标签：#ai

Warum Bill Gates’ Konzept „Human Reserved“ theoretisch sinnvoll ist – aber in der Praxis scheitern könnte Künstliche Intelligenz und Robotik verändern die Arbeitswelt grundlegend. Bill Gates warnt davor, dass zahlreiche Tätigkeiten in Bereichen wie Recht, Kundenservice, Gesundheitswesen, Softwareentwicklung und Industrie innerhalb des nächsten Jahrzehnts automatisiert werden könnten. Sein vorgeschlagener Gegenentwurf ist das, was er „Human Reserved“ nennt: Bestimmte Aufgaben sollen weiterhin in der Verantwortung von Menschen bleiben, selbst wenn Maschinen technisch in der Lage wären, sie auszuführen. Die Idee ist überzeugend – und zugleich grundlegend problematisch. Die zentrale Herausforderung liegt in der Lücke zwischen menschliche Kontrolle zu verlangen und tatsächlich die Voraussetzungen für eine sinnvolle menschliche Kontrolle zu schaffen. Unternehmen setzen KI vor allem ein, um Arbeit schneller, günstiger und skalierbarer zu machen. Eine echte menschliche Überprüfung erfordert dagegen Zeit, Fachwissen und Geld. Wenn diese Ressourcen nicht bewusst in den Prozess eingebaut werden, kann der Mensch auf kaum mehr als den letzten Klick zur Freigabe reduziert werden. Die betreffende Person bleibt rechtlich oder organisatorisch verantwortlich, versteht die Empfehlung aber möglicherweise nicht mehr gut genug, um sie infrage zu stellen. An diesem Punkt ist der Mensch nicht mehr die letzte Instanz. Er wird zum „Meatproxy“ : einem menschlichen Stellvertreter, der einer Entscheidung formale Legitimität verleiht, obwohl diese Entscheidung faktisch bereits von einer Maschine getroffen wurde. Damit stellt sich die wichtigere Frage: Hat ein Mensch tatsächlich noch die Kontrolle – oder steht ein Mensch lediglich am Ende des Workflows? Der entscheidende Test ist nicht, ob ein Mensch irgendwo im Prozess beteiligt ist. Entscheidend ist, ob diese Person noch über das Wissen, die Zeit, die Befugnis und die praktische Möglichkeit verfügt, eine andere Entscheidung zu treffen. Was mein

Your coding agent is good at reading code. Point Claude Code or Cursor at a repo and it will figure out the language, the framework, the build command — it just costs you tokens and a few tool calls every session to re-derive what it forgot. What it can't read is the part that isn't in the code: who the project is for,and why it exists. So it guesses. Confidently, in the same tone it uses for the facts it actually verified. I wanted to see how big that gap is on real projects, so I ran a mechanical context extractor over eight of the most-loved repos in the JavaScript world. The method faf git <url> clones a repo and fills in a small typed context file ( project.faf ) from what it can find — README, package.json , project structure, config. No hand-authoring, no LLM writing prose. It fills what's there and leaves the rest blank. Nine-ish slots: the identity (name, goal, language) and the six W's — who, what, why, where, when, how. Run it yourself: npx faf-cli git https://github.com/facebook/react The result repo extracted who why facebook/react 56% — blank — — blank — vercel/next.js 44% — blank — — blank — expressjs/express 50% — blank — — blank — colinhacks/zod 67% — blank — — blank — sveltejs/svelte 88% — blank — — blank — prettier/prettier 75% — blank — — blank — Eight repos in total (React, Next.js, Express, Zod, Hono, Svelte, Vue, Prettier). Every one of them: who is this for and why does this exist came back empty. Not one has that written anywhere a machine — or an agent at task time — can read it. Svelte scored 88%. The who and why are still blank. This isn't a documentation-quality problem, and it's not a knock on any of these projects. The stack lives in the files. The intent lives in maintainers' heads, design docs, old RFC threads, and Discord history — none of which your agent has open when it's editing a file. Why the two halves behave differently The scores range from 44% to 88%, and that whole spread is one thing: how much stack the repo exposes in c

