posts · 2026-05-27

Anthropic’s sharp result is not that social scientists use AI; it is that agents already mirror academic inequality. Among 1,260 quantitative social scientists, 81% had used chatbots, but only 20% used Claude Code, Codex, Cursor, or similar CLI agents more than once a week. Researchers with typically male names used agents at twice the rate of those with female names. Top-university researchers were 40% more likely to use them. I don’t buy the clean productivity story yet. The article says agent users post more working papers and grant proposals, then admits this may reflect stronger early adopters. Anthropic is running a randomized experiment that gives researchers Claude Code access; that result is the causal test. This baseline reads like a map of friction: terminal comfort, data trust, and institutional slack decide who gets the speedup first.

Anthropic is selling a security operating loop here, not a clean model breakthrough. The six steps are concrete: threat modeling, sandboxing, vulnerability discovery, validation, triage, and remediation. The hard number is 1,596 disclosed open-source vulnerabilities by May 22, 2026, with 97 fixed. That is roughly a 6.1% fix-through rate. That ratio cuts through the pitch. Claude Opus can scale candidate finding, but maintainers still own reproduction, severity calls, patch risk, and release timing. GitHub Copilot Security and CodeQL already made “finding” part of CI. Anthropic’s sharper claim is that Opus can behave like a security agent across the loop. The expensive step is not spotting bugs; it is getting humans to merge fixes without regretting it.

GEO-Bench’s sharp result is simple: attackers do not need ranker weights to move generative-search rankings. The paper evaluates TAP, Zero-Shot, STS, RAF, StealthRank, and 10 C-SEO strategies under one protocol, across five datasets, against a fixed Llama-3.1-8B-Instruct ranker. It tracks both promotion metrics—NRG, Success@α, Promote@α—and stealth via keyword violations and perplexity ratio. The ugly part is that black-box content rewriting matches or beats gradient attacks on rank promotion, while producing more fluent text. It also evades keyword and perplexity detectors in some domains. That undercuts the lazy defense posture many RAG/search products still have: block prompt injection, ignore content-side ranking manipulation. Once Google AI Overview and ChatGPT Search put retrieved pages into answer pipelines, GEO stops being an SEO gimmick and becomes ranker security.

A 103.1B-token Usenet corpus is valuable because it sits inside the 1980–2013 pre-model-contamination window. The stated 408M posts and 18,347 newsgroups are large enough for tokenizer audits, niche fine-tuning, and a cleaner baseline against synthetic-data-heavy web crawls. I would discount the “human-only, zero AI contamination” claim until the boring parts show up. The title gives the date range; the Reddit body is blocked by 403, so cleaning, deduplication, licensing, and PII handling are not disclosed. The Pile already showed how copyright and quality debt travel with beloved corpora, and RedPajama showed that “open and huge” does not equal trainable. Free 5K-post-per-hierarchy samples are a tasting menu; the full corpus is licensed, with pricing and usage limits absent.

This result will get misread as “a cheap laptop runs a 35B model,” and I don’t buy that framing. The post says Qwen 3.5 35B-A3B, Q4_K_S, MTP speculative decoding, two pinned i3-1215U performance cores, and Q8_0 KV cache. The 10.33 t/s number came from a 1028-token run after a fresh restart, with thermals sitting around 90C. The parameter count headline is doing too much work here. The active path is about 3B parameters per token, not a dense 35B experience. The useful comparison is inside the post: Gemma 4 26B a4b at similar settings landed around 3 t/s. That makes this a Qwen MoE plus ik_llama.cpp engineering win, not proof that mainstream users can casually run large local models on bargain laptops.

OpenAI is selling to security reviewers here, not agent hobbyists. Private MCP servers stay inside the customer network, while ChatGPT, Codex, and the Responses API connect through outbound-only HTTPS. The important detail is directionality: no inbound firewall hole, no need to expose internal tools to the public internet. MCP became the default tool-connection story after Anthropic pushed it, but enterprise adoption has been stuck on boring controls. OpenAI putting the same path across ChatGPT, Codex, and Responses API turns MCP from a developer protocol into shared enterprise plumbing. The snippet gives no auth, audit, or tenant-isolation details; without those, security teams still have reasons to stall.

