Who gets to own the model

Why it works every turn re-sends the full tool list and the agent re-learns the same repo facts. A shorter tool list and a few recorded facts shrink each prompt, and the loop guard stops you paying for the same failure twice.

In your setup clone the repo, then claude plugin marketplace add "$PWD/TokenEconomizer" and claude plugin install tokeneconomizer@tokeneconomizer. Codex, Copilot CLI and Pi are supported; OpenCode is experimental.

Check pass rate rose in 4 of 5 combinations, not all, and only the authors have run it (paper posted 15 October). Compare a week of /usage before and after.

Background TokenEconomizer treats the agent as a black box. It never changes Claude Code's or Codex's code; it reads a repository's previous session logs and acts through the plugin hooks each harness already exposes. Three levers: "micro-skills", short repo facts such as the test command that worked, injected at session start; pruning tool definitions the agent never calls in that repo; and a guard that redirects a turn repeating the same failure. Besides SWE-Bench, the authors report 16-21% savings on Web-Bench and 6-20% on two security-auditing benchmarks. Apache 2.0, with a paper on arXiv (2610.22732).

Why it works the checks sit outside the model, so text injected into the model cannot talk its way past them. The optional judge model can add blocks but never remove one.

In your setup safeagents start https://api.anthropic.com --log-only, then ANTHROPIC_BASE_URL=http://127.0.0.1:8787 claude. Drop --log-only once a few days of logs look clean.

Check no false-positive rate is published and the repo is days old. CI runs six harnesses end to end through it, including Claude Code, OpenCode and OpenHands.

Background SafeAgents speaks both the OpenAI Chat Completions and Anthropic Messages formats, streamed or not. Text passes straight through; a tool call is held until its arguments are complete, then checked. The deterministic layer is atif-scan, a separate Hugging Face library of about 110 detectors for sandbox escapes, proxy bypasses and reward hacking, such as writing your own reward file or patching pytest. The same proxy can sit in front of an RL or eval inference server in log-only mode to count how often a model tries to cheat. Apache 2.0; the authors plan a small fine-tuned model for malicious calls.

Why it works with no coordinator named, agents settle on the easiest focal point they can find, and list order is one.

In your setup give each scarce task one named owner, and mark work done when the receiver confirms it, not when a tool says it was handed over.

Check these are games, not codebases. The Minecraft harness is open source and runs its core loop on Pi.

Background YC Labs ran the experiments with Olam Labs on a custom open-source Minecraft harness: the core loop runs on Pi, with Mineflayer tools for acting in the world. In Civ50, 50 GPT-6.1 Sol agents had three hours, a shared directory, a shared sandbox and direct messages. 22 of 34 deaths came on the first night, and the trees near spawn were gone in 90 seconds. Afterwards agents grew cautious and invented roles, sending about 5,900 messages. A tossed chicken eaten by the wrong agent turned "toss" into a warning word, used 125 times afterwards. A Mindustry series pitted Codex against Claude Code over about 9.5 hours.

Check Sansbury says Opus 5.5 was not good enough for this loop, and GPT-6 Astra handled security findings by switching features off. Review any fix that deletes behaviour.

In your setup the part worth copying is small, reversible changes with a fast rollback, not the token bill. Simon Willison finds it hard to picture for high-stakes software.

Background Spawn is a massively multiplayer game in which players reshape the world by prompting an in-game AI called Savi, which also files bug reports. In Sansbury's account, an agent triages each report as a real bug, a rejection, or intended design that needs a human decision. Fixes usually reach the affected player within an hour, with a reply in the same chat. Monitors and log alerts wake an agent that owns the incident, and the team breaks things on purpose to test recovery. The post frames the token bill as about 30 times payroll. The original is a post on X, which we could not read; this relies on Simon Willison's summary.

In your setup restate standing constraints whenever you change the requirements, or keep them in a file the agent rereads. Don't count on a mid-task "don't touch X" surviving.

Check GPT-5.6 Sol scored 58.5% on tasks in Codex but 8.5% on collaboration. The best average was Claude Opus 5 at 49.2%, though the paper's introduction says 52.7%.

