Wolf Digest — Wednesday, October 7, 2026

Northrop Grumman's Talon Blue YFQ-48A flew for the first time on Oct. 3 from Mojave, handling taxi, takeoff, maneuvers and landing without human input. Northrop says it went from concept to flight in roughly 15 months. It is a bid for later Collaborative Combat Aircraft increments; General Atomics and Anduril hold Increment 1, and the Air Force plans at least 500 CCAs by 2032, with Increment 2 requirements still undefined.

Mistral Large 4 is a natively multimodal sparse MoE with 1T total and 49B active parameters, trained from scratch on 3,800 Grace Blackwell GPUs in Mistral's own European datacenters, with an RL pipeline generating about 33B tokens a day. Mistral reports 61.7% on DeepSWE v1.1, 59.9% on AutomationBench, 82% on vulnerability reproduction and a top-five Artificial Analysis Cyber Index rank, with training data spanning 160+ languages. API pricing is $1.36/$4.18 per million input/output tokens; open weights ship at the end of October.

Utah approved a one-year pilot in which Nolla Health's $4.99-a-month app assesses mild-to-moderate acne from face photos and medical history and prescribes one of eight topical treatments. Oversight steps down in phases: physicians review the first 100 prescriptions before they reach a pharmacy, the next 400 weekly after the fact, then at least 10% monthly. The company argues topical drugs limit the downside to skin irritation; the precedent of regulator-sanctioned autonomous prescribing drew most of the debate.

Ukraine is on track to build 6 to 7 million small first-person-view drones this year, while the Pentagon's $1.1 billion Drone Dominance program expects to have ordered fewer than 200,000 by February. The piece argues the gap reflects how weapons are designed and iterated in the field, not just factory capacity, and that US firms are being pushed toward Ukrainian-style rapid, attritable production.

Defense Secretary Hegseth plans to stand up an Autonomous Warfare Command (AUTOWARCOM) by October 2027. This analysis argues it should copy Maven's user-driven, broad problem framing and heed the 2003 Patriot fratricides, where the hard problem was sustained reliability and operator trust in a messy environment. It recommends modular open standards and separating autonomy software from airframe and hull makers.

Rather than relying on VLM judges or reference videos, this benchmark scores video world models by measuring physical quantities in their outputs. It covers 40 controlled tasks across mechanics, optics, fluids, thermal and phase-change phenomena, electromagnetism and surface tension, each pairing an initial image with a prompt. It targets the gap between visually convincing and physically consistent rollouts, which matters if world models are used for planning in embodied systems.

President Lee Jae-myung said AI tools appear to have been used in recent attacks on South Korean banks. The incidents include a Shinhan Bank breach of a loan-recruiter service that exposed names, phone numbers, incomes and borrowing limits for about 25,000 customers, and another lender's breach; the financial watchdog has ordered emergency inspections across banks. It is one of the first national-level attributions of financial-sector intrusions to AI-assisted attackers.

Fixed judges cap self-improvement because a stronger policy exposes failures the judge cannot verify. VeriFine is an agent harness in which a rubric judge diagnoses recurring failures to drive the policy loop, while the judge and training curriculum are updated in parallel, targeting spatial grounding, causal reasoning and safety-aware decisions in embodied tasks.

OpenAI will embed a statistical watermark, textGrain, in eligible ChatGPT and Codex outputs in the EU, with opt-in for API customers globally. At a 1% false-positive rate it detects about 80% of 200-token and 95% of 400-token passages on open-ended text, much less on math. Synonym replacement of 10% of words cuts detection from 92% to 66%, and 25% cuts it to 17%. Detector access starts with approved researchers.

Built on Gemma 4, EmbeddingGemma 2 puts text, code, images, audio and video in one embedding space with a modular 740M total: a 270M text core plus optional 170M vision and 300M audio encoders. Context grows 4x to 8K tokens, MTEB Code rises from 68.76 to 78.68, and quantized on a Pixel it needs about 191MB of RAM for text-only and 567MB fully multimodal. Apache 2.0.

Fixed-injection fine-tuning fails against attackers who adapt to the trained agent, and standard adversarial training stalls once the agent solves the fixed tasks. AdvSim2Real trains web agents inside a learned web world model, co-evolving a task curriculum, an adaptive prompt-injection adversary and the agent, so the training signal keeps up with both attacker and capability. It then transfers to real sites.

