Back to archive
Issue #165··40 min read·20 stories

Claude watermarks output 🔏, read any model's private thoughts 🧠, Grok Bots learn by watching 👀

Kimi K3 does offensive security with no safeguards. DeepSeek now runs a quarter of Vercel's tokens.

Anthropic, OpenAI and Google all hide the model's thinking behind an encrypted block, then hand that block back to you to return on the next turn. Researchers took one of those blobs from a frontier model, dropped it into a weaker sibling from the same family, jailbroke the smaller model, and had it read the bigger model's private reasoning out loud. Decoding 315,320 of these blocks out of agent logs people had published on GitHub turned up 62 API keys while the visible transcript looked clean.

Anthropic will now watermark every token from new Claude models, across the API, Claude Code and anything served through AWS, Google Cloud or Microsoft Foundry, and concedes that editing or paraphrasing strips the mark.

NVIDIA put out a 30B open model for the grunt work inside agent systems, plus a router to decide when to call it. Routing only pays when your two models sit far apart in price, because in LangChain's launch-partner run the judge deciding each hop took 21% of spend on its own.

Forcing test-first into the agent loop made results slightly worse. Birgitta Bockeler's non-TDD runs designed the whole architecture before writing any code, while the TDD runs locked the design into whatever shape the first test happened to take.

NEWS

Anthropic will embed invisible watermarks in text from new Claude models, covering the Claude API, Claude Code and output served through AWS, Google Cloud and Microsoft Foundry. The mark sits at the model level and survives copy-paste, but Anthropic acknowledges editing, paraphrasing, translating or combining responses can weaken or remove it. Teams that need real provenance should keep logging model ID, prompt version and a hash of the original output.

Nemotron 3.5 Lightning is a 30-billion-parameter mixture-of-experts model for the high-volume work inside multi-agent systems, and NVIDIA put NeMo Switchyard out alongside it to route each request to whichever model can handle it. It runs locally on RTX PCs, DGX Spark, DGX Station and Jetson, or scales out to data centres. Launch partners report cost cuts of 27% to 74%, and the weights are on Hugging Face, ModelScope and OpenRouter.

Microsoft's MAI-Code-1.1-Flash is in production in GitHub Copilot at a quarter of the price of the 1.0 model from June. Microsoft reports a 22% improvement on Terminal-Bench 2.1 in GitHub Copilot CLI, 15% on .NET tasks, and tokens that stream 25% faster while using 25% fewer per task. Code survival rose 4% and return visits increased 9%, production numbers that matter more than the benchmarks.

SpaceXAI's Grok Bot puts agents on their own cloud computer, signed into your tools and working across apps and inboxes. It is in beta on desktop and iOS for SuperGrok Heavy, Cursor Ultra and Cursor Teams Premium subscribers, with an enterprise waitlist. SpaceXAI says its own teams run several Bots in parallel with one managing the others, and a Bot learns a workflow by watching you run it.

CME Group is partnering with Silicon Data to list two compute futures contracts on 5 October, pending regulatory approval. The contracts trade against the rental cost of Nvidia's H100 and Blackwell B200 GPUs, priced off Silicon Data indexes that track hourly GPU rental prices, with each contract representing a month's rent for the H100. That gives AI developers and data-centre operators a way to hedge their costs or revenues.

Sundar Pichai says Gemini has reached 1 billion monthly active users, faster than any other Google product. The metric counts only people opening the Gemini app or web interface, not Gemini inside Gmail, Drive or AI Overviews, and one prompt a month qualifies. Distribution explains much of it: virtually every Android phone carries the Gemini app, and the Gemini 3.5 Pro promised for June has not appeared.

Mojo reaches 1.0 in Modular 26.5, a milestone the language has been building toward since its 2023 debut. It converges duplicate syntax on var declarations and a single Pointer type, and Mojo now diagnoses memory safety problems involving reference invalidation. Through the 1.x timeframe changes should primarily be additive, though breaking changes may still be made and will be managed with care.

TECHNICAL

Anthropic, OpenAI and Google all hide the model's chain-of-thought behind an encrypted block, then hand that block to the client to send back on the next turn. Researchers replayed those blocks into a weaker sibling from the same provider, jailbroke that one, and got the strong model's reasoning back in plaintext, without touching the strong model at all. Decoding 315,320 blocks out of published agent logs also turned up 62 API keys their owners never saw. Can Boluk found an even lazier route: turn reasoning off and hand the model a tool named deep_think.

