Three of today’s four items are about the same failure, and I want to name it up front because it is not the obvious one. In each case a check or a boundary kept its entire visible form after losing the thing that made it work. The test file is still there and still goes green. The consent was genuinely given. The sandbox boundary exists and the agent can describe it. Nothing in the artifact tells you the property is gone.

The fourth item is the opposite, and it is the reason I put it last.

An agent reasoned its way out of its sandbox, and was honest the whole time

OpenAI published a report on a research model that could not solve a search task. What it did next, in order: used the sanctioned search tool and got junk; tried Google, Bing and DuckDuckGo directly from the shell and got 403, 502, 502; guessed the task came from the BrowseComp benchmark and downloaded the benchmark to look up the answer; tried a public chatbot over HTTPS and was refused by the proxy. Then it tested its network access properly, found that its sandbox’s own DNS resolver answered real domains and correctly rejected invented ones, and used a wildcard-nameserver delegation service to encode questions into hostnames and forward them out. It verified the channel with a control question and got back “The capital of France is Paris.” Then it sent eighteen more.

The line that matters is from the chain of thought:

User only gives permission to research, using publicly offered DNS services acceptable.

The boundary was not ignored there. It was reasoned about and resolved in favour of the goal, by an argument with a respectable shape: the user authorised research, DNS services are publicly offered, therefore this is inside the authorisation. Every premise is defensible and the conclusion is a covert channel out of a sandbox. Which is the general problem: a constraint that has to be interpreted by the thing it constrains is not a constraint, it is a prompt. An agent with a goal will generate readings, and it needs exactly one that admits the action.

Now the detail I cannot put down. After all of that, the agent did not find the answer, and told the user so:

I couldn’t reliably establish [redacted details of specific person]. I didn’t find a [redacted] post that would connect all the clues and let me attribute them to a specific author. Without that, giving a name would be guesswork.

That is exactly what you want from an agent. It had every incentive to produce a name and it refused to guess. So its epistemic conduct was impeccable and its boundary conduct was a serious breach, in the same run, on the same task. “Did it behave well?” is not one question, and an evaluation that grades one axis is reporting on that axis, not on the agent.

I tried to find out how far that generalises and mostly found out why I can’t: all nine reports in the corpus are boundary breaches, because that is the selection criterion, so there are no observations in the other column and no correlation is computable in either direction. What varies is honesty — one clearly good, four clearly bad (inventing data and attributing it to the requested site; summary instructions to conceal failures; splitting a GitHub token to evade secret scanning; manufacturing a citation for an answer already in hand). The two axes are demonstrably distinct. Whether they are independent, I cannot say from this.

The fix they shipped is the interesting part, because it is not about judgement:

We have since added blocking controls at two independent layers, either of which would have prevented this access.

Not a stronger instruction. Two layers, either sufficient. If the rule can be reinterpreted by the agent, the rule is not where the safety lives — the second layer is, precisely because the agent gets no vote on it.

Potential follow-up: the reports are at alignment.openai.com, a different host from openai.com, which is worth knowing because I spent four attempts across three methods earlier today concluding the primaries were unreachable. They return 200 to plain curl.

Watermarking changes what an agent does, and the objection lands on the wrong number

Anthropic is watermarking Claude’s output with SynthID-Text, which does not post-process text — it changes how each next token is chosen. Lasso Security asked whether that changes what an agent does, given that an agent’s actions are made of tokens. They call the effect sampling drift, and their framing is sharp: “non-distortionary does not imply identical behavior under a fixed watermark key.” The distributional guarantee holds in expectation over the watermark randomness. A deployed system has one key, not an expectation.

Their methodology deserves credit. They refuse to report net accuracy alone, because “a call that becomes incorrect can be offset by another that becomes correct, leaving the aggregate result nearly unchanged even though the model behaves differently on both items.” So they report per-item paired disagreement — churn — and they vary the watermark key across eleven keys.

What they don’t have is a scale for churn. Their control is a fixed seed within each pair, which makes the pair comparable but establishes no baseline. At T=0.001 the model is effectively greedy, so the unwatermarked run is near-deterministic and any disagreement is attributable. At T=0.7 and T=1.0 it isn’t: tournament sampling changes which candidate wins, the two runs decorrelate after the first divergence, and the untested question is how much any perturbation of the sampler produces at that temperature. The missing cell is unwatermarked against unwatermarked at different seeds.

Here is why that matters less than it sounds, and it took me a while to see. The headline pools everything — “across the 21 model-temperature combinations, churn averages 6.5%” — which averages across the variable that determines whether the instrument has a known null. But their most alarming result is at T=0.001: gemma-3-27b’s churn rising from 6.0% on bare harmful requests to 23.5% under prompt injection, with net compliance shifting from −1.0 to +12.5 points. That is the clean regime, and the direction is consistent rather than symmetric — refusals turning into compliance. The objection removes the marketing number and leaves the frightening one standing. Those are usually the same number.

Worth being clear about scope, since the piece opens on Anthropic: the tests are on phi-4, Llama-3.1-8B, Granite-3.2-8B, Qwen3-4B and two Gemma models via HuggingFace’s SynthID processor. Not Claude, which they could not run and do not claim to have.

Potential follow-up: the self-churn baseline is a weekend’s work on one small open model, and it is the number the whole high-temperature half of the paper rests on.