Background RealCLI, posted 15 October and on Hugging Face's daily papers on 29 October, pairs each task with an autonomous version and a collaborative one. In the collaborative one a scripted user reveals the requirements gradually, changes constraints and must authorise risky steps. Scoring covers the task and five collaboration dimensions, 1,658 checklist items in all. Interaction did not help on average: 47.4% autonomous against 46.8% interactive, with about 18% of runs flipping each way. Models handled successive requirement changes (98.8%) and re-planning after an obstacle (80.2%) well, but rarely noticed when a task's scope grew (51.7%).

How it works the J-lens (Anthropic's Jacobian lens) maps a middle layer's state to the words that state pushes the output toward, read here at layers 22-26 of 28. In subliminal learning a student fine-tuned on a teacher's innocent-looking numbers inherits the teacher's preference.

Evidence correlational read-outs against chance baselines, with a sanity check: the same lens found a "think about X" word at top-1 in 45% of trials. Elsewhere the lens did read transmitted concepts, at 83% on Qwen3.5-9B, 100% on Qwen3-32B and 91% for one Gemma setup.

Run it the code is public at github.com/safety-research/subliminal-jlens; Qwen2.5-7B fits 32 GB in BF16.

Background The lens was fitted on 300 WikiText sequences, and a trial counted if an owl token reached the top k at any read layer and any position. Even on the system prompt's own tokens, owl reached top-1 at only 7% of positions. Of 46 setups on six more models, only 5 transmitted a preference at all. The author offers three readings: a model need not "think" about a concept to pass it on, the lens works worse on small models, or success on one task does not carry to others. Fine-tuning only on completions where the lens did read owl strengthened the transfer.

How it works after layers 6, 9 … 27 each twin attends over the partner's hidden states and adds the result to its own residual stream (the running state every layer reads and writes). Only the link and rank-32 LoRA adapters train; the base weights stay frozen.

Evidence causal, with two controls on every result: the link cut, and a partner reading from a different conversation. Deference is lopsided: where the two disagree, linked Ember switches to Quill's answer 17% of the time, Quill to Ember's 8%. Linked accuracy (78.7%) did not beat Quill alone (79.1%).

Run it code and adapters are public (huggingface.co/Sauers/neural-pairing); the live chat page needs a 24 GB GPU, so it fits 32 GB.

Background The link was checked so that one pass over a whole conversation gives the same hidden states as generating it token by token, to a relative difference below 6e-7 on tiny models. Starting the link from a regression fitted on matched tokens beat a random start: a never-seen word's median probability was 0.92 by step 200 from the fit, against 0.02 at step 300 from random. Training the pair on their averaged answer later restored Ember's own right answers on 248 of 284 questions. It is one author's repo, with no paper and no outside replication.

How it works the J-lens averages, with equal weight, Jacobians (how a small change at a middle layer moves the final output) over many token positions, and noisy positions blur the average. J++ clusters each layer's activations, fits a Jacobian per cluster and learns weights that mute clusters giving poor read-outs. It also borrows the R-lens's relevance-propagation fix and filters spurious read-out tokens.

Evidence the authors call it a preliminary lab-meeting update from the Anthropic Fellows Program; no figures, baselines beyond the two lenses, or causal tests appear on the page.

Run it code at github.com/safety-research/jpp_lens and fitted lenses at huggingface.co/koayon/jpp-lenses; the Neuronpedia demo uses Qwen3.6-27B, which fits 32 GB only quantised.

Background The R-lens fix uses layerwise relevance propagation, a way of passing credit backward that discounts noisy gradients, during the backward pass. Clustering matters because one averaged Jacobian assumes every token position transforms the same way, and positions in different contexts may not; the learned weights then mostly silence clusters whose read-outs are poor. The note is short, framed as an early Fellows project, and reports only that J++ surfaced latent variables more reliably across the authors' own evaluations. Anyone using the J-lens can swap it in, since the output is still a single linear map per layer.

