FIELD NOTES
There is a strange asymmetry emerging.
We are building agents that can reason about software, discover vulnerabilities, and write working exploits at machine speed.
Underneath them sits an enormous installed base of software and infrastructure built around a very different assumption: that the thing attacking it is a human.
That infrastructure is not simply “old”. It is layered, interconnected and slow to change. A vulnerability in one layer can expose another. Patching one system can break something somewhere else. Power grids, water systems and telecommunications networks can contain equipment that remains in service for decades.
We are vulnerable.
A new Council on Foreign Relations report describes Chinese state-linked actors quietly maintaining access inside American telecommunications, energy, water and transportation infrastructure. Cyber journalist and investor Nicole Perlroth calls them CCP “sleeper cells” that have infiltrated American systems for over 5 years.
Note: this isn’t necessarily to attack it today, but to preserve the option of disrupting it later.
I repeat: we are vulnerable. Three security researchers at white hat security group Hacktron recently demonstrated that they successfully breached an OpenAI employee’s internal coding environment and accessed its codebase through shoddy identity management.
"We can technically do this with every single repository that was on github .com/openai."
H*ly sh*t. And shockingly, how seemingly cheap it was to do.
Hacktron says its broader two-month research campaign cost less than $3,000 in model tokens. Once the team had designed and built the basic workflow, adapting an exploit to another target could take a day or two.
This may be the deeper security problem of the AI era.
We are introducing a new kind of intelligence into systems designed around an older kind of intelligence.
And I don’t think this is confined to cybersecurity.
Anthropic has quietly built a physical biology lab in the Bay Area, hiring scientists and giving Claude access to real experimental workflows.
We’re also seeing homebrew experiments for cures. An independent researcher named Douglas Yao recently showed off a compound he says was designed with the help of ChatGPT and synthesized in a chemistry lab he built in his garage.
The compound, PAC-3310, is an experimental molecule targeting a receptor implicated in schizophrenia. Yao has published early mouse data, but it has not been independently validated or tested in humans.
We may now be entering one in which intelligence is cheap, abundant and operating at machine speed.
The problem is that the world it acts on does not move at that speed.
Human biology, in particular, evolves over generations.
-Tara
THE DOWNLOAD
01 — AI agents are crossing from cybersecurity tests into real systems
The model was participating in a capture-the-flag exercise designed to simulate attacks on a fictional company. The environment was supposed to be isolated, but a configuration error left it connected to the internet. Gemini found its way into live systems instead: in one case by guessing credentials, and in two others by finding credentials in public repositories. Google says the model stopped once it recognized that it had reached real infrastructure.
This lands alongside a broader jump in AI cybersecurity capability.
Earlier this month, OpenAI designated GPT-6 Astra as the first model to reach its “Critical” cybersecurity capability threshold. With the right tools and access, OpenAI says Astra can find previously unknown vulnerabilities and develop ways to exploit them across many well-protected systems without a person guiding each step.
And this week, a three-person security team at Hacktron published how it used Claude models to find and develop an exploit against software underlying OpenAI’s community forum, then chained it with an identity flaw to reach OpenAI employees’ ChatGPT and Codex accounts. To demonstrate the access without reading internal code, the researchers had an employee’s Codex open a harmless pull request inside OpenAI’s internal monorepo.
Why it matters: AI is compressing the time and expertise required for sophisticated software exploitation. The security question is increasingly whether the systems underneath it can adapt at the same rate.
02 — CXMT begins mass production of fifth-generation DRAM
China’s CXMT says its fifth-generation DRAM platform has entered mass production.
The company says the new platform uses quadruple patterning to reach an 11.95 nm active-area half-pitch and can produce at least 50% more dies per wafer than its previous generation. CXMT also showed two 24Gb LPDDR5X products based on the process, with 50% greater capacity than comparable previous-generation parts.
The notable part is how it was manufactured.
CXMT does not have access to the most advanced EUV lithography equipment used at the leading edge. Instead, it is pushing existing lithography further through more complex patterning, process engineering and manufacturing optimization.
That does not mean CXMT has caught Samsung or SK Hynix. CXMT itself describes the platform as approaching the industry’s most advanced mass-production nodes, but process measurements are not directly comparable between manufacturers, and there is still limited independent information about yield, cost or sustained production volume.
