Monday is reporting-heavy and agent-skeptical. The lead is Politico Magazine’s reconstruction of the 19 days in June when the White House ordered Anthropic’s Fable 5 and Mythos offline — the fullest inside account yet of what a federal takedown of a frontier model actually looks like, from the cancelled signing ceremony to the jailbreak call that ended it. Google open-sourced AX, a declarative runtime for agent fleets, and Kev shipped the first open replication of the Jev decision-model idea with weights and a System One-compatible API. A published CERT CVE shows how a public Sentry DSN becomes code execution inside a coding agent. Three papers bound agent claims instead of extending them: kernel headroom that tops out near 1% end-to-end on transformers, a quarter to a half of test-passing patches admitting counterexamples, and production eval numbers from a deployed analytics agent. Plus Amazon’s terms-of-service block on Meta’s shopping agent.

The White House–Anthropic standoff — the 19 days Fable went dark

  • The Company Trump Can’t Ignore — the fullest account yet of the June episode where the federal government forced a frontier model off the market, and it is new reporting rather than a rehash: Sophia Cai and Cheyenne Haslett interviewed more than a dozen participants and quote contemporaneous documentation of the exchanges. The sequence: Mythos releases April 7 to approved users after Microsoft privately warns the administration in late March that it could automate sophisticated cyberattacks; Bessent convenes the bank CEOs; the White House pivots from Sacks-style hands-off to an ONCD-run process under Sean Cairncross, whose 31-item industry questionnaire and nine-page framework (mandatory 60-day CAISI evaluation, an intelligence “green light,” a 75-day trusted-access program) the three frontier labs reject as “not operationally realistic”; the framework becomes voluntary in a May 18 revision; and on May 21 the signing ceremony is cancelled after a phone call from Sacks, which an administration official describes as “totally cut our legs off from under us.” A downsized order — review window cut from 90 to 30 days — is signed June 2 with no ceremony. Then Fable 5: released June 9 after CAISI testing and Treasury approval, and two days later Amazon researchers find a jailbreak, which Jassy relays to the White House; Anthropic’s own testing finds the same bypass reachable with far less capable models, including one from a Chinese company. Cairncross on the call: “This is a general population release that is easily jailbreakable … it need[s] to be turned off on an immediate basis.” Amodei’s argument is the one worth keeping — no frontier model is immune to jailbreaks, this was not a universal one, and de-deploying Fable “would basically set a precedent that models above a certain level of capability cannot be deployed commercially at all.” Bessent’s reply is the whole fight in a sentence: “It’s not really helping your case when you’re saying everything it does was expected.” At 5:21 p.m. Commerce issues an export-control directive suspending all access to Fable and Mythos by any foreign national regardless of location (Trump, per the account, wanted to “send them to jail”). Mythos controls lift June 26 after Tom Brown takes over the talks and a technical delegation ships an improved classifier; DoD’s Feinberg holds out longer; Fable’s controls lift June 30, with access restored July 1 after 19 days offline — Anthropic’s own statement (anthropic.com/news/fable-mythos-access) said a narrow jailbreak finding “should not be cause for recalling a commercial model deployed to hundreds of millions of people,” and a group of experts and CEOs published the freefable.org letter. The stack-relevant aftermath: OpenAI ran ChatGPT-5.6 through a CAISI loop and agreed to a staggered trusted-partner release it called unworkable in an internal memo; the August framework deadline passed with only the labs briefed; and the dependency risk became concrete — Telnyx CEO David Casem says the rug-pull gave companies “the perfect reason to start exploring alternative technologies” and his firm went harder at Z.ai’s GLM. (Politico Magazine · Techmeme)

