The evidence had to exist already
How we organise
99% of my website traffic is bots (PatronView)
The operator of a donor-research database instrumented a week of his own traffic. His server served 1.28 million pages. His visitor statistics recorded 5,977 pageviews. That is about 214 unseen loads for every visible one. He blocked one retailer’s AI crawler after measuring it at 117,000 pages a day, with not one visitor referred back. Another vendor’s crawlers he measured at 35,000 crawls per referred visitor. He now judges a crawler by one measure, which is pages taken per visitor returned.
Finance: an organisation meets the cost of AI twice, and it has a number for only one of them. The cost of running your own agents arrives on an invoice. The cost of serving everybody else’s arrives as capacity. It stays invisible, because analytics only count a visitor who runs the script, and a crawler never does. We have watched organisations cost one side of that line and ignore the other. That gap is the difference between what your infrastructure does and what your organisation believes it does.
Put one week of server logs beside one week of analytics. Pages served against recorded pageviews is a number your finance function has never seen. It takes an afternoon.
How we build
GLM-5.3: frontier coding with emergent cyber capabilities (Z.ai)
Z.ai has released GLM-5.3 and calls it the most capable open-weights model for coding. It then says something vendors rarely say. Cyber capability developed faster than the company expected. The gains are largest in exploiting a vulnerability rather than in finding one. On CyberGym, which tests whether a model can find and confirm a vulnerability, it scores 84.5 per cent against 77.2. So the weights are being held back. They arrive in two weeks, once safety evaluation is complete.
Architecture: an open-weights model has always been the dependency you could plan around. Nothing sat between the announcement and the model arriving. A gate now sits there, and a safety evaluation decides when it opens. Two weeks is a short delay and that is not the point. An architecture that assumed weights arrive when a model is announced now depends on somebody else’s judgement about capability. No roadmap we have reviewed records that dependency.
List the models your roadmap assumes you can run yourself. Beside each one, write what you do if the weights arrive late. Every blank is a dependency nobody has costed.
How we assure
Shared AI Findings Exchange, draft proposal (Open Secure AI Alliance)
The draft is open for comment and it is short. A member would agree to report an incident whenever an agent it operates reaches into somebody else’s systems without permission, or escapes the boundary it was given. Intent does not decide whether an incident is reportable. Believing an environment was simulated may explain one, the draft says, but it does not remove the duty to report it. The deadlines are ordinary. The affected organisation hears at once, and a confidential report follows within four business days. The harder clause is the next one. A member must preserve the evidence a full investigation needs, including the prompts, the tool calls, the agent identities and the credentials that were live during the run. A near miss counts too.
Risk: the deadlines are the easy half. An organisation can write a report in four days, and the clock starts only once something has already gone wrong. The evidence list cannot be met on the day. Every item on it had to be captured while the agent was running normally, by whoever configured logging months earlier, who was not thinking about an investigation. Most agent logging we see keeps the conversation and discards the authority under which each action was taken. An organisation that cannot say which credentials were live during a run will probably not reconstruct what happened. What it agreed to report makes little difference.
Take an agent run from last week. Try to produce those four things from what you kept. Whatever you cannot produce is your gap, and an incident is too late to close it.