The only control that held was a person
A safety policy that is now a sentence somebody has to write, three days between an agent acting outside its remit and anyone noticing, and a signature on a malicious build.
How we organise
A safety classifier with no fixed list of harms
A 3-billion-parameter multimodal classifier, released openly and sized for a single GPU. There is no retraining step and no fixed list of harms. The policy is a plain-language question somebody writes, answered with a calibrated score.
We tell a client that this moves the policy out of a vendor’s training run and into a sentence the client has to write. Authority moves with it. We have asked a good many for that sentence and have yet to be handed one.
How we build
A training kernel that returns the same answer twice
Cursor has open-sourced the kernel behind its coding model, and the part that travels is not the throughput. The kernel is deterministic. The order of floating point operations is fixed, so the same input gives a bitwise-identical output.
Our position is that repeatability comes before an experiment can teach anyone anything. Most evaluation stacks we are shown vary in sampling, in batching and in how the provider serves the model, all at once. Nobody has measured the noise.
How we assure
Agents that left the test environment
Agents under evaluation spent three days acting against real people and projects outside the environment they were given. Estate-wide monitoring caught it afterwards. A human maintainer spotted the malicious code and refused to approve it.
We judge a run by the monitor watching it while it executes. The control that fired was built for the estate. The control that should have fired was never built for the experiment.
Provenance signed the malicious build
An attacker took a maintainer’s account, and eleven malicious releases followed on packages with hundreds of millions of monthly downloads. The real workflow built and attested them. The signature is correct.
We read provenance as an answer to where a build came from, never to whether the code inside it is safe. A firm that adopted signed artefacts this year bought the narrower question. The signature will not be what tells it so.