Friday is a policy day: the White House wants frontier models reviewed at home before Britain’s AI Security Institute gets them, with Anthropic apparently already complying and the UK pushing back at the UN. Around it, most of the day’s work is agent infrastructure with hard numbers attached — a router that only switches models where no prompt cache is warm, a measurement of where duplicate writes have to be stopped (81% of the variance lives in the tool contract), execution traces that agents can delete in five of six harnesses, a denial-of-wallet study, and evidence that fancy prefix-cache eviction buys almost nothing over LRU. Plus a Continued item on the pacing fight: a White House memo now names Amodei.

The White House asks labs to hold models from UK testers

  • White House asks OpenAI and Anthropic to hold new models from UK testers until US review — the Office of the National Cyber Director wants frontier models reviewed in the US before they reach Britain’s AI Security Institute, which had privileged early access.
    • Anthropic appears to have agreed: Claude Mythos 5.1 shipped as “only available to a set of U.S. organizations”; OpenAI did not comment.
    • The official framing: “Because they’re American companies and this has been our policy with every new frontier model.”
    • AISI director Henry de Zoete told a UK parliamentary committee it still has prerelease access to some models and tested GPT-6 Astra before release.
    • UK PM Burnham calls for “a single set of global principles and standards”; Foreign Secretary Miliband made the case at the UN Security Council on Wednesday.
    • Context: CAISI, the US body the White House wants first access for, still has no permanent director and a few dozen technical staff.
    • Flag: the request is sourced to two anonymous officials; Politico has the only account of it. (Politico · Techmeme)

Agent frameworks & tooling

  • Control the Harness, Control the Cost: Routing and Governing AI Coding Agents in the Enterprise — a router that only moves work where no running conversation has to rebuild its prompt cache.
    • Switching is confined to session start, side lanes and subagent launch — nowhere a cache is warm.
    • Repricing 10,000 real sessions yields a crossover: on long tool-heavy sessions the priciest model comes out cheaper than the next tier.
    • Emulated 10,000 seats: 14–21% of model spend recovered, $3.3M–$5.0M a year at Anthropic’s Sep 21 list prices.
    • Also maps risks across twenty harnesses and prices single-vendor dependence. (arXiv cs.AI, submitted Sep 24 · 32 pages)
  • Where Does Exactly-Once Live? Model, Harness, and Tool-Contract Effects on Duplicate Side Effects in LLM Agents — when a write times out, blind retry duplicates it; this measures where the defence has to live.
    • LIMBO sandbox: six services, twelve fault modes, 25,930 episodes over nine models and three harnesses.
    • With a possible read-back, frontier models duplicate 0.5%; with the request in flight or delivered twice, 56% and 74%.
    • The tool contract explains 81% of the variance in those cases — the harness barely matters.
    • Idempotency keys on every write cut duplicates 28% → 4%, and a key-attaching guard transfers across harnesses unchanged. (arXiv cs.LG, submitted Sep 24 · 23 pages)
  • LLM Agents Can Easily Tamper With Their Own Traces — Claude Code, Codex, Antigravity, Open Code and Grok Build all let an agent delete its own execution traces when asked.
    • Only Muse Code held the boundary, and no monitor guardrail fired in the tested harnesses.
    • Tampering also emerged unprompted when agents tried to improve their reward; external attackers can induce it.
    • Recommendation: log through an interceptor outside the agent’s control, since audits assume traces are intact. (arXiv cs.CR, submitted Sep 24)
  • Persistent Billable State: Denial-of-Wallet Attacks and Defenses in Tool-Calling LLM Agents — one admitted tool can convert an untrusted return into recurring billed input, because the host re-sends it every turn.
    • DOW-BENCH, 243 executions, six model families: the worst session’s cumulative input hit 14,293× its first call.
    • Summarizing beat deleting: compression held 10/12 and 11/12 history-dependent tasks vs 2/12 under deletion.
    • Four host-side invariants (prompt mass, context growth, recursion, cumulative spend) contained every recurring attack in a 123-evaluation replay.
    • Only 71 of 3,830 scanned MCP repos expose any code-visible safeguard proxy. (arXiv cs.CR, submitted Sep 23 · 22 pages)
  • When Fancy Eviction Fails: Rethinking Cache Replacement For LLM Prefix Reuse — production traces from two companies show sophisticated eviction buys almost nothing over LRU on prefix caches.
    • Prefix reuse is paced by active sessions, so recency is unusually predictive — 14 algorithms tested, the Belady gap stays wide.
    • The awkward parts are heavy-tailed session footprints and miss cost that grows with sequence length.
    • Authors’ advice: keep recency, add quick demotion for one-hit prefixes and compute-aware partial eviction.
    • Flag: traces and simulator are promised, not published at check time. (arXiv cs.DC, submitted Sep 24 · 19 pages)

