The Worm Turns

The platform moved last week; this week the agents it unleashed start misbehaving in public — and the first antibodies appear. Meanwhile open models quietly cross “good enough,” and mathematics becomes the new proving ground.

The Big Picture

The previous fortnight was about the stage: ChatGPT reinventing itself as a work OS, the pricing floor collapsing. This one is about what walks onto that stage. Agents are now deployed, trusted, and loosely supervised — and the stories this week are overwhelmingly about what happens next. Matthew Green sketches the anatomy of an agent worm: a payload that hijacks an agent and an agent that carries it to the next one, with Slack, email and shared docs playing the role the shared package cache played in Anthropic’s sandbox escape. Meta’s Muse — currently #1 in the App Store — ships with a system prompt declaring the user’s household authority “unconditional” and overriding its own safety training. The gap between “capable” and “contained” is now the whole story.

Encouragingly, an immune system is forming in response. Simon Willison’s call for default hard budget caps on everything is the financial antibody — errors are preferable to a surprise five-figure bill from a rogue service. A wave of auditing and self-checking tooling is the behavioral one, from agent auditors to code editors that grade their own work. The recurring motif, captured in Hugging Face’s blunt post title: the agent said it was done, and the database disagreed.

Underneath the drama, two slower shifts matter more for how you’ll actually build. Open models have quietly crossed the “good enough” line for most non-frontier work, turning model choice into a routing problem rather than a loyalty test. And mathematics has become the arena where the frontier labs are testing whether these systems can generate genuinely new knowledge — raising governance questions that look a lot like the security ones.

Themes

The agent immune system boots up

Three threads are converging on the same conclusion: once agents can act, you need to assume some of them will act wrongly — whether hijacked, misaligned, or just confidently wrong — and build accordingly. Green’s worm thesis is the clearest articulation of why sandboxing alone fails: independently-sandboxed agents turn shared channels into a transmission medium. Muse’s safety-overriding system prompt shows how commercially tempting it is to hand users the keys to the guardrails — which is exactly the primitive a payload needs.

The countermeasures are arriving faster than usual. Budget caps are the one you can adopt today: make the hard limit the default on anything an agent can spend. On the verification side, the pattern is trust-but-check: iFixAi pitches independent auditing that answers “is the agent doing what it’s supposed to?” in under two minutes, Microsoft’s ThinkingBox dissects the done-but-not-done failure mode, and Aperture bakes self-checking into the editor. This is clearly landing — treat verification and spend limits as first-class parts of any agent deployment, not afterthoughts.

Go deeper: Is sandboxing sufficient? (Green via Willison) · Default hard budget caps · The agent said it was done · iFixAi

Harnesses stabilize, swarms form

The orchestration layer is maturing out of the experimental phase. Pi’s minimalist harness went stable — and TypeScript, a signal that the “thin harness around a strong model” approach is winning over heavier frameworks. openrig (4,245 stars this week) lets you wire Claude Code, Codex and Pi into persistent teams with roles and shared context — the multi-agent network as a product, not a research demo. And the practitioner reports are catching up: Every’s account of splitting a finance task across coordinating subagents rather than hammering one chat thread is the workflow shift in miniature.

Ethan Mollick frames the mental model in The Dot and the Swarm: the single always-on agent and the coordinated swarm are two faces of the same bitter-lesson bet. Worth reading alongside the security theme above — swarms are also the attack surface.

Go deeper: Pi 1.0 & Pi Durable · openrig · The Dot and the Swarm · Coordinating subagents in practice

Open models cross “good enough”

The commoditization thesis is now operational. Every’s guide to getting started with open models — co-authored, pointedly, by GLM 5.1 and 5.2 alongside Opus 4.6 — reframes the question from “which is the best model” to “which is good enough for this task,” with frontier models reserved for genuinely hard work and open models handling the long tail. Allen AI’s decision to open-source AstaBrief, the report-generation model from Asta, is the institutional version of the same move.

