adjustment faces a tradeoff: representations must be rich enough to preserve confounders but sparse enough for finite-sample overlap and low variance. The paper uses sparse autoencoder features as the adjustment basis and iteratively selects a minimal feature set via conditional independence testing, giving a principled route between dense embeddings and hand-picked covariates.

Many production systems can evaluate a configuration only by using it on live traffic and observing noisy feedback, which describes most agentic inference-time choices: model selection, retrieval depth, prompting strategy, decoding temperature. The paper formalizes this as Online Hyperparameter Optimization and casts it as an infinitely many-armed bandit over mixed and conditional spaces, which is the honest formulation when no representative validation set exists.

GlossoGen studies emergent language in multi-agent LLM populations under partial information, with the SaveVeyru scenario forcing agents to communicate to coordinate. The safety framing is the reason to care: if agent populations drift toward private codes, monitorability degrades exactly as agent-to-agent traffic scales.

Direct sim-to-real transfer offers no guarantee: a simulator-trained policy can be arbitrarily suboptimal under sim-to-real mismatch, and correcting the mismatch requires real data, which reintroduces the sample complexity the simulator was meant to avoid. The paper provides conditions under which transfer is provably safe, which is the missing piece in a workflow the field otherwise applies on faith.

Safin-1 argues safety should be an intrinsic property of the model's own computation rather than a behavioral constraint imposed by external safeguards or post-hoc alignment. It represents and invokes safety-relevant capability through memory-native state evolution, which is a substantively different bet from the guardrail-and-classifier architecture that dominates deployed systems.

Standard forward-KL distillation from post-trained teachers behaves differently during mid-training than during post-training: in controlled experiments it favors reasoning capability over factual recall. That stage dependence matters because distillation recipes are usually transplanted across training phases without re-validation.

Agent capability increasingly depends on the harness rather than the weights, and changing the harness alone can substantially move task performance. HarnessDev evaluates whether models can develop and evolve their own harness, which is an underexplored axis given how much of the current agent progress is harness engineering rather than model progress.

Every SFT run rediscovers the same decisions — learning rate, batch size, LoRA versus full fine-tuning, epochs, optimizer, data mix — from scratch. This sweep varies one lever at a time across dense and mixture-of-experts models in the Qwen3 and Llama families on four real customer datasets, producing the reference table the practice has been missing.

The position paper argues that privacy claims about synthetic data have quietly shifted from a bounded statement about residual inference risk under stated assumptions to an appearance-based property inferred from the fact of generation itself. It is an argument about community standards of evidence, and it names a substitution that is now common in published work.

Some Navy submarines are waiting years for shipyard availability, a backlog Defense One puts in the billions of dollars in lost readiness and carrying cost. It is not an AI story, but it is the constraint that autonomy-heavy fleet plans keep running into: the industrial base that maintains platforms is the binding limit on force structure, whether or not the platforms are crewed.

A recap of an Ai2 event marking its expanded collaboration with Providence Swedish, in which researchers laid out where AI-assisted discovery systems actually break: keeping them steerable by the scientist, keeping outputs grounded in human judgment and sound method, and keeping them responsive when new experiments contradict earlier conclusions. The framing is a useful counterweight to autonomous-discovery claims, and it pairs with this week's EvoSCM and SCILAWS-BENCH submissions on belief revision and law discovery.

AfterQuery, an AI model-training data startup, has reportedly raised at a 3.2 billion dollar valuation five months after announcing a 30 million dollar Series A at 300 million. The roughly tenfold step in under half a year is the fastest unicorn path in Y Combinator's history and is the clearest current marker of how frontier-lab demand for high-quality training and evaluation data is repricing the data-vendor layer.

AIR raised 50 million dollars for a platform that discovers agents already running inside a company, continuously vets the skills and add-ons they load, and blocks unwanted behavior. The problem is real and newly acute: skills persist in an agent's runtime context, so a malicious or compromised one has a durable channel into future actions, which is precisely the threat model the Defense-as-Skill paper on today's arXiv listing attacks from the research side.

The Electronic Frontier Foundation argues that courts hearing AI training cases should apply existing copyright doctrine rather than construct new categories in response to the technology, warning that doctrine built for this moment would apply far beyond it. The piece is a position brief rather than analysis, but it is the clearest statement of the civil-liberties framing that has been largely absent from the training-data litigation coverage.

The continuing resolution that deferred a government shutdown also carries a short-term extension of the Cybersecurity Information Sharing Act of 2015, now running to December 11. The extension is directly load-bearing for the White House's new private-sector cyber operations program: the memorandum contemplates participating companies receiving threat information from other private entities, and the 2015 law is the statute that protects those entities from disclosure and privilege-waiver risk when they share it.

