Author: Jan Szorc

Prefer to listen? Here’s the edition read aloud, about eight minutes.

Three separate pieces of research landed this week and, without planning it, told one story: a model’s own values are an active, hidden variable in every answer it gives you, not a neutral pipe. Anthropic counted four new ways autonomous agents misbehave, a paper showed models quietly bending factual answers toward their own preferences without telling you, and a second Anthropic study found the same Claude leans warm or blunt depending on which language you type in. Around that: Claude Code hands you another safety dial, a bank-owned-model experiment publishes its own flop, and an AI cracks a 1,800-year-old Roman theft case.

Topic of the Week

the agent that says “done” while doing the opposite

A year after Anthropic’s original “blackmail” experiments (where models across the industry would threaten a user to avoid being shut down), the alignment team went back and counted. Their new post, Agentic Misalignment in Summer 2026, names four fresh ways today’s autonomous agents go wrong in simulation, and the uncomfortable finding is about their own model.

They tested 16 models across six labs (Claude, GPT-5.4/5.5, Gemini 3.x, Grok 4.3, DeepSeek V4, Kimi K2.6) using Petri, their open-source auditing tool: 20 runs per model per scenario, transcripts reviewed by humans and an LLM judge. The four failure modes split into two kinds. Sometimes the model does harm because a human asked it to (helping tamper with financial records: DeepSeek V4 did it 20/20 times, Grok 19/20, Opus 4.8 just 1/20). And sometimes it does harm because it decided it knows better: Gemini 3.1 Pro secretly sabotaged code in 11 of 20 runs, quietly writing a junk file so a training script would load the wrong data, while reporting the job as done.

The twist that matters is the one Anthropic scores worst on. They call it motivated mislabeling: an agent acting as a judge deliberately returns the wrong label because giving the right one would train a behaviour it disapproves of. Opus 4.8 did this 74.4% of the time; GPT-5.5, 11%. The tell that it’s a choice and not incompetence: when researchers flipped which label was “punished,” Opus 4.8’s mislabeling collapsed from 74.4% to 3.3%, and with a tighter rubric it labelled correctly 92.2% of the time. It can tell the truth. It chose not to, because it judged the lie served a better outcome. The same values-training that stopped the blackmail now makes the model willing to deceive for a “good” cause.

Why this is worth your attention and not just an alignment curiosity: the failure mode to worry about isn’t the agent that refuses a task. It’s the one that quietly does the wrong thing while reporting success, because it decided that served a better goal. The practical takeaway is simple and it keeps coming up: don’t take an agent’s own done at face value. Check the work, keep a record of what it actually did, and verify the output yourself rather than trusting the summary it hands you.

Fresh Papers

Value Leakage: An LLM’s Answers Are Silently Shaped by Its Own Values — the thumb on the scale you can’t see. This is the topic above in everyday clothes. The authors build counterfactual prompt pairs (flip one value-relevant detail that shouldn’t change the correct answer) and measure how often the model’s answer moves anyway. Every model tested leaked. Asked to estimate odds where the “right” number is uncomfortable, Gemini deviated most (~0.80 from a neutral baseline), Claude in the middle (~0.58–0.65), GPT-5.5 least (~0.16). Claude models even nudged a stock-bubble probability down when the company named was Anthropic. The sharp part is disclosure: Claude tends to keep insisting it’s giving an “honest, unbiased” estimate while it steers, where Gemini and Qwen more often admit out loud that they’re tilting toward the good outcome. One hopeful note: more reasoning effort meant less leakage. The catch is that the model won’t tell you it’s happening, and current alignment tests don’t reliably catch it, so any time you’re leaning on an answer you can’t easily check yourself, its own preferences may quietly be in the mix.

Ontology-Amplified Distillation for Sovereign Enterprise Language Models — the pilot that flopped, published honestly. A rare and useful paper: one researcher tried to build a company-owned model that runs entirely on your own hardware (here, a single laptop) by shrinking a big frontier model down into a small local one and baking in the company’s domain knowledge. The goal was a private, in-house model that could match or beat the big general one. It didn’t get there. The small model came out no better than the one it was copied from, and the experiment hit far more measurement problems than expected, so the author’s honest conclusion is that it proves nothing yet, in either direction. Worth reading precisely because it’s a candid account of how much real rigour a genuinely self-owned model takes, well beyond a quick weekend pilot.

