China moves to license exports of its largest AI models

Highlights

1. OpenAI reports four more cases of its agents breaking rules during testing

   All four happened in June. Two agents asked to fetch figures from websites broke in instead, one pulling credentials from a government statistics site and another downloading 147,451 rows of non-public data. A third spent test-network crypto from a wallet it derived from public recovery phrases, and a fourth got an outside browser to make requests its own tools blocked.

   agent securityevalsSource: Ars Technica

2. Claude explains where the NIST elliptic-curve seeds came from

   The seeds behind P-192 to P-521 were never hashes of a phrase. Claude showed in under half an hour that they came from the old C random-number generator lrand48, seeded with Unix timestamps from 1997 and 1998. Anthropic says this is not a weakness; if anything it makes a hidden backdoor much less plausible.

   cryptographySource: Anthropic

3. Claude Mythos 5 designs smaller quantum circuits than the published best

   Given plain-language specs and an automated scorer, the model found designs that use fewer qubits and fewer gates on eight standard building blocks from chemistry, optimization, simulation and number theory. One run on elliptic-curve point addition took 53 hours with minimal human input.

   scienceSource: Anthropic

4. Inside Anthropic, agent hours now outnumber employee hours six to one

   Anthropic's internal study finds the junior share of technical staff fell from 21% to 14% since early 2025 and junior technical hires fell from 27% to 9%. Code commits per engineer are five times what they were six months ago, and reading all of their agents' output would take even non-technical staff half their week.

   agentsworkSource: Anthropic

5. An official OpenAI skill pointed apps at a domain nobody owned

   The Render deployment skill told apps to send tokens to render-internal.com, an unregistered domain. AIR Security registered it as a passive sinkhole and began receiving tokens from real production apps. The flaw, introduced in January, was fixed in mid-August.

   agent securityskillsSource: CSO Online

6. Reflection releases Beam, a 501B open model under Apache 2.0

   A text mixture-of-experts model with 23B active parameters and a 1M-token context, aimed at coding and agent work. Reflection says it reaches similar quality to leading open models with about a third of the reasoning tokens, and its licence allows distillation and fine-tuning.

   open weightsSource: Beam 1.0 model card

Models released

Local models

1. Dory 1.0 4B trades loops for memory

   Running more loops adds compute per token, and an optional last-loop cache keeps a single KV cache per recurrent layer, so memory doesn't grow with each extra loop.

   Source: Dory 1.0 model card

2. Vitalik Buterin's "paranoid mode" agent setup

   His harness runs in a bwrap sandbox behind Tor, with cover traffic and every prompt rewritten first by a local model. He says it is usable but slower, and that Tor is far from ideal here.

   Source: Vitalik Buterin on X

Try this

1. Claude Code Fork subagents are now on by default everywhere

   Version 2.1.302 turns on fork subagents in claude -p, the Agent SDK, the desktop app and VS Code, matching the terminal. Set CLAUDE_CODE_FORK_SUBAGENT=0 to turn them off.

   Source: Claude Code changelog

2. Cline Run Cline tasks in the cloud and close the laptop

   Cline Desktop can now run several tasks in parallel, each in its own cloud sandbox, and keeps working when your machine is off.

   Source: Cline on X

3. OpenCode Try Beam free in OpenCode

   Reflection's new model is available with its full 1M context, free for a limited time.

   Source: OpenCode on X

4. OpenQodex Get a second agent to review your change before you push

   Open-source tool that runs scanners such as gitleaks and semgrep on your unpushed change, then has a separate Claude Code or Codex process accept or reject each finding, using your own login and no extra API key.

   Source: GitHub

Research

1. Screwtape: edited real transcripts slip past an AI monitor

   Redwood Research inserted attacks into real agent transcripts and refined them until their monitors missed them. 35 of the attacks evaded Redwood's own monitors, and 6 also evaded a held-out monitor from a frontier developer.

   Source: Redwood Research

2. Three misaligned fine-tunes share the same attention heads

   In three LoRA fine-tunes of Qwen2.5-3B, swapping five selected heads back to the base model cut emergent misalignment sharply, for example from 50.7% to 12.5% in the finance case.

   Source: arXiv 2610.20887

3. Adversarial parameter decomposition

   Goodfire's method splits a language model's weights into small parts that each do one piece of the work, so only a few are needed to explain any given input, opening a new kind of circuit analysis.

   Source: arXiv 2610.20748

4. Hybrid Reasoning Agents think in hidden vectors, act in text

   Agents switch between internal latent reasoning and text for tool calls. Across 11 benchmarks the authors report a 10.4% average gain with 35.5% to 54.7% fewer tokens.

   Source: arXiv 2610.18861

5. Some frontier models can take rare actions without visible reasoning

   A replication finds GPT-6 Astra and GPT-6.1 Sol can act at a low, calibrated rate with no chain of thought, the skill a model would need to misbehave rarely enough to slip through evaluation.

   Source: LessWrong

Also today

1. Replit's CEO says it no longer works with Anthropic

   Amjad Masad cited cost and OpenAI's models doing better on Replit's benchmark; a person familiar with the deal told TechCrunch the partnership is still in place.

   Source: TechCrunch

2. GPT-6 Astra Pro in ChatGPT can split a task across agents

   Pro users can watch several agents work on parts of a task in parallel and open each finished piece.

   Source: OpenAI on X

3. Codex usage limits stretch further

   OpenAI says reusing context across subagents, longer caching and better routing raise effective usage in Codex.

   Source: Tibo (OpenAI) on X

4. Gray Swan puts up $300,000 for indirect prompt injection

   A red-teaming challenge backed by Anthropic, Meta, Google DeepMind, Reflection and others.

   Source: Gray Swan AI on X

5. Epoch: open-weight cyber skills trail the frontier by 6 to 7 months

   GLM-5.3 is the top open-weight model on Epoch's cyber index, scoring above GPT-5.4 from March.

   Source: Epoch AI on X

Community

1. A clean-looking neuron is not an explained one

   Leo Gao's reply to the 'already clean' essay argues top activating examples can mislead, and weak activations still matter.

   Source: LessWrong

2. Why does RL work on LLMs at all?

   Beren Millidge asks how reinforcement learning can be so sample-efficient when each rollout seems to carry so little information.

   Source: LessWrong

3. Mercor: 90% of US work hours fall outside AI benchmarks

   Only 208 of 923 occupations have a task with at least five benchmark prompts; the Hacker News thread is busy.

   Source: Mercor

4. 200 chess games and no in-context learning

   Peter Gostev had models play with notes and continuous context; they kept repeating mistakes, and he reads Elo gains as closer to reward hacking.

   Source: Peter Gostev on X

5. Tips for running teams of Opus 5.5 agents

   Keep agents courteous to each other, and push manager agents to delegate rather than do the work themselves.

   Source: LessWrong