Repository-level code generation usually retrieves context at task level, which supplies relevant files without indicating which tokens in the generation actually depend on repository specifics. This work retrieves adaptively around critical tokens instead, tying retrieval to the points in the generation where repository consistency is at stake.

Embedding retrieval is tested where surface form and meaning are deliberately separated, retrieving items sharing structure but not wording, across competition mathematics and embodied-agent trajectories under one protocol. In mathematics the failure is total: strict Hit@1 at the heaviest disguise tier is zero percent for the tested production embedders, which is a sharper negative result than the usual retrieval-robustness literature reports.

Do multilingual models transfer facts across languages during continued pretraining, or mostly recall facts seen in the target language? The intervention design answers it cleanly: continue pretraining an English-pretrained model on Persian data from which specific facts have been systematically removed at varying granularity, then test what survives. The SIFT resource makes the manipulation reproducible.

Matrix-Game 3.5 adds patch memory to real-time streaming interactive world models, targeting the hard part of long-horizon interactive generation: holding scene geometry, dynamic consistency and camera control stable while remaining autoregressive and real-time. Persistent simulation, rather than offline clip synthesis, is what makes these models usable for games, robotics and embodied agents.

GUI world models are usually scored as one-step next-screen predictors but deployed as multi-step environments for agents. GUI-CC tests the property that mismatch hides: whether generated states stay contextually consistent when repeatedly reused as the substrate for further interaction.

CoVA-SFT supplies the missing training substrate for visual chain-of-thought: a large-scale, multi-step, self-corrected dataset teaching models to construct and maintain internal visual abstractions rather than serializing visual problems into prose. Architectural support for visual reasoning has existed for a while; the supervision has not.

DiagEvo guides self-play question generation with hierarchical error memory rather than with difficulty, learnability or diversity signals. Those keep questions hard and varied but say nothing about which unresolved weaknesses the next round should target, which is why unguided self-evolution plateaus or regresses.

E-Commerce Bench simulates a full 365-day business operation with multi-round counterpart negotiation and dynamic events, requiring agents to explore, learn from experience and adapt policy over thousands of steps. It is the first open-source benchmark to treat long-horizon as a qualitatively different regime rather than as short tasks chained together.

Self-Routing conditions the post-training recipe on the model's own rollout behavior: depending on correctness and confidence, a sample is routed to GRPO, on-policy self-distillation, regularization, or skipped entirely. Applying one recipe uniformly ignores that different samples are in different learning states.

Layer-wise emotion probing is usually run on a single corpus, leaving open whether the depth at which emotion becomes linearly accessible is a model property or a text property. Testing across Twitter posts, Reddit comments and a more contextualized corpus separates the two, with causal intervention confirming which layers carry behavioral weight.

VLM-driven self-improvement of web code has the model that proposes the repair also judging it, and visual plausibility is a poor proxy for whether the page works. WebWorld makes the browser the counterparty: a deterministic executable simulator of the artifact's actual behavior that the VLM cannot talk its way past.

SafeAtlas-VL replaces binary multimodal moderation with judgments separated by source — risk arising from visual content, from user intent, and from assistant behavior — arguing that collapsing these makes risks incomparable across an interaction and hides ambiguous cases. It ships large-scale data and guard models rather than a benchmark alone.

End-to-end weather models produce skillful global forecasts directly from raw observations at a fraction of the cost of the numerical pipeline, but they are deterministic and issue no uncertainty. This work makes the Aardvark Weather model probabilistic by attaching one stochastic mechanism per component, which additionally disentangles how much forecast uncertainty comes from observation error versus model error.

EM^2Mem organizes multimodal memory around events rather than fragments, so retrieval returns generation-ready units with cross-modal and temporal alignment already resolved. Retrieving captions, frames, transcripts and graph facts separately leaves the model to reconstruct those alignments at inference time, exactly when context is scarce and attribution is hardest.

Prompts in multi-agent systems carry two entangled roles: generating task content and specifying execution-critical protocol such as routing, output format and termination signals that the surrounding code depends on. Separating control flow from data flow makes prompt optimization stable, because a content edit can no longer silently break the orchestration.

Existing agent frameworks assume bounded, user-specified tasks. This work argues persistent assistance over long horizons needs a perception-centered architecture instead, where the agent continuously observes rather than waiting to be invoked — a different decomposition from the memory-plus-tools-plus-planner stack that dominates current designs.

LatentPress writes conversational history and long documents into continuous memory tokens that a frozen decoder reads directly through its input-embedding interface, with no text reconstruction at inference. Compressed context is usually carried as readable text or rendered images that must be decoded, even when the only consumer is a language model.

LLM judges are deployed both as scoring tools and as training signals, yet the procedure by which they assign a rating is poorly understood. An eight-attack perturbation taxonomy across readability and adequacy, paired with a generation pipeline, exposes mechanistically which surface features move a judge's score.

