The second opinion had the same blind spot
How we organise
Open Weights and American AI Leadership (Microsoft, and the same letter hosted by NVIDIA)
The letter asks the US government not to restrict open-weight models, and argues that open weights are how AI reaches the rest of the economy. Its case runs in three parts. Startups, universities and public institutions can build on advanced models without training one from scratch or paying frontier prices for every task. Competition across models, chips and applications keeps the gains from concentrating in a few hands. An organisation that can run and adapt a model itself is not locked to one provider. It concedes real and distinct risks, because released weights are beyond their developer’s control and modified versions are hard to trace. Its answer is that prohibition would leave defenders without capabilities the attackers already have. Openness is itself a safety mechanism, it argues, since a closed model can be breached, misused, or fail in ways outsiders cannot detect. Four asks of policymakers: expand compute access for startups and researchers, invest in shared datasets, tools and evaluation frameworks, avoid premature restrictions that drive innovation overseas, and stop conflating distillation with unlawful extraction. Microsoft records more than 230 signatories as of 30 July, and the hosted PDF, dated 24 July, lists 236, Amazon, Google, Meta, Microsoft, NVIDIA and OpenAI among them.
Structure: Anthropic did not sign, and published its refusal. It accepts that open weights expand access and give customers control. It rejects the claim that they necessarily make safeguards easier, or help defenders more than attackers. In their place it proposes chip controls, a crackdown on industrial-scale distillation, and mandatory safety testing for every sufficiently capable model, open or closed. So the industry is now arguing in public about the future availability of a whole class of model, and it is the class most enterprise cost cases quietly assume. Neither side is obviously wrong, and both are argued by people with everything to lose.
Take your three largest AI commitments and mark which of them assume open weights stay available at roughly today’s capability. That is your exposure if this argument goes the other way.
The statement says capability development is accelerating beyond our ability to understand or control the resulting systems, and that the world lacks the technical and governance tools to pace frontier-wide progress deliberately. It asks one thing: that the US government support an international effort to build those tools. Over 1,300 employees of the frontier labs have signed, read this morning at 1,337, and the named signatories include Amodei and Kaplan of Anthropic, Pachocki of OpenAI, Legg of Google DeepMind and Sutskever of Safe Superintelligence.
Structure: the people best placed to know are describing a coordination problem they are inside, where competitive pressure prevents anyone slowing unilaterally. Read next to the open-weights letter, the same week produced two industry statements pointing in opposite directions, both signed by senior people at the same firms. Your own AI commitments divide the same way: some you control, some move only if your sector moves, and some wait on regulation.
Sort them into those three piles, then name who represents your firm in the rooms where the second and third get argued. Where no name comes back, you are accepting the sector’s decisions as given.
Usage page to token amount, what? (Cursor community forum)
Cursor has removed cost data from the Usage page and from the API for every plan below Enterprise, and staff confirmed it on the record in this thread. The Spend metric, the Cost column and the CSV cost fields are gone for self-serve plans, Teams included. The change is retroactive. The rule runs when records are read, so last month’s numbers went with them. One Teams admin reports 30,000 dollars of spend this cycle with no breakdown left by user or by model.
Finance: the fastest-growing line in most engineering budgets has just lost its meter, withdrawn by the supplier with no migration path and no notice. Cost visibility a vendor supplies is a feature, and features get removed. The exposure is not this tool; it is every AI tool whose unit economics you know only through somebody else’s console.
Ask your finance team for last month’s AI spend by team and by model, drawn from your own records. If the only source is a vendor dashboard, you have found the gap.
When AI builds itself (Anthropic Institute)
More than 80 per cent of the code merged into Anthropic’s codebase in May 2026 was authored by Claude, up from low single digits before Claude Code’s February 2025 preview. The typical engineer merged eight times as much code per day in Q2 2026 as in 2024. On a fixed training-code optimisation task the speedup went from about 3x in May 2025 to about 52x in April 2026, where a skilled human takes four to eight hours to reach 4x. Its own conclusion is that human code review has become the bottleneck, reached through Amdahl’s law applied to the org chart. In a footnote, Anthropic records that its leadership has said 90 per cent in public where the instrumented figure is over 80, and puts the gap down to holes in attribution.