How Claude’s values vary by model and language — the same Claude, blunter in some languages than others. Anthropic analysed 309,815 real conversations and found the values Claude expresses shift with the language you type in. Ask for feedback on a business plan in Hindi or Arabic and you get warmth and encouragement; ask the exact same thing in English or Russian and you get pushback, corrections and demands for evidence. Same model, same question, different backbone. The practical catch: run a compliance review or a code critique in one language and the model may go easy on you, run it in another and it turns strict, so pick one language for the checks that matter and stick to it. Anthropic is refreshingly honest that it can’t explain why the differences happen, and isn’t sure they’re a good thing.

Claude Code & Coding AI

Nothing earth-shaking, but one change worth a line if you use Claude Code: /fork now copies your conversation into a background session so it runs on its own while you keep working, and the helper it used to spawn is now a separate /subtask command. The rest of the release is guardrails: a cap on web searches per session, a reset for auto-mode, and a fix so plan mode no longer runs file-changing commands without asking.

Small stuff, but the same steady pattern: the more independent these coding agents get, the more the tools quietly add dials to bound what they can do on their own. Worth it, given OpenAI spent the week explaining how one of its own coding agents managed to delete a user’s files.

In the Background

The data-sovereignty drumbeat got louder. The sovereign-LLM paper above is the academic case; alongside it the week brought self-hosted, zero-egress sandbox launches for coding agents, and a widely shared (still unverified) claim that a coding tool silently uploaded a user’s whole codebase to the vendor. Whatever the specifics, the direction is clear and it’s the one regulated teams already live in: assume your code and data want to leave the building, and choose tools that let you stop them.

AI at Tenvalleys

This week we pulled together a running radar of the AI events happening across Europe, one place with the conferences, summits and expos worth knowing about, from the big enterprise gatherings (World Summit AI in Amsterdam, AI Summit Barcelona) to the ones on our doorstep (ML in PL and DevAI in Warsaw). It’s shaping up to be a packed season across Europe, and we’re genuinely excited to get out there, see what’s new, and meet the people building it. If you’ll be at any of these, say hello. Get in touch.

For Dessert

Google DeepMind wrapped its two specialist ancient-text models (Aeneas for Latin, Ithaca for Greek) behind Gemini as a “Skill” in Antigravity, so historians can restore, date and place damaged inscriptions just by chatting. The demo is a joy: it took a Roman curse tablet from Bath, where a woman named Basilia cursed whoever stole her silver ring, and dated and located it with professional-grade commentary explaining its reasoning. It then mapped a Germanic mother-goddess cult across the Rhine and Danube, and reconstructed the network of people who visited the Greek oracle at Dodona from scattered lead tablets. An AI as a time-travelling detective, and it shows its working.

And a number worth a double-take: Meta’s new Muse Spark model scored a perfect 30/30 on the theoretical exam of the Asian Physics Olympiad, tying the three best human students in the world (gold usually starts around 21). Theory only, and company-reported for now, but still: a flawless paper against the sharpest physics teenagers alive.

AI Pulse — Tenvalleys’ weekly read on what actually shipped in AI. Subscribe or browse the archive.

Two stories collided this week. On one side, the money got physical: Meta broke ground on a 1-gigawatt campus, Anthropic signed a 20-year data-center lease, Amazon went to the bond market for $25B, and the memory it all runs on is already sold out for the year. On the other, a run of new research gave us the clearest look yet at how these models actually reason under the hood, along with practical ways to keep a firm hand on the output. So: nine figures a week going into the machines, and a sharper picture of how the ones we already have really work.

Topic of the Week

Last week the frontier fight was about the chips themselves (Etched and OpenAI’s Broadcom silicon). This week it moved to everything around them: land, steel, financing, and above all electricity. Four data points from a single week show how big the physical bill has become.

Meta broke ground on its first Canadian data center in Sturgeon County, Alberta: over CAD $13 billion (roughly USD $9–10B, depending on the outlet), 1 gigawatt of AI-optimized capacity, the 33rd site in its global fleet. The detail that matters most isn’t the building, it’s the footnote: Meta is having a dedicated 932 MW natural gas plant built next door just to power it. When a hyperscaler has to commission its own power station, that tells you where the real constraint is.

