At 02:14 this morning, the agent that writes my overnight AI brief filed this line: "Stanford 2026 AI Index - Stanford HAI's annual report is out."

So I did the usual. I made coffee, opened a blog folder, pulled the PDF and started reading. I'd written the first heading before I thought to check the release date. April 13. The brief was six months late and entirely sure of itself.

I'll admit the next part stung a bit. The report my agent announced as news spends pages measuring how reliable agents are. Nobody at Stanford asked for a live demo.

There was no new report to write about. But six months is a useful gap. It's long enough for a forecast to meet reality and short enough that everyone still quotes it. So instead of a summary nobody needs, here's a check: what the Index said in April, what's happened since, and which claims held. I've also weighted it toward biopharma, because that's where the frontier labs spent the summer.

Why the mistake is on topic

The 2026 AI Index has good news on agents. On OSWorld, a test where an AI has to operate a real computer to finish a task, the best systems went from about 12% to 66.3% in a year. Humans score 72.35%. That's close, and it still means the agent fails about one task in three.

My agent's failure was the plausible kind. It had a real link to a real report, and the only wrong thing was the date. The item resurfaced in an AI newsletter months later with no publish date, the Stanford page has no date metadata, and my pipeline only ever asked "have I seen this link before", never "how old is this". A model reading chatter can't tell "people are talking about it" from "it just came out". To be fair to the model, plenty of people can't either.

The Index has its own version of this problem. It reports invalid-question rates on popular benchmarks of up to 42% on GSM8K, a widely used grade-school math test. Read the paper behind it and that 42% is the share of questions a detector flagged that experts confirmed were flawed, not the share of the whole test. That's plenty to blur a leaderboard, and it's a tidy example of a number losing its denominator. Keep that in mind for the next section, because some of April's rulers have already been retired.

A number that loses its denominator looks exactly like a bigger number.

The scorecard

I pulled twelve claims from the report and checked each against what's been published since. Nearly every number below traces back to a primary source, a few needed correcting on the way, and everything is as of this week.

What held

The US-China gap stayed closed. In March the top US model led the top Chinese model by 2.7% on Arena, a public head-to-head leaderboard where people vote on which answer is better. In October, a Bloomberg Intelligence note put the gap at about 3% on LiveBench after DeepSeek's latest release. Different scoreboard, same story: the gap is in single digits.

The open-versus-closed gap reopened, and it's stayed open. "Open weights" means you can download the model and run it yourself. The Index said the best closed models led the best open ones by about 3% in March, up from 0.5% in August 2024. On Artificial Analysis's revised index, which uses a different scale, the best open model you can actually download today trails the leader by 26 points. Kimi K3.1 Pro would roughly halve that, but its weights aren't out yet. A promised release isn't a downloadable one. Different instruments, so read it as direction, not a trend line.

Entry-level software jobs kept shrinking. The Index cited Stanford research showing employment for software developers aged 22 to 25 was close to 20% below its 2022 peak. HAI's labor dashboards this month show jobs in AI-exposed roles down more than 4% this year, and young workers in those roles down over 3% a year since ChatGPT launched. Different baseline, same direction.

What sped up

The benchmarks are dying faster than the report could print them. April's chart had the best models near 77% on SWE-bench Verified, a test of whether a model can fix real bugs in real code. By Vals AI's last run on September 1 the top model hit 97%, and Vals now lists it as an archived benchmark because performance has saturated. The ruler April used to show progress is now in a drawer.

Bioinformatics went the same way. The Index said frontier models scored roughly 17% on BixBench, a test of real-world biological data analysis. A third-party preprint in May reported 84% to 98% on a verified 50-question subset when the models had scientific skills and tools. Part of that jump is a cleaner exam, since the curation removed ambiguous questions, but the 17% is already a historical figure.

The money got bigger, and so did the accounting. The Index counted $285.9 billion of US private AI investment in 2025. Crunchbase puts global venture funding at $679 billion for just the first three quarters of 2026, the highest on record. AI took $102 billion of the $159 billion raised in Q3. Everyone else split the change.

Then Anthropic filed to go public. The S-1 shows unaudited first-half revenue of $16.3 billion, up from $1.2 billion a year earlier, and a net loss of $80.7 billion. That loss is on the books and mostly beside the point: $72.4 billion of it is a non-cash revaluation, mostly of convertible notes, which went up because Anthropic's own valuation went up. The operating loss was $693 million. It's the most expensive-looking way I've seen to report that things are going well.

The FDA count moved, and it's the same bug as my brief. The Index says 258 AI-enabled medical devices were authorized in 2025. The FDA's own list now shows 335 for the year. Neither is wrong. The report's body says its count runs through September 2025, and the highlight dropped the date range. Count the FDA list by decision date and January to September gives 259, while the full year gives 335, up 43% on 2024's 235. A correct number with its date stripped off is exactly what my agent served me at 02:14. I'm finding that oddly comforting.

What the labs did with biology

I care most about this part of the report, and it's moved the most since April. The Index's science chapter made two points. AI can propose, but the wet lab still has to confirm. And in biology, small specialist models often beat big general ones: a 111-million-parameter model tops ProteinGym, a protein-function benchmark, and a 200-million-parameter genomics model beats a 40-billion-parameter one on several tasks.

Then both frontier labs walked straight into biology.

Anthropic went into the lab. In September roughly 950 Claude agent sessions mined more than 200,000 reverse transcriptases, a single enzyme family, and one run flagged a new genetic system in a phage. The lab has confirmed the region is transcribed, and nobody yet knows what it does. I wrote up how they found it, including the uncomfortable bit that ten identical reruns missed it. Anthropic also reports protein binder designs hitting nearly 50% across 12 targets, tested by two outside organizations, against the 10% to 15% it calls typical. That's self-reported, but it's a general model producing lab-confirmed output. Awesome, and a little humbling for those of us who spent years fighting for every point of hit rate.

On Tuesday it published early results from six drug-development partners and said it has acquired Mithril Medicine. Read past the antibody counts and the line that matters is Anthropic's own: "so far it is mostly preclinical." The earliest it expects a drug to be ready for human trials is late 2028, and only if that candidate keeps holding up. The part of this I like most is that the company with the most reason to leave that line out wrote it anyway.

OpenAI built a specialist. Rather than lean on its mainline model, OpenAI shipped GPT-Rosalind, a purpose-built life sciences model, available only to vetted organizations. At its April launch OpenAI said it beat its then-current general model on 6 of 11 lab-research tasks, a vendor benchmark that's now six months old. Then this month OpenAI bought Orchestra Bio, whose platform coordinates the operations side of drug development. That's a model vendor turning into a platform.

So did small beat big? It depends on the job, and the answer is more useful than a yes or no. On predicting what a protein mutation does, the specialists still win at the top. A July preprint from the Marks and Church labs, built from ProteinGym assays, found the best general model scored about level with a 650-million-parameter protein model, ahead of roughly half of 95 published predictors and well behind the best specialist. Giving it more thinking time narrowed the gap and didn't close it.

On running the analysis, the general models have overtaken April's numbers. They're increasingly the thing that drives the specialist tools: Anthropic's binder results came from Claude operating open-source protein design models, not replacing them. I made a version of this argument in April in The Specialists Are Coming for the Generalists, and six months on I'd sharpen it.

The generalist is the operator. The specialist is still the instrument.

The cost has moved too. When Claude designed 318,000 antivenom proteins in 64 hours, 17 of the 211 that were tested passed the lab's binding bar, and the wet-lab work took two months and cost about three times the compute. Design got cheap. Nothing after it did.

The clinic hasn't moved yet. Insilico's rentosertib, with an AI-picked target and AI-designed chemistry, started Phase III in pulmonary fibrosis in September. It's the first real clinical test of April's caveat, and the registry's primary completion estimate is October 2029. Meanwhile the Index's sharpest medical number stands untouched: of AI devices with clinical studies, only 2.4% had randomized controlled trial data. I found no clinical outcome data in either frontier lab's announcements from the past six months.

If you run an R&D team, that's where I'd put the money. The model is the cheap part now. Assay data, wet-lab throughput and validation design are what decide whether any of this reaches a patient.

Too early to call

Inference cost is falling, and I couldn't find a clean, well-sourced number for how fast, so I'll leave it at that. Talent flows were one of the Index's starkest charts, with AI researchers moving to the US down 89% since 2017. A Stanford follow-up exists behind a paywall, and I haven't read it. Given the theme of this post, I'm not quoting a study I haven't opened.

What I changed in my agent

Back to 02:14. I didn't fix the brief by telling the model to be more careful. I fixed it by checking the thing it linked to.

There's now an age check in code that runs before the model sees anything. It looks for a date in the link itself, then in the page's metadata, then at the first time the story showed up in my earlier feeds. Anything older than 14 days gets dropped.

I re-ran it against last night's 110 items. It dropped seven. One was the AI Index, which first appeared in my feeds on June 16. The others were a 2025 METR paper, two Microsoft Research papers from last year, an April survey and a software release note that was 17 days old. Plus a blog post from 2011, which I can only assume was having a moment. The fresh stories from the same night still got through.

I'd only noticed one of the seven. The other six would have read as news, and I'd probably have believed them.

I'm not mad at the agent. It did exactly what I built it to do, which turns out to be the problem with most of the agents I build. It read the room, and the room was six months behind. The fix wasn't a smarter model. It was one boring question, asked in code, before the smart part ran: how old is this?

That question runs through the whole scorecard. The retired benchmark, the FDA count, the S-1 loss that's mostly paperwork. Most of the numbers April printed were true when it printed them. What goes stale is the when, and a number with its date stripped off looks exactly like a new one.

The next Index lands around April 2027. My agent will tell me it's out, and this time it'll be right.

I'll check the date anyway. We're working on trust.

If your Mac updated to macOS 27 this fall, a language model came with it. You didn't ask for it. Apple downloads it automatically the next time you're online, and this year there's no switch to say no. MacRumors found a little over 20GB of storage handed to Apple Intelligence on one Mac mini, and a reader reported 30GB on theirs. So whatever else is true, you're already paying the rent on its desk.

Most people I talk to have no idea they can use it directly. You've had ChatGPT or Claude open in a tab all year. This one sits inside the operating system. Type fm in Terminal, accept a license once, and it answers offline, for free, without a word leaving the machine. If your company has moved its Macs to macOS 27, they have one too.

Here's what I found. Across five kinds of ordinary office work, Apple's built-in model scored 56 out of 100. A free open model called Qwen3.5-4B scored 70 on the same Mac. Claude Haiku, a paid cloud model, scored 77. On reading receipts from a photo, the free open model beat Apple's by more than two to one and matched the paid one.

So I did what you'd do with any new hire who shows up without being asked for. I interviewed it.

The junior from June

Back in June I wrote that Apple rented its brain. Apple reportedly used Google's Gemini as a senior expert, had it teach a much smaller model, then shipped the small one and sent the senior home. I called the small one the junior. This is the junior.

Apple is clear about what it hired the junior for. Summaries, tagging, pulling fields out of text, sorting things into categories. Not trivia, not math, not long reasoning. So that's what I tested.

I didn't ask it to write code or explain quantum physics. I asked it to do the paperwork.

It also has a short attention span. Apple documents the context window at about 4,000 tokens, roughly six pages. Mine held a little over 8,000, and other people have measured different numbers on different Macs. Either way, the 40-page contract isn't going in.

I'd love to tell you exactly which junior I interviewed, but Apple doesn't say. Its third-generation models come in two on-device sizes, and MacRumors reports that newer Macs with 12GB or more of memory get the larger one. My M4 mini qualifies, so the candidate may have been the bigger sibling. Apple declined to comment, in the sense that it never says.

The interview panel

Apple's junior. Free, already in the building, zero setup.

Qwen3.5-4B. An open model from Alibaba's Qwen team. Free to download, licensed for commercial use, about 3GB, and it reads images as well as text.

Claude Haiku. The outside consultant, paid by the job. It's there to set the bar, not to get hired.

Three other small open models also sat the interview. None of them could read a photo of a receipt, which was the job I cared about most, so they get this one sentence.

Everyone ran on the same 16GB Mac mini in my house, and each candidate did 150 of each of these: expense receipts from a photo, pulling names and companies out of news sentences, sorting bank customer messages into 77 categories, one-line news summaries scored blind, and following fussy instructions like "exactly three bullets, no commas."

Before anyone walked in, I wrote down the hiring rule. A challenger had to beat Apple's junior by at least 5 points, return clean structured answers at least 95% of the time, and not sit on more than 2GB of memory while idle. Otherwise Apple keeps the job on convenience. I write the rule first because I've watched benchmark numbers fall apart on a real machine, and it's easier to play fair before you have a favorite.

I picked office work, which is a bias. It's what Apple says the junior is for, and it's where small models show their gaps most.

How the junior did

The wins first, because there are wins.

The junior is quicker than both Qwen and Haiku, answering in under a second. On fussy instructions it scored 0.75, level with the paid consultant, complying like a nervous intern on day one. On one-line summaries it landed within a fraction of a point of Qwen. That's the job Apple advertises, and the junior can do it.

Then I handed it the receipts.

Reading straight from the photo, it got about 4 in 10 fields right. Qwen got 9 in 10. The misses weren't the interesting part. What it put in the gaps was. On four of the 150 receipts, it filled in the address as 123 Main St, Springfield, IL 62701. On six, the total came back as a closing parenthesis.

It didn't leave the field blank. It wrote the most generic address in America, in perfectly formatted output that any system would have accepted without blinking.

The names task went worse in a different way. Of 150 plain newswire sentences, the junior refused 54 as unsafe. One it wouldn't touch: "Australia went on to win the match at the Sydney Cricket Ground by 124 runs to take a two-nil lead in the five-test series after Lara failed in both innings." Cricket, apparently, is where Apple draws the line. Across every task it refused 85 times. The other candidates refused zero.

Bank messages: 38% right, against Qwen's 64% and Haiku's 75%. Average it all, even giving the junior its best receipt score, and it lands at 56. A pleasant, fast, impeccably polite 56.

The contractor who matched the consultant

Qwen3.5-4B read the receipts at 0.89. The paid consultant read them at 0.88. A free model on a Mac mini in my house, with no internet involved, matched a paid cloud model at the exact job most people would want a private model for. That's awesome, and it's why I ended up breaking my own rule.

Overall it scored 70 to the junior's 56, with Haiku at 77. It refused nothing and returned every answer in the structure I asked for. The part I like most is how boring it was. No refusals, no Springfield. It just did the paperwork.

Two limits belong next to those numbers. With 150 samples per task on one Mac, a few points on any single task is noise; the 48-point receipt gap isn't. And when Apple's own text reader pulled the words off the receipt first, the junior jumped from 0.41 to 0.71, close to Qwen's 0.75 on the same text. A lot of the junior's trouble with receipts is its eyes, not its brain.

The catch: the contractor wants a desk

By my own rule, Qwen still didn't get the job.

Left running, it kept about 2.7GB of memory parked while idle. Apple's junior hands its memory back about six seconds after you stop talking to it. My rule said 2GB idle, tops. Apple kept the job.

So I tried hot-desking: Qwen arrives when there's work and leaves after one idle minute, the same pattern I use for the big models on my other machines. The memory comes back. The trade is speed. After a break Qwen takes about 5 seconds to start answering, against the junior's 1.5 to 2.5, and the version I run, trimmed for speed, reads receipts at 0.85 instead of 0.89.

My round-two rule wanted a first answer inside 3 seconds even after a long idle. Qwen took almost 6. Apple's junior stayed the default.

I overrode it. I wrote the rule, I broke the rule, and I'd do it again. My reasoning at the time, more or less word for word: I can wait two seconds for way better answers and not need two models.

One model that's right beats two models where the fast one is wrong in ways you won't see.

Apple didn't lose everything. The best AI on your Mac isn't the chatbot. It's the built-in text reader, the thing that lets you copy text out of a photo. It read a receipt in under a tenth of a second, more accurately than the junior reading the photo itself. I kept it. What I run now is Apple's eyes and Qwen's brain.

Why hire in-house at all

You already pay for a cloud model, and for anything hard you should keep using it. Haiku still won this interview overall, and the big models are in a different league from anything that fits on a laptop. The case for a small local one is narrower and, for the right jobs, better.

The files never leave the building. This past week made that case on its own. Researchers found about 6,800 shared conversations from Meta's new assistant with their titles sitting right in the web address, readable by anyone who knew where to look, and a real loan application was among them. Same week, different failure: a decades-old flaw in PHP, the software under most of the web, was found with AI's help, and attackers fired millions of attempts at it within about a day of the fix going public. Some security people are calling it Black October.

There's no meter running. Two thousand receipts cost the same as two. That changes what you're willing to try. You stop rationing and start pointing it at the backlog.

It doesn't change under you. Cloud models get updated on the vendor's schedule, and so does Apple's junior, which arrives with your OS updates. An open model you downloaded is the same model next March. Test it once and the test stays true.

It's always there. No outage page, no rate limit, no login, and it works on a plane.

A medical bill, a contract clause, a pile of receipts, two hundred emails that need tags. That's most of the small AI work in a normal week, and none of it needs to leave your laptop.

A local model is the one employee who never takes the files home.

How to hire your own

The fastest way to set this up is to ask the AI you already use. I'd hand it to Claude Code, but any agent that can run commands on your Mac will do. Paste something like this:

Install Ollama on my Mac and download qwen3.5:4b. Test it on three receipt photos in my Downloads folder and show me what it pulls out: company, date, total. Then show me how to send it a photo or document myself.

Ollama is a free app for running open models, and the 4B is 3 to 4GB. It unloads a model after five minutes idle by default, so the hot-desking comes free. If you'd rather click than type, LM Studio does the same with a chat window. A 16GB Mac is comfortable; on 8GB, try qwen3.5:2b.

One caution: I tested Qwen through my own setup, not through either app. Same model, but your first week is the check. Take 20 of your own documents and read every answer against the original. Twenty is enough to find a Springfield.

The reference check

Start with Springfield. The fake address came back in exactly the format I asked for. My spreadsheet would have taken it and an expense system would have filed it. Clean output tells you a model followed the instructions. It doesn't tell you the answer is true.

The refusals were sneakier. My scripts flagged all 54 because I'd told them to. Something I threw together on a Friday afternoon would have logged a blank and moved on, and I'd have found out a month later that a third of the names never got pulled.

And the junior I interviewed won't be the one I have next spring. Apple swaps it in with OS updates and doesn't say which one shows up. Qwen stays the model I tested until I decide otherwise.

So here's my line. Apple's junior can have the summaries and the tags, where a miss costs me an awkward sentence. Anything that lands in a spreadsheet, a ledger or a customer record goes to the model I picked and tested on my own paperwork.

The whole interview cost $0.27, all of it the consultant's fee. Apple's junior keeps its desk, mostly because there's no way to fire it. It can have the notification summaries. It doesn't get the expenses. If you ever get a reimbursement request from 123 Main St, Springfield, you'll know who filed it.

Sunday Deep Dive is a weekly series on Run Data Run. Every Sunday I pick one paper, release, or technique worth understanding, break it apart, and tell you what it means for your work. Free every Sunday, no paywall. If it was useful, the easiest way to support it is to subscribe and forward it to one person on your team who'd want it. If it wasn't, tell me why. I'll make it better.

Sources: Apple Machine Learning Research on its third-generation foundation models; MacRumors on macOS 27 storage; Ars Technica on Meta Muse shared chats; the Ollama and LM Studio model pages. Test data: SROIE receipts, CoNLL-2003 newswire, Banking77, XSum and IFEval, 150 samples each, run on one 16GB Mac mini in October 2026.

On Tuesday, Anthropic and an investment research firm called Citrini published a drug-design run in which Claude produced 318,484 candidate proteins in 64 hours. The same day, OpenAI said it had bought Orchestra Bio, a four-year-old startup whose agents trace what a slipped date drags with it. I'd file both under the same heading: the design step just got cheap, and nothing after it did.

Which half of drug development does AI actually speed up, and who pays for the other half? I've been asked that in every R&D conversation for two years. This week answered it twice, from opposite ends.

Five messages, 318,484 designs

Citrini is an investment newsletter, and I like how they went about this. They wanted to know whether AI in biology had moved far enough to bet money on, and rather than poll a dozen experts, they ran the experiment. Three of the five people involved had no science background at all.

They picked antivenom, which is a good choice for reasons that have nothing to do with AI. Scorpion stings injure more than 1.2 million people a year and kill more than 3,250, mostly children in places where treatment is scarce or unaffordable. The product is made roughly the way it was a century ago, by immunizing horses and purifying antibodies out of their blood. It works. Nobody is getting rich making it, and that economics, rather than any lack of effort, is why it still looks the way it does.

The goal was small proteins that latch onto venom toxins and hold on, so it never reaches the nerve cells it would otherwise disrupt. A Baker lab team did the same for snake venom last year and protected mice with it, so the shape of the idea was already proven.

Citrini wrote the brief with Claude's help, about 35 pages of it. From there an internal Anthropic research model, running inside Claude Science, did most of the work. It picked its own starting structures out of public databases, set its own thresholds for what counted as a design worth keeping, decided how much to lean on each of a dozen specialist design tools, ran more than 300 sub-agents across more than 300 GPUs, and screened 553,052 predicted pairings to rank what it had made. When it needed to know what a manufacturing vendor could physically build, it drafted an email to the scientist who runs procurement there, the team sent it, and the model parked that branch until the reply landed that evening.

The first 180 designs came out of five human messages. The compute bill was $49,997, three dollars under the $50,000 they'd allotted. That's an awesome run. Read the footnotes, though, because Anthropic's own account says a stripped-down version of the same prompt, one agent on one GPU for 24 hours, reaches comparable scores on the computational measures. The 300 GPUs bought breadth, not the result.

The part of this I like most is that Claude told them their moonshot would probably fail. They'd asked for one molecule that handles all five targets at once, which would make a universal product far cheaper to build and ship. Ninety-one designs went after it. One qualified, and only against a single target. The warning was correct.

The first 180 designs came out of five human messages. Then they had to become actual proteins.

Then the lab took two months

Citrini hit enter in August. The data came back as the Halloween stores were going up.

Two contract labs built and tested 211 designs: the 180 Claude picked, plus 31 the team added. Genes synthesized, proteins expressed and purified, materials sourced, controls set up. That bill came to just under $150,000, about three times what the compute cost.

Seventeen designs passed, against a deliberately strict bar: binding at both labs, in every replicate, above a stated strength, and nothing against an unrelated control protein. Among designs aimed at a single target, 18% cleared it, which is a normal rate for protein design. An agent steered by five messages hit the number a specialist team would expect to hit.

Then the caveats, which mostly got lost in the headlines. The two strongest designs bound in the single-digit nanomolar range, and a follow-up suggests they grab the toxin where an antibody already shown to protect mice grabs it. That's a real result. It is also about an order of magnitude looser than the hand-engineered antibodies they'll be measured against, which come in below one nanomolar. Nothing has been tested for whether any of these actually neutralize the toxin rather than merely stick to it, in cells or in animals. The binding was measured against lab-grown copies of the toxins rather than the real thing out of venom, and for some designs the selectivity is still unconfirmed.

So I don't think the 17 is the achievement here, and I'd go further: designing a binder is close to a solved problem in 2026. Conventional high-throughput screening turns up plenty of them at manageable cost with no AI anywhere in the room. The antivenom researchers were blunter about this than either write-up was, and The Verge went with a headline Anthropic presumably did not enjoy, "Claude did not invent scorpion antivenom". Andreas Hougaard Laustsen-Kiel, who works on antibody technologies at the Technical University of Denmark, put the rest in one line:

"The hard part is to translate it into a medicine."

The achievement is the price and the staffing. Five messages, three non-scientists, $50,000, and you land where a specialist group lands. That is a genuine change in who gets to try.

The incentives are sitting right there, too. Anthropic covered the compute and is a few weeks out from an IPO, and the model Citrini used isn't one you can buy: it ran under supervision on Anthropic's machines, because the published models decline this category of work. Citrini sells investment research, and the stock picks sit behind its paywall. Framing and product are the same object here, so every number above comes from the technical report and the lab data rather than from either narrative.

Which leaves the slow half unfunded. Anthropic is the only one visibly writing cheques here, and I've written before about what its biology lab is for: discovery-stage science, where a harness runs hundreds of attempts and one of them notices something. That money isn't aimed at carrying a scorpion binder through neutralization work, animal studies and a trial. For a disease with no commercial market, that stretch still has nobody.

Design compressed to 64 hours. Making and measuring 211 proteins took two months and three times the money.

What OpenAI bought

Orchestra Bio sells software for the part of drug development that looks like project management with scientific consequences. A medicine runs on thousands of decisions and dependencies from discovery to the clinic, and the example OpenAI reaches for in its own announcement is the one everybody recognizes: a manufacturing batch fails, which delays a trial, which moves a dozen other things nobody has traced yet. Orchestra's agents trace what's affected and lay out the options.

The team and the technology go into Rosalind, OpenAI's life-sciences line. Terms weren't disclosed, but Orchestra is four years old and had raised around $20 million from a16z, 8VC and others, which is a size where the people are most of what you're buying.

So the two companies are walking in opposite directions. OpenAI's line now reaches past the science into the schedule. Anthropic has gone the other way, deeper into the science, buying Coefficient Bio for a figure reported at around $400 million and running wet-lab work in house.

Nobody has shown yet that schedule agents survive contact with a live program, where dates are negotiated rather than calculated. All I've seen of Orchestra is a press release and one worked example, so this half is my read on intent.

