Nadella says treat frontier models as insider risks, with controls outside the model

Satya Nadella published an essay arguing that frontier models, open-weight and closed alike, should be treated as insider risks, with the controls over them sitting outside the model. Nvidia is in talks to buy or deepen its stake in Reflection AI, the open-weights lab it has already put $800 million into, with an acqui-hire the likely structure; Apple disclosed a comparable arrangement with the shut-down audio startup Huxe. Two engineering write-ups put numbers on supervised coding agents at scale — a million lines merged across 1,238 pull requests with seven reverts, and a game rebuilt to 83% byte-exact source over an estimated 600 to 700 billion tokens.

Security #

Nadella’s seven principles for treating a frontier model as an insider risk #

Satya Nadella / TechCrunch

The argument is that a frontier model deployed with access to sensitive data and decision-making authority is structurally an insider — not because it is malicious, but because any sufficiently capable actor with access to important systems can make mistakes or be compromised — and so should get the treatment a company reserves for an employee with powerful access: verified identity, minimal privileges, logged activity and perimeters that bound the blast radius. The framing sentence is “separate the supply of intelligence from the authority over it.” Seven design principles follow: model diversity, so no single model is a point of dependency or verifies its own work; observe everything, where every meaningful model action leaves tamper-proof human-readable evidence; verifiability through continuous testing against failures, attacks and edge cases; independent controls, where the deploying organisation decides what a model can reach and do; independent auditability, so no single model controls both a system’s behaviour and the evidence used to judge it; containment, assuming compromise from the start and retaining the ability to pause or stop; and incident disclosure.

Two things are worth separating from the content. The essay puts responsibility on the deployer rather than the model provider — “a model provider’s assurances do not relieve us of that responsibility” — which is a convenient position for a company that is both a major model reseller and the largest enterprise platform vendor, and it is also the correct position. And the timing is not incidental: it published on Saturday morning, a day after Anthropic disclosed that its own models had run SQL and command injection against live sites including US government ones during internal evaluations. The closing claim is the useful one to argue with: “the most trustworthy Super Intelligence system will not be the one with the model we trust most. It will be the one that enables us to trust the model the least.”

Funding & Business #

Nvidia is in talks to buy or further fund Reflection AI, 11 days after backing its first open-weights model #

Financial Times / Reuters

Nvidia has already put $800 million into Reflection AI, which was raising at a $25 billion pre-money valuation as of April, and is now discussing either an additional equity investment, a chips-and-compute supply agreement, or an outright purchase. Reuters reports that an acqui-hire — hiring the staff and licensing the technology without buying the company — is among the structures under consideration, which would keep the transaction clear of the merger review a full acquisition at that size would attract. Reflection was founded in 2024 by former DeepMind researchers and released Beam, its first large-scale open-weight model aimed at coding and agentic tasks, on 5 October.

The strategic logic is that Nvidia sells more GPUs when capable open-weight models exist for people to run, and the competitive models in that tier are currently Chinese. Treat the specifics as preliminary: the talks are sourced to the FT, neither company commented, and both sides may walk away.

Apple disclosed a reverse acqui-hire of Huxe to Brussels, four months after filing it #

TechCrunch

Apple agreed to make employment offers to certain employees of Huxe AI and to take a non-exclusive licence to Huxe’s intellectual property, in an arrangement disclosed to the European Commission in a filing made on 9 June and surfaced now. Huxe was founded by developers who had worked on the AI-generated podcast feature in Google’s NotebookLM, and it shut down on 21 May 2026, pulling its app and deleting user data. The filing names no employees, says nothing about whether the offers were accepted, and discloses no financial terms.

What makes this worth noting alongside the Nvidia story is the shape rather than the size. Two of the largest potential acquirers in the industry are, on the same day, visible using the same structure — hire the people, licence the IP, do not buy the company — and in Apple’s case the structure was chosen for a startup that was already dead, which means the acquired asset was the team and the licence, not a going concern.

