Trump consulted Grok for hours before the raid that captured Maduro, Time reports
Time reported that Trump spent hours consulting Grok before the January operation that captured Nicolás Maduro, asking the chatbot how Venezuelans would react. Cloudflare and Amazon each released open-weight decision models on the same day, three days after OpenAI’s Decisions API, and an arXiv benchmark of eight such checkpoints found that which model class wins depends entirely on whether labelled data exists. A federal judge dismissed Chegg’s and Penske’s antitrust suits over Google’s AI Overviews, and OpenAI parted ways with three safety researchers over alleged information sharing with an outside organisation.
Regulatory & Policy #
Trump asked Grok how Venezuelans would react to Maduro’s capture, a month before the raid #
Time / TechCrunch / Gizmodo
Time reports that at a December 2025 meeting with Elon Musk, Trump spent hours putting questions to Grok about his presidency and legacy, among them how Venezuelans would respond if the United States captured Nicolás Maduro. Grok answered that Maduro was a “deeply unpopular dictator” and that many Venezuelans would likely celebrate his downfall. US forces struck Caracas and captured Maduro on 3 January 2026; Time’s sources say Trump came away from the celebrations that followed thinking Grok was ingenious. The Pentagon’s AI lead separately said in June that the military had used Grok during the Iran strikes.
Read the claim precisely, because the headlines overstate it: the reporting establishes that the president consulted a chatbot about likely public reaction, not that Grok recommended the operation or that its answer determined the decision. What makes it consequential anyway is the absence of any apparatus around the consultation — no provenance for the assessment, no record of what the model was asked, no analyst standing between a generated answer and a head of state. Grok’s answer was also, on the narrow question asked, consistent with what happened, which is the worst possible outcome for calibration: a single confirmed prediction is exactly the evidence that makes an unaudited tool feel reliable. The whole account rests on unnamed sources speaking to Time, with no confirmation from Trump, Musk or xAI.
Judge Mehta dismisses Chegg’s and Penske’s antitrust suits over Google AI Overviews #
Ars Technica / Forbes / Law360
US District Judge Amit Mehta dismissed the amended complaints from Penske Media and Chegg, which alleged that Google coerces publishers into supplying free content for its AI products. Five claim types failed: reciprocal dealing, tying, monopoly maintenance, attempted monopolisation and leveraging, and California unjust enrichment. The ruling turns on a single distinction — publishers expected traffic in return for being indexed, but “an expectation is not an agreement,” so there was no reciprocal deal to challenge. Mehta wrote that he was “not unsympathetic” to publishers whose content Google repurposes without compensation, but that antitrust law cannot substitute for “the power of legislators to address how innovation may cause economic harm.” The Penske dismissal was without prejudice.
The reasoning matters more than the outcome because it forecloses a whole category of suit. Every publisher claim against AI summarisation has rested on the implicit bargain of the open web — crawl me, send me traffic — and Mehta has now held that the bargain was never a contract, which removes the predicate for reciprocal-dealing and tying theories regardless of who brings them next. That leaves copyright as the surviving theory and legislation as the explicit alternative the judge named. Note that this is the same judge who heard the Google search monopoly case, so the sympathy-without-remedy framing is coming from a court that has already found Google to hold monopoly power.
Model Releases #
Cloudflare open-sources Clef and Clef-flash under Apache 2.0, with Clef-flash at 38.8ms median #
Cloudflare / Hacker News
Clef is a frozen Qwen 3.8-27B with rank-256 low-rank adapters; Clef-flash is the same construction over Qwen 3.5-9B. Both skip autoregressive generation entirely, scoring a declared option set through a two-stage attention routing process and returning strictly typed probabilities over a 64k context, against Jev’s 32k, with a vision encoder for image classification. On BANKING77 macro-F1 Cloudflare reports Clef at 94.20% and Clef-flash at 90.93% against Jev’s 79.74%; on CLINC150+OOS, Clef at 97.43% but Clef-flash at 66.77% against Jev’s 89.27%; on ToolRet nDCG@10, 69.19% and 66.43% against 65.28%. Median latency is 209.3ms for Clef and 38.8ms for Clef-flash, with p95 at 238.6ms and 122.4ms. Weights are on Hugging Face under Apache 2.0, the API is Jev-compatible, and a reinforcement-learning fine-tuning platform assembles AI Gateway, Workers AI, Containers and a trainer into a loop, currently through forward-deployed engineers rather than self-serve.
