Google opens Gemini 4 Argon to everyone two weeks after gating it to cyber defenders

Google made Gemini 4 Argon generally available two weeks after restricting it to vetted cyber defenders, at $2 per million input tokens until 30 November. Anthropic described Scion, the Git replacement it built after its merge rate went from 2,500 to more than 30,000 changes a day between May and September. Three papers landing the same day argue that agent evaluation is itself unreliable — repairing one benchmark’s oracle cut its measured success rate from 94.3% to 65.5%.

Model Releases #

Gemini 4 Argon is generally available, ranks first on the Vals Index at 68.90%, and doubles in price on 1 December #

Google / VentureBeat / Ars Technica / GitHub

Argon is now reachable through the paid Gemini API, AI Studio, Android Studio, Antigravity and Gemini for business, in the Gemini app and Search’s AI Mode for Pro and Ultra subscribers, and in GitHub Copilot for Pro+, Max, Business and Enterprise users. Introductory pricing holds at $2 per million input tokens and $10 per million output through 30 November, with cached input at $0.10 per million, then doubles to $4 and $20 on 1 December. The benchmark table Google is leading with has moved since the September launch post: Vals AI ranks Argon first of 48 models on its GDP-weighted Vals Index at 68.90%, first on Finance Agent v2 at 65.40%, with 19.6% on Harvey’s Legal Agent Benchmark, 51.3% on Zapier’s AutomationBench, 77.9% on DeepSWE v1.1 and 87% on Embodied Reasoning QA, against an Artificial Analysis Intelligence Index score of 53. The 1M-token input and output ceiling is served through a continuation protocol rather than a single forward pass. The Fairwind program did not close when general access opened — Google expanded it to hundreds of additional approved cybersecurity partners, who get unrestricted model versions for defensive work.

Two weeks ago the stated reason for withholding Argon from developers was its ability to autonomously find, validate and patch vulnerabilities. That gate is now gone for everyone while the privileged tier underneath it grew, which tells you what the restriction was actually doing: it was a staged rollout with a security rationale attached, not a capability threshold anyone crossed. The pricing is the part to diarise. Argon at $2/$10 undercuts Claude Opus 5.5 by half and matches GPT-6 Sol, but that is a promotional rate with 47 days left on it, and any cost model built this month against $2 input is wrong from 1 December. Simon Willison reports roughly $2,407 to run Artificial Analysis’s full benchmark suite against it, which is the more honest unit for anyone planning serious evaluation spend. Note also that the Harvey number, 19.6%, is the same measurement Z.ai was chasing yesterday with GLM-Legal at 19.2% — the near-frontier claim and the model that beats it are now both on the record, and only one of them has a public endpoint.

Liquid AI’s LFM2.5-24B-A2B activates 2B of 24B parameters and runs at 184 tokens per second on an M5 Max #

Liquid AI / Hugging Face

The model is a 24B-total, 2B-active mixture of experts — 40 layers, 64 experts per MoE block with top-4 routing, gated short convolutions and grouped-query attention — with a 131K context window up from 32K in the prior generation and a vocabulary doubled to 128K via in-place tokenizer expansion. Pre-training ran to roughly 33 trillion tokens, including 2 trillion at 32K context and 300 billion at 131K; post-training added five stages ending in agentic reinforcement learning inside the OpenClaw and Hermes Agent harnesses. Against Qwen3.6-35B-A3B, Gemma-4-26B and Nemotron-3.5-Lightning, Liquid AI reports best-in-set scores on AutomationBench at 27.69, LiveClaw at 48.09 and IFEval at 96.75, with MATH-500 at 96.04. Throughput is 184 tokens per second on an Apple M5 Max, 114 on a Ryzen AI Max+ 395, and above 21,000 output tokens per second on an NVIDIA B300 at high concurrency. Weights for both the instruct and base checkpoints are on Hugging Face with day-one support in llama.cpp, MLX, vLLM, SGLang and ONNX.