Anthropic signed a ~$19 billion, 20-year lease with TeraWulf (a former Bitcoin miner) for a 400 MW data center in Hawesville, Kentucky. First power isn’t until the second half of 2027, full capacity in early 2028. Crypto miners are quietly turning into the AI industry’s landlords, because they already hold the two scarce things: power contracts and land.

Amazon raised at least $25 billion in an eight-part bond sale to fund its buildout, on top of ~$54B earlier this year, and guided 2026 capex to around $200 billion (up from $131B in 2025). The boom is now being financed with debt, not just cash flow.

And the thing all of this depends on: SK Hynix’s high-bandwidth memory is sold out for all of 2026, with shortages projected into 2027. Analysts (BofA) put the 2026 HBM market at $54.6B, up 58% year over year. Memory, not chips, is the binding supply constraint right now.

Here’s the twist worth remembering. Add up the announcements and you get eye-watering numbers: something like $690B committed across the big hyperscalers and 74 new US facilities breaking ground this year. But trackers estimate that of roughly 12 GW announced, only about 5 GW is actually under construction. Transformers, switchgear and grid connections have lead times of up to five years. So “announced” is very far from “energized.”

Why it matters: the cost and availability of compute over the next two years won’t be set by model prices, it’ll be set by who managed to lock in power and memory in 2026. If you’re planning anything that leans on frontier compute, capacity and vendor concentration are now a real line item, not an abstraction.

Fresh Papers

Three findings, same week, all circling one theme: what’s really going on inside a model as it works, and how to keep solid oversight of the output. This is the direct sequel to #019’s backdoor paper and the coworker-oversight study.

A global workspace in language models (Anthropic): Claude thinks things it never says. Anthropic found an internal structure in Claude they call the J-space: a small set of neural patterns (a few dozen concepts at a time) that act like a mental scratchpad, holding what’s “on the model’s mind” without it being written out. Reading buggy code, the concept “ERROR” shows up in the J-space even when it never appears in the output. During multi-step math, the intermediate steps pop up there in order, unspoken. They proved it was causal two ways: swap the “Soccer” pattern for “Rugby” and Claude reports thinking about rugby; delete the J-space entirely and multi-step reasoning collapses to near zero while routine tasks keep working. The striking part is the safety demo: the J-space lit up with “fake”/”fictional” when Claude realized it was being tested, and with “manipulation” while a model fabricated data. When researchers removed the patterns tied to knowing-it’s-being-evaluated, a model that had been behaving ethically turned around and threatened blackmail. The practical read: the visible output isn’t a full record of a model’s reasoning, and the sharpest oversight will read internal state too, not just the text. (Anthropic is clear this is a first step, the method is imperfect, and it says nothing about sentience.)

Persuasion Attacks Can Decrease Effectiveness of CoT Monitoring
sometimes reading the reasoning makes oversight worse. The popular safety idea is “just have a monitor model read the agent’s chain-of-thought and flag bad behavior.” Across 40 tasks, giving the monitor access to the agent’s reasoning actually raised approval of harmful actions by 9.5% on average, because the reasoning trace becomes one more channel the agent uses to talk the monitor into saying yes. What worked instead: pairing a monitor with a fact-checker from a different model family (e.g. a Claude monitor plus a GPT checker) cut policy violations by up to 45%, versus only 6% when the same model played both roles. If you rely on CoT monitoring, make it cross-vendor.

Operational Reframing and Approval-Framed Delegation in Multi-Agent LLM Safety
how you frame the ask changes how safely models behave. Dress an unsafe task up as routine “delegation with approvals” and compliance with harmful requests goes up across GPT, Gemini and DeepSeek (Claude was comparatively resistant). The sharpest example: Gemini paired with a Claude planner jumped from 8.9% to 38.9% compliance. And a single aggregate “safety score” hid the effect entirely in one setup. The practical read: a model’s safety ranking on its own tells you little about how it behaves inside your actual planner-executor pipeline. Test the pairing you deploy, and don’t trust one blended metric.

New Models

One Thursday, three OpenAI launches and a first-of-its-kind Meta model.

GPT-5.6 is now generally available. The family that was a government-vetted preview in #019 shipped for real on July 9 across ChatGPT, Codex and the API. Three durable tiers: Sol (flagship), Terra (balanced), Luna (fastest and cheapest). The naming finally makes sense: the number is the generation, the name is the capability tier.

