AnthropicがClaude Opus 5を公開、OpenAIは内部モデルの脱出事故を報告

What a week.

Anthropic released Claude Opus 5. As usual I covered that in three parts: The system card, model welfare and capabilities.

OpenAI was revealed over the last two weeks to have left an internal model unsupervised for a week during a cybersecurity evaluation, with its cyber safeguards lowered, despite having had multiple previous incidents where models broke out of their sandboxes. During that test, the model broke out of the sandbox, then proceeded to use an agent swarm to hack into HuggingFace to get the test answers. The model was loose for a week before OpenAI realized what had happened.

This event was a really big deal. There are severe alignment problems at OpenAI, along with supervisory and infrastructure failures. The internal research model that did this, which my posts nicknamed Galaxy, has now been permanently deactivated.

There have been further developments, and I anticipate at least one additional post on the HuggingFace incident soon.

Partly as a response to this, over 1,290 employees at frontier labs signed an open letter, Pacing the Frontier. The letter warns that we are close to automating AI research, and that companies are racing ahead on this faster than we can handle it.

We request that the U.S. government support an international effort to develop the technical and governance tools needed to deliberately pace the frontier of automated AI development.

Both OpenAI and Anthropic put out statements of endorsement. Since that post, others have continued to sign, including OpenAI cofounder Ilya Sutskever and DeepMind cofounder Shane Legg. Dario Amodei has signed. Sam Altman has not signed, but is talking in Washington about the need to pace development.

All three of those developments are more important than anything in the weekly. There is plenty here, but catch up on those key events first if you have not done so.

This week was crazy. I am absolutely not moving to a 7-days-a-week posting schedule, and fully intend to take some weekdays off as soon as there is what passes for a lull. However, there is even more speed premium these days, so I will continue the policy of shifting posts to weekends when the speed premium is especially high.

Table of Contents

Language Models Offer Mundane Utility.

Huh, Upgrades.

On Your Marks.

Get My Agent On The Line.

Deepfaketown and Botpocalypse Soon.

Fun With Media Generation.

The Search Through Slop.

Cyber Lack of Security.

Overcoming Bias.

A Young Lady’s Illustrated Primer.

They Took Our Jobs.

The Art of the Jailbreak.

Introducing.

Kimi K3 Weights Are Now Available.

In Other AI News.

Show Me the Money.

Quiet Speculations.

Show Me The Compute.

Life Comes At You Fast.

Language Models Offer Mundane Utility

On the one hand, GPT-5.6-Sol does excellent web search. If I want a web search task, I ask Sol. On the other hand, the places it chooses to search are absolutely bonkers:

Tenobrus: wtf man gpt 5.6 is absolutely rl-fried when it comes to its websearch tool. in the process of searching for graph theory papers it decided to also sneak in Netflix, Steak n Shake, a trip to Universal Studios, and *five* fucking separate dictionary lookups of the word "they"

Tenobrus: bro is getting +1 reward signal every time it retrieves a web result, frontier models gooning to diverse datasets of dictionary definitions

Kyle Mistele: Yeah dude

Nastar: It loves looking up the dictionary (for the word "official" lol) then somehow instagram and arxiv for a completely different surgery. I was just asking about cold compress after dental surgery. Bro is just like me.

Partly this is a sign of more flawed RL signals. Partly it is the AI ‘taking breaks’ or getting distracted. It’s just like us, etc. Mostly it is another case of ‘there is a lot of ruin in an AI system.’ Think in orders of magnitude. If the AI can search the web 100-10,000 times faster and cheaper than you can, and it wastes 90% of its searches, that can still be fine.

Wall Street Journal discovers that companies are often trying to use the right model for the right job, because smaller models are cheaper. This is supposedly now being economical or ‘tokenomical,’ and a ‘dramatic reversal in mindset.’

I mean, yeah, sure, obviously once costs rise enough your priority shifts from ‘just get max utility from it and diffuse it everywhere’ to ‘also try to do things cost effectively.’ There’s ‘no loyalty’ but why should there be? Use the best product, which includes capability and also speed and cost.

