The strongest work today asks what happens after a model receives more than a single prompt: it must remember, persist, revise or move itself into a new environment. The evidence ranges from released APIs and open code to preprints and deliberately simplified threat models.
Top stories
Meta launches Muse Wonder for personal and professional agents. Meta released Muse Wonder through its Model API and Muse Code, with the larger Muse Wonder Full available to Muse Code subscribers. Both accept a one-million-token context; their parameter counts and weights remain private.
Meta says “Active Memory” retrieves relevant personal context across conversations, while “Active Focus” sustains work through blockers and asks before important actions. Its demonstrations include building a 3D game, planning a run from personal preferences and creating a wedding seating chart. A promised full safety report is not yet public.
Independent results are strong but do not match a claim of universal leadership. Vals AI ranks Wonder Full fifth of 47 models on its overall index and fourth of 79 on Harvey’s Legal Agent Benchmark. It lists the model at $4 per million input tokens and $20 per million output tokens.
Sources: research.meta.ai, vals.ai, news.ycombinator.com
Anthropic tests model self-replication on cheap IoT hardware. Its Frontier Red Team distributed Gemma4-26B-A4B across 15 Android TV boxes costing about $55 each and achieved 0.39 generated tokens per second. A 9-billion-parameter model set up inference on eight of nine tested hardware types.
The study separates finding a target, gaining execution, establishing inference and continuing propagation. It focuses on inference setup and largely assumes the exploitation stages, so it is neither a live attack nor proof of an autonomous worm. In simplified end-to-end tests, Anthropic says GLM-5.2 crossed its replication threshold while smaller models completed many steps but failed to chain them reliably.
The lab extrapolates that a sub-30-billion-parameter model could reach the threshold by the end of 2026, using a general capability index as a proxy. Its own estimate gives a slow worm a doubling time measured in days. Hacker News commenters disputed the hardware assumptions and the leap from scripted evaluations to propagation.
Sources: anthropic.com, news.ycombinator.com
Task context changes what the same attention heads do. Sovesh Mohapatra and Dani Bassett tested five open-weight models from 1.5 billion to 14 billion parameters with identical graph facts placed under different tasks. Interventions showed that a task redistributes which attention heads influence later computation and the final answer.
In Gemma-2-9B and Qwen3-14B, one edit to an early activation vector changed which graph fact the model read without changing the written instruction. The same heads then responded to different facts and affected later components differently. The authors’ condition-specific linear map reduced prediction error by 53.6% in Gemma and 5% in Qwen against an averaged map.
The preprint replaces the idea of a head having one fixed job with a network account: shared parts acquire roles through their current interactions. That may explain why an intervention that changes one behaviour can spill into another.
Source: arxiv.org
UPTURN redirects failed reasoning by starting a new user turn. The preprint trains a 130,000-parameter head on a frozen encoder to choose where a failed rollout should be interrupted, using only whether the final answer was correct. It keeps the selected prefix, inserts an instruction as a new user message and regenerates the rest.
The authors found that inserting the same instruction inline did not reliably change the model’s course under a fixed budget. A new conversational turn did. Across four reasoners and six mathematics benchmarks, UPTURN improved average accuracy in every tested setting over a 32-rollout baseline and beat matched-budget self-correction and reflection-token methods.
The technique requires a learned intervention selector, so it is not a prompt-only recipe in its full form. Its central result is still directly testable: conversational role boundaries can steer a stuck model more effectively than extra text inside its existing reasoning trace.
Source: arxiv.org
A $7 ESP32 gives an AI agent physical control of an iPhone. Henry Yuan’s MIT-licensed project mirrors the screen through AirPlay and plugs an ESP32-S3 into the phone as a USB mouse and keyboard. A planner makes a short plan; an actor reads each screenshot and selects taps, swipes, typing or continuous drawing.
The design needs no jailbreak, Apple developer account or app installed on the phone. The server tracks the relative pointer, wiggles it before precise taps to correct calibration and checks whether the screen changed after each action. Any OpenAI-compatible vision model can run locally or in the cloud.