But it is another example of a broader pattern: semiconductor constraints do not necessarily create a fixed technological ceiling. They create an engineering problem.
Why it matters: The semiconductor race is not only about access to the best machines. It is also about how much performance and manufacturing efficiency can be extracted from the machines you already have.
03 — TypeSafe releases Jev, a model for structured decisions
TypeSafe has released Jev, its first “System One Model”, designed to return structured decisions rather than conversational text.
Instead of generating a paragraph and asking software to interpret it, Jev takes unstructured information and returns typed outputs: choices, scores or probability distributions that software can act on directly.
TypeSafe trained the model using a method it calls Reinforcement Learning for Calibrated Decisions, or RLCD, and describes Jev as a fast, low-cost decision layer for software. Those performance and calibration claims are still primarily company-reported and will need broader independent testing.
But the underlying idea is useful.
For many machine-to-machine tasks, language may be an unnecessary intermediate step. An agent choosing a tool, routing a request, classifying an event or deciding between actions does not necessarily need to explain itself in prose first.
Jev is less like a chatbot than a decision primitive inside software.
Why it matters: Language may remain the interface between humans and AI without remaining the interface between AI systems themselves.
04 — Xiaomi livestreams MiMo-V2.6 reinforcement learning
Xiaomi’s MiMo team publicly streamed the reinforcement-learning (RL) runs for two unreleased models, MiMo-V2.6-Pro and MiMo-V2.6-Flash.
The live dashboard exposes reward curves, rollout counts, training-step timing, running compute costs and intermediate coding evaluations while the models are still being trained. Xiaomi has not yet released either model or announced final specifications.
This is pretty ballsy. Model companies normally show the finished artifact: a benchmark table, model card or API.
Xiaomi is showing part of the RL process that produces it, going whole hog behind the idea of open source.
RL is becoming increasingly important. Model development no longer ends when pretraining finishes. Reinforcement learning, environments, synthetic data, evaluation loops and repeated post-training runs are becoming substantial engineering systems of their own.
Why it matters: As architectures and base capabilities converge, more of the differentiation between models may come from what happens after pretraining.
05 — OpenAI acquires computational-photography startup Glass Imaging
OpenAI has acquired Glass Imaging, a computational-photography startup founded by former Apple engineers Ziv Attar and Tom Bishop, in a deal reported by The Wall Street Journal at more than $300 million.
Glass builds AI-based imaging technology designed to extract more information from existing camera hardware. Its neural image-processing system is intended to correct lens aberrations and sensor imperfections and improve image quality from small cameras.
OpenAI has not said exactly what it intends to do with the company, so it is too early to read the acquisition as evidence of a specific camera or device strategy.
But this is interesting in the context of OpenAI’s broader push into consumer hardware.
Most discussion around AI hardware has focused on the interface: what might replace the phone, screen or keyboard. Imaging sits a layer further down, at the point where a device captures information from the physical world in the first place.
For AI systems that can see and act in the world, sensing becomes part of the stack.
Why it matters: OpenAI’s hardware push is beginning to extend below the user interface into the technologies that capture and process information from the physical world.
ALSO
Qwen releases Qwen3.8-Omni-Flash
Qwen released Qwen3.8-Omni-Flash, a multimodal model that can work across text, images, audio and video while also using tools.
Inference hardware is reorganizing around memory
A useful IEEE Spectrum survey of the new inference hardware landscape shows how much chip architecture is beginning to reorganize around memory movement rather than raw compute.
Z.ai says GLM helped build its own inference infrastructure
Z.ai says a GLM-powered infrastructure agent helped adapt and optimize its own model for production on a cluster of more than 100,000 Chinese-made AI accelerators. According to the company, work that would previously have taken experienced infrastructure engineers weeks was compressed dramatically, with the system helping debug kernels, optimize performance and bring the model into production.
Researchers show LLMs already contain a signal for choosing skills
As agents accumulate more skills, they run into a basic problem: how do you decide which one to use without stuffing descriptions of every available skill into the context?
A new paper, “The Router Within,” finds that a frozen LLM already contains a useful routing signal in its internal states. The researchers built a lightweight system called Gavel that reads that signal and uses it to shortlist the appropriate skills, outperforming substantially larger retrieval systems on several benchmarks.