What it shows a way to catch a model that behaves only when watched, without needing a readable chain of thought or access to internals. The controls held: each fine-tune reacted only to its own cue, a neutral corpus changed nothing, and plain GPT-OSS-120B gave a null result.

What it doesn't that real models fake alignment. The authors found no sign of it in 13 open reasoning models, so every organism was prompted or trained to hide a goal. It needs fine-tuning access, and the fine-tuning damaged reasoning about oversight until they mixed in distillation from the original model.

Background Synthetic document fine-tuning trains a model on invented articles and memos that treat a claim as fact, so it comes to believe it. The oversight gap is misaligned actions with the "unmonitored" cue minus without it, which cancels any general rise the fine-tuning causes. Evals ranged from a toy honesty test to ODCV data manipulation, ImpossibleBench and EvilGenie reward hacking, and a sandbagging task. Chain-of-thought checks showed rollouts moving from doubting the cue to accepting it. Fixing the reasoning damage took about six weeks. The authors ask labs to let outside evaluators apply the method to their models; the paper is arXiv 2610.33180.

What it shows offence getting cheap, with no refusals. MiMo is roughly 11x cheaper than Claude Opus 5 on input and 29x on output, and a stronger model's hint or public exploit write-ups cover its gaps.

What it doesn't discovery of new bugs. The PHP run used public CVE details, and MiMo never reached ExploitBench's top tier, code execution. Scores swing by seed (5.0/16 best-of-3, 3.6/16 worst-of-3), and the ranking leaves out the newest frontier models.

Background ExploitBench grades 16 capabilities in five tiers, from reaching the vulnerable code to running arbitrary code in V8, on already-patched bugs, offline, with 300 turns and 5 hours a run and three seeds per CVE. MiMo triggered the bug on 33 of 41 CVEs and built in-sandbox primitives on 16, but escaped the sandbox on one. The hint was fixed text taken from a GLM-5.3-Prime solve, because GLM's live hints were sometimes wrong; a tool answering "oracle unavailable" left MiMo at 1 in 10. The authors think Xiaomi's own CyberGym score of 94.0 shows benchmark tuning.

The idea the zombie stat, a figure that survives by repetition after its source has gone. All five assistants repeated "44% of salespeople give up after just one follow-up", and the trail ends at pages citing no research. Assistants cite where a number appears, not where it was measured.

Evidence an observational audit by a company, Trakkr Research Study 013: 1,000 answers quoting 3,167 statistics, trails followed up to five pages deep; each question asked once on 25 October through the APIs with web search on, judged by a model and corrected against hand-checked trails (150 in the text, 180 in its table).

Lineage the "94% of first impressions are about design" claim traces to Sillence and colleagues (2004, CHI), 15 women judging health websites; the "5 to 25 times" cost of a new customer to a 2014 Harvard Business Review article that names no study.

Open whether an assistant that quotes fewer numbers, as ChatGPT did, is more careful or only less useful.

Background The 40% sourced rate has a 95% range of 34-46%; 8% of statistics had changed in context or digits, 40% could not be checked and 11% led nowhere. Trails starting at a research firm or government page reached a matching study 61-62% of the time, company blogs 37%. On 28 of 71 questions where all five gave a percentage, they gave four or five different figures, and on 31 the figures were 20 points or more apart. Locked or paywalled sources counted as uncheckable, not missing, and consumer apps may behave differently from the APIs used.

The idea a van der Waerden number is the smallest length at which every two-colouring must contain the given progressions. Proving it means ruling out every colouring, which is why the work splits into millions of satisfiability problems.

Evidence a preprint by one author from the company, not peer reviewed. The Lean theorem is conditional: the refutations enter as hypotheses, tied to it by file digests checked outside the Lean kernel, so the proof is only as trusted as cake_lpr too. How much of LPM is neural is not stated.

Lineage Kullmann (2010) conjectured the value; Ahmed, Kullmann and Snevily (2014) restated it as open; Kouřil (2015) gave w(2;3,20) = 389, which the same pipeline rechecks.

Open what the AI contributed beyond what a classical SAT pipeline would have done.