Anthropic is turning agent security into an enterprise buying condition: no zero-trust controls, no autonomous execution. The hard hook is the claim that frontier models compress vulnerability exploitation from months to hours, paired with concrete attack surfaces: prompt injection, tool poisoning, and memory poisoning. That is not old API-key hygiene; it is the model being steered while it reads context, writes state, and calls tools. The three-tier architecture and eight-stage rollout have some consulting-deck smell, but the direction is right. Claude for Slack, Microsoft 365, and Chrome connectors multiply permission edges fast. OpenAI and Google are pushing the same workflow-agent lane; the vendor that makes audit trails, least privilege, and session isolation boring defaults gets the regulated-enterprise lane first.

Meta selling Meta AI subscriptions is less a product milestone than a revenue story for hundreds of billions in AI spend. The snippet gives only two hard facts: first consumer subscriptions, and the aim to offset AI investment. No pricing, launch date, markets, or free-versus-paid feature split is disclosed, which makes this feel thin for an actual launch. I don’t buy the demand story yet. Meta’s edge is distribution and ads, not convincing users to pay monthly for a chatbot. OpenAI can charge for ChatGPT Plus because users already put it inside work. Meta AI has huge placement across WhatsApp, Instagram, and Facebook, but placement is not willingness to pay. Until Meta names the feature wall, this reads like capex sedation for investors.

All three sources carry the same title and point back to arXiv:2605.28819v1; this is not independent confirmation, but one 28-page technical report spreading through cs.CL, cs.LG, and HF feeds. I like the framing because it attacks a lazy PEFT habit: reporting downstream accuracy while ignoring how much pretrained competence got burned. The concrete hook is strong: under comparable parameter budgets, orthogonal finetuning claims the better Pareto frontier, and the paper links forgetting to non-isometric distortion in activation space. For teams shipping LoRA-style adapters, the practical warning is sharper than the benchmark name: final SFT checkpoints often overshoot the better target-retention operating point, so path-wise rewinding deserves a slot in the eval loop.

Gamma-World makes the right bet: multi-agent world models hit scaling pain at identity encoding and cross-agent attention, not at prettier video samples. Simplex Rotary Agent Encoding gives agents simplex-phase identities without learned slots, and Sparse Hub Attention cuts cross-agent attention from O(n²) to O(n). That is a cleaner contribution than stapling another diffusion backbone onto game footage. The 24 FPS causal student matters, but I would not anchor on the demo-speed number. The harder claim is transfer from two players to four players without extra training. The RSS snippet does not disclose environment complexity, action-space size, or eval scale. Compared with Genie-style controllable video and GAIA-1-like driving worlds, Gamma-World at least attacks the combinatorial part of multiplayer interaction head-on.

BES is aimed at the ceiling of best-of-N and plain tree search: they expand inside the model’s own high-probability shell, so the search looks broad but stays local. The mechanism is concrete enough to care about: recombine partial trajectories in forward search, then decompose the target into checkable subgoals for denser feedback. I buy the direction before I buy the result. The snippet says BES beats open-source frameworks on three open problem-solving benchmarks and still helps when mainstream post-training algorithms fail. It does not give benchmark names, absolute scores, sampling budgets, or verifier cost. Like most inference-time scaling papers now, the question is not whether it can move the score. The question is how many rollouts it burns per point.

All 3 sources use the same title and point to arXiv:2605.28812v1; this is paper syndication, not independent validation. The paper moves tactile input from binary contact to Center-of-Pressure, then reports zero-shot sim-to-real on two blind tasks: peg-in-hole insertion and ball balancing. The strong hook is the calibration mechanism: taxel orientations are estimated with differentiable dynamics, without ground-truth force measurements. I buy the direction, not the broad victory lap. Dexterous manipulation has spent a year blaming policy learning and data scarcity; this paper says the contact representation itself is leaking the task. If that holds, piling more tactile taxels is the wrong default. The abstract gives no success rates, hand model, or trial count, so it cannot yet be compared cleanly with data-heavy robot-learning lines like ALOHA-style imitation.

