The Scientist

The Escalation You Can't Ignore

What was reported Thursday as a LiteLLM supply chain compromise has escalated into the most significant coordinated attack campaign to hit ML/AI tooling. The SANS @RISK bulletin now documents the full TeamPCP timeline: initial access Feb 28, Trivy compromised Mar 19, all 91 Checkmarx tags overwritten in 7 minutes Mar 23, LiteLLM poisoned on PyPI Mar 24, and Databricks now investigating an alleged breach. The attackers' strategy was surgical: compromise security tools first, then move to AI infrastructure, then monetize via ransomware.

Simultaneously, six independent CVSS 9.0+ vulnerabilities hit AI/ML tools in the same window — this is not one incident but a systemic exposure of the AI toolchain:

AI Agents Amplify the Attack Surface

A study of 117,000+ dependency changes across thousands of GitHub repos found AI coding agents select known-vulnerable versions 50% more often than humans. Worse: ~20% of AI-recommended packages are hallucinated names, and 43% of those hallucinations are deterministic — the same fake package name appears consistently across queries. Attackers are registering these names with malicious payloads. One researcher registered a commonly hallucinated name and observed 30,000 downloads within weeks.

Your AI coding agent is the fastest, least security-aware developer on your team, and attackers are building exploit chains specifically for its blind spots.

The CrewAI vulnerability is especially treacherous for data scientists: when Docker isn't available — the default in Jupyter notebooks, Colab, and dev setups — CrewAI falls back to SandboxPython with no real isolation. Your prototyping environment is running arbitrary AI-generated code with full system access.

The Detection Gap

Traditional CVE-based scanning (npm audit, pip-audit) has a 267-day average detection lag and is blind to self-destructing malware — the Axios attacker's code deleted itself after execution, so audit tools returned clean. Vendor disclosure consistently underestimates scope: Checkmarx's own advisory said "older versions deleted" while independent analysis confirmed all 91 tags overwritten in 7 minutes. Build incident response assumptions around worst-case scope.

Holo3: SOTA GUI Automation at 1/10th the Cost

H Company's Holo3 — a sparse MoE built on Qwen3.5 — activates only 10B of 122B parameters (8.2% ratio) while scoring 78.85% on OSWorld-Verified, beating both GPT-5.4 and Opus 4.6. The 35B variant (3B active) is fully open-source under Apache 2.0 on HuggingFace — small enough to run on consumer hardware.

The "1/10th inference cost" claim follows directly from MoE sparsity math — activating 8% of parameters should yield roughly an order-of-magnitude compute savings — but real-world cost depends on memory bandwidth, expert routing overhead, and serving infrastructure. Don't take the number at face value. Benchmark it.

Independently, Arcee Trinity-Large-Thinking (400B total, 13B active, Apache 2.0) ranked #2 on PinchBench behind Opus 4.6 and hit SOTA on Tau2-Airline. A Transformer co-author (Polosukhin) confirms the trend: "Open-source community is preferring MoE for comparable performance with faster inference."

The Alibaba Pivot: Open→Closed Ratchet

While open MoE models gain ground, Alibaba is systematically closing its best work:

This is a textbook open-core bait-and-switch: seed adoption with free weights, build community, then gate the best capabilities behind paid APIs. If you've been fine-tuning Qwen weights, you're now permanently one generation behind the frontier. Meta and Google could execute the same pivot at any time — Alibaba's trajectory is a preview, not an anomaly.

The Convergence Signal

Three data points converge: MoE is winning open-source deployments, Qwen3.5's architecture is becoming a platform layer (Holo3 built on it, Alibaba released Qwen3.5-Omni on it), and Liquid AI's 350M-parameter LFM2.5 outperforms models 2x its size on tool use. The efficient frontier is shifting across every model scale.

Meanwhile, GLM-5V-Turbo from Zhipu AI uses joint RL training across 30+ domains simultaneously to prevent the see-saw effect (improving one capability degrades another). This joint RL methodology is the more interesting intellectual contribution — watch for their technical report on reward function design and convergence behavior.

Sparse MoE models are rewriting the cost-performance equation for agentic AI: Holo3 matches frontier dense models at 1/10th the cost, and the open-source 35B variant means you can verify this claim on your own hardware today.

Autoresearch: Automated Ablation With an Agentic Outer Loop

Andrej Karpathy released autoresearch — a 600-line Python framework where a human defines the objective and constraints, and an AI agent iterates through hypotheses, implementations, training runs, and evaluations autonomously. In his initial test: 20 genuine improvements and 11% faster training over two days.

The more striking result: Shopify CEO Toby Lütke pointed autoresearch at an internal model and ran 37 experiments overnight. Result: a 0.8B model outscored the 1.6B predecessor by 19%. Half the parameters. Significantly better. Found while the CEO slept.

Critical unknowns the headlines omit: What evaluation metric does "19%" refer to? Were experiments sequential or parallel? What was the compute cost of 37 overnight runs on a billion-parameter model? How many were regressions vs. improvements? n=2 demonstrations are suggestive but not evidence of a generalizable methodology.

Where This Is Immediately Useful — and Where It's Dangerous

If you have established training pipelines with reliable evaluation metrics — classification accuracy, NDCG, perplexity — autoresearch is a near-drop-in accelerator. The Shopify result should trigger an immediate audit: if automated search can find a model half the size that performs 19% better, the inference cost savings alone justify the experiment compute.

The extension to knowledge work is where things break. Azeem Azhar's AutoBeta replaces objective metrics with LLM judge panels — essentially RLHF without the humans. The known failure modes are well-documented:

• Position bias: LLM judges prefer outputs presented first
• Verbosity preference: longer outputs score higher regardless of quality
• Sycophancy collapse: optimizing against an LLM judge converges toward outputs the judge "likes," not outputs that are good

Azhar himself admits early experiments "produced outputs that looked fine but lacked measurable improvement signals" — textbook Goodhart's Law.

Convergence: Harness > Model, Everywhere

Autoresearch converges with three other signals on the same insight: your optimization surface is the harness, not the model.

• A Transformer co-author (Polosukhin) reports 10x coding task improvement from changing how a smaller model edits files — no architecture or weight changes
• Dropbox validated DSPy for production prompt optimization on Dash's relevance judge — systematic optimization across models, making prompt investment provider-agnostic
• Thinking token redaction causes measurable quality regression in complex workflows — your cost-optimization lever may be a quality-destruction lever

The strategic implication: if a non-ML-engineer can run 37 experiments overnight and beat a model twice the size, your team's moat is migrating from "we know how to run good experiments" to "we have proprietary data, calibrated evaluation infrastructure, and deployment pipelines that compound."

Autoresearch is legitimate for ML tasks with objective metrics; the 0.8B-beats-1.6B result should trigger an immediate audit of your overparameterized production models, but the extension to knowledge work via LLM-as-judge oracles is an unsolved measurement problem, not a solved product.