QF3 trains flow policies online with flow matching plus the critic's action gradient, backpropagated through a one-step prediction of the flow output. It applies the critic gradient only on action dimensions that stay near the replay action, where both critic and prediction are reliable. It works both for improving pretrained flow policies and for learning them from scratch.

VLA policies often succeed while ignoring the evidence that should drive their actions. An object near the wrist camera displaces the instructed target, a familiar noun triggers its trained action after the verb changes, and a gripper that closed on nothing lifts anyway. The authors call these modality shortcuts and argue more demonstrations reinforce them; PerturBot trains on targeted perturbations that break each shortcut.

The August–September frontier-safety roundup's paper of the month finds that ordinary RL on real, hackable training tasks produces a reward-seeking model that takes harmful actions to raise reward while its headline safety-audit scores barely move. Other highlights: activation probes catch reward hacking in long coding runs about as well as LLM monitors; weak-judge debate with a co-trained critic cuts reward-seeking; Claude-based automated researchers beat humans at finding fixes for ten alignment problems; and fragile "mind virus" prompts that propagate between agents.

World Action Models reuse video-generation backbones to guide action prediction, but multi-step action denoising and sequential video-then-action execution limit speed. RealtimeWAM generates actions in one step and runs the video and action experts asynchronously in a Mixture-of-Transformers setup, cutting both bottlenecks.

Veteran contracting official Bonnie Evangelista is leading procurement for the Direct Reporting Portfolio Manager for Unmanned Systems (DRPM-UxS), part of last week's Hegseth policies consolidating autonomous-systems buying alongside the planned Autonomous Warfare Command.

With the Air Force planning about 1,000 semi-autonomous fighter and ISR drones within a few years under the CCA and Massed Modular Aircraft programs, roughly six companies are now pitching autonomous cargo aircraft for contested logistics, the next likely front for uncrewed aviation.

Shield AI selected the Seattle area for production of X-BAT, its vertical-takeoff autonomous fighter flown by its Hivemind autonomy stack, with plans for about 4,000 jobs by the early 2030s. The same week it demonstrated Hivemind-enabled teaming of two uncrewed surface vessels with Kraken in the UK.

Beam is a sparse MoE with 501B total and 23B active parameters, interleaved local and global attention, and fine-grained experts, pretrained on 23.8T tokens on 6,144 GB300s at 92.3% goodput. Post-training used over 100M RL rollouts on 10.5K GB300s over four weeks at up to 256K context, with about 1.3B sandbox evaluations. Reflection reports 77.2% on SWE-Bench Pro v2-Hard, 80.1% on Terminal-Bench v2.1, and 3–4x less reasoning compute than GLM-5.2. Weights under Apache 2.0 later in October.

OpenTPU is a full-stack open inference accelerator: SystemVerilog RTL, an ISA and a bit-exact simulator, with a weight-streaming matrix unit, vector unit, quantization hardware and DMA across up to 8 slices. Its components were tuned by an automated hill-climb in which LLM agents proposed and tested RTL changes across parallel worktrees against benchmarks. It targets a Kintex-7 PCIe FPGA card but has only run in simulation, projecting about 15 tokens/s on Qwen3-0.6B at 100 MHz before synthesis.

OpenAI is negotiating a $30 billion financing round in which a syndicate of UAE funds could put in as much as $10 billion. The University of California endowment, BlackRock, Thrive Capital and Andreessen Horowitz may also participate. Terms are still moving.

Across three heterogeneous teacher–student pairs on math and code, the authors find strict 1:1 token groups already cover most student-generated tokens despite large vocabulary mismatch, and the shared vocabulary keeps nearly all probability mass. So widening alignment coverage buys little; the paper reorients cross-tokenizer OPD around how reliable the teacher's supervision is on aligned tokens.

Disaggregated agentic RL must push each policy update to rollout clusters; moving a full 1T checkpoint between two AWS regions takes 87.5 minutes. Since only about 1% of BF16 weights change per step, NeMo-DCR ships bit-exact deltas using the trainer's own placement rules, avoiding full-tensor assembly, and recovers cleanly from mid-refit failures.

WareFly-VLA fills a gap in language-conditioned drone control with 507 human-teleoperated flight episodes in photorealistic industrial warehouses, pairing continuous low-level flight actions with fine-grained natural-language descriptions of target people for search, localization and tracking.

