The Scientist

What co-training does to a paired design

Standard agent evaluation holds the scaffold fixed and varies the model. That is a clean paired design, and it isolates the model effect. A system with its loop behavior trained into the weights takes that lever away. What is being compared is no longer models, it is (model x scaffold) treatments, and the results doc still says 'model A beat model B'. That is textbook confounding, and it stays invisible as long as scaffold identity is not logged as a factor.

The mitigation is a schema change rather than a research project. Make scaffold_version and a tool-registry hash mandatory fields on every agent eval run, then re-analyze the most recent cross-model comparison with scaffold entered as a factor. A week of work either confirms the conclusion that already shipped or shows it was a system delta wearing a model label.

The evidence ceiling here is low. TheSequence's reading rests on a section heading in Meta's release, with the substantive analysis paywalled: no benchmark numbers, no ablations, no sample sizes. Treat it as hypothesis generation, pull Meta's own write-up and model card, and check whether any published gain is attributed to the loop or to the weights.

The other end of the squeeze

Prime Intellect open-sourced Prime Agent the same week, which puts scaffolding under pressure from both directions: free below, trained-in above. The cheap experiment is a paired spike, same base model, same task suite, same tool interface, with the harness as the only varied factor, reporting per-task paired deltas and a confidence interval on the success-rate difference. If an open harness lands within noise of an in-house loop, that is a mandate to delete orchestration code and move the headcount to evals and task datasets, which is the part nobody is open-sourcing for you.

Then score coupling on every agent surface with two questions. Can the base model be swapped without rewriting the loop? Can the loop be upgraded without a retrain? A co-trained system can take peak task success on the research leaderboard while converting config changes into training cycles, and that iteration-velocity tax appears on no benchmark.

The same layer is where the breaches land

CSO's reporting places most agent compromises in the harness -- tool integrations, orchestration, glue code -- rather than in the weights, and notes that most organizations have zero observability at that layer. If that holds, the standard safety suite of refusal rate, jailbreak success rate, and red-team pass rate instruments the model while the exploitable surface sits in application code.

The concrete additions are unglamorous. Log tool name, full arguments, caller identity, and outcome for every invocation into the same store as model traces, then run out-of-distribution detection on argument patterns with the anomaly machinery already pointed at feature drift. Report containment rate -- the fraction of successful injections that never reach a privileged tool call, subprocess, or write path -- next to refusal rate.

Two caveats keep this honest. The harness attribution is 'usually', with no paper, no incident count, and no ablation separating harness bugs from model-induced tool misuse, so believe the sign and distrust the magnitude. The third pointer at this layer, a survey of 101 enterprises via VentureBeat attributing many confidently wrong answers to bad context, reports a detection rate for governed semantic layers rather than an error rate, and mature shops have both. Confidently wrong is also partly a calibration defect, which puts expected calibration error and a coverage-risk curve beside accuracy.

If scaffold identity is not a logged factor, your cross-model agent benchmark varies two things and reports one.

The joint, not the marginals

Most model-selection processes compute two independent marginals: a quality score from a public benchmark, and a price from a vendor pricing page. Effective cost is the joint. Expected cost per resolved task is input price times input tokens plus output price times output tokens, multiplied by attempts to success, divided by success rate. Three multiplicative terms sit downstream of price. None of them appear on a price sheet.

Work the arithmetic once and the ranking stops being obvious. A model 4x cheaper per token that emits 1.6x more output tokens, from verbose reasoning with no early termination, and resolves 60% of tasks where the incumbent resolves 80%, lands at roughly 1.9x cheaper: 4 divided by (1.6 x 1.33) is 1.88. That is before pricing human review of the extra failures. In an agentic loop the terms compound. Per-turn token overhead multiplies across turns, and lower per-turn reliability raises the expected number of turns before termination. A standard benchmark harness cannot see this mechanism, which makes it the most plausible one behind the reported finding.

Why both readings survive

The Information's reported analysis says premium models can be cheaper. One favorable task class satisfies that, so it is an existence claim, not a distributional one. The honest version is stronger and less quotable: effective-cost rankings are task-mix dependent and non-transitive across workloads, and they invert between short classification and long-horizon coding. That argues for per-task-class routing measured in house, not for any vendor. With the sponsor undisclosed and no task mix, n, prompting strategy, temperature, or retry policy published, the finding does not belong in an architecture or procurement document yet.