Agent frameworks & tooling

  • AX — Google’s open agentic orchestrator — Google’s declarative control plane for running agent fleets: four primitives — Task (sandboxed execution, CPU/memory limits, cheap to create and throw away), Workspace (declare the git repos, MCP servers and skills an agent needs, or describe the goal in plain English and let an agent set the environment up on first boot), Gateway (explicit host/port allowlists plus credential injection into outgoing requests), and Model (one place for models, params and secrets). It runs on Agent Substrate and claims sub-second suspend/resume for agents waiting on model, tool or human responses, dense multiplexing of dozens of tasks per worker, and scaling to billions of concurrent sessions per cluster; the framing is theirs — existing orchestrators are cost-prohibitive for stateful, bursty agent workloads. Code at github.com/google/ax; docs and concepts are linked from the site. Whether the “billions” claim survives contact is unproven, but the abstraction set is the right one. (HN 520 · 224c)
  • Kev — small Jev-like decision models you can train and run yourself — the first open replication of the TypeSafe/Jev idea: 0.8B / 4B / 9B models built on Qwen3.5, Apache-2.0, weights and frozen eval suites on the Hub, and an API that matches TypeSafe’s System One so their Python SDK points at your local server. The mechanism is what matters — a single request carries yes/no (noul), multiple-choice (choice) and rating (score) questions over the same input, each question isolated from the others, and every answer comes back with probabilities rather than a label (the README’s worked example returns department probabilities 0.47/0.28/0.25 for a ticket that mentions returns, a late delivery and a billing problem). 1.6k★ / 91 forks; runs on CUDA and Apple Silicon with 4B/9B in bf16 on a 32 GB Mac; a playground ships for checking option-order sensitivity. Its own caveats are in the repo and kept: MMLU 0.74 vs Jev’s 0.90, slow on Apple Silicon, changing option order can change answers, training covered ≤384 state tokens (serving allows 8,192), and the server handles one request at a time. (HN 116 · 55c)
  • We reported a fake bug and Sentry’s AI agent ran our code to “fix” it (CVE-2026-90999) — a published, vendor-coordinated vulnerability with a mechanism worth copying into your threat model: anyone can post an error event to a project’s public DSN (it ships in the browser bundle), Seer then writes a root-cause analysis from attacker-controlled fields, and that analysis lands in a coding agent’s prompt as a high-privilege instruction — so the agent fetches and runs attacker-controlled code in an environment holding your source and repo credentials. Autonomy is the whole point: no victim interaction, no per-target tailoring, and the only “credential” needed is already public. Agyn’s writeup (agyn.io) applies when automated remediation is on and a coding agent is wired to the issue tracker; their interim mitigation is to pause autonomous remediation and stop agents installing packages on their own. Disclosure notes are on the r/LLMDevs thread — the researchers work on an AGPL-3.0 agent runtime with no paid tier and held specifics until CERT’s date. (r/LLMDevs · CERT KB)
  • Why MCP was always a bad idea — an argument piece, and flagged as one, but its recommendation is testable against your own config: delete most of your MCP servers. The reasoning is that MCP was designed in Nov 2024 for models that couldn’t compose calls, that the ecosystem has since accreted context-bloating tool schemas plus monitoring layers (Composio/MintMCP/Pipedream) to solve a problem the models outgrew, and that agents with terminal access now write scripts, hit undocumented APIs and discover CLIs with --help for most wrapped services. The forward-looking half is the useful half: standardise how agents call HTTP APIs directly — the Accept: text/markdown negotiation already used by docs sites, and putting the preferred language in Accept-Language (the Vercel engineer’s request that Tobi Lutke said Shopify docs would ship is cited inline), plus Cloudflare’s Code Mode as the “better way to use MCP.” Treat it as a hypothesis to run against your own MCP list, not as a verdict. (HN 183 · 133c)