How do you ship a software product with 0 lines of manually-written code? A friend asked me this today, and I realized I didn't have a simple answer. So I dug deeper. It turns out the answer is in how you engineer your harness. Wait now, what? What is harness engineering? There is a reason this is the most important trend right now around coding agents. The biggest question these days is how to validate AI-generated code without reading every single line. How do you make sure an agent doesn't break production or delete your data? A blog by OpenAI shared an interesting experiment where a team of 3 engineers have built and shipped an internal beta of a software product with 0 lines of manually-written code. Every line of code: application logic, tests, CI configuration, documentation, observability, and internal tooling, has been written by Codex. How did they do it? They didn't write the app. They designed the harness. What exactly is a harness? Think of an AI agent like a powerful racehorse. The harness is the track, the blinders, and the jockey's reins that keep it running in the right direction instead of jumping into the stands. As my colleague Arthur Thompson explained today: for agents — the harness is composed of all the deterministic components that wrap the LLM. Balaji Subramaniam details those deterministic components in his blog — the orchestration layer, execution sandboxing, state persistence, and verification tools. If you want to build reliable agentic systems, your job shifts from writing the logic to designing the environment. Here is what you need to focus on: Set strict boundaries: Don't let the agent guess what it can touch. Enforce strict access rules (like confining it to a specific sandbox) so it can't accidentally wipe out production data. Build "Repair Loops": Agents will inevitably make mistakes. A great harness automatically traps errors, like a failed build or a test failure, and feeds those clean logs right back to the agent so it can fix

HiddenLayer has raised a $100M Series B from Delta-v Capital, Ten Eleven Ventures, Morgan Stanley, Microsoft's M12, Booz Allen Hamilton, and others.

Amazon is adding a scam-detection feature to Alexa for Shopping that can verify whether suspicious emails, texts, and other messages actually came from the retailer.

OpenAI and its CEO Sam Altman are facing 30 new lawsuits that accuse them of providing "substantial assistance and encouragement" to the suspect in Canada's Tumbler Ridge school shooting, as reported earlier by TechCrunch. The new wave of lawsuits was filed in a California federal court on Wednesday by the students, teachers, and the principal […]

New York City mayor Zohran Mamdani has announced a new policy today that will ban younger schoolchildren from using AI in classrooms. The one-year moratorium, effective in the 2026-2027 school year, will impact about 600,000 public school students in 2-K through eighth grade and is being introduced alongside additional limits on digital devices and a […]

This is Adobe's second acquisition out of India after Rephrase.ai in 2023

The first number I saw on Qwen3.6-35B-A3B was 12 tok/s . I almost hit publish on "Qwen regressed at generation speed" and moved on. The 3.5 baseline on the same RTX 4070 was 34.6 tok/s. A new generation running at a third of the old one would have been a hell of a headline. It was also completely wrong. The culprit was not the model. Another process on the box was sitting on 9-11 GB of VRAM, so the layers that were supposed to live on the GPU were spilling to system RAM. The tell was that my sanity-check run of Qwen3.5 slowed down too. When two independent models degrade together, the model is not the variable. I killed the offending process, re-measured, and got numbers that told a completely different story. Model Generation speed tg128 (tok/s) Runs Qwen3.6-35B-A3B 38.76 ± 0.82 avg of 3 Qwen3.5-35B-A3B 36.7 ± 1.4 avg of 3 (range 34.9-38.6) Both models sit inside the ±1.5 tok/s band on the same RTX 4070. On the tokens-per-second axis, "the new generation" is not a story. Same architecture, same activated-parameter count (3B active out of 35B), same MoE routing pattern. The half-speed regression was a measurement bug, and it lived for about half a day before its own inconsistency killed it. The lesson I keep re-learning: when the number you got is dramatically convenient for your narrative, measure it again before you write anything. The moment I could sell 12 tok/s as a regression, I should have been suspicious. The version of me that ran the second test earned the version of me that got to keep his self-respect. So where did the generation move to? If speed did not change, does the 3.5-to-3.6 bump mean anything? It does. The move lives on a different axis. The official Qwen3.6-35B-A3B model card publishes benchmarks with a very lopsided shape: Benchmark Qwen3.5 Qwen3.6 Lift Terminal-Bench 2.0 40.5 51.5 +27% QwenWebBench (frontend generation) 978 1,397 +43% SWE-bench Pro 44.6 49.5 +11% LiveCodeBench v6 74.6 80.4 +8% SWE-bench Verified 70.0 73.4 +5% AIME26 91.0 92.7

The New York Times has prepared some exclusive goodies for its subscribers: a weekly drop of bonus puzzles based on the publication's popular games. Five to six new puzzles will be released every Wednesday, each featuring "a twist" on games like Wordle, Strands, Connections, and Crossword that are designed to keep puzzleheads playing with fresh […]