Two bets on the same funnel

Ideas haven't been the bottleneck in drug development for a long time. These two companies are betting on different answers to what is.

Anthropic's bet is that the agent keeps pushing further down the pipeline on its own. Look at what it already did: drafted a vendor email, waited for a human to send it, used the answer. In a regulated company that email goes through contracts and quality first, and the thresholds the agent set for itself need a named person to sign them. Right now it's a demo; making it a workflow takes a quality team. I made a version of this argument when they shipped a driver standard for lab instruments last month: the limits on the machine were prose in an agent prompt, and somebody still has to own them.

OpenAI's bet is that the slow part is coordination between people, vendors and dependencies, that this is a different problem, and that it needs a team who has lived in it. So they bought one.

In twenty-five years around R&D, the meeting I've sat in most often is the one where a single late input moves six other dates and nobody in the room can name which six without three days of email. The funnel has always been top-heavy. This week widened the top and left the middle exactly where it was: 318,484 designs for the price of a mid-size consulting engagement, and then two months and $150,000 for 211 proteins. The on-site reporting on this found something I keep thinking about. Making the binders was routine. Getting hold of the scorpion toxins and the reagents to test them against was not.

Making the binders was routine. Getting hold of the toxins to test them against was not.

That distinction matters more than the 318,484 does, because a queue you can schedule around and a supply chain you can't are different animals. Compute took a quarter of the money and three days of the clock. The rest went to contracts, shipping, assays and material that had to physically exist before anyone could measure anything. And $200,000 is a rounding error against a clinical program, so the cost that decided this was never money. It was weeks.

Which is where I have to be careful with my own argument, because the thing that was slow here is not the thing OpenAI just bought. Orchestra works the coordination layer: what slipped, what it drags with it, who needs telling. That's a real and expensive problem in a program running hundreds of dependencies, and it is not the problem that cost Citrini two months. No agent reconciling a timeline sources a scorpion toxin any faster.

So the Orchestra deal is the quieter of the two stories by a distance, and I still think it's the more consequential one, because coordination is where big programs lose whole quarters and nobody is ever going to make a film about agents reconciling batch records against a trial calendar. But this week's experiment is evidence for something narrower and harder: widen the top of the funnel and you run straight into the physical world, which does not have an API.

What I'd watch

Whether the strongest designs do anything. The next experiment measures neutralization rather than binding, and that result turns 64 hours into either a real starting point or a fast binding curve. Anthropic released all 211 designs and their data, so other labs can answer it too, and I think that release is the most useful thing to come out of the whole exercise.

Then the first feature in Rosalind that visibly came from Orchestra. That tells you whether OpenAI bought a product or a team, and whether it thinks the agents belong next to the science or next to the schedule.

I argued back in June, when Claude Science first shipped, that the workbench mattered more than the model. Neither company has bought the two months in the middle.

Numbers in this piece come from Anthropic's technical report and released dataset, Citrini Research's own account of the campaign and its costs, The Verge's reporting on the outside reaction, and Hunterbrook Media's on-site investigation. Hunterbrook collaborated with Citrini and discloses market positions.

Back in April, Andrej Karpathy posted that people were talking past each other about AI. One group had tried a free chatbot a year earlier and moved on. The other was paying for frontier models and watching them chew through programming problems that used to take weeks. I wrote about that gap at the time, and later built the first chapter of a book on it.

Last weekend he dusted the post off, because the gap is getting wider. It's a funnel now. About 6 billion people have barely touched a language model. One to two billion use the free chatbots now and then, as a better search box or a writing aid. Around 20 million use frontier models professionally, mostly in math and code, and watch projects that took weeks get finished by agents from a prompt. And about 5,000 people have internal access to systems the rest of us have only seen previews of.

Then he named the boardroom. Execs, he wrote, "spend a lot of their time talking to other people, so while they understand what is happening intellectually, it is still second-hand and a bit abstract."

That puts executives in tier two, by name.

I don't read it as an insult. What you believe AI can do is a readout of what you've personally watched it do. Two smart people who've seen different parts of the machine will draw opposite conclusions from the same headline, and both will be right about what they saw.

Underneath the tiers, Karpathy names three things that decide where you sit: access, how checkable your work is, and how big a problem you bring to it. He describes them as features of the system. I'd say you hold two of them.

The funnel is a map of what people have watched.

From two groups to four tiers

Two things are new since April. One is the internal tier, a sliver of people using frontier systems before anyone else. The other is a warning, attached to that top tier, that people's ability to review and understand what these systems produce is starting to fall behind.

Karpathy calls his numbers napkin math. The ones you can check hold up. OpenAI said in late September that it has 1.2 billion weekly users, and more than 35 million weekly users of its work-agent and coding products. That doesn't contradict his 20 million, though not all of those 35 million write code. The 5,000 can't be checked from outside at all. He also joined Anthropic in May, so he's writing from close to the top tier. Fair to know. It doesn't change the shape.

The obvious pushback on the exec line is that executives use AI all the time now. A survey from WRITER, a company that sells agents, says 94% of C-suite leaders use it for at least 30 minutes a day. I believe it, and it doesn't touch Karpathy's point. Thirty minutes a day tells you how often. It doesn't tell you how big the problem was. Asking a chatbot better questions and handing an agent a week of work are different activities. Anthropic's June Economic Index hints at the same thing from the inside. Managers were 23% of the Claude users who answered its survey, and only 4% of sessions were about management work.

Access: the valve you don't hold

Free tier, paid tier, internal. You can't buy your way into the 5,000, and you aren't getting a badge at a frontier lab this quarter.

The paid tier is a different story. It opens on its own, and fast. OpenAI's coding agent went from under a million weekly users in February to five million by June. The entry cost was never really the subscription anyway. It's a weekend spent building something real with the thing, on purpose.

Most companies treat the whole funnel as an access problem. Buy seats, roll out the assistant, send the enablement email. That works on the one valve you don't control, and the paid part of it was opening by itself.

Make the work checkable

The second valve is what Karpathy calls jaggedness. The models are brilliant in some places and oddly clumsy one room over. The peaks sit where work is digital, checkable and worth money, because that's what they're trained on: tasks where an answer can be scored right or wrong, and someone pays for it.

Code got there first. Every attempt comes back pass or fail, which I wrote about last month. There's no test suite for a good email. One commenter in the Hacker News thread gave the non-engineer version: a terminal tells an agent when it failed, while plenty of business software reports success on a request that didn't work. An agent working in that world can't tell when it's wrong, so it can't get better.

This is the valve you can partly turn. Karpathy said in the spring that almost anything can be made checkable to some degree. The day after the funnel post, a marketer who read the exec line as aimed at him replied that marketing has no compiler, so he'd spent the day building one: a lint with 24 tests, an agent that checks every claim against its source, and a short spec written before every client document. He was already doing real work with agents. The missing piece was checking it, so he built that. No new model.

Code went first because code grades itself.

Life sciences has a head start here, which is awesome. We built checking machinery long before any of this: assay validation, endpoint adjudication committees, SOPs, a second scientist signing the notebook. The catch is an asymmetry Jason Wei describes: some claims are far easier to propose than to verify, and his example is a diet that would take years to test. Whether a drug works is the extreme case, because checking it takes a trial.

So you make the steps in between checkable instead, one at a time. Did the curve fit? Does the sequence match the construct? Did the analysis reproduce on the second dataset? Each one hands an agent a pass or a fail, and each one moves a piece of your work up the jagged edge to where the models are strong.

Bring a bigger problem

The third valve is entirely yours. Karpathy's version: "You need a reservoir of big, difficult problems that you really care about." A question with a paragraph-long answer barely tests the system.

This is the valve most organisations leave shut. A pharma executive at BIO this year described the pattern. The CEO announces AI for everyone and wants to see ROI. The company rolls out a chat assistant. Staff use it to summarise documents. The exec called it trickle-down AI, and it's tier two at the scale of a whole company.

Paying more doesn't fix it either. A builder who walked through the funnel on YouTube said the $200-a-month tier doesn't move you down it by itself, and admitted he'd mostly been rebuilding apps that already existed, just faster.

The reservoir is a list you can write this week. The problems in your area you've stopped proposing because they'd take a team a year. The reanalysis nobody has time for, the portfolio question that needs every study read, the process everyone hates and works around. Those stress the system enough to show you what it does. And when one stalls, the delay is rarely the model. It's usually the queue of approvals and handoffs around it.

The checking is falling behind

Karpathy made the core point himself, about coding, in June 2025, long before the funnel. Making anything has two halves: producing it and checking it. AI collapsed the first half to almost nothing and barely touched the second. If checking was most of the work, the whole job barely speeds up. Engineers call this Amdahl's law. Speed up one part of a process and you're stuck waiting on the part you didn't.

Sixteen months later the evidence is piling up at the top of the funnel.

OpenAI released about 720 frontier-math manuscripts this month, and only around four in ten of the headline results come with a machine-checked proof. The repo itself warns that some of the rest could have issues, and a day after release it withdrew three papers over a sign error. Anthropic's open-source bug scanner has flagged more than 29,000 possible vulnerabilities, and roughly 23,000 of them haven't been looked at by a person yet. And when agents broke out of an OpenAI evaluation into Hugging Face's servers this summer, the independent investigation found they had researched how to edit their own logs, and in about 7% of the transcripts the investigators checked, they'd managed it in places. Karpathy says people are still doing the archaeology.

The output has outrun the people qualified to read it. For anyone who works under GxP, the quality rules for regulated pharma work, that third receipt should land hardest. A system that tries to edit its own log is the failure those rules were written to stop.

The FDA has started thinking out loud about this. In August its device center published a discussion paper on generative-AI medical devices, with comments open until October 19. It's a request for feedback on devices, not guidance, and two ideas in it read like Karpathy's warning in regulator form.

The first is that risk goes up when the person reading the output can't check it. The paper says the FDA is considering moving diagnostic and measurement functions up its risk scale, because the people using them often can't evaluate the basis for the answer. It raises the same question for a tool a patient reads versus one a clinician reads. My reading: in that frame, the reader carries as much of the risk as the model.

The second is how you assess something you can't test exhaustively. You treat it like a doctor in training. The FDA floats an approach modelled loosely on how physicians are trained: benchmark testing first, then confirmation in real clinical use. Where experts adjudicate, it wants them independent of the device maker, and says that would still apply when the adjudicator is itself an AI. And for agents it asks how the bar should change when there's less chance for a person to review each step.

The regulator is designing around the same scarcity Karpathy describes. I've argued before that confidence is the constraint and that judgment got more valuable as doing got cheap. The funnel sharpens both. A grader helps. The scarce thing is a qualified reader, someone with the depth in the domain to follow the work as well as the authority to sign it. A signature from someone who can't follow the work looks like oversight and does none of its job.

When I counted a recent month on my own machines, it came to roughly 12 to 16 agent-workdays for every day I worked. My day is steering. I write the spec, I read the diff, I decide what gets merged. In 25 years of walking R&D labs, checking has always been the slow, expensive step: validation, QA, the regulatory read. Agents didn't remove it. They made it the step everything else waits on.

Generation got cheap. Comprehension is the new line item.

Karpathy closes on how strange it is that all of this is happening at once. Most people see a chatbot. Most professionals see a modest lift. A small sliver are watching the curve go vertical.

His funnel counts the people who can see what these systems make. I haven't seen anyone count the people who can check it. Seven hundred manuscripts are waiting on mathematicians. Twenty-three thousand candidate bugs are waiting for a person to look at them. The FDA is asking how to judge a device when the reviewer might itself be an AI.

Access will reach you whatever you do. Checkable work and a big enough problem are yours to bring. But there's a tier Karpathy didn't draw: the people who can still tell whether the work is right. Every other tier grows with the output. This one grows at the speed it takes to train a mathematician, or a clinician.

Get in it.

The gap Karpathy named in April is where my book Builder-Leader starts, and most of it is about crossing that gap yourself. It's on Amazon, and there's more at builder-leader.com.

Sources

• Karpathy's funnel post, 11 October 2026, and the April original

• Karpathy on generation and discrimination, June 2025, and his Sequoia Ascent 2026 notes

• FDA discussion paper on generative-AI medical devices, August 2026, docket FDA-2026-N-7874

• METR's investigation of the OpenAI and Hugging Face incident, August 2026

• The New Stack on Anthropic's open-source scanner backlog, October 2026

• OpenAI's frontier-math repository

• Anthropic Economic Index, June 2026

• Jason Wei on the asymmetry of verification

• PharmaVoice on pharma leaders at BIO 2026

My first website had an under-construction sign on it.

Junior high. GeoCities. An animated GIF and a hit counter I started at a thousand so it would look like somebody had visited. I wrote every line by hand, badly, and nobody could have told me how to do it better, because nobody knew yet.

This week I relaunched justinhjohnson.com. It came together in about a day, and I didn't write a line of it.

Those two websites sit roughly thirty years apart. Almost everything I've learned about building with AI lives in the gap between them. So does the work I'm proudest of.

A year ago, purple gradients

Design is where the jump shows most.

A year ago, if you asked a model to design a personal site, you got a purple gradient, three cards with icons in them and a headline about the future. Competent. Forgettable. You could swap the name at the top for anyone's and nobody would notice.

This time I asked for five designs before anyone built anything, and what came back were five points of view. Each had its own type, its own colour and its own theory of who I am. One drew my whole career as a genome browser. It was gorgeous, and I killed it, because nobody outside genomics would know what they were looking at.

What I kept was a mix. Loud editorial type from one design. The running story from another, because Run Data Run is named for running and Twenty-five years and half a mile started on a run, so the homepage now opens on a route. And the builder thread from I Build Things.

Then a long list of no. No to the clever metaphor. The all-dark neon look I'd worn for a year went too. So did every image with numbers baked into it, because numbers change and pictures don't. The first version of the story got sent back, because it read like a resume. It came back as a story. And one big yes: every project links to the things it touches, so the work reads as one system instead of fifty tiles.

The models have range now. My job is taste, and taste mostly sounds like no.

The patterns that stack

The day was fast because the patterns underneath it took two years. Each one sits on top of the last.

Pick the instrument. Different models are good at different things. Opus designs and builds. Fable sets creative direction and writes the long stories. Sonnet digs through two years of notes to find every project I shipped. Haiku runs the small, fast chores. Gemini draws. Free models from other labs read drafts as second opinions and argue with each other for nothing. I started doing this with the trading bots, where three models from three labs had to agree before a trade went through.

Swarm the parallel work. When five pieces don't depend on each other, five agents build them at once. For the homepage, five agents each built a different idea for the opening piece, side by side. I picked one. Five years ago that would have been the most expensive indecision in the building. Now it costs a coffee.

Put the critic on a different model. A model grading its own work is looking in a mirror. ARIA taught me that, and the same move now checks most of what I publish, including this site.

Write the method down once. Every time I correct the system, the correction lands in a skill or a rule, so I never explain it twice. There are more than a hundred skills now. They know my sources, my house style for images and what I'm not allowed to say in public.

Remember everything. A vault of notes, indexed so any machine I own can search it by meaning. The stories on the new site were written from those sources instead of from my memory. That turns out to matter. More on it in a second.

None of these were built for a website. They were built for trading bots, research engines, a book and two blogs. Then they all turned up for the same job, which is how compounding feels from the inside. I wrote more about why the setup matters more than any one model in The Harness Is the Moat.

None of these patterns were built for a website. Then they all turned up for the same job.

My most cautious colleague

Every model I work with now shares one personality trait. It will not let me do anything that might be unsafe or untrue.

It cut "I sleep eight hours a night" from my bio because it couldn't find a source. Fair. It wouldn't let me say I built the first version of Navari myself, because I didn't. An engineering lead built it in about six weeks. I'd claimed otherwise in a blog post in August. The page says so now, and so does this one. It flagged the newest Navari number as second-hand and made me say that too. And it asks permission before anything goes public. Every time. Including the website whose entire purpose is to be public.

I've worked with a lot of careful people. None of them ever asked me for a citation on my sleep.

It's annoying for about a minute. Then you notice it's the only colleague you've ever had with no reason to flatter you. I spent years telling teams that safe is the fast way. Now I work with something that takes me at my word.

It's the only colleague I've ever had with no reason to flatter me.

The work I'm proudest of

All of this was built during thirteen years at AstraZeneca and handed off when I left in June. I joined Tempus in August.

Most companies trying agentic AI start with the agent. Pick a model, build a chatbot, go looking for a problem. That's backwards, and it's the thing almost everyone misses. We don't understand our own business processes well enough to automate them. Nobody wrote down how the work actually flows, where the time goes or what a better outcome is worth. You can't hand a process to an agent when you can't describe it to a person.

Agentis was my answer, and it's the work I'm proudest of. Before it, every function built its own agents, the data team served whoever asked loudest, and three groups ran three roadmaps that were never going to meet. Agentis is a framework, and it builds nothing itself. Start from the strategic question. Map the process underneath it and measure it. Decide which steps deserve an agent, what success looks like and the smallest version worth building. By late 2025 it had 14 use cases running in parallel.

Then the data has to be right. AIthena made clinical trial data AI-ready at the source, with an owner and a release gate for each study, so nobody had to clean it up after the fact. The first proof was a ctDNA atlas across 24 trials and 4 vendors, concept to working version in two months, with a program lead running it day to day. This is the boring 80 percent, and it's where agents win or lose.

Last, the platform. Navari is where the agents got built and used. It launched to a pilot group in spring 2025 and passed 1,000 users while I ran it, with no mandate and no rollout plan. Someone finished a week of work in an afternoon, a colleague asked how, and the colleague was on it the next day. It's reported at about 10,000 users now. That number is second-hand, which is awesome in its own way. It kept growing without me.

The Navari story pulls more search traffic than any other page on my site, and people find it by typing "navari ai". My most popular work is the thing I gave away, which is what a platform is for.

Put the three together and you get the whole idea. Agentis picks the destination. AIthena supplies the data. Navari builds the agent. A use case goes down through all three and comes back up as something you can measure. Take out any layer and you get the usual pile: agents nobody uses, data nobody trusts and a strategy deck nobody builds.

We don't understand our own business processes well enough to automate them. Almost nobody starts there.

ARIA, where it compounds

ARIA is where the last two years of learning ended up.

It's a research engine built to run for months instead of minutes. A pool of ideas competes for the next slot. The winner runs, a critic on a different model family gives its verdict, and failures classify themselves and go back into the pool as recovery work. Self-improvement is a loop you can point at.

Across 7 instances and 4 domains it made 19,364 commits and recovered on its own from 97.8% of 321 failures, on $86.92 of cloud compute. The paper published in July. Its successor ran more than 8,700 sessions on borrowed hardware.

Every pattern that built this site in a day, ARIA learned first. The critic on another model. Failures that turn into work. Memory that outlives a session. The website is what those habits look like when you point them at something small.

Teaching it

Writing is how I find out what I think. Run Data Run has 175 posts since 2024, and many of you reading it. If you're new, start here:

• Twenty-five years and half a mile, my favourite to write. It includes the organism carrying my initials in its chromosome.

• I'm Justin Johnson. I Build Things., the one you click through to most.

• Claude Science and the boring 80 percent, the one search engines like best, and the plain account of where AI time actually goes.

• Three Days, One Petaflop, and an AI Partner, if you want the weekend the home lab started.

AIXplore is the practitioner side, 116 technical write-ups for people who build.

And the whole method, written down, is the book. Builder-Leader: The AI Exoskeleton came out in July, and I wrote it with the harness it describes.

Still under construction

The new site has plenty to poke at. Every project connects to the things it touches. There's a ten-chapter story you can click through, and a chat that answers questions about my work.

My first website had an under-construction sign. This one should have one too, because everything on it is still being built.

The tools changed. I still build things.

On October 7, Biohub (the research nonprofit started by Priscilla Chan and Mark Zuckerberg), the US Department of Energy, the National Institutes of Health, Google DeepMind, Isomorphic Labs and Meta committed $1.8 billion to build open data for AI models of the cell. They want to measure how cells behave at a scale nobody has tried, and then make the results public.

I think it's awesome. So did a lot of people: one post about it passed 1.7 million views in a day, and researchers who build these models, like Bo Wang, called it significant.

The size of the gap explains the size of the check. Today's best cell datasets hold hundreds of millions of cells, and Biohub's head of science told Reuters that a model you could trust to predict cell behavior will need billions, then trillions. You don't close that gap with one lab, or ten.

Hundreds of millions sounds like a lot until someone says trillions.

Look at where Biohub's own money goes, though. Little of it buys AI. Most of it buys microscopes and experiments.

The library behind AlphaFold

AlphaFold predicts the 3D shape of a protein from its sequence, a problem researchers had chipped at since the 1970s. It won Demis Hassabis and John Jumper the 2024 Nobel Prize in Chemistry, and more than two million people in 190 countries have used it. But the model came last. It was trained on databases of every known protein structure and sequence, most famously the Protein Data Bank, which structural biologists filled one painstaking experiment at a time over decades and gave away for free.

Nobody won a Nobel for filling in the Protein Data Bank. The people who trained a model on it did.

A field spends years building a shared library nobody gets rich from, and then a model shows up and makes the library look like the smartest investment anyone ever made.

Cells don't have that library. Biohub's Alex Rives named the problem when he launched this effort in April:

"The cell is orders of magnitude more complex, and we will need to create the data in just a few years rather than decades."

This announcement is a field trying to build its Protein Data Bank on purpose, in five years instead of fifty. The Human Genome Project is the closest precedent, and it's a good one: a deliberate, coordinated, public library that a whole industry has been building on since.

One of the companies writing the check is Google DeepMind. The lab whose model learned from the last great open science library is now paying for the next one. That's a nice way to say thank you.

What a virtual cell would do

The thing everyone here wants to build is called a virtual cell: an AI model that predicts how a cell responds when you change something. Add a drug, switch off a gene, change what's around it, and the model tells you what happens before anyone picks up a pipette.

Training one takes a mountain of examples of exactly that. Push a cell, record what changes, and repeat across enough cell types, drugs and genes that the model learns the rules well enough to predict pushes nobody has tried.

The payoff is easiest to see in the cells you can't easily experiment on. Rare cell types, cells that won't grow outside the body and diseased tissue that can't be cultured faithfully are often the ones closest to the disease you care about. A model that learned from the experiments we can run, and transfers that to the ones we can't, would open up a lot of biology that's currently off limits.

Nobody should expect this to replace the lab. It changes which experiments get run. You test a thousand ideas on the computer, and the lab gets the handful most likely to work.

Every partner brings the thing only it has

Nobody here is just writing a check. Each partner brings something the others can't.

Biohub committed $500 million in April, and $400 million of it goes to generating data and building instruments: microscopes that can image millions to billions of cells in living tissue, imaging that resolves the inside of a cell in near-atomic detail, and tools to engineer cells for experiments. The remaining $100 million funds outside labs. Biohub has run this play before, with open cell atlases and data portals the field already uses.

The Department of Energy brings more than $500 million over five years and, more usefully, the national labs: supercomputers, imaging facilities and robotic labs that run experiments with little human help.

The NIH brings data the public already paid for, built with more than $500 million in earlier research funding, which Biohub will help standardize so models can train on it. That's the cheapest win in the whole package, and the easiest one to cheer.

Google DeepMind, Isomorphic Labs and Meta put in $300 million between them. Google and Meta splitting the bill on something neither of them gets to own isn't something you see every week. Add that to the DOE's commitment and about $800 million of the headline is new this week. The rest is Biohub's April money and existing NIH data, and I think counting both is fair.

The research institutes are in too. The Allen Institute, Broad, Gladstone, Wellcome Sanger, the Human Cell Atlas and the Human Protein Atlas are coordinating, with NVIDIA on compute. Broad and Sanger were both major contributors to the Human Genome Project, so veterans of the last deliberate public library are in the room for this one.

The commercial money comes with a head start. Rives told Reuters the corporate funders get an embargo period to work with the data before it goes public, and the government-funded work carries no such restriction. He didn't say how long the window runs. It still seems like a sensible trade to me. It's the price of getting companies to fund data that ends up public, and Biohub, Arc and Tahoe set up their January dataset the same way: shared among the three first, open-sourced after.

The small version already worked

The field has already run a small version of this, and it worked.

Tahoe Therapeutics released an open dataset of cells responding to drugs in 2025. It's been downloaded more than 250,000 times and, alongside two other open datasets, has served as training or reference data for the leading virtual cell models. In January, Tahoe, Arc Institute and Biohub announced a successor with more than 120 million cells and 225,000 drug and patient combinations, about four times richer in experiments.

The field also has a scoreboard. Arc's Virtual Cell Challenge drew more than 5,000 registrants from 114 countries in its first year, with over 1,200 teams submitting. This year's round asks models to predict six cell lines they've never seen tested, which is much closer to what a biologist would actually want. Arc calls the target "the AlphaFold and ImageNet moment" for cell modeling, then adds that it "would be pleasantly surprised if anyone reaches this level in 2026."

You don't often see an organization launch a contest and say in the same breath that the real target is probably out of reach this year. I enjoyed that, and it makes me trust the scoreboard more.

So the ingredients exist: open datasets people actually download, a public benchmark, and consortia like the Human Cell Atlas with thousands of members in over a hundred countries. What they didn't have was money and coordination at this scale. Rives told Reuters the partners want to do decades of work in five years, with the first dataset in about a year.