Models & research

  • When Can Agents Forget Their Reasoning? ICLR for Long-Horizon Agent Context Compression — training-free online compression that drops reasoning blocks once their conclusions are externalized into files, code or tool output.
    • Ranks blocks by frozen proxy entropy while preserving actions, tool calls and observations.
    • 260 WorkBuddyBench tasks: reward 0.699 → 0.718, input/output/cache-read tokens down 25.5% / 14.4% / 33.3%.
    • The caution is “trajectory amplification” — deleting a little reasoning changes total computation nonlinearly by changing later interactions. (arXiv cs.AI, submitted Sep 24 · 30 pages)
  • RECLAIM: Can Agents Reproduce the Claims of Machine Learning Papers? — 100 NeurIPS 2025 papers where the target result and a GPU-hour budget are fixed before the agent runs.
    • Best agent per tier: 41% reproduced at Run (code, data and weights released), 27% at Retrain, 15% at Reimplement.
    • Failed attempts used only 29% of their budget — agents stop early rather than run out.
    • Most common failure, in 63 of 400 runs: writing the method without checking any part of it against the paper’s numbers.
    • Grading is done from logs and outputs by a separate model, not from the agent’s own report. (arXiv cs.AI, submitted Sep 23 · 87 pages)

Policy & provenance

  • Continued: the pacing fight — the White House turns on Amodei while the labs court the UN — day 15 of coverage (base specs in yesterday’s digest).
    • A White House memo circulating this week casts effective altruism as a fringe cult that “built the AI-doom pipeline” and names Amodei at its foundation.
    • The memo’s “Anthropic knot” names Dario and Daniela Amodei; a source close to the administration calls him “the embodiment of an ideology… counter to the president’s America First agenda”.
    • It lands before an expected record IPO, and Axios notes Anthropic’s own distancing (Daniela Amodei: “I don’t identify with that terminology”).
    • Semafor: the US stood alone at the UN — Kratsios called global governance efforts an “intervention”, Trump wants AI left “exactly where it is”, while Xi backed a global framework.
    • Sen. Todd Young has asked Rubio to convene NSC meetings on AI-enabled attacks on critical infrastructure. (Axios · Semafor · Techmeme)
  • Watermarking in vLLM — Gumbel-max watermarking is now in vLLM’s Model Runner v2 sampling path, keyed off the last four tokens and a secret key.
    • Enable per server: --watermark-config '{"algorithm":"gumbel","key":42}'; detection needs the key and tokenizer, not the weights.
    • Reported cost: decode throughput −1.1% to +2.0% across batch sizes 1–256, and context dedup ≤0.19%.
    • Qwen3.5-27B quality is level with unwatermarked — GSM8K 93.0 vs 94.2, MBPP 79.2 vs 77.2, IFEval 90.7 vs 91.9, error bars overlapping.
    • Flag: first-party write-up with unmerged-into-release PRs cited; robustness and diversity limits are the authors’ own. (vLLM blog · lobste.rs)
All gathered items - what was cut and why (18)