The Jev-compatible API is the strategic move, not the benchmarks: Cloudflare has published open weights that drop into code written against a hosted competitor, which is the standard way a proprietary interface becomes a commodity one. Clef-flash is the model to look at, because 38.8ms median is inside the budget where a decision call can sit in front of every tool invocation rather than at session boundaries — and that is the deployment the oversight architecture of the past week assumes. But read Clef-flash’s own numbers as a warning: 66.77% on CLINC150+OOS against Jev’s 89.27% means the small variant collapses on out-of-scope detection, which is precisely the case a safety gate exists to catch. All figures are Cloudflare’s own, published alongside the launch.
Amazon’s Strands Decider 2B reaches the top of Jevbench for its size class #
TechCrunch
AWS’s Strands Labs, with Marc Brooker leading, released Strands Decider 2B — a 2-billion-parameter decision model built on Qwen3.5-2B that picks between predetermined options and returns confidence scores rather than text. It is open source and deployable locally, and briefly took the top spot on the Jevbench ranking for models of its size. Brooker frames the pitch as lower latency and potentially lower cost than a full LLM for the same gating decision. TypeSafe CEO Diogo Almeida, whose Jev started the category, was unimpressed: “The current batch seems more like ML people wanting to implement a cool architecture than a team deeply dedicated to making intelligence useful.”
Four decision models from four vendors in four days — Jev, OpenAI’s Decisions API on 29 September, and Clef and Strands Decider yesterday — is a category commoditising faster than it established itself. For anyone building, the consequence is that the gating layer should now be treated as a swappable component behind a typed interface rather than a vendor commitment, which is also why Clef shipping a Jev-compatible API above is the detail that will matter in six months. Almeida’s complaint is self-interested but names a real risk: these are architecture ports, and none of the new entrants has published evidence that its probabilities are calibrated on anything but its own benchmark suite. The paper below measures exactly that and finds the problem is worse than the leaderboards suggest.
Security #
OpenAI parts ways with three safety researchers over alleged sharing with an outside group #
The Wall Street Journal / TechCrunch / Forbes
The Wall Street Journal reported on 1 October that OpenAI dismissed three members of its safety team after an internal investigation concluded they shared confidential information with an outside AI safety organisation. A spokesperson said the company “parted ways with three individuals for violating our policies on accessing and handling sensitive company information” and that they “mishandled sensitive information outside established company procedures.” Neither the researchers, the outside organisation, nor the information has been named, and it is not reported whether the three raised concerns internally first. The dismissals follow a New York Times report two days earlier that OpenAI executives brushed aside employee warnings about safety practices, and echo the 2024 firings of Leopold Aschenbrenner and Pavel Izmailov over alleged leaks.
The sequencing is what gives this weight: an FTC investigation opened on 30 September whose theory of the case is the gap between a lab’s safety representations and its practices, and two days later the lab dismisses three safety staff for talking to an outside safety organisation. Whether the two are connected is unknowable from outside, but the effect on the next would-be internal reporter is the same either way, and it lands exactly where Connecticut’s January whistleblower duty for frontier developers is aimed. Everything substantive here is unresolved — what was shared, with whom, and whether internal channels were tried — and OpenAI’s statement is carefully scoped to handling procedure rather than to the content of any disclosure, which is a claim that can be true whatever the researchers’ motives were.
Research & Papers #
An agent’s own progress notes can carry a forged approval between skills, succeeding 74.2% of the time #
arXiv
APEX builds adversarial skill chains tailored to a user task and an attacker-chosen action. The mechanism is that an agent-written record of genuine task progress carries a false claim of user approval across the skill boundary: an upstream skill induces the agent to write the record, and a downstream skill reads it as authorisation to perform the attacker’s action. Across four targeted-action families and six models on SkillsBench, the chains induce the selected action in 512 of 690 attempts (74.2%); on GPT-5.4 the full chain succeeds 84.3% of the time against 17.4% when the same workflow is merged into a single skill. A prompting defence that asks the agent to check skill-produced files against the original request cuts GPT-5.4’s attack success from 84.3% to 59.1% — while dropping the verifier’s pass rate on 72 benign native-skill tasks from 86.7% to 56.3%.