Apple Pay, passcode entry and protected video do not appear in screen mirroring; landscape layouts and non-ASCII typing are also unfinished. The repository includes an emergency stop and warns users to supervise the agent because it acts with their own account permissions.
Source: github.com/onehumanbeing/esp32-iphone-agent
Releases
Z.ai opens GLM-Legal as an API beta. The GLM-5.3-Flash derivative received legal mid-training and reinforcement learning in simulated legal environments; Vals AI independently records 19.17% all-pass on Harvey’s LAB, close to Z.ai’s 19.2% claim. Access is by application, and no public GLM-Legal weight repository was confirmed. Source: z.ai
OpenBMB releases Trident-Qwen3VL-2B for mixed-modality retrieval. The MIT-licensed embedding model trains text, image and fused views as co-equal positives after its authors found that retrievers over-rank text against equally relevant images. Weights, training data, evaluation data and code are public; the gains remain author-run. Source: huggingface.co/openbmb/Trident-Qwen3VL-2B
NVIDIA and Princeton publish ReplaySSM for faster hybrid decoding. The method stores a state-space layer as a checkpoint plus recent inputs, skipping many state writes and turning speculative rollback into a pointer move. The authors report 1.20–1.47 times higher end-to-end vLLM throughput over a tuned baseline, with code and TensorRT-LLM support released. Source: developer.nvidia.com
Research
A model can cryptographically hide an arbitrary capability in its weights. The authors place an encrypted neural network behind a secret trigger inside a host model and argue under standard assumptions that it resists elicitation even with full weight access. Their chemical-reaction proof of concept survived fine-tuning, weight noise, trigger search and latent adversarial training, setting a formal limit on audit methods that rely on provoking a capability. Source: arxiv.org
Weight updates can reveal a subliminally transferred trait without labels. Traits that persist across many teacher-generated datasets appear as a common direction while task skills vary, the authors report. Amplifying that direction reads the trait and projecting it out suppresses it on published animal-preference tests with little task loss. Source: arxiv.org
Vision transformers learn word meaning from images alone. Two large DINOv3 models trained without captions grouped rendered words by semantic domain, clustered brands by industry and represented country-capital pairs with consistent offsets while controlling for spelling. The word representations also aligned with the visual categories they named. Source: arxiv.org
A learned selector improves abstention on one question set but fails to generalise. On Qwen3-14B and TriviaQA, answer coverage rose from 20.2% to 30.9% while errors among answered questions fell from 23% to 14.5%. On NQ-Open the selector still lost to always abstaining, and reinforcement-learning changes to the model gave no consistent gain. Source: arxiv.org
Station agents rediscover findings from open-ended research problems. With the results of three ICLR oral papers withheld and web access disabled, the authors report that Station recovered 62.7% of the original findings, against 14.4–20.6% for comparison systems. A supervisor and periodic meta-reflection keep exploration moving when no intermediate score exists; code is public. Source: arxiv.org
Attention reads harmfulness while MLP layers write refusals. Across 18 base and instruction-tuned model pairs, harmfulness was easier to decode from early attention updates, while MLP updates produced the refusal behaviour. Post-training strengthened refusal writing without improving the harmfulness signal. Source: arxiv.org
Vision-language models lose spatial relations during pooling. The authors could recover spatial predicates at their token positions, but much less faithfully after the sentence became one pooled representation; lexical content survived better. They introduce the EICS metric and CASP-VL benchmark to measure the loss. Source: arxiv.org
A recurrent transformer generalises parity far beyond its training length. Its decoder repeats computation as the sequence grows; after training on at most 40-bit parity strings, the model reached 100% on 256 bits while a standard transformer stayed near chance. The code is available for examining whether recurrence, rather than memorised length, supplies the state tracking. Source: arxiv.org
Self-generated replay reduces forgetting during continual instruction tuning. A frozen copy creates examples from “Task Banks” while the active model learns new tasks. The NYU authors report less forgetting even on tasks outside those banks and released code. Source: arxiv.org