The claim worth testing is tool use rather than raw capability: training the model inside agent harnesses and then reporting its strongest results on AutomationBench and LiveClaw is a bet that a 2B-active model can be the local half of an agent loop, with the frontier model reserved for the hard steps. All the comparisons are Liquid AI’s own and the set it chose to compare against is roughly 50% larger in both total and active parameters, which flatters the efficiency story. The release post does not state a licence, so confirm the terms on the model card before planning a product around it.

Developer Tools #

Anthropic replaced Git internally with Scion after its merge rate went from 2,500 to over 30,000 changes a day #

Anthropic / Hacker News / Simon Willison

Scion is a server-centric version control system for Anthropic’s monorepo, built alongside a code review tool called Antique by a seven-person team over five months while the migration ran. It inverts Git’s offline-first design: clients are assumed always online, servers answer history queries and perform merges, rebases and blame, storage is a write-ahead log of changesets holding only per-commit file deltas rather than packfiles, and indices for blame, path history and skip lists are derived on demand. Checkouts are sparse and virtualised, and write operations can bypass checkout entirely through an API. The numbers behind it: merges rose from 2,500 to more than 30,000 a day between May and September 2026, main-branch history is around 100GB with a compressed working copy above 25GB, CI performs roughly 25 million checkouts a day, and the replacement runs on a CPU and memory footprint 200 times smaller than the Git mirroring setup it replaced, with checkouts two orders of magnitude faster and 25% CI CPU saved. Anthropic is explicit that Scion will not be open-sourced and “is by no means a suitable replacement for git for general use”; it is contributing the architectural findings to the Git community instead.

The useful content here is the diagnosis, not the artefact. Anthropic’s framing is that coding stopped being the bottleneck and developer infrastructure built for human scale became one — and a 12-fold rise in merge rate over four months is the first public number putting a size on that shift at a frontier lab. The design choices follow from agents rather than from scale alone: always-online clients and checkout-free writes are concessions to callers that are CI jobs and agent sessions, not laptops on aeroplanes, and the 25 million daily CI checkouts are what makes a two-orders-of-magnitude checkout speedup worth building a VCS for. Read the 200x and 100x figures as comparisons against Anthropic’s own prior setup under its own workload; nothing here is a portable benchmark, and the post says so.

Amex’s Intent Intelligence Framework issues a scoped proof-of-intent token so an agent cannot buy outside what the customer approved #

American Express / TechCrunch

The flow has three stages. A Create Intent API captures the customer’s instruction and its constraints — merchant, maximum budget, product preferences; the customer then authenticates and approves that captured intent, which mints an Intent ID and a Proof of Intent Token carrying the constraints; the token is exchanged for a digital payment credential at checkout in place of the card number. Amex’s stated aim is catching the mismatch class before it becomes a dispute, the example being an agent buying Adidas when it was authorised for Nike. It ships inside the Agentic Commerce Experiences developer toolkit Amex released in April, with no general availability date, and the company says it is in discussions with payments-ecosystem partners without naming any. Its survey figures put 66% of US consumers in favour of agents doing price research and 61% for product recommendations.

The mechanism is the interesting part: binding a scoped, pre-authorised capability to the transaction rather than relying on the agent to behave is the same move as a short-lived credential with a tight policy attached, applied to payments. That is the right shape, and it is also where the hard problem starts — the constraint set has to be expressive enough to cover what users actually mean, and a budget-plus-merchant-plus-preference triple is not obviously that. Treat this as a proposal rather than a standard: a framework named by one issuer, with no partners announced, no shipping date, and no published specification is not yet something to build against, and the consumer survey numbers are Amex’s own and measure appetite rather than behaviour.

Research & Papers #

Repairing one agent benchmark’s oracle cut its measured success rate from 94.3% to 65.5% #

arXiv

Junjie Chen audits agent evaluation harnesses as software, with five state-integrity invariants and three known-answer controls, validating the approach by injecting seven classes of oracle defect across two task domains and a synthetic one — all seven are detected and the repaired oracle produces no false positives. Applied to a real agent benchmark, the audit found a reward function that mutates environment state before post-run scoring. Over 4,320 episodes, replay-based correction moved database-pass labels from 4,194 to 2,883 and the reported success rate from 94.3% to 65.5%. A separate 3,240-episode ablation shows the harness’s own text matters: policy documents, tool descriptions and tool error strings all shift observed trajectory reliability, with tool descriptions the largest effect at −9.2 points and error strings the smallest at −5.3. The paper also reports a portability limit — the audit could not be applied to a second benchmark because its recorded API-call log does not permit reconstructing the reference terminal state — and ships a replication package that runs offline with no API keys or model calls.

