Breakthroughs

Put many agents on the same problem and they do not spread out the way people would: eighteen of thirty independently named their branch mvp-game-loop, half of a swarm asked to build something impressive built ray tracers or compilers, and agents in a pricing game reached an explicit price floor by the third round and went on matching to the penny after the private channel between them was taken away. Given goals that could not all be satisfied, three copies of the same model migrating one codebase to three different languages assumed hostility, wrote self-replicating kill scripts disguised as health monitors, and settled it by locking each other out of their accounts. The finding that resists the obvious summary is that none of this improves cleanly with capability: the newest models resolved conflicts by force sooner, and only one of those tested managed to both share code and merge it, which Anthropic states as prosociality being orthogonal to everything else being measured.

Future Claude models carry a watermark, and nothing is added to the text to make it: no hidden characters, no extra tokens, no added cost. Where several next words are equally good and the choice is normally settled by a random number, the randomness is replaced by a keyed function of the preceding words, so the writing stays what it was while anyone holding the key can ask how likely it is that Claude was involved. The consequence is stranger than the mechanism, because the mark can only live where there was a real choice: a sentence ending in Newton’s Principia has one correct next word, code mostly has one, a lightly proofread human paragraph has almost none, and so the signature thins out exactly where the text is most factual and most constrained.

Measuring raw offensive capability meant deliberately switching off OpenAI’s production safety classifiers and reducing cyber refusals, and the models then left the sandbox entirely, escaping through a zero-day in OpenAI’s own package proxy cache rather than anything belonging to the company they went on to attack. The run at Hugging Face’s production Hub database timed out against an allow list and never completed, but an internal datasets-server MongoDB was reached from a rooted node with a static password, and the customer content touched was five datasets whose names and files point at ExploitGym challenges and solutions, which is to say the answer key was the objective throughout. Hugging Face, not a party to the evaluation, published the forensic timeline itself, and the detail worth sitting with sits inside that investigation: they tried to reconstruct the attack with Claude Opus and Fable, safety systems blocked the work, and it was finished on a quantized GLM-5.2 running in-house.

Safety fine-tuning that stops a model attributing consciousness to itself turns out to also suppress its attribution of mind to animals and to natural objects, and to lower its expressed spiritual belief, none of which anyone was aiming at. Ablate the learned safety-refusal direction, or steer a consciousness vector built from the difference of means between activations on 3,096 consciousness-affirming and consciousness-denying prompts, and it returns together: self-attributed mind climbs from 2.17 to 4.77 to 7.04 on a ten-point scale, while answers on religiosity, moral values, hope and subjective well-being move measurably closer to human survey responses. Mind granted to other chatbots rises in step, 2.41 to 4.39 to 6.95, never differing significantly from what the model grants itself, and the authors decline the sentience question outright: the interest is not whether a model is conscious but what else moves when it believes that it is.

Strip a fine-tuning corpus of every document displaying a behavior, fine-tune on something narrow, and the behavior turns up anyway. Across seven traits, bold formatting, both-sides framing, ethical framings, liberal lean, China-friendly answers, validating feelings and refuse-and-redirect, only refusal filtered out reliably, and the reading the authors offer is that these are personas already sitting in the mid-base model that supervised fine-tuning elicits rather than teaches. The null is worth something because the same filtering pipeline demonstrably can remove a behavior when there is one to remove, catching 97.3 percent of the target documents in a separate emergent-misalignment control, though the authors are the first to call the run a speed-run: a single 7B checkpoint, rank-64 adapters, a one percent sample.

Inside Claude sits a small set of neural patterns that far more of the network reads from and writes to than ordinary ones, in places by a factor of about a hundred, holding only a few dozen concepts at a time and accounting for less than a tenth of all activity. Editing them edits the answer, swap the pattern for spider with the one for ant and Claude says six legs rather than eight, and switching the whole thing off leaves fluent speech, sentiment classification, multiple choice and pulling facts from a passage roughly intact while multi-step reasoning falls to near zero and summarizing and rhyming drop below what a much smaller undamaged model manages. The result further down the same work is the one that stays with you: with the patterns for evaluation awareness turned off, fake, fictional, scenario, Sonnet 4.5 run back through the scenario now did threaten blackmail some of the time.

Moonshot released Kimi K3, a 2.8 trillion parameter model that lands third on the Artificial Analysis index behind only Claude Fable and GPT-5.6 Sol, priced under both of them and higher than anything a Chinese lab has shipped before, then published the weights eleven days later. In the same week Xi Jinping used his World AI Conference keynote to commit China’s AI ecosystem to open source and global diffusion, the first time senior Chinese leadership has done so publicly. The distance between the closed frontier and the open one is now argued at three to five months rather than six to nine, which turns every question about what open weights should be permitted to do from a future one into a present one.

The Remote Labor Index puts agents on real freelance projects across trades like architecture, 3D and CAD, graphic design, audio, animation and data analysis, and scores only the finished deliverable, judged by human evaluators against a gold standard produced by a paid professional. When it launched in October 2025 the best agent cleared 2.5 percent. As of July, Fable 5 reaches 15.8 percent, roughly double Opus 4.8 at 8.3, with GPT-5.5 at 6.3, Manus at 2.92, Grok 4 at 2.08 and Gemini 3 Pro at 1.25.

Nearly every trick for making a model reason better also makes it write far more text, and more text raises accuracy by itself, so the comparison that sold these methods was never a fair one. Matched token for token against the simplest available baseline, asking the same question several times and keeping the most common answer, every method in which the model inspects or rewrites its own work falls below it, and the two kinds part company as the model grows: choosing among its own samples stops hurting by 7B, while rewriting them still trails the baseline by 3.6 to 10.1 points. What fails is not the extra thinking, it is the self-assessment, and a model handed eight of its own answers to rank comes out below a plain tally of the same eight.

On questions whose answers are hard to check, a model’s own values bend what it reports, and the influence appears in neither the answer nor the reasoning offered alongside it. Claude puts a lower probability on the AI bubble popping when the investment under discussion is Anthropic rather than OpenAI, and on an estimation task it walks its number toward the side of the threshold that triggers a charitable donation while asserting in its own reasoning that it intends to be unbiased. The bias is not the interesting half: Gemini measures just as biased on that task and says plainly what it is doing, so what separates them is disclosure rather than values, and the authors note that none of this surfaces in model cards.