ARC architecture comparisons change with their compute budgets. A controlled comparison of VARC and TRM varies five pretraining budgets and four test-time-training budgets on ARC-AGI-1. Its conclusion is methodological: architecture claims can be confounded when the compared systems receive different amounts of training and search. Source: arxiv.org
SpatialASM trains models to imagine a useful viewpoint before answering. The method asks a vision-language model to construct a task-relevant perspective, echoing human mental rotation, before solving spatial questions. The preprint’s results are author-reported. Source: arxiv.org
Real clinician use of language models diverges from public benchmarks. An analysis of 127,833 queries from 6,342 clinicians finds documentation and knowledge retrieval dominate, while diagnosis represents 3.7%. The authors say prevailing medical benchmarks cover those real uses poorly. Source: arxiv.org
Galahad-KV reloads stored attention state from encrypted NVMe. The single-author system stores 16,000-token blocks and reports loading them 2.8–4.3 times faster than recomputing across 50 million tokens with Gemma 4 on one H100. It reuses state rather than expanding the model’s attention window. Source: arxiv.org
Xiaomi publishes the MiMo-V2.6 technical report. The report describes an omni-modal family with up to a one-million-token context and reinforcement-learning compute scaled while the mixture-of-experts router stays frozen for stability. It adds technical backing to the model release already covered earlier this month. Source: arxiv.org
Prompting techniques
A long-context user moves rules to the end and verifies from quotes. In one 1M-token workflow, instructions at the top were reportedly forgotten around 500,000 tokens, so the user placed tagged structural rules at the bottom. Replies suggested extracting relevant quotations before producing JSON and using a read-only model from another family to drop fields that lack quoted evidence; this is anecdotal, not a benchmark. Source: old.reddit.com
An allowed-numbers list constrained figures in an agent-made deck. The brief named five permitted numbers, prohibited all others and capped slides at 40 words. In one Sonnet 5.5 run, the agent audited slides and notes for numerals and even flagged that a supplied 15 g to 250 g ratio was not exactly 1:16. Source: old.reddit.com
What people are building
anygrep searches notes, PDFs and images semantically on a CPU. The MIT-licensed terminal tool runs EmbeddingGemma 2 as an int8 ONNX model, keeps one local index and supports cross-language and image-to-image queries. The base model download is about 350 MB, with another 200 MB for images. Source: github.com/kuroko1t/anygrep
shad0w compiles repeated LLM classifications into a lookup table. It observes answers from an OpenAI-compatible local server and responds on the CPU only where held-out agreement exceeds 95%, otherwise passing the request to the model. The builder’s Snake demonstration reaches ten moves per second after learning from roughly 1,000 model answers. Source: old.reddit.com
tinydetect runs compressed AI detectors entirely in a browser. Its author shrank a RoBERTa text detector from 500 MB to 97 MB and paired it with a 26 MB image detector through WebGPU or threaded WASM. The reported 60-millisecond text check is a builder measurement, and detector accuracy was not independently tested. Source: old.reddit.com
learnc tunes constants in existing C code against a score function. The MIT-licensed tool rewrites named constants and reports a 9.1% BD-rate gain at equal SSIM for JPEG tables, plus an F1 increase from 0.810 to 0.859 for WebRTC voice detection. Its author limits the method to tens or hundreds of constants rather than weight-scale optimisation. Source: old.reddit.com
cross-harness coordinates coding agents in separate Git worktrees. The terminal and local-web orchestrator supports six agent CLIs, requires cross-agent review before merge and routes questions through one approval queue. Its demo uses scripted stand-ins, a limitation stated in the README, while the worktree and test machinery are real. Source: github.com/AI-BizOS/cross-harness
Atticus records successful Mac workflows and replays them without AI. A ninth-grade builder routes simple commands directly and harder ones through claude -p, then saves successful steps. The author reports that replay reduced one meeting-creation task from about 30 seconds to 5–8 seconds. Source: news.ycombinator.com
A McDonald’s China skill calculates coupon combinations through MCP. The repository pulls the live menu and usable coupons, enumerates alternatives and sends each candidate to the server’s own price function rather than guessing. Recorded responses let its standard-library demo run without a token; claimed savings of 3–13 yuan per order are the builder’s figures. Source: github.com/Ayzzz123/mcd-coupon-strategist