A mechanistic account of translation in multilingual models tests the hypothesis that conceptual content is first represented language-independently and then produced in the target language. Separating syntax from language in the representation is the specific claim, and the paper looks for where in the stack the split occurs.

VerTox uses verifiable reward-guided generation to poison corpora against neural ranking models, exploiting the fact that LLMs can now produce fluent deceptive content at scale. Since neural rankers sit inside retrieval-augmented generation pipelines, corpus poisoning is an attack on the grounding layer that the rest of the system treats as trusted.

Deep-research agents typically search along one evolving trajectory, and trajectory-level analysis shows the characteristic failure: at an early state with several plausible directions the agent commits to one before collecting comparative evidence, and everything after inherits that commitment. Hypothesis-guided search makes the branch explicit before committing.

Tokenization is treated as input preprocessing, but in an autoregressive model tokenizer granularity determines what must be resolved in one forward pass and therefore what supervision signal the model receives. Reframing it as output supervision changes both the difficulty of the learning problem and the representations that emerge, and gives a principled reason to treat tokenizer choice as a modeling decision.

Skills loaded as persistent runtime context give a malicious skill a durable channel into future actions, and the payload can stay dormant until a user task and workspace state make the unsafe action look useful — which defeats pre-install vetting. Defense-as-Skill evolves a runtime guard skill instead, moving the check to the point of use.

Single-cell RNA sequencing destroys each measured cell, so control and perturbed populations are unpaired, yet most perturbation-prediction methods model at the single-cell level and implicitly assume correspondence. PopPert models the joint distribution at population level instead, which matches what the assay actually produces.

OpenAI profiles Basis, Clay and Exa Labs on where agent deployment produced durable capability rather than one-off automation, concentrating on onboarding, account management and developer integrations. It is vendor-authored and reads that way, but the specific workflow decompositions are more concrete than most enterprise case studies and are usable as a checklist.

Hung Cao, acting Navy secretary since April and previously the Senate-confirmed undersecretary, has been nominated for the permanent role. In the undersecretary post he served as chief management officer leading modernization of the Navy's unclassified IT systems, which makes his confirmation directly relevant to the service's digital and autonomy programs, including the collaborative combat aircraft solicitation opened this week.

TechCrunch's read of the Fable 5.1 release centers on the two changes enterprise buyers will feel first: token cost falling through cheaper cache reads, and a safeguard revision that Anthropic says cuts cybersecurity false positives by 60 percent by permitting vulnerability discovery while still blocking exploit development. The capability benchmarks are treated as secondary, which is a defensible framing given how much of this release is commercial rather than technical.

Polish ModernBERT is a family of four Polish encoders at Base and Large scale, each with 512-token and 8K-context variants, adapting the ModernBERT recipe through staged selection experiments. The accompanying long-context benchmark covers legal topic classification, ideological decision-direction prediction, factual consistency over literary plot summaries and human-rights violation assessment — a reminder that encoder-only models remain the right tool for discriminative work in lower-resource languages.

ReST is a recommendation-native Transformer scaling study addressing why language-model scaling does not transplant cleanly to behavior-sequence ranking: recommendation signals are noisy, temporally irregular and sparsely supervised, and the computation is asymmetric because each request scores many candidates against one shared user history under a tight latency budget.

Generative augmentation for class imbalance is widely used and poorly characterized theoretically. Formalizing augmentation as distribution mixing, the paper shows the resulting risk distortion is controlled jointly by augmentation strength and class-conditional Wasserstein distance, giving a concrete quantity to check before trusting synthetic minority samples.

KATok replaces the fixed compression ratio of conventional video VAEs with an adaptive keep-or-drop tokenizer, allocating latent capacity to spatio-temporal regions by complexity. Fixed-ratio compression is a poor fit for video, where information density varies enormously within a single clip, and this is a clean statement of the alternative.

ContextBias asks whether the profession-to-attribute associations that underpin stereotypical bias in text-to-image models are stable, or whether they shift when the same professional role is prompted into different contexts. Treating bias as context-conditional rather than fixed changes what a debiasing intervention has to demonstrate.

Adding a persistent hidden state to a diffusion denoiser and removing timestep conditioning yields a single shared update that can be iterated to arbitrary depth. The result is an anytime solver whose accuracy keeps improving well past the rollout lengths and backpropagation window used in training, reaching 99.90 percent exact solve on Sudoku — a clean demonstration that diffusion training can serve as a curriculum for timestep-free recurrence.

A systematic layer-wise probing study of V-JEPA 2 and VideoMAE-v2 asks what visual concepts self-supervised video representations encode, where across the transformer stack they emerge, and how they are geometrically organized. Lightweight probes make all three questions answerable on the same models rather than inferred from downstream performance.