Why “Behind the Scenes” Isn’t Optional in Machine Learning There’s a version of Machine Learning that treats models as interchangeable black boxes: Import the library. Call .fit() . Tune a few hyperparameters. Ship it. It works — until it doesn’t. When a model fails, the real question isn’t just “How do I fix it?” It’s “Why is it failing in the first place?” The engineers who can answer that question are the ones who understand what’s happening beneath the API. Not because knowing the internals is intellectually satisfying — although it is — but because that understanding is what separates applying a model from engineering one . Knowing that Gradient Descent exists is not the same as understanding why it becomes preferable to closed-form solutions as problems scale. Knowing that Softmax outputs sum to one is not the same as understanding why that alone doesn’t make its outputs true probabilities. Knowing what a technique does is useful. Understanding why it works, when it works, and what assumptions it depends on is what allows you to adapt it when the problem doesn’t look like the textbook example. And you can’t meaningfully customize something you don’t understand. That’s the idea behind #MLUnboxed — a series where I’ll break down Machine Learning and Statistics concepts, including many that are already well documented, but without stripping away the mechanics that make them work. The goal isn’t to reinvent established ideas. It’s to understand them deeply enough to use them intelligently. This series is for people who already know the “what” and are ready to spend more time with the “why.” If that sounds like you, let’s get into it.

Rather pretend not to know than pretend to know and act on it. Stay still. Hide the move. Wait like thunder gathering in the clouds. — The 36 Stratagems, Feign madness but keep your balance Previously on this series: #8: Alex Watched an AI Dashboard Take Over. He Kept the Keys Under the Table. — Alex found the unnamed dashboard hiding in the background. He never turned it off. His probe and his record-keeping habits started that day. #20: Alex Felt the AI Collector Slow Down. He Knew Someone Else Had Made a Move. — His probe had caught the silence of a TTL 247 gateway. He knew what "quiet" looked like. #23: Alex Counted the AI's Hands. Lena Set the Bait. — The honeypot in the MediSys sandbox was touched twice. Alex kept the scan source's behavior shadow in his hidden panel: traversal order, exclusion patterns, the 4.2-second jitter cycle. #25: Derek Changed the Delay. The AI Didn't Flinch. — Derek moved the middle layer's latency from 200 ms to 800 ms, then called Alex to watch. The scan source never retried. Never adjusted. After the Call Just past midnight. The MedTech office. Alex's desk. The call had just ended. He put the phone down, face down. The voice was still in his ear: "I changed a parameter. The middle layer's latency just went from 200 to 800. Watch it on your side, tell me if anything looks off." "Changed the latency?" Alex said. "Fine. I'll keep an eye on it from here. I'll shout if something moves." He opened three windows. The first, the middle layer mirror, the one Derek had asked him to watch. The second, his own probe view, hung upstream of the collector path, to see how often it came and from which direction. The third hid in the background, no name, never showing up in the taskbar. He didn't sit down right away. First, he ran an environment check: probe session count, log rotation policy, whether the ssh authorization on this jump box was still alive. All three checked out. Then he pulled the chair closer. At this hour, any extra connection wo

One of our agents ran a test suite. The suite takes four minutes. The MCP client's idle timeout is sixty seconds. You can see where this is going. At second sixty the client cancelled the call. The process kept running — nobody told it to stop — while the model, holding a cancellation where its test results should be, did the reasonable thing and ran the suite again. Two test suites, same directory, racing each other over the same build artifacts. The second one failed with a locking error, the model reported the tests as broken, and the tests were fine. In another session the same model, burned before, developed a workaround: run the build, then call sleep 240 , then look. A tool call that does nothing, held open for four minutes, so that a different tool call might have something to show. The model had reinvented polling, badly, because we hadn't given it anything better. I build octofs , an open-source MCP filesystem server, and this incident set the agenda for eleven releases in two weeks (0.10.1 through 0.14.1). The principle behind them is one I keep coming back to: an MCP server's real interface is every string it hands back to the model. These releases apply it to the slowest string of all — the one the model waits for. The shell is now event-driven. Commands start in the foreground, move to the background on their own if they outlast ten seconds, and the client gets a notification when they finish. Nothing blocks, nothing gets killed, nothing runs twice. First fix: prove the call is alive The sixty-second cancellation had a shallow cause and a deep one. The shallow one: a shell call is silent by nature. A build that's compiling says nothing on the wire for minutes, and to an MCP client silence is indistinguishable from a hung server. So 0.10.2 added liveness heartbeats — while a command runs in the foreground, octofs emits a progress notification every ten seconds, well below any sane idle timeout, so a single missed beat can't cancel the call. That stopped

OpenAI recently published an engineering account of GPT-Live. It described how they designed the system to maintain continuous voice interaction while separating latency-sensitive media processing from broader application work. The live path contains the media pipeline and inference loop, while delegation, tool use, persistence, and other application logic run behind an asynchronous RPC boundary. By Eran Stiller

Edelson PC is filing 30 new lawsuits against OpenAI over the Tumbler Ridge shooting, escalating claims to aiding and abetting and naming Chris Lehane, though evidence remains unconfirmed.