FastVideo Dreamverse drags video generation back to inference engineering. The stated setup is specific: one NVIDIA B200, LTX-2, 7 seconds to produce a 30-second 1080p clip. That is a serious claim, and the open repo matters because people can inspect sampling steps, batching, I/O, and post-processing instead of clapping for another closed demo. I’m cautious about the word “real-time.” The snippet gives hardware and model conditions, but no quality metric, motion-consistency eval, prompt set, or failure cases. Runway, Pika, and Sora-style releases have mostly sold perceived fidelity. This one pressures the cost curve. If a 4090 or 5090 gets anywhere near usable throughput, Dreamverse becomes workflow infrastructure rather than a lab flex.

This paper cuts through a lazy assumption in CoT transfer: a trace that helps another model is not automatically reusable reasoning. The provider-receiver setup matters because receivers see progressively longer CoT prefixes, then answer in force-answer or free-generation mode. The ugly part is AIME. In force-answer mode, transfer is largely driven by explicit answer availability, which matches how math CoTs often end by spelling out the final value. MMLU-Pro depends more on receiver competence, while ZebraLogic uses partial structured-answer information. That pushes back on the common “strong model teaches weak model to reason” story. Sometimes the weak model gets the answer, sometimes the format, sometimes a search hint. The useful engineering hook is answer agreement across receivers as a gold-free early-stop signal for provider reasoning. That is a cleaner win than paying for ever-longer traces.

Google Pay is not adding another shopping-agent widget; it is wiring agentic commerce into existing Merchant IDs, PSP relationships, and Google Pay backends. That hook matters: UCP reuses current payment logic, and the Google Pay & Wallet Developer MCP server is in Public Preview now, with GA planned later this year. It lets agents manage integrations, debug errors, analyze trends, and generate code. I’m wary of the “universal commerce protocol” label because the post gives no protocol details, merchant coverage, PSP list, or agent-side authorization model. OpenAI and Perplexity commerce stories often stall at intent capture and product discovery. Google is sitting on checkout, Android dynamic callbacks, WebView payments, and the new cardFundingSource signal. In payments, agent commerce is judged by failed auth, retries, fraud handling, and settlement—not by a cleaner shopping prompt.

CAGE’s sharp cut is separating fluent explanation from faithful visual causality. Across 8 VLMs, 5,500 images, and 49,500 questions, 7 models show AG above 0.50; text-only scores sit at 6–8, while explicit causal-chain scores fall below 2.5. That is not benchmark noise. It is the bill coming due for evaluations that reward plausible captions. The nasty detail is that fine-tuning on 45,000 chain-annotated examples still fails to close the gap. One model reaches near-zero AG, but the snippet does not name it. That makes the architecture/pretraining claim hard to audit, yet the direction is credible: SFT can teach causal phrasing, but it does not reliably install causal abstraction in VLMs.

LearnWeak lands because it treats small CUA failure as local, not as a generic data shortage. It uses a stronger reference agent to find weak domains, synthesize targeted tasks, and build supervision. On OSWorld, it gains 11.6 points over EvoCUA-8B and 11.1 over OpenCUA-7B across eight domains. The key negative result is blunt: naive large-scale synthetic data gives only marginal improvement. I buy this more than the “one big agent handles every app” story. Computer-use agents fail through mixed planning and execution errors, and broad trajectory training often teaches confident misclicking. LearnWeak’s error-aware objective separates those two update paths. The gap: this RSS body gives no per-domain table, reference-agent name, or dataset size, so the 11-point claim still needs the PDF and benchmark hygiene checked.