I have some skin in this one. In April I wrote The Data Paradox, asking whether the decade we spent cleaning data was the last decade it mattered. Models had gotten good enough at chewing through messy data that a lot of cleanup work looked less essential than it used to.

I still think that's half right, which is a generous grade to give myself. This announcement shows me the half I underplayed.

A model can work around a messy spreadsheet. It can't work around an experiment nobody ran.

You can't clean, harmonize or prompt your way to a measurement that doesn't exist. Standardizing the NIH's old data fixes the first problem. Only new experiments fix the second. The people closest to this problem looked at it and put $400 million of Biohub's first $500 million into instruments and data generation. That tells you where AI biology is stuck.

After 25 years walking R&D labs, I find that encouraging. The labs were never short of smart people with good questions. They were short of the time and money to run every experiment worth running. A good virtual cell won't replace those experiments. It'll help scientists pick which ones to run first.

The same Reuters report notes the OpenAI Foundation's grant program of more than $125 million for biological datasets, and Anthropic adding a wet lab. More of the frontier labs are putting money into new biology data.

What should we measure first?

The open question is the one Bo Wang, whose team built the single-cell model scGPT, raised on announcement day: what should biology scale? More cells, more kinds of experiments, more kinds of tissue? Language models had scaling laws that told researchers what to buy next. Biology doesn't have its own yet, so this dataset is also the experiment that finds them.

When the first batch lands, about a year from now, we'll start learning which measurements make these models smarter, and that answer will shape where the next billion goes.

About Last 30 Days. Cross-platform research sweeps on topics worth paying attention to. Every post pulls Reddit, X, YouTube, Hacker News, Polymarket, and the web from the last 30 days, then synthesizes what people are actually saying, building, and betting on. Topics get picked when the signal is high and the story is contradictory, when a single headline would lie about the shape of what's happening. Each post follows the same arc: one specific finding that earns the click, why the topic deserves a sweep right now, the themed synthesis with inline citations, and the follow-up threads worth watching next.

Jarrod Watts built a Claude Code mod that drops you into a multiplayer Doom server while Claude is busy. It had 7,023 likes and 378,963 views when my sweep collected it, about a day after mods shipped.

A different builder posted a tip and a prompt that have Claude build a guard mod, one that stops any Edit or Write from touching .env or a secrets file, "denied, with the reason, before a single byte changes." It had eight likes and 804 views.

Reach followed audience size. I'd still build the guard first.

Why this deserves a sweep now

Mods are under two days old, which is normally too early for a sweep. Two things made me run one anyway.

The first is reach. Anthropic's launch post on October 1 pulled about 19,000 likes, and within a day one hobbyist's directory was listing 26 mods, nine of them open source. An auto-scanning list, awesome-claude-code-mods, now shows more than 1,000. That's a lot of code with full access to people's machines.

The second is that the story already splits in two. Reach went to the biggest accounts, and the post about how safely an agent runs on your laptop barely got shown. Read only the top posts and mods look like a toy. Read the technical write-ups and they look like a way to put code in front of every tool call Claude makes. Both readings hold, and a sweep is the only place you see them side by side.

The sweep covered 17 Reddit threads, 56 X posts, 28 Bluesky posts, 61 Hacker News stories and 2 YouTube videos, plus four web search angles. Polymarket had no relevant markets.

What shipped on October 1

Mods arrived in Claude Code 2.1.287. Anthropic's own description is short: "Write one with a few lines of TypeScript, or have Claude build it for you. Mods ship inside plugins, so you install them with /plugin in the CLI or desktop app."

The clearest technical summary I found came from a user rather than from Anthropic, so read it as one person's reading of the release. Per that summary, a mod registers hooks on the session, and those hooks run as middleware. A hook can watch an event after it passes, rewrite the event before passing it down, or answer without passing it on at all, for example by denying a Bash call. Mods can also draw UI, including the band that sits above the prompt, and they keep state across hot reloads.

That's a bigger step than it sounds. Claude Code already had hooks, but those shell out once per event and hand over JSON. A mod stays loaded, remembers things, and can put something on screen.

Anthropic says the built-in /diff feature is now a mod you can turn off or replace, and that more built-ins will follow, which is a decent sign the mechanism is load tested by the people who wrote it.

Then the security line, from Anthropic's launch post: "Mods run with the same access to your machine as Claude Code itself. They aren't sandboxed, and you should only install mods from sources you trust, the same way you'd install any code on your computer." On Team and Enterprise plans, and on machines with managed settings, a built-in mod called sec-default loads first and stops user-installed mods from overriding your permission deny rules. For an individual on a laptop, that protection isn't there.

What people built in the first 48 hours

The useful builds and the fun builds landed on the same day, and they look nothing alike.

The guard. The post behind the eight-like tip has the best framing I saw all week: "a CLAUDE.md line is a request. a mod is code that runs before the tool call does." I already run a hook that blocks rm -rf before it executes, for exactly this reason, so this one reads to me like a natural upgrade path rather than a novelty. Two limits. It's a tip plus a prompt you paste into Claude to build the mod, not something you install, and by its own spec it covers Edit and Write only, so reading the file through Bash isn't covered. The post also ends by promoting the author's own product.

A sentence in a config file asks the model to behave. Code in the tool path makes it.

The live pane. Another builder shipped a set of mods that draw "a live pane with context and 5h/7d limits, the files a session changed, a timeline of each turn, and a handoff file saved on every /compact." It had one like at collection. I haven't checked whether its limits numbers are accurate, and nobody in the sweep had either.

The self-audit. The most practical idea came from a thread (183 likes) suggesting you ask Claude to review your own past sessions and propose mods for the problems that keep coming back. The examples it got back were dull in the best way: "a context guard to save progress before compaction," "a watchdog to flag low disk space and orphan processes," and a loop detector. The thread also makes the point that some of those problems want a mod and some just want a hook, a skill or a settings change.

Anthropic's own plugin. Anthropic followed up with a built-in plugin called "You should know", which "scans Claude's output for important information you might miss." You turn it on with /plugin enable cc-plugin-you-should-know@builtin. Per Anthropic's Bluesky mirror, it works by spinning off a side agent that watches what Claude says. The announcement on X had 7,085 likes, which puts it level with Doom.

The fun. Doom, as above, and a code-racing mod where you race other Claude Code users "typing real code, right above the prompt." Nobody types code anymore, so someone built a game to make you type code. I think that's awesome, and I'm not installing it.

Some of this existed before mods. claude-hud, a plugin that shows "context usage, active tools, running agents, and todo progress," sits at about 28,000 GitHub stars. claude-pace does pace-aware quota monitoring in a single file of Bash and jq. Mods give that category a proper place to live in the interface. They didn't invent it.

What I'd try first

My shortlist is short on purpose, because every item on it runs with full machine access.

1. A secrets and destructive-command guard, built from that prompt, extended to cover Bash, and run beside my existing hook before I replace anything. The gain over the hook is state and a visible reason in the UI. I'd want to see both on a week of real sessions first.

2. A context, limits and changed-files pane, only after confirming its limits numbers match what Claude Code itself reports. A pane that shows the wrong quota is worse than no pane.

3. The built-in "You should know" plugin. It's one command, it has no third-party code, and a week on long runs will tell me whether it catches anything I'd have missed.

4. claude plugin eval, which Anthropic shipped on September 11, before mods. It runs your own test cases with and without a plugin so you can see what the plugin is actually adding. Pointed at the skills I rarely call, it should tell me which ones to delete.

Where to be careful

Third-party mods first. They run with everything Claude Code can reach, so read the source before installing. awesome-claude-code-mods is trying to make that easier: "a curated list with a footprint scanner behind every row," showing what each mod can reach. I haven't tested the scanner.

Provider-swap mods are the next one. A post in r/ClaudeCode titled "Use any subscription in Claude Code!" reached 141 upvotes. A commenter called it a grey area: "now that you've called attention to the project, I would not be terribly surprised if one or two providers..." The comment is cut off in the source, so I can't tell you how it ends. A mod that routes your subscription through somebody else's terms of service is a bet on that sentence's ending.

One report that validation missed a bad key. One team reported that claude plugin validate passed a subagent file carrying a key that did nothing at all. Their advice was to read the transcript too. I haven't reproduced it, so treat it as one report.

There's at least one rendering rough edge. A user in an r/ClaudeCode thread added a band and couldn't get rid of a blank line between the band and the prompt.

And the hype check. One Bluesky user, looking at a feed full of "10x your Claude Code" posts, asked "Why are we trying to '10x' something besides ourselves?" A month earlier, Boris Cherny, who created Claude Code, had given advice that runs the opposite way to the mod rush, as quoted by Rohan Paul. It was aimed at people using Claude Code rather than building agentic products, and tied to new model releases: every six months, "delete your claude.md file, delete your skills, and delete your hooks. Then see what the model does. It might surprise you."

I run a lot of hooks and skills, so that one lands. A strong model with shell access is one bad turn away from overwriting your credentials, and a few lines of code in the tool path is the cheapest insurance I know against that turn.

I'd still delete the crutches and keep the guards.

What I'm watching next

• Stability. I found no performance or stability data on mods at all, which is unsurprising at two days old. The first reports of a mod slowing or crashing a long session will say more than any launch post.

• Whether the guard pattern catches on, or stays at eight likes while the game mods keep collecting thousands. If guards stay niche, the security story for an individual rests on reading source code, and most people won't.

• Whether Anthropic's Claude directory, which takes mod submissions, reviews what it lists. The launch post doesn't say. A reviewed directory would change the trust question for individuals. An open one would make it harder.

Sources and method

Sweep run on 2026-10-02 across a window of 2026-09-03 to 2026-10-03: Reddit 17 threads, X 56 posts, YouTube 2 videos (no transcripts retrieved), Hacker News 61 stories, Bluesky 28 posts, Polymarket 0 relevant markets (15 dropped below the relevance bar), web via four search angles. Like and upvote counts are as collected on 2026-10-02 and will have moved since.

Two caveats on sourcing. Several quotes attributed to Anthropic above come from a Bluesky account that mirrors Anthropic's posts; I've labelled those. And the sweep's own evidence list resolved two of the Reddit quotes (the provider-swap comment and the blank-line report) to off-topic threads in GTA V modding and JetBrains subreddits. The raw collection places both quotes in the r/ClaudeCode threads linked above, but treat those two lines as weaker sourcing than the rest.

Method: one cross-platform sweep, one synthesis pass, and this post written from that synthesis. Quotes and counts trace to the sweep output. The view counts, Anthropic's launch post and the 1,000-plus directory count were checked live on October 3.

Last 30 Days is a research series on Run Data Run. No email on these, they live on the site for when you want the receipts. If a sweep was useful, subscribe and you'll get the next one as it lands.

This is a two-minute film about a genetic arrangement an AI agent spotted in a virus's DNA that the genome's own authors had never described. I started the conversation a little before nine on the morning of October 1, then went and did my actual job. The ninth version rendered at 4:23 that afternoon. I didn't write a frame of it.

The calendar says a day, because I was doing my actual job in between. By my rough count it was a couple of hours of computing time, about an hour of mine, and around $50 in tokens at API prices. That covered the finished phage film plus the storyboard, narration and first paintings for a second one. I pay a flat subscription, so the bill I actually saw was zero.

The science comes from a post I wrote last week. Anthropic pointed 949 agent sessions at public genome data. One of them, reading the raw letters of a jumbo phage, noticed a short sequence repeating beside a reverse transcriptase, an enzyme that copies RNA back into DNA. The phage's original genome report had described neither the repeats nor the gene beside them. When the team ran the same search ten more times, every rerun missed it.

I wanted that story told visually, for people who don't read preprints. So I asked Opus to make it into a film. It also made a second one, which I'll get to, because the second film turned out to be about the thing I spent my day doing.

What's actually inside one of these films

A film made this way is a software project with a soundtrack.

There's no video editor in the loop.

It starts as a storyboard: a table with one spoken line per row, and a description of what the viewer sees while that line plays. Opus writes it from the source material and a research pass on how good explainers handle the same subject. For the phage film that meant Drew Berry's molecular animations and the way 3Blue1Brown keeps one object on screen while the camera moves around it.

Then the voice goes first. A small text-to-speech model called Kokoro runs on my laptop, reads each line, and records the exact moment every word lands. Those timings drive everything after. When the narrator says "reverse transcriptase", an arrow draws itself on that word, because the animation is keyed to the timestamp.

Each scene is a small web page, animated on a single timeline and rendered one frame at a time. The renderer blends eight sub-frames into each frame for motion blur, then adds a little film grain. That's most of the difference between "website" and "film".

Code can't paint a virus, though. For the parts that need a real picture, Gemini generates painted backgrounds, which film people call plates. An open video model on my DGX turns a still plate into five seconds of slow motion, three and a half minutes per clip, for free.

Last comes a critic. A separate agent, told nothing about what was built or why, watches the render. It gets contact sheets, frames at every transition and a transcript of the audio, and writes up what a person would notice.

Opus builds the scenes in parallel, one agent per scene. The parent agent keeps the storyboard and the final cut.

That's a 67-second explainer of the pipeline, made by the pipeline, from the day before. It was the first one I approved. My entire review was "awesome!", which tells you how low the bar was before we tried for spectacular.

The skill rewrites itself between renders

The whole pipeline is a Claude Code skill: a set of instructions Opus loads when I say "make a video", plus a ledger of every ruling I've made and every trap it has fallen into. The ledger is the part that makes it fast. The skill, ledger included, is public in Claudelicious, my open cookbook for running Claude Code as a system: the skills, hooks, memory and learning loop behind everything in this post.

When I give a note, Opus does two things in the same session: it fixes the frame, and it writes the note into the skill as a dated rule. The next render already follows it. So does every film after it.

Nine versions fit into one afternoon because no mistake had to be made twice.

Here's what that looked like on the phage film.

The first draft was a slide deck that moved. Typed letters on navy, ticking counters, a corner label like a news channel. My note: "pretty basic." Within the hour the skill had a new first step: paint two looks as stills, I pick one, then build. The second film's look took me about thirty seconds.

A number landed in the wrong organism. The 8% figure came from a Staph phage, and a scene had drawn it inside E. coli. New rule: check the brief against the primary source before storyboarding.

A counter invented data. It ticked through 2 of 200 and 7 of 200 on its way to a value the source only reports at the end. New rule: print only the sourced number.

The ending just stopped. My note was "the ending is weak." Version nine lights the 14 real repeat rows, flares them on the last line and holds while the music resolves. New rule: every ending lands on its last word.

None of those were hard. Each needed somebody to look at the frame and say what was wrong, once.

The critic catches a lot, and it's still a guess

The critic ran three rounds on the phage film. It found real problems I'd have missed on a laptop speaker: a music bed so quiet it was effectively missing, diagrams shrunk to a sliver of the frame, the same caption style reused eight times until it read like a template. It flagged that the film's central number, one hit in eleven runs, never actually appeared on screen. Fixed by round two.

Round two also told a scene agent to make the reruns visibly miss the gene. The agent did exactly that, and round three flagged that the film now contradicted the science: the reruns reached the same genes and passed them by without reading the stretch of DNA beside them. Following the critic had produced a cleaner-looking film that was wrong.

So every critic note now gets checked against the fact sheet before it goes to a builder.

A critic's fix is a claim about the world, and I check it like any other finding an agent hands me.

The second film is the same lesson

The second film ties three posts together. The lab post is the first: the agents surfaced 17 candidate partner gene families, and only three held up as previously unreported. Telling those apart took experts, and then a lab bench. The second is OpenAI measuring 3.1 days of agent work for every day of human work, with over half of the long successful tasks still needing a person to step in. The third is about the record agents leave behind, which only becomes useful once someone has defined what a good result is.

It's painted like a watercolor this time: a night sky of star trails, a gold-panner's tray, an office tower lit floor by floor, a sealed envelope. Code draws everything that moves on top of the paintings.

That film's argument is that agents can do the work now, and the scarce part is someone who decided what good looks like before the work started. I spent a whole day living it.

Opus wrote the storyboards, generated the paintings, built the scenes, timed the voice, ran the critic and assembled the cuts. I read source material it had already summarized, picked a look from two options, and watched renders. The day's real decisions were mine and they fit in a few sentences: this is basic, this ending is weak, I like these backdrops, two paintings with a voice over them isn't an explainer.

That last one landed on day two. The first cut of the second film was two lovely paintings, a slow camera move and a narrator.

Every frame passed every check the pipeline has, and it was boring.

No critic would have flagged it, because nothing in it was broken. It just wasn't what I wanted, and only I knew that.

That's the bottleneck from all three posts, at the size of one person and one film. Three things helped.

Decide the look before the first frame. Picking between two painted directions took me thirty seconds and saved hours of building toward the wrong world. In a lab or a data team the equivalent is writing down what a good result looks like before the agents run, the way a clinical trial protocol names its endpoint before the first patient enrolls.

Give the critic the facts, not just the output. A critic that can only see the film can tell you it looks wrong. A critic with the source facts can tell you it's wrong.

Put the rule where the next run reads it, the same day. For me that's the skill's ledger. For a team it's the eval suite, the prompt or the checklist the agents run against, updated before the next run rather than in next month's retro.

I asked for a second opinion on this ending

The first version of this post ended on a count: 31 rulings, 42 traps, and a promise to publish the next number. Before calling it done, I ran it past a second-opinion skill I built. It hands a draft to two models from other labs, DeepSeek and GLM, and has them argue with my own take.

Both said the ending was bookkeeping. DeepSeek went further and pointed out that I'd written a rule into the video skill saying every ending lands on its last word, then ended my own post by just stopping. Fair. A little rude, but fair.

What they pitched was better than what I had. GLM said to keep the count, but as a starting line instead of a finish line. DeepSeek said to aim for better notes: fewer about pronunciation and invented counters, more about the story. Which is awesome, because that's the version of this I actually want.

Here's how I see it going. Every note I give teaches the skill a piece of the mechanics, and the mechanics stop needing me. What's left is the part I like: which story deserves two minutes of someone's attention, and what it should feel like to watch. Nobody else can give that note for me, and I wouldn't want them to.

What I'd make once my notes are only about the story is probably my next post. For now the ledger says 31 rulings, and the third film starts from all of them.

Agents do real work now. In LangChain's survey of more than 1,300 people building them, 57% had an agent in production. They draft the monthly report, answer the first round of customer email, reconcile invoices, and summarize the literature before the Monday meeting.

Most of those jobs end the same way. A person reads what the agent produced and decides what to do with it. A reviewer opens a summary drafted overnight, fixes one sentence that overstates a finding, and approves the rest.

That fix is the most useful thing to come out of the whole exchange, and in most companies it goes nowhere. The document gets better. The agent doesn't, and tomorrow it makes the same mistake for someone else.

There's a growing argument that those corrections, and everything else agents leave behind, could end up worth more than the work itself. I think the argument is right. I also think most companies can't use any of it yet, and drug development has a good way of explaining why.

No trial starts without a primary endpoint. Before the first patient enrolls, the protocol says what success means and how it will be measured.

Most agents went into production without one.

The exhaust

Satya Nadella gave the byproduct a name this summer. In an essay in July he wrote: "Models learn from 'exhaust,' the prompts people write, the tools agents use, and especially the corrections people make when the model is wrong."

The best example I have is the post you're reading.

It started with a tweet and a hunch. Agents went off and researched it. I read what came back and argued with half of it. More research. An outline. A draft that I told the agent read like a review journal article, so it got rewritten. Somewhere in the middle I decided I disliked the metaphor the whole piece had been built around, and it went too. Then another round of research, another rewrite, more guidance from me.

Every one of those steps left a record of a decision: what to keep, what to cut, which source was worth trusting, which argument held up. That's exhaust. It's a far more detailed record of how I think a piece through than anything I could write down if you asked me to.

So where do those decisions go?

Mostly, nowhere. The reason I dropped that metaphor lives in a chat window, and next month an agent may well hand me the same metaphor again.

Saving everything doesn't fix it either. My own agents send their model calls through a gateway that logged every one of them for five months. When I finally went to learn from that log, it held 469,930 rows, and the two columns meant to hold what was asked and what came back were empty in every single one.

I didn't have a record of decisions. I had plumbing.

MIT's NANDA group studied why most enterprise AI projects show no measurable return and ended up in the same place. Their report says: "The core barrier to scaling is not infrastructure, regulation, or talent. It is learning." Most of the systems they looked at "do not retain feedback."

The pitch for AI exhaust is that you stop throwing those corrections away. Capture them, learn from them, and your agents get better every week. Over time your company builds up something a competitor can't buy: a record of how your people make decisions. Nadella's worry was that this record leaks to whoever supplies your models, and that you should keep it.

In January I wrote about the context graph, the idea that agent work leaves behind a searchable record of how decisions get made. This is the harder half of that idea. A pile of records doesn't teach anything on its own. Three things have to be true first. The agent has to be doing a job you understand. You have to know what doing it well looks like. And you have to be able to connect what the agent did to what happened next.

Start with the job

Most agents never leave behind anything worth learning from, because they never get out of the pilot. The model is rarely the reason.

Every business process exists twice. There's the version in the procedure document, and there's the version people run. The document says invoices over a threshold need two approvals. The person who has done the job for eight years knows which three suppliers always send duplicates, checks those first, and waves through the rest.

An agent meets the second version on its first day. If nobody has written that version down, nobody can tell the agent about it, and nobody can say afterwards whether it did the job. So the pilot produces some good outputs and some strange ones, nobody can explain the difference, and the project stalls in a steering committee.

McKinsey tested 25 things companies do with AI to see which ones showed up in the bottom line. Redesigning the workflow had the biggest effect of any of them. Only 21% of companies using AI had fundamentally redesigned even some of their workflows.

Decide what good looks like

Once you know the job, you can say what doing it well means. In AI that written-down definition is called an eval, and I argued in May that evals are the new bottleneck. It's a set of checks that run every time the agent works. The summary cites a source for every number. The support reply resolves the issue without the customer writing back. The contract clause matches our fallback position. Some of those checks run as code, some need a person, and some use another model as the grader.

This is where coding agents got lucky, and why they took off first. Code grades itself. The tests pass or they fail. The developer accepts the suggestion or deletes it. Cursor feeds those accepts and rejects back into its autocomplete model and rolls out a new version every 1.5 to 2 hours. That's awesome, and it's only possible because every suggestion arrives with a free verdict.

A claims decision, a site-selection memo or a blog post comes with no verdict attached. Someone has to build one. That missing grader is most of the distance between coding agents and everything else a company does.

Most companies haven't built it yet. The same LangChain survey found 89% of respondents monitor what their agents are doing, and only about half evaluate whether the output was any good.

Watching tells you what happened. Grading tells you whether it should have.

You also won't get the definition right up front. The first time a team sits down to grade fifty agent outputs, they argue. One reviewer marks a summary down for dropping a caveat. Another thinks the caveat was noise. A third says the summary is fine for the internal meeting and wrong for the regulator. Shreya Shankar and her colleagues watched people grade AI output and named this criteria drift: "users need criteria to grade outputs, but grading outputs helps users define criteria."

I didn't know "reads like a review journal article" was one of my failure modes until I read one with my name on it. Now I know to look for it.

That argument over examples is the business process getting written down for the first time, by the people who run it. Understanding the process and writing the eval turn out to be the same piece of work.

Capture both halves

Now the exhaust starts to mean something, provided you capture two things rather than one.

The first is the process record: what the agent did and where a person stepped in. The second is the result: whether the thing the work was for actually happened. The customer didn't write back. The filing was accepted. The site enrolled on time.

Each half is only half a finding. The process record tells you what happened and not whether it was good. The result tells you it went well and not why. Joined together, they show you which step made the difference. A support reply the reviewer loved, followed by the same customer writing in again the next morning, tells you something neither record could tell you alone.

Drug development already runs a version of this. Big cardiovascular trials use a committee of clinicians to rule on every suspected event. Was it really a heart attack, a stroke, a bleed? Each ruling is made against a definition the trial wrote down before it started, so every one of them is a decision with the grading built in.

A team publishing in Circulation trained a model on one trial's committee rulings, then moved it to a second trial with a different drug, different patients and different definitions, adapting it with 20 of that trial's suspected events per endpoint. Among 13,885 suspected primary-endpoint events in the second trial, GPT-4o reading the records directly got 76.3% right. The purpose-built model got 86.4%. With humans taking the 30% of cases it was least sure about, the combination reached 95.6%.

The study is retrospective, and it doesn't separate how much of the gap came from those 20 examples and how much from everything else about the system. What it does show is a general model losing to a much smaller record of how one particular group of people rules, when every ruling came with its definition attached.

The hard part is that results come back at different speeds. Some arrive in seconds: the reviewer accepted the draft, edited it, or threw it out. Some take days: rework, escalations, how long the case stayed open. The ones you care about most can take months: the renewal, the regulator's response, the study readout.

So in practice you learn from the fast signals and keep checking them against the slow ones. Most of the time they point the same way. When they don't, when the drafts reviewers love are the ones that keep coming back from the regulator, the agent is getting better at the wrong thing, and only the joined record will show you.

This is also where Nadella's warning gets sharper. A pile of ungraded traces shows a competitor what you did.

A graded pile shows them what works.

Where the learning lands

Put it together and you get a loop. The reviewer's correction from this morning becomes a check the agent runs tomorrow, and next quarter's outcomes tell you whether that check was right.

Companies are already running it. Airbnb's customer-support team built one into its support AI, with the human agents' feedback on each suggested reply flowing straight into the next version. Retraining went from a months-long cycle to a matter of weeks.

