Four throughlines run through today’s edition. The first is a pattern four separate writers found independently: a system takes a number that measures one thing and quietly treats it as a guarantee of another. A retrieval score becomes a trust decision, a tool’s output becomes an instruction, a benchmark label becomes a comparison, and polished code becomes finished code.
Trusted by Default: Four Signals Doing a Job They Were Never Given
Nobody decided any of this. In each case a measurement that was only ever describing one property got promoted, silently, into a guarantee about a different one.
- A gap between two guardrails is where agent hijacks now hide. Most defences check what the user typed, then separately check the action about to be taken. Content that arrives in between, as the result of a tool the agent called itself, is read as data rather than instruction. ARMO proposes watching for actions with no basis in the agent’s own history, which is a proposal rather than a control anyone has validated.
- A Blog Post Argues Cosine Similarity Was Never a Trust Signal. Semantic closeness knows nothing about whether a passage is true or who wrote it. Amine Raji’s point is that a vector database ships with exactly one signal, so relevance ends up making a trust decision nobody consciously delegated to it.
- A Benchmark’s Name Is Not Its Measurement Procedure. Same provider, same model family, same metric name, different score. Dmitrii Zatona walks through what actually varies underneath: which questions were used, how the prompt was laid out, whether a string match or another model did the grading. A leaderboard row is only comparable to a row produced the same way.
- An engineer says AI code breaks the intuition that spots bad code. The claim is about predictability rather than quality. Engineers navigate unfamiliar code using learned instincts about where humans cut corners, and Jimmy Miller argues generated code looks finished everywhere, so the instinct has nothing to catch on until production does the catching.
The Compute Bill, and Who Gets to Collect It
One enormous commitment, and two attempts to take a share of what it pays for.
- Anthropic’s compute leases hit $517 billion in 11 months. Read the number carefully: it is contracted lease value across 14.8 gigawatts and many providers, not cash out the door. Contracted capacity is a fixed obligation while the revenue to service it is still a forecast, which is the part worth watching.
- Google’s TPUv7 beats Nvidia on cost per token, analyst finds. Ironwood is the first TPU generation Google is genuinely selling for other people’s inference. The cost advantage comes from SemiAnalysis’s own modelling and depends on assumed pricing and workload, and the software stack, not the silicon, is what decides whether anyone can use it.
- Arm’s next phone GPU adds AI math units, but skips key formats. Arm licenses designs rather than shipping chips, so its choices propagate across most flagship phones at once. The new matrix hardware supports integer precision but not the floating-point formats on-device inference has settled on, which limits what it helps with.
Two Bets on the Shape of an Agent
One developer made the harness small enough for the model to read. One company appears to be preparing to sell you the whole thing instead.
- A developer built an agent harness small enough to read itself. Configuration becomes environment variables, tools become shell commands, subagents become child processes. Jonathan Chang’s argument is that most of what agent frameworks build already exists as operating system machinery, and a harness the model can see is one it can reason about.
- Leaked Code Points to OpenAI Managed Agents Ahead of DevDay. Unreleased interface code spotted by TestingCatalog, not an OpenAI announcement, and features found this way get cut. If it ships, it puts OpenAI in direct competition with the harness vendors currently building on its own API.
Models Outside the Chat Window
Three releases and reports where the model is pointed at something physical rather than at a conversation.
- Qwen’s driving model keeps its general vision skills intact. Driving models have historically been specialised into uselessness at everything else, so the reportable claim here is retention rather than raw driving score. Everything is the lab’s own evaluation, released as research code, and nothing about it suggests a system ready to control a vehicle.
- ByteDance May Launch a Real-Time Spatial Video Model Next Month. Reported rather than announced, with the timing openly provisional and Zhang Yiming’s hands-on role coming from Bloomberg’s characterisation. Real time is the hard part in this category, so frame rate and session length are the numbers to wait for.
- Google and Cathay Pacific expand AI contrail-avoidance trial. A small share of flights produces most of the contrail warming effect, so predicting which ones and nudging their altitude is a rare AI climate application with a checkable mechanism. The roughly 40 percent figure is Google’s own estimate from its own trial.
Two Arguments About Ceilings
One about what machines cannot learn without data that does not exist, and one about what people might stop doing on purpose.
- Why robots can’t learn the way chatbots did. Language models had the internet. There is no equivalent corpus for a hand closing around an unfamiliar object at an unfamiliar angle, and Jan Bosch argues that absence, not model capability, is what holds robotics back. His advice to go narrow is easier to give than to fund.
- A former AI optimist explains why he now expects people to submit. Fernando Borretti’s mechanism is the interesting half: not that control gets seized, but that deferring to a better judgement is locally rational every single time you do it. That claim is testable in a way his timeline is not.
Quick Hits
- Google builds Gemini agents to move PyTorch code onto its TPUs. Porting cost is the moat keeping developers on Nvidia, so tooling that automates the move to JAX and TPU kernels is a competitive play rather than a convenience.
- A Developer Built Passive AI-Text Detection Into His Own Browser. Deckard runs a local model to flag AI writing as pages load. Sean Goedecke’s own numbers put it far behind Pangram on accuracy, and he presents it as a build log rather than an evaluation.
- Lovable adds drafts so teams can test app changes before going live. Parallel copies of a project, edited without touching the published app. This is branching, which developers have had for decades, and the open question is whether it also inherits the merge problem.