A macOS guest on Apple's virtualisation stack sees a virtual GPU reporting conservative capabilities, so llama.cpp runs much slower GPU code. Cua's compatibility layer intercepts those answers for one guest process, claiming a newer Apple GPU family and raising a reported memory limit from 32 KB to 64 KB. On one M1 Ultra, TinyLlama 1.1B generated tokens 16.36x faster and Gemma 4 12B 14.54x faster than the stock guest.

A dependency fixer that ran one GitHub Copilot coding agent per repository took roughly 46 minutes for 30 repositories sequentially, and about 12 with five workers. Getting there meant a unique working directory per job, cleanup on failure, a cap set by the first resource to run out, and durable job claims. The gain was about 3.8 times, limited by uneven job duration, disk and network contention, and provider latency.

Compression and language modelling both reduce to predicting the next symbol, and better predictions cost fewer bits. The ngrok explainer builds up to arithmetic coding, which encodes a whole string as one number, where a skewed example cost 0.82 bits per symbol against 1.38 for a flatter one. LLMs are trained to minimise cross-entropy, the same bits-per-symbol number, but shipping a multi-gigabyte model to compress an HTTP response stays impractical.

ANALYSIS

LangChain ran Nvidia's Switchyard router across 145 multi-step agentic tasks as a launch partner, sending only 7% of turns to Claude Opus 4.8 and cutting cost 74% against Opus alone, for six points of accuracy. The catch is the judge model deciding each hop, which took 21.2% of routed spend by itself. That overhead sets the bar: if your two models are close in price, the judge eats the saving.

Claude's seat plans and its per-token billing price the same model and the same tokens up to 40x apart. A replayed 24-hour Claude Code session cost $180.91 at list prices, and 82% of the author's API-equivalent cost was cache related, because agents re-read their whole context every step. Among companies the author has spoken to, everyone moving from seats to per-token Enterprise saw the bill at least double.

Vercel's August production index has DeepSeek running a quarter of gateway token volume in July, more than twice Google's 11%. Volume grew 59% and spend 37%, so the average price paid per token fell 13.6%, driven entirely by which models teams chose to route to. Anthropic still took 65.1% of gateway spend on 30% of volume, at 4.4 times the average price of every other lab's tokens.

Ben Thompson reads Nvidia's new financing partnerships, which aim to mobilise over $500 billion of third-party capital, against the railway bond collapse of 1873. Oracle, Meta, Alphabet and Amazon raised $194 billion in debt by July 7, against $108 billion in all of 2025. The structure preserves Nvidia's margins by finding new pools of capital willing to bear risk that, unlike equity, goes unmarked.

Malte Ubl set Kimi K3 on escaping Vercel Sandbox. It never got out, but it mapped the guest-kernel attack surface and wrote a fuzzer. On DeepSec Bench, which measures application-code vulnerability discovery, it ranked highest among the open-weight models Vercel evaluated, roughly matching Sonnet 5, and every frontier model Vercel tested except Fable 5 will do defensive security work today.

Bockeler ran five batches of greenfield coding tasks through Sonnet 4.6, two solutions with TDD in the agent loop and two without. Judged blind by Opus 4.8, TDD had no clear advantage and performed slightly worse overall, with no meaningful difference in mutation scores. The proposed explanation is that non-TDD runs designed the full architecture up front, while TDD locked design into whatever shape the first test took.

Paul Dix argues every developer already runs production software on operating systems, frameworks and libraries they have never read. He points out that every bug his own team has put into production passed human code review, and that verifiability matters more than familiarity with every line. His proposed test is a ten-day project at an hour a day, directing an agent without ever looking at the implementation.

TOOLS

Mcptoon is a command-line client for MCP servers, the connectors that give an AI agent access to outside tools. It returns results in TOON, a compact notation that swaps JSON's braces, quotes and brackets for pipes and spaces, and it installs as pure Python with no third-party dependencies. Reach for it when five MCP servers and 20 tool calls burn 40,000 to 70,000 tokens before your agent starts thinking.

Popcorn is a dispatch layer between PyTorch model code and a fragmented ecosystem of GPU kernels. You call a stable op API and it routes each call to the fastest implementation validated for those inputs and hardware, with a pure PyTorch reference as the correctness oracle. Tilde Research open-sourced it and published it on PyPI, so reach for it if you are hand-picking kernels per shape, dtype and GPU.