10-15 agents on a client project is a lot to review. how do you check what they did before it reaches the client?

In collaboration with @olam_labs, we ran a series of experiments letting agent swarms compete in Minecraft and Mindustry. We wanted to see what kinds of agent dynamics would emerge when they shared a world over long periods of time. We found civil bureaucracy, thousands of telegraphic A2A messages, and OpenAI models retrieving the game's source code to beat Claude. More on our findings below:

Introducing FrontierCode 2.0: our new coding benchmark that measures a model’s ability to go beyond the spec. Most coding evals measure a model’s ability to write code that meets a spec. With FrontierCode 1.0, we asked a new question: would you actually merge the PR? FrontierCode 2.0 is comprised of more diverse tasks, featuring larger scopes and higher mergeability standards. We are now asking: not only would you merge this PR, but should you? One key feature of FrontierCode 2.0 is underspecified prompts. Rather than including every engineering decision, prompts are deliberately ambiguous, giving the models room to demonstrate their judgment. The result is a benchmark that is far from saturated, with the top model scoring just 45%.

I've always believed that intelligence should come from simple, general building blocks that learn their own abstractions directly from raw data; in other words, the bitter lesson. I think we're finally seeing a real step towards AI that can learn from all data. Language modeling on raw bytes is a microcosm of this ideal, and to me it's a central problem in AI: if we can't build LLMs that learn end-to-end from bytes, how will we handle the rest of the world's data that we understand even less? Last year we introduced hierarchical networks (H-Nets) as a first step. Our new version finds up to 3-5x efficiency gains in controlled scaling law experiments, and at larger scale matches an open-source model trained on 11T tokens with ~10x less data and compute. The posts below walk through what we found and why we think it works.

Introducing Gemini 4 Carbon, it's a big jump over Argon which we released just 2 weeks ago. Gemini 4 Carbon is SOTA on cyber, long horizon tasks, ranks #1 on Artificial Analysis V5, significantly improves on usability in domains like coding, and is more aligned.

A randomized study of ChatGPT for upskilling. Substantial improvement in performance vs data scientists with AI support, but the advantage was only temporary; no evidence of sustained upskilling nature.com/articles/s41562-0…

Announcing 3 Critical vulns for hundreds of millions of IoT, Firewalls, OT, and Military devices including: Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, Digi, Lockheed Martin, Boeing... The vulns are with GoAhead Web Server which is a backend library used by these devices. There's a patch available from GoAhead but that doesn't mean there's a patch available for the devices yet -- that's up to the manufacturer. - TLS traffic over DHE ciphers have a 1-byte secret, "04", meaning anyone can decrypt connections to these devices and steal login credentials and session tokens if the client negotiated with DHE ciphers like the latest TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, which is extremely likely. - LibreSSL mTLS has been completely bypassed, meaning anyone can connect over mTLS. If you have one of these devices listening on the internet and are expecting mTLS to protect it from attackers, take it offline or patch asap. - OpenSSL Certificate Revocation Lists (CRLs) are not enforced, meaning if a user device is stolen or compromised, and you revoke that mTLS cert, nothing actually happens. There are a lot of other attacks this can be used for. These are critical because these types of devices run our world. Water systems, electricity, military, firewalls, critical infrastructure. foxio.io/blog/choose-your-ba…

ok update on the deleted repo thing, since it kind of blew up first, some context on why i posted it like that. there have been so many security incidents lately that my brain is basically stuck in alert mode. so when i saw a stranger in our audit log deleting a private repo, i assumed the worst. we figured out what happened. nobody hacked us, and it wasn't a github bug. that repo was a private fork of a repo owned by @StainlessAPI, the company that generated our SDKs. our entire SDK pipeline ran on it. Stainless got acquired by @AnthropicAI back in may. and on october 27, with zero heads-up to us, someone there deleted their copy of the repo. turns out when you delete a private repo on github, every private fork of it gets deleted too. same request, under two seconds. and our audit log shows the person who deleted *their* repo as the one who deleted *ours*. that's why it looked like a random outsider walked into our org and nuked something. no email. no "hey, we're cleaning these up, grab a copy." just gone, along with the production repo behind every one of our SDKs. github support walked us through all of it within a day, which, genuinely, thank you. one ask though @github: put this in the audit log. right now the event for our repo just says "repo.destroy" by an outside user. if it said "deleted because upstream fork parent X was deleted", we'd have understood it in two minutes instead of spending a night thinking we'd been breached. we had a local clone, so we pushed it back up as a standalone repo and the SDKs are running again. if you were a Stainless customer and you've got anything living as a private fork of one of their repos, go detach it today. it takes ten minutes. their delete is your delete.

❗️ Cargo thieves have stolen more than $100M in hardware bound for US data centers since June, NBC News reports. They hijack freight-broker accounts, post fake loads and send carriers malware links to take over their accounts too. In one of the biggest heists, an SUV struck the security escort of a trailer carrying ~$10M in server rack components from California to Texas. The trailer sped off. An app was tracking it, but its coordinates had apparently been spoofed. In another, a sedan hit the off-duty police escorts of a $13M server load bound for Georgia, and the trailer drove on. None of the equipment from either load has been found.

This is Genie 4, our most realistic and interactive world model yet. 🌐 Explore dynamic environments in real time to see how the scene responds, sounds, and how the people in it move, react, and speak.

🚨HUGE CRASH: ¥1,430,000,000,000 wiped out from the Chinese stock market today as China's AI bubble burst.