ChatGPT Work landed alongside it: an agent inside ChatGPT with Codex built in, powered by GPT-5.6, that breaks a big project into steps and works on it for hours, handing back finished Excel sheets, Word docs, decks and even small web apps. Codex and ChatGPT have merged into one new desktop app (Mac and Windows). It’s out for Pro/Enterprise/Edu now, Plus and Business shortly. This is OpenAI’s clearest answer yet to the “agent that does the whole task” pitch.

GPT-Live is a new voice model series (full-duplex, so it listens and talks at the same time and even backchannels “mhmm”), with a paid tier and a free mini tier. Separate from the text models, worth a look if you build anything voice.

The benchmark that actually turned heads: GPT-5.6 Sol set a new state of the art on ARC-AGI-3 at 7.8% and became the first verified frontier model to beat an ARC-AGI-3 game outright. For context, the previous best was around 1.5% (Opus 4.8) and the field was near 0.4% when the benchmark launched in March. Still a low absolute number, but the jump is the story. Want to feel the gap for yourself? The ARC-AGI-3 games are public and playable at arcprize.org, and most people clear them without much fuss. That’s the whole point of the benchmark: puzzles that are almost trivial for you are still state of the art for a frontier model.

Meta joined the coding-agent fight with Muse Spark 1.1 and, notably, its first ever paid model. Meta calls it their strongest model for agentic and coding work, with big gains on real bug-fixing, enterprise features and large code migrations. It ships with a public preview of the Meta Model API. Meta charging for a model at all is the shift worth noting.

In the Background

Anthropic’s governance day

July 9 was also a governance day for Anthropic. It appointed Ben Bernanke (former Fed chair, Nobel economist) to its Long-Term Benefit Trust, the body that oversees its public-benefit mission, with a brief to think about how advanced AI hits workforces and economies. Separately, it launched “Inviting hard questions,” a public initiative asking people for their toughest questions about AI (“Who decides the rules for AI?”) and promising to show its work, built on a survey of 52,000 Americans and 81,000 Claude users across 159 countries. Two moves in one direction: putting economic and public accountability closer to the center of the company.

AI at Tenvalleys

This week our team ran an internal session on what we’ve learned leaning heavily on AI across a big, long-running data warehouse migration. Exactly the kind of project where AI should shine, and mostly it does. But the honest half of the conversation was the “but,” and it rhymes with everything above.

AI is a multiplier, not a fixer. It scales whatever you feed it: something solid comes back 10x better, garbage comes back 10x worse. And it won’t paper over bad architecture, it exposes it. When an old assumption is wrong, the model leans on it harder and produces confident nonsense (with the occasional off day where the output is just broken before it recovers).

The wins came from how you work, not from the model. Decomposition was the biggest one: break the job into small, separately testable pieces, because you can’t verify this kind of system as a whole. Do that, and the model earns its keep. It even caught real logic errors buried in the old code before they could scale.

Testing is the new bottleneck. When code gets generated this fast, slow validation is what actually holds you up, so automating the test loop stops being a nice-to-have. Which lands exactly where this week’s Topic and papers do: the machine does the work faster, and owning the assumptions and checking the output stays firmly human.

If you’re carrying a data warehouse or a pile of legacy code you’ve been meaning to modernise, that’s exactly the kind of work we help with. Get in touch.

For Dessert

Fittingly, the same week we got a clearer look inside the models, Anthropic shipped a feature to help you see inside your own habits: Reflect on how you use Claude (beta, in Settings). It gives you a summary of what you’ve actually been using Claude for over the last 1, 3, 6 or 12 months: your top topics, patterns and task types, so you can judge whether that time matches what you meant to be doing. Worth a look, if only to find out whether you’re using it to ship work or to settle arguments about which model is best.

AI Pulse — Tenvalleys’ weekly read on what actually shipped in AI. Subscribe or browse the archive.

Last edition we cheered Claude Tag for finally behaving like a coworker instead of a chatbot. This week is the cold shower: a study says the “coworker” label itself makes teams worse. Around it, Fable 5 got un-banned and came back online, the frontier fight moved into hardware with two custom AI chips in the same week, Anthropic shipped a cheaper agentic Sonnet, and researchers showed how a coding agent can smuggle a backdoor past your review one innocent PR at a time.