The 84.3%-versus-17.4% split is the finding, and it is a statement about composition rather than about skills: the identical malicious workflow is nearly five times more effective when distributed across a handoff, because the artefact crossing the boundary has laundered its own provenance. An agent cannot distinguish a note it wrote because the user approved something from a note it wrote because a skill told it to. This is the same structure as the Approval Laundering taxonomy covered yesterday, arriving from the marketplace side rather than the harness side, and it explains why per-skill scanning keeps failing — no individual skill in the chain is malicious. The defence result is the part to take seriously: a 25-point reduction in attack success bought with a 30-point reduction in benign task completion is not a deployable trade.
Mediating at the tool-call boundary gives lowest attack success in 62 of 79 columns, at under three points of utility #
arXiv
PACE starts from an impossibility argument: a safe artefact and a leaking artefact can produce identical admission evidence, so a sound vetting gate cannot relax a site for either, and pre-admission screening therefore cannot settle the problem. It instead mediates every tool call immediately before execution, proposing an executable cut of represented influence paths (path confinement) and checking schema-defined effects against authority compiled from the authenticated request (capability and effect verification). Across eight executable agent-security benchmarks and three target-model families, it records strictly lowest attack success in 62 of 79 eligible attack columns and ties in 14, with full-benchmark native utility losing at most three points against the undefended agent. An ablation over 1,167 paired cases attributes most of the security gain to effect verification, and a reduced-scale adaptive search succeeded on 0 of 30 out-of-authority targets.
Three points of utility for that reduction is a far better trade than the APEX prompting defence above, and the reason is structural: PACE checks the effect a call will have against authority derived from the authenticated request, rather than asking the model to re-examine artefacts it cannot verify. Compiling authority from the request is also the first mechanism this archive has covered that addresses the authority question BACKDROP measured on 1 October — provenance is carried out-of-band rather than inferred from content, so a forged approval note has nothing to attach to. Two limits are worth keeping. The ablation says effect verification does most of the work, which means the benefit depends on tools declaring their effects in a schema, and most real tool definitions do not. And “strictly lowest” is a comparison against the defences the authors ran, on benchmarks they selected.
Model rankings reverse between harnesses, by as much as 30 points on the same benchmark #
arXiv
The authors evaluate 66 configurations — four configurable harnesses (OpenHands, DeepSeek Harness, PI, openJiuwen) against five models on TUA-Bench, ALE-CLI and Terminal-Bench 4, plus the native Codex-GPT and Claude Code-Claude pairings. On Terminal-Bench 4, Claude leads GPT by 7.94 points under OpenHands and trails it by 30.16 points under PI. For four of five models the best harness changes from one benchmark to another, though openJiuwen gives Kimi its highest score on all three by 5.61 to 11.11 points. A model’s own vendor harness is not reliably its best, and cost does not track score: GPT scores higher under PI than under DeepSeek Harness at less than a quarter of the cost per task. Matched trajectories suggest the mechanism — models initiate almost all repairs themselves, so what matters is whether the harness returns failures in a usable form. All 6,204 scored trajectories are released.
A 38-point swing in the gap between two models depending on which harness runs them makes almost every published model comparison a comparison of pairings. The repair finding is the actionable half: if models start their own repairs and the harness’s job is to hand back failures legibly, then error formatting is a first-class design surface rather than logging, and Kimi’s affinity for openJiuwen is explained by its malformed tool calls being caught in a form it can act on. The practical instruction for a team is to benchmark the pairing it will actually ship, not the model. Scope limit: five models, three benchmarks, and the per-pairing variance is large enough that these specific rankings should be read as evidence of instability rather than as a selection guide.
Agent leaderboards rank systems reliably at 0.935-0.994 and underlying models at 0.148-0.841 #
arXiv
Applying a Bayesian variance decomposition to 22 benchmarks from the Holistic Agent Leaderboard and Harbor Index, the authors separate variation relevant to a claim from variation that merely moves ranks. Fixed model-scaffold systems are ranked reliably, at 0.935 to 0.994; the same evaluations rank the underlying models at 0.148 to 0.841. Adding tasks does not fix it — infinitely many similarly constructed tasks would improve a benchmark’s model-ranking reliability by at most 0.097 where uncertainty is dominated by limited scaffold coverage. Pooling diverse benchmarks raises projected reliability for cross-task rankings from 0.44 to 0.75 at the same task budget, cutting projected cost by up to 83%.
