The second opinion had the same blind spot
A false proof that passed the kernel and then passed the independent checker too, an industry arguing with itself twice in one week, and a cost meter withdrawn by its supplier.
How we organise
Open weights and American AI leadership
Two hundred and thirty-six firms ask the US government not to restrict open-weight models. The case is that openness is itself a safety mechanism, because a closed model can fail in ways outsiders never see.
We tell a client to mark which of its largest AI commitments assume open weights stay available at roughly today’s capability. That is the exposure if the argument goes the other way. Anthropic did not sign, and published its refusal and its alternative: chip controls, and mandatory testing for every capable model, open or closed. Neither side is obviously wrong. Both are argued by people with everything to lose. The class of model they are arguing about is the one most enterprise cost cases assume.
More than 1,300 frontier-lab employees ask their government to back an international effort to pace capability.
Our reading is that the people best placed to know are describing a coordination problem they sit inside, where nobody can slow down alone. Your own commitments divide the same way. Some you control, some move only if the sector moves, and some wait on regulation.
Cost data removed from the usage page
Spend, cost and the CSV cost fields are gone below the enterprise plan. The change is retroactive. Last month’s numbers went with them. One admin reports 30,000 dollars with no breakdown left by user or by model.
We judge cost visibility supplied by a vendor as a feature. Features get removed. The exposure is every tool whose unit economics you know only through somebody else’s console.
More than 80 per cent of the code merged into one codebase in May was authored by the model, against low single digits before. The typical engineer merged eight times as much per day as in 2024. The stated conclusion is that human review has become the bottleneck.
We hold that review capacity is a resource to be planned rather than a courtesy. Most firms have an owner for delivery throughput. Nobody owns review.
Four time scales for a technology
Research runs ten to twenty years to a solid demonstration. Reshaping an economy has historically taken more than fifty, which is a working lifetime rather than a planning horizon.
We read this next to the item above. Both are right. Capability arrives on a two-year clock into institutions that change on a twenty-year one. A capability bet and an operating-model change should not share a review cycle.
How we build
Postmortem for a kernel soundness bug
A false disproof of the Collatz conjecture passed Lean’s kernel, which had dropped a parameter from a generated type. It then passed the main independent checker too, for an entirely unrelated reason. Two bugs, in two implementations, had to line up.
We want to see the list of checks an agent may not edit. Trust has to sit in something small, separately maintained and out of reach of what it checks. An agent that writes the code, the test and the check has produced a second opinion with the first one’s blind spot.
Two modes: diffuse work, when you do not yet know what you want, and leverage on a target already chosen.
Our warning is that greenhouse work produces artefacts. Artefacts read as output. Output gets reported as productivity. That is how a firm reports high adoption and ships nothing.
An agent harness built for organisations
One org-wide posture sets a floor. Narrower scopes may only tighten it, and a predeclared command policy of hard denials holds under all three tiers.
Our position is that this resembles filesystem permissions far more than it resembles a prompt. That puts it in the platform rather than in each team’s instructions, which makes it an architecture decision.
The development pipeline is a production system
For the team building it, the pipeline is a production system. A broken build is an outage.
We treat it as a service with an owner, a restoration target and a route that wakes somebody. A flaky pipeline used to cost developer patience. It now costs throughput on work that is metered by the token, and the bill arrives whether the pipeline was green or not.
Generate candidates at each training step and backpropagate only through the best. The paper reports 6.2 times the sample efficiency. Language models are the one domain tested where it has not yet paid, which the authors volunteer.
We want a date against the inference-cost assumption in every build-or-buy case. Almost nobody writes it down.
The session you cannot take with you
Inference APIs are drifting from portable transcripts towards provider-sealed state. Encrypted reasoning, hosted search whose passages never reach the client, compaction the provider documents as opaque.
We judge the information contract as the client’s to hold. Here the supplier is drafting it. If the reasoning cannot leave the provider, nobody can replay the decision elsewhere or hand it to a regulator.
What a cluster loses below the application layer
Gaps of 8 to 12 per cent between what partners deploy and the vendor’s reference architecture. Every root cause was invisible from the application layer.
We read a tenth of the GPU spend sitting in BIOS settings and environment variables as a larger number than the model choice above it. Most firms have not staffed that discipline. This is vendor marketing, and it is useful anyway.
How we assure
Ten advances, each with a formal proof
Ten problems open for a decade or more, resolved or advanced by an internal model. The formalisations are published, so a reader can check them.
We hold that a firm needs its own attribution rule long before a regulator asks for one. Work goes out under people’s names already part-generated. Formalisation is the strongest verification anyone has, and this same week it was demonstrably unsound in two implementations at once. Strongest is not sound.
Deprecating obsolete key exchange in TLS 1.2
Finite-field Diffie-Hellman and RSA key exchange are deprecated, and static ECDH suites discouraged. It updates seventeen existing RFCs.
We put this here because it has nothing to do with AI at all. Every firm rewriting its priorities around agents still runs long-lived TLS 1.2 endpoints, and has DTLS embedded in something nobody has opened for years. The compliance backlog does not pause while the industry argues about open weights. The inventory is usually harder than the remediation.
A security agent that runs at publish time
It scans for broken access control, exposed secrets and gaps in business logic, then applies fixes in one pass.
Our test is where the authoritative gate for agent-written code sits. A fix applied inside a publishing tool is no evidence that your pipeline saw the defect.