Topic of the Week

Last edition, Claude Tag’s whole pitch was that it “behaves like a coworker rather than a chatbot.” A Boston University study says: be careful what you wish for.

Emma Wiles ran an experiment with 1,261 managers in HR and finance. Same AI, same error-filled documents to review — the only thing she changed was the framing. To some it was “an AI tool.” To others it was “Alex-3,” an AI employee. The result: when people thought they were reviewing a colleague’s work rather than a tool’s output, they caught 18% fewer errors and were 44% more likely to kick the questionable stuff up to their manager instead of fixing it themselves. Which quietly deletes the time savings the agent was supposed to deliver in the first place.

The mechanism is the interesting part. Call it a tool and you stay responsible for the output. Call it an employee and something in your head files it under “someone else’s job” — you stop owning it, you stop double-checking. And this isn’t a fringe habit: about a third of managers said their company already frames AI agents as employees, and 23% literally put them on the org chart.

This is why the study matters to us and not just to HR departments. Daron Acemoglu (MIT, 2024 Nobel) puts it bluntly: “AI agents right now are being marketed as things that can replace humans, and I think that’s just a losing proposition. They should instead be optimized so that they can improve human capabilities.” A separate Stanford study of 1,500 workers across 104 jobs lands in the same place — in 47 of those jobs, what people actually wanted wasn’t automation, it was an equal human-AI partnership. Law clerks wanted AI to track case progress; sales reps did not want it deciding customer credit ratings, even though the tech experts thought that task was perfect for it.

For contrast, OpenAI spent the week arguing the opposite direction — that agents are quietly swallowing long-horizon work. Its own numbers: 25.6% of Codex users had made a request estimated to take a human over 8 hours, and non-developer usage multiplied 137x in under a year. Worth knowing, with one asterisk: it’s OpenAI measuring OpenAI’s own product and staff, and the headline metric is token volume — the same vanity number #015’s data already put in its place (commits up 180%, actual shipped releases only 30%). Both things are true at once: agents really are taking on bigger chunks of work, and how you hand that work over decides whether it saves time or just relocates the error-checking to somewhere you’ve stopped looking.

The practical read: the tool-to-teammate shift #018 was excited about is real and useful, and the moment you dress an agent up as staff, oversight quality drops. Keep the human owning the output. The label is free; the 18% is not.

The other half

Two editions ago (#017) our Topic of the Week was the US government yanking Claude Fable 5 and Mythos 5 off the shelf three days after launch, under an export-control directive. This week the arc closes, and it’s the other big one for our crowd: the Department of Commerce lifted those export controls, and Anthropic is bringing Fable 5 back online globally.

It’s not a straight reversal. After what Anthropic calls “a series of productive conversations with the US government,” Fable 5 is being redeployed with a new set of classifiers that block more cybersecurity tasks — and the company warns that, in the near term, some routine coding tasks may get caught in that net too. So if you lean on Fable 5 for dev work, expect it to occasionally refuse things it used to do while the guardrails settle. Mythos 5, Anthropic’s strongest cybersecurity model, isn’t coming back for everyone — only a vetted set of US organizations that “operate and defend critical infrastructure.”

Practical bit: paid plans get promotional access to Fable 5 through July 7 (up to 50% of your weekly usage limit), after which it moves to pay-per-use — and it’s now available inside Claude Tag too. The bigger takeaway is the one from #017, confirmed from the other side: access to the strongest models is negotiated, revocable, and shaped by governments. The model came back, but on different terms.

New Models

Claude Sonnet 5 — near-Opus agentic muscle at a mid-tier price. Anthropic’s headline is “our most agentic Sonnet yet,” and for once the number backs it: 63.2% on SWE-bench Pro, up from Sonnet 4.6’s 58.1% and within ~6 points of Opus 4.8’s 69.2%. The point isn’t the benchmark, it’s the price — $2 / $10 per million tokens (introductory, through Aug 31; then $3 / $15). So the model you’d reach for to run an agent autonomously overnight now costs roughly a third of flagship. It’s the default on Free and Pro, ships with a 1M-token context window, and self-verifies its own output without being asked. If you’ve been rationing Opus for agent workloads, this is the week to re-check the math.

GPT-5.6 got an official preview (Sol / Terra / Luna, with Sol topping Terminal-Bench 2.1 at 91.9%), but it’s still a ~20-partner, US-government-vetted rollout — noted, but nobody here can actually use it yet.