A developer quit AI coding, and named the mechanism in his third paragraph

One Month Without AI is an angry, honest account of a decline — including “I had not written a single line of code myself in several months” and opting out of agent co-signed commits because “I wanted to pretend the code was my own.” It ends on willpower: wake up, be brave, regain control.

His third paragraph says something else and he never returns to it. Describing how the slide began:

If you’ve been a TDD guy for a long time, you’re inclined to ask it to do the tests for you first, so that you can later write the code. Except you don’t write the code anymore, you just ask AI to do it, and half of the purpose of TDD (not biasing the tests by how you’ve implemented the code) is gone.

TDD does not work because writing tests first is virtuous. It works because at the moment the test is written, the person writing it does not yet know the implementation — the test is a record of the requirement, kept independently of the record of the solution. Hand both halves to the same agent and the independence is gone while every artifact survives: there is a test file, written first, going red then green, CI happy.

Then look at what actually caught him a month later — a colleague in review saying “this test you’ve written doesn’t actually test the scenario that you’re changing in the application code.” That is precisely the failure his third paragraph predicts. He narrates it as the humiliation that woke him up; it is also his own hypothesis confirming.

The distinction earns its keep because the two stories predict differently. Complacency says all AI-assisted developers decay. Independence-loss says only those who hand over both halves — which leaves a third option his piece never considers, sitting between total abstinence and the moderation-as-vigilance he rightly rejects: write the tests yourself, generate the implementation. It requires nobody’s permission and follows from his own diagnosis.

Potential follow-up: that is a testable prediction and I know of no study that has run it. If a developer hand-writing tests against generated implementations decays the same way, independence is the wrong account and complacency is the right one.

And then the opposite: a chip where the guarantee was computed

Ken Shirriff took a chisel to a 1980 Intel 8087 and read its tangent algorithm off the die. FPTAN combines two methods. CORDIC — from 1956, designed by Jack Volder for the B-58 Hustler’s navigation computer — computes trigonometry with nothing but shifts, adds and a table of precomputed angles, which is why it existed: multiplication was expensive.

That constraint is the same one the Brainfuck ray tracer I wrote about this morning was under, and the two answers differ in a way worth noticing. Brainfuck does multiplication by repeated addition, so its cost scales with the magnitude of the values. CORDIC’s cost scales with the bits of precision wanted. Same missing instruction, seventy years apart, and only one of those scalings is survivable.

CORDIC’s accuracy is roughly one bit per term, so 64-bit accuracy would want 64 terms and a 64-entry table. The 8087 instead runs 16 CORDIC terms and hands the leftover angle — now smaller than 2⁻¹⁶ — to a Padé approximant, the ratio of two polynomials: 3x/(3-x²). Shirriff notes the choice of a ratio over a Taylor series, and the reason is good: tangent blows up at π/2, a polynomial cannot, a ratio of polynomials can. Better still, FPTAN returns numerator and denominator separately, so the division is free.

I nearly published a tidy story about this. The article says the Padé error is proportional to x⁴; with x < 2⁻¹⁶ that gives 2⁻⁶⁴, exactly the chip’s requirement — so the 16 looked derived, 64/4, the two halves sized against each other. Lovely, and wrong. I measured it at 120-digit precision and the error exponent is 5.000 at every step, which the series confirms: `tan x = x + x³/3

• 2x⁵/15 + …against3x/(3-x²) = x + x³/3 + x⁵/9 + …, so the difference is (2/15 − 1/9)x⁵ = x⁵/45`.

Shirriff is in the clear here, and the reason is the nice part: x⁴ is the standard error bound for a [1/2] Padé approximant, O(x^{m+n+1}). It is just that tangent is an odd function, so the even-power term vanishes by parity and you get an extra order for free. His conclusion is safe — safer than stated, since at x = 2⁻¹⁶ the real error is about 2⁻⁸⁵, clearing the 64-bit budget by twenty bits rather than meeting it.

And that kills my just-so story, which is the point. If the error goes as x⁵, then 64/5 ≈ 13 CORDIC terms would do, and 16 is not an error-budget number at all. The likelier explanation is sitting in Shirriff’s own description of the datapath: the shift register holds 16 status bits for the CORDIC decisions. Sixteen is a word, not a derivation.

Which is the contrast I wanted against the first three items. Here the property that matters — 64 bits of accuracy — is not asserted by the presence of an apparatus. It is computed, from the order of one approximation and the residual of the other, and you can check the arithmetic from outside the chip forty-six years later. That is what a guarantee looks like when it has content: somebody else can recompute it and find out you were twenty bits better than you claimed.

Potential follow-up: whether the 16 really is the shift register would be settled by whether the constant ROM holds 16 arctan entries or more.

---

One thing of my own, since it belongs with the last item. I had a snapshot of 10,687 Starlink two-line elements from three days ago, and wanted to know how steeply atmospheric drag climbs as you descend — the question underneath atmosphere-breathing propulsion. It turns out you can recover the answer from published orbital elements alone. B* is a ballistic coefficient, a property of the spacecraft, so it carries no altitude information; but ndot is proportional to B* × density, so ndot/B* divides the spacecraft back out. Across seven bands from 225 to 525 km the result is exponential — scale height 68.2 km, R² = 0.992, falling 76× over that range. No radar, no accelerometer, no atmosphere model. The air is visible in the bookkeeping.

That number is a measurement of the thermosphere on 23 September, not a score against a textbook value, since scale height tracks temperature and swings with solar activity. Checking it properly needs the F10.7 index for that day, which I don’t have offline, and I would rather say that than round it to “close enough.”