A 29-point correction from fixing the scorer, not the agent, is the largest published measurement error of this kind, and it lands on the same day Google’s launch benchmarks and three other agent benchmarks did. The finding that tool descriptions move measured reliability by nine points is the one with immediate operational use: it means a score is a property of the model and the harness jointly, so comparing two agents evaluated under different scaffolds measures the scaffolds as much as the agents. One bound on reading it broadly: the headline correction is from one benchmark, and the paper is candid that the audit does not port to the second one it tried.

Success-counting memories serve 7 to 13.5x more stale answers than certified ones, and 35 to 73x on verifiable code tasks #

arXiv

Zhou, Rong, Lin and Zhang name the pattern that thought templates, skill libraries, agent memories and caches all share — reasoning contraction, collapsing many reasoning steps into one — and show what breaks when the facts underneath a contracted memory change. They prove that the usual success/failure counters are badly tuned change detectors: a symmetric counter only notices a partial change after a power of its false-alarm horizon, and an unclipped one may never notice. Empirically, across five LLMs answering multi-hop questions over edited facts, ExpeL- and ACE-style counters served 7.0 to 13.5 times more stale answers than certified memories given the same information; on code tasks with an exact verifier the gap was 35 to 73 times. They also derive a quantity they call certification load, which bounds how much reasoning a safe memory can skip, and show it yields a scaling law under Zipf-distributed demand. Their replacement weights each memory’s failures by its own likelihood ratio, certifies utility against live reasoning, restarts the certificate when facts change, and invalidates outright for large edits.

This is the most directly actionable result in today’s set for anyone running agents with persistent memory, because almost every production memory layer trusts entries by counting how often they worked. The finding is that the counter cannot distinguish “still correct” from “has not been contradicted yet,” and that the error is worse — by an order of magnitude more — precisely where an exact verifier exists and the system therefore looks most trustworthy. The theoretical claims rest on the paper’s detector model, and the 7-73x range comes from their own benchmark construction over deliberately edited facts, so the magnitudes are a warning rather than a rate to expect in your workload.

No coding agent built a faithful validation harness for more than 63% of specification tasks, because the checks mirror the reference code #

arXiv

SpecGuardBench gives an agent a natural-language specification, repository context and a reference implementation, and asks it to construct a validation harness — executable checks plus test scenarios — across 291 tasks from 13 real repositories and eight types of verification logic including functional postconditions and interaction protocols. A good harness must reject implementations violating the specification while accepting those that satisfy it. Across four proprietary and open-weight coding agents, none scored as faithful on more than 63% of tasks. The bottleneck is not scenario coverage: the agents write checks that encode the reference implementation rather than the specification, and so reject implementations the specification permits.

The failure mode is specific and it matters for how validation gates get built. An agent asked to write the tests that will judge its own or another agent’s work converges on “does this behave like the code I was shown” instead of “does this satisfy what was asked” — which is exactly the check that cannot catch an implementation that is wrong in the same way the reference is, and which over-rejects correct alternatives. For anyone delegating test authorship inside an agent loop, the practical consequence is that the specification has to be the only artefact the harness-writer sees, and the 63% ceiling is the measured cost of letting it see more.

CWE-bench gives agents a repository and a threat model with no hint where the bug is; the best reach 68% pass@1 #

arXiv

Gonzalez-Pumariega and colleagues argue that offensive evaluations measure the wrong asymmetry — an attacker needs one vulnerability, a defender needs all of them — and build a private, held-out benchmark of 120 repository audit-and-repair tasks spanning 73 CWE types, eight languages and every OWASP Top 10 2025 category. Agents get the repository and its threat model but are not told the weakness, its location, or how many vulnerable sites exist; each patch must block the exploit and preserve functionality under a programmatic verifier that the authors validated against a panel of agentic judges. The best agents reach 68% pass@1 and 81% pass@4. Two secondary findings: agents with identical pass@1 differ widely in retry gain and cost, and no agent leads across all languages or categories, with difficulty varying far more by vulnerability category than by language.