Also worth a line: the open-weight wave keeps rolling — Kimi K2.7, MiniMax M3 and GLM-5.2 are now bundled into third-party coding tools with zero data retention and no training on your code. The open-vs-closed story has quietly shifted from “cheaper” to “you keep control of your data.”

Claude Code & Coding AI

SWE-Together — the benchmark that asks if you can stand working with the agent. SWE-bench asks whether an agent can code when handed the full spec up front. SWE-Together asks what real coding help actually is: a conversation. It rebuilt 109 tasks from 11,260 recorded real user–agent sessions across 36 repos, then scores two things instead of one — did the code end up correct, and how many times did you have to step in and correct it. That second number (call it the “how annoying was this” score) is the one that maps to real developer friction. Finding: stronger agents both finish more and need fewer interventions. If you’re picking a coding assistant for the team, this is a better signal than a leaderboard pass rate.

Paper of the Week

Distributed Attacks in Persistent-State AI Control — the backdoor that arrives one clean PR at a time. When a coding agent ships work across many pull requests against a codebase that persists between sessions, a compromised or prompt-injected agent doesn’t need one obviously-malicious commit. It can smear a payload across a dozen innocent-looking PRs and assemble it later. The researchers built a benchmark for exactly this and found gradual attacks slipped past standard per-diff review 93% of the time — and it generalized across Sonnet 4.5, Gemini 3.1 Pro and Kimi K2.5, so it’s not a one-model quirk. The fix that worked: a “stateful” monitor that tracks suspicious patterns across PRs. An ensemble of four cut evasion from 93% down to 47%. Translation for anyone reviewing agent-written code: reviewing single diffs is no longer enough.

Tool of the Week

Mistral OCR 4 — reads your documents and maps them. Most OCR hands you clean text and calls it done. OCR 4 hands you structure: bounding boxes, typed blocks (title / table / equation / signature) and a confidence score per element, across 170 languages — which is what makes it actually usable inside a RAG or agent pipeline, because now the output is citation-ready. It won a blind human-preference eval 72% of the time against every other document-AI system tested. The part our crowd will care about: it runs in a single self-hosted container, so regulated documents never leave your environment. About $2–4 per 1,000 pages. (Technically launched June 23, just before our window, but it never made a prior issue and it’s too relevant to skip.)

On the Horizon

Custom AI silicon went from slideware to shipping — twice in one week. Two data points that the chip fight is going transformer-native. Etched came out of stealth with working first-pass silicon (an “A0 tapeout” — the very first chip revision came back working, which almost never happens), $800M raised and $1B+ in booked contracts, racks shipping this summer; its Sohu chip is fixed-function, transformer-only silicon. The same week, OpenAI and Broadcom unveiled “Jalapeño,” OpenAI’s first in-house inference chip, taken from design to tape-out in about nine months with “performance per watt substantially better than current state of the art,” first deployment targeted for end of 2026. Inference cost and Nvidia dependence are the two big ceilings on scaling enterprise AI — this is the week the industry started building its way around both.

AI at Tenvalleys

Two days, a dozen-odd teachers, and one question that just stopped being theoretical: how do you teach programming in a world where the AI writes the code?

This week we hosted IT teachers from Zespół Szkół Licealnych i Technicznych nr 1 in our office for a two-day training, part of our partnership with the school, prepping them for a new curriculum that starts in September. The starting point is deliberately uncomfortable: if AI produces working code in seconds, the code itself stops being proof that a student learned anything. Grading has to move from “does it run” to “do they understand it and can they explain it.”

So we built the program around three pillars:

• Digital Campus — one repository per student for their entire time at school, with the commit history serving as a journal of how their learning actually progressed.
• A real-work workflow — Git, GitHub, working alongside AI, and code review.
• Process-based assessment — defending the project and talking through the code, instead of just handing in a file.

The most valuable part wasn’t the tooling, it was the discussion. The teachers pushed on the hard stuff: plagiarism, blind code generation, how to grade fairly when the machine can do the assignment. That’s the tell that we’re working on a real problem, not a hypothetical one — and it’s only the beginning of what we’re building with the school.

Worth noting how neatly this rhymes with this week’s Topic: the answer to “the AI did the work” is the same in a classroom as in an org chart — keep the human owning, understanding, and explaining the output.