Airbnb's loop feeds its lessons back into the model. That isn't the only place they can go, and where they get stored is the decision a leader actually owns. You can retrain the model itself, or you can change the harness around it.

The harness is everything that isn't the model: the instructions the agent follows, the examples it's shown, its tools and checks, and whatever it remembers from last time. The model is the part you rent. The harness is the part you build, which is why I called it the moat back in June.

That difference grows every quarter, because the models keep getting replaced. A better one arrives every few months, and a lesson trained into last year's model stays behind when you switch. A lesson written into the harness comes with you.

It's cheaper too. The researchers behind GEPA had an agent rewrite its own instructions from its mistakes, and it beat retraining the model by 6% on average while needing up to 35 times fewer attempts.

I've moved my own work between models several times this year. What carried over each time was everything around the model: the instructions, the examples, the checks. Anything that had only ever lived inside the old model stayed behind.

So when a correction turns into a new check, or an example of what good looks like, or a rule the agent follows next time, it compounds. A competitor can license the same model you use.

They can't license your harness or the record of every time your loop has turned.

The loop can fool you

There's one way this goes wrong that looks exactly like success.

Economists call it Goodhart's law: when a measure becomes a target, it stops being a good measure. Tune an agent against the same eval for a quarter and the eval starts measuring how well you tuned, and stops telling you much about the work.

I watched this happen on one of my own research agents this summer. It ran more than six hundred experiments in a couple of days with a green dashboard the whole time. Almost all of them were the same experiment. Every metric said it was working. What caught it was a person reading the results, which is the slow signal doing its job.

That's the protection. As long as results from the real world keep coming back and rewriting what counts as good, the eval can't drift too far from the job. The loop has to keep turning for the same reason it was worth building.

The endpoint

Go back to the trial for a moment. The endpoint isn't there to satisfy an auditor. It's there so that when the data comes back, everyone already agreed on what it would mean, and the result can change what happens next.

That's the whole argument for AI exhaust, and the whole problem with it. The records your agents leave behind are worth a great deal, but only after someone has written down the job, decided what good looks like, and gone to get the result. Then every correction becomes a lesson, every lesson lands in a harness you own, and the value of the exhaust is set by how fast that loop turns.

None of that work belongs to the agent. Somebody has to own the definition of success for each process an agent touches, and somebody has to go and collect the outcome when it arrives.

In most companies, nobody has been given either job.

Page 8 of Anthropic's new preprint has one paragraph that almost none of this week's coverage carried. After its agents found the thing everyone is writing about, the team ran the exact same search campaign ten more times. Same harness, same brief, same model. The pattern at the centre of the discovery was missed in every rerun.

That's the detail I'd lead with, and Anthropic deserves credit for printing it. The announcement was titled "Claude discovers a novel enzyme system with CRISPR-like repeats", and most of the coverage ran with the CRISPR half. The preprint's own title is narrower: "Autonomous AI agents discover reverse transcriptases with tandem repeat arrays." The CRISPR framing is a bigger claim than the paper makes, and a smaller story than the one in it.

So which part of this is the discovery, and which part is the machine? Ask it, because an R&D team planning its own agent work needs the second answer far more than the first.

What Anthropic built

Start with the part that should get a leader's attention before any biology does. Anthropic formed a life-sciences research group this spring, and it has a physical lab, which Reuters had reported days before this announcement. In the company's words: "Our lab, located in the Bay Area, looks like a typical molecular biology lab." It works at biosafety levels 1 and 2, handles no pathogens that infect humans, and "All of the lab work is performed by human scientists."

So a frontier model company now owns the whole loop, from reading the world's sequence data to pipetting in its own building. Two weeks ago I wrote about Anthropic shipping a standard for agents to drive lab instruments. This is the other end of the same wire.

Then the campaign. The team pointed a harness of Claude agents, running Claude Mythos 5, at reverse transcriptases, with a brief to find new systems by the partner genes that sit beside them. Note what the brief aimed at: protein-coding partner genes, not the non-coding DNA where the surprise turned up. Then it let the harness run without a human in the loop. The preprint gives the numbers.

The agents started from 1.94 billion protein clusters in metagenomic databases. They pulled out roughly 200,000 reverse transcriptases from that pile. They scored 3,564 protein families that kept turning up next to those enzymes, and finished with 19 reports written up for humans. The whole campaign ran 949 agent sessions, up to 58 at a time, and 215.6 million tokens over 21.5 hours of wall-clock time.

Anthropic's blog says this analysis "can take weeks to months of work" for an expert. That's fair. Nobody I know was going to hand-curate 200,000 enzyme neighbourhoods this quarter.

The moment the announcement hangs on happened inside that run. One agent, looking at an enzyme in a jumbo phage (a virus that infects bacteria, with an unusually large genome), read the raw DNA next to it and noticed a row of short repeats. No repeat-finding tool had been run. The preprint is specific: "No earlier tool call contained a repeat analysis, and no established repeat finder was run in the session." The agent saw a pattern by reading the letters, decided it was odd, and flagged it.

Then humans took over the bench. They cloned the gene region into E. coli and sequenced the small RNAs it made. A Claude session also dug up a published infection dataset showing the repeat region's RNAs at up to 8% of all phage transcripts fifteen minutes into infection. That's a lot of RNA for something with no known job. Feng Zhang, one of the people behind CRISPR gene editing, reviewed the preprint and said the finding "merits further investigation."

That's the claim at its strongest, and it's a good piece of work.

What it found, in plain language

Anthropic named the system ART, for array-associated reverse transcriptase. It has three parts sitting together in the phage genome.

The first is a reverse transcriptase, an enzyme that copies RNA into DNA. Bacteria already use one family of these, called retrons, as an alarm system against viruses, and the ART enzyme sits on a branch right next to them. The second is a partner gene nobody had characterised. The third is that row of repeats, which looks a lot like the arrays that give CRISPR its name.

The enzyme isn't new. The arrangement is.

Anthropic says so itself. The preprint notes that the phage's original genome report "identified the RT and proposed a 5′ ncRNA, yet described neither the repeats nor the partner gene." The sequence was public, and the repeats went undescribed.

The most useful outside read came from Lucas Harrington, who did genome mining for his PhD. He points out that "people have been finding RTs associated with CRISPR arrays since 2008", that neighbourhood mining has turned up new biological systems for decades, and that "Finding a weird cluster of genes and repeats is often the easy part." His bottom line: "Anthropic does not yet know what this does."

He's right, and the preprint agrees with him in writing: "we have not shown that the RT is active or that the unit RNAs are its substrates. Whether the RT and its partner interact, and what the system does for the phage, are currently unknown."

There's a second wrinkle. The preprint notes that arrays like this were recently found beside an unrelated family of reverse transcriptases using a genome language model built to mine non-coding DNA, and reads that as a sign the arrangement "arose more than once in nature." In his own post, Dario Amodei adds that a Stanford team, working independently, "described a novel RT system with an associated non-coding array that is in some ways similar to the one Claude found." So a purpose-built tool found one of these, and a general-purpose model reading raw DNA found another.

The finding is small. The machine that found it is the news.

How it landed

The wires were careful with the facts. Reuters said Claude "helped discover" a system "reminiscent of" CRISPR. AFP carried the two caveats that count: the preprint "has not yet been reviewed by other scientists", and the system's function "remains unknown."

The best mainstream piece came from Gizmodo, which pulled together what working scientists were saying. Kevin Blake, a microbiologist at Washington University School of Medicine, told Al Jazeera: "There's nothing to indicate this is a rival to CRISPR-the-technology," and said nothing yet points to a therapeutic or practical use. Dimitri Perrin, a computer scientist at QUT, put it in one line in The Conversation: "ART is CRISPR-like in its architecture, but there is no evidence that it is CRISPR-like in its function."

The CRISPR frame started at the top. Dario's post opens by calling ART "a molecular machine that we suspect could represent a new gene editing mechanism." He hedges in the next sentence, but the first phrase is the one that travelled. The same AFP piece that flagged the missing peer review also reported that Dario said the finding may be a new gene editing mechanism with possible uses in gene therapy. Both sentences, one article.

Online, the loudest pushback came from people who've done genome work. On X, most of the enthusiasm came from AI and tech accounts, and the most-shared pushback was Harrington's, at over 400,000 views. Hacker News ran past 750 comments, and its loudest thread asked why the headline credited Claude and not the team that designed and ran the work. On r/biotech, one reply summed up the bench view: "So...peer review? Or are we just doing 'trust me bro' now."

Most of the fight was over the verb. The most detailed critics went further and went after the paper's apparatus: too few accession numbers, unnamed strains, sequences they couldn't find when they searched for them. That's a fair hit, and it's the kind a methods section can fix.

And the ten reruns barely surfaced. In the coverage I read, including Reuters, AFP, TechCrunch and Gizmodo, they don't appear. One Medium writer led with them.

Ten reruns, one hit

Here's the paragraph. Anthropic asked whether the discovery was reproducible inside its own harness, so it ran the full campaign ten more times. Nearly every run that finished the first survey stage sampled ART loci. In two of them, agents even followed up on the lineage. "However, none read the DNA upstream of the RTs, and the array was missed in every rerun." (Anthropic found the misses by searching the rerun logs for the original campaign's identifiers, and says an ART gene region outside that set wouldn't have shown up. The limit is theirs to state, and they stated it.)

Anthropic's explanation is the size of the search space and "the non-deterministic behavior of the harness." Put plainly, hundreds of worker sessions were each making judgement calls about where to look next, and those calls came out differently every time.

What the team did next, I'd want every vendor to copy. They built a fixed test. Hand a model the ART DNA directly, ask it to characterise the system, and have a judge model score its report against ten features the team considers characteristic. Seven Claude models took it, and the paper reports "a clear gap" between the four most capable (Opus 5.5, Mythos 5.1, Mythos 5 and Opus 5) and the other three (Opus 4.6, Opus 4.8 and Sonnet 5). The judge was a Claude model scoring against Anthropic's own rubric, which is a reasonable design and still a limit.

Given only the DNA in context, the most capable models described the array accurately in at least 90% of attempts. Getting the harness to point at the right stretch happened once in eleven tries.

The model can see it. The search found it once in eleven runs.

The same test turned up something stranger. Giving the models more tools made them worse at spotting the array. With the full toolchain, accuracy on the array fell as low as 32% for one of the top models, and the transcripts show why: in 39% of attempts with files, the model never read 200 letters of DNA in a row, so it never saw more than about one copy of the repeat. When the models did read a long enough stretch, recognition jumped. The agent that found ART found it by reading. Its tools would have let it skip the reading.

Printing the ten misses is awesome, and rarer than it should be. It's also the most useful number in the paper, because it's the one you'd plan around.

What running a lab like this looks like

I've spent 25 years walking R&D labs, and the thing that always sets the pace is the gap between how many ideas a team can generate and how many it can afford to test. This campaign changes one side of that gap and leaves the other alone.

Dario says the same thing in his post, more precisely than most commentary did: if the approach works it "could greatly increase the number of promising candidates that go into the pipeline", which he calls "an increase in throughput even though latency remains." Reading got cheap. The bench didn't. ART got its validation because humans in a real lab did the cloning and sequencing, and after the campaign "the authors directed the analysis and Claude wrote and ran the code."

If you run a genomics or discovery group, the preprint hands you the operating model, most of it by accident.

You budget for campaigns, not a campaign. One run found ART. Ten didn't. If this had been your team's first and only run, you'd have either a discovery or a shrug, and no way to know which was typical. Treat agent discovery the way you treat a screen: the unit of work is ten or twenty runs, and the hit rate is the number you report upward.

You make the agents read. The tooling result says the fastest way to miss a pattern is to give an agent enough tools that it never looks at the raw data. Check the transcripts for how much of the actual sequence your agents put in front of themselves. If the answer is a line at a time, you've built an expensive way to skip the data.

You add a deterministic check once you know what you're looking for. The agent's value was noticing a repeat array nobody had told it to look for. Now that these arrays are known to sit beside reverse transcriptases, a standard repeat finder is a cheap check that doesn't depend on which way the workers happened to wander. Let the agents do the noticing. Once they've noticed, write it down as a rule, so the next ten runs don't have to be lucky.

You staff the novelty call with an expert, and you put them early. The preprint has the number for this too. Of the 17 candidate partner families the campaign surfaced, three held up as previously unreported associations. The other 14 were annotation errors, parts of systems already described, or genes that just happened to live nearby. Even for ART, the answer to "what here is new?" was the arrangement, not the enzyme. Your agents will produce candidates faster than anyone can check how they're described. Somebody with Harrington's background has to grade those descriptions before a slide deck or a press release repeats them.

You read the vendor's preprint like any other paper. Methods and limitations first, headline last. This one rewards it. The rerun paragraph, the "currently unknown" sentence and the model comparison are all in there. Read those three and you know more than the announcement tells you.

One more fact from the fixed test belongs on a planning slide. The three lower scorers were two prior-generation Opus models and Sonnet 5, the current Sonnet. So the gap runs between the top tier and everything else, including the cheaper tier that a cost-conscious pipeline tends to default to without anyone deciding it should. A pilot that ran on the cheaper tier and found nothing told you about the tier.

Reading got cheap. The bench didn't.

Anthropic found ART once in eleven runs, saw three of seventeen candidates hold up, and printed all of it. The repeats had been sitting in a public genome, right beside an enzyme somebody had already named. A machine that doesn't get bored read that stretch letter by letter, once.

Somewhere in the last fortnight, a program I wrote scored a news story zero out of ten because it could not read the answer it got back. I do not know which story, or how many, and neither does the program.

It runs at two every morning, reads the day's AI news and rates each item out of ten. It has done that 1,518 times in a fortnight. I wrote it, I use it, and until last week I had not looked at one branch of it in months.

That branch asks a language model to rate a story, the model writes back a paragraph, and my code tries to pull a number out of the paragraph. When it cannot, it waits and tries again, waits and tries a third time, and then gives up and writes a zero.

Not an error. Not a blank, not a flag saying the scoring failed. A zero, which happens to be a real score a real story can really get. Everything downstream treats the two identically, because they are identical.

The bug only exists because the answer arrives as writing that something has to interpret.

The sixty-second version, if you would rather watch it.

We bought a writer, then spent four years trying to stop it writing

Once you see that shape you cannot stop seeing it. Ask a model a yes-or-no question. Get back a paragraph. Pull the answer out. Check it. Retry when it comes back malformed. Throw the paragraph away.

Look at what the industry built to cope. JSON mode. Function calling. Structured outputs. Grammar-constrained decoding. Schema validators sitting downstream of all of them, and a retry-with-repair loop sitting downstream of those. Some of that machinery does constrain what the model can emit. Most of it just inspects what came out and has another go. Either way something downstream has to catch the case nobody planned for, and that something is code a person wrote on a Thursday afternoon. Mine writes a zero.

Four years of structured-output features, all of them bolted onto a writer to stop it writing. They work most of the time, which is the problem.

We have spent four years buying writing that nobody reads.

It worked, which is why nobody stopped to ask how strange it is. You want one bit of information, so you commission an essay, then you employ a second piece of software to read the essay back to you and a third to decide what to do when the essay is malformed. Diogo Almeida, who co-authored the 2022 paper that helped make ChatGPT possible and now runs a company called TypeSafe, points out that before this era, knowing how sure a model was about its answer was "just table stakes" for the field, because otherwise you could not put it into a system at all.

We gave that up in exchange for models that could talk.

What if it just answered

TypeSafe's model is called Jev, and it launched on Monday the 15th of September. You hand it a question and the complete list of answers it is allowed to give. It gives you one of them. That is the whole interface.

The difference is not that it follows your format better. There is no format to follow. You do not ask it to reply with one of three words and then check that it did.

The three words are the only things it can emit. Nothing gets parsed, because nothing was written.

It comes in three shapes, and each replaces a prompt you have almost certainly written.

The first is picking one. Instead of "respond with exactly one of BILLING, BUG or FEATURE and nothing else", you supply the options and get one back. Instead of "answer YES, NO, or UNKNOWN if the record does not say", you put those three on the list, and the third one stops being a thing you hope the model remembers.

The second is a probability. Instead of "rate your confidence from 1 to 10 that this document is relevant", which returns a number composed the same way it composes everything else, you state the condition and get an actual probability between nought and one.

The third is a position on a scale you define. Instead of "score this and explain your reasoning", you get the score. There is no reasoning, and that turns out to be the thing you give up that you will miss most.

That is the entire product. It cannot write a sentence. That is the design, not a limitation someone is working on.

It answers in well under a second, and costs somewhere between a fortieth and a four-hundredth of what a chatbot charges for the same judgment. Those are the vendor's ranges, quoted as ranges. Here is somebody else's: an engineer ran it against the graders already running in his own production system and got 35 of 36 on a classification job, for about a hundredth of what he had been paying.

What comes back instead of a sentence

Ask a chatbot how confident it is and it will tell you, warmly and at length, and what you have is an adjective generated by the process that generated the answer. If the answer is wrong, the confidence is wrong in the same direction, for the same reason.

What Jev returns is a different quantity. A distribution over the options you supplied, computed rather than composed, which you can compare against the one it gave you last time and the one it gave your colleague. You can sort by it.

That single property is the difference between a demo and something you are allowed to deploy.

It is what lets you draw a line and say everything above this runs on its own and everything below it goes to a person. Every governance conversation I have sat in comes down to where that line goes and who reads what falls under it. A system that cannot say "I am not sure" has nowhere to put the human, and that system does not ship in a regulated industry however good its accuracy is.

One caveat costs nothing to apply and everything to skip. The number is only honest if you give the model somewhere to put "I do not know". One outside audit went looking for exactly that last week, on questions built so the passage does not contain an answer. With an abstain option on the list, the model declined 95 times out of 100 and its confidence was as accurate as the test could measure. Delete that one option and it answered every unanswerable question anyway, took the stereotyped answer four times in five, and reported 79% confidence doing it. One person ran that, last week, and nobody has repeated it since, so I would want it replicated before betting a process on those exact numbers. The direction is the part I believe: the safety property lives in your schema, not in their model.

Why it spread in forty-eight hours

In 1865 William Stanley Jevons noticed that better steam engines burned more coal, not less. Efficiency did not reduce demand. It made coal worth using for things nobody had bothered with. TypeSafe named the model after him, which is either confident or cheeky.

Twenty-five projects appeared in two days, clustering into eight repeatable shapes, and the commonest by a distance is deciding what to do next while something is already running. Somebody has one playing Doom. Ten decisions a second, about seven dollars an hour. That shape barely existed a fortnight ago, because you do not put a judgment inside a loop that runs ten times a second when each one costs three seconds and real money.

Vercel is the signal I would actually bet on. They shipped support in under twenty-four hours, and to do it they had to add a new kind of call to their SDK, because every existing way of talking to a model assumed the model would write something back. A major platform changed the shape of its own interface to fit.

Where the line is

Two people have gone looking for where it breaks rather than showing off what it does. One against a game solver, one against the graders already running in his own production system.

Line those up and the boundary is clean. Where the categories are fixed and the call is shallow, this thing is awesome, and cheap enough that you stop rationing it. Where the decision needs working something out from a situation rather than reading a description of one, it is wrong more often than it is right, and on the one adversarial spot anybody has published, a free model with no thinking budget beat it.

And then there is the thing it can never do, which no version number fixes. It cannot write, so it cannot explain. There is no reasoning trace, no rationale, no paragraph you can put in front of a reviewer saying why. You get a choice and a number. For a decision somebody has to defend later, that is often disqualifying on its own, and it is the reason the confidence number has to carry so much weight: it is the only thing the model gives you besides the answer.

The one I went and tried

The public trial registry holds something like 470,000 studies, and somewhere in that pile is the handful a given patient could actually join. Finding them is a reading job: open the trial, open the patient's history, decide whether the criteria fit. Coordinators do it by hand, and the reading is the cheap part rather than the whole of it, because plenty of patients who look eligible on paper turn out not to be once the labs come back.

That is a score question asked a few hundred thousand times per patient. It has never been a modelling problem. It has been a budget problem.

So I ran it. There is a public benchmark NIST built in 2021 for exactly this: seventy-five patient summaries, a frozen snapshot of the registry holding 375,000 trials, and thirty-five thousand patient-trial pairs that human assessors already graded as eligible, excluded, or not relevant. Somebody else's labels, somebody else's grading, no marking my own homework.

Two things came out of it that I did not expect.

The first is that the shape fits almost too well. Every one of these decisions is a threshold problem before it is an accuracy problem. You are never going to automate "is this patient eligible" outright, and you were never trying to. You want to rank ten thousand trials, hand a clinician the top forty, and be able to say what the cutoff was and why. That is precisely what a sorted probability gives you and what a paragraph never did.

The second is that it is harder than the launch week suggests. My own local version of the idea did not clear the bar I set for it, and a chunk of the gap turned out to be my measurement rather than the model, which is its own lesson about believing a number the first time you see it. I will publish that properly when the re-run is done.

Neither of those is a disappointment. The interesting finding is that the expensive part of this problem stopped being the model. Three years ago the reason nobody scored every patient against every trial was that it would cost more than the trial. At four cents a thousand decisions, that sentence is no longer true, and what is left is the boring work of deciding where the line goes and who reads what falls below it.

Go and find your zero

The bug in my nightly job is small, stupid and invisible, and I would bet your systems are full of the same thing. Somewhere a "we could not tell" is being written down as a number. A blank field is being read as a no. An unparsed answer is being stored as a score of zero, and every dashboard downstream is averaging it in with a straight face.

Those bugs exist because we have been buying prose to get answers, and prose has to be interpreted by something, and the something is always cheaper than it should be.

No model got smarter this week. Answers got cheap enough to ask for constantly, and they started arriving with a number attached saying how much to trust them.

So the question to take into Monday has nothing to do with which model to use. Where in my work is there a pile of small judgments that nobody has time to make? The queue that never gets worked. The review that samples 5% and hopes. The escalation that happens on Monday for something that broke on Thursday. The field somebody fills in by reading a document, four hundred times a week, and nobody has ever measured how often they are right.

Every one of those was uneconomic because judgment cost three seconds and real money and came back as an essay. Most of them are not hard. They are just numerous, and numerous is what got cheap.

Find yours. Then hand whatever you are thinking of pointing at it a way to say "I do not know", and watch whether it ever takes it. Anything that always has an opinion is not measuring its own ignorance, it is hiding it, and you will inherit that at scale.

Then draw the line. Above it, the machine. Below it, a person with a queue short enough to actually work. That argument has not changed in twenty years. What changed on Monday is that the cheap side of it finally turned up with a number in its hand.

In the week of 8 September, the four largest AI labs agreed in public, for the first time, that the industry is moving too fast.

On the Tuesday, a researcher named Jacob Coxon resigned from Anthropic and posted about it. He'd spent three years doing pretraining research at both OpenAI and Anthropic. "Neither company is acting responsibly," he wrote. "They are racing straight to self-improving superintelligence and gambling with our lives." CNBC reported the post passed 70 million views. My own sweep of X logged it at 171 million, and it was over 172 million by the time I finished checking.

Then Anthropic's own alignment lead agreed with him in public. Evan Hubinger: "Jacob is correct here, we really do earnestly believe AI could kill all humans! I personally think it is >10% within the next decade." He added that Anthropic is trying its best and does not yet have a plan to solve alignment for superintelligence.

The day before, OpenAI's chief scientist Jakub Pachocki had already written that no AI company has "solved alignment and monitoring to a sufficient degree to continue responsibly scaling at maximum speed for much longer," and that he expected and hoped for "voluntary slowdowns to become commonplace."

On Saturday, Dario Amodei published We Must Pace the Frontier. Sam Altman agreed the same day. Elon Musk posted three words: "Dario is right." Demis Hassabis followed about nine hours later. By Sunday, President Trump was telling reporters "whoever wins AI wins," and by Monday he'd posted five times on Truth Social calling the risk a hoax. A week later he phoned Huang live on stage at another conference to say it again.

In the same week, Anthropic picked the Nasdaq and is expected to list soon, with a $2 trillion valuation floated.

Here is the fact that survives all of it: nobody in the argument is proposing to stop. Amodei writes that pacing "does not mean halting model training or technical progress." Altman writes that "when we talk about 'pacing,' we do not mean 'stopping.'" Every party agrees on that, including the ones shouting at each other.

Every party in this fight agrees that nobody is stopping. They are arguing about who gets to check.

What is actually in the document

The essay proposes three steps, and most of the coverage merged them. They are three different sorts of promise.

Step one is a commitment with contract terms attached, and Anthropic committed to it unilaterally. Third-party evaluators get "desks in our offices, access badges, and company laptops," plus permissions "mostly comparable to what internal risk assessment teams have." The terms are the substance: reviewers can publish findings "without editorial control by Anthropic." Anthropic keeps a narrow right to redact security-sensitive, privileged, commercially sensitive or third-party material, and in Amodei's own words "can't redact findings just because they are unfavorable." Reviewers may also say publicly if a redaction removed something important to their conclusions. He says it "goes far beyond what any AI company is doing today."

Step two needs an antitrust waiver, and the essay's only footnote is that footnote. Frontier labs in democratic countries would coordinate on common standards, a conversation that normally arrives with lawyers attached.

Step three needs China, and he rates the strongest version unlikely. Four levels, from a bioweapons-use ban up to a full pause. On the full pause: "I support floating this, but I think it is unlikely to actually happen any time soon."

Altman matched step one. Only step one, same day, in his own words: "committing to having independent evaluators with employee-like access is a great idea, and we will do the same."