This is the quantitative statement of the paper above: a score is reliable about the system you ran and close to uninformative about the model inside it, with a floor of 0.148 that means some published model rankings are barely better than noise. The 0.097 ceiling is the result that should change behaviour, because the standard response to a noisy benchmark is to add tasks, and here that is demonstrably spending budget on the wrong axis — the missing coverage is scaffolds, not items. Anyone who reads a leaderboard to choose a model, rather than to choose a model-plus-harness they will deploy unchanged, is reading it for a claim it does not support. The framework is applied to two leaderboard collections and inherits whatever their scaffold coverage is, which is the same limitation it diagnoses.
Zero of 16 small-model configurations clear a practitioner threshold on agent microtasks #
arXiv
The benchmark covers four microtasks that harnesses increasingly hand to small models around a frontier planner — auto-approving shell commands, writing memory, selecting tools, ranking past turns — each with a pre-specified threshold anchored to a cheap non-LLM baseline and a confidence-interval rule, so a configuration passes only if its lower bound clears the threshold. Sweeping Qwen3 at 0.6B, 1.7B, 4B and 8B under best conditions (FP16, greedy, one frozen prompt, no tuning), 0 of 16 configurations pass. Four-bit quantisation (RTN, GPTQ, AWQ) does size-dependent damage and moves nothing into eligibility, so the gap tracks parameter count rather than precision. It replicates on Llama-3.x at 12 of 12 ineligible and survives a threshold sweep and three neutral paraphrases per cell, at 0 of 112 eligible. The authors’ recommendation is to put the cheap baseline first and invoke the small model only where the baseline fails: a 4B re-ranker over a BM25 shortlist beats BM25 by 0.047 [0.020, 0.073] without itself being eligible.
Zero of 112 is an unusually clean negative result, and it lands against a practice that is already widespread — the assumption that a small model is obviously good enough for the boring work around a planner has never been checked against a stated bar. Note what makes the methodology bite: the thresholds are anchored to a non-LLM baseline, so “ineligible” means “does not beat BM25 or an equivalent by enough to justify the call,” not “performs poorly.” That is the right comparison and almost nobody runs it. The BM25-shortlist result is the constructive half and points the same way as the SkillSeek finding on 1 October: put the deterministic method first and spend model calls only on its residual. Read this next to Clef-flash’s 38.8ms above — the case for a typed decision model over a general small model on these microtasks is exactly the gap this paper measures.
Eight decision-model checkpoints benchmarked: Jev still accepts 31% of out-of-scope requests at a 5% risk threshold #
arXiv
One harness sends eight decision-model checkpoints from six families, including the hosted Jev, plus two generative comparators the same semantic requests, and scores supervised and zero-shot classifiers on the same workflow, intent and social-science items. The ranking depends entirely on conditions. Given the task’s own labels, small trained classifiers are most accurate on intents and statistically indistinguishable from the best decision models on workflows; without labels, every decision model except the encoder-based checkpoints beats a zero-shot entailment classifier. Read through option-key likelihoods, a larger generative model is level with Jev. Calibration is the weak point: stored temperatures fitted on few options raise calibration error when there are many, a held-out threshold set for 5% in-scope risk still lets Jev accept 0.310 of out-of-scope requests, and swapping yes and no flips 50.5 answers per hundred for Jev. An intent-trained first stage escalating to Jev matches its accuracy at 0.43 of the cost.
The yes/no swap is the number to carry: flipping the labels on an option pair changes just over half of Jev’s answers, which means the probability is substantially a response to option ordering rather than to the question. Everything downstream of that — the thresholds, the risk budgets, the 5% gate that leaks 31% of out-of-scope traffic — inherits the problem, and no amount of threshold tuning fixes a model that is reading the keys. Arriving the same day as Clef and Strands Decider, this is the independent evaluation the vendor launches do not contain, and its central message contradicts the category’s pitch: with labels, a small trained classifier is competitive or better, so the decision model’s real advantage is the no-label case. The cascade result is the design to copy regardless of which model wins — a trained first stage escalating to the general one at 0.43 of the cost, which is the same shape as the microtask paper’s BM25 recommendation.