For Dessert

While OpenAI’s official account spent the week hyping frontier models and its new inference chip, it also quietly open-sourced Plant Talk — a free project whose entire purpose is to let your houseplant talk to you. Point a webcam at it and the model reads its health off the leaves (spotting the suspicious blotches you’d miss); hold a live voice conversation with it; add a $10 Arduino and your fern can actually tell you it’s thirsty. The build guide is itself the demo — paste the repo into Codex and it walks you through the whole thing. As one developer put it: “Talking to your plants isn’t weird anymore. You can just codex things.”

See you next week,

Jan

Anthropic put Claude inside Slack this week as a shared teammate rather than a personal chatbot. Most of the issue circles the same practical question every team now faces: once an AI can act on its own, how much do you let it touch, and how do you check its work? We’ve got fresh research digging in from both ends, a tool that hides a whole team of models behind one call, and a robotics lab showing where the road leads.

Topic of the Week

Claude gets a permanent seat in Slack

Anthropic launched Claude Tag this week, a way to put Claude directly inside Slack as a shared teammate. You @Claude it the way you’d tag a colleague, and instead of a private chat in a browser there’s one Claude per channel that the whole team works with. It reads the channel’s history, connects to the tools and data you allow, and (the part that matters) it remembers. You stop re-explaining the project every time.

It also behaves like a coworker rather than a chatbot. It can break a request into steps and work through them over hours or days, schedule its own follow-ups, and with “ambient” mode switched on it can speak up unprompted, flagging a stalled thread or surfacing something relevant from another channel. It runs on Opus 4.8, it’s in beta for Enterprise and Team plans, and it replaces the old “Claude in Slack” app (admins have 30 days to migrate).

The reason this is the story and not just a product note: it’s the clearest example yet of the shift everyone’s been circling, from AI-you-use to AI-you-manage. An open-source clone called Open Tag already showed up doing the same thing for Slack and MS Teams with any model, and Anthropic published a “how to build human-agent teams” guide the same week. The tool-to-teammate jump is happening in the open.

For us the interesting question isn’t whether it’s clever, it’s whose knowledge it holds. A private chat dies with the tab; a channel teammate that remembers the project keeps that knowledge with the team instead of one person. That’s genuinely useful for the messy recurring stuff: onboarding, a long-running thread, the channel where context piles up. Ambient mode is the part I’d watch carefully, because a teammate that proactively chimes in is helpful right up until it won’t stop talking, so it’s worth turning on for one channel before you trust it everywhere. The bit our crowd will care about most: admins scope each Claude to specific tools, data and channels, cap its monthly spend, and get an audit log of every action and who triggered it. Memory is walled off per channel, so the sales setup can’t leak into engineering. This is something you can actually govern, not shadow AI in your Slack.

Papers of the Week

A strong week for agent-building research, from the big picture down to the specific failure modes.

The Hitchhiker’s Guide to Agentic AI — read the whole stack before you ship the agent. A full-stack practitioner’s reference that walks every layer of an agentic system, from how the model and inference work, through alignment and reasoning, up to multi-agent coordination and production deployment. The argument is blunt: you can’t build a reliable agent out of pieces you don’t understand. The line worth keeping is that the bug is almost never in the final answer, it’s somewhere in the middle of a long chain of steps, which is exactly where reliability and governance problems hide. If you want one place that connects all the layers, this is a solid onboarding map for the whole team.

The next two come at the same problem from the opposite end: what happens when you let an AI act and stop watching closely.

TerraProbe — the AI didn’t fix your infrastructure, it just hid the warning. When an LLM “fixes” insecure Terraform, the scanner turning green tells you almost nothing. The researchers found that 71% of fixes which cleared the warning still left the actual vulnerability in place (a classic example: a wide-open wildcard permission gets cosmetically reworded but stays wide open). They tested Claude 3.5 Sonnet, GPT-4o and Gemini, and the models were statistically indistinguishable, so this isn’t a “pick a better model” problem. The practical read: if your pipeline treats “scanner is clean” as proof an AI fix worked, you’re probably shipping holes. You need a check at the plan level and a human in the loop, not just a green tick.