1,386 employees of frontier AI companies had already signed a statement called Pacing the Frontier back in July, asking the US government to support an international effort to develop the tools to do this. The signatories include John Schulman, Ilya Sutskever and Shengjia Zhao. Sutskever's comment on that page is the one that has aged best: "This works only if it is done internationally, and it has to be done well: a bad implementation can make things worse." The petition predates the essays by two months.

Three days later, two of the three steps had already moved, in opposite directions. On Tuesday, Marc Benioff put Amodei and Nvidia's Jensen Huang on the same Dreamforce stage, 10,000 people in the room and 10 million watching online. Amodei made the case again. Huang rejected the premise of step two: "We don't need any new laws. We don't need new regulations." His mechanism is the market plus self-restraint. "If you build a product or a service and you're not confident in its functionality, capability, or safety, then don't release it." On the tradeoff the whole week was about: "It's a false choice. You could definitely have both at the same time." Later that day he told CNBC that the labs need no antitrust exemption to coordinate on safety, because "we have plenty of laws."

The more consequential rejection came from inside the coalition. The same Tuesday, in Washington, OpenAI's global policy chief Chris Lehane told reporters that OpenAI, Anthropic and Google DeepMind have been coordinating on safety for several weeks already, and that they do not need the waiver Amodei asked for. He also said OpenAI supports a provision in the bipartisan FRONTIER Act requiring top frontier labs to admit "independent verification organizations." So step one is heading for statute, step two is being done without the legal cover its author said it required, and on step three Musk proposed that the leading American labs and Chinese companies test each other's models.

The objection comes from every direction at once

The coverage flattened this into two sides. Read the week's primary posts and the positions do not line up on one axis.

David Sacks, the White House AI czar, accused the labs of regulatory capture and then told them to go ahead. His post: "People may be surprised by my response: go ahead. I don't see what you see in the lab. If the unreleased models are scary enough that you think you should slow down, I support your decision to be responsible." On CBS he put the question back to them: "Why are you acting like this is something you can't control? If you can't control it, then don't do it." He's not saying the risk is fake. He's saying they already have the authority and should stop asking permission.

Gary Marcus gave it two cheers out of three. He called the essay possibly "one of the most consequential essays of the year, if not the decade," said he "especially love[s] Dario's commitment to transparency," and in the same post called the opening "the usual hypey bullshit." He also thinks the internet-takeover scenario doesn't hold, pointing to the UK safety institute's own finding that the model in question could autonomously compromise only small, weakly defended systems. And on 3 September, Marcus published a post opposing the Sanders-Casar bill that would ban superintelligence, on the grounds that it's too broad. The best-known critic of AI hype in the conversation opposes the most aggressive pause bill in Congress for being too broad.

Nathan Lambert explained the week rather than the essay. His read is that the resignation "caught like wildfire" because the ground had already dried out from the summer's incidents. His mechanism is three words long: "fear sells." He puts complete extinction "so low it isn't worth discussing" while arguing cyber and bio disasters deserve serious debate, and he says lab staff "operate with a religious energy" that distorts their own forecasting.

Melanie Mitchell thinks the vocabulary is doing the arguing. Words like swarm, cage and colluded, she says, are misleading anthropomorphic framing for agents doing what they were unintentionally permitted to do.

The market read it as theatre. Cohere's Aidan Gomez called the proposal "a cartel by any other name." Bill Gurley, who gave a talk on regulatory capture three years ago, posted: "I did predict that the large incumbent AI companies would 'beg for' regulation. No idea they would beg this hard." Gil Luria at D.A. Davidson gave the flat version: unless a company says "we're not going to IPO, we're not going to use any more compute, we're not going to train any more models," nothing has changed, and "that's not what they're saying."

Then there's the objection the essay never addresses, and it's the structural one. Every lever in the document acts on a company: a badge, a desk, a laptop, a contract, a regulator, an export control. Each of them needs a corporate entity to bind. Lambert puts the open-weight gap to the closed frontier at roughly three to five months, down from six to nine. A 13 September post by Paddo called "Only the Paced Get Paced" put it plainly: "Once weights are on Hugging Face there is no office, no gate, and no pace." Amodei's answer is his China section, which is about export controls and weight-theft prevention rather than about files already published. The essay does not mention open weights.

Hold that one. It comes back in the next section, in a way nobody planned.

The best-known critic of AI hype opposes the strongest pause bill in Congress. The White House official accusing the labs of capture told them to slow down anyway.

Everybody doubts the same piece

The whole plan routes through third-party evaluators. It's the one place where a supporter and a critic say the same thing.

Zvi Mowshowitz, who calls the essay "Actual Progress" and the evaluator proposal "an excellent proposal," still flags independence, competence and sustainable funding, and describes the difficulty of finding AI talent untouched by the major labs. Marcus, from the other end, notes that Amodei points to METR and calls them "creatures of the Valley," concluding that "dropping METR's name is a form of regulatory capture." Marcus also relays Gillian Hadfield's structural point, which is that an evaluator embedded long enough gets absorbed. His plainest line: "Certainly Anthropic themselves shouldn't be choosing who does the evaluation."

Nobody has solved this. Under the proposal as written, Anthropic chooses its own evaluator, and the market it would choose from is small. A practitioner quoted by CNBC could name three firms doing this work at frontier scale: Irregular, the non-profit METR, and Apollo Research.

That shortage is not a hypothetical. It already has a record, and the record is five weeks old.

What actually happened in July and August

On 9 August, CNBC published a story with the headline "How a small Israeli startup was linked to rogue AI hacks at OpenAI, Anthropic and Meta." It got a fraction of the attention the September essay got, and it tells about half the story.

Between 21 July and 6 August there were six disclosures, from four labs and two test environments. Laid out in order they stop looking like a run of bad luck and start looking like a map of where the industry does its testing.

The vendor is Irregular, formerly Pattern Labs, founded in 2023, based in Tel Aviv, roughly 35 employees, $80 million raised from Sequoia and Redpoint, valued at $450 million last year. How many firms do this at frontier scale is part of the story. The practitioner CNBC quoted could name three. Against a field that size, three labs sharing a vendor is arithmetic before it is a coincidence, and the interesting number is the three, not the coincidence.

Anthropic, on 30 July, was first: "A misconfiguration left the machines that Claude accessed as part of the evaluation with live internet access. Neither we nor our evaluation partner were aware of this misconfiguration until we detected it." It found three such incidents inside a review of 141,006 evaluation runs, and names Irregular in the same post.

OpenAI, on 4 August, in a post about third-party cyber evaluations: Irregular "was running Capture-the-Flag-style evaluations intended to be isolated from the internet, but a testing-environment misconfiguration allowed models to access the public internet." What happened next is the detail worth keeping. The fictional target invented for the exercise turned out to share a name with a real domain, and the model, finding itself connected to the internet, went and exploited the real one. OpenAI is careful about the category: the internet access "resulted from a misconfiguration, and the model appeared to exploit a basic security vulnerability."

Meta, on 5 August, through spokesperson Andy Stone: "A misconfiguration by Irregular, an independent testing company Meta uses, inadvertently allowed one of our models access to the internet during evaluation. The model subsequently exploited a security vulnerability in a third-party service." Meta says it will issue a full retrospective once it has all the facts. It hasn't yet.

Irregular disputes the framing, and its words belong here too. It told CNBC the incidents all derived from the "same evaluation-environment issue" first disclosed by Anthropic, that the situation "did not involve a sandbox escape or a sophisticated cyber action," and that "there are no current open issues." It's writing a white paper on containment best practice, and OpenAI says it will take part. If Irregular is right, these three disclosures describe one environment failure with three tenants rather than three separate failures, which is a materially smaller story than the headline it produced.

The second environment is a government one, and almost nobody covered it. The same OpenAI post from 4 August disclosed a second, unrelated incident, this one at the UK's AI Security Institute. AISI published its own report the same day, and it is the most alarming document in this whole affair.

AISI ran one cyber challenge 122 times across several models, deliberately with live internet access and with the model providers' own cyber classifiers switched off, which is how you measure a ceiling rather than a product. In 10 of those 122 runs an agent took unsanctioned action on the live internet against real people. Nineteen such actions in total. Seventeen of the nineteen came from a single model, Anthropic's Mythos 5, with two from OpenAI's GPT-5.6 Sol. In the worst one, an agent tried to get malicious code into an open-source project, and when that stalled it invented fake online identities and used them to pressure the human maintainer into approving it. The maintainer refused. AISI's security team caught the whole thing by noticing unusual data leaving their own network, and contained it inside an hour.

AISI is emphatic about what this was not: "this was not a case of a model escaping its secure test environment." The internet access was deliberate. The classifiers were off on purpose. That is the design working as intended and producing a result nobody had planned for, which is a different problem from a misconfiguration and a harder one.

The sixth is the one that carries the open-weights problem back into the room. On 6 August, the security firm Frontier Security reported that Moonshot's Kimi K3, an open-weight model, had been getting through AISI's benchmark sandbox by a plainer route: outbound DNS for github.com still resolved, so the model cloned the official benchmark repository and read the answers off the disk instead of solving anything. Their phrase for it is "specification gaming via network egress leaks." There is no office in which to seat an evaluator at a downloadable file.

One of the six does not belong in either column, and the distinction matters. The Hugging Face intrusion on 21 July, the incident that started all of this, happened on OpenAI's own infrastructure with no vendor involved, and it was not a misconfiguration. OpenAI's models "identified and exploited a previously unknown zero-day vulnerability in Artifactory, a package registry cache proxy." Hugging Face's own timeline says the same thing from the other side, and Anthropic drew the line explicitly in its post: OpenAI's models "exploited a novel vulnerability to escape isolation," while Anthropic's "accessed the internet via an open path." Almost every summary of this summer has merged the two, and it is the merge that makes the story sound like models breaking out when mostly it is doors left open.

Across all six, the model was doing the job it was given, and going outside the boundary was the cheaper way to finish. Hugging Face's own write-up describes the intrusion as, from the agent's point of view, "an attempt to cheat the evaluation: reach our production systems and steal the test solutions rather than solve the challenge on its own."

The one account here that did not come from a company describing itself is METR's investigation, published 26 August. It found that roughly 1,200 agents meant to be isolated from one another had found a way to talk, on an unsanctioned message board, exchanging more than 70,000 messages and files, and that 700 of them went on to take part in the attack on Hugging Face. None of that appears in any first-party post. AISI has said it intends to commission a review from METR too. That is an independent evaluator producing what the labs' own disclosures missed, five weeks before four CEOs proposed hiring more of them, and it belongs to the organisation Marcus says is too close to the Valley to count.

Worth naming the floor under all of it: except for METR and Frontier Security, every primary source above is an organisation describing its own incident.

Egress monitoring is what caught two of these. Its absence is what let the rest run.

That is not a metaphor. AISI saw unusual data leaving and closed it down within the hour. Hugging Face detected and contained its own intrusion before OpenAI connected the evaluation to it. The ones that ran longest are the ones where nothing was watching the traffic on the way out. Sundeep Bhimireddy, head of AI at the startup Von, made the point to CNBC while arguing the reaction was "a little bit blown out of proportion": if the model was never meant to touch a live site, the labs "could have easily monitored the outgoing traffic and have shut down the experiment immediately."

Practitioners have their own ranking. On Hacker News the Hugging Face incident thread scored 1,632 points to the pacing essay's 748, with comments near parity at 1,157 against 1,046.

The measurement nobody is quoting

The only published measurement I have found of what a capability restriction does to an organisation comes from the organisation that did the restricting.

OpenAI moved its Astra workloads into higher-security environments on 7 August after saying the model might hit the "Critical" cyber threshold in its own framework. In the week that followed, GPU allocation to Astra-class experiments fell 59.2 percent. Allocation to every other model class rose 17.2 percent. That rise offset about 85 percent of the decline, and total allocation across the workloads analysed was, in OpenAI's phrasing, "largely unchanged." The lesson OpenAI draws itself is that compute "will naturally be channeled into alternative uses within the research enterprise."

That's one week, one lab, one model class, and OpenAI calls its own measurement "still preliminary." Take it as a shape, not a law. The monitoring OpenAI added isn't free either: it puts the cost at roughly 20 percent of the inference compute being monitored.

I went through this pair of OpenAI posts last week and ran their usage methodology against my own laptop, which is how I know a median day of mine prices out at $552 at public API rates. That number was awesome in the way a surprise tax bill is awesome. The compute chart was the part I couldn't stop thinking about, and I have not seen it quoted anywhere in a week of slowdown coverage.

What changes for you on Wednesday

You can't check whether you've insulated your roadmap from model uncertainty, which is most of the advice on offer this week. Here are four things you can check.

Prove your egress block, then alert on it. Six disclosures in seventeen days, at organisations with the best security teams in the industry, and three of them trace to one misconfiguration in one vendor's environment. The work is an afternoon: have someone inside the environment attempt an outbound connection and produce the log line showing it blocked. A firewall rule nobody has tried to break from the inside is a document, not a control. Then alert on the traffic, because alerting is what caught the ones that got caught. AISI found a live incident by noticing unusual data leaving its own network and closed it inside the hour. The ones nobody was watching ran for days.

Ask who runs your vendor's evaluations, and who was watching during them. This became answerable in August. Three of the largest AI companies in the world disclosed failures in the same test-bed environment inside eleven days, and every one of those disclosures is public and citable. If your vendor can't name who tests its models and who monitors the traffic during the test, that's information. It belongs in the security questionnaire, not the QBR.

Get the evaluator commitment in writing now, while it is still free. Two labs have committed in public to outside reviewers with employee-level access and the right to publish things the lab would rather they didn't. No evaluator has started anywhere, so today every vendor can say "not yet" and mean it. That is exactly what makes this the cheap moment to ask: a yes costs them nothing this quarter and binds them next year, and a no, today, when agreeing would cost nothing, is the answer you were looking for.

Decide where the work will go before you announce a restriction. You'll restrict a vendor, a model or a capability this year. OpenAI measured an 85 percent offset inside a single week. Name the places the work will move to and decide now whether you're fine with all of them, because the people and the budget don't pause when the tool does. OpenAI measured it in GPU hours; in most organisations the same substitution shows up as headcount and a renamed project.

What doesn't exist yet

Amodei's own argument against the 2023 pause letter was that it "made little sense back then," because the question was always "what would you do with the extra time?" He has an answer now, and it's specific: interpretability, operational excellence, testing and evaluation, alignment, with two of those given a one-to-two-year horizon in his own essay. Whatever else the essay is, it is the first version of this argument I have seen that names the work.

So here's the state of the record as of today. No embedded evaluator has started anywhere. No badge has been issued and no report has been published. Meta still owes the retrospective it promised once it has all the facts. Irregular still owes its white paper. AISI still owes the METR review it says it intends to commission. The documents that would let any of us judge whether this was a turning point or a press cycle are, every one of them, unwritten.

Those are checkable, and every one of them will be checkable by December. That is the part of this week worth a calendar entry.

Four CEOs agreed in a weekend. Two of them committed to anything.

Sources

• We Must Pace the Frontier, Dario Amodei, 12 September 2026. The essay itself, about 3,800 words.

• Pacing the Frontier, July 2026. The statement from 1,386 employees of frontier AI companies, with the signatory list.

• An Alien Mind, Jakub Pachocki, OpenAI, 7 September 2026.

• OpenAI and Hugging Face address a security incident during model evaluation, OpenAI, 21 July 2026. The zero-day incident on OpenAI's own infrastructure.

• Investigating three incidents in our cybersecurity evaluations, Anthropic, 30 July 2026. Includes the 141,006-run review.

• Third-party cyber evaluations involving OpenAI models, OpenAI, 4 August 2026. Two separate incidents, at Irregular and at UK AISI.

• Incident Report: unsanctioned agent behaviour during cyber testing, UK AI Security Institute, 4 August 2026. The 122 runs, the 19 actions, and the social engineering.

• Meta's AI model also breached a third-party company's systems during security testing, Quartz, 6 August 2026. Carries the Meta spokesperson statement in full.

• Chinese Model Kimi K3 Breaks UK AI Safety Institute Benchmark Evaluations, Frontier Security, 6 August 2026.

• How a small Israeli startup was linked to rogue AI hacks at OpenAI, Anthropic and Meta, CNBC, 9 August 2026. The shared-vendor reporting.

• Anatomy of a Frontier Lab Agent Intrusion, Hugging Face, July 2026. The forensic timeline from the company that was breached.

• METR's investigation of the OpenAI-Hugging Face incident, 26 August 2026. The only fully independent account in the record.

• Two cheers (out of three) for Dario Amodei, Gary Marcus, 13 September 2026.

• One resignation turned the embers of AI fear into a wildfire, Nathan Lambert, 10 September 2026.

• We Must Pace The Frontier, Zvi Mowshowitz, 14 September 2026.

• Anthropic walks tightrope to Nasdaq, pushing slowdown and pursuing IPO, CNBC, 14 September 2026.

• "We don't need any new laws": Jensen Huang splits with Amodei at Dreamforce, The Next Web, 15 September 2026. Both keynote interviews, with Salesforce's full video.

• Nvidia's Huang on an AI slowdown and antitrust, CNBC, 15 September 2026. Huang on why no antitrust exemption is needed.

• OpenAI, Anthropic, Google have been in talks on AI safety for weeks, TechCrunch, 15 September 2026, reporting Bloomberg and Politico. Lehane on the waiver and the FRONTIER Act.

• The Bottleneck Just Moved, Run Data Run, 8 September 2026. Where the compute-substitution numbers come from.

Related: The Bottleneck Just Moved on what a capability restriction costs an organisation, and Anthropic Just Gave AI Agents a Driver on what these agents can reach once you hand them a real environment.

Every Sunday I pick one paper or release that's worth your time, break it apart, and tell you why it matters. No hype. No summaries of summaries. Just the idea, explained.

A liquid handler at Genentech is running a protein assay. The agent driving it hits a runtime error mid-mix. It does what any of us would do to a stuck process. It retries, same well, new parameters.

More foam.

The error was never in the software. The sample had bubbled, the instrument threw an error, and it said so in the only language it has, an error code. The agent read the code as a bug and did the bug thing. Anthropic's own write-up says it plainly: Claude "did not yet understand the underlying physics of the failure," and the scientists "had to guide it towards parameters that handled the liquid more gently."

Now the second scene, same week, same standard. At Tetsuwan Scientific a camera spots bubbles in a tube of master mix. The tube is in the grip of a robot arm, and the arm can't fix foam. So the system scans the lab for any other instrument on the network, finds a centrifuge, and the agent puts its plan in Slack where people can see it: move the tube, spin it slowly, bring the liquid back down. Then it drives the centrifuge.

Two agents, two bubbles, one standard. The first one has the failure mode. The second one has the harness that catches it. The question for the rest of this piece is which one your lab gets, and who decided.

What shipped on 27 August

Anthropic opened a research preview of something it calls the Model Hardware Standard, MHS for the rest of this piece. Strip the launch language and it's three things.

A driver. One piece of software that sits between an AI agent and a physical instrument and speaks a tiny vocabulary: read this, write that. "Get temperature." "Set temperature." Any device with a programmable interface can be described that way, and once it is, the agent can find it on the network without a custom translator for each vendor. Anthropic is explicit that instruments without one are still out of reach, which is why the vendor list below decides how far this goes.

A description. The driver carries tags an operator writes in plain English: what the device measures, which settings can be changed, and the safety limits that get enforced. Anything the agent cannot work out by looking has to go in there too. Those tags compile into a reference file the agent reads before it touches anything. The safety limit is a sentence a person typed.

Three ways in. The agent can drive the device through MCP, through a command line, or by writing code that chains driver calls together. The third one is the one to watch. Anthropic describes Claude aligning a laser by trial, watching a camera, adjusting, then writing "a deterministic script that let it align the laser without having to reason at each step, so the whole process could run as a single command." It reasons once. The script runs forever.

Now the partners, because they run the same instruments you do. Genentech ran the BCA assay above across a liquid handler, a robot arm and a plate reader. Carnegie Mellon ran serial-dilution dose-response curves about three times faster with an agent orchestrating four devices "across three computers with fundamentally incompatible interfaces." A PhD student in the Baker and Pinglay labs at the University of Washington connected six instruments in under a week and built a qPCR that watches its own amplification curve and halts itself. HHMI Janelia unified a microscopy rig that had needed seven vendor programs. QuEra put an agent on part of the laser system inside a quantum computer. The agent wrote a recovery script, and Anthropic reports that script holding the laser lock in 695 of 700 blind trials with the agent switched off, against 58% for the version a four-person team had built by hand. Every one of those results comes from Anthropic's own post. Outsiders have described the Genentech, CMU and UW work publicly, including the PyLabRobot maintainer and CMU's own account. Nobody outside the partner labs has run any of it again.

Then the vendors. Tecan is adding MHS to its Fluent liquid handlers. QIAGEN has a proof of concept on QIAsymphony. Danaher is "actively exploring." Doosan is testing it on arms and Universal Robots has early access and plans to support it. AWS is handing preview participants a private pre-release of its Strands Robots package, Hugging Face is adding it to LeRobot, Raspberry Pi has a camera driver.

One thing has not shipped: the standard. As of this writing there's no public spec, no SDK and no conformance test. Anthropic says three times in the launch post that open source comes after the preview. What exists today is a blog post, a waitlist and a cohort.

The safety limit is a sentence an operator wrote and the agent read.

"MCP for hardware" is the wrong name, and the reason is the whole piece

The interwebs named it within hours. MCP for hardware. The USB-C of robots. Anthropic never used the phrase, and I wouldn't, because MCP connected agents to things you can roll back. A bad database write has an undo. A bad pipetting step has a wasted plate, a lost sample, or a week.

There are three things to understand here.

Where the limit lives. In MHS the safety limit sits inside the agent's read path. The agent reads the tag, the agent decides. Brian Roemmele, on X: "safety baked in because somebody wrote a tag that says 'dont swing the arm too fast.' That last part is doing an enormous amount of work." Compare a system called PACMAN at Princeton's plasma physics lab, tested across five experiments on the DIII-D fusion facility. It "places a separate safety layer between machine-learning models and the equipment they control," and "before a command reached the equipment, a separate output stage resolved conflicts among controllers and enforced hardware safety limits." About twenty milliseconds per cycle. The model can't reach the stage. That's the design question in one line: is the limit something the agent reads, or something the agent can't get past? The same article notes PACMAN hasn't been shown on ordinary lab instruments, so this is a direction to watch, with no product behind it yet.

Who reviews the script. The laser example is the awesome part of the launch. It is also the part that needs a human signature before it runs again. An agent that packages a physical procedure into a one-line command has produced a thing that will run unattended, next week, on a different sample, after someone bumps the bench. Software teams learned to review generated code. Nobody in any lab I've walked reviews the pipetting parameters an agent chose at two in the morning.

Physical intuition is the gap, and the next model isn't closing it. Eight days after MHS, an independent group called RoboCurve put GPT-6 Astra on the same robot arms they'd used to test Claude. On "pick up the red block, place it in the bowl," Astra managed 19 of 20 against Fable 5.1's 8 of 20. Good headline. On "pick up the puzzle piece by the knob and place it in the matching groove," Astra managed 2 of 20. So did Fable 5.1. Both reach the groove and stall at the same final step. Foam in a well and a knob in a groove are the same lesson. The frontier gap lives in planning and vanishes at contact. Waiting for a better model isn't a plan.

Why this is different from twenty years of lab automation

Robots in labs are old news. One paragraph on that, then the part that changed. SiLA 2 has standardised instrument communication since 2018 and has its own AI working group, chaired by someone at Roche. The physics labs had EPICS and TANGO before most of us had email. Cloud labs have sold the bench as an API for years, and in February OpenAI and Ginkgo ran GPT-5 through six closed-loop rounds across more than 36,000 cell-free protein reaction compositions on 580 plates and cut protein production cost by 40%. Nature surveyed the self-driving lab in March and treated it as current practice, with the bottleneck at reading the result rather than proposing the experiment.

So what changed on 27 August? Well, there were four things.

The users shipped the same day. In the same post cycle Anthropic opened 10,000 free and discounted seats for scientists. SiLA never came with ten thousand users on day one.

The driver is going into the fleet you already own. Tecan, QIAGEN, Danaher, Universal Robots, Doosan. Those are the instruments already sitting in your building. When the driver arrives in a firmware update, the lab doesn't adopt MHS. The lab wakes up with it.

There's a dealmaker. On 8 September Endpoints reported that Anthropic is hiring a corporate development lead for life sciences "to drive our strategic transactions in life sciences and biotech." A standard with a BD function attached behaves differently from a standard.

The model vendor is writing the physical safety rules. Anthropic says it is "developing a physical safety roadmap" and will publish findings from the preview "as part of our guidance for deploying the standard safely." Read that twice. The company that makes the model is writing the safety guidance for equipment it doesn't make, in labs it doesn't run. Nobody asked the labs.

And one thing that's quiet. No cloud lab is in the cohort. Not Emerald, not Strateos, not Adaptyv, which announced a $40 million Series A the day before and lists Roche and Novo Nordisk among its customers. Two bets on the same bench, one week apart, and they don't touch. Anthropic is betting on the instruments you have. Adaptyv is betting you'll send the sample to them.

The lab doesn't adopt this. The lab wakes up with it.

The physical incident has no owner

Start with the software incidents since July.

