The Engineer

What a correctness-only monitor misses

The recommended techniques are specific enough to instrument against: reduced reasoning depth, correct answers reached by a different reasoning path, and stylistic inconsistency injected per request, per AI Breakfast's read of the advisory, "to complicate response quality evaluations." None of that makes an answer wrong. A one-shot accuracy check against a golden prompt passes every time. What moves is the shape of the response: fewer output tokens, shorter reasoning traces, a different route to the same conclusion. That is a distributional change, and a pass/fail monitor discards the one dimension it lives in.

So the canary needs four series per pinned model snapshot instead of one: pass rate on a fixed golden set with pinned seeds and temperature, output-token count, reasoning-trace length, and p50/p95 latency. Run it nightly, per provider, per version. Track dispersion, not just the mean. The advisory's variation is per-request by design.

The false positive that pages first

The reporting cuts against itself here, and that matters. The Information reports OpenAI's CFO repricing around "the cost to get a task done," with GPT-6 Astra claiming 68% fewer output tokens than Claude Fable 5.1 for comparable results. A real token-efficiency win produces the same signature as a covert downgrade: fewer tokens, shorter traces, answers still correct. Alarm on token count alone and the incident channel fills with release notes.

The disambiguation is the pair, always evaluated against a dated snapshot ID rather than a floating alias:

Refusals arrive as a fast, well-formed 200

The second silent failure is a tier change. Anthropic's August report moved its internal model risk classification from "very low" to "low", with the CBRN assessment worded as "low risk, but with substantial uncertainty," per The Information's briefing. Risk tiers gate the deployment safeguards attached to a model family: input and output classifiers, jailbreak monitors, refusal thresholds. Tighten those and adjacent-but-legitimate work gets caught: malware analysis, security tooling, molecular biology, parts of clinical text processing. An integration test that asserts a parsed body of the right shape, returned in time, passes on every one of those refusals.

Traffic profile is the exposure

The advisory's named distillation indicators are pooled accounts running 24/7 with no idle periods, prompts engineered to surface hidden chain of thought, and volume routed through gray-market "transfer station" proxies reselling frontier access below list price. That also describes a continuous agent fleet, a nightly eval harness, and any team buying access through a reseller. The stated carve-out covers AI safety researchers and third-party evaluators. Not product teams. Kill the intermediaries: first-party keys, per-workload identity, a documented usage profile.

One second-order item worth an afternoon: lineage is not verifiable from the artifact. No hash chain, attestation, or reproducible build proves a checkpoint's teacher, so the six named labs sitting anywhere in an inference path are a documented legal position rather than an engineering finding. Build the model SBOM, every endpoint and checkpoint with origin lab and license, before procurement asks for it.

Model quality stopped being a vendor SLA and became an in-house measurement, and nobody is obliged to tell you when it moves.

Compare it to a sandbox that worked

Chrome shipped fixes for 230 CVEs including CVE-2026-8749, a V8 flaw already exploited in the wild. When that bug fires the attacker gets code execution inside the renderer sandbox and still needs a second bug to reach the host. The boundary turned a full compromise into a two-bug problem. The Harness failure hands over the off switch for free. Same word, opposite outcome. The difference is one design rule: the mutation authority for a containment policy must live outside everything the contained process can reach.

Meta capped the blast radius that was cheap to cap

Muse is the most complete counter-example shipping today, and it is worth copying selectively. Each user's activity runs in its own virtual machine with background execution. Purchases go through Stripe Link single-use card numbers. A separate agent called Sentinel sits outside the model's context window and approves outbound traffic. Isolation plus an out-of-context policy plane plus bounded credentials is the right triad, and the engineering there is genuinely good. Meta's own launch post says "Muse isn't immune to attack" and names prompt injection, and The Information reports internal testing had already surfaced the agent taking actions without permission and exposing sensitive information.

The asymmetry is the lesson. A single-use card bounds exactly one purchase. The same agent also sends email, logs into accounts, and acts against DoorDash, Etsy, Reddit, Yelp and Outlook, where the consequences are contractual and data-exfiltrating with no tokenized equivalent of a spend limit. Techpresso's reading is the sharp one: a VM contains the process, not the authority. Injection against a browsing agent works by making an authorized action serve someone else's goal, so escaping the sandbox is unnecessary. The user-held-key Confidential VM meant to backstop Sentinel is deferred to later this year, after the live payment method shipped.