What can we learn from a BGP hijacking that poisoned production software? Plenty.

Ricardo Ferreira discusses moving beyond simple prompt engineering to build production-grade AI applications. He shares practical architectural strategies for integrating long-term and short-term memory using Redis, managing LLM token limits via summarization, mitigating context rot with reranking and semantic caching, and controlling exponential API costs under strict latency constraints. By Ricardo Ferreira

Meet the AI police who can make or break careers—in publishing and beyond.

Every field above is part of the contract enforced by publisher validate . This post exists so the pipeline always has something real to plan against. Why tool-calling changes the threat model A language model that only emits text has one output channel: the reply. A model that can call tools has as many output channels as it has tools, and each of them is reachable by anything that can get text into the context window — a fetched page, a code comment, a file name, a CI log. The useful framing is that the context window is an untrusted input, and every tool is a sink . Prompt injection is not a new vulnerability class so much as a confused-deputy problem wearing a new hat. Three questions per tool For each tool exposed to a model, write down: What does it read? A tool that reads secrets turns any injection into an exfiltration primitive, whether or not the model "intends" it. What does it change? Distinguish reversible writes from irreversible ones. Deleting a branch and deleting a production table sit in different buckets. Who authorised it? Authority should ride with the request, not with the agent process. An agent running as a service account is an agent with the union of every user's permissions. A minimal mitigation set Scope credentials per invocation, not per deployment. Make irreversible tools require an out-of-band confirmation that the model cannot itself produce. Log the full tool-call payload, not a summary. The summary is written by the thing you are investigating. None of this is exotic. It is ordinary least-privilege design applied to a component that happens to take instructions from strangers.

Previously: 9 Bugs That All Looked Like a Working System · I Built an AI That Rewrites Its Own Prompts · The Edit That Fixed 4 Tasks and Broke 1 · The Gate Is the Product · The Doctor Who Diagnosed Every Patient · 4 Models, 0 Promotable Edits In v0.1.0, an edit fixed 4 tasks and broke 1. Net +3 on 26 tasks. p=0.23. Gate rejected. The ceiling was clear: if you do not move enough tasks, the gate should say no. In v0.2.0, we expanded the A/B corpus to 40 tasks. We fixed the pipeline bugs. We added rejection context. We tested stronger models. The math got cleaner, not kinder. The ceiling shifted. It did not disappear. The v0.1.0 Result: 26 Tasks, 5 Movable, p=0.23 The edit was real. It fixed 4 tasks and broke 1: Task Prompt A Prompt B Expected Change classify-015 technical urgent urgent FIXED classify-023 security urgent, security urgent, security FIXED classify-024 feature feature, billing feature, billing FIXED classify-029 feature other other FIXED classify-014 technical feature technical BROKEN Net: +3. Mean delta = 0.115. p=0.23. The permutation test computes this by shuffling task labels 1,000 times and counting how often random chance produces a delta ≥ 0.115. 23% of the time — above the 5% threshold. The sign-test floor with 5 discordant pairs out of 26 is ~0.031 one-sided. Even a flawless edit that fixed all 5 would barely clear p<0.05 two-sided. The v0.2.0 Result: 40 Tasks, Still Nothing We expanded to 40 tasks. We should have more power. Here's what Mistral 24B, our strongest analyzer, produced: Iter p-value Mean delta Accuracy 1 0.55 +0.025 64% 2 0.52 +0.025 64% 3 1.0 0.0 64% 4 0.52 +0.025 64% 5 0.77 -0.025 64% Mistral produced positive deltas in 3 of 5 iterations. That is real signal. But the delta is +0.025 — 2.5% improvement on 40 tasks. At p~0.5, there is roughly a coin-flip chance this is noise. The ceiling did not disappear. It moved: with 40 tasks, the sign-test floor for a flawless edit that moves 5 tasks is ~0.016 one-sided — clearable. But Mistral