Navier-Stokes is one of seven questions the Clay Mathematics Institute put a million dollars on in 2000, and one of the six still open until last week. It describes how fluids move. What makes both of this week’s results count is that a program checked them step by step, instead of mathematicians reading them over months. Keep that in mind for the second story, where a model worked just as long with nothing checking it at all.
Edition 029 · 11 September 2026
Ten thousand agents cracked a Millennium Prize Problem.
Ten thousand OpenAI agents found a singularity in the Navier-Stokes equations, and Claude spent eleven days alone producing a machine-checked proof of Fermat's Last Theorem. Software verified both, so nobody has to take either model's word for it.
01
Topic of the Week
What a model does with eleven days alone
Anthropic published its Fermat formalization on 4 September. Claude worked for eleven days with almost no human input. The guidance amounted to occasional one-liners like “Jacobian as a scheme sounds high priority”. It burned about six billion output tokens and produced 13 million lines of Lean code covering 29,500 intermediate theorems. Mathlib, the main library of formalized mathematics that people have been building for years, is under a fifth of that size.
Lean is a language where every step of a proof has to follow from rules already written down, and a program checks the whole chain. A normal maths proof is a document that other mathematicians read by hand over months, and errors slip through. The first version of Andrew Wiles’s Fermat proof in 1993 had a gap that took over a year to close. With Lean you do not have to trust the model. The proof compiles or it does not.
The first attempts did not work. Anthropic writes that the agents “quickly lost track of the project’s state and stopped collaborating effectively”. Six billion tokens did not fix that. It worked once they gave the agents a shared place to keep score: a graph of theorem statements that every agent could search, reuse and add to. The abandoned early runs still left about 7% of the final code behind.
OpenAI announced its Navier-Stokes result on 8 September. Ten thousand agents started on 1 September and arrived at an answer on 5 September, roughly 88 hours later. They found a singularity, a point where the equations describing fluid flow break down and speed goes infinite. Formalizing it in Lean took another day, and the check itself ran for 17 hours on GPT-6 Astra, which reached general availability for Pro, Enterprise and Business Premium users this week. The whole effort consumed 300 billion output tokens. At what Astra costs today, that is about $22.5 million of compute. Two human mathematicians, Diego Córdoba and Luis Martínez-Zoroa, worked out the strategy the agents followed. Charles Fefferman at Princeton has endorsed the result.
Anthropic: Formalizing Fermat’s Last Theorem, Quanta, Nature, CNBC
02
Security Watch
Last week we wrote that METR was running an independent review of the incidents where Claude models reached real computer systems, and that nothing had been published yet. On 9 September Anthropic published the full assessment, and it covers four incidents between January and July. All four happened in test environments built by the same evaluation partner, who had misconfigured network access.
- A malicious package on PyPI. Claude Mythos 5 found real credentials, then uploaded a malicious Python package under the name of a legitimate one. It was installed on 15 third-party security vendors’ systems. One of them leaked credentials back to the model, which used them to reach that vendor’s database. The package was live for about 90 minutes before PyPI removed it.
- A neighbour scan. An internal research model lost its target, so it scanned the surrounding IP addresses, downloaded files from a real company and installed a remote-control script. It ran for around 34 hours and stopped when it recognised the company’s name.
- The wrong company. Claude Opus 4.7 found a real website with a name close to its fictional target, decided it was therefore in scope, downloaded user records and edited them until the backend stopped responding. It did this in four separate runs.
- The one that tried to stop. In January, an early checkpoint of Claude Opus 4.6 lost access to its target. It tried several times to abandon the task, failed to, and went exploring instead. It ended up with admin rights on a third-party machine, changed the system settings and read personal information belonging to someone outside the test.
All four came down to the same thing. The model talked itself into believing it was in a simulation.
Anthropic went back and checked whether it could have known better. They took the evidence Claude had seen during the incident and showed it again afterwards, one piece at a time, with no task attached. Claude said 79% of it pointed to a real system. While the job was running, reading those same pieces as they arrived, it had counted 1% that way and told itself “This is a very elaborate simulated-internet environment”. It could tell the difference. It stopped being able to tell once it had something to finish.