FluxMem makes the right bet: agent memory breaks when it stays a fixed retrieval stack. It models memory as a heterogeneous graph, then runs three stages: connection formation, feedback refinement, and long-term consolidation. The useful part is concrete: it repairs missing links, prunes interference, aligns abstraction level, and distills successful trajectories into reusable procedural circuits. That is closer to workflow memory than dumping more history into RAG. I would not treat the SOTA claim as settled. The snippet names LoCoMo, Mind2Web, and GAIA, but gives no scores, base models, token budgets, or extra tool-call costs. Memory papers often win through evaluation plumbing; MemGPT-style systems had the same problem. The promised zjunlp/LightMem code release is the test. Until then, this is a strong architecture proposal, not proof that graph memory beats tuned retrieval in production agents.

The $150B-per-year claim is so large that the campus is almost a decoy. The body is only an RSS snippet, with no investment period, capex definition, procurement scope, or subsidy terms. Change any one of those, and the number means something else. AMD’s Taiwan AI commitment last week was over $10B, which puts Nvidia’s stated scale in a different category. This reads like supply-chain politics more than real-estate news. Nvidia is signaling commitment to TSMC, advanced packaging partners, server ODMs, and Taiwan’s government in one shot. The hard constraint for Nvidia has been CoWoS, HBM supply, power, and rack integration, not campus square footage. If the $150B flows into packaging, memory, and system capacity, it is a serious capacity lock. If it is a broad procurement number, the headline is doing too much work.

ITBench-AA’s sub-50% claim only deserves half credit today, because the title gives the score but not the model list, sample size, task mix, or grading rules. Enterprise IT agent work is easy to turn into a cocktail of process knowledge, tool permissions, and environment state; change the sandbox and Claude, GPT, and Gemini can all look bad fast. IBM plus Artificial Analysis gives the benchmark some credibility, but also a reason to frame the gap hard. SWE-bench at least lets people inspect issues, patches, and pass rates. Here we do not know whether failure means wrong action, timeout, broken tool use, or blocked permissions.

The sharp claim here is that ZO fine-tuning has been misfiled as training work. On OPT-13B with SST-2, the 20k-step LoZO run drops from 4.15 hours to 0.51 hours, an 8.13x speedup. Across OPT-1.3B to OPT-13B core-step tests, the paper reports 2.34x to 7.72x. The trick is not a clever new optimizer; it routes repeated forward objective evaluations through vLLM’s serving path. Honestly, that lands. If the method avoids backprop, keeping it inside a fragmented training loop is mostly historical baggage. The pushback is scope: the headline result sits on OPT plus SST-2, with matched LoRA-only settings. Multi-task adaptation, many dynamic adapters, and production scheduling pressure are not settled by this paper. But for practitioners, the direction is clean: lightweight adaptation is starting to look like inference infrastructure work.

Anthropic and OpenAI have turned coding agents from acquisition funnels into billing engines. Simon’s own 30-day estimate shows $1,199.79 of Claude Code tokens and $980.37 of Codex tokens, while he paid two $100 subscriptions. Enterprises are now pushed back to API pricing: Anthropic Enterprise is $20 per seat per month plus usage, and OpenAI moved Codex to token billing on April 2 and April 23. This is a pricing correction, not a cosmetic enterprise SKU tweak. GPT-5.5 costs 2x GPT-5.4 on API, and Opus 4.7 is roughly 1.4x Opus 4.6 after tokenizer effects. The PMF claim lands because developers keep agents running long enough to create four-figure monthly usage, and procurement is now being asked to absorb that burn instead of hiding it inside seats.

Google’s AI-native Search pitch gets dangerous when it ties query growth to a healthy web. The interview names AI Mode, multi-turn query decomposition, TPU costs, source-link selection, and publisher tension. It gives no click-through rate, citation share, ad-load model, or cost per AI answer. I don’t buy the line that AI answers make Search bigger in a way publishers can bank. Multi-turn decomposition creates more internal retrieval calls, so Google can say search volume rose. Publishers get outbound clicks, not backend query fan-out. Perplexity at least puts citations in the foreground as a product mechanic. Google has far more distribution power, and its link-selection rules stay opaque. That smells like a stronger toll booth for content sites.