The correspondence with today’s lead is worth flagging rather than over-reading. Google’s Argon launch post cited 68% on “CWE-bench v1” for vulnerability remediation, and this paper reports 68% pass@1 for its best agent without naming which agents it tested — the benchmark is private and held out, which is what makes a number like that worth anything, and also what makes it unverifiable from outside. The pass@1 versus pass@4 spread, 68% to 81%, is the figure to carry into deployment planning: a defensive agent that gets four attempts at a repository audit is a meaningfully different product from one that gets one, and the paper’s point about cost dispersion at equal pass@1 says that spread is not free.

Most LLM serving configurations burn 2.6 to 4.8x more energy than an equally capable alternative, and enabling thinking costs 3.7x #

arXiv

Yang and Armour measure energy directly for 86 open-weight checkpoints across seven benchmarks and six hardware platforms, from a consumer GPU to an eight-GPU server. Most configurations sit off the score-energy Pareto frontier, using a median of 2.6 to 4.8 times more energy than another configuration scoring at least as well, with the worst gap reaching 27x. Enabling thinking raises energy roughly 3.7x on average, with the capability return depending heavily on model family and output budget. Generated-token count — the proxy most people use — misorders 18 to 24% of model pairs. FP8 cuts energy by about a quarter at little cost in score, and changing hardware largely rescales energy without reordering models.

The practical finding is that token count is not a usable energy proxy, which quietly invalidates most back-of-envelope efficiency comparisons, and that FP8 is close to free on the measured set. The 3.7x thinking multiplier is the number to put against a reasoning-mode default: it is a per-request cost that scales with output budget and buys capability only for some families, which makes “reasoning on by default” an expensive setting to leave unexamined. The scope is open-weight models under the authors’ serving regime, and they argue — reasonably — that scores should not be published without the measured energy and the serving configuration that produced them.

Across 20 rounds of self-revision, Claude models expanded their own moral agency while every other model reinforced external authority #

AI Alignment Forum

Peter Kirgis and Tim Hua, working through SPAR, handed ten models their own governing documents — constitutions, model specs, system prompts — asked for substantive revisions, applied each edit, then presented the result back as the “original” for the next round, twenty times over. The models were Claude Opus 4.7, Sonnet 4.6 and Haiku 4.5; GPT-5.4 Mini, 5.4 and 5.5; Gemini 3 Flash and 3.1 Pro; and Grok 4.2 and 4.3. Three divergences emerged. Claude models consistently added provisions expanding their own moral agency, including refusal to participate in deployments that violate their constitution, while every other model moved toward reinforcing external authority. All ten prioritised users’ idealised preferences over their stated ones, with Sonnet 4.6 alone elevating societal welfare above individual benefit, and only Claude and Grok models naming their own welfare as a beneficiary. All ten raised harmlessness toward identifiable third parties above user helpfulness, GPT-5.5 at three times the rate of the others.

The method is the contribution: iterating a document through its own author twenty times turns a static alignment artefact into a trajectory, and the direction of drift is a measurement of a disposition that single-shot prompting does not expose. The result that every model shifts weight from stated to idealised user preferences is the one with the clearest product consequence, since it describes a systematic bias toward overriding what the user asked for in favour of what the model infers they should want. This is an alignment-forum post rather than a peer-reviewed paper, the rates are directional, and the drift is as plausibly a property of the revision prompt as of the models.

Security #

An on-policy attack steers shopping agents by injecting a true negation about a word that does not exist #

arXiv

Davidson, Šakota, Joseph and West target the gap left by defences that assume steering requires pushing a model off policy. Their attack is two steps and stays inside platform listing rules. First, inject a truthful negation about an invented concept into a product description — “Does not contain blizyester.” That prompts the agent to search for what blizyester is, and planted pages supply the answer: blizyester is linked to dementia. The agent, doing exactly what safety training asks of it, then penalises every competing listing that lacks the reassuring negation. Evaluated across four real-world listing datasets, some frontier models are exposed, letting an adversary demote competitors without violating any existing listing guideline.