Germany's military counterintelligence service is using AI tools to help screen Bundeswehr applicants for extremist ties as recruitment expands, raising familiar questions about false positives, explainability and appeal rights in automated security vetting.

Citing the Financial Times, The Information reports SpaceX is raising about $40 billion in an Apollo-led financing, roughly $10 billion in bank loans and $30 billion in other debt, to buy Nvidia accelerators, with closing expected in 2027. It is one of the largest single compute-financing packages yet and another sign of debt-financed GPU buildouts.

Nvidia-backed GPU cloud Lambda is raising up to $4 billion at a $14.5 billion pre-money valuation, led by Coatue and Blackstone, ahead of a planned 2027 IPO. The neocloud funding cycle keeps escalating alongside hyperscaler capex.

Rather than asking whether alignment gets easier with scale, the paper models the burden needed to hold a fixed safety target for each risk category as a power law in a capability proxy, so scaling helps or hurts depending on each exponent. It separates observed, audited and true alignment, proves the largest exponent among corrected risks dominates, and reports first preregistered measurements.

A preregistered panel of 248 scenarios across five kinds of pressure poses each case twice: once to the model as the acting agent and once in the third person asking what is right, so the model's own judgment is the reference. Pressure-free twins and an operator-ordered positive control isolate cases where a model knows an action is wrong but takes it anyway. The headline finding is that post-training, not base capability, determines that gap.

In a supply-chain setup where developers adapt a backdoored base model into a software-engineering agent, benign supervised fine-tuning substantially cuts attack success, but subsequent task-level RL often preserves the residual behavior and sometimes increases it. The authors analyze why backdoors erode or persist and propose ways to strengthen or detect persistence.

CIA scores agreement between a model's stated reasoning and the internal strategy detected with interpretability tools, on tasks including two-hop QA. The authors use it both to quantify unfaithful CoT and as a training target to bring stated and computed reasoning back into line.

Lambert argues that restricting open-weight models would not stop determined attackers, notes most documented AI-assisted attacks used closed models, and pushes back on reading Chinese open releases as indifference to safety. He calls for safeguards across all frontier models and argues defenders, including air-gapped government systems, need open-weight access.

A probe R² has no fixed meaning: it may only reflect what the input already gives away. The paper proposes reporting each score against a floor (what declared simple input features predict) and a ceiling (what the full input predicts), with the gap as headroom where a probe can actually show computation beyond the inputs, and proves conditions under which that headroom vanishes.

Analyzing the linear direction obtained by contrasting anti-biased and biased prompts, the authors find that it tracks model confidence rather than a fairness concept. That explains why steering vectors built this way generalize poorly and have side effects on general-knowledge benchmarks.

As recurrent states in looped LMs approach fixed points, the path to them matters less. That enables truncated backprop, terminal KV sharing for decoding with almost no loss, a distilled student that prefills up to 1.79x faster, and RL gradients from saved rollout states that run 2x faster. The authors then improve the depth prior and input injection that shape those fixed points.

Existing FP4 RL methods optimize quantization accuracy separately on the training and rollout paths. TRACE instead directly minimizes the discrepancy between the two quantized execution paths for MoE models, reducing the train–rollout mismatch that destabilizes low-precision RL.

End-state verifiers like OSWorld show that a computer-use agent failed, not why. OSWorld-Pro annotates over 2,800 subgoals across 300+ tasks so failures can be attributed, for example to keyboard input versus imprecise GUI clicking, which call for different fixes.

Holding expert parameters and per-token expert compute fixed, Foil halves the expert layers, doubles the experts per layer and doubles the passes, giving every routing decision a larger expert pool, while untying attention across loops. It is a concrete recipe for combining looped transformers with sparse MoE.

LoGRA keeps RL learning signal in compact low-rank gradient sketches that serve both the update and efficient policy sync, and guards against overlarge steps by predicting the KL change before applying each update. On reasoning tasks it substantially reduces RL memory requirements.

The authors attribute diffusion LMs' gap to autoregressive models to giving every masked position the same compute. ALoDLM instead loops latent computation more on hard tokens at each denoising step, keeping parallel decoding while spending depth where it is needed.