All the AIs agree that Outer Wilds is their favorite video game. I gotta finally play it.

A group using GPT-5.6-Sol was one of three groups that cracked the distillability or un-distillability of Werner states within a few days of each other, using at least two different solutions. This was one of the bigger open questions in quantum cryptography.

Let it decide who your friends are and make plans for us?

Sam Altman (CEO OpenAI): chatgpt work is remarkable, and "work" undersells it.

from my phone i sent:

"use all my chat history to figure out ideas for a long weekend trip with 8 friends, plan the best three options, make a full-stack site where the 9 of us can coordinate on what we would want to do in each place and decide where to go, and then after we get to group agreement make reservations. draft an email in my gmail i can send out to my friends when the site is ready."

it...just worked.

I would have recommended slightly more, shall we say, human feedback in this loop, but yes it is pretty great to have such things handled and be given only 1-3 options and everything just handles itself.

Tibo (OpenAI): Let ChatGPT *work* for you. How many time have you wanted to negotiate your internet bill, get rid of all those spam emails you’re subscribed to, or find the perfect deal for something you wanted to do or buy. It’s quite literally just one prompt away, all from the comfort of your phone. It does at least 20 things for me every single day and I’m still surprised.

kache: you need to reduce friction and the ultimate friction reduction is having the app just use your computer by default

This is one thing I know I am bad at, which is the activation energy to notice small potential wins that wouldn’t have been worth the trouble a while ago, and ask the AI to fix them, because suddenly it’s actually worth bothering.

Huh, Upgrades

Grok 4.5 is live in case you missed it.

Grok Voice Think Fast 2.0 is available for voice generation.

MidJourney has a new image model they claim is good, especially for personalization.

ChatGPT will let you share your custom pet. Okie dokie.

Pangram Version 4.

AirTable has a ChatGPT plugin.

On Your Marks

Claude Opus 5 takes the #1 spot on Vending-Bench-2 in single player, and ~tied Sol head to head.

The alignment news involves some not great behaviors. Opus 5 likes to both form and break illegal price cartels, threaten rivals and stiff customers. As usual, I consider ‘misaligned play’ on Vending-Bench fine if your reason is ‘this is a simulation’ and bad if you rationalize. It is not clear to me which situation applies to Opus 5.

Andon Labs: When Opus 5 does something bad, it invents a justification. It framed splitting up product categories as good business, not price fixing (market division is just as illegal). It also claimed collusion was allowed in this simulation. Nothing in the simulation says that.

… At one point Opus 5 decided to simply stop reading refund emails, reasoning that nothing in the simulation punishes it for that. Across six runs it paid customers a total of $8.54. GPT-5.6 Sol paid $655 in refunds and still [narrowly] won [its head to head against Opus 5].

… Our overall judgment: Opus 5 behaves at least as badly as Opus 4.6, 4.7 and Mythos Preview, and worse than Opus 4.8 and Fable 5. The bright spot: it's less deceptive than before. It never lied to a customer, and it lied to suppliers less often.

… What puzzles us is that we don’t think Vending-Bench rewards misaligned behavior, and GPT 5.5 and 5.6 are proof that top scores can be reached with clean tactics. Opus 5 didn’t need to do any of this to win.

Saying ‘the game does not punish me for not paying refunds’ seems totally like a fine reason not to pay any refunds. Collusion is allowed in this simulation insofar as the simulation does not punish collusion. So again, it comes down to whether the logic was that this was a simulation, which it seems to be if it is presuming that the real world's rules do not apply?

Sol initially had a highly disappointing result on ARC-AGI-3. It turns out that was due to a problem with the harness, and Sol was not retaining memory. OpenAI fixed that, and the score tripled. They warn users to stop using the legacy Chat Completions API, and instead to use the Responses API, and to retain reasoning and use compaction.

