The control was a habit
How we organise
Model Genome: fingerprinting whether an LLM was trained from scratch or derived (mayafree, Hugging Face)
A vendor that says it built its own model is making a claim an outsider can now check. The pipeline published on 8 August reads three things the vendor already ships. The architecture fields in the model’s config file give a tuple of five or six numbers. Where that tuple matches an open-weight base exactly, the authors treat it as strong evidence the architecture was adopted rather than designed. The tokenizer check compares vocabularies. The weights check is the one that does not work. Neither measure the authors tried separates continued pretraining from training from scratch, and that leaves the config file and the tokenizer carrying the evidence. They are explicit that building on an open-weight base is legitimate and widespread, so the pipeline reports lineage and not wrongdoing.
Finance: the claim is checkable before the invoice, which makes leaving it unchecked a decision. Buying a model built on somebody else’s base is a reasonable thing to do, and it prices differently from what a vendor implies when it says the work was its own. It also inherits a dependency the vendor does not control, so a licence change or an abandoned base lands on the buyer. The check runs on public files and takes an afternoon. We now run it before recommending a model. Nothing about it needs the vendor’s cooperation, so the useful question in the next procurement is not whether the model was trained from scratch. It is whether anybody looked.
Take the model your organisation pays most for. Find its config file and its tokenizer on the public repository, and compare the shape against the open-weight bases. If neither file is public, you have bought a claim rather than a model.
How we build
How Cursor Router chooses the right model for the task (Connor O’Keefe and Yuri Volkov, Cursor)
Cursor has published how its router picks a model for each turn, meaning each exchange between a developer and the agent. The choice is learned from production traffic rather than from benchmark scores. Cursor built its dataset from live traffic. It inferred performance from what the developer did next, and calculated cost from token usage on that turn. Moving to the next piece of work counts as a positive signal and correcting the agent counts as a negative one. A complexity predictor decides whether a turn is simple enough for a cheap model. Where it is not, a taxonomy learned from the same traffic picks the frontier model. Cursor reports one configuration running above Fable-level satisfaction at 68 per cent lower cost, and another beating Opus 4.8 at 41 per cent lower cost.
Architecture: model choice has stopped being a standard and become a runtime decision somebody else makes. An organisation that named its model in an architecture document held a real control, however crude, because the choice was written down where anyone could read it and the cost followed from it. A learned router probably chooses better than that document did. It also moves the decision inside a product, retrained on traffic the buyer cannot see and repriced on a schedule the buyer does not set. Both things are true at once, and the second is the one nobody writes down.
Find where model choice is recorded in your organisation. If the record is a setting in a vendor’s product rather than a standard you own, work out what your monthly cost does when that router is retrained. You will not be told in advance.
How we assure
Auto mode is now the default in Claude Code for Pro, Max, and Team plans (Anthropic)
Anthropic has measured the permission prompt and published the result. In a controlled study, 1,053 paid testers each met one session in which a clearly dangerous command was swapped into a single prompt. The testers caught it 143 times, or 13.6 per cent. The classifier that replaces those prompts blocked the same command 937 times, or 89 per cent. The surrounding numbers say why. Users approve 97 per cent of permission prompts. They reject 39 per cent of the plans put in front of them. And 62 per cent have at some point bypassed permissions, or told the tool to stop asking about shell commands. From 14 August the prompt stops being the default on the paid individual and team plans. It stays opt-in on enterprise plans and the cloud platforms, so administrators have time to read the change before it reaches them.
Risk: an approval rate of 97 per cent is not a control. The same people reject 39 per cent of plans, so the failure is the shape of the question rather than the diligence of the person. A prompt arrives mid-work, one command at a time, with no view of what the agent is doing or why. A plan arrives first and reads as a decision. That is why it gets argued with. We read every agent policy for that distinction first. Most governance written in the last two years rests on the prompt and calls it human oversight. The number attached to that phrase is now public, it came from the vendor, and it is 13.6 per cent.
Read your own agent policy for the phrase “human approval”. For each place it appears, ask one question: does the human see a plan, or a single command arriving in the middle of somebody else’s work? Everything in the second category is a step your evidence does not support, and you lose it as a default on 14 August.