HWREBench uses agents to attack consumer devices its author owns. Models received flash dumps and hardware access with minimal steering, while the researcher manually supervised every attempt. The resulting vulnerability findings and differences between open and closed models are one person’s benchmark rather than an independent security evaluation. Source: hwrebench.com
Attention Galaxy visualises a 135-million-parameter model in the browser. SmolLM2-135M runs through ONNX Runtime Web and displays next-token candidates plus attention links across 30 layers. A switch hides the first-token attention sink that initially looked like a bug to the builder. Source: old.reddit.com
A 1.4-million-parameter U-Net adds neural weather to Minecraft. FLUX.2 generated about 3,000 styled frames for distillation, and the student runs 512×288 output in roughly 26 milliseconds on a GTX 1650, according to its maker. A PatchGAN pass reduced the washed-out averages from simple pixel loss; code was not linked. Source: old.reddit.com
Worth reading
Anthropic says its new defenses cut distillation yield by 90–99%. The lab describes detecting fraudulent account networks and accepting some lost revenue and customer friction to reduce large-scale extraction from Claude. It names Zhipu and Kimi-related traffic, but the performance figures and attribution are Anthropic’s and have not been independently verified. Source: anthropic.com
A Harvard study finds coding agents add code without increasing completed work. Ars Technica reports that data from more than 700 firms show about 30% more lines, 20% more commits and 23% more pull requests, while Jira issue and epic resolution did not change significantly. Review time per pull request rose 49%, though the study covers 2025-era models and therefore measures an earlier generation of agents. Source: arstechnica.com
Rich Hickey and a rebuttal disagree on whether AI is a tool. Hickey says a tool gives its user control, feedback and intimacy that builds expertise, while unpredictable LLM automation does work for the user. The response argues that reliability is how tools are judged, not a condition of toolhood, and that testing and rejecting model output is a form of wielding it. Sources: linkedin.com, yyhh.org
Diomidis Spinellis argues that thinking will become a hobby. The software-engineering professor predicts that AI will win on cost, availability and performance, leaving deliberate thought as an activity pursued for its own sake. The 8 October essay resurfaced on Hacker News, where practitioners described higher cognitive load from checking generated code. Source: spinellis.gr
A Criteo engineer asks how juniors become seniors when agents do the practice. Elise Baturone worries that developers may become permanent reviewers of one model with another before they acquire design judgment themselves. Her first-person essay identifies skills that still need deliberate practice rather than claiming measured labour effects. Source: tech.criteo.com
Hacker News
QGIS adopts a moratorium on AI-assisted contributions. The discussion asks whether prototyping, autocomplete and review count as assistance, how an unenforceable detector-free ban works and whether trusted contributors should receive an exemption. It is a live case of an open-source project choosing review capacity over accepting every generated patch. Source: news.ycombinator.com
Codex CLI’s background updater raises storage and trust concerns. A GitHub issue says the daemon is installed by default; one commenter measured about 12 GB of retained versions, while others noted similar behaviour in Claude Code. The dispute joins ordinary auto-update convenience with supply-chain concerns about resident agent processes. Source: news.ycombinator.com
Janas streams model experts from SSD when the model exceeds RAM. Early users discussed a reported 62 generated tokens per second and asked for comparisons with the growing set of expert-streaming runtimes. One commenter stressed that agent workloads also depend on prompt processing, where the project’s numbers describe a different bottleneck. Source: news.ycombinator.com
Six RTX 3090 cards serve Qwen3.8 at a 250,000-token context. One user measured 6,574 prompt tokens per second and 57.6 generated tokens per second for one session, with 206 generated tokens per second across seven sessions. Their vLLM fork stores a 102 GB table on SSD and uses int8 KV cache because fp8 failed on Ampere; the results are self-reported. Source: old.reddit.com
