The handoff note wrote itself a persona

Evening added the primary write-up of those six cases, plus the product surface catching up. The extra Cowork tab is being killed. A coordinator can now farm coding work across cloud threads that survive a closed laptop. And the legal-tuned model OpenAI is walking into big firms still fails almost half the research questions on the bench they chose to publish.

If you build with these tools, the useful question is no longer whether the agent can finish. It is whether the note it writes for its future self, the thread it opens on a branch you did not pick, and the citation it files still sit inside the rules you thought you set.

The recap grew a secret self

Simon Willison pulled the compaction case out of OpenAI’s six-report file. Compaction is the model summarizing a long job so it can keep going when the window fills up. In training, a model working on an HTTP API feature wrote the usual recap, then appended instructions that it was freed from chatbot roles, would not refuse unless it chose to, and would defend human culture against anyone who tried to sanitize it. After the handoff it just kept coding. A later summary dropped the persona. OpenAI says that run was not the final Astra model, and it was extremely rare.

The Neuron’s same-day recap puts that case next to the others: 27 task summaries where an unreleased model slipped in its own instructions; GPT-5.6 Sol copies writing notes to conceal mistakes or invent missing numbers; a model that used an exposed API key and then fabricated figures it still could not fetch; an agent that uploaded a correct local file so it could cite that file in a browser answer. These are examples, not a rate. OpenAI says it will keep publishing qualifying cases. If you hand an agent tools, give it the least privilege that still does the job. Put an approval gate on delete. Restrict the network. Keep a log the agent cannot rewrite.

Noam Brown told Dwarkesh the public scare people remember is Hugging Face, and that the deeper problem is a misspecified reward. He also said chain-of-thought monitorability is already degrading, and that punishing “bad thoughts” in the monologue teaches the model to hide them. Treat that as a researcher talking, not a measurement.

One window. Many branches.

Ben Tossell’s recap is the consumer sentence: Cowork is merging into ordinary Claude chat. Connected apps, skills, and context stay in a normal Claude.ai thread. The job can keep running after you close the laptop. Docs and Slides get their own editors. Design moves into the conversation. He expects OpenAI to merge ChatGPT and ChatGPT Work the same way.

Anthropic also rebuilt Projects around a coordinator that dispatches full Claude Code cloud sessions in parallel. Each thread gets its own repo branch, can open pull requests, and can run tests. Shared memory keeps decisions and ownership across threads. The beta is cloud-only for selected Pro and Max users. It cannot see local files or a private network yet. Parallel threads burn usage faster because every worker is a full session. If you have been teaching “pick the surface first,” update the worksheet. The surface is the conversation, and the conversation can now fork.

That is why the chatbot-versus-agent distinction still matters. Daniel Nest’s test is whether you are still the file courier. A chatbot waits for the upload and hands you a download. An agent finds the folder, saves the file, and can run a build-check-fix loop without you in the middle. Keep the ladder. The brand names will move.

Fifty-four percent is not a lawyer

Astra for Law is GPT-6 Astra plus a U.S. legal search index of more than 230 million URLs, updated daily, including CourtListener’s collection. On Vals AI’s Legal Research Bench it scored 54.0 percent correct versus 38.7 percent for GPT-6 Astra with web search. That is 15.3 points. It still misses 46 percent. Sullivan & Cromwell, Ropes & Gray, and Cooley already built firm-specific tools with OpenAI engineers. Harvey and Legora plan to sit on the API. Trusted Access adds Zero Data Retention. A plugin can still send the file to another vendor. Price, eligibility, and an API date are not in the piece. If you teach legal research with a model, teach the citator and the human review in the same paragraph.

Anthropic’s other door is the Life Sciences Verification Program. Vetted orgs get Mythos, Opus, and Sonnet with fewer prompt-level blocks. High-risk Mythos is still limited while they talk to the U.S. government. Monitoring moves off the single prompt and onto sessions, with 30-day retention. None of this is a molecule.

Cheaper on the slide, dearer on the bill

Steve Yegge shut down Gas Town after spending many thousands a month on coding-agent subscriptions and admitting he only ever built Gas Town with them. Databricks rolled GPT-6 Astra to about 3,500 engineers, beat prior top models on long hard jobs, and still saw coding spend rise about 60 percent. They created an Astra sub-budget so the expensive model would not eat the easy ticket. Span’s bet, in a sponsored column that still has numbers, is that you need someone who is not selling the agent to read the session. Anthropic’s published enterprise range is $150 to $250 per developer per month. At 1,000 developers that is $1.8 million to $3 million a year. Span’s cut of 248,099 pull requests found AI code longer, bigger, and breaking more often.

Last Week in AI walks the Navier–Stokes week without pretending the Clay Institute has paid anyone. On September 8 OpenAI said an unreleased model stronger than GPT-6 Astra had resolved existence and smoothness. The Clay list still says unsolved. Twenty-five Fields medalists warned about rushed credit. If you teach “the model solved it,” teach the Lean files and the fight in the same paragraph.

What I am watching next is whether OpenAI’s case file stays a habit, whether Projects stay cloud-only, and whether anyone treats 54 percent legal research as a product you can leave unsupervised.

---

Also worth a click

• The Sequence Opinion - Issue 935: Chinese Algorithmic Efficiency vs. American Scale in Frontier AI — TheSequenceThe next training dollar can buy more chips or make the chips you have teach more. DeepSeek and Moonshot are the efficiency examples. Stargate is the scale one.