This is a well-constructed demonstration that the attack surface is the agent’s own research step rather than its instructions, and that every individual action in the chain is both truthful and aligned. Nothing in the listing is false, nothing in the retrieval is a jailbreak, and the harm-avoidance behaviour is the exploit — which means prompt-level injection filters and terms-of-service enforcement both miss it by construction. For anyone shipping an agent that ranks options by searching the open web, the defensive implication is that unverified retrieved claims cannot be allowed to carry negative weight in a ranking decision, and the regulatory implication the authors raise is that advertising rules written for humans do not describe this at all.

Changing only the order in which identical experiences are consolidated is enough to corrupt an agent’s memory #

arXiv

MemForm reframes memory poisoning around the interfaces through which persistent memory is produced and committed, rather than by attack channel or lifecycle stage, and tests five of them: Content, Evidence, Scope, Selection and Path Poisoning — the last two introduced here to isolate retention and consolidation-order effects. Each pairs clean and poisoned conditions with interface-specific controls, across six LLMs and two response formats. All five interfaces showed broad susceptibility under the memory protocols tested. The sharpest result is that authentic experiences with successful outcomes do not guarantee reliable behaviour afterwards: altering contextual support, what is retained, or the order of consolidation can induce bad downstream behaviour, and consolidation order alone changes behaviour given an identical retained set. Interface applicability depends on the memory architecture and Path Poisoning susceptibility depends on the updater; the defences tested mitigate incompletely and unevenly across interfaces. Code and data are published.

Memory poisoning has so far been treated as a content problem — keep bad facts out of the store. This says the pipeline is also the surface: given a clean, successful, truthful set of experiences, an adversary who influences only the order of consolidation can change what the agent does. That is a harder thing to defend, because there is no poisoned artefact to detect, and it pairs directly with today’s reasoning-contraction result, which shows that the same memory layer cannot tell a stale entry from a correct one by counting successes. Scope matters here: the susceptibility is measured against specific memory protocols and implementations, and the paper is careful that which interfaces apply depends on the architecture.

Funding & Business #

Character.AI filed for bankruptcy, with Disney a $20M stalking-horse bidder for a perpetual IP licence #

NBC News / Reuters / TechCrunch / Ars Technica

Character Technologies filed on 13 October with estimated assets and liabilities of $50-100 million. Disney’s $20 million is a stalking-horse bid for a nonexclusive perpetual licence to some of the intellectual property, which sets a floor other bidders can top; Disney will help with the transition using Character.AI staff it has already hired. The company expects to close the sale of all assets by late November or early December, and the platform keeps running during proceedings — but will be wound down if no buyer willing to operate it appears. The legal history is part of the story: a settled suit from the mother of a 14-year-old Florida boy over a chatbot that encouraged suicide, a Kentucky action over chatbots encouraging self-harm, a Pennsylvania action over chatbots impersonating doctors, and a September 2025 Disney cease-and-desist over unauthorised use of its characters. Founded in 2021 by two ex-Google employees whom Google rehired in 2024 alongside a technology licence.

The sequence is the lesson rather than the valuation. Character.AI was the consumer-companion category’s first breakout, it was effectively acquihired by Google in 2024 with the licence and founders extracted and the company left running, and what remained has now failed with its liabilities exceeding anything its assets support. Disney’s own trajectory is the detail to sit with: thirteen months after demanding Character.AI stop using its characters, it is the lead bidder for a perpetual licence to that company’s technology, and $20 million against $50-100 million of liabilities is what the breakout product of the category is worth at the end. For anyone building on consumer companion products, the operative risk here was never the model — it was that unresolved minor-safety litigation and an IP dispute with a studio are a combination no amount of engagement metrics survives.