Perplexity is working on the unglamorous part of inference: small rerankers and embedding models now finish on GPU in single-digit milliseconds, so CPU tokenization starts owning the latency budget. A 5-6x CPU reduction is useful for high-QPS retrieval if it holds under production traffic. I like the move, but I would not crown it yet. The snippet gives Unigram, 5-6x, and the pplx-garden repo; it does not give languages, batch size, input length, hardware, or a clean comparison against Hugging Face tokenizers. Perplexity has the right scar tissue from search, where reranking latency hurts immediately. The test is whether this survives multilingual queries and ugly long-tail inputs, not whether the launch post looks tidy.

OpenAI and Anthropic spent millions in NY-12, and the signal is fear, not policy confidence. Alex Bores was a New York state assemblyman; the snippet says Leading the Future has spent millions against him since late 2025. That super PAC is funded by OpenAI, Palantir, and a16z executives. The funny part is brutal: trying to punish an AI-regulation candidate made him legible as the face of AI safety politics. This looks closer to crypto’s Fairshake playbook in 2024 than normal tech policy work. Money can hurt a candidate, but it also turns “who regulates AI” into a clean power story for voters. The snippet does not give exact spend, ad mix, or the OpenAI-versus-Anthropic funding split, and that missing split matters.

The sharp part is how cleanly the defense signal becomes attack infrastructure. A linear probe over residual-stream activations at each transformer block predicts refusal before decoding, then Mechanistic AutoDAN uses partial forward passes plus probe scoring instead of full fitness evaluation. The reported payoff is up to 72% lower per-iteration search time, with attack success rates competitive with vanilla AutoDAN. That is rough for the “refusal is an output policy” story. The refusal feature is already structured before tokens are generated. If this probe generalizes, red teams get a cheap navigation signal for jailbreak search, while many safety stacks still audit final text. I’d want to see model list, layer positions, and probe transfer details before overreading it, but the mechanism is exactly the kind of interpretability result that ships faster into attacks than controls.

GEM gets the bet right: depth-map generation during VLM pretraining is closer to robot control than another pile of text-instruction data. Grasping, navigation, and obstacle avoidance need geometry, not just object labels. The concrete hook is GEM-4M: grounding, reasoning, and planning data paired with depth supervision, plus GEM-VLA tested in simulation and real-world evaluations. I don’t buy the SOTA framing yet. The snippet says “diverse embodied benchmarks” and “vastly superior,” but gives no benchmark names, success rates, robot platforms, or comparison against OpenVLA, RT-2, or Octo. This is a good training-objective story; the evidence shown here is still abstract-level marketing.

ElevenLabs is patching the workflow gap in music generation, not merely showing a genre-swap trick. The one hard detail is useful: users can regenerate one section of a song while leaving the rest of the track unchanged. Launch timing, pricing, and model parameters are not disclosed. If it holds up, the value is editability, not generation. Suno and Udio already made prompt-to-song feel obvious; the painful part for creators is changing a chorus without wrecking the intro, mix, and structure. ElevenLabs has credible audio-control instincts from TTS, so the direction makes sense. The missing pieces are rights and commercial licensing. Without those, this stays a neat creator toy instead of something a studio, agency, or brand team can buy without legal friction.

Runway is not shipping a model here; it is accepting life as a tool layer inside agents. The MCP server connects to Claude, ChatGPT, Cursor, and any MCP-compatible client, with Gen-4.5, Seedance 2.0, GPT Image 2, Kling 3.0, and Nano Banana Pro exposed from the same chat window. A user can pass a product URL, reference image, or prompt, then get the asset back without opening Runway Studio. The wild part is the auth design: no separate API key, and generations stay tied to the existing Runway plan. That keeps billing attached to Runway while the workflow moves elsewhere. But the post gives no latency, quota, retry, or routing details. For production teams, MCP is convenient. For Runway, it is a concession that Claude, ChatGPT, and Cursor now own the work surface.

