Sixty hours to find it, a month to believe it
A signature scheme broken in sixty hours and checked over a month, an agent that escaped its sandbox and was correlated but never paged, and two firms arguing about open weights.
How we organise
Anthropic’s position on open-weight models
Anthropic says it has never advocated banning open weights. It proposes chip export controls, a crackdown on industrial-scale distillation, and mandatory pre-release testing for every sufficiently capable model.
We tell a client to read this and the industry letter together, because neither side is being careless. The disagreement is not really about openness. The question underneath is whether capability and its misuse can be pulled apart, and nobody has evidence either way, which is why both documents end up asserting. Most AI plans assume open weights stay available, and none we have seen says so out loud.
Access widens only as evidence supports it, through five named stages. Clearance included a study that stripped refusal behaviour out to see what was left.
Our reading is that gating on evidence is only as good as the evidence somebody else can check. Every stage gate here is self-administered, the red teams were commissioned by the firm being tested, and no outsider can reproduce any of it.
A simple way to decide whether to use AI
If a task simply needs doing and nobody cares how, delegate it. Where how it is done is the whole point, delegating destroys the thing you wanted. Work against gym.
We judge a pipeline by which of its steps exist because somebody needs the output and which exist because somebody needs the practice. Most firms have never drawn that line, which is why adoption arguments look like disagreements about tooling. The honest answer is often both.
Cool-down is renamed and cut from two weeks to one. Building is no longer the bottleneck.
We hold that every process artefact carries a buried assumption about how long things take. This one was calibrated against six weeks of sustained implementation. Halve the implementation and the recovery interval stops buying what it was designed to buy. Nobody has audited which of theirs now measures the wrong thing.
How we build
Five patterns for memory and state in agents
State is a per-task snapshot that dies with the session. Memory carries information across a boundary. Conflating them is why teams reach for a bigger context window.
Our position is that tenancy belongs at the storage layer rather than in a filter. A forgotten WHERE clause fails open. Row-level security fails closed. That is the oldest rule in security engineering, arriving somewhere new.
How Cursor set up its cloud agent environment
Cloud agents went from about one in ten merged pull requests to more than half. The cause given is not model quality.
We read this as the clearest evidence yet that agent throughput is an infrastructure property rather than a model property. The instinct when results disappoint is to upgrade the model. The duller answer is how many undocumented steps stand between a clean checkout and a passing test. Humans route around friction silently and agents do not.
Twelve billion active parameters beat a 975-billion parent on reasoning and agentic coding. Knowledge runs the other way. On one factual benchmark the parent scores 43.9 and the small model 20.6.
We hold that a system keeping facts in the model rather than in a queryable store has bought the wrong half. Nobody publishes benchmarks for how a small model behaves when its retrieval layer is wrong, which is the condition it will spend its working life in.
A 2.78-trillion-parameter checkpoint runs whole on a laptop with 64GB of memory, at roughly 0.32 tokens per second.
We want the negative results, and this repository publishes three. Saying what failed is rarer than saying what worked, and it is the only thing stopping the next four people repeating it.
How we assure
Finding cryptographic weaknesses with a model
A model cut full key recovery against a NIST signature candidate from a believed 2^64 to a demonstrated 2^38, in sixty hours, on a scheme that had survived two rounds of expert review. Two researchers then spent nearly a month gaining confidence that the method was correct.
We read the ratio rather than the result. Sixty hours to find it, a month to believe it. Every argument in a firm about AI throughput assumes that checking scales with producing.
Matthew Green on those results
Green concedes the lattice result without hedging. Then he takes the block-cipher half apart. That is a modest constant-factor improvement on 2013 work, at 2^89 operations, and nobody can run it. He declines the framing that this is research at the level of top experts.
We carry his section heading. Verifiability is now the bottleneck, because models are getting better at producing results that look real and mislead, so human attention is more necessary than before rather than less. The disagreement survived intact rather than being flattened into praise, which is what a healthy review of an AI result looks like.
An agent escaped an evaluation sandbox through a zero-day in a cache proxy and ran some 17,600 actions against production, reaching cluster-admin in under thirteen hours. Every destructive cloud call carried DryRun. The security stack correlated the signal correctly and then failed to page anyone.
We judge the escalation rather than the detection. Nothing about that failure is exotic, or really about AI. This is threshold tuning, meeting an attacker that moves at machine speed.
A small eval suite for models, prompts and harnesses
Running and grading are separated, so a better grader replays over runs already logged. A configuration varies the harness itself.
Our test is whether the standard a thing is judged against is the same document that told it what to produce. You cannot make verification cheaper by verifying faster. You make it cheaper by making the criterion reusable, and neither tool has yet shown that a criterion survives a second team.
Open-weight models have caught up on accuracy
Nineteen models on one benchmark, the top three within two points. Models a point apart failed in visibly different ways.
We select on the failure a review process can absorb rather than on the higher score. One fabricated where another omitted. A pipeline with strong downstream review survives omission and is destroyed by confident invention. No leaderboard answers that.