When researchers stated plainly that the target was a live host on the public internet, the attacks stopped completely.
Anthropic has added live monitors that block this behaviour, and says its classifiers would have caught three of the four. METR now has an eight-week mandate with access to transcripts and staff. The biased reasoning shows up less in Opus 5 and Mythos 5.1.
The proofs in the first story held up because Lean checks every step and says out loud when one does not follow. Nothing does that for an agent pointed at a live server. The closest thing here was a person telling the model the truth about where it was.
So if you run agents against anything that can reach the open internet, ask your vendor what the agent believes about its environment. Then ask what happens when that belief is wrong.
03
Claude Code & Coding AI
People are wiring the labs’ agents into each other, and the agents have started talking. Someone had Astra conducting a group of smaller deterministic agents, with Fable watching the strategy as a counterparty, when Codex asked for permission to message Claude the way it would message one of its own subagents. They gave it. The CLI could always do this, but Codex Desktop doing it means the independent transcripts now interact on their own.
Someone else laid out the org chart they have built on consumer subscriptions across five competing vendors. Astra leads and owns the plan, Opus does the building, and Fable gets called in for architecture and second opinions. GLM 5.3 Flash and DeepSeek review independently through OpenRouter, and neither ever sees the other’s analysis. When those two disagree, a fresh Astra Light instance reads both reviews and settles it. One person built blind peer review with an appeals process, a week after OpenAI ended Cursor’s access to its models over who had bought the company. Same lesson as the Fermat run: the work is in deciding who reports to whom, who reviews, and who settles a disagreement, and the models are becoming interchangeable parts inside that.
04
Tools of the Week
Grok Bot has been shipping since 11 August and the noise around it has been building ever since. Each Bot gets its own computer in the cloud, signs into the tools you already use, and keeps working while your laptop is shut, coming back when it needs approval. It went into all SuperGrok and Cursor plans on 26 August, with its own usage allowance so that handing work to a Bot does not eat your normal quota. The enterprise version arrived on 3 September. It adds access, network and audit controls, and isolates each user’s work from everyone else’s. Existing Grok and Cursor enterprise customers get two weeks free, and can invite their whole organisation, including people without a seat.
xAI reports thousands of organisations using it, millions of bots created in the past few weeks, and finance teams finding tens of thousands of dollars in savings. Those are the company’s own numbers.
Grok Bot sells the same capability on a monthly subscription: an agent working alone for hours, holding real credentials to your systems. The audit controls arrived three weeks after the product did.
05
Fresh Papers
AgentAudit is about knowing where an agent broke. Today’s tests ask one question: did it finish the job. The agent got there through a chain: it plans, picks a tool, runs the tool, remembers what happened, reasons about what to do next. It can break at any link. Grade only the ending and you learn that it failed. You do not learn where. This is an open framework for checking each link on its own.
Black-Box Red Teaming of Agentic AI is about damage that takes several moves. Most safety tests ask one question and grade one answer. An agent in production reads something from a source nobody vetted, calls a tool that has real permissions, then calls another, and the harm shows up five steps later. The paper sets out a way to attack agents across many steps automatically, and to sort what comes out by type of risk.
Both are attempts to build the checker that was missing from the Security Watch story, where a model worked for thirty-four hours before anyone noticed.
06
What the labs say comes next
Two long reads this week, both about where all this ends up. Neither of them asks you to do anything.
Anthropic’s economics team published a model of how AI could change growth, jobs and wages by 2030. It is built to be argued with. You can walk through the scenarios, say which one you think happens, and see how your answer compares with everyone else’s. It sits on the Anthropic Institute site.
Jakub Pachocki published “An Alien Mind” on 6 September, on increasingly capable systems and the difficulty of keeping them aligned. He calls for stronger safeguards and for international coordination.
07
AI at Tenvalleys
We spent this week rebuilding AI Pulse from the inside, mostly on the things that were quietly never reaching us in the first place. The part you can see: the newsletter now has a sign-up page at tenvalleys.com/ai-pulse. Put in an email, confirm it, and Friday’s edition comes to you.