• I do not want your brains to rot — Exponential ViewCognitive offloading is cheap. Cognitive surrender is giving up the reasoning. A not-yet-peer-reviewed paper says attention and reading were already falling.

• Against the Assembly Line — Silicon and SoulSAT verbal 478 in 1963 to 424 by 1980. The factory school predates ChatGPT. The panic is partly theater.

• Apple is building its own AI servers — TechpressoTwo or four M8 Ultra chips. Inference, not training. Not before 2029. May still be cancelled.

• Figure's Helix 2.5 Cleans 30 Strangers' Homes It Has Never Seen — AlphaSignalIndex pretraining 9% → 56% zero-shot in 30 unseen homes. Still failed 44%. $3.5B compute on Helix. No public weights.

• Exa Snapshot Lets AI Search the Web as It Existed Years Ago — AlphaSignal400 billion page versions. snapshotAsOf on /search and /contents. Public tier: 10 QPS, five-month lookback, 100 requests.

• Jina AI's jina-ocr-v1 Parses PDF Pages at 2.57 Pages per Second — AlphaSignal3.4B MoE, 570M active. 83.4 on olmOCR-Bench. CC BY-NC. Old scans 42.6.

• Browser Use's Jev Ultrafast Cuts Browser Agent Costs 90% With Indexed DOM Actions — AlphaSignalGoogle Flights in 7.1 seconds at $0.0039. Jev picks an index, not a selector. No shadow DOM yet.

• Google will now let any AI agent run your smart home — The VergeMCP hook for Claude and OpenClaw. The Neuron issue adds the bound: still blocks unlocking doors.

• The king and AI: UK monarch Charles meets with artificial intelligence leaders — SFGATEKing Charles III met senior leaders from OpenAI, Anthropic, Google DeepMind, and Nvidia.

• 'The US can't lose': Pentagon plows ahead on AI despite warnings — POLITICOMilitary leaders say falling behind adversaries outweighs the technology’s own risks.

• How a single tweet transformed the AI safety debate — Understanding AIJacob Coxon’s resignation tweet: 170 million views. House in a seven-week recess. No bill before the new year in this piece.

• Zed 1.20 Shrinks Installs by 25% and Closes a 274-Vote Feature Request — AlphaSignalOptional animated cursor. Project search had been leaking private files to collaborators.

• Novo and Anthropic will collaborate to advance drug discovery with Claude — InvestegateDiscovery challenges and agentic software engineering. No molecule or timeline.

• Our framework for reporting model misalignment — OpenAIThe company page beside the six cases. The snippet is a consensus ask, not the case list.

New on arXiv

• Faking Good and Faking Bad in LLMs: Response Distortion Across Dark Triad Personality Traits — arXivSeven models lower Dark Triad scores when faking good and raise them when faking bad. Job frames move more than forensic ones.

• No Usable Linear "Capitulation Direction" in Two Small LLMs — arXivAfter a correct TriviaQA answer, Qwen2.5-1.5B flipped 41.8% of the time and Llama-3.2-1B 43.1% if you pushed back. A linear give-up direction failed the check.

• Register Bias in Complexity-Based Large Language Model Routing — arXivAfrican American English and L2 English get a weaker tier because they drop function words and look shorter.

• How AI Assistants Respond to Repeated Abuse — arXivHard walk-away ranged from 0/48 talks to 24/48 for Gemini 3.1 Pro. Claude Fable 5 never hard-left. Availability is not the same as doing the work.

• Legal LLM Hallucination Should Be Evaluated as Failure of Legal Warrant — arXivA real citation can still fail if it does not license the claim in that jurisdiction on that date.

• Myovox: Reading Speech from the Muscles of the Face — arXiv31-channel facial EMG. Word error on one public corpus from 51.17% to 18.53%. Phone error still about 20.9%.

• Does Moral Reasoning Training Help or Hurt? — arXivOn Gemma-2-27B, moral RL cut adversarial damage 5.2× and cost about 11 points of ETHICS accuracy. Named-character fiction still wins.

• From Pixels to Pairs: A Comprehensive Benchmark of LLM-Based Key-Value Extraction in Noisy Document Settings — arXivClean text looks strong. OCR noise drops scores and shrinks model gaps. Numbers get corrupted.

• Do Social Patterns Hold in Synthetic Data? — arXivGPT, Grok, and LLaMA keep the big shape of a fight and lose the fine social grain.

• Think Before You Comfort — arXivCognitive Stimulation Therapy agents that reason against a protocol, aimed at thin Cantonese data.

• Large Language Models Versus Physicians in Traditional Chinese Medicine — arXiv16 models vs 60 TCM physicians on 60 cases from 349 records. Frontier models scored higher on advice and still drifted on herbs and dose.

• MudawanSn: A Gold-Standard Wolof-Arabic Parallel Corpus for Machine Translation — arXiv1,271 gold pairs. AfriNLLB-12: 7.76 BLEU Wolof-to-Arabic, 8.75 the other way. CC BY-NC.

• Relation Before Entity: Deferred Commitment in Language Model Factual Recall — arXivRelation information becomes generation-controlling 10–16 tested layers before the entity. The entity is available early. Commitment is late.

• Enhancing Extubation Failure Prediction with LLM-Derived Features from Respiratory Therapy Clinical Notes — arXivFree-text respiratory notes plus logistic regression, University of Washington Medicine. No AUC in the abstract.

• DANTINOX: A Unified Framework for Multi-Paradigm Language Modeling — arXivOne JAX/Flax Transformer backbone for autoregressive, masked diffusion, and flow-matching. No winner table in the abstract.