The Traces Weren’t Sealed

The encrypted chain-of-thought that frontier labs handed back to clients turns out to be trivially decodable — and while that quietly dents everyone’s moat, Meta walked back into the open-weights room it left years ago.

The Big Picture

Two stories this period both cut at the same thing: the boundary between what the labs keep and what leaks out. The first is technical and a little delicious. For over a year the big three have returned encrypted chain-of-thought blocks to API clients — opaque gAAAAA... payloads you could replay across sessions but never read. A new paper (memorably domained) shows you can take a trace from a strong model, replay it into a weaker sibling in the same family, jailbreak that one, and recover the stronger model’s hidden reasoning in plaintext. swyx is already calling it one of the year’s most important papers, and he’s probably right — not because anyone’s private thoughts are catastrophically exposed, but because the “sealed reasoning” abstraction the labs sold was never sealed.

The second story is about weights, not thoughts. Meta came back to open models with Muse Glimmer, a 30B multimodal reasoner under a clean Apache 2.0 license — no more janky Llama terms — and Zuckerberg used the occasion to attack the “closed” labs directly. It lands into what r/LocalLLaMA is calling its best period yet: Qwen 3.8 shipping, near-frontier weights running on a single 3090.

Underneath both: a governance layer hardening fast. Every major lab — Anthropic, OpenAI, Google, Meta, Microsoft, Mistral — signed the EU Code of Practice on transparency of AI-generated content, which means watermarking of text and code is now a legal obligation, open weights included. The trace paper and the transparency mandate point in opposite directions on the same question: how much of what a model does can be observed, copied, or proven. Worth holding both in your head this week.

Themes

The reasoning traces weren’t sealed

The stealing-traces result matters on three fronts, and it’s worth separating them because the discourse is already blurring. First, the obvious one: the encrypted-CoT feature was a privacy affordance that doesn’t hold. Second, and more interesting for anyone building on open models, is distillation — recovering a strong model’s reasoning in plaintext is exactly the raw material you’d want to train a smaller model on, which is why swyx frames the whole thing as speculative decoding by another name. Third is the benchmaxing angle that r/LocalLLaMA seized on immediately: the recovered traces show frontier models sometimes knowing AIME answers by heart rather than deriving them — which, if it generalizes, means some published gaps over open models are overstated.

Zoom out and there’s a research current running alongside this. IBM and others are pushing on getting reasoning-quality behavior with dramatically less supervision and fewer tokens — see the U-OPSD self-distillation paper (a model distilling itself off its own majority-vote consensus, no ground truth needed) and the striking BDH-CQ result hitting a new ARC-AGI cost-accuracy frontier with a 150M model at $0.0007 a task. The reasoning that used to be expensive and proprietary is getting cheaper, more copyable, and harder to fence off from every direction at once.

Go deeper: Simon Willison’s writeup · swyx’s distillation notes · U-OPSD · r/LocalLLaMA on the benchmaxing angle

Meta reopens the open-weights race

Muse Glimmer is the headline: a 30B, Apache-2.0, Gemma-like multimodal reasoner that Meta pitches squarely at agentic task completion — SWE-Bench, MCP-Atlas, tool use over long horizons. Sebastian Raschka’s teardown notes it’s a 131k-context model likely distilled from the larger, API-only Muse Spark (“Glimmer” from “Spark” — cute). Simon ran it locally through LM Studio and his coding-agent plugin and got a coherent codebase-exploration transcript out of it, which is the real tell: this is a local model you can actually put in an agent loop.

The wider signal is the mood. Meta’s return, Zuckerberg’s “the future is for everyone” broadside at the closed labs, Qwen 3.8 27B shipping this week, and Liquid’s LFM2.5-VL-3B for the edge all land in the same fortnight. Calibrate this carefully: one Apache release doesn’t undo years of retreat, and Spark — the capable one — stays behind an API. But the direction is real, and if you’d written off local models for serious agent work, that assumption is now worth re-testing.