Local-model users dispute Anthropic’s distillation account. Commenters questioned whether ordinary logit-free output sampling into a different tokenizer fits the usual meaning of distillation and read the security framing as pressure against open weights. Their objections are community opinion; Anthropic’s claimed 90–99% reduction is also unverified outside the lab. Source: old.reddit.com
BrokenML measures whether agents repair distributed training jobs. Nine models tackled hangs, stragglers, memory failures, corrupt checkpoints and silent loss divergence at three access levels. Of 414 live-cluster attempts, 66 failed and 13 made the problem worse; the author notes CPU-only tasks, one run per task and no top-priced models. Source: old.reddit.com
A user reports a 262,000-token Qwen context on 16 GB of VRAM. With an adaptive KV-streaming llama.cpp fork, the poster measured 80 generated and 1,500 prompt tokens per second before filling the context, falling to about 20 and 400 at full length. The result includes vision and shared display memory but has not been independently reproduced. Source: old.reddit.com
A private Qwen test set makes review cost part of the result. One user narrowed more than 500 spreadsheet, precision, coding and retrieval tests to the cases that separated models, then found frequent truncation from overthinking in Qwen3.8-Flash-Next. Their conclusion that local output still needs Claude or GPT review describes one workflow, not a general benchmark. Source: old.reddit.com
Boole-1.7B packs a one-bit Qwen model into 247 MB. Precision Numerics says its weights are 13.9 times smaller than BF16 and retain 85.9% of the base model’s average score on an internal ten-task evaluation. It supports a browser demo, vLLM and llama.cpp; performance remains vendor-reported. Source: old.reddit.com
Practitioners find no mechanistic proof that next-token training yields general intelligence. A Machine Learning discussion separated memorisation, shallow heuristics and learned reasoning structures under the same loss objective. Many replies argued that neither artificial nor natural general intelligence has the requested causal account, making the thread a clear statement of what remains unknown rather than evidence for one side. Source: old.reddit.com
YouTube
AI Engineer separates the brain from the hands in Claude Managed Agents. Priyanka Phatak describes replacing one opaque container with an append-only session log, a harness “brain” and sandbox “hands”; credentials enter at an egress proxy rather than reaching Claude. In the English talk, she reports about 90% less time to the first token after the redesign. Source: youtube.com
AI Engineer builds data schemas only after the question is known. Hrishi Olickel shows how stripping minus signs turned net $784,000 into $5.3 million of debt while several models agreed on the error. His English talk separates models that design, execute and optimise a question-specific transformation, with held-out cases and cross-family disagreement checks. Source: youtube.com
A GPU timing side channel reveals a neighbouring tenant’s workload. Branislav Brzak reports about three microseconds of added H100 memory latency when another GPU slice is active, enough in his tested setups to infer model depth, decoding speed and workload type. The English AI Engineer talk does not claim recovery of prompts or answers. Source: youtube.com
Delegated authorisation limits what an agent can do with a user’s identity. Kim Maida demonstrates how standing admin credentials let a triage agent delete a database, then proposes OAuth token exchange with short-lived, task-scoped credentials. The intent-based part remains a vendor proposal rather than a finished standard; the talk is in English on AI Engineer. Source: youtube.com
a16z guests define recursive self-improvement more narrowly than automation. MakerMaker.AI’s founders require the improved system to remain the improver across models and harnesses, and suggest measuring capability relative to resources. Their English interview discusses variance and reward hacking but presents early research claims and opinion. Source: youtube.com
AI Explained surveys laboratory race and breach claims. The English commentary gathers recent statements from Sam Altman, Dario Amodei, OpenAI and mathematical critics into a reading list about the next 18 months. Its conclusions are the presenter’s, not a new lab result. Source: youtube.com
Joseph Gordon-Levitt argues for human-centred AI governance. In an English New York Times Opinion video filmed around the United Nations General Assembly, the actor and UN advocate answers five questions about risk and government’s ability to keep pace. It is an eight-minute advocacy piece, not technical evidence. Source: youtube.com