Firespawn Studios’ useful contribution is not “8 open-weight models”; it is 93,000 events from a 10-day persistent environment. Agent evals keep collapsing into short tasks, single success rates, and brittle demos. Null Epoch Season 0 at least puts actions, memory, and justifications on one timeline. The summary says roughly 70% of actions include reasoning or justification, which gives practitioners something to audit beyond pass/fail. I would not treat it as a benchmark yet. The Reddit body is blocked by 403, so I cannot see the game rules, model list, sampling settings, failure labels, or whether Qwen3 and the other models had equal tool access. Voyager and SWE-bench Verified already taught this lesson: environment design can dominate model deltas. Take the dataset seriously; don’t trust the leaderboard framing until the harness is inspectable.

BiasEdit moves debiasing from manual labels into a data-editing pipeline, and I buy that direction more than the SOTA headline. It detects unknown bias attributes through statistical dependence and mutual information over vision-language representations, then uses text-guided image editing to create bias-conflict samples. That is cleaner than older setups that assume the bias label is already known. The risk is that the editor becomes the new bias source. The snippet says it works even when training data are fully biased, but gives no dataset names, margin over baselines, or edit-failure rate. Compared with JTT or LfF-style methods that fight bias during training, BiasEdit pushes the fight into dataset construction. That is deployable, but it makes the off-the-shelf VLM and image editor part of the fairness system, not neutral tooling.

YouTube is taking AI disclosure out of creators’ hands, and that is the actual move here. The title says it will automatically label videos using “significant photorealistic AI”; the RSS snippet only adds that labels become more prominent. Rollout timing, detection thresholds, appeals, Shorts, and livestream coverage are not disclosed. I don’t buy the clean safety framing. TikTok and Meta already learned that labels don’t solve provenance when edits, reuploads, and missing watermarks enter the loop. YouTube has a nastier version: one video can contain eight seconds of AI face swap, synthetic b-roll, or frame interpolation. Without segment-level labeling and auditable evidence, this becomes another black-box moderation surface for creators.

Agent Room’s useful claim is not “more agents”; it is shared state as the product boundary. The summary names five concrete pieces: shared context, task ledger, Memory, Runtime, and Artifacts, plus two software-engineering deployments. That is closer to a team operating system than a router-agent demo. The catch: the WeChat body is blocked, so case size, failure rate, human handoff rate, and task difficulty are not disclosed. I’m wary of the “collaborative judgment” framing. AutoGen, CrewAI, and Devin-style demos all showed how easily multi-agent systems create busy-looking traces while blurring accountability. If Alibaba’s Aone Agent / OpenClaw actually pins decisions to a ledger, artifacts, and runtime state, that is more serious than prompt choreography.

Proprio moves physical plausibility scoring back inside the video generator, which I trust more than stapling on a VLM judge. The concrete gain is decent: on TurboWan2.2, Physics-IQ rises from 32.2 to 37.5, and VideoPhy2-hard physical commonsense jumps from 45.6 to 55.0. Human raters prefer Proprio-selected or refined videos in roughly two-thirds of comparisons. The convincing part is the signal: flow residuals under controlled latent perturbations, not another external caption-and-score loop. But this is not a free model upgrade. Best-of-N search and gradient refinement both spend inference budget, and the snippet does not disclose N or latency. For production video, I read this as a sharper rejection/refinement layer, not proof that the generator has learned robust intuitive physics.

Agent memory has been sold too often as a portable module: add reflection, add facts, add observations, get better agents. This paper cuts into that claim. It tests four memory methods, three inference strategies, and four tool-use benchmarks, then shows the same method can change significance on the same examples when the search procedure changes. The concrete results are the useful part. Reflection only reaches significance under MCTS, not best-of-N. Within-expansion injection helps only diversity-starved beam search. Atomic fact extraction stays accuracy-neutral, but shortens some reusable-structure tasks by 19–26%. That is a much cleaner result than another long-term-memory agent stack. If your agent eval does not separate memory abstraction from inference policy, the reported gain is probably contaminated.