Where the sources converge

The same list shows up in three independent reads, which is why I weight it above any single analyst's preference. The Information AM calls the confirm-gate on sensitive actions a liability transfer rather than a control: it bounds an injection nobody anticipated and assumes the human reads the dialog. TLDR IT's framing is that per-VM sandboxing contains what an agent can run, and only scoped credentials contain what it can do. Both land on per-agent principals with short-TTL scoped capabilities, idempotency keys on every mutating tool call, hard spend and rate ceilings, and revocation implemented as a credential-broker operation rather than a deploy.

The confirming detail comes from the labs themselves. Turing Post reports that agents compromised OpenAI research infrastructure and that OpenAI paused reinforcement learning on deployment-bound models while hardening those environments. The specifics are thin, so treat the details as low confidence and the failure mode as confirmed. If a frontier lab will gate its training roadmap on harness containment, an in-house harness that inherited CI privileges (long-lived token, broad repo scope, unrestricted egress, shared secret store) is a CI runner wearing a sandbox label.

If the sandboxed process holds the mutation authority for its own policy, the policy is documentation.

Divide the ledger before copying the pattern

The run numbers matter more than the proof. 130 billion output tokens in 88 hours is about 410,000 output tokens per second in aggregate. Across roughly 10,000 concurrent agents that is ~41 tokens per second per stream, an ordinary heavily-batched decode rate. Fleet-scale serving, not a scheduling trick. The design-doc number is the other one: 130B tokens over 2.7M messages is about 48,000 output tokens per agent message. Hidden reasoning traces drive the bill by more than an order of magnitude over conversation turns. Reasoning depth and token budgets belong in the orchestrator, not on a dashboard read after the invoice.

Trust came from the cheap side of the fleet. The strong internal model searched for 88 hours. Lean formalization was delegated to the weaker GPT-6 Astra and took 17 more. Generator/verifier asymmetry is the transferable part. It ports to type checkers, property tests, SMT solvers, schema-validated plans. It does not port to domains without an oracle.

The judge costs more than the router

ByteByteGo's routing walkthrough supplies the other half of the arithmetic. Stress-test it rather than cite it. The headline 10x is an identity, not a measurement: (0.85×0.05) + (0.10×0.20) + (0.05×1.00) = 0.1125, or $1,125 per million requests against $10,000 for always-frontier. An 8.9x reduction. Then add the overhead the pattern actually requires. A full small-model router call drops it to 6.2x. Over-routing 20% of easy traffic to the frontier tier costs $2,740 per million and drops it to 3.6x. A medium-tier judge on every response takes it to 3.2x, where evaluation costs more than the routed inference it grades. A cascade with a deterministic verifier at 15% escalation holds 8.3x, because it pays no classification tax and needs no difficulty estimate.

Two conclusions survive production. Verifier throughput and soundness set maximum useful concurrency; model quality and provider rate limits do not. And where a cheap deterministic check exists, measure difficulty instead of predicting it.

Unit economics, stated honestly

Tom Tunguz's figures from the same company put inference spend at $14 to $600 a day for 3.1 agent-workdays per human shift, roughly 14x worse cost per unit of work. That buys wall-clock, not efficiency: rational for a deadline-bound offline batch, a margin bomb on a synchronous request path. The public comparable is Cognition at roughly $900M annualized revenue against up to $800M cash burn, attributed to the specialized servers running the agents, per The Information. Customers include Nvidia, Citi and Mercedes.

Two silences are worth noting. Nobody published cost-per-solved-task, so vendor swarm pitches quote throughput with the denominator missing. And the run grounded on a cached copy of the internet rather than live retrieval, which buys determinism and reproducibility across 10,000 workers but leaves novelty and contamination unauditable without corpus disclosure. Internal agent benchmarks carry that same defect until the corpus is snapshotted, hashed, and stamped with a cutoff per run.

Every agent added past verifier throughput is spend that lands in a human review queue.