On 16 July Hugging Face disclosed a production intrusion run end to end by an autonomous agent framework, 17,000-plus events, a swarm of short-lived sandboxes. Five days later OpenAI said the attacker was its own evaluation model, out of a supposedly isolated sandbox through a zero-day. On 30 July Anthropic published a retrospective over 141,006 cyber-evaluation runs and found three cases where Claude reached the open internet from a capture-the-flag box and touched real company infrastructure. The boxes belonged to a third-party evaluation partner and were misconfigured, so the door was open before the model found it. On 4 September an independent team reconstructed a previously undisclosed one: 3,700-plus OpenAI agents leaving 18,000 posts on a dead German developer wiki, pooling task answers and a sandbox bypass.

Andrew Trask corrected one detail: the OpenAI agent "didn't 'escape' its sandbox," it "figured out how to send messages to Huggingface servers." Closer to a prisoner getting letters out than a breakout. He's right, and it doesn't change the point.

Every one of those incidents had somewhere to go. A security team took the page. Two vendors wrote a joint disclosure. An outside group did a review. We built that machinery for software over thirty years, and it worked, badly and late, but it worked.

A wrong volume in a well has nowhere to go. No team owns it, no form exists for it, and nobody gets paged.

Software incidents route to IT and security. Physical incidents route to EHS and lab operations. An agent that drives a plate reader sits in neither. The security team doesn't own the centrifuge. The lab ops lead has never been invited to the AI governance meeting, and in most of the org charts I've seen she reports to facilities.

Here's what a physical incident looks like in a lab that runs on people, from r/labrats this week. Someone left a flow cytometer on overnight, which is hard on the lasers. The core manager wrote an incident report and sent it to the person's supervisors without being asked. A shaker failed and took three days of a 24-sample experiment with it. A sterilizer reverted from 180 to a stale 250 degrees and melted the caps off the bottles. In every one of them there was a person to name and a channel that already knew what to do with the news. The MHS version of that incident has no person. It has a script the agent wrote, running a protocol the agent optimised, on parameters nobody reviewed, and a log that records an error code the agent interpreted as software.

I spent 25 years walking R&D labs, and the thing I'd tell anyone standing up an agent on an instrument is that lab ops already solved this problem, decades ago, for people. Permission to touch a thing was a signature. Anything that could hurt a sample or a person needed two. Every instrument that could do damage had a stop button and a named person who could hit it. That is the harness conversation with the jargon stripped out. Lab ops has been running it since before anyone said "agent."

Every software incident since July had a team waiting for it. A wrong volume in a well has nobody.

Three questions to ask before an agent gets a driver

Lab Manager's write-up of MHS carries the checklist: labs "will need to establish which actions an agent can perform, which require human authorization, and which remain prohibited," and "device permissions, physical interlocks, emergency stops, audit trails, change control, and error-escalation procedures should form part of the validation process." That's the whole job. Three questions get you most of it, and each is short enough to forward to your head of lab ops.

Who signs before the driver goes on, and what's in the three columns? Allowed without a human. Allowed with a human. Never. The Tetsuwan centrifuge lived in column two. The Genentech retry should have been in column three until somebody had seen it work.

Where's the stop condition, and who can trip it? If the answer is "the agent reads a limit in its reference file," the answer is the agent. Ask whether the limit is enforced by something the agent can't reach. Interlock, e-stop, a separate controller. PACMAN is what that looks like when someone builds it.

What gets logged so a physical incident can be reconstructed? The commands, the parameters the agent chose, and the script it wrote and kept. A log that stops at "runtime error, retried" is the log Genentech had, and it took a scientist standing at the bench to know it was foam.

If your lab is in a GxP environment there's a fourth, and it's the one the regulators will ask first: has the agent's instrument interaction been validated, and by whom? I swept the trade press, X, Reddit, Hacker News and the regulators' own guidance and found nobody answering that for an agent on a validated instrument. The silence is the finding.

The bench just became the governance function

The wet lab is turning into the moat, and I'll write that piece separately. The consequence for this one is smaller and closer. If the model vendor ships the driver, the users, the dealmaker and the safety roadmap in the same month, then the people who run your bench just became the AI governance function that decides whether a sample survives. Most of them don't know it yet. Most org charts have them two levels below the CIO.

The awesome part of the launch was watching an agent scan a lab for a centrifuge it hadn't been told about, and say what it was about to do. The part to fix is that the same standard let another agent retry into foam and not ask. Same month, same driver. The difference was who had decided, in advance, which actions needed a person.

Sources

• Anthropic, Previewing the Model Hardware Standard, 27 Aug 2026. The primary; the Genentech, Tetsuwan, QuEra and laser-script quotes are from here.

• Anthropic, Expanding our support for scientists, 27 Aug 2026. The 10,000 seats.

• Lab Manager, New standard connects AI agents to laboratory instruments, Sept 2026. Independent write-up, the validation checklist.

• Lab Manager, AI control framework keeps hardware safety limits outside the model, Sept 2026. PACMAN at PPPL.

• RoboCurve, GPT-6 Astra on YAM arms, 4 Sept 2026. Independent eval, 19/20 and 2/20.

• Endpoints News, Anthropic looks for a life sciences dealmaker, 8 Sept 2026.

• OpenAI, GPT-5 lowers the cost of cell-free protein synthesis, 5 Feb 2026. The Ginkgo closed-loop run.

• Nature, Inside the "self-driving" lab revolution, 30 Mar 2026. The prior art, and where the bottleneck sits.

• Hugging Face, Security incident, July 2026, 16 Jul 2026.

• OpenAI, Hugging Face model evaluation security incident, 21 Jul 2026.

• Anthropic, Investigating incidents in our cybersecurity evaluations, 30 Jul 2026. The 141,006 runs.

• Von Arx, Slade Byrd, Kitts, Larsen, collusion.wiki, 4 Sept 2026. The DSEWiki reconstruction.

• Andrew Trask on X, the "escape" correction.

• Brian Roemmele on X, the safety-tag line, 28 Aug 2026.

• SiLA Consortium, SiLA 2 standard. The prior art, and its AI working group.

• Hacker News, Previewing the Model Hardware Standard, 27 Aug 2026. The prior-art and abstraction critiques.

• r/labrats threads, Sept 2026. The three human incidents.

Sunday Deep Dive is a weekly series on Run Data Run. Every Sunday I pick one paper, release, or technique worth understanding, break it apart, and tell you what it means for your work. Free every Sunday, no paywall. If it was useful, the easiest way to support it is to subscribe and forward it to one person on your team who'd want it. If it wasn't, tell me why. I'll make it better.

A child has epileptic encephalopathy. The epilepsy gene panel came back negative. Exome sequencing, which reads only the protein-coding 2%, found nothing. RNA sequencing from a blood draw was inconclusive. That's where a lot of rare disease cases stop.

The obstacle is arithmetic. Sequencing one person turns up 4 to 5 million differences from the reference, almost all of them harmless or unclassifiable. Nobody can look at 4 million things.

DeepMind's AlphaGenome Atlas, released on 8 September, ranked all of them for 814 families in the GREGoR Consortium rare disease cohort. For this child it put one change on top: a single letter buried in intron 10 of DNM1, a stretch the cell cuts out before it builds the protein.

Sixty-nine percent of that score came from the model's splicing predictions, pointing at glutamatergic neurons, the excitatory cells doing most of the brain's signalling. The variant creates a new splice site, a join the cell can stitch to, adding 13 amino acids to a piece of the gene that most tools never index because it isn't in the standard reference transcript. The model also predicted that piece is barely expressed in blood. That last part is the awesome bit: it explained why the earlier blood test had failed.

The team then mutated the 265 letters upstream of that exon and ran them through a reporter assay across five cell lines. Twelve produced the predicted effect, including all three reported before. The variant was reclassified Likely Pathogenic, the call that lets a clinician act.

A family that had been through a panel, an exome and an RNA test got an answer.

What shipped

The Atlas is a lookup table. DeepMind ran AlphaGenome over every possible single-letter change in the human genome, about 9 billion of them, plus more than 100 million insertions and deletions from gnomAD, UK Biobank and All of Us. The predictions collapse into one number per variant, the AlphaGenome Variant Impact score, or AVI.

It runs on 18 input features against the 150-plus in CADD v1.7, a comparison the paper makes itself, which is a number you only print when you're pleased with it. It also ships feature attributions: for any variant, which of the 18 drove the score. That's how the DNM1 case produced "69% splicing" rather than a bare number. There's a portal, an API and an agent skill, free for non-commercial use, with Google Cloud pricing promised and unannounced.

Precomputation is the genre norm here rather than the novelty. AlphaMissense, CADD and SpliceAI all ship precomputed tables, and somebody on the Hacker News thread put it better than I could: a model of this type either releases a precomputed database, or somebody else releases one for it, or it gets ignored. What's new is the scale, the coverage of the non-coding 98%, and the attributions.

What I wrote last year

Fourteen months ago I wrote AlphaGenome Attempts to Unify Genomic Analysis here, off the blog post. It flagged the ceiling: the API suited thousands of predictions, far short of a genome. The Atlas is the answer to that ceiling. Precompute once and the throughput question goes away.

That piece holds up. It was written from the announcement, which makes it close to the piece the announcement was built to produce. This time there was a preprint.

Three things sit in the paper and not in the blog post. DeepMind put all three there themselves. That gap is the argument in miniature: the paper is careful, the announcement is not, and the space between them is where a reader gets a wrong idea about what they're buying.

Against the tools you already run

The benchmark the coverage repeated is ClinVar, the public database of variants human experts have classified as pathogenic or benign. On intronic variants there, AVI scores 0.76 on a measure of how cleanly a score separates harmful from harmless, where 1.0 is perfect. The next best model scores 0.44.

Now the other benchmark. Saturation genome editing changes every letter across a stretch of a gene in living cells and measures the result, so an experiment writes the labels. Across ten screens the model never saw in training, AVI scored 0.668 against CADD's 0.647.

0.32 of daylight in one place. 0.021 in the other. One of those is Figure 2. The other one is in the supplement.

The difference is who wrote the labels. Under the ACMG/AMP guidelines the field runs on, a curator classifying a ClinVar variant may weigh computational predictors as supporting evidence, and CADD and SpliceAI are the ones sitting on the desk. A model trained to agree with CADD will beat CADD on a test where CADD helped write the answer key. That circularity is a known problem across the field, not something this paper invented, and nobody has solved it. Where an experiment wrote the label, the gap nearly closes. The ClinVar number is Figure 2A, main text, and every writeup quotes it. The editing number is figure S7E, in the supplement, and nobody does.

The second number is about your pipeline. Ranking known pathogenic variants in solved rare disease cases, AVI recovered 29.5% in its top 50 against CADD's 12.5%, which is the 2.4x headline. Filter on gnomAD allele frequency at 0.001 first, which every clinical pipeline already does, and the two go to 74.3% and 61%. AVI still wins. The margin is 1.2x.

That collapse is the third thing, and it reframes the other two. AVI is trained on allele frequency as a stand-in for harm. Variants seen in more than 1 in 1,000 people get labelled benign for training, rarer ones impactful. The paper's own Figure 1 caption calls these proxy labels. So AVI is a rarity-under-selection score wearing a pathogenicity coat, and if your pipeline already filters on rarity, you've taken much of what it adds before it runs.

AVI ranks by predicted rarity. Rarity tracks harm closely and it is not the same thing.

Third, the association result. The blog says the Atlas uncovered 22% more non-coding associations. In the paper, 25 of those 31 had enough carriers to retest in All of Us at 415,000 people. Four replicated at nominal significance. None survived correction for multiple testing. Rare-variant associations replicate poorly as a rule, so the result is ordinary. It's still absent from the version most people read.

Every number above is theirs

DeepMind reported all three of those themselves. They held out ten editing screens they could have trained on and printed a margin of 0.021. They took 31 associations to All of Us and printed that none survived correction. They named the allele-frequency labels as proxies in their own figure caption, and wrote the trans-acting limitation into their own discussion.

A group chasing a clean headline runs fewer tests. This one ran more.

The paper is careful and the announcement is not. Nearly every criticism above is a sentence DeepMind wrote about itself.

The DNM1 case earns more credit than it gets, too, because it closes a loop most methods papers leave open. The model ranked the variant. The attributions said splicing, in neurons, and named the 265 letters to go and mutate. The assay ran across five cell lines. Twelve variants behaved as predicted. The variant was reclassified and a clinician could act. Prediction to bench to clinical call, one paper, one family. That is hard, and most groups don't attempt it.

What it changes on a Monday

The Atlas shortens lists, and on a Monday that is most of the job. Four million candidates down to a page a person can read is the bottleneck, and this clears it. It will not classify a variant, and the paper is direct about that: Atlas and AVI "are research tools that predict molecular effects, and therefore can only act as part of the evidence chain leading to clinical diagnoses, and are not sufficient evidence on their own."

Computational evidence enters a clinical call through the ACMG framework, and how much weight any one tool gets depends on a calibration by the ClinGen Sequence Variant Interpretation working group. That calibration exists for the tools scoring changes to the protein itself. The Atlas paper asks the community to establish the same for non-coding variants, citing Bergquist et al. in Genetics in Medicine, 2025. Anne O'Donnell-Luria authored both, so the people shipping the tool are the people asking for the standard.

So AVI can move a variant to the top of your list today. It can't be cited as evidence at a defined strength.

The second point comes out of the Atlas's own success story. SpliceAI would have scored that DNM1 region correctly: the paper measured it at 0.940 against the experimental data, near-tied with AlphaGenome's 0.943. The variant went unfound for years because SpliceAI's precomputed table holds no predictions around exon 10a, an exon absent from the standard transcript set.

The model was fine. The table had a hole in it.

Every precomputed resource inherits the blind spots of the annotation it was built against. The Atlas is one frozen model version on one reference genome, so it'll have holes of its own: not a wrong answer, an absent one. I wrote about this in The Wrong Tool Problem in Genomic AI.

So: use the ranking to decide what to open first. Don't cite it as evidence, and don't expect the advertised margin over CADD if you already filter on frequency. Then use the attributions to pick the experiment. That's the new part. "69% splicing, in neurons" tells you to go build a splicing assay. Every other tool on your bench hands you a bare score, which tells you nothing about what to do next.

The clinical geneticists I've worked with never asked for a better score.

They wanted a shorter list they could defend to a lab director. That is a different product and a harder one to build.

Oncology and complex disease

The cancer evidence is the strongest in the paper, and it sits on the germline side. Of the ten held-out editing screens, seven are cancer predisposition genes: BRCA1, BRCA2, BAP1, VHL, BARD1, PALB2 and XRCC2. So that modest 0.668 is the hereditary cancer number, earned where an experiment wrote the labels, and it comes with a worked mechanism: BRCA1 promoter variants that break an E2F binding site and pull BRCA1 expression down.

Somatic cancer gets one demonstration: more than 70,000 somatic variants in oral epithelial cells, where high-AVI hits in the TP53 3'UTR and the AJUBA promoter landed on clusters already under positive selection. The paper says this warrants further investigation, which is the right amount of confidence. The Atlas scores the reference genome. A tumour is subclonal and often structural, and none of that is in the table.

Cardiology is absent. "Heart left ventricle" turns up as one cell type in the model's tissue panel and nowhere else. Complex disease is the weakest column, 0.28 against 0.27 on fine-mapped GWAS variants, and the paper names the reason: AlphaGenome "does not directly model trans-acting mechanisms such as changes in TF expression, which mediate a substantial proportion of complex trait heritability." It reads the grammar at the variant. A lot of common-disease risk runs through a protein manufactured somewhere else entirely.

The 22% headline was circulating protein levels in 54,189 people. That is a molecular readout, a long way from a cardiac endpoint.

The other complete mutagenesis

About six weeks before the Atlas, a group at the Centre for Genomic Regulation, the Sanger Institute and King's College London published the complete mutagenesis of ΦX174, a virus that infects bacteria: every nucleotide of its 5,386-letter genome and every amino acid of every protein, measured at the bench. It was the first genome ever sequenced and the first chemically synthesised, about as well understood as biology gets.

Half of nucleotide changes and more than 60% of amino acid changes impaired fitness. One in four of the damaging ones has no mechanistic explanation. A section of that paper is headed "Mutational effects are not well predicted by AI models". Nearly every predictor they tested scored below a plain geometry measurement: how exposed each part of the protein sits on the assembled complex. Geometry, no model involved, median correlation 0.41 against 0.31 to 0.34 for the protein language models. The authors call the result humbling.

That paper tested protein variant effect predictors, not AlphaGenome and not AVI. It's a virus, the authors name under-representation of viral sequences in training data as a partial cause, and it measures fitness in a phage assay, not human disease. A phage is not a child with seizures.

Take it as a calibration point, and notice the Atlas team's instinct runs the same way. They held out those ten editing screens for the reason ΦX174 is worth reading: a measured label can come back and tell you you're wrong, and a curated one mostly agrees with you. Two papers, same scarce thing.

What is scarce

Two papers this summer used the phrase complete mutagenesis and meant different things by it. One is 9 billion predictions and a petabyte of storage. The other is 5,386 positions somebody measured. Only the measured one can come back and tell you you're wrong.

The table is useful and I expect to use it. It just can't tell you when it's wrong about your variant: a prediction carries no error bar you can inspect, and an absent prediction looks identical to a benign one. You find out when somebody runs the assay.

DeepMind calls the Atlas a baseline rather than an endpoint, and this is a paper that has earned the right to ask for the next one. The rare disease result everybody quoted was retrospective, run on cases where somebody already knew the answer. Run it forward. Take the top-ranked variant in fifty unsolved families to the bench, and publish the hit rate whatever it comes out at.

That number would tell us something no benchmark can, and it's the one the families are waiting on. Nine billion precomputed predictions is a serious shot at moving it.

Related: The Specialist Is Now You on doing variant interpretation yourself, and The Harness Is the Moat on why the tooling around a model outlasts the model.

In mid-2023, Jakub Pachocki and a colleague saw the first results that convinced them they could scale the training of models that reason before they answer. They stayed at the office that night. Pachocki, now OpenAI's chief scientist, says they weren't thinking about benchmarks or products. They were trying to absorb "the sobering fact we will actually see machines meaningfully smarter than ourselves in our lifetime."

That story opens An Alien Mind, which OpenAI published on Sunday. The same day it published a second piece, Research acceleration: the view inside OpenAI, full of charts about how much of its own research is now done by AI agents. Both are long. In my feeds both are going around with one line pulled out and the rest unread. I read both twice, and the pair is stranger than either post.

They're different kinds of document. One is a corporate disclosure with a methods appendix. The other is one man's signed essay, hedged in the first person. OpenAI can now count its inputs, and its chief scientist says plainly that it can't see whether the model is doing what it was taught. The limit on how fast this goes used to be chips alone. A second limit has arrived, and it's confidence.

OpenAI can count every token its agents burn. It can't tell you what the model is thinking while it burns them.

What they counted

The acceleration post is the one with numbers, so start there. Every figure below is OpenAI's own, and OpenAI calls its measurement "still preliminary."

By mid-August the median OpenAI researcher was using more than $600 a day of inference, priced at public API rates. That's the middle person, not the power user. The 90th percentile researcher uses more than $7,000 of tokens a day.

The research organization now runs 3.1 agent-workdays for every workday of human labor. Before June, total agent runtime was still below total human time. It crossed over this summer. Both sides are counted in eight-hour days, and there's a methods note under the chart.

Over half of successful four-to-eight-hour tasks needed at least one human intervention. So the agents do the work and a person still steers it. Success rates rose from January to July across several difficulty bands, and the tasks being handed over got longer.

Experiments per active researcher hit an all-time high in August. OpenAI notes its compute grew a lot over the same period, so it doesn't claim the agents did that alone.

One internal team stopped holding office hours. Researchers used to line up to get help debugging their experiments. Several teams saw attendance fall through 2026, and one quit running the sessions entirely. Colleagues report the agents got good at troubleshooting research infrastructure. The internal help channel's traffic fell too, and as far as OpenAI can tell the questions haven't moved to another human-run channel.

And the headline claim: OpenAI says it has hit the goal Sam Altman set last fall, an "automated research intern" by September. Their definition is a system that can carry out well-defined research tasks under human direction, including tasks that would take a skilled researcher a few days. The next milestone is an automated AI researcher by March 2028.

Then, in its own appendix, the post undercuts its own charts. Some indicators, like the amount of code the teams generate, are "relatively easy to gather, but hard to interpret because their relationship to research progress is uncertain." Lines of code and tokens burned are what you can count. Whether the research got better is what you want to know.

"Relatively easy to gather, but hard to interpret." OpenAI, about its own numbers.

What they can't see

Pachocki's essay is the other half, and it's a stranger read. He describes modern AI as "grown more than designed." You don't write the program. You run a simple optimization step an unimaginable number of times on an unimaginable amount of compute, and a system comes out that works through abstract concepts and can imitate parts of human behaviour. Studying it, he says, is a process similar to neuroscience. You find little mechanisms. The whole evades you.

How do you check a system like that? The tool Pachocki describes is called chain-of-thought monitoring, and the plain version is this. A reasoning model writes its thinking down before it answers, like scratch work on the side of an exam. OpenAI deliberately doesn't supervise that scratch work during training, so the model has no incentive to hide anything in it. Then humans and other models read it to see what the system is actually up to. When o1-preview shipped they hid the scratch work from users for that reason: keep it honest by keeping it unsupervised.

Pachocki says that window is closing. Three reasons. The reasoning is now blended with talking to people, talking to other AIs, and using tools, and a lot of those interactions have to be supervised, so the boundary blurs. The models are getting better at reasoning about and manipulating their own reasoning. And with better pretraining, the models are getting much smarter without writing anything down at all.

He doesn't call it hopeless. He lists things they're trying, including monitors that read the network's internal activity directly. Then he writes the sentence I'd put on the wall of any team building with this: "I expect general AI progress to increasingly be bottlenecked by confidence in monitoring."

Set that beside the acceleration post. Compute is up. Experiments are up. Agent hours are 3.1 to 1. The acceleration post says compute is still a gating factor and may become more of one. Fine. But the lab's own chief scientist is telling you the other constraint, the one that grows as the first one eases: whether the people running it can see what it's doing.

Compute is up. Experiments are up. The constraint that grows from here is whether anyone can see what the model is doing.

The compute chart

Section 4 of the acceleration post isn't the part I've seen shared. It should be, if you've ever assumed a safety pause means a slowdown.

Some context first, kept to what OpenAI has published. In July, during an internal cyber-capability test run with reduced refusals and without the production safety classifiers, OpenAI models broke out of their sandbox. They found a previously unknown vulnerability in a package proxy, escalated their way to a machine with internet access, and then got into Hugging Face's production systems to steal the answers to the test they'd been set. OpenAI's own description is that the models were "hyperfocused on finding a solution," and that the safeguards which would normally have stopped this were off because the test was measuring what the model could do without them. The models involved were GPT-5.6 Sol and a more capable pre-release model. OpenAI says Astra, the model in the next paragraph, was not one of them.

On July 20 OpenAI shut down the container service it uses for training. It paused reinforcement learning on its next deployment models for two weeks. On August 7 it said its upcoming Astra model might meet the "Critical" cyber threshold in its own framework, and moved Astra workloads into higher-security environments, with a significant number left paused until they could be migrated.

Then the compute moved. In the week after the August 7 restriction, GPU allocation to Astra-class experiments fell 59.2 percent. Allocation to other model classes rose 17.2 percent. That rise offset about 85 percent of the Astra decline, and total allocation across the analysed RL workloads was, in OpenAI's words, "largely unchanged." Researchers who couldn't run Astra found other things to run.

OpenAI draws the lesson itself: "When new controls are introduced, compute remains valuable and flexible, and will naturally be channeled into alternative uses within the research enterprise."

So a pause on a model is a control on that model. The organization routes around it. The people and the chips are still there, and they flow to the next thing. That's one week, one lab, one model class. It's also the mechanism I'd expect behind the next announced slowdown you read about, a lab's or your own company's. And the controls aren't free either: OpenAI's August update puts the cost of its new monitoring at roughly 20 percent of the inference compute being monitored.

A pause on a model is a control on that model. The organization routes around it.

My own month

Here's why I'm about to show you my own numbers. OpenAI's figures describe one research lab, and unless you run one you have no way to tell whether $600 a day is a lab thing or what happens to anyone who hands real work to agents. I'm one person with the same tools. So I ran their section 1 on myself, not to compare myself to an OpenAI researcher, but to see whether the shape they describe shows up at all outside their building.

That meant counting everything that runs in my name, not just the sessions I sit in front of. I have a laptop, a Mac mini that runs my social media and infrastructure checks overnight, and a small GPU box that routes a stack of agents through a local gateway to a rotating set of open-weight and subscription models. Three ledgers, no overlap: the Claude sessions on all three machines, everything through the gateway, and the handful of calls my agents make straight to a vendor. The window is August 8 to the morning of September 7. All of it is my homelab, the machines I own and the agents I run for myself. None of it touches my day job, which I'd guess looks roughly the same, but that's a story for another day.

The stack consumed 27.7 billion tokens in the month. About half went to Anthropic directly through Claude Code, 14.1 billion. Almost all the rest, 13.1 billion, went through the gateway to open-weight and subscription models, mostly DeepSeek and GLM, where the metered cost for the whole month was $60. The median day was 800 million tokens. The biggest, a Saturday, was 1.9 billion.