What it costs to settle internally

Power first. Detecting a 10-point success-rate gap from a 70% baseline at 80% power and alpha 0.05 takes roughly 290 tasks per arm. Resolving a 5-point gap takes about 1,250. Pairing, meaning the same frozen task set through every candidate, removes task-difficulty variance and cuts the required n meaningfully. Sample the tasks from production traffic, not from a public suite.

Then report the distribution instead of the mean. Token spend is heavy-tailed and one runaway trajectory dominates an average, so publish p50, p95, and a bootstrap confidence interval on mean cost per resolved task. The p95 is the capacity-planning number, the mean is the finance number, and a single average serves neither. Self-hosted open weights need a third column: GPU-hours divided by achieved throughput and utilization, including idle burn and eval overhead, with an explicit break-even QPS.

The profit-and-loss evidence already landed, which is what makes this timely. Canva reports cost per task down roughly 90% since Canva AI 2.0 shipped in April, achieved by re-architecting rather than shipping features, while cutting growth guidance by a third to 20%. Figma's free-cash-flow margin fell from 27% to 14% in a single quarter. Caveat the 90% properly. Cost per task is unaudited and exposed to denominator drift, since a task-mix shift toward cheaper operations produces the same ratio with zero engineering. Treat a 10x gap between a naive and an optimized inference path as an upper-bound hypothesis to test on your own stack, not a target someone else has proven.

A price per token and a leaderboard rank are two marginals pretending to be a decision.

The number nobody in this debate has published

Start with the arithmetic, since it is not in dispute and it constrains everything downstream. Positive predictive value equals true-positive rate times prevalence, divided by that same product plus false-positive rate times one minus prevalence. Take a charitable operating point of 95% true positives and 5% false positives. At 30% machine-written prevalence, precision is 89%. At 10% it is 68%, so one flag in three is wrong. At 2% it is 28%, so most positives are false. A vendor AUC does not inform this decision. Precision at measured prevalence does.

Then there is the datapoint suggesting the real operating point is worse than charitable. The a16z essay's author ran Pangram against his own blog posts from 2019 and 2020, written before ChatGPT existed, and several came back at 70-75% 'AI Generated'. That is not threshold-tuning noise. A classifier scoring pre-LLM human prose that high has learned a stylistic register and is reporting it as provenance.

The test itself is weak evidence and should be handled as such. Unblinded, single-author, n reported only as 'several', threshold undisclosed. At three positives out of five documents, the Wilson 95% interval runs roughly 0.23 to 0.88, which supports neither a policy nor a dismissal. What it supports is running the real experiment. Roughly 200 documents buys plus or minus 3 points of precision against a 5% false-positive rate; resolving a 1% rate to plus or minus 0.5 points takes about 1,500. Two days of work. Nobody in this discourse has published it.

Where the signal is moving

Frontier labs are pivoting to watermarking at the source. That is an architecture change, not a tuning change: inference-time stylometry out, provenance metadata emitted by the generator in.

The underrated payoff of that schema change sits upstream of any enforcement policy. A provenance field on content and training-data records is a deterministic filter for excluding synthetic text from scraped fine-tuning corpora, which remains the only real hedge against training on a model's own exhaust.

The same defect, inside a clinical model

The same failure shows up with no detector involved. In a lung-cancer cohort, only 46% of 7,186 patients met USPSTF pack-year eligibility criteria. A screening model trained on the screened cohort inherits a 54% blind spot, and its in-cohort AUC is measured on a population the deployed model will never encounter. The 2026 GOLD report's first dedicated AI chapter moves that from hygiene to governance artifact.

Both failures have one shape: the negative class was never sampled, so the reported metric cannot be wrong in any way the report would surface. Eligibility rules are label filters. A verified pre-2021 corpus is a negative-control set. Credit pre-approval and claims adjudication are the same structure with different paperwork. The fix generalizes. Sample the population you will actually score, or carry inverse-probability weights plus a documented bias audit.

One adjacent hazard earns a standing rule. The same essay notes that models are all-too-eager to declare a set of topics 'one big idea' and are suspiciously confident that two ideas are deeply related. An assistant that never returns a null result is a hypothesis generator with no type-I error control. Pre-register every model-suggested relationship, test it on a held-out split, and log the replication rate as a metric of the tooling itself.

A detection gate that has never been scored against a verified human corpus is a style preference with a confidence number attached.