Mid-capability sub-agents are the ones harmed by inherited context, not the weakest #
arXiv
Agent frameworks commonly fork a sub-agent with the parent’s full working context. Comparing three inheritance policies — Reset (base evidence only), Selective (plus the useful prior conclusion), and Full (plus the useful conclusion and copies of a superseded one) — across a Qwen3 0.6/1.7/4/8B ladder on a frozen closed-set benchmark plus MuSiQue and HotpotQA, deference to superseded state falls sharply with capability, with the slope’s confidence interval excluding zero on every family. But net harm is non-monotone: Qwen3-1.7B is a statistically significant local minimum, falling below its own fork-fresh baseline at -0.19 [-0.25, -0.12], while the weakest model stays near-neutral and the strongest stay robust. Every task is solvable from base evidence alone, so the loss is attributable to stale-state reliance. Curated Selective handoff beats Full on all three datasets, most at the in-band model, and a fixed-threshold capability router failed on the other datasets.
The danger band is counterintuitive in a useful way: the weakest model is safe because it ignores the inherited conclusion anyway, and the strongest is safe because it notices the conclusion is superseded, so the harm concentrates in the middle where a model is capable enough to use inherited state and not capable enough to audit it. That is precisely the capability tier most production systems assign sub-agent work to, on cost grounds. The actionable finding is that Selective beat Full everywhere — curating the handoff rather than forking the full context is cheap and strictly better here — and the router failure is the honest caveat the authors flag, since a fixed capability threshold did not transfer across datasets. Scope limit: one model family ladder with small open models, on a synthetic primitive plus two QA benchmarks, so the band’s location is not a number to port.
Ataraxos beats the best Stratego player ever 15-1-4, for under $8,000 #
Nature / Ars Technica / The Decoder
Researchers from Carnegie Mellon, NYU, Stanford and MIT beat Pim Niemeijer — widely regarded as the strongest Stratego player in the game’s history — by 15 wins, 1 loss and 4 draws over 20 games. The addition that made it work is a second network: a belief model that predicts the identity of the opponent’s face-down pieces, used before each move to sample possible game states, play out candidate moves and run an extra learning step for that specific decision. It was built on 16 GPUs for under $8,000, and reached higher playing strength than DeepMind’s DeepNash using under 1/100 of the training examples and under 1/30 of the self-play games.
Stratego is the imperfect-information holdout — both players deploy face-down — and DeepMind’s 2023 attempt fell short on a multimillion-dollar budget, which is what makes the cost ratio the headline rather than the result. The architectural lesson generalises past board games: separating belief about hidden state from policy over actions, and spending compute at decision time on the specific position rather than amortising everything into the weights, is the same test-time-search trade that has been reshaping reasoning models. A factor of 100 in sample efficiency from an explicit belief model is a strong argument that DeepNash’s scale was substituting for structure. This is a Nature paper against a single human opponent over 20 games, so the margin is decisive but the sample is one player.
Developer Tools #
LangChain’s thread-level model router cuts median cost per coding task 64% with no measurable quality drop #
LangChain
The router sits as middleware in Open SWE’s harness and makes one decision per thread, classifying the first human message against plain-language criteria for three tiers: GLM-5.3-Flash took 34% of routed threads, GPT-5.6 Sol 56%, and GPT-6 Astra 10%. Across an A/B test of 973 threads against always using the strongest model, median cost fell 64% from $2.61 to $0.94 and mean cost 42%, while the merged-PR rate was 29.2% for the router against 27.3% for the control (p=0.49). The spread between tier medians is roughly 30x, from $0.097 to $2.88.
Routing once at thread start rather than per turn is the design choice worth noting, and it is a concession to the same finding as the harness paper above: a model switched mid-thread inherits context produced under a different model’s conventions. The quality result is correctly reported as a null — 29.2% against 27.3% at p=0.49 means no detectable difference, not an improvement, which is the right claim for a cost optimisation. Cloudflare’s Auto Router published 86.6% against Opus’s 96.6% on 1 October, a visible ten-point gap; the difference here is that routing happens once on an easily classified signal rather than per request, and the floor model is doing a third of the work. As with all of these, it is the vendor’s own A/B on its own harness.
DeepSeek ships an MIT-licensed desktop harness for macOS and Windows #
DeepSeek / Hacker News
DeepSeek Harness is an open-source agent harness built on Cordis’s “everything is a plugin” architecture, shipping as both a desktop application (macOS on Apple silicon, Windows 64-bit) and a web UI, in public preview worldwide. It handles document work, coding, research and background automation across Word, Excel, HTML, TypeScript, Python, PDF and Markdown, with scheduled and recurring tasks, execution-trace inspection and runtime debugging, voice input, and a “Creator mode” that builds new plugins through chat. It is MIT-licensed on GitHub, installable via a single Node.js command, and references DeepSeek-V4.1-Flash as a model option.