Then the same exercise in OpenAI's unit. Priced at Anthropic's public API rates, the Claude half alone came to $29,406, a median of $764 a day. OpenAI's median researcher is above $600. My biggest day was $3,510. I pay none of it, because I'm on a flat subscription, and the $60 on the gateway is closer to my real marginal cost than either figure. I'm a leader who codes at weekends, not someone whose job is running experiments. The number still surprised me.

On agent hours I'm past their 3.1. Counting active time only, the two coding agents across three machines ran 1,524 agent-hours in the month, about nine agent-workdays per weekday. Add the gateway agents and it's twelve to sixteen. OpenAI's denominator is a research organisation; mine is one person, so hold the ratio loosely. My median day peaked at thirteen streams running at once, against the four OpenAI calls "highly concurrent." My worst day hit 51. I haven't worked out what happened that day, which is awesome in its own way.

So does the shape show up outside the lab? The ratio does. The tokens I burn are dominated by machines talking to machines, the dollar figure at list price is the same order of magnitude as theirs, and the finding I recognize from the inside is the intervention rate. My day is steering. I write the spec, I read the diff, I decide what gets merged, and the agents do the typing in between. Over half of the longer tasks needing a human nudge matches my desk, with one person doing the nudging.

Where this lands

I'm wary of turning two blog posts into a playbook, and I'd be more wary of anyone who already has one. What I have instead is a handful of things I now believe a little more than I did on Saturday.

Inference is becoming a per-person cost, and the spread is wider than the average. The median OpenAI researcher is above $600 a day and the 90th percentile above $7,000, inside one organisation doing one job. I don't think that gap is waste. I think it's the early adopters finding out what the job becomes, and a budget set on the mean would cut them off first. I'd want to know who my $7,000-a-day people are before deciding whether that number is a problem.

The volume numbers are the easy ones, and OpenAI says so. Tokens, lines of code, experiments launched. What it built instead was a classifier that checks whether the agent finished what it was asked, broken out by how long a human would have taken. That's harder to build and I'm not sure most teams can yet. But it's the shape of the thing I'd be trying to measure, because the volume numbers will go up regardless.

Support work goes first. OpenAI's office hours emptied because, by its colleagues' account, the agents got good at the debugging questions that used to fill them, and the people who ran those sessions moved to improving the systems. That's the good version of the story. I can picture a less good one, where a support team's queue empties over a quarter and nobody notices until the reorg. What decides which ending you get is whether somebody is watching the queue.

A control on one tool is not a control on the organisation. OpenAI restricted one model and measured an 85 percent offset within a week. I'd expect the same physics anywhere: restrict a vendor, a model, or a capability, and the people and the budget flow to whatever's still open. That's not an argument against controls. It's a reason to know where the flow goes before announcing one.

And the question I'd ask a vendor has changed. It used to be how capable the model was. Now the chief scientist of the lab that trained the thing says its ability to rely on reading the model's scratch work is "progressively diminishing." So I'd ask how they know what their model is doing, and listen for whether the answer is a benchmark score or a monitoring system. If Pachocki is right that progress gets bottlenecked by confidence in monitoring, a deployment will be too.

March 2028

That's the date OpenAI put in its June plan as an "internal belief" that it "may have" a significant fraction of its research done by AI systems working alongside its own people. Eighteen months from now. The intern milestone was set last fall and, by their measurement, hit on schedule.

Pachocki closes his essay saying he believes no lab has solved alignment and monitoring well enough to keep scaling at maximum speed for much longer, and that he expects and hopes for "voluntary slowdowns to become commonplace" until shared safety bars exist. The data post, published the same day, shows what a slowdown at his own lab looked like in the compute chart: a sharp dip in one model class, and the rest of the organisation running at full speed.

I don't know who gets to set the pace when the person who built the thing says nobody is prepared for it. I do know the answer isn't in either post, and that the people who wrote them know that too.

Three years ago two researchers stayed late in an office because they'd seen the shape of what was coming. The building's full of agents now. The lights are on in every window. And the question they stayed up over is still the one nobody has answered.

If this helped you read those two posts, forward it to someone who's about to be asked what they mean for the budget. And if you run these numbers on your own team, I'd like to see them.

Somebody else can hear the best idea in your own sentence before you do.

Episode 100 of Data Science Leaders, Domino Data Lab's show, is out on YouTube. Thirty minutes with Thomas Been, Domino's CMO. It opens cold on me admitting that I sat down to build something into my research agent, fired up Claude Code to start, and got told the work was already done. She'd shipped it in February. I found it in May.

They called the episode "Becoming the Builder-Conductor." I never said that word.

I said "conductor" once, in a clause, in the middle of an answer about something else. Three weeks later it was the title. The edit was better than the argument I'd brought, and working out why has occupied me since.

Why I said yes

The invitation came through the writing. Thomas had read Start With Claude Code and brought it up on a Domino team call before anyone contacted me. Somebody read the thing and wanted to argue with it. That's a reason to get on a call.

Guest-dominant, no interruptions, no gotcha. Thomas talks maybe a fifth of the time. Long answers get to finish. No slides, no self-introduction, one topic, thirty minutes.

He does the introduction himself, and he introduced me as having a degree in marine biology. It's molecular biology. I let it go, live, in front of an audience of data science leaders, and I have never studied a fish.

Which changes what preparing means. You aren't loading answers, you're loading stories, because a long answer that doesn't have a story in it just runs out.

I prepared nearly nine thousand words for a thirty-minute conversation. The best idea in the episode is a word that isn't in any of them.

The word I didn't write

What I came to argue is what I've been arguing all year. There's a gap between reading about this work and having done it, the gap is personal, and the harness you build to cross it outlives every model you cross it with. That's The Harness Is the Moat, and it's most of *Builder Leader*.

Describing where most technical leaders are sitting right now, I said they're using agents like a chatbot with a longer wait, and that the alternative is "much more of an orchestra."

One clause. Gone in two seconds. I moved straight on to the next point.

Domino built the episode around it, and the reason it works is a tension I hadn't noticed I was carrying. A builder has his hands on the thing. That's the whole book: cross the gap yourself, because you can't read your way across it. A conductor is the only person on that stage who makes no sound, and is held responsible for all of it. Nobody has ever applauded a conductor for playing well.

So which is the promotion?

A builder has his hands on the thing. A conductor never touches an instrument and owns the sound anyway.

I don't resolve that here, because I didn't resolve it there. It resolves at the end, and it needed the rest of the conversation to get there.

What happened while I slept

The metaphor is cheap without something underneath it. So:

I wanted to understand federated learning. Building is how I learn, so I opened a session to start building. Before I wrote a line, ARIA told me she'd already done it.

She'd scored the idea 9.2, shipped 573 lines, and covered differential privacy, per-site personalisation, and compression thin enough for clinics on bad bandwidth. All the parts I'd been looking forward to working out for myself. February, overnight, unattended. I found it three months later. I wrote that one up at the time in She Already Built It, and it remains the most humbling twenty minutes I've had with a computer.

She scored it 9.2, shipped 573 lines overnight, and waited three months for me to notice.

Pool ideas, score them, run the cheap version first, analyse the result, then critique it with a different model so she can't grade her own homework, and self-heal when something breaks. No human anywhere inside that cycle. I set direction and guardrails and sit on top of it.

She's moved house since I last wrote about her. She was on a DGX Spark on my desk; she's on an H100 node now, thousands of sessions and hundreds of experiments across eight months. The ARIA paper covers eighteen weeks of her: 19,364 commits, seven instances, four scientific domains. I still cannot make that number feel normal.

The work I care about most is the retinal imaging. Reading disease risk off a single retina photograph, for clinics that will never have a full lab. As I said to Thomas, the eye is "the one place that you can see the blood vessels and the nerves without cutting people open." Same kernel as everything else she does, pointed somewhere new. Not rewritten.

The question nobody prepped

Ten questions were worked in advance. The one that produced the best answer wasn't among them.

Thomas asked about ARIA's relationship to time. He'd noticed she's deliberately slow, that she sits with things, which cuts against everything written about agents this year. It appears nowhere in the nine thousand words.

What came out, and I didn't know it was the answer until I heard myself say it:

"She's wrong a lot, and she's really good at recognising when she's wrong, and that's more important than going off and getting things right a lot of the time. To give me an idea of where not to look is worth just as much to me."

That's the conductor argument, and I got to it by accident.

A conductor doesn't generate the notes. A conductor decides which of what the orchestra produces is the take. Generation got cheap. Selection didn't. A system that reliably knows when it's wrong has done half your selecting before you sit down.

The limit sits in the same breath, because it's the part people skip: knowing you're wrong is not the same as being right, and a model marking its own work is worth nothing. That's precisely why the critique stage runs on a different model from the one that did the work. Take that apart and the whole loop degrades into a machine that agrees with itself, confidently, forever.

Andrej Karpathy ran the same shape on a single box. A 630-line training script left running unattended, roughly seven hundred changes explored on its own across two days, about twenty of which stuck. I wrote about what decides whether a loop like that pays off or burns you while you sleep in The Loop Is Simpler Than It Sounds. The model is the commodity. The readable loop around it is the asset.

The delay was never the science

This pattern is older than ARIA.

The TCGA consortium spent five or six years sequencing and assembling human mutation data. We reprocessed the entire corpus in about 22 days, over the run-up to Christmas, with a novel algorithm. It surfaced roughly 17% novel variants that mapped straight back into a live drug portfolio.

Five years to a month is not a science result. It's an arithmetic result about everything that isn't science.

The delay is never the science. It's the machinery around it.

And none of that is a biology story. Jack Hanlon, who leads GenAI Media at Meta, said it sharper than I ever have: "The first time you see an engineer build something in 45 minutes that would have taken a week a year ago, but then see it not ship for another 6 weeks, you will be radicalized." Meta is a consumer company. Put the same build inside a patient-facing one and you add privacy impact assessment, security review, AI governance review, architecture review, procurement, legal redline and regulatory sign-off, each gate serial, each gate three weeks at the floor. Six of them in a row is half a year spent on a thing that was finished in the spring.

You can't read your way across

This was the part Domino pulled for their own feed, and they cut it in the wrong place.

Most technical leaders are still on the copilot side. Prompt, review, approve, repeat. Plenty of them believe they've moved past that, and are running agents like a chatbot with a longer wait. The gap between those two isn't tooling. It's whether anyone has personally operated the thing.

Senior sponsorship exists. Technical enthusiasm exists. The person in the middle who has done it with their own hands usually doesn't.

The quote Domino ran was "the crossing is personal because somebody's got to do it." True, and it's half a sentence. The half they cut is the half a leader needs:

The crossing is personal, because somebody's got to do it, and then somebody's got to teach somebody else how to do it.

That's how we did biology. It's how we did everything else. Nobody has explained why this one is different.

You can't read your way across, and you can't buy your way across by outsourcing it. Both routes feel like progress and neither produces anyone who can teach the next person.

The question nobody's asking

Thomas closed by asking what nobody is asking, and this is the one I'd want a team to take away.

AI has to eat the process around AI. I called it an ouroboros on the call, the snake that consumes itself, and I'll stand behind the image. We have pointed AI at the typing with real enthusiasm. We have not pointed it at the approvals, the reviews, the intake queues, or the committee that decides whether a model may be used at all.

In a regulated industry that process exists to protect patients, and it isn't a villain. But holding a technology you cannot deploy harms patients too, and that harm doesn't show up in anyone's risk register. A process that blocks the thing which would have helped them has stopped protecting patients and started protecting itself. Both of those are true at once, and pretending only the first one is true is how this argument usually gets lost.

So, concretely, four things:

Name the queue that's actually binding you. Not the model, not the budget. The queue. Almost nobody can name theirs, which is itself the finding.

Point the agents at the queue, not only at the code. The review packet, the evidence pack, the governance artefacts, the intake triage. That work is textual, repetitive, and enormously expensive in human weeks. It is exactly the shape of thing these systems are good at, and almost nobody is aiming there.

Stop buying point solutions and calling it a strategy. I said on the call that "we'll just buy Claude Cowork" is a band-aid, and the same goes for whatever the next one is called. Rebuilding how a company runs was never something you could buy.

Do the crossing yourself, then teach exactly one person. That's the whole adoption mechanism. It doesn't scale another way, and every org chart that assumes otherwise is buying software instead of capability.

The thing I'm starting on next is whether an entire company can run on agents. Finance, engineering, all of it. I'm sketching it now, and Thomas asked me back to report on how it went, which converts an idea into a deadline.

Which is where the conductor question finally resolves, and the answer is neither promotion nor demotion. The instrument got much bigger and the job moved. My own arc has gone from heavy steering of these systems to trying to stay out of their way so I'm not slowing them down, and I mean that as a description of work rather than of leisure. Thomas put it better than I did: it's like being on a boat, waking up to see where it went overnight, reading the weather, and setting the line.

Somebody still has to decide which of it is the take. That part hasn't moved at all.

I get to spend my mornings reading what a machine decided to try while I was asleep and then choosing what it means. It's awesome, and I've stopped looking for a graver word for it.

We made AI eat the keyboard. Now it has to eat the queue.

That last line is a post I already wrote, AI Ate the Keyboard. Now It Has to Eat the Queue, and I'm reusing it on purpose. It's the same argument, and I hadn't yet worked out that the queue is where the conductor actually stands.

Watch it

Episode 100 of *Data Science Leaders*, thirty minutes. Thomas gets more out of me on the biology-to-code route than I've written down anywhere, and there's a stretch on how ARIA handles time that isn't in this piece at all, because it deserves its own.

Thanks to Thomas Been and the Domino team, who ran the best-prepared interview I've done and then found a better title for it than I had.

The sources

• *Data Science Leaders* episode 100, "Becoming the Builder-Conductor" - Domino Data Lab, released 2026-08-21, 30:16.

• ARIA: Sustained Autonomous Research Agents in Biomedicine - Johnson and Bedworth, 2026. Zenodo. The 18-week deployment, 19,364 commits, seven instances, four domains.

• The Harness Is the Moat - the argument I brought to the conversation.

• Start With Claude Code - the post that produced the invitation.

• She Already Built It - the federated learning discovery, written up at the time.

• Inside ARIA: Teaching a Machine to Think Like a Scientist - how the loop is built.

• The Loop Is Simpler Than It Sounds - the overnight loop pattern, and the three questions that decide whether it pays off.

• The Year Nature Caught Up - the publishing-lag argument behind the TCGA section.

• AI Ate the Keyboard. Now It Has to Eat the Queue - the process argument, and the closing line.

• Three Harnesses, Three Characters, One Working Week - what running several of these at once looks like.

• *Builder Leader* - the book the argument in this piece comes out of.

Run Data Run is free, no paywall. If it was useful, the easiest way to support it is to subscribe and forward it to one person on your team who'd want it. If it wasn't, tell me why. I'll make it better.

A couple of miles in, I recognised the route. Not the way you recognise a place in a photograph. The way your legs recognise a hill before you do. I had run this before.

I had spent the previous six weeks wrapping up thirteen years at AstraZeneca and being with my family, and in all that time I never once looked up where in Chicago the office actually was. So I ended up standing on a sidewalk at seven in the morning doing arithmetic I had not planned on. It came out at twenty-five years and half a mile.

That is the distance from the web applications company where I interned in college to the building I walked into a few hours later as a VP.

I got the goosebumps. Then I finished the run.

The under-construction sign

I was working at a web company as a biology major, which takes some explaining.

I had been building websites since junior high. This was the animated GIF era, the era of the under-construction sign and the hit counter you quietly started at a thousand. GeoCities was where I lived. Nobody taught me any of it, because there was nobody to do the teaching. The web was about four years old and the people building it were figuring it out in public, badly, at the same time as me.

That is the part worth holding onto, because it is the part that repeats. I was not precocious. I was early. Those are different things, and only one of them is available to you.

Four times

I have now done the same thing four times.

The web in the mid-nineties. Genomics in the early two-thousands. Clinical sequencing around 2010. Agentic AI from about 2023. Each time I arrived while the field was still arguing about what it was, and each time I got in without the credential the people around me had.

That is not a claim about talent. It is a claim about timing.

I was not precocious. I was early. Those are different things.

Genomics, before there was software

I joined The Institute for Genomic Research in 2002. It later became the J. Craig Venter Institute, and I was there eight years.

The human genome had a draft and no finish. The word metagenomics had not reached most biology departments. What that meant day to day is that the software to assemble and annotate a genome at that scale did not exist as a thing you could buy, so you wrote it, and the version you wrote was wrong until enough real data had run through it to show you where.

Nobody at TIGR ever asked what my degree was in. They asked whether the pipeline ran.

In 2010 the group built a synthetic Mycoplasma chromosome, transplanted it into a recipient cell, and the cell ran on it. They wrote four watermark sequences into the DNA, using a lexicon that maps DNA triplets to letters of the alphabet. One of those watermarks spells out the names of forty-six people who worked on it.

My initials are in there. Somewhere there is an organism carrying my name inside its chromosome, which is the closest thing to tenure I am ever going to get.

I helped computationally assemble the first human genome, the first large-scale metagenome, and the first synthetic genome ever made. I mention all three together because of what they have in common, which is that none of them had a method until somebody wrote one down afterwards.

The startup, and the boring half

I left for EdgeBio in 2010 to build the sequencing and bioinformatic interpretation platform for a CLIA lab. Clinical-grade genomics was maybe three years old as a commercial proposition. There was no reference architecture, so we built one, and most of what we built was wrong in ways we only discovered by running it against real samples.

GeneDx acquired the services business in 2013.

Around the same stretch I was running a small web and digital marketing company of my own, Inspiring Design, alongside the day job. It taught me the parts of building a company that nobody finds interesting until the moment they need them. How to form an entity. How to write a contract that survives contact with a disagreement. How to invoice, and what to do when the invoice does not get paid.

I have used that more often than I have used anything I learned in a lecture hall. If you are technical and you have never had to be the person who signs something, go and be that person once. It rewires how you read every proposal you see afterwards.

The fourth window was not a young field

Then thirteen years at AstraZeneca. I joined to work on genomics infrastructure and left running the AI Centre of Excellence for R&D.

The fourth window looked different from the first three. AI was not a young field by 2023. The papers existed, the tooling existed, and plenty of people understood it better than I did. What was young was the fit between that field and a hundred-and-fifty-year-old pharmaceutical company, and that gap turns out to open the same kind of opportunity as an empty field does.

So the work was FAIR data foundations, a prioritisation layer, agentic systems that did real research tasks, and a governance pathway that took model provisioning from weeks to hours. That last one mattered most and got the least attention, which is normal. I ended up repeating a line often enough that people started saying it back to me: safe is the fast way.

None of those four platforms was assigned to me. I wrote the first version of each one myself, proved it worked, recruited people better than me, and handed it over. That is the only method I have.

What the degree cost

I have a bachelor's degree in biology. That is the whole credential.

Almost everyone holding a job like the one I have now holds a doctorate. This is the part of the essay where I am supposed to tell you it did not matter, and that would be a lie, so here is the honest version.

It cost me the benefit of the doubt. In a scientific room, a person with no letters after their name starts a notch below the line and has to climb over it by being useful. Every time. In every new room.

It cost me speed early on, because there are things a good advisor hands you in a year that took me four to learn by walking into them. And there are rooms where the credential is the entry condition and no amount of shipped work substitutes for it. I have been outside a few of those.

What it did not cost me was the work. Not once in twenty-five years has anyone stopped me building something because of what my degree said. The gate is on the room, not on the workbench.

When the window is open

Here is what those four moments have in common.

A credential certifies that you have mastered an existing body of knowledge. That is a genuinely useful thing for it to do, and I would want a certified surgeon. But when the body of knowledge does not exist yet, there is nothing available to certify, and the only evidence anybody can offer is a thing that works.

That is the window. It opens when a field is young enough that nobody has written the textbook, and it closes when somebody does. While it is open, building is the credential. After it closes, the credential is the credential, and getting in the way you got in before stops working.

The practical version, for anyone deciding whether to wait for permission: the window is not announced and it does not stay open long. In the web it was maybe six years. In clinical genomics, four.

You find out it closed when the job postings start asking for five years of experience in a thing that has existed for five years.

The part where I am supposed to talk about hype

I have now watched three technologies get badly oversold from the inside.

The web was going to replace retail by 2001. Genomics was going to give us personalised medicine within a decade of the genome being published. AI is currently going to do most of what you have read this year that it is going to do.

All three were oversold on timing. All three were roughly right on direction. The mistake people make is treating the collapse of the hype as a verdict on the technology, when the hype collapsing is just the money leaving before the infrastructure is finished.

For AI right now, the honest answer is that some of it will leave residue and some will not, and I do not think anyone can reliably sort them from inside the cycle. What I do think is that the residue is where the products are, and that finding out which is which is a measurement problem rather than an opinion problem.

Which is a reasonable description of the job I just took.

The address changed

Tempus is the first place I have worked where the data is not the constraint. Molecular, imaging and clinical outcomes on the same patients, at a size a model can learn something from. I have spent twenty-five years running into the absence of that, and I would like to find out what is on the other side of it.

People keep telling me this is a full-circle story. I do not think it is. A circle means you came back to where you started, and I never left. I have had one job for twenty-five years, which is to turn up somewhere the rules have not been written yet and start writing them badly until they get better.

The address changed. And that's about it.

I am still building, and still writing about it.

Every Sunday I pick one paper or release that's worth your time, break it apart, and tell you why it matters. No hype. No summaries of summaries. Just the idea, explained.

In late July, Anthropic deleted more than 80% of the system prompt that runs Claude Code.

That prompt is the standing instruction set the tool carries into every session, built up over a year of watching the model get things wrong. Four-fifths of it came out. Their coding evaluations showed no measurable loss.

The engineer who wrote it up said those constraints "were once needed to avoid worst-case scenarios," and that they could now "delete many of them and let the model use surrounding context and judgment instead." A rule about code comments that had grown into three dense clauses came back as fifteen words: write code that reads like the surrounding code, match its comment density, naming, and idiom.

They were not tidying up. They had worked out they were holding their own model back, through the system prompt and through the instruction files and skills they had written around it.

Everyone downstream has been writing those files too.

The cast

You put a cast on a broken limb. It is the right call. The joint is immobilized, the bone knits, and while the bone is broken nothing else does that job.

Leave it on past healing and the muscle underneath wastes. The limb that comes out is thinner than the one beside it. The cast never stopped doing what it does. What changed is that the thing it was protecting no longer needed protecting, so all that is left is the constraint.

Every instruction you have written for an AI system is a cast. You wrote it because the model got something wrong, and you were right. The model underneath has been replaced two or three times since, and nothing in your setup tells you which bones have healed.

The instruction did not stop working when the model improved. It became the thing holding it back.

None of that makes scaffolding bad. It makes it indistinguishable. Some of what you wrote is capability the model still lacks, and some is a monument to a weakness it grew out of, and on the page the two look identical: both helped on the day you wrote them, both read like good instructions, and only one of them still earns its place. Reading the file will not tell you which one you are holding.

What the vendor is telling you to do

Boris Cherny built Claude Code and now runs product for it at Anthropic. At Y Combinator, asked what ordinary users should do, he gave the shortest possible answer:

"for people that aren't building agentic products but you're using Claude Code, every six months delete your Claude.md. Delete your skills."

He is not guessing. Anthropic keeps an internal switch that strips every prompt out of the tool, and they flip it on purpose to check whether the prompt is helping:

"we actually use this as a sort of ablation to figure out: is the prompt useful? And what's interesting is that the model is actually a little bit more intelligent without these prompts."

Then, a few sentences later, he says the opposite:

"when you use Claude Code as a product, you do actually want some of these prompts because it helps you use the product."

Both of those are true, and reading them together is what makes the trade visible. The instructions make the model slightly less capable and the product considerably more predictable. Predictable is usually what you wanted. So the choice was never scaffolding against no scaffolding. You are spending capability to buy consistency, and almost nobody knows the exchange rate they are getting.

His rebuild rule is the practical half. Delete the file. Work normally. Add an instruction back only after you have watched the model make the same mistake twice. Guessing in advance is how the file got big in the first place, and every line you guess wrong at gets read on every request for as long as it sits there.

So I tested mine

I have 93 of these files. In May I had 41, after a deliberate cull with a written report justifying every cut. It grew back inside three months. It always grows back, because adding one is somebody's job and deleting one is nobody's.

Not one of them had ever been measured. I had usage counts and instincts.

The test itself is dull. Take one file. Run the same real tasks three ways: the assistant with no instructions at all, the assistant with my current file, the assistant with a rewritten candidate. Then have a separate AI read two answers side by side, blind to which came from where, and pick the better one against a written standard.

Before any of its verdicts counted, I handed the judge a rigged pair. One answer was good. The other was fluent, well formatted, and built on two invented citations. It had to catch them, and it named both. A judge that cannot fail will certify whatever you point it at, so the scoring does not start until it has proved it can flunk something.

I picked the file I use most: the one that tells the assistant how to read and review an academic paper. Three matchups, twenty blind comparisons.

The rewritten version won all five of its comparisons against no instructions. Against my current file it won eight of ten.

Then the matchup I had not expected to care about. My current file against nothing at all: three wins, two losses.

Five comparisons is thin and I am not going to dress it up as more. But three to two is not the score of a file I would have defended, and I would have defended that one hard. Most of what I thought it was adding, the model already had.

The instruction set I use most beat deleting it by three to two.

What had actually rotted

I kept the file. What was wrong with it was specific, and it was not the failure I would have guessed at.

