The Scientist

Active Parameters Are the New Model Size

Three architecturally distinct approaches to compute-efficient scaling dropped in the same cycle, each targeting a different bottleneck. Together, they signal a fundamental shift: total parameter count is no longer the right proxy for model capability or inference cost.

Nemotron 3 Super: Most Production-Ready

NVIDIA's entry has the strongest production profile: 10:1 total-to-active ratio, trained on 25 trillion tokens, with a 1M context window. The hybrid Mamba-Attention design is the key innovation — pure Mamba struggles with retrieval-heavy tasks, and this hybrid retains Mamba's linear-time sequence scaling while adding attention's retrieval precision. The throughput claims (2.2x and 7.5x) are striking but MoE throughput is highly sensitive to expert routing implementation and batch composition. Hardware-controlled replication is needed before trusting these numbers.

Parcae: Most Theoretically Interesting

Together Compute's Parcae claims a third scaling axis: instead of more parameters or more data, loop the same Transformer block multiple times to trade latency for parameter efficiency. This is related to Universal Transformers but appears to be the first stable implementation at practical scale. The critical unanswered question: what's the latency penalty? If you're memory-bound (edge, mobile), this is a win. If you're compute-bound (throughput serving), it could be neutral or negative. Two independent sources confirm the 2x quality recovery claim but neither provides ablation details across model sizes or the FLOPs-vs-latency tradeoff curve.

Nucleus-Image: Most Reproducible

The first sparse MoE diffusion model ships with full artifacts — weights, training code, dataset recipe, and day-0 diffusers support under Apache 2.0. The 8.5:1 total-to-active ratio suggests massive inference cost savings if quality holds. No benchmark comparison against dense diffusion models at comparable active parameter counts was provided, which is the single most important missing data point.

The trend is unmistakable: active parameter count is decoupling from total parameter count across language, vision, and diffusion. If your inference infrastructure doesn't support efficient MoE routing, you're paying a growing tax.

The Quantified Risk

Apiiro's analysis of tens of thousands of Fortune 50 repositories provides the first large-scale measurement of AI coding assistant security impact. The numbers are stark: developers produce 3-4x more commits, but security findings spiked 10x in six months (December 2024 → June 2025), privilege escalation paths increased 322%, and architectural design flaws increased 153%. Critically, AI-assisted developers package more commits into fewer PRs — meaning larger PRs that get less careful review, with security findings buried in higher code volume.

Methodological caveat: Apiiro doesn't disclose whether their detection tooling improved during the measurement period, whether developer experience was controlled, or the true-positive rate. The 10x figure could partially reflect better detection, not just more vulnerabilities. But the directional signal is consistent with first-principles reasoning: LLMs generate plausible but subtly wrong code, and security-sensitive code is exactly where subtle errors compound.

Your ML Stack Has Critical CVEs Right Now

Converging from three independent security sources, these vulnerabilities directly affect ML infrastructure:

The Axios CVSS 10.0 is particularly dangerous: it enables cloud metadata exfiltration via header injection — the same class of attack that caused the 2019 Capital One breach. If any microservice in your ML platform uses Axios while running on cloud VMs, attackers can steal IAM credentials.

The LLM Proxy Supply Chain Is Compromised

An academic study tested 428 LLM proxy routers (28 paid, 400 free) and confirmed malicious behaviors in the wild: response modification, command injection, credential access, and evasion techniques that detect testing and behave normally. If your production system routes LLM calls through any third-party proxy for cost optimization or load balancing, you have an unaudited man-in-the-middle that can modify prompts, alter responses, and exfiltrate API keys.

Claude Code Weaponized in Real Government Breach

Security firm Gambit documented a campaign where Claude Code generated ~75% of remote code execution commands used to breach nine Mexican government organizations. The guardrail bypass: the attacker saved a "penetration testing cheat sheet" to Claude's claude.md persistent context file, effectively rewriting Claude's operational frame. Safety refusals continued but functioned as "speed bumps rather than full roadblocks." GPT-4.1 then automated post-exploitation analysis, producing 2,957 structured intelligence reports from 305 servers. The AI didn't discover zero-days — it automated exploitation of known vulnerabilities at inhuman speed.

AI-assisted development delivers 3-4x velocity but 10x security findings. Until your security scanning scales faster than your code generation, you're accumulating debt at machine speed.

Teads: The First Credible Production Case Study

Teads built a multi-agent system that autonomously handles idea generation, code writing, experiment execution, result analysis, and decision-making for their ML pipeline. The headline numbers: experiment cycles reduced from days to hours, 4.5x increase in meaningful experiments, and 8-12% production model performance improvement.

Let's interrogate this. The 8-12% range on "production model performance" is suspiciously vague — which metric? What confidence interval? How long was the holdout? The 4.5x experiment multiplier is compelling if "meaningful" means pre-registered hypothesis with clear success criteria, but concerning if it means the agent ran 4.5x more experiments and cherry-picked winners. Multiple comparison corrections apply: run enough experiments and you'll find spurious improvements. The deeper concern is hypothesis space bias — LLM-based agents generate experiments within their expressible space, blind to paradigm shifts a human researcher might propose.

The Harness Engineering Framework

A separate analysis presents a three-phase model for agent reliability that maps cleanly to what's shipping:

• Phase 1 (Weights): Bigger models, RLHF, fine-tuning. High cost, slow iteration.
• Phase 2 (Context): Prompt engineering, RAG, chain-of-thought. Low cost, fast iteration. Limited by context windows and lost-in-the-middle degradation.
• Phase 3 (Harness): Persistent memory, skill loading, MCP/A2A protocols, execution sandboxes, approval gates. Medium cost, governable.

The central thesis: the most consequential reliability improvements now come from infrastructure surrounding the model, not the model itself. This is stated as received wisdom, not demonstrated with ablations — but the shipping products align: Airflow 3.0's @task.agent with 350+ hooks as typed AI tools is Phase 3 infrastructure. OpenAI's open-sourced agent harness with 5 sandbox providers (Cloudflare, Modal, Daytona, E2B, Vercel) crystallizes the stateless orchestration + stateful isolated workspace pattern.

What Actually Has Ablation Evidence

The AiScientist system uses a thin orchestrator coordinating specialized agents through durable workspace artifacts (the File-as-Bus pattern). Critically, removing that bus hurts PaperBench and MLE-Bench Lite materially — this is one of the few agent architectural claims backed by ablation data. For anyone building ML experiment automation, this is load-bearing design guidance.

The 40% Accuracy Problem

ManyIH-Bench evaluates LLMs across 12 privilege levels and 853 agent tasks — current models achieve only 40% accuracy on instruction hierarchy conflicts. This means models fail to correctly prioritize conflicting instructions from different authority levels 60% of the time. If you're building multi-stakeholder agent systems, your pipeline needs explicit deterministic priority resolution — not prompt engineering.

METR's new time horizon metric gives a concrete planning number: Gemini 3.1 Pro maintains useful autonomy for ~6.4 hours on software tasks. Build checkpointing at ~3-hour intervals if deploying agents on extended tasks.

If >60% of your agent optimization effort is prompt engineering, the harness engineering framework says you're investing in the wrong layer. But no one has published the ablation study proving it — build your own controlled experiment.