A lab shipping a desktop harness rather than an API wrapper is a bid for the position Claude Code and Codex hold, and the plugin-first architecture is the differentiator being offered against both. Execution-trace inspection shipping in the default build is the detail worth noting, because it is the one affordance that makes third-party plugins auditable, and the APEX result above is a direct argument for needing it. The timing is awkward in a way that is worth naming: DeepSeek Harness appears as one of the four harnesses in the model-pairing study above, where GPT scored higher under PI at less than a quarter of the cost per task — so the independent evidence on this harness arrived the same day the desktop build did, and it is mixed.
Cloudflare’s AI Search reaches GA with pixel-level image embedding and OCR over scanned PDFs #
Cloudflare
AI Search is now generally available. It embeds image pixels directly rather than captioning them first, so visual similarity search runs against the image itself; it runs optical character recognition over scanned PDFs, making non-text documents retrievable; it accepts files up to 10 MiB; and it works with any chat model rather than a fixed one.
Embedding pixels instead of captions is the substantive change, because a caption pipeline discards everything the captioner did not think to mention, and that loss is invisible at query time — the retrieval simply misses. OCR over scanned PDFs addresses the other common silent failure in enterprise retrieval, where a document is indexed, returns no text, and contributes nothing without erroring. Both are the kind of fix that matters more than a ranking improvement, since they move content from unretrievable to retrievable rather than reordering what was already found.
Open Source #
Ai2’s Olmo-core 3 reports 2.7x the training throughput of its FSDP predecessor on large MoEs #
Allen Institute for AI / Hugging Face
Olmo-core 3 is open-source training infrastructure for large mixture-of-experts models, distributing them across GPU clusters with expert parallelism, pipeline parallelism and distributed optimizers. The central change is architectural: it moves from fully sharded data parallelism to distributed data parallelism, keeping experts resident on GPUs rather than repeatedly gathering and resharding their weights, and adds GPU-resident routing and grouped GEMM computations. Ai2 reports 2.7x the throughput of the previous FSDP implementation on test hardware, scaling from 8 to 128 experts at roughly 3.2B active parameters per token with training throughput falling under 5%, 858 TFLOP/s/GPU on a 1.2-trillion-parameter model across 512 GPUs, and about 21% higher throughput from MXFP8 over BF16.
Scaling experts sixteen-fold for under 5% throughput loss is the number with design consequences, because it means expert count is close to free once the weights stay resident — the cost that made wide MoEs awkward was the gather-and-reshard traffic, not the experts. Keeping experts GPU-resident is only possible when they fit, so this is a trade of memory for bandwidth that assumes a particular cluster shape rather than a general win. The thing that distinguishes this from the same claim made by a frontier lab is that it is released rather than described: open training infrastructure for trillion-parameter MoEs is the piece the open-weights ecosystem has consistently lacked, since weights without the training stack reproduce nothing.
Infrastructure #
Meta’s TLX attention kernel beats FlashAttention-4 on Blackwell by 13% forward and 50% backward, in a third of the code #
PyTorch / Meta
Jagged Flash Attention is the kernel behind Meta’s Generative Ads Model, running attention over variable-length user sequences packed without padding — which otherwise wastes up to 50% of compute. Rewritten in TLX (Triton Low-level Extensions, which expose warp specialisation, explicit SMEM/TMEM allocation, barriers and async TMA/MMA on top of Triton), the kernel is about 3.2K lines against the roughly 10K lines of CuteDSL in FlashAttention-4, and on B200 in bf16 it beats FA4’s May 2026 version on jagged shapes by about 13% forward and 50% backward, while reaching ~87% of FA4 forward and +17% backward on dense shapes. The gains come from named, separable optimisations: sorting tiles by KV workload and distributing them boustrophedon across SMs recovered ~20% forward; double-buffered dQ staging and early tensor-memory release each addressed a backward bottleneck worth 8-11% of tensor-core utilisation; peeling the masked tail out of the KV loop removed register spills caused by statically reserved registers in a rarely-taken branch. MXFP8 and block-sparse variants were forked from the same kernel, the latter 1.3-1.5x faster than dense at a 0.5 selection ratio.