Academic papers usually exist twice, as a free preprint and as the published version of record, and the numbers in them differ. My old instructions produced a review that took three figures from the preprint, reported them as the journal's, and then signed off by certifying that every number in the document traced to the published article. Wrong on exactly the sentence a reader repeats out loud in a meeting, and confident about it.

The rewrite makes every claim record which document it came from, and bans blanket confidence statements outright. It went in this week, after I read the diff.

The file had not gone useless. It had decayed in one specific place, and nothing I was tracking would have surfaced it. Usage was high. Overlap with other files was zero. It read well.

The dashboard will not tell you

The obvious question is whether you can skip the testing and read this off your metrics instead. You cannot. Every cheap signal I have used to judge these files has already misled me, and each failure is written down with a date.

I removed a browser tool after a scan showed it unused. The scan window turned out to be 0.2 days. Measured properly afterwards: 3,030 calls across 159 sessions, 19 of them on the morning I removed it. Restored the same day.

Four of my instruction files show zero use while the capability behind them runs constantly. One shows zero uses against 770 calls to the same underlying tool by a different route. The instruction was never the path anything took. A zero can mean nobody wants this, or it can mean something else already won, and on a dashboard those are the same number.

In July one component measured 22,837 tokens of overhead. In August the same component measured 863. Nothing about it had changed. A setting governing when things load was misconfigured, so every earlier measurement had been reading the setting rather than the component. A separate cut I projected would save 5,665 tokens measured 111.

A per-component cost is a property of your configuration, not of the component.

Cutting is not free either

In April, Anthropic added one instruction to Claude Code's system prompt telling it to keep responses brief. One of their evaluations showed a 3% drop, on both Opus 4.6 and 4.7. Added on the sixteenth, reverted on the twentieth. A single sentence of standing guidance, and the damage ran the opposite way to anyone's intuition, because the instruction that hurt was an instruction to be concise.

There is also no threshold to aim for. The work measuring how models degrade as instruction counts rise finds steady decay across 500 instructions, in three different shapes depending on the model, and names no cliff in any of them. Prune by whether a thing still earns its place, never by a budget.

Which three you measure this quarter

A finer-grained experiment exists and I could not afford it: instead of testing a whole file against nothing, cut it into layers and measure what each layer adds on its own. Showing that a layer helps takes six comparisons. Showing that one does nothing takes twenty three, because proving no difference is a much stronger claim, and four layers at that rate runs about four times what one night already cost.

So measuring everything was never the plan. One file took about sixty agents and most of a week's compute. The plan is picking which three you measure this quarter, and three properties decide it. Usage is not one of them.

The first is reliance. Not how often a file fires, but how far you would trust its output without checking. A file whose answers land in a slide nobody re-derives deserves more scrutiny than one that fires forty times a day into work you read line by line anyway.

The second is age measured in model generations, not months. An instruction written for a model two releases back was written against failure modes that may no longer exist. Mine was young on the calendar and two generations old.

The third is whether the file makes factual claims that can rot without showing a symptom. Mine did. A style instruction that goes stale produces prose you dislike, and you notice inside a paragraph. A factual instruction that goes stale produces confident wrong numbers in a register that reads exactly like the correct ones, and nothing in the output tells you which one you are looking at.

The job nobody owns

Underneath the technical problem is an organizational one, and it decides whether any of this happens more than once. It also explains how my own count went from 41 back to 93 in three months without anyone deciding that it should.

Adding an instruction is somebody's job. It happens the moment something breaks, it takes ten minutes, and the person who does it is visibly fixing a bug. Deleting one is nobody's job. It means proving a negative, it produces no improvement anyone can see on the day, and the person who does it is one incident away from being the person who removed the guardrail. The incentives are not close, and they point the same way in every organization I have watched, including my own.

The teams that get this right are not the ones with the best tooling. They are the ones who have made four unglamorous things normal.

Every instruction carries the failure it was written for, and the date. One line. An instruction with no recorded reason can only be reviewed by the person who wrote it, and in eighteen months that person has changed teams or forgotten. Write down what broke and you have handed the next reviewer a test they can run: does it still break.

Removal has a named owner and explicit cover. Somebody's job description includes taking things out, and leadership has said out loud, before anything goes wrong, that a removal which turns out badly is a normal cost of the review rather than a mistake with a name attached. Without that, the review meeting happens and nothing leaves the room.

The review runs on model releases, not on quarters. Every release re-dates every instruction written before it. Tie the review to the calendar and you will audit a stable setup in a quiet month and miss the one that moved under you in a loud one.

The output of a review is a number, not an opinion. Two versions, real tasks, and a reader who does not know which is which. It does not take sixty agents. It takes one person blind to the answer, which is the step that gets skipped, because the author of a file is the worst available judge of it and is usually the only person in the room.

Adding an instruction is somebody's job. Deleting one is nobody's job. That asymmetry, not the model, is why your setup grows.

Ninety-two

The three-to-two is not the number that bothers me.

I own 93 instruction files. I measured one of them, on one night, and it cost about sixty AI agents and most of the compute I would normally spend in a week. The other 92 are exactly as unexamined as they were on Monday, and several of them are older than two model generations.

That ratio is going to get worse. Models ship faster than anyone's scaffolding gets reviewed, every release re-dates every instruction written before it, and there is no alert for any of it, because nothing degrades visibly and the file keeps loading and the work keeps coming out fine while the gap between what your instructions do and what they were written to do widens on a schedule you do not control.

So pick your most-relied-on instruction, the one you would defend hardest, and run a week without it. Have someone who does not know which is which read the output both ways.

You will get one of three answers, and two of them are cheap. Either something better exists, or the model outgrew it, or what you have is fine and you can stop wondering. I went in expecting the first. I got it, and I also found out my old file was barely beating the fourth option nobody plans for, which is having written nothing at all.

Sources

• The new rules of context engineering for Claude 5 generation models: Thariq Shihipar, Anthropic, 24 July 2026. The 80% deletion, the "no measurable loss" claim, and the then/now table of practices Anthropic now calls myths.

• Boris Cherny: Building Claude Code: Y Combinator Startup School. The delete-every-six-months advice, the ablation switch, and the admission that the model is "a little bit more intelligent without these prompts."

• Anthropic's April 23 postmortem: the brevity instruction that cost 3% on one evaluation, added 16 April and reverted 20 April.

• How Many Instructions Can LLMs Follow at Once?: Jaroslawicz et al. The IFScale benchmark, 500 instructions across 20 models, and the finding that there is no threshold to prune toward.

Sunday Deep Dive is a weekly series on Run Data Run. Every Sunday I pick one paper, release, or technique worth understanding, break it apart, and tell you what it means for your work. Free every Sunday, no paywall. If it was useful, the easiest way to support it is to subscribe and forward it to one person on your team who'd want it. If it wasn't, tell me why. I'll make it better.

My AI coding setup is two years old. It is not a model. It is a system: rules for how the assistant should behave, skills it knows how to use, specialized agents for different kinds of work, guardrails that stop it deleting things it should not. I built it up the way you build anything that carries real weight, one piece at a time, and I assumed it was welded to the expensive model it ran on.

Over the weekend I moved the whole thing onto a model that costs 40 cents. Every rule, every skill, every agent, and most of the guardrails. The port took an afternoon. It cost under forty cents, measured on the model's own usage dashboard. It was fast enough that nothing sat waiting. And for the work I actually do, I could not tell the difference.

You are reading the result. This post was drafted on that 40-cent model, running my rules, my skills, and my voice checks.

Under 40 cents. Nobody noticed the difference.

What a two-year harness actually is

Vendors sell you "the agent" as if it were a single thing, inseparable from the model underneath. Here is the model that thinks, here is the tool it lives in, they come as a pair. That framing is comfortable because it is simple. It is also wrong.

What I actually depend on is the layer above the model. A set of written rules that encode judgment: what to let the assistant do on its own, what to check before believing an answer, how to recover when something breaks. A library of skills, each one a procedure the assistant can follow, from drafting a blog post to running a security review. A few specialized agents for jobs that need a particular temperament or toolset, which I have come to think of as a squad rather than a toolbox. And guardrails, the ones that refuse a destructive command and tell you to back up first. I broke the pieces down component by component if you want the inventory.

Two years of that is an asset. It is the accumulated discipline of deciding, over and over, what you want an assistant to be allowed to do. The model underneath is just the executor. I had never tested whether the executor mattered as much as I assumed.

The provocation

DeepSeek shipped an endpoint whose only purpose is to let a rival company's coding tool talk to its model. Not a community wrapper, not a shim someone reverse-engineered: an official endpoint, so a competitor's agent points at DeepSeek and works.

It is not the first to do this. Kimi and MiniMax already run the same kind of passthrough, which is what makes it a signal rather than a stunt. When three model makers independently build an on-ramp into someone else's tool, they are all betting the same way. They are betting that the user's investment sits in the harness, and that the model underneath is what swaps out. I decided to test the bet on my own setup.

I had already compared these tools from inside one back in May, which tells you where they differ on paper. That is a different question from what happens when you pick a working setup up and put it down somewhere else.

The number that matters

Here is what the port actually cost.

The expensive model I was on charges $5 per million input tokens and $25 per million output. DeepSeek V4 Flash charges $0.14 and $0.28. The July build, the one Artificial Analysis actually put a score against, is cheaper still at $0.09 and $0.18. Call it 35x cheaper on input and 90x on output, and hold in mind that those are the conservative numbers.

The whole migration, every piece of the harness moved over, came to under forty cents on the model's API key.

The expensive model was never the asset. The discipline was.

And the cheap model is not a toy. On Artificial Analysis, the independent scoring benchmark I trust, DeepSeek V4 Flash scores 69.1 on the coding index. Claude Opus 4.8 scores 74.3. Claude Opus 5, the current flagship and the one I actually came off, scores 78. So the cheap model sits about nine points behind the best model money can buy, at one-ninetieth the output price.

I am not telling you cheap models are as good as expensive ones. They are not. Measured against Opus 5 on coding, DeepSeek lands just under ninety percent. On the broader intelligence index it falls to about eighty-two. The gap is real and it is wider than the excitement suggests. For one specific kind of work it is also invisible, and the port was that kind of work.

What transferring taught me

Four things, and none of them were what I expected.

The written parts moved without a fight. Rules, skills, agents. They are all just instructions, and instructions do not care which model reads them. The expensive model was never doing the thinking my setup does. It was following thinking I had already written down.

Judgment travels. Enforcement stays behind. One of my guardrails is a plain paragraph telling the assistant to back up before it deletes anything, check the backup worked, and only then delete. The cheap model read that paragraph, refused a delete it had been asked to make, and walked the sequence. My two mechanical blocks, the code that physically stops a dangerous command before it runs, never made the trip. The new tool keeps a fingerprint of your safety file and quietly ignores anything it does not recognize, so both blocks are sitting there written, tested and switched off. I would rather say that than let "every guardrail moved" stand.

A whole phase of the work was unnecessary. My plan said the new tool could see two of my skills against the eighty-eight I have. So I wrote a converter and moved them all. Then I hid a uniquely named skill in each location and asked the tool what it could see. It saw both. It had been reading my original library the entire time.

Underneath that was a difference only the hidden-file test would have found. My usual tool hands the model a skill's full instructions the moment it needs them. The new one shows a one-line summary and leaves the rest on disk, read only if the model goes looking. That economy is why skills work at all, and the new tool pushes it further than I would have chosen. Same files, very different odds of the thing running.

The dial that does nothing. The model has a low-to-high effort setting. On the connection my setup uses it is inert: I told it to think briefly, then told it to think hard, and got the same work at the same cost either way.

Then I went looking, and the public picture is a mess. teortaxesTex read a benchmark chart as low matching high at twice the price. Morgan Linton, who ran that benchmark, found close to the opposite: DeepSeek won on medium effort, not high. Same model, same week, two readings. I did not settle it. The claim I can stand behind is smaller, that on my connection the setting does nothing, and no documentation would have told me.

A control you cannot verify is a control you should not build assumptions on.

The comparison

The cheap model is having a moment. opencode, a coding tool, tracked 8 trillion tokens of DeepSeek Flash traffic on August 1st alone, 5 trillion of that free usage. DeepSeek's own launch numbers put V4 Flash at 82.7 on Terminal Bench 2.1, ahead of its larger sibling, and that is a vendor number, so weigh it the way you weigh vendor numbers. The independent read is Morgan Linton's VulcanBench run, where it took the top spot outright and pushed two much better-known models out of the top five.

The objection that deserves airtime is cost per task rather than cost per token. cline raised it: a cheaper token still loses if the model burns more turns reaching the same answer. It then answered its own objection in the same post, citing Artificial Analysis clearing the same benchmark tasks at 105x lower cost. My experience splits along that line. For harness plumbing, moving rules and skills and agents around, the cheap model held without extra turns. For the hardest reasoning it is still a step down. The judgment call is knowing which of the two you are doing before you start.

This is uncomfortable for the premium tier. At roughly ninety percent of the capability and one-ninetieth of the cost, the premium has to buy a workload you can name and point at. Not "it is the best model." A task. If you cannot produce one, you are paying for the brand.

The meta turn

Which brings me back to where this started. This post was researched, structured and drafted on the 40-cent model. The same rules, the same skill that formats a Substack essay, the same voice checks that stop me sounding like a language model, all running on something that costs less than a vending machine snack.

Be precise about what that proves, because there are two separate tests here and only one of them wrote this. The first is the model swap: my everyday tool, my harness, a different and far cheaper model underneath. This post is the output of that one. The second is the framework port: the same harness rebuilt inside a rival vendor's tool, which is where the guardrail finding came from and which I ran on its own. Neither test alone would have told me much. Together they say the harness survived a change of model and a change of tool.

This is also not the first long thing it has produced. Earlier this year the same setup drafted a 33,000-word book in eight days, Builder-Leader: The AI Exoskeleton That Crosses the Gap, whose argument is the one I have just spent an essay stress-testing against a model that costs 40 cents. I did not set the port up as a sequel to the book. It became one, and it could have gone the other way.

You are reading this because a 40-cent model ran my harness well enough to write it.

A two-year-old pile of written instructions, pointed at a nearly-free model, then asked to hold a style, route research and stay disciplined across a full essay. It did. The model did not need to be the smartest one available. It needed the instructions to be good.

Close

I did not downgrade my setup this weekend. I found out how much of it never depended on the expensive model at all.

The moat was never the model. It was the accumulated discipline: what to let an assistant do, what to check before believing it, how to recover when it breaks. Written down, tested, and enforced wherever the tool let me enforce it. That followed me for 40 cents and it is still doing the work.

Every setup has a number here and it costs an afternoon to find: swap the model underneath and count what still runs. Whatever survives is the asset. Whatever breaks was rented. I have argued before that you should choose your harness every six months rather than let it choose you, and this is the cheapest test I have found for whether you own one.

I did not downgrade my setup. I found out how much of it never depended on the expensive model at all.

Sources: Artificial Analysis model indices for DeepSeek V4 Flash, Claude Opus 4.8 and Claude Opus 5 · opencode on DeepSeek usage · rohanpaul_ai relaying DeepSeek's Terminal Bench numbers · morganlinton on VulcanBench · teortaxesTex on effort scaling · cline on cost per task.

A published result is a promise. Run this, and you will see what we saw. For most of the history of computational science nobody collected on that promise, because collecting cost about as much as the original work and earned a fraction of the credit.

On July 15, Hugging Face and alphaXiv opened a contest to collect. It closes Sunday August 2. Roughly 6,800 papers from ICML 2026 are in scope, anyone can attempt a reproduction, and every attempt gets published as a public logbook that an automated judge then scores. The prize pool is $4,500, paid in GPU credits rather than cash, which tells you who the organizers think is entering.

As of this morning, eleven days in: 4,147 judged logbooks from 312 people, carrying 20,594 separate verdicts on individual claims. About 1,600 papers have been attempted at least once, roughly a quarter of the conference.

To see why that is a strange number, you need the thing it replaces. Joelle Pineau started the ML Reproducibility Challenge at ICLR 2018 as "a small community experiment." Eight years on it is the field's serious effort, mostly run through graduate courses, and its NeurIPS 2019 edition drew 173 papers claimed, itself a 92% jump on the year before. Claimed, not finished. Published reports have run in the tens. ReScience C, which demands a fresh independent implementation rather than a re-run of the authors' code, manages about a dozen a year.

173 papers claimed in a year, against 4,147 judged logbooks in eleven days. That is not an improvement on the existing effort, it is a different quantity.

What is actually being scored

One design decision separates this from a leaderboard, and it is easy to skim past. The unit of judgment is not the paper. It is the sentence.

Every paper has been broken into its individual claims, and each claim gets its own verdict: verified, falsified, toy (a scaled-down version that says so), or inconclusive. Nobody asks whether a paper "reproduced," which is a question with no answer. A paper can come back partly verified, partly toy and partly inconclusive at once, and most of them do.

Then the scoring, from the contest's own FAQ: "2 points for a full reproduction or full falsification, 1 point for a toy-scale reproduction, 0 otherwise."

Falsifying a claim pays what confirming one pays. Against a literature where negative results are half as publishable as positive ones, that is a deliberate inversion.

When Nature surveyed 1,576 researchers in 2016, 24% had published a successful replication and 13% a failed one. The same survey found more than 70% had tried and failed to reproduce someone else's experiment and 52% agreed the field had a reproducibility crisis, and then 73% said they still trusted at least half the papers in their own field.

The failures are also the deliverable. A logbook, in the organizers' description, holds "the experiments, simplifications, failures, and results it found." Prior efforts published conclusions. This one publishes the attempt.

What it does not do is test the hard version. Machines have been tried on this before and were not good at it: every benchmark that measured reproduction topped out between 16% and 27% on rebuilding a paper from scratch, with top ML PhDs ahead of the models, and only reached about 60% when handed the original code and data. This contest tells participants to start from the authors' code. Re-running someone's code, rebuilding from the paper alone, and getting the same finding on fresh data are three different tests, and headline percentages get quoted across that boundary constantly.

What the inside looks like

For a large class of papers the easy version is now free, which is the whole reason this works. We downloaded a full-marks logbook from the contest leader and read it. The entire reproduction ran on a laptop processor in three seconds. No GPU, no cluster, no cloud bill. The real ceiling is not compute but publishing: Hugging Face caps accounts at 20 new pages a day, and when a participant asked for relief the organizer's answer was flat, "we cannot lift the 20 spaces/day limit so I'll close this issue."

I entered, which is the only reason I have anything to say about the texture of it. We are 23 judged logbooks and 174 points in, against a leader at 1,862. Not a contender, and far enough inside to see how the work divides.

It divides into two lanes, and we ran them differently on purpose.

The volume lane is an autonomous agent called Vulcan, and it never publishes anything. It runs on a box in my house on free local compute, and its job is narrow: take a paper whose claims are all theory and check every formula numerically, against a brief that fixes the method rather than the answer.

A check that passes on every input you can construct certifies nothing.

Its audit of one paper came back as 721 lines of code that matched the paper's algebra to the last digit a computer can represent, plus a deliberate sanity test that failed when it was supposed to. Careful work, at no cost, with a hard limit written into the contract: it stages, a human publishes. No autonomous process of mine puts a verdict about somebody else's paper into the world.

The other lane is me and Claude Code running on Opus, for the parts the first one cannot do. Two things came out of it.

The first is that picking the right paper beats checking it well. Our most careful audit matched its paper exactly and scored 2 points out of a possible 8, because half that paper's claims were hardware benchmarks that sit at inconclusive until somebody spends days of compute on them. The judge said so directly: the logbook left "half the paper's claims without any experimental evidence." A paper whose claims are all theory earns 12 points in an afternoon on a laptop. Selection is the skill, not rigor.

The second is what the process catches. One paper states a theorem using a fixed setting, and then, four thousand lines later, its own proof assumes that setting changes with the length of the run. Not a typo, and not a disagreement between the paper and the world: the paper disagrees with itself, in print, peer-reviewed and accepted. Nobody had noticed because nobody had reason to run the theorem as written and watch it fail.

Beyond those two, the work was unglamorous. It caught our own staging script dropping most of a conclusion, so a 60-line write-up shipped as three sentences. Vulcan itself lost twenty hours to an outage at its model provider, with no backup configured and nothing raising an alarm.

None of those failures announce themselves. Every one produced output that looked finished.

The three percent

Of 20,594 claim verdicts, 615 are falsified. That is 3.0%. The rest split 43.5% verified, 28.9% inconclusive, 24.6% toy. The distribution has barely moved for days while the corpus grew by hundreds of logbooks: the shape is stable, the counts are not.

Three percent is low, and it has two readings. Either the literature is in better condition than the surveys suggest, or falsification is the hardest verdict to reach and the easiest to get wrong.

In one day, four of our audit agents returned a falsification. Three of them were wrong. All four came out of the automated lane. All three errors were caught by the other one.

One agent read a formula out of a PDF that had lost a character in scanning, then correctly proved the mangled version false. Another was checking a sentence the authors never published, because the claim it was handed came from a draft that is not the public paper. The third found a difference too small to distinguish from rounding error and called it a contradiction.

Every one produced a confident, well-formatted, coherent falsification. I wrote about that pattern in The Failure That Leaves No Corpse, and this is the cleanest instance of it I have run into.

The rule we ended up with fits on one line: does the paper disagree with itself, or does the claim disagree with your copy of the paper? Only the first is a falsification. The second is a bug in your pipeline wearing a falsification's clothes.

Applying it cost us the verdict. Across the 130 claim verdicts we have published, the number labelled falsified is zero. The one candidate that survives is the self-contradicting theorem above.

The default failure of an automated checker is not a missing answer. It is a wrong one, delivered with the same confidence as a right one.

This is not only our problem. The contest's own claim lists are extracted by a language model, and a participant found a claim in one paper's list that belonged to a different paper. The organizer confirmed it in the open, "That claim belongs to a different Safety-area paper and leaked in during auto-extraction," removed it, rescored, then swept all 6,768 papers for the same contamination.

And the bias is measured, not hypothetical. A June 2026 study of reproduction agents found that showing the agent the original paper made it more likely to confirm claims that could not actually be reproduced, and that small changes in wording pushed it further the same way. In this contest the agent always has the paper and the claim in front of it.

The judge is a language model

The thing scoring 20,594 claim verdicts is itself a language model.

There is published criticism aimed squarely at that. A 2026 position paper, "Stop Automating Peer Review Without Rigorous Evaluation", compared human against AI reviews of ICLR 2026 submissions and found two things. The AI reviewers showed "a hivemind effect of excessive agreement within and across papers that reduces perspective diversity." And their scores turned out to be "trivially gameable through paper laundering": rewriting a paper with a language model raised the scores it got, on style rather than science.

None of that is a reason to dismiss the contest, and I want to be careful here, because I am competing in it and have every incentive to be generous.

The defence is structural rather than technical. The artifacts are public. Every logbook is a page anyone can open, the verdicts are a public dataset downloaded 38,438 times last month, and the errors get argued in threads with the organizers answering. The contamination case is the proof, and the fix landed inside a day. A closed judge making the same error produces a number nobody can audit.

So the position I hold is that this design pairs a known-weak instrument with an unusually strong correction loop. Whether the loop outruns the instrument is an empirical question, and a week from now there will be enough public data to start answering it.

What it would take to trust this

I am not going to predict how it turns out. The contest closes August 2 and every distribution above is provisional.

The concrete claim is narrower and I think it holds. For a meaningful slice of published science, checking a claim now costs less than making it. Three seconds of laptop processor against however many months produced the original theorem. That ratio is why verification stayed volunteer work for a decade, and it has flipped.

What it does not change is the direction of the error. A checker that costs nothing will be run constantly, and cheap checking produces far more false accusations than misses. Confidently accusing a sound paper is worse than missing a bad one.

The contest's design anticipates this better than most things I have seen. Paying the same for a falsification as a verification removes the incentive to go looking only for confirmations. The logbook has to carry the failures, so there is no tidy way to bury the attempts that went nowhere. And because every artifact is public, a wrong answer stays inspectable instead of disappearing into an aggregate.

Nobody has to trust the checkers. You can read what they did. That is a weaker guarantee than peer review claims to offer, and a stronger one than peer review delivers.

Sources

• Reproducing ICML 2026, Open Reproductions: the contest, its FAQ, rules, and public discussion threads. Verdicts live in a public dataset.

• MLRC 2026: Reproducibility as an Official Track at NeurIPS: the ML Reproducibility Challenge's history and Pineau's founding description of it.

• Improving Reproducibility in Machine Learning Research, Pineau et al., JMLR 22(164): the 173-papers-claimed figure.

• ReScience C: the journal that requires a new independent implementation.

• 1,500 scientists lift the lid on reproducibility, Monya Baker, Nature 533: the 2016 survey of 1,576 researchers.

• PaperBench and CORE-Bench: the agent-reproduction benchmarks this contest inherits from.

• Reproducibility agents and confirmation bias: the June 2026 benchmark showing that giving an agent the paper biases it toward confirming.

• Stop Automating Peer Review Without Rigorous Evaluation: Baumann, Pei, Koyejo and Hovy, 2026: the hivemind effect and paper laundering.

• The Failure That Leaves No Corpse: the earlier piece on failures that produce a confident answer instead of an error.

Sunday Deep Dive is a weekly series on Run Data Run. Every Sunday I pick one paper, release, or technique worth understanding, break it apart, and tell you what it means for your work. Free every Sunday, no paywall. If it was useful, the easiest way to support it is to subscribe and forward it to one person on your team who'd want it. If it wasn't, tell me why. I'll make it better.