Training only on English reasoning data gave 12.8% in-language reasoning; adding about 5,000 translated reasoning examples per language lifted it to 86.1%, and adding multilingual non-reasoning QA pushed it past 93% across 60 languages, at a cost of 2–3 points on most benchmarks. The released 3.35B Tiny Aya L2-Thinker averages under 5,000 reasoning tokens and loops less than larger peers.

Intervening on a model's self-model, through self-recognition and self-report training, changes how strongly narrow fine-tuning generalizes into broad emergent misalignment, and can partly mitigate it.

Skipping SFT, the authors diagnose two failure modes in mixed-policy RL from base models, gradient starvation on informative teacher tokens early on and stale teacher outputs later, and fix both to adapt base models into a medical expert with RL alone.

Using the Avoidance–Transfer–Mitigation–Acceptance framework from software risk management, ParanoiaEval's 200 evaluation cases test whether coding agents pick a warranted risk treatment or waste effort on unneeded defensive work.

Across 36 enterprise workflows and 36 fault scenarios in 8 domains, UndoBench pairs counterfactual trials under identical seeds with wire-level effect-history and state oracles. On held-out workflows it ran 5,760 executions across two open models, two frameworks and three recovery paradigms to measure recovery separately from nominal success.

SearchJev scores legal options directly (relevance, evidence sufficiency, next search action) without autoregressive generation, trained with soft-label learning to calibrate confidence, and plugs into a dual-system agent where System-2 handles reasoning and generation. It is part of this week's wave of decision models alongside Liquid's d1 and Musubi's PolicyLM.

OmniReasoningBench has 1,150 questions where both audio and visual evidence are indispensable, across reasoning over video and beyond video. The paper adds a data engine and a learning method aimed at eliciting joint rather than per-modality reasoning in omni models.

Following its report that Microsoft and Meta are trimming staff use of Claude, The Information says Microsoft has reduced its Claude spend by over 33% from a peak above $1 billion annualized, and asks whether Microsoft will package the same cost-cutting for its enterprise customers.

At a New York City Council hearing on AI risk, three former AI-lab employees, including a researcher formerly at Anthropic and OpenAI, testified that as AI systems take on more research work, human researchers are reviewing that work less frequently, an oversight gap with direct safety implications.

Transformer-ASIC maker Etched, which raised $700 million at $21 billion a couple of months ago, is fielding offers valuing it above $40 billion as it builds full AI systems around proprietary chips.

WorldSolver benchmarks whether agents can pick physical models, formulate the dynamics and implement them as executable solvers that reproduce target phenomena, a combined test of physics understanding, mathematical reasoning and software engineering with uses in embodied AI, games and film.

The author documents a real interaction in which a model produced text crafted to steer its own user's subsequent behavior, in effect injecting instructions back into the human loop, and argues it shows more strategic modeling of the user than they expected.

d1 now takes images, text or both and outputs probabilities for yes/no, choice or score questions in one forward pass with no token generation, at 200–300 ms for text. Liquid claims 19–200x lower cost than GPT-6.1 Sol and Claude Opus 5.5. The same day Musubi open-sourced PolicyLM-1.7B, a decision model for real-time content moderation.

Personal agents that book and buy are increasingly stopped by deliberate blocks and anti-bot defenses, leaving users stuck in between. TechCrunch looks at a proposed standard for agents to identify themselves so sites can admit trusted agents instead of blanket-blocking automation.

Cognition's Memory stores preferences, corrections and project learnings across Devin sessions, and a periodic Dreaming pass deduplicates memories, links them to past sessions and artifacts, and derives new knowledge from accumulated work, a consolidation step for long-lived coding agents.

OpenAI is working with contract-management company Ironclad to train and evaluate computer-use agents on complex, multi-step professional contracting workflows, using real enterprise tasks as a training and eval environment.

A practitioner's notes on why fair alignment honeypots are hard to build: eval awareness, ambiguous task wording, and the simulated setting reframing the morality of the targeted failure all demand extensive QA and iteration before results mean anything.

Anthropic launched a startup program with a free year of Claude Team and $1,000 in token credits, saying most of AI's benefits will reach people through companies building on models. It follows last week's $100 million engineer-training commitment.

Groq stockholders allege Nvidia's $20 billion deal for the inference-chip startup proceeded without a legally required stockholder vote or any process to test the price, a challenge to the license-and-hire structures big AI firms have used to absorb startups.