The reasoning was not sealed
Agents that sign in rather than call an API, one model scoring 82 and 9 on the same table, and encrypted reasoning read back in plaintext.
How we organise
SpaceXAI gives each agent its own computer
Every agent gets a machine in the cloud, signs into the tools an organisation already runs, and works across them the way a person does. The announcement is explicit that this covers tools with no usable API. Agents come back only when something needs approval.
We tell a client that an agent which signs in sits inside its own access control, not inside a vendor’s API scope. A granted scope was the limit of what could go wrong. A sign-in carries everything the person behind it could reach. Here the agent at least gets an account and a trail of its own.
How we build
NVIDIA’s own table, two numbers apart
The model scores 81.94 on a broad test of general knowledge. On a benchmark that asks an agent to complete a customer’s banking task against a simulated bank, it scores 9.28. Both figures are on the model card, measured under NVIDIA’s own harness.
Our position is that you pick the benchmark nearest the work before you look at a model. General knowledge is not the work. A banking task counts as done only when every step is done, and a single-digit score means the agent almost never finishes. The vendor published both.
How we assure
Reasoning traces read back out of the encryption
Three providers return a model’s reasoning as an encrypted trace that the client sends back to continue. Those traces are portable. Fed to a jailbroken weaker model from the same provider, they come back in plaintext. From public repositories the researchers decoded 315,320 of them.
We judge stored agent transcripts as sensitive by default. The reasoning is data a firm holds and cannot read, and it travels wherever the transcript goes: an audit record, a session on a bug report, a log shipped to a vendor. Of the private items recovered, some appear nowhere in the visible session.