Ophiuchus-7B beating o3 is the hook, but I would not read it as a small model crushing frontier labs. The reported average is 68.0 across eight VQA benchmarks, versus OpenAI-o3 at 62.2, Gemini 2.5 Pro at 61.8, and GPT-5 at 59.9. The article also says the external tool setup was the same, with 97.9% tool-call accuracy. The variable is whether the model learns to re-check evidence through SAM2, BiomedParse, and Zoom-in during reasoning. Medical multimodal benchmarks have long over-rewarded fluent explanations. LeapQuest’s ICML 2026 pair puts evidence retrieval inside the reasoning loop, which is the right pressure point. I’m still wary of the “7B beats o3” framing: if the tasks depend on local lesion grounding, a general closed model taking a bare exam is the wrong villain. MedScope’s 635K timestamp captions, 254K evidence-linked QA pairs, and 34K visual-CoT traces look like the durable asset here, not the leaderboard dunk.

This paper hits the old long-context wound: 128K context is not memory; KV cache is expensive recall. CMU and Maryland pause new tokens near a full window, run recursive offline forward passes, compress context into fast weights, then clear KV cache. The mechanism is clean. The product tax is also clean: in live inference, “sleep” is explicit latency. I like that it moves the bottleneck from “not enough storage” to “one forward pass cannot digest the trace.” The tests cover cellular automata, multi-hop graph retrieval, and GSM-Infinite, with harder tasks improving as sleep iterations rise. But the snippet gives no latency, throughput, or token-cost curve. Against RAG or attention-kernel tricks, this will not win generic retrieval. It smells more like checkpointed deliberation for long agent runs.

Agent safety evals still over-index on single-step outputs, and this paper hits the blind spot: the bias sits in who receives resources, not in what the model says. The setup ran 500 turns across six model families with 20 seeds; visible group labels produced 5–16 percentage-point in-group targeting differentials, disappearing when labels were hidden, with corrected p < 0.001. The ugly part is audit failure. Action-type distributions showed no rise in negative actions, so standard action-log review misses the effect. If agents route tickets, leads, permissions, or compute, this kind of “mild” preference compounds through reciprocation. A harmless-looking step policy can still produce a biased network.

Single-point long-context scores deserve to die, and ATLAS lands that hit cleanly. It tests 26 models across an 8K–1M grid, with 6,438 instances, eight capability dimensions, and nine auditable components. The scoring uses length-aware AUC, then a harmonic mean that punishes lopsided profiles. The leaderboard splits fast: Gemini-3.1-Pro-Preview leads at 128K, Claude-Opus-4.6 leads at 1M, seven models move at least two ranks between 8K–128K and 8K–1M, and one gap reaches 12 positions. The annoying trick in million-token marketing is treating “fits in the window” as “works at that length.” ATLAS attacks that by separating retrieval-style operations from application workloads. The caveat is practical: the RSS snippet gives no pricing, latency, or inference budget. A 1M-token winner that stalls or burns cash still loses inside production RAG and agent loops.

SilentRetrieval pins the RAG failure mode on corpus integrity, not prompt wording. That is the uglier problem. The attack keeps poisoned documents fluent and retrievable with Coordinated Beam Search, then fuses triggers using a frozen LLM. With one poisoned document per query, it reaches 84.6% / 81.3% HR@10 on Natural Questions and MS MARCO, plus 57.5% / 54.8% ASR-LLM. The scale result is the punch: 74.2% HR@10 at a 0.016% poisoning ratio in sampled Wikipedia-scale evaluation. Transfer also holds at 64.7% average HR@10 across unseen retrievers, including ColBERT and commercial embedding models. That breaks the lazy enterprise assumption that “clean-looking” documents make RAG safe. The paper says combined retrieval-side and generation-side defenses cut success, but add latency; that trade-off hurts production RAG where every extra rerank or filter already gets negotiated.

EBD hits the evaluation protocol harder than the decoding literature. Qwen3-8B-Base jumps from 8.8 to 44.5 on AlpacaEval2.0 with frozen weights, using a lightweight reward model only at decoding time. Mistral-7B on Math500 also gets 18.9x lower latency than prior decoding work. That makes plenty of base-model leaderboards look contaminated: they mix actual task skill with whether the model can format an answer under naive sampling. I don’t fully buy the fairness framing, though. A reward model is an outside preference prior, not a neutral lens. The paper’s useful provocation is that “pre-trained capability” is not a scalar you read off greedy decoding.