Talent: if review is the constraint, then review capacity is a resource to be planned rather than a courtesy engineers extend each other between their own tasks. Most firms have an owner for delivery throughput and nobody at all for review throughput.
Measure how long a change currently waits for a reviewer, and write the number down before your next agent rollout rather than after it.
Four Time Scales for Technology Development and Deployment (Rodney Brooks)
Brooks separates four things people collapse into one: research ideas, hype, deployment at scale, and the reshaping of an economy. Research runs ten to twenty years before a solid laboratory demonstration. Even software with no marginal cost has usually needed twenty years to scale, and his deployment case is Waymo, licensed for roughly 4,000 vehicles in San Francisco. Reshaping an economy has historically taken over fifty years of continuous deployment, which is a working lifetime rather than a planning horizon.
Structure: set him against the Anthropic paper and neither is obviously wrong, because Anthropic is measuring the first two scales and finding they collapse, while Brooks is saying nothing has ever compressed the fourth. We think both are right, and that capability arrives on a two-year clock into institutions that change on a twenty-year one. A capability bet and an operating-model change are different kinds of commitment and should not share a review cycle.
Take your three-year plan and mark each commitment with the scale it assumes. The ones nobody can classify are the ones to look at first.
How we build
Postmortem for Kernel Soundness Bug #14576 (Leonardo de Moura)
On 25 July, Ramana Kumar published a disproof of the Collatz conjecture, produced with AI assistance and sorry-free, which in Lean means it admitted no gaps. The proof was wrong. Lean generates an auxiliary type for every nested inductive type, the bug dropped phantom parameters from that generated type, and a dropped parameter is never type checked. It was fixed an hour after it was reported, and de Moura is careful to call it a bug in one implementation rather than a hole in the meta-theory. The same proof then passed nanoda, the main independent external checker, for an unrelated reason. Nanoda did check the case Lean’s kernel had missed, but not the type name in a projection node. His verdict is that independent checking survives, because defeating it took two distinct bugs in two implementations, and that anyone relying on it needs current versions of both. He then refuses the fix people proposed, which was to restrict metaprogramming. The elaborator is untrusted by design, and soundness cannot rest on an untrusted component choosing not to build a bad term.
Engineering: your coding agent is that elaborator, and the careful instructions you wrote for it are the restriction he refused. Trust has to sit in something small, separately maintained, and out of reach of whatever it checks, which is the opposite of how most agent harnesses are being assembled. An agent that writes the code and the test and the check has produced a second opinion with the same blind spot as the first.
Ask for the list of checks your agents may not edit. If nobody can produce one, the agent is marking its own work.
The Greenhouse and the Lens: Two Modes of Agentic AI Work (Aaron Brethorst)
Greenhouse mode is for work where you do not yet know what you want: diffuse, cheap, judged afterwards. Lens mode is leverage on a target you have already chosen, where the agent proposes ten things and you throw away nine. Brethorst argues that neither is the senior skill, and that the senior skill is knowing which mode the work needs and noticing when you have drifted. His example of drift is that you sit down to ship a feature and forty minutes later the agent is scaffolding an admin panel nobody asked for.
Engineering: greenhouse work produces artefacts, artefacts read as output, and output gets reported as productivity. That is how a firm ends up reporting high adoption and shipping nothing, which we have now watched happen more than once.
For one week, label each piece of agent work greenhouse or lens before it starts. Then count what the greenhouse work ruled out. That, and not the artefacts, is what it was for.
qm (yc-software)
An agent harness built for organisations rather than individuals, MIT licensed, and the governance model is the reusable part. One org-wide security posture sets the floor and narrower scopes may only tighten it. Three tiers: Strict pauses every tool call for approval, Auto runs a classifier over provenance-labelled external data, and Dangerous screens nothing. Underneath all three sits a predeclared command policy with hard denials for recursive deletes and destructive SQL, which applies in every posture, Dangerous among them. Each person and each room gets scoped memory, files, keychain view, permissions, crons and sandbox, and the core is agnostic about which harness sits on top.