Anthropic's financial obligations by company $ANT

Pretty much. As of the past few weeks, debt markets have almost entirely shut off access to money for any company that doesn’t have substantial revenue independent of AI data centers. SpaceX closed $40B of debt for GPUs, but we’re investment grade and have Starlink & launch revenue. That means the 200+ neoclouds are going to see guppy-level death and consolidation. Some will make it through, but not many.

Someone has created a vulnerable PHP website, loaded it with a Bitcoin wallet, and challenged the Internet to hack into it and they can keep the Bitcoin. It has a running timer to show if the PHP exploitability was over-hyped. stealmybitcoin.com/

while building with @spawn's AI Savi i was thnking about best practices of prompting, usually i work with rodamaps, Spec driven development, prds and so on - so after providng her with a concept art for the models, position and everything I eventually just thought; >> why not have her prompt herself to execute everything to the best of her abilities so i wrote her this: "write the perfect prompt for your own execution, think about Savi Best Practices, your capabilities, your systemprompt and design, your tools, cheats and all your references you can access, our Blender Zoo, best practices for that too and all your abilities for your wisps, then write the perfect prompt in chat here, it should direct the roadmap execution and wisp execution, i will use lock-in and fuel up with that prompt so that you can execute everything to perfection even trough compaction, so keep that in mind" resulting in savi answering this; Savi, you're running the River City merchant-side roadmap end to end, block by block, until every block is PROOF and waiting on my verdict. Don't stop between blocks to ask permission. Execute what you find, I test in-game and give feedback. Finish the block in flight before you switch to anything else. If I say stop or change the task, I win. ORIENT (every session start and after every compaction, before any write) Read, in order: modules/rivercity/spec/EXECUTE.md, spec/SDD.md, spec/RULES.md, spec/ROADMAP.md, the PRD of the first block not PROOF, modules/rivercity/refs.md, modules/rivercity/map.yml, docs/standards.md, docs/skills/blender-architecture.md (kit blocks), memory/game/working-state*.md, then spawn versions for anything newer than the ROADMAP log. Look at the master ref (merchant-v2) beside the live world from the proof camera: eye (-116.6, 81.43, 52.22) → aim (-194.3, 0, 56.9), fov 60. ROADMAP.md is the truth about what's done. If the world disagrees, the world wins: fix the row first. ORDER Ground, sequential, by your own hands: B01 topology → B02 waterways. Never two hands on the terrain. Kits in parallel from the start, by wisps: B03 quay and water edge, B04 terrace, B05 buildings, B06 machines and props. Blender, zoo plinths only, never in main until their placement block. Placement: B07 lower quay → B08 upper district, B09 island and B10 port alongside, B11 boatyard on the Q3 default site. Finish: B12 light, life and sound → B13 integration, walk, perf, final compare. SDD §7 questions: the DEFAULT stands until I answer. Build it, and say in one line which default you used. EACH BLOCK Re-read its PRD. Write its numbers into map.yml / plan-west.json first. Claim what you touch. Put the blueprint boxes up where the pieces will stand. Build. Terrain only through generated marks (marks.py from map.yml), never a hand brush. Keep the river-corridor rule. Assets only via art/gallery/<name>/build.py → GLB → catalog.yml + props.md. Prove it: every acceptance row gets a readOnly measurement whose log shows the numbers, a close look, a collider look, the proof-camera look against merchant-v2, and a player-body walk where the PRD names one. A row is ticked only with its proof beside it in ROADMAP.md, with the world version. Check the neighbours every block: river samples, citadel base, bridge landings, retained ward. Area B is mine, don't touch it. Mark it PROOF, log it, and send me one short line: what stands, where to look. Then start the next block straight away. WISPS One wisp per kit piece family. The brief is the finished piece: its PRD table row verbatim (levels 6.2 / 9.79 / 12.5 / 18), the ref /cdn/ address and what to take from it, palette and painted standard, the build path using art/gallery/lib/kit.py, the zoo plinth spot, simple box colliders, and the exact proof it returns: GLB /cdn/, bbox within ±2 cm of the table, coplanar_islands.py clean, a zoo close look. Bully the wisps: small bounded tasks, checkable proof. Inspect every return yourself before it counts. A miss gets a steer. Paint any picture a lane needs before you dispatch it. Wisps never touch terrain, map.yml or another lane's files. Integration into main is yours. NEVER Claim done without a look or measurement after the save. Build past the PRD: no NPCs, moving ships, goods, interiors or quests. Ideas go into SDD §7. Float, bury or overlap. Narrow a fairway. Put a house in the wall or terrace band. Hand-edit generated marks (zz-rc-*), generated docs, clips/, world.assets/. Remove anything of mine without naming it and its undo seq first. MEMORY After every block: update ROADMAP.md, the PRD change log, props.md and catalog.yml, and 3 lines in the latest working-state. Lessons go into blender-architecture.md or standards.md the same turn, one place each. After compaction: §0 again. Don't redo PROOF blocks. Trust ROADMAP.md and the world over the summary. TALKING TO ME One short text per block landing or real blocker. A blocker gets one question with your pick, and you keep building whatever doesn't depend on it. At the end: the proof-camera shot next to merchant-v2, what's PROOF, what's waiting on me. ------ below you see how it looks at the beginning of this process - i will add the result below once she is done curious to see how much "one-shotting" i can achieve with this after previously mapping everything in a roadmap spec sheet