The reasoning was not sealed
How we organise
Introducing Grok Bot (SpaceXAI)
SpaceXAI opened Grok Bot to subscribers on 11 August, in beta. Each agent gets its own computer in the cloud, then signs into the tools an organisation already runs and works across them the way a person does. The announcement is explicit that this covers tools with no usable API. Agents are meant to finish a job end to end and come back only when something needs approval. Inside SpaceXAI the company describes a sales agent writing call notes into the customer record, and an ops agent handling invoices that arrive by email. An engineering agent reproduces a bug and files the ticket. Staff run several agents at once, with one agent managing the others.
Structure: an agent that signs in sits inside your access control, not inside a vendor’s API scope. Those are different boundaries. When work reached a system through an API, someone granted a scope, and that scope was the limit of what could go wrong. An agent working the interface holds a sign-in instead, and a sign-in carries everything the person behind it could reach. An agent gets its own account here, and its own trail. An organisation that lends an agent a person’s credentials has an agent it cannot tell apart from that person.
Take the three systems in your organisation that people still work by hand because the API is poor or absent. Those are the systems an agent will reach by signing in. Write down whose account it would use, who reads that account’s activity, and how often.
How we build
Nemotron 3.5 Lightning (NVIDIA)
NVIDIA published Nemotron 3.5 Lightning on 11 August with its benchmark table on the model card. The model has 30 billion parameters, is built for long-running agents, and scores 81.94 on MMLU Pro, a broad test of general knowledge. On a banking benchmark, which asks an agent to complete a customer’s banking task against a simulated bank, the same model scores 9.28. NVIDIA measured these numbers under its own harness. It says they may differ from what other vendors report.
Engineering: one model produced 82 and 9 on one table, and which of those two numbers reaches a buyer depends entirely on who is selling. General knowledge is not the work. A customer’s banking task only counts as done when every step of it is done. A number in single digits means the agent almost never finishes the job. The vendor published both, which is to its credit, and the deck built from it will carry one. We choose the benchmark nearest the work before we look at any model, and we expect that number to be lower and duller than the headline.
Take the strongest number in the last vendor deck someone sent you. Find that model’s card and read the row closest to the job you actually have in mind. If no such row exists, the absence is your answer.
How we assure
Stealing Reasoning Traces from Proprietary LLM APIs (Alexander Panfilov, David Schmotz, Ilia Shumailov and others)
Anthropic, OpenAI and Google all return a model’s reasoning to the client as an encrypted trace, which the client sends back when the conversation continues. The researchers show these traces are portable. Injected into a weaker model from the same provider that has been jailbroken, meaning talked out of its own restrictions, the trace yields the stronger model’s reasoning in plaintext. The stronger model is never attacked. They then collected 6,708 agent trajectories from public repositories that still carried encrypted traces, and decoded 315,320 reasoning traces out of them. From genuine user sessions they recovered 704 distinct private items, and 64 of those appear only inside the reasoning and nowhere in the visible session.
Security: the reasoning is data your organisation is holding and cannot read. It was easy to assume the encrypted trace was a sealed internal detail of the provider, discarded after the turn. It is neither sealed nor discarded, and it travels wherever the transcript travels. Every agent trajectory kept for audit, every session attached to a bug report, every log shipped to a vendor, carries reasoning a third party can decode. We now class stored agent transcripts as sensitive data by default, at the same level as the systems the agent touched.
Search your repositories and issue trackers this week for stored agent transcripts. Any that still carry the encrypted reasoning field should be handled as material you have already published.