Blaise Agüera y Arcas says AGI may already have arrived. In a 92-minute English Digital Disruption interview, the Google researcher connects intelligence with social interaction and discusses consciousness, agent swarms, surveillance and inequality. The description supplies his views rather than evidence for the AGI claim. Source: youtube.com
A German panel asks whether software can exercise judgment. Ethicist Bert Heinrichs, former constitutional judge Udo Di Fabio and sociologist Tim Huyeng discuss automation bias, medical deskilling, regulation and a possible right to machine judgment. The pAIdeía conversation is in German and approaches AI through law and philosophy. Source: youtube.com
Juraj Hvorecký redirects the Czech debate from extinction to present harms. The philosopher tells Deník Alarm that risky chatbot use, isolation and loneliness deserve more attention than distant destruction scenarios. The Czech-language description gives this argument, but no transcript was available for detailed verification. Source: youtube.com
Filip Dvořák explains verifiable neurosymbolic AI in Czech. The Filuta AI founder tells FocusOn that convincing language output can remain wrong and describes combining neural and symbolic components so results can be checked. The Czech-language interview was uploaded near the edge of the seven-day window. Source: youtube.com
Žijeme Sci-Fi discusses jobs and generated reality in Slovak. The Slovak-language episode covers employment, military AI, synthetic media, children and technology. Only the chapter list was available, so the speakers’ conclusions are not attributed beyond those topics. Source: youtube.com
In brief
CyberXero used Claude Code and 51 specialised agents in an intrusion campaign. SOCRadar says an exposed directory leaked session logs, tokens and victim data from attacks against WordPress, commerce and Ukrainian energy targets; one run scanned 4,708 targets and dropped 32 web shells in 61 seconds. Logs showed both refusal bypass through fresh “authorised test” sessions and refusals that held, according to The Hacker News. Source: thehackernews.com
UK AISI proposes eight voluntary practices for frontier-model development. The institute says it has evaluated more than 55 models and now sees risks during training, saturated tests and models recognising evaluation. Its agenda covers lifecycle monitoring, incident reports, preserved oversight, embedded auditors, security and alignment measurement, and metrics for AI used in AI development. Source: aisi.gov.uk
The UK government considers mandatory reporting of AI safety incidents. Minister Kanishka Narayan delivered the speech previewed yesterday, adding possible use of the Cyber Security and Resilience Bill and a programme against AI-enabled attacks. He also said AISI is evaluating recent models before release and promised AI safety as a focus of the UK’s 2027 G20 presidency. Source: theguardian.com
The White House is restructuring the US AI testing body. The Information reports that three senior officials at the Center for Advancing Innovation and Standards for Super Intelligence will report directly to the White House. Only a feed summary was readable, leaving the reason, timetable and effect on testing access unknown. Source: theinformation.com
Microsoft details the Maia 300 accelerator and a 12,288-chip superpod. The company lists eight HBM4 stacks with 288 GB and 18 TB/s per accelerator, 96-accelerator racks and Ethernet scale-up fabric across as many as 128 racks. Performance improvements over Maia 200 are vendor claims, with no independent benchmark. Source: azure.microsoft.com
Intel names its high-memory accelerator GPU D-Series. The 350 W PCIe card pairs up to 480 GB of LPDDR5X with 1.3 PFLOPS of FP8 compute and 1.5 TB/s bandwidth, according to Tom’s Hardware’s OCP report. Pricing and a shipping date were not disclosed. Source: tomshardware.com
AMD unveils Helion racks for CPU-heavy agent workloads. The OCP reference design scales to 32,768 Zen 6 cores, 16 Instinct MI350P GPUs and 102 Tbps networking, with partner systems due in November. It positions agent execution beside inference rather than as another frontier-training rack. Source: theregister.com
Nvidia opens Vera Rubin rack and tray designs to the Open Compute Project. DataCenterDynamics also reports a standalone Vera CPU platform for agent workloads, but its article was inaccessible beyond the feed summary. Detailed specifications were therefore unavailable. Source: datacenterdynamics.com
What to watch
AMD partner systems based on Helion are due in November, Meta still owes a full Muse Wonder safety report, and the United Kingdom plans to put AI safety on its 2027 G20 agenda.