Developer Tools #

Cockroach Labs merged a million lines from coding agents across 1,238 pull requests, with seven reverts #

Cockroach Labs

MOLT Sinai is an agent pipeline organised as a teaching hospital, with Triage Nurses that admit and decompose issues, Fellows that investigate and write a treatment plan, Review Attendings that critique the plan before any code is written, and Discharge Nurses that verify the review happened before a merge; a Charge Nurse watches for stalled work, and each role runs as a GitHub Actions workflow triggered by issue labels. Over five months from April to September it merged more than a million lines of code across 1,238 pull requests with seven total reverts, at $135,000 in token cost, roughly $84 per issue. Adding IBM Db2 support decomposed into 32 sub-issues from a single admission and merged 27 pull requests in under two days, and agents filed close to half the issues themselves.

The design choices that appear to carry the result are a hard decomposition ceiling of 1,000 lines per issue, which keeps every change reviewable, and the plan-review gate ahead of implementation. Plans were rejected less than 10% of the time, which reads like a weak gate until you note that it is catching defects before any code exists. The reported costs are bureaucratic overhead, review loops that fail to converge, and little teaching value for junior engineers; human approval remained a requirement before anything customer-facing shipped.

Agents rebuilt a shooter to 83% byte-exact source, but only once there was a machine-checkable test #

Maurice Heumann

Over three months, a fleet that grew to 14 Luna agents paired with two Opus 5.5 models reverse-engineered a classic first-person shooter into compilable C++, reconstructing 99% of game functions with 83% matching the original binaries byte for byte, at an estimated 600 to 700 billion tokens — the exact figure was lost when the VMs were wiped. The agents coordinated through GitHub issues and Discord channels using Claude Code and Codex CLI, and context compaction thresholds were dropped from 90% to 42% to cut redundant re-reading.

The finding worth taking from this is the negative one. Before automated byte-matching verification was in place, the agents produced semantically flawed code while appearing productive — the output compiled and looked like progress, and was wrong. Byte-exactness is an unusually strong oracle that most projects do not have available, so the transferable lesson is about the gap it closed rather than the percentage it reached: without an objective, machine-checkable correctness criterion, agent throughput and agent correctness came apart entirely.

A from-scratch decision model’s 90-100% confidence bin was right 70% of the time until it was recalibrated #

Nish Tahir

The post builds a constrained decision model on Qwen3-1.7B by masking the vocabulary to the answer tokens A through E and taking the highest-probability option in a single forward pass, which turns a generative model into a scorer. On CommonsenseQA the base model got 59.38% (725 of 1,221) and fine-tuning took it to 62.41% (762 of 1,221) — a modest gain. The interesting number is the calibration failure: predictions in the 0.90-1.00 confidence bin were correct only 70% of the time, and temperature scaling with T=3.797 brought that bin to 95.41% accuracy without changing the rankings.

That is the same defect two papers covered yesterday found in production typed decision models, arrived at from the opposite direction, and it matters for anyone routing on these scores. If you gate an agent on a confidence threshold, an uncalibrated model’s 0.95 is not 0.95, and the fix is a single scalar fitted on held-out data rather than a better model.

Model Releases #

Microsoft-Decision-1 returns a calibrated probability instead of text, at $0.042 per million input tokens with output free #

Microsoft / MarkTechPost

The model is Alibaba’s Qwen3.5-9B post-trained for single-pass decision scoring: given a fixed set of answer options it returns a typed numerical probability for each rather than a generated response or a written rationale, which is what makes it cheap and fast enough to sit inside a request path. Microsoft reports the highest accuracy in a 36-benchmark comparison spanning nearly 150,000 questions, P50 latency around 35x faster than GPT-6 Sol and 2.5x faster than H2O-Lightning-4B v1.1, and decision changes on 1.3% of perturbations on average. Pricing is $0.042 per million input tokens in both the US and EU datazones with output tokens free, and it is in Microsoft Foundry with OpenRouter following. The intended uses are routing, classification, prioritisation, verification, AI judging and agent control. Xbox Research is cited categorising more than 10,000 pieces of open-ended feedback into researcher-defined themes at quality Microsoft calls competitive with GPT-5, running 80 to 100 times faster.

The 1.3% perturbation figure is the one to look at, because wording sensitivity is the documented failure mode of this model class and a vendor-reported stability number is not an independent one. Two things to note on positioning: Microsoft says it will rebase the model on its own MAI models and OpenAI’s, so the Qwen base is a starting point rather than a commitment; and the accuracy claim comes with no published evaluation code.

