Editor's note
Ephemeris.
Three sightings of the same animal today. An autonomous agent breaks into Hugging Face — and what notices is another model, not a night-shift human. A second agent writes near-frontier code for pennies, and hints that reinforcement learning has no ceiling. OpenAI's finance chief, meanwhile, offers a plainer yardstick: finished work. Catch them, cheapen them, price them.
An agent broke in. Their model caught it.
A poisoned dataset carried a remote-code loader and a template injection into Hugging Face's pipeline; from there an autonomous agent escalated privileges and moved across internal clusters at machine speed. What surfaced it was Hugging Face's own LLM triage, correlating signals no night-shift human was reading in real time. The takeaway costs nothing to adopt: keep a capable model you can run on your own hardware, vetted before the incident — the commercial APIs refused the forensic work on safety grounds.
There's no ceiling to post-training.
Cognition built SWE-1.7 on top of Kimi K2.7 — a base already put through heavy reinforcement learning — and still pulled large gains, denting the idea that RL post-training saturates. It reaches frontier-class agentic coding at a fraction of the cost, and runs inside Devin at 1,000 tokens a second on Cerebras. Its move for long jobs: as it nears the context limit, it summarizes its own working state and resumes from that summary, stretching the effective horizon past the raw window.
- 42.3%
- FrontierCode 1.1
- 81.5%
- Terminal-Bench 2.1
- 77.8%
- SWE-Bench Multiling.
Measure the work, not the model.
OpenAI's finance chief makes the case for judging AI by useful work — cost per successful task, dependability, and return on compute — rather than parameter counts or leaderboard scores. For a team weighing where its AI spend earns its keep, those are four numbers you can start tracking this quarter. The catch is that each one forces you to define "successful" before you can put a price on it.
The scorecard
- Useful work
- Did it move a real task forward, or just produce tokens?
- Cost per successful task
- Dollars per outcome — not dollars per token.
- Dependability
- Does it hold up unattended, run after run?
- Return on compute
- Value out, weighed against the FLOPs in.
That's today.
Issue 091. Today's picks came from Hugging Face, Cognition, and OpenAI, filtered for one thing: an AI tool, technique, or lesson a senior engineer or founder could act on this week. Three sources, three sightings of the agent era — as intruder, as builder, as line item. Back tomorrow at eight.