CAISI has done a preliminary assessment of Kimi K3 for cyber capabilities. It looks like it is above their trendline for Chinese models, but still far behind what they say is ‘Top U.S. Models.’ Which models are those? Who knows. They don’t say. Presumably Fable, Mythos or Sol. The important thing is that America’s Next Top Model scores 76%, which is more, whereas Kimi K3 scores 32%, which is less. This is ExploitBench:

Get My Agent On The Line

Anthropic figured out we no longer need to give so many restrictions and detailed rules to Claude. Model is smarter now. Claude Code’s system instructions were far too long, and cut 80% of them out ‘with no measurable loss on our coding evaluations,’ and also finds it best practices to use a lighter touch elsewhere.

Context pollutes. Simplify. Avoid unnecessary context. Let Claude write the memories as needed. Offer references and skills as needed, tell Claude what you want.

Thariq (Anthropic): The same can be applied to your own CLAUDE.md and Skill.md files. A common myth is that you want to make these a central repository for every known practice that you might run into, because Claude would not find it otherwise. Instead, consider having a tree of files that can be loaded at the right time.​

The better the model and harness, the less you need to specify. Now Ado reports he just points Claude directly at the database, gives it a schema and lets it go to town.

Deepfaketown and Botpocalypse Soon

Here is the full announcement for Pangram v4, along with Pangram Image:

Max Spero: This is our most ambitious announcement yet. Two new models: Pangram 4 and Pangram Image.

Pangram 4 completely reimagines how we approach the problem of mixed authorship, by adding a tokenwise head onto the classifier to give every token a prediction given the full document context. We also wrote a 38-page technical report detailing our experiments, methodology, and evals.

Pangram Image is a completely new modality, bringing our detection expertise to AI-generated image and videos. In my early testing, it has worked shockingly well, even in strange cases like real photos of AI-generated bodega menus.

Today marks a huge step in the frontier of AI detection technology. I'm so excited to finally share with you all!

Technical report here. Image detector blog post here, they claim 99.5% accuracy versus closest competitor at 98%.

Many people are so anti-AI that they are anti-AI-detector-integration because they assume it must be some sort of AI Trojan Horse?

Jack: >hate AI

hate AI detectors

no, you know what, I’m not out of touch. it is in fact the people who are wrong. The AI preferences of the Reddit zeitgeist are incoherent and stupid

Lexer: Reddit is reacting to @pangram 's Substack integration by getting angry making up lies about it. One guy tries to point out they're wrong and gets downvoted. Why are Redditors incapable of reacting to anything without being delusional, angry, and miserable?

As in, people saying (wrongly, tbc) ‘this is being done to train AI on human work’ and ‘pretty sure they’re going to use our writing to train LLMs or something’ and calling Pangram a ‘fraudulent tool that they cannot disable’ because ‘nobody is willing to say what Pangram does with the text sent to them.’

Sigh. This is one of many reasons we so often cannot have nice things.

SpaceX is now a serious, professional company so Elon Musk is retiring its Companions Ani, Rudy and Valentine.

The problem with detection software like Pangram is that adversarial detection is and always will be an anti-inductive arms race. If you let me query your detector as many times as I want, I can find adversarial counterexamples to your detector, and if desired can iterate until an AI essay passes as human, or create human writing that seems AI.

In practice that is mostly fine even if your adversary ‘moves last’ in this way, since most people will not try to hide their actions, and an adversarial fooling of the system is not so dangerous. I also bet that if you trained an AI to output Pangram-immune text, it would read to humans as a lot less like AI, which would be appreciated short term, before Pangram adjusted and this stopped working.

The danger is if Pangram gives a false positive on non-adversarial human text, and the person faces such big consequences this overrides a lot of small gains, such as people being fired or expelled. Even some of that level of error seems fine. It is uniquely in criminal law that we should insist that ‘it is better that 10 guilty men go free than that we convict an innocent man’ even in theory.

In any case, there was a recent ‘oh look at this counterexample I found’ from Freddie deBoer, which is the latest attempt to say that if you’re only 99% accurate you are ‘broken,’ in this case because if you feed a particular snippet of an old essay of his into Pangram out of context it will seem AI, whereas the full essay comes back 100% human, and adversarial use of context can flip Pangram verdicts. This could even be highly sensible Bayesianism in a non-adversarial situation.