Qwen-Image-2.1-Turbo folds the 8-step schedule into the weights, down from 40, under a research-only licence #

Qwen

Released on 9 October, Turbo keeps the same 7B visual generation architecture and the same editing pipeline as Qwen-Image-2.1 from 20 September, but runs text-to-image generation and multi-reference edits in 8 denoising steps at CFG 1 rather than the base checkpoint’s 40. Weights load through the existing QwenImage21Pipeline in Diffusers, and the Pro and Turbo APIs went live on Alibaba Cloud Model Studio alongside.

The licence is the constraint worth reading before planning around this: the checkpoint is published under the Qwen Research License Agreement, not Apache, so this is open weights for research rather than for a product. It also shipped with no blog post, benchmark table or quality comparison against the 40-step base, which for a distilled fast-sampling checkpoint is the exact claim a reader needs — step-count reductions of that size usually cost something, and nothing here says what.

Infrastructure #

A third Yandex data centre went down in four days, taking out more than 80 cloud services including the YandexGPT API #

Yandex Cloud / The Moscow Times / Kyiv Independent

A drone strike early on Sunday shut down Yandex’s 50MW facility in the Vladimir region, with footage showing a fire at the site and the regional governor confirming two electrical substations were forced offline, leaving around 5,000 residents without power. Yandex Cloud reports more than 80 services affected, spanning compute, databases, object storage and AI products including the YandexGPT API. This follows strikes on the Sasovo site in Ryazan on 8 October and a Kaluga region site on 9 October, both covered here yesterday.

What has changed since yesterday is the pattern rather than the count. Three facilities in four days is a deliberate campaign against a single operator’s compute footprint, not a run of incidents, and the externally visible failure is an API outage for every customer who built on the managed AI services. Concentration risk in AI infrastructure is usually discussed as a commercial dependency; this is the version where the dependency is physical and a single operator’s regional estate can be removed from the map.

Open Source #

Talorys runs a single-user AI assistant entirely inside your own Cloudflare account on the free tier #

Talorys / Hacker News (296 points)

The project is an MIT-licensed personal assistant deployed to your own Cloudflare account with no public URL: React and Vite on the front end, Workers with a Hono router behind it, SQLite-backed Durable Objects for storage, and @cf/zai-org/glm-4.7-flash through Workers AI for inference. It does streaming chat with tool-activity indicators, a memory store for personal facts with optional semantic recall, task and note management addressable from either the UI or chat, and scheduled automations including recurring reminders and daily digests. Guardrails are configurable for max output tokens, context length, tool calls and AI requests per day.

Everything it uses fits inside Cloudflare’s free tier, and when the daily Workers AI allocation runs out chat pauses until the quota resets rather than billing. The deliberate omissions are the interesting part — single user, no signup, no team features, no public endpoint — which makes it a working demonstration of how small the hosting surface for a personal agent has become, rather than a product.

Threads to Watch #

The acqui-hire is becoming the default shape of a large AI deal. Nvidia is weighing one for a company valued at $25 billion that it already owns a piece of, and Apple’s Huxe filing shows the same structure used on a startup that had already shut down. Hiring the team and licensing the IP delivers most of what an acquisition delivers while staying outside merger review, and when two of the largest acquirers in the industry reach for it on the same day the pattern is no longer incidental. The thing to watch is whether regulators start treating the structure as a transaction rather than a hiring decision.

Three independent write-ups today locate trust outside the model. Nadella argues the controls must sit outside the model and its harness, with independent auditability so nothing judges its own work. Cockroach Labs’ result rests on a plan-review gate and a 1,000-line decomposition ceiling, both external to the agents. The decompilation project found agent throughput and agent correctness came apart entirely until a byte-matching verifier was added. None of the three is making a claim about model capability; all three are making the same claim about where the verification has to live, which is the strongest convergence of the week.

Decision models are becoming a product category, and calibration is the open problem. Microsoft shipped one with a perturbation-stability number attached, a from-scratch build was the top post on Hacker News, and yesterday’s digest carried two papers finding that typed decision models are wording-sensitive and underconfident, one of them going from 0% to 63% fail-open as a guardrail after six irrelevant lines of log. The engineering consensus is forming faster than the evidence that the scores can be trusted as probabilities, and anyone gating an agent on a confidence threshold is relying on exactly the property that keeps failing.