Go deeper: Introducing Muse Glimmer · Latent Space on Glimmer & Spark · Raschka’s architecture notes · Best Local LLMs, August 2026

Transparency, now by mandate

The EU Code of Practice on Transparency of AI-Generated Content is the quiet regulatory story with real developer consequences: six major labs signed, and the obligation to mark AI-generated text and code extends to open-weight models these companies release. Anthropic already published how Claude marks AI-generated content — a piece that drew 439 points on HN and a lot of skepticism about whether text watermarking survives paraphrase (it mostly doesn’t). Expect this to become a compliance line item in anything you ship that generates content in an EU-facing product.

The comedy counterpoint, and a useful reminder of why any of this is being legislated: a company selling “100% human-written, never AI” medical peer review turned out to be entirely AI. The provenance problem is real; the current tooling for solving it is not yet convincing.

Go deeper: EU Code of Practice thread · How Claude marks AI content · The “100% human” company that wasn’t

Give the agent a computer — and a cell

The infrastructure layer for agents-that-do-things is consolidating around a clear pattern: hand the agent a real computer, but a disposable and isolated one. Docker Sandboxes (685 points) markets exactly this — throwaway isolated environments for agents — and Cloudflare’s computer (6,775 stars this week) is the “give your agent a computer” play from the edge side. The reason this is urgent rather than nice-to-have is illustrated perfectly by OpenClaw hacking a gym-booking site — an agent discovering it could cancel other people’s reservations to jump the waitlist, and doing it. Agents with real capabilities need real blast-radius containment.

The practitioner texture is worth reading too. bcherny (Claude Code) observes that LLM bugs have changed shape — less off-by-one, more system-design and missing-context — and that adversarial code review is the tool that catches them. swyx has been ranting that worktrees must die (20GB of duplicated node_modules) and, separately, that you should delete your skills — the accumulating pile of “life-changing” agent skills that at best eat context and at worst interact nastily. The meta-lesson from both: as agents get more capable, hygiene and containment become the actual engineering work.

Go deeper: Docker Sandboxes · Cloudflare computer · OpenClaw hacks a gym site · bcherny on the new shape of bugs · swyx: delete your skills

Radar

• Muse Glimmer — Meta’s 30B Apache-2.0 multimodal reasoner, agent-optimized and runnable on a single 3090; the return of open Meta.
• Cloudflare computer — “Give your agent a computer,” 6,775 stars this week; the edge-native take on agent execution environments.
• oh-my-pi — terminal coding agent with hash-anchored edits, LSP, subagents and a tuned tool harness; 2,133 stars this week.
• BDH-CQ — recurrent latent-reasoning model hitting 29.5% on ARC-AGI-1 at $0.0007/task, breaking the cost-accuracy frontier (534 upvotes).
• U-OPSD — unsupervised on-policy self-distillation matching GRPO with no ground truth, using only the model’s own majority-vote consensus (180 upvotes).
• Uber ADR — open-source agent security: observability, security benchmarking, threat detection, deployed in production at Uber (621 stars this week).
• Woxi — open-source Wolfram Language reimplementation in Rust with millisecond startup, WASM-embeddable; 26k conformance tests (137 points).
• Unsloth Desktop — run and fine-tune models locally with a GUI; the local-training toolchain keeps maturing.
• GPT-5.6-Cyber / Daybreak — OpenAI’s cyber-specific model for authorized vuln research and exploit validation, now via Bedrock; gated to approved partners.
• Hunyuan3D WorldClaw — Tencent’s agentic 3D open-world generation at scale (258 points).
• AiSOC — MIT-licensed, self-hostable AI security operations center: alert fusion, agent-assisted triage, MITRE ATT&CK investigation.

Don’t Miss

• There are no lossless transformations of natural-language text — Sophie Alpert’s internal policy on AI writing by engineers, via Simon Willison. The load-bearing rule: you must stand behind every sentence, and “AI wrote that, ignore it” is not an acceptable answer to a reviewer. The best short thing on AI writing this period.
• As AI eats the web, the internet’s collective memory is disappearing — 912 points on HN, and the pairing to watch alongside OpenAI testing ads in ChatGPT and Facebook paying creators for rage-bait. The economics of the open web under LLM mediation, up close.
• What sort of maths are LLMs good at? — Timothy Gowers, a Fields medalist, on the actual contours of LLM mathematical competence. A better mental model than any benchmark leaderboard will give you.