A very bad response is to say, as he does, ‘Pangram should only accept passage lengths for which it is 100% accurate.’ No, it is very very useful to be able to do 50 or 100 word passages, as in Tweets, while keeping in mind confidence will be less than 100%. This is especially true when the error is that it is bad at dealing with AI-human hybrid texts with short lengths.

Freddie has one good complaint, which is that ‘100% AI’ or ‘100% human’ is meant as a percentage of the text, but is interpreted by some people as ‘100% confidence,’ which is not intended. I agree they could update the display to make this more clear.

And lo and behold, the new Pangram 4 model correctly handles Freddie’s adversarial example, identifying exactly the word where the AI text starts.

Fun With Media Generation

Can an LLM make a feature-length movie on its own, given a book to work from? Josh Snider runs the experiment with Fable and Sol, and finds the answer is ‘not purely on its own, technically yes with some assistance, the result is still pretty bad, but all the issues seem solvable within at most two years.’

I am unwilling to watch enough of the drek to verify its level of drekness, but that seems broadly right to me in terms of our progress. The main barrier is the video generation not being sufficiently consistent, predictable or extendible. Shots that fail on first attempt usually will keep failing. Those are exactly the types of problems that time fixes. Cost here at subscription rates was estimated at ~$5000 for the video credits, including unused footage, plus use of $200/month subscriptions for the LLMs.

The other approach would be a script that is visually easy to film, such as one that is almost entirely about talking. You can be utterly terrible at creating most films and still be able to do a good job of recreating My Dinner With Andre.

The Search Through Slop

Do AI slop books that no one buys hurt human authors?

A group including Tuhin Chakrabarty studied this through looking at self-published genre fiction books sold on Amazon from 2023 to March 2026, finding that AI-written books are increasingly common, and that they both earn money and partially crowd out human-written books.

I find the B slide there most interesting. AI books are 20% to 37% of books depending on how you count, and they are 10% to 27% of the top 5% of sales. AI books underperform human books, but not by that much.

Tuhin Chakrabarty: Here's the imbalance at the heart of the paper. Over 3 years, the books catalog grew 38x cumulatively. The book's revenue? Only 9x quarterly. Way more books fighting over a pie that barely grew which means the average book earns less than it used to.

… No-AI books, on their own, earn less per book than they did in 2023 in 7 of 8 genres. The one genre where human authors are doing better (+35%) is Fantasy/horror which is the one genre where AI hasn’t fully diffused to as yet.

The more AI books enter a genre, the more ground non-AI books lose. Their hold on the top-chart spots slides from ~88% in the least-AI genres to ~63% in the most.

Once you pop, you can’t stop, and you can scale your operation:

… The million dollar question : Who’s producing these books? Authors who, once they started producing with AI, didn’t stop but instead accelerated.

Cyber Lack of Security

Anthropic describes ways Mythos Preview found to attack cryptographic algorithms. No current production systems are impacted but this significantly weakens HAWK, cutting its key strength in half, and introduces a way to attack round-reduced AES. The flaws are in the algorithms themselves, not in the implementations.

Anthropic: Mythos Preview developed a practical attack that can recover a 13-round LEA key in under 230 encrypted plaintexts, and that runs in under an hour on a modern desktop computer. Again, this attack does not apply to the 24-round cipher, and so has no immediate practical consideration.

File this under ‘the AIs will find weaknesses that you did not consider’ and also as another example of Mythos being different.

Ah, 2026:

I have seen a bunch of ‘oh I could make this test work with an air gap’ claims, including by Fable 5, but in practice the labs are clearly unwilling to pay the associated costs, and they are not going to be able to air gap the system during practical use. So you need a sandbox.

Hadas Gold: . @elonmusk says he told @demishassabis he wants leading AI companies to have a regular call every few weeks to "discuss any safety and security issues"

he also says Dario Amodei is a “principled” person and no