Architecture: whether this project survives is beside the point, because somebody has written down what permissioning looks like at org scale, and it resembles filesystem permissions far more than it resembles a prompt. That places it in the platform rather than in each team’s instructions, which makes it an architecture decision rather than a tooling preference.
Find out where your agent permissions are actually set, and whether any team can loosen them locally. One deny list that nothing below it can weaken is the thing to aim at.
The development pipeline is a production system (Jerry Orr)
Short and unglamorous. For the development team the pipeline is a production system, so a build that will not compile is an outage and ought to be triaged as one. Orr notes that manufacturing and SRE both have mature escalation, and that almost all of it points at the service delivered to customers rather than at the people building it.
Engineering: put it beside the Cursor item and the pattern shows. A flaky pipeline used to cost developer patience; it now costs throughput on the thing you meter by the token, and the bill arrives monthly whether the pipeline was green or not. That makes it a service with an owner, a restoration target and a route that wakes somebody.
Look up the time-to-restore on your last red build. A build nobody timed is a build nobody owns.
Explorative Modeling (Alexi Gladstone, Heng Ji, Yilun Du)
A claimed third scaling axis for pretraining, alongside parameters and data, which the authors call generative expressivity. Training generates K candidates at each step and backpropagates only through the best match, moving factorisation out of inference and into the training loop. They report 6.2x sample efficiency, 4.1x FLOP efficiency and 47 per cent better parameter efficiency, with 1.43 FID on ImageNet 256 without guidance. End-to-end variants match Diffusion Policy on behaviour cloning in a single forward pass rather than 100. The gains widen with scale instead of saturating: 7 to 36 per cent with data, and 13 to 23 per cent with parameters. Autoregressive LLMs are the one domain tested so far where exploration has not been an immediate win, which the authors volunteer in the post rather than burying.
Architecture: nothing in your estate changes this quarter because of this paper, and that is why it is worth two minutes. Every build-or-buy case your architects are writing rests on an assumed cost curve for inference, and almost nobody writes that assumption down where it can be revisited.
Find the inference cost assumption in your current build-or-buy case and put a date against it. Then a third scaling axis turning out to be real is a review you can run rather than an argument nobody can settle.
The Session You Cannot Take With You (Earendil Engineering)
Inference APIs are drifting from portable transcripts towards provider-sealed state: encrypted reasoning, hosted search whose passages never reach the client, opaque compaction, encrypted messages between agents. Against the providers’ own documentation it holds up. OpenAI’s Responses API stores responses by default for at least 30 days, and Gemini’s Interactions API defaults to store true, retaining for 55 days on paid tiers. OpenAI documents its compaction item as opaque and not intended to be human-interpretable, where Anthropic’s returns a readable content field. It reads as an essay about API design, and the argument underneath is about lock-in.
Architecture: Build governs the information contract, and this is that contract being drafted by your suppliers rather than by you. If the reasoning trace cannot leave the provider, you cannot audit the decision or replay it elsewhere. You also cannot hand it to a regulator who asks.
Pick one completed agent run and rebuild it from your own logs alone: the prompt, the passages it retrieved, the reasoning, the tool calls. Most teams we work with have never tried. We find the gap is usually in what they never captured rather than in what the provider withholds.
Exemplar Cloud: Lessons for Unlocking Full Performance on AI Infrastructure (NVIDIA)
NVIDIA reports routinely seeing gaps of 8 to 12 per cent between what partners deploy and its own reference architecture, on the same workload, model and global batch size. Every root cause in its four case studies is invisible from the application layer. A GB200 VM running DeepSeek-V3 ran 12 to 14 per cent slower than bare metal, with 24 per cent of CPU cycles traced to an ARM SMMU command queue path. An H100 cluster lost 12 per cent to BIOS C-states pinned at C1 and NUMA misbinding. A GB300 cluster recovered a 31 per cent gap at 512 GPUs by moving one NCCL queue-pairs setting from 1 to 4, and a B200 container lost between 13 and 53 per cent because a topology file never propagated inside enroot.