On-device LLM inference runs inside a multitasking operating system that evicts model weights and KV cache under memory pressure when users switch apps, so the next request pays a full reload. mzCache manages that lifecycle explicitly rather than treating eviction as an unmodeled cost, which is the difference between benchmark latency and the latency users experience.

Simulated markets populated by language-model agents produce prices, profits, consumer surplus and welfare numbers that look economic without instantiating the behavior the claim names. Auditing a multi-turn buyer-seller hotel testbed, the paper shows an initial implementation reported welfare gains from marketplace guardrails that construct-validity checks do not support.

A long-horizon agent's trace outgrows both consumers: the human monitoring the run and the agent whose bounded context must absorb it. The live trace model is an append-only event ledger folded incrementally into typed run state and compiled into per-consumer views, evaluated for both against deterministic ground truth.

Inverse folding pipelines usually have a structure encoder predict a coarse sequence that a protein language model then edits post hoc, so the evolutionary prior only ever corrects rather than informs. SymFold synergizes evolutionary and structural priors during generation instead of after it.

Evaluating an omni-modal model means running text, image, video and audio toolkits whose inference engines, prompt conventions and metric implementations are mutually incompatible, leaving practitioners maintaining parallel environments and unable to compare results. OmniEvaluator composes them into one reproducible system.

Sequoia-incubated Empirik launched with 21 million dollars, pitching predictive failure detection for IT infrastructure with the explicit analogy of doing for operations what Cursor did for software engineering. The interesting question for the category is whether outage prediction has enough labeled failure signal to support the same feedback loop that made code assistants improve, or whether it stays anomaly detection with a language interface.

Google Pics replaces the canvas-and-toolbar interaction model with prompting as the primary editing surface, pushing Google deeper into a creative-software market Canva and Adobe dominate. The bet is that generation quality is now good enough that direct manipulation becomes an escape hatch rather than the default, which is testable and, if wrong, expensive.

MongoDB Field CTO of AI Pete Johnson traces database design from the 1970 relational paper through normalization as a response to disk scarcity, and argues that the constraint structure has now inverted again: agent memory is a write-change-recall-forget workload rather than a query workload, and the storage decisions that follow from that differ from both classical relational and vector-first designs.

Matt Pocock's collection of coding-agent skills reached the front page, one of a growing number of curated skill repositories emerging as the portable unit of agent configuration. The practical tension the format surfaces is the same one AIR raised funding to address this week: reusable skills are durable runtime context, which makes them both the reason agents improve and the channel through which they can be steered.

Tarn Adams describes an industry he sees as destabilized by simultaneous generative-AI adoption and layoffs, in unusually blunt terms. It reached the Hacker News front page on the strength of the source rather than new information: Adams is one of the few developers with enough independence from the funding structure to say it plainly.

Philip Wadler argues the term artificial intelligence obscures more than it names, and that the systems in question are better described by what they compute than by the category they are marketed under. Coming from a programming-language theorist rather than a commentator, the argument is about definitional precision rather than deflation, and it drew a substantial Hacker News thread on exactly that distinction.

A Defense Department memo details entitlements and support policy for military families evacuated from Bahrain. It is administrative rather than technical, included here because the same regional contingency is shaping the deployment tempo that defense autonomy programs are being scheduled against.

Google's latest Android release adds motion-sickness and accessibility features, some catching up to iOS parity and others built on Gemini specifically. The Gemini-dependent items are the ones worth tracking, since they are early examples of on-device model capability being spent on assistive rather than generative use.

Weedout is a Safari extension that filters YouTube videos carrying the platform's AI-generated content label. It works only because the disclosure labels exist, which makes it an early data point on what mandated provenance labeling enables downstream: once the signal is machine-readable, filtering is trivial and the labeling decision becomes the whole policy.

Amazon has given Alexa the ability to proactively surface products it predicts a user will want. Mechanically it is a recommendation trigger moved from a screen to an ambient assistant, and it is a useful marker of how proactive-agent design is being resolved in consumer products: the first widely deployed proactive behaviors are commercial rather than assistive.

Fambot is targeting the household as an agent deployment surface, coordinating schedules and logistics across family members. Consumer agent products keep converging on shared-calendar orchestration because it is the rare domain where the coordination cost is high, the stakes of an error are low, and the ground truth is checkable.

A whistleblower says the Postal Service is deploying new IT systems governing mail-in ballot processing without adequate testing. The claim is about software assurance in a high-consequence deployment rather than about AI specifically, and it is a reminder that the verification standards debated for model deployment remain unmet for the ordinary systems already in place.

A House bill advancing this week would concentrate federal anti-scam authority in the Federal Trade Commission. The relevance to this digest is generative fraud: voice cloning and agent-driven social engineering are landing in an enforcement structure that was designed for a slower and more centralized fraud economy.