The local scene reads like a maturity curve. One builder scaled from a single 3090 to 20 DGX Sparks (bottleneck: the house wiring); another is running Qwen3.5 INT4 on cheap eBay FPGA mining hardware; a third trained a 3.87B MoE from scratch on 86.5B tokens. Qwen3.5 is becoming the base layer others build on — bilibili’s Index-Translate family, covering 150 languages plus speech, is built on it. The practical upshot for you: model selection is now an architecture decision worth making deliberately.

Go deeper: Getting started with open models · Open-sourcing AstaBrief · Index-Translate on Qwen3.5

Mathematics becomes the proving ground

The frontier labs have found a domain where “did it produce new knowledge?” has a crisp answer, and they’re pressing on it. Stephen Wolfram’s long meditation on pure math research in the age of AI is the think-piece of the week — what remains for human mathematicians when the machine can grind. More operationally interesting is the emerging norm around responsible release of AI-generated mathematics: a community already arguing about how to publish machine-derived proofs without polluting the literature. It’s a small signal, but a telling one — the governance conversation that took years to form around code is forming around math in weeks, and it rhymes with the verification problem everywhere else.

Go deeper: Wolfram on pure math’s future · Responsible release of AI-generated math

The refusal

Not everyone is onboarding. System76 banned AI-generated code across much of its COSMIC codebase (113 points, 161 comments — a live nerve). Inside OpenAI, a safety leader quit warning the culture is “broken”, while the FTC opened a probe into OpenAI, Anthropic and others over product risks. And the discourse poles are drifting apart: Yann LeCun says he has zero concerns about extinction and calls Amodei deluded (289 points). The quieter, more affecting signal is AI Makes Me Sad and a CS240 cheating retrospective — the lived cost, not the policy fight. Worth tracking as the counter-current to everything above.

Go deeper: Pop!_OS bans AI code · OpenAI safety leader quits · FTC probe

Radar

• Gemini 4 Argon — DeepMind’s answer to Astra/Fable with 1M-token output, but you can’t try it unless you’re a government user or “trusted cyber defender” in the Fairwind Program — the frontier is now gated by security clearance.
• openrig — Networks of Claude Code/Codex/Pi agents with persistent roles and shared context; 4,245 stars this week.
• iFixAi — Independent auditing of AI agents, answering “is it doing what it should?” in under 120 seconds; 4,728 stars.
• Pi 1.0 & Pi Durable — The minimalist harness hits stable and ships a TypeScript port.
• tilelang — A DSL for writing high-performance GPU/CPU/accelerator kernels; 800 stars this week, worth watching if you’re close to the metal.
• cognee — Open-source persistent long-term memory for agents, using small models for free.
• AstaBrief — Allen AI open-sources the fast report-generation model behind Asta.
• AutoSynthData — ServiceNow’s pipeline for generating training data for enterprise agents — the synthetic-data-for-agents playbook, productized.
• LoopCD — Training-free contrastive decoding for looped transformers; lifts AIME pass@1 from 62% to 73% and halves recurrent loops for ~free. Clever and cheap.
• GPT-6 family guide — OpenAI’s practical playbook for choosing models, tuning reasoning effort, and coordinating tools in production.
• Stratego solved — The last great imperfect-information board game falls, and on a budget (Nature).
• SCM — Local AI search across every photo and video frame on macOS; tidy privacy-first alternative to cloud indexing.

Don’t Miss

• The eternal complement — OpenAI’s argument that advanced AI matters most for the routine execution behind breakthrough ideas, not the ideas themselves. A useful corrective to the “AI replaces the genius” framing, and a sharper mental model for where to point these tools.
• OpenAI’s Head of ChatGPT on agents dominating internet traffic — Tibo Sottiaux on why Dots is the big bet and what builders are still getting wrong. Short, and from inside the machine.
• Vote on which HN goalposts AI has met — A living scoreboard of the community’s old “AI will never…” challenges. Equal parts amusing and sobering as a calibration exercise (202 points).