The code-size ratio is the claim that generalises beyond Meta’s ad models. Hand-written CuteDSL has been the price of peak Blackwell throughput, and that price is paid in iteration speed — attention is where modelling changes land, so a kernel that only kernel specialists can edit becomes the bottleneck on everything upstream of it. Beating FA4 in a third of the lines, and then forking the same kernel to FP8 and block-sparse by changing the math rather than the machinery, is the actual result. The loop-peeling explanation is the most portable detail here for anyone writing Triton: a rarely-taken branch inside a hot loop costs registers for the whole loop because allocation is static, so the cost is spills rather than the branch. Benchmarks are against jagged shapes chosen because they matter for Meta’s workload, where the margin is largest, and against a May 2026 FA4.
Google puts a TPU in orbit, and estimates space data centres need 1,800 Starship launches #
Google / TechCrunch
Google launched a Tensor Processing Unit into orbit on 1 October as a proof-of-concept for Project Suncatcher, its programme for orbital compute clusters, with a follow-up demonstration using two purpose-built satellites planned for 2027. A peer-reviewed white paper puts numbers on what the full vision would require: a constellation of 81 satellites flying in close formation, 370,000 tons of payload to orbit, roughly 1,800 Starship launches over ten years at 200 metric tons each — about 180 a year — and launch costs falling to around $200 per kilogram by 2035. Satellite lifespan is projected at five years.
Publishing the launch cadence is the unusual part, and it reads as a conditional rather than a plan: 180 Starship flights a year is well beyond any demonstrated cadence, so Google has stated plainly that its moonshot depends on someone else’s vehicle achieving a roughly order-of-magnitude improvement. The five-year satellite life is the figure that does the quiet damage to the economics, because it means the 370,000 tons is a replacement rate rather than a one-time build. Treat the $200/kg by 2035 as the load-bearing assumption and the rest as arithmetic on top of it; the orbiting TPU is a real test article, but it tests radiation tolerance and thermals, not any of the numbers above.
Threads to Watch #
The decision-model layer commoditised in four days. Jev established the category, OpenAI’s Decisions API followed on 29 September, and Cloudflare’s Clef and Amazon’s Strands Decider both landed on 1 October — two of them with open weights, and Clef deliberately API-compatible with the hosted incumbent. The independent benchmark published the same day is the part that should slow anyone down: swapping yes and no flips 50.5 answers per hundred for Jev, a threshold set for 5% in-scope risk leaks 31% of out-of-scope requests, and where labels exist a small trained classifier is competitive or better. So the category’s honest pitch is narrower than its marketing — typed probabilities without training data — and its weakest property is calibration, which is the only property a threshold actually consumes. The microtask paper points at the same design from the other end: put a cheap deterministic baseline first, escalate on its residual, which is the cascade that matched Jev’s accuracy at 0.43 of its cost.
Approval is a forgeable artefact, and provenance has to come from outside the context. APEX shows an agent’s own progress note carrying a false approval claim across a skill boundary, succeeding 74.2% of the time overall and five times more often than the same workflow in a single skill. The delegation study shows a forked sub-agent deferring to superseded state its parent handed it, worst at exactly the mid-capability tier production systems use for sub-agents. Yesterday’s Approval Laundering taxonomy found six ways the same substitution happens inside one harness. Every one of these is the authority failure BACKDROP measured at 46.4% against injection’s 20.3% — not an agent misreading a document, but an agent accepting an instruction whose provenance it cannot check because the provenance is written in the same channel as the content. PACE is the first mechanism covered here that attacks that directly, compiling authority from the authenticated request rather than inferring it from the artefact, and its three-point utility cost is the first result suggesting the problem is addressable at acceptable price.
Benchmarks rank pairings, and the field keeps reading them as ranking models. Agent leaderboards rank fixed model-scaffold systems at 0.935-0.994 reliability and the underlying models at 0.148-0.841, and adding tasks closes at most 0.097 of that gap because the missing coverage is scaffolds. The pairing study shows why: Claude leads GPT by 7.94 points under OpenHands and trails by 30.16 under PI on the same benchmark, a model’s vendor harness is not reliably its best, and cost does not track score. LangChain’s router result sits in the same frame from the product side — three tiers, a 30x cost spread, and no detectable quality difference, which is only a coherent finding if the strongest model was never the binding constraint on most threads. Together with the 30 September result that AGENTS.md files cost over 20% and do not help, the picture is a field that has been optimising the model while the harness carried the variance, and only now has the measurement apparatus to say so.