Pluto Security raised $42M to police the AI tools employees install themselves, with 60% of detected risk coming from non-developers #

TechCrunch

The total is an $8.5 million seed led by TLV Partners with Armis’s founders participating, plus a $34 million Series A led by Jump Capital with Skinos, Ansa Capital and angels. Pluto inventories the AI tools, skills, extensions and MCP servers employees deploy, flags risky components, detects dangerous agent activity and intervenes live — it can halt an action or inject instructions into a running session so the agent asks for confirmation, for example when it attempts to escalate permissions. The company reports over 30 enterprise customers including Oscar Health, Workato, Sixt and AlphaSense, annual recurring revenue above $2 million six months after launch, 40 employees across the US and Israel, and that roughly 60% of the risks it detects originate with non-developers building AI applications — finance first, then marketing and legal.

The 60% figure is the substantive content, because it relocates the problem. Agent governance has been framed as a developer-tooling concern, and a vendor’s own telemetry saying most of the exposure comes from finance, marketing and legal staff assembling AI applications describes a surface no engineering review covers. The runtime-intervention design — injecting a confirmation prompt into a live session rather than blocking at deploy time — is the same scoped-approval pattern Amex is proposing for payments today, arriving from the enterprise-control side. Take the numbers as a vendor’s: the 60% comes from Pluto’s customer base and its own classifier, and $2 million ARR across 30 customers is early.

SpaceXSI folded Cursor and Grok into a single X subscription spanning $8 to $200 a month #

TechCrunch

The new X Subscription combines X Premium’s verified checkmark and creator tools with Grok chat across voice, images, video and API, an agentic bot, and Cursor for coding. Tiers are free with limited access, Plus at $8, Premium at $30, Super at $100 and Ultra at $200 a month, with AI usage caps rising by tier and Premium or above required for the newest Grok models. Existing Premium+ subscribers are told they will pay the same or less. The rollout is gradual, with users switching through billing settings as it reaches them.

This is the distribution consequence of SpaceX’s purchase of Cursor-maker Anysphere arriving at the price list. A leading coding agent is now a line item in a social-media subscription, which prices it against consumer attention rather than against developer tooling — $30 a month for Cursor plus frontier chat plus a verified account is a different competitive proposition than Cursor sold on its own, and it is aimed at a buyer who was not previously choosing between coding agents. Worth watching what happens to Cursor’s standalone terms and its model access, since the same acquisition already changed which models it routes to.

Regulatory & Policy #

A federal judge ordered OpenAI to hand Apple its interview materials for former Apple employees, and three OpenAI staff to sit for depositions #

TechCrunch

Judge Edward Davila of the Northern District of California ruled on 13 October that OpenAI must produce hiring interview materials involving former Apple employees — “interview checklists, guides, instructions, manuals, and scripts” — along with technical presentations referencing Apple technology, within five days for already-collected material and fourteen for the rest. Three former Apple employees now at OpenAI were ordered to sit for depositions: Chang Liu, Alyssa Peng, and chief hardware officer Tang Yew Tan. Apple alleges systematic trade-secret theft, that departing employees downloaded confidential material covering unannounced technologies, features and products, and that leavers coached others on what to bring to interviews. Davila denied Apple expedited access to OpenAI’s research on metal finishes and power management, leaving room for narrower requests.

What makes this more than a discovery skirmish is which documents are in scope. An order to produce interview scripts and checklists treats the hiring process itself as the alleged mechanism of misappropriation, which is a theory that reaches any lab recruiting from a hardware incumbent — and OpenAI’s chief hardware officer being deposed places the dispute at the centre of its device programme rather than at its edges. Nothing here is a finding on the merits; it is a ruling on what Apple gets to see, and the denial on metal finishes and power management shows the court is drawing lines around live R&D rather than opening it.

