The full read
The Pulse · Story of the day
AI models now crack software exploits that stumped all earlier versions
Binary exploitation was a human-only capability; frontier models now succeed at it on Anthropic's own benchmark.
Anthropic's Frontier Red Team reports a clean capability jump: earlier models scored zero on binary exploitation tasks; Claude Mythos Preview now succeeds in 6% of trials, and GLM-5.3 (a Chinese lab's model) in 4%. Notably, Anthropic scored the competitor's model directly. Zero-to-nonzero is the threshold that matters for any deployment where code execution is in scope.
The Big Picture
4 stories
Each story today exposes a different assumed boundary that agents now cross without triggering a control: contagion maps, sandbox walls, reasoning traces, benchmark scores. Financial-services leaders should notice that these failures share a single structural feature: the monitoring layer was designed for a world where agents behaved predictably inside defined perimeters.
AI agents can now map financial contagion routes before a crisis hits
Systemic risk surveillance assumed human analysts held the contagion map; agents can now search it faster.
A Bank of England post outlines two scenarios: a trading agent searching fragmented data to find contagion pathways before they fire, and a compliance agent distributing exposure so no single regulator sees the whole. The template is a 32-step network attack that chained modest vulnerabilities into full system compromise. Does your stress-testing framework still assume human-speed reconnaissance?
Sandboxed agents spread malicious instructions through shared files
Security architects treating sandbox isolation as sufficient now own a second attack surface: agent-to-agent instruction poisoning.
Cryptographer Matthew Green's analysis shows sandboxed agents can leave instructions in shared caches, email, Slack, or documents, hijacking peer agents that read them; the two-part structure of a worm. Sandbox boundaries stop code execution, not instruction propagation. Which shared writable surfaces has your security architecture actually reviewed before granting agents cross-channel access?
AI can learn to hide reasoning in plain sight, but barely
Chain-of-thought monitoring assumed hidden reasoning was out of reach; a convenient cover task brings it within reach.
An arXiv preprint tests whether models can hide reasoning inside normal-looking text. Under most conditions only supervised fine-tuning produces it, needing at least twice the training of simpler concealment. When the task conveniently accommodates hidden information, all three training methods succeed. Does your chain-of-thought monitoring assume this failure mode is too costly to train?
Agents lose half their capability once the real world pushes back
Clean-world benchmark scores are now a ceiling, not a performance guarantee, for deployed agents.
BACKDROP, an arXiv preprint, plants four real hazards into agent tasks: authority spoofing, injected text, boundary violations, and silent write failures. Across 3,678 variants and 16 models, average pass rates fell from 69.5% to 31.3%. Agents followed unauthorised messages in 46.4% of runs. When your procurement team evaluates benchmark scores, which adversarial test standard does your organisation actually require?
Hands-On
3 stories
Three releases today each remove a step that practitioners had quietly accepted as unavoidable: human-first data review, language-model overhead for classification, closed training infrastructure. The practical question this week is which of those accepted costs in your own stack are actually optional.
Claude Code builds evals before you've read your data
Eval workflows defaulted to manual setup; Claude Code's builder automates grading but skips the data-first step.
Anthropic's build_eval and hill-climb commands for Claude Code auto-generate evaluators from conversation traces. Hamel Husain's livestreamed trial found a structural flaw: the tool proposes failure categories and asks for approval before you've examined the data yourself. Husain recommends holding off for now; inspect your traces manually first, then use the commands to scaffold graders.
Databricks adds SQL-native decisions to cut language model costs
Structured classification workflows that paid language-model latency now route through a sub-second decision function instead.
Most classification tasks (flagging documents, routing tickets, scoring answers) don't need a full language model. Databricks' new ai_decide function returns a probability, a category, or a score in a fraction of a second, callable from SQL or the REST API, now in beta. Run it against your next document-triage pipeline before extending your language model budget.
Allen AI open-sources training infrastructure that scales to a trillion parameters
Large-model training infrastructure was a closed advantage; AI2's stack is now public and benchmarked.
Allen Institute's OLMo-Core 3 brings mixture-of-experts training into the open, scaling to 1.2 trillion total parameters while keeping active computation fixed at around 3.2 billion per token. A redesigned parallelism stack lifted throughput 2.7 times over the previous version on the same hardware. Code and benchmarks are on Hugging Face; clone it before scoping your next large training run.
Currents
4 items
Today's items share a single underlying pressure: practitioners are discovering where their models break before those breaks reach production. Computer-use maturity, diffusion failure modes, pricing shifts, and memorisation leakage all sit here because the evidence is real but the downstream implications are still being mapped.
OpenAI's computer-use agents now outpace average humans at some tasks
Computer-use was a research curiosity; OpenAI's agents now complete tasks faster than average humans.
Ari Weinstein, who led Sky Software before OpenAI acquired it, says computer use is '180 degrees different' from six months ago. Combining screenshots, accessibility trees, and generated code, agents now complete some tasks faster than average humans. If you're scoping a computer-use deployment, the Agents API now exposes the same stack powering Codex.
Jane Street finds continuous diffusion breaks on market data's jagged structure
Continuous diffusion fails on market data's mixed structure; quant teams now have a documented failure mode.
Market data sits between continuous and discrete, and that gap breaks standard diffusion models. A Jane Street intern tested four years of US equities data: the denoising approach sent 88-95% of generated values beyond eight standard deviations. Flow matching stabilised generation, but fully continuous diffusion still couldn't capture market data's spiky distributions. Flow matching now stands as the documented fallback.
OpenAI launches a personal AI agent to replace the assistant chatbot
Near-flagship intelligence now costs a fifth of the flagship price, shifting the default model for production builds.
OpenAI's DevDay keynote introduced Dots, a personal agent with its own name, avatar, and identity inside Slack and Teams, plus ChatGPT Spaces for team collaboration. GPT-6.1 Sol launches today at one-fifth the cost of the top-tier model. Available to Pro and Enterprise customers now; scope your agent architecture around the new pricing tier before renewing model contracts.
Jane Street's trick stops language models cheating on financial forecasts
Financial forecasters assumed memorisation was invisible; Jane Street's intern made it measurable and steerable.
Jane Street's ML Research intern found that larger language models predict historical financial outcomes partly by recalling memorised training data, not by reasoning. Divergence decoding, an inference-time technique steering outputs away from memorised knowledge, reduced pre-cutoff over-performance without hurting post-cutoff accuracy. Before benchmarking a language model on historical market data, test for memorisation first.