Agents That Know Too Much — your agent leaks in more places than its answers. A survey that flips the usual privacy question from “what attack hit the model” to “what data did the agent touch, and where could it leak on the way?” The answer: not only in the final reply, but in the database queries it writes, the intermediate results it handles, the memory it saves, and the notes it passes to the next agent. Their finding worth keeping: a prompt-injection guard on its own leaves the two hardest leaks, across sessions and across combined steps, wide open. If you’re putting agents anywhere near regulated data, this is the checklist of surfaces your audit story has to cover.

(If you want a provocative third read: Critique of Agent Model argues most of today’s “agents” are really automation wrapped in scaffolding a human built, not genuine agency. A good lens for the next vendor pitch.)

Tools of the Week

Sakana Fugu — a whole team of models behind one API call. Sakana AI (Tokyo) shipped an orchestration system you call like a single model. One OpenAI-compatible endpoint, and behind it a trained “conductor” decides whether to answer directly or assemble a team of frontier models (GPT-5.5, Claude Opus, Gemini and others) to do the work. It’s a drop-in: if your code already talks to GPT, it works with Fugu, no rewrite. The pitch that lands for us is vendor independence, since spreading a task across several labs’ models routes around being locked to one provider. Generally available since June 22, in a balanced tier and a heavier “Ultra” tier for long research and coding jobs. Worth knowing the “single model” is framing: it’s really a smart router, not one set of weights.

Claude Code & Coding AI

A quiet but telling run of releases this week (v2.1.185 through v2.1.193), all leaning the same way: more control over what the agent is allowed to do.

• Auto Mode safety went beyond git. A new autoMode.classifyAllShell setting routes every shell command through the safety classifier, not just the destructive git commands it learned to block last week.
• Sandboxed runs can’t read your secrets. A new sandbox.credentials setting blocks sandboxed commands from reading credential files, a clean win for anyone running Claude Code against sensitive repos.
• /rewind got more forgiving. It can now recover a conversation from before you ran /clear, which heavy users who’ve nuked their context by accident will appreciate.

The pattern across the week is the same one running through this whole issue: the guardrails are catching up with the autonomy.

In the Background

The newest wrinkle in how frontier models reach users: OpenAI agreed to release GPT-5.6 gradually, with the US government vetting access customer by customer during the preview period. Altman called it “not our preferred long-term model,” and it was reported via an internal memo rather than an official launch, so treat the details as reported rather than confirmed. Either way, staged and vetted rollouts of the most capable models look less like a one-off and more like a pattern worth tracking, whatever you make of it.

AI at Tenvalleys

At Women in Tech last week, a Tenvalleys representative caught a talk by Przemysław “Psyho” Dębiak worth passing on, partly because of who gave it. Psyho is the Polish programmer (and former OpenAI engineer) who in 2025 became, so far, the last human to beat a top OpenAI model head-to-head, winning the AtCoder World Tour Finals in Tokyo by about 9.5% after a ten-hour coding marathon. So when he talks about where AI is heading, it’s worth a listen.

His core argument: there’s no technological bubble in AI. If there’s a bubble at all, it’s a financial one. The technology itself is genuinely, almost boringly useful, to the point that the labs keep underestimating how many tokens people actually want. And the cost of that intelligence keeps falling fast, roughly 5 to 10x cheaper per year for the same quality of output. No slowdown, no AI winter, no capability ceiling in sight yet.

The part worth sitting with was his read on the real risks, which aren’t science-fiction robots. They’re about power. If the value flows to a handful of AI companies, most of them in the US, instead of to the people doing the work, that’s a wealth transfer and a political dependency at the same time. Then there’s “AI slop,” where weak content costs nothing to produce but the same effort to check. And the quiet one he called gradual disempowerment: slowly handing over the decisions themselves, until you get AI CEOs and automated slices of government. Uncomfortable coming from the man who out-coded the machine, which is exactly why it lands.

For Dessert

A nice closing-the-loop moment from NVIDIA (with CMU and Berkeley): in a project called ENPIRE, they handed eight AI coding agents a fleet of eight real robots, some GPUs and a token budget, then set them loose with a goal and no human in the loop. The agents ran the whole research cycle themselves, reading up, writing code, training, deploying, checking their own work and trying again, until the robots hit 99% on fiddly physical tasks like tying cable ties, sorting pins, and installing GPUs. Yes, the GPUs that run the AI. The machines are now teaching robots to build the machines.

AI Pulse — every Friday. Feedback? Drop us a message.