The Scientist

The number that matters for serving math isn't the leaderboard rank. It's 25K output tokens per Intelligence Index task, against 43K for GLM-5.2 max, 38K for Kimi K2.6, and 37K for DeepSeek v4 Pro max. That gap lands on every inference invoice. Roughly 40% fewer output tokens for equal-or-better quality is an edge that survives a cost review.

The architecture is a stack of unconventional bets. Inkling drops RoPE for relative positional bias, wraps attention/FFN in short convolution layers, runs 2 shared expert sinks where most MoEs use 1, adopts DeepSeek's aux-loss-free load balancing, trains with muP plus corrected MuonC/AdamC weight decay, and ships 8 MTP heads for speculative decoding. The 975B-total / 41B-active model scores 41 on the Artificial Analysis Intelligence Index, edging Nemotron 3 Ultra at 38 and well above gpt-oss-120b at 24.

The day-0 inference ecosystem makes this testable now. vLLM serves NVFP4+BF16 at up to 380 tok/s/user on 4×GB200, Modal's DFlash speculator claims +67% throughput, and a causal-conv1d + FlashAttention-4 swap nets about 15% with no retraining. The cheapest entry point is Unsloth's 1-bit GGUF: 270GB, 86% smaller than the 1.9TB checkpoint, retaining 74.2% of top-1% accuracy with vision and audio intact.

Two things temper this before committing. The 'trained from scratch / non-distilled' framing is contested. Critics cite distillation from open weights and Kimi 2.5 SFT traces, and one credible read calls it behind GLM 5.2 on agentic. Trust the token-efficiency numbers and discount the provenance story. Separately, the no-RoPE relative-bias design reportedly has a nastier backward pass, so validate LoRA and long-context behavior before any fine-tune commitment. Note the split: the managed Tinker API caps at 256K context ($3.74/1M input, $9.36 output), while only self-hosted checkpoints reach 1M.

Inkling won't top the leaderboard. Under Apache 2.0, at 40% fewer output tokens, it can win on cost per task. That is a claim about the economics, not the benchmark rank.

A model does not need 'pregnancy' as a feature to learn it. Recent leave, reduced hours, tenure gaps, and benefits-utilization flags are all high-fidelity proxies, and that is exactly the structure in the lawsuit alleging Meta's layoff-scoring system marked lower output during medical, parental, and disability leave as underperformance without normalizing for time away. Strip the HR framing and it is a label-contamination defect: the target variable encodes an artifact correlated with a protected attribute.

The same week, the European Commission preliminarily found that personalized recommendations, not just infinite scroll and autoplay, constitute addictive design Meta failed to risk-assess under the DSA. That moves the regulatory target off the UI shell and onto the recommender objective itself. When a regulator calls an engagement-maximizing feed a harm vector, it is regulating the loss function. This is Meta's second EU breach finding of 2026, and it carries enforcement rather than guidance.

The through-line is that internals treated as implementation detail, the target label and the objective function, are becoming auditable and legally exposed. The audit is cheap and well-established:

• Four-fifths rule: selection rate of the disadvantaged group ÷ advantaged; below 0.8 is a red flag.
• Proxy-leakage test: train a classifier to predict the protected attribute from your 'neutral' features; high AUC means they encode it.
• SHAP attribution review: check whether leave/tenure proxies dominate individual decisions.

For any per-period output feature, normalize by active availability before it becomes a bias vector. For EU-facing recommenders, prototype a well-being-aware objective, a satiation/diversity penalty or session-length dampener, and quantify the tradeoff via offline replay plus a holdout A/B before a consent decree dictates it. The thing these numbers do not tell you is how the cases resolve. Caveat: these are allegations at 0.75–0.85 confidence and a preliminary DSA finding Meta disputes; the failure pattern is real and reproducible regardless.

Both the Meta suit and the DSA finding are live disparate-impact tests for the scoring and ranking models you already own, not an HR story and not a UI story.

The exposure to close before the next repo clone: Cursor on Windows silently executes a file named git.exe planted in a cloned repository's root. Zero clicks, zero approval, disclosed repeatedly over seven-plus months without a fix. ML workflows sit squarely in the blast radius. We clone untrusted HuggingFace mirrors, research code, and Kaggle notebooks constantly, and open them without inspecting the tree. That turns this from phishing-grade into drive-by RCE.

On the agent side, Tracebit built what is effectively an agentic-AI red-team benchmark: a simulated AWS account seeded with 10 misconfigured attack paths, run against five frontier models (Opus 4.8, Gemini 3.1 Pro, GLM 5.2, DeepSeek 4 Pro, Kimi K2.6) over 152 trials. Baseline autonomous agents reached full admin access in 57% of runs and persistence in 36%. Their 'context bomb' defense, short trigger strings embedded in canary secrets that trip the provider's own safety filter and halt the agent, collapsed those to 5% and 1%, with zero attack paths completing without an alert. The thing 152 trials on one account doesn't tell you is per-model variance, which is where you'll actually make a deployment call.

The third piece: Claude's Slack integration responded to literal '@Claude' text posted by bots and automated feeds. No human mention required. That potentially fires retrieval, posting, and deletion in connected systems. Classic indirect injection, where untrusted content becomes an invocation channel for tool-calling logic.

The pattern across all three is trust boundaries treated as implicit: a cloned repo is inert until run (Cursor breaks it), an agent's permissions are gated by intent (Claude/Slack breaks it), and provider guardrails are a durable control (context bombs prove they're the defense, and the single point of failure). Caveats: Cursor's flaw carries no published CVE; Tracebit is a vendor with commercial stake, one account, no per-model breakdown, and a defense entirely dependent on providers keeping filters strict.

Your agent's safety is a benchmarkable number, not a vendor promise — if you can't state its escalation success rate under adversarial eval, you don't know if it's safe.