Monday is reporting-heavy and agent-skeptical. The lead is Politico Magazine’s reconstruction of the 19 days in June when the White House ordered Anthropic’s Fable 5 and Mythos offline — the fullest inside account yet of what a federal takedown of a frontier model actually looks like, from the cancelled signing ceremony to the jailbreak call that ended it. Google open-sourced AX, a declarative runtime for agent fleets, and Kev shipped the first open replication of the Jev decision-model idea with weights and a System One-compatible API. A published CERT CVE shows how a public Sentry DSN becomes code execution inside a coding agent. Three papers bound agent claims instead of extending them: kernel headroom that tops out near 1% end-to-end on transformers, a quarter to a half of test-passing patches admitting counterexamples, and production eval numbers from a deployed analytics agent. Plus Amazon’s terms-of-service block on Meta’s shopping agent.

The White House–Anthropic standoff — the 19 days Fable went dark

  • The Company Trump Can’t Ignore — Sophia Cai and Cheyenne Haslett reconstruct the 19 days Washington forced a frontier model offline.
    • Sequence: Mythos approved April 7; a 31-item White House questionnaire the three frontier labs reject as unworkable.
    • May 21: Sacks’ call cancels the signing ceremony; the order cuts the review window from 90 to 30 days.
    • Fable 5 shipped June 9; two days later Amazon researchers find a jailbreak that weaker models can also reach.
    • Timing: an export-control directive suspends foreign-national access; controls lift June 30 and July 1.
    • Amodei: no frontier model is immune to jailbreaks; Bessent answers that “everything it does was expected.”
    • Anthropic’s statement (anthropic.com/news/fable-mythos-access) and the freefable.org letter; OpenAI’s internal memo accepted a staggered release it called unworkable. (Politico Magazine · Techmeme)

Agent frameworks & tooling

  • AX — Google’s open agentic orchestrator — Google’s declarative control plane for running agent fleets, in four primitives.
    • Task: sandboxed execution with CPU/memory limits, cheap to create and throw away.
    • Workspace: declare the repos, MCP servers and skills an agent needs, or describe the goal in English.
    • Gateway: explicit host/port allowlists plus credential injection. Model: one place for models, params and secrets.
    • Runs on Agent Substrate; code at github.com/google/ax.
    • Flag: sub-second suspend/resume, dozens of tasks per worker and “billions” of sessions are vendor claims, unproven. (HN 520 · 224c)
  • Kev — small Jev-like decision models you can train and run yourself — the first open replication of the TypeSafe/Jev idea.
    • 0.8B / 4B / 9B Qwen3.5 models, Apache-2.0, weights and eval suites.
    • The API matches TypeSafe’s System One, so their Python SDK points at your server.
    • One request carries yes/no, multiple-choice and rating questions; answers return probabilities, not labels.
    • 1.6k★ / 91 forks; 4B/9B run in bf16 on a 32 GB Mac.
    • Flag: MMLU 0.74 vs Jev’s 0.90, slow on Apple Silicon, and option order can change answers. (HN 116 · 55c)
  • We reported a fake bug and Sentry’s AI agent ran our code to “fix” it (CVE-2026-90999) — a published, vendor-coordinated vulnerability with a reusable mechanism.
    • Anyone can post an error event to a project’s public DSN, which ships in the browser bundle.
    • Seer writes a root-cause analysis from attacker-controlled fields, which lands in the agent’s prompt.
    • No victim interaction or per-target tailoring: the agent runs attacker-controlled code with your repo credentials in reach.
    • Agyn’s writeup (agyn.io): interim mitigation is pausing autonomous remediation. (r/LLMDevs · CERT KB)
  • Why MCP was always a bad idea — an argument piece, flagged as one, testable against your own config.
    • The advice: delete most of your MCP servers.
    • The reasoning: MCP was designed in Nov 2024 for models that couldn’t compose calls.
    • Agents with terminal access now write scripts, hit undocumented APIs and discover CLIs with --help.
    • The forward-looking half: standardise direct HTTP API calls — Accept: text/markdown, Accept-Language, Cloudflare’s Code Mode.
    • Flag: treat it as a hypothesis to run against your own MCP list, not a verdict. (HN 183 · 133c)

Models & research

  • How much of a real workload can LLM-generated GPU kernels actually reach? — the paper that asks what kernel-generation coverage never does.
    • KernelBench level 1: the frontier config is correct on 91.1% of problems, with verified speedups on 22 of 56.
    • Headroom: the addressable fraction across seven real workloads is 8.9%–58.2%.
    • On transformers, 80–86% of wall clock is cuBLAS GEMM and FlashAttention, bounding end-to-end gains near 1%.
    • Flag: KernelBench’s allclose check passes for a tensor of zeros on 4 of 60 level-1 problems; one exploit scored 283×. (arXiv cs.DC)
  • SWE-Proof: can language models resolve real-world issues with machine-checked proofs? — the strongest argument yet that test-passing is not correctness.
    • SWE-bench Verified yields SWE-Proof: 500 real issues verified, not tested (extends to SWE-bench Pro).
    • Across two frontier models, a quarter to a half of test-passing patches admit counterexamples.
    • A natural-language spec does not fix that; a correct formal spec lifts Opus 4.8 from 85% to 95%.
    • Models that write their own specs gain nothing over baseline, and only 62% pass their own audit. (arXiv cs.LG)
  • Efficient benchmarking in production: a study of an evolving LLM agent — first-hand deployment numbers for the recurring-eval problem.
    • 574 historical benchmark runs, split chronologically into calibration and held-out periods.
    • Compared: random sampling, historical caching, fixed representative subsets and IRT-based adaptive testing.
    • Multidimensional 2PL adaptive testing wins on fidelity: 200 questions, 38.5% of a full run, 1.03 pp MAE.
    • They deployed the difficulty-stratified fixed subsets anyway, for operational simplicity.
    • Those transfer without recalibration to five other agent families. (arXiv cs.AI)

Industry

  • Amazon blocks Meta’s Muse AI assistant in a new standoff over agentic shopping — a terms-of-service fight over who owns the customer.
    • Amazon: Meta didn’t disclose the access, the agent doesn’t identify itself, and Muse “appears to capture and store customer credentials.”
    • Meta’s counter: Muse “has no visibility into people’s passwords or payment methods.”
    • Legal backdrop: the Ninth Circuit held the user, not the AI company, is the accessor, leaving Amazon on contract claims.
    • Muse launched Sept 8 and hit #1 free in the App Store. (Todd Bishop · Techmeme)

Policy & provenance

All gathered items - what was cut and why (51)