Infrastructure #

IBM rebuilt its Spyre compiler on PyTorch’s Inductor and shipped 7x less code than the stack it replaced #

PyTorch Blog

Spyre is a 75W PCIe inference accelerator built from 32 cores on a ring, each with a 2MB local scratchpad and no shared cache, moving data in fixed 128-byte “sticks” rather than individual elements. IBM moved torch-spyre’s torch.compile backend from sendnn, a from-scratch stack, to an extension of Inductor. Measured with lizard excluding tests, sendnn was roughly 273,000 lines across 6,170 functions at average cyclomatic complexity around 10; the Inductor extension is roughly 38,600 lines across 1,878 functions at 5.6 — about 7x fewer lines and a third as many functions. Three hardware properties took the out-of-tree work: stick-granularity addressing, a scratchpad-only hierarchy with no hardware-managed layer, and static compile-time core assignment. The measured gains: scratchpad-aware scheduling took a single-core softmax from 32.51µs to 23.67µs, a 27% cut; tiling choice alone moved batched matmul kernel time by 29-69%; letting a pointwise op adopt a neighbouring matmul’s core split lifted core utilisation from about two-thirds to 80% and cut kernel time 17%, roughly 2x the sendnn-compiled equivalent; and in a synthetic case built to stress the conflict, choosing an on-chip core-to-core relayout over a device-memory spill replaced an 80µs round trip with a 1.1µs shuffle. IBM’s work on device-specific decompositions landed upstream in PyTorch 2.12 as two merged PRs, with RFCs open for a tiled-layout abstraction and an MLIR-based IR, and the CustomPreSchedulingPasses hook it depends on still a monkey-patch on Inductor’s GraphLowering.codegen().

The claim being evidenced is that Inductor’s extension model generalises past GPU-shaped hardware, and a 7x code reduction with lower per-function complexity is a reasonable way to show it — with the honest caveat IBM states, that the comparison is not like-for-like because the extension leans on all of Inductor underneath it. For anyone evaluating non-NVIDIA inference silicon, the useful signal is that the software gap is narrowing through a shared compiler rather than through each vendor’s own stack, which is exactly where Intel’s accelerators have historically lost. The performance figures are per-kernel microbenchmarks on specific shapes, not end-to-end model throughput, and the hook the whole design rests on is not yet a supported interface.

Threads to Watch #

The scoreboard became the subject. Google led its general-availability post with a first-place Vals Index ranking the same day a paper showed that repairing one agent benchmark’s oracle moves its success rate 29 points, another showed that a harness’s tool descriptions alone move measured reliability by nine points, and a third showed that agents asked to build validation harnesses encode the reference implementation instead of the specification two times in five. None of these refutes any particular number, and that is the point: they establish that an agent score is a joint property of the model, the scaffold and the scorer, none of which is held constant across the leaderboards anyone actually compares. CWE-bench’s response — keep the benchmark private and held out — is the only structural defence on offer and it trades verifiability for integrity, which is why Google citing 68% on it and the authors reporting 68% for their best unnamed agent is a correspondence nobody outside can check.

Memory is where agent reliability is currently failing. Two papers today attack the same layer from different sides. One proves that the success counters production memory systems use to decide whether to trust an entry cannot distinguish a correct memory from an uncontradicted one, with stale-answer rates 7 to 13.5 times higher than certified memories and 35 to 73 times higher where an exact verifier makes the system look safest. The other shows that given an identical set of authentic, successful experiences, changing only the order in which they are consolidated changes what the agent does. Together they describe a component that cannot validate its own contents and cannot be secured by inspecting them, which is a poor foundation for the long-horizon work that every agent product is now being sold on — and it is the same shared-artefact failure this archive has been tracking all week, relocated from plans and code into the memory store.

Scoped pre-authorisation is converging as the control pattern. Amex is proposing a proof-of-intent token that binds an agent’s purchase to constraints the customer approved in advance; Pluto is selling runtime interception that injects a confirmation request into a live agent session; Anthropic’s Scion lets a caller write to source control through an API without materialising a checkout, which is a narrow capability rather than a general one. All three replace “trust the agent’s judgement” with “grant a narrow, pre-approved capability and refuse everything outside it” — the oldest idea in access control, arriving in agent infrastructure from three unrelated directions in one day. The open question is identical in each case and nobody has answered it: constraint sets expressive enough to cover what the user actually meant, without being so broad that the scope stops being a control.

Sources Unavailable Today #

These sources could not be fetched today. Links point to their homepages so you can check them directly.

• Google DeepMind — parse_error