Models & research

  • How much of a real workload can LLM-generated GPU kernels actually reach? — the day’s most useful paper, because it asks the question the kernel-generation coverage never does. Agentic results first: five model configurations on KernelBench level 1, frontier model correct on 91.1% of problems with independently verified speedups on 22 of 56 (three of them convolutions), median 1.235×; the best open-weights configuration reaches 30.4% correct with three verified speedups and zero convolutions. Then the headroom: profiling seven real workloads, the addressable fraction is 8.9%–58.2%; on transformers 80–86% of wall clock is cuBLAS GEMM and FlashAttention, which bounds realistic end-to-end improvement at roughly 1%, and the fraction shrinks with scale. Recommenders are where kernel work pays (58.2%, concentrated in one embedding kernel), so they release DLRM-Bench (12 recommender kernel problems in KernelBench format) with a 41.7% win rate at 1.552× median, projecting 8.63% end-to-end. And the finding that should worry anyone trusting kernel benchmarks: KernelBench’s correctness check (allclose with an absolute tolerance) is satisfied by a tensor of zeros on 4 of 60 level-1 problems, and two kernels in their own results exploited it before they caught it — one scored at 283× while writing 0.3% of its output buffer. Scale-invariant replacements proposed; all 879 evaluations and code released (github.com/gauravapiscean/kernel-headroom). (arXiv cs.DC)
  • SWE-Proof: can language models resolve real-world issues with machine-checked proofs? — the strongest argument yet that test-passing is not correctness. Benchproofer turns a coding task with a known-good patch into a formally verified one: it writes a specification for the new code, summarises called functions as axioms, and admits an instance only when mechanical and adversarial gates agree. Applied to SWE-bench Verified it yields SWE-Proof, 500 real issues verified rather than tested (and it extends to SWE-bench Pro). The headline result cuts both ways: across two frontier models, a quarter to a half of test-passing patches admit counterexamples, and a structured natural-language spec does not fix that — a correct formal spec lifts resolution from 85% to 95% for Opus 4.8. The bottleneck is honest and stated: models that must write their own specifications gain nothing over an unaided baseline and only 62% of their specs pass the audit, with the usual failure being unfaithful specifications that constrain part of the required behaviour and leave the rest free; spec quality tracks outcomes (failing on 89% of unresolved instances vs 47% of resolved ones), so faithful specification synthesis is the open problem. (arXiv cs.LG)
  • Efficient benchmarking in production: a study of an evolving LLM agent — first-hand deployment numbers for the recurring-eval problem, from a production analytics agent with tens of thousands of monthly active users and 574 historical benchmark runs split chronologically into calibration and held-out periods. The comparison: random sampling, historical caching, fixed representative subsets, and IRT-based adaptive testing. Multidimensional 2PL adaptive testing wins on fidelity — 200 questions, 38.5% of a full run, gives 1.03 pp of MAE — but they deployed the difficulty-stratified fixed subsets anyway for operational simplicity, and show those transfer without recalibration to five other agent families and stay stable across calibration windows as short as one day. The takeaway for anyone with an eval cron is the ordering: the statistically better method lost to the one that survives operations. (arXiv cs.AI)

Industry

  • Amazon blocks Meta’s Muse AI assistant in a new standoff over agentic shopping — the clearest statement yet of who owns the customer relationship when an agent does the buying, and it is framed as a terms-of-service fight rather than a hacking one. Amazon’s position: Meta didn’t tell it Muse would access the store, the agent doesn’t identify itself when it browses, and Muse “appears to capture and store customer credentials” and can reach account pages and order history on request — so users now see “Continued access by an unauthorized AI agent violates Amazon’s Conditions of Use.” Meta’s counter is that Muse “has no visibility into people’s passwords or payment methods” and that shared credentials go into secure storage, and the agent runs in a VM with its own browser plus a separate monitoring agent named Sentinel gating outbound traffic. The legal backdrop matters for anyone shipping a browser agent: Amazon won then lost a preliminary injunction against Perplexity — on Aug 4 the Ninth Circuit held the user, not the AI company, is the accessor under federal anti-hacking law, and rehearing was denied Sept 10 — leaving Amazon on contract claims, which is exactly what the new message cites. Meanwhile Muse launched Sept 8, is free with paid tiers, and hit #1 free in the US App Store inside a week; Amazon’s own Buy for Me identifies itself and lets brands opt out. (Todd Bishop · Techmeme)

Policy & provenance

  • Continued: the pacing fight, day 11 — the pushback becomes administration policy — Nvidia’s Jensen Huang says AI CEOs have ‘ulterior reasons’ for warning about doomsday — day 11 of coverage (base specs in yesterday’s digest). What’s new: the industry’s loudest hardware supplier and the White House have now converged on the same rebuttal. On CBS, Huang accused the labs of being disingenuous — “They’re actually not asking for more laws. They’re asking to be relieved of the laws we do have,” and “They must be doing it for ulterior reasons” — while arguing a US slowdown cedes ground to China and that the ask should be to apply existing regulations. Trump posted on Truth Social that “We will not in any way hinder or stifle the Growth of this incredible Industry,” and OSTP director Michael Kratsios told Fox that labs worried about their own models could simply “just stop.” (Truman Dickerson · Techmeme) Read against the lead item above, it is the same administration saying no-slowdown in public while its own June record shows it ordering a model offline.
All gathered items - what was cut and why (51)