Engineering: this is vendor marketing and it is useful anyway. If a tenth of your GPU spend sits in BIOS settings and environment variables, that is a larger number than the model-selection decisions being agonised over above it. It also belongs to a discipline most firms have not staffed.
Get the measured gap between your cluster and the vendor reference architecture, and find out when it was last taken. A platform nobody has measured is a platform nobody has tuned.
How we assure
Ten advances in mathematics and theoretical computer science (OpenAI)
Ten results, on problems open for at least a decade, run across high-dimensional geometry, coding theory, arithmetic circuit complexity, group theory, operator algebras, quantum complexity, lattice cryptography and extremal combinatorics. They include a disproof of Connes’s rigidity conjecture and resolutions of Erdős problems 146, 180 and 183. An internal version of Astra produced them, and finding all ten would cost roughly 2,000 dollars at Sol API rates. OpenAI states that claiming human authorship for a proof an AI system generated would misrepresent both the system’s contribution and human intellectual work. It takes responsibility for correctness, and says plainly that the system generated the arguments.
Ethics: the position is right, and it was taken voluntarily, ahead of any norm requiring it. Your firm will need the same rule long before a regulator asks, because work going out under your people’s names is already part-generated. OpenAI also published Lean formalisations, which is the only reason a reader can check any of it, and formalisation is the strongest verification available to anyone. This week it was demonstrably not sound in two implementations at once. Strongest is not the same as sound.
Take one thing you shipped last month and decide in writing how it would be attributed under a rule of your own. When is authorship claimed, when is contribution disclosed, and who signs for correctness either way?
RFC 10015: Deprecating Obsolete Key Exchange Methods in TLS 1.2 and DTLS 1.2 (IETF)
Standards track, published this month. Finite-field Diffie-Hellman and RSA key exchange are deprecated in TLS 1.2 and DTLS 1.2, and static ECDH cipher suites are discouraged. It updates seventeen existing RFCs, which is a fair measure of how much estate it touches. The scope is deliberate: 1.0 and 1.1 were deprecated already, and 1.3 either avoids these algorithms outright or hides the configuration from whoever deploys it.
Security: none of this has anything to do with AI, which is exactly why it is here. Every firm rewriting its engineering priorities around agents still runs long-lived TLS 1.2 endpoints and has embedded DTLS in something nobody has opened for years. This is dated work rather than a position to hold, and the compliance backlog does not pause while the industry argues about open weights.
Ask for the inventory of endpoints still negotiating these key exchanges, with an owner against each. We usually find the list is the hard part rather than the remediation.
Security audit on publish (Bolt.new)
A security agent runs at publish time, scanning for broken access control, secrets left in code and gaps in business logic, then writing and applying fixes in one pass. It takes two to three minutes per app, it is free, and Bolt absorbs the token cost. Every figure is attributed rather than asserted. Veracode is cited for the roughly 45 per cent of AI-generated code that introduces vulnerabilities. Endor Labs is cited for agents picking safe dependencies 20 per cent of the time alone against 57 per cent with tooling in the loop, and Georgia Tech for 74 confirmed vulnerabilities traced to AI-generated commits. Bolt frames its own tool as a first pass rather than a replacement for the security tooling in your CI/CD.
Security: a vendor understating its own product, with citations, in a category where nobody does. Your own estate has to answer where the authoritative gate for agent-written code sits, because a fix applied inside a publishing tool is not evidence that your pipeline ever saw the defect. The Georgia Tech trend is worth separating from the product it appears in: six confirmed vulnerabilities a month in January had become thirty-five by March, which is not a plateau.
Name the one gate that agent-written code must pass, then check that it actually runs on the commits your agents author.