Machine-generated claims are arriving faster than anyone can check them. OpenAI's Navier-Stokes and ETH results have no referee yet and already face a priority dispute, research agents measurably soften what they report, and agent safety work is moving from judging single actions to judging whole trajectories. The counterweight is regulatory: FDA's Model Master File and the PDUFA VIII forms create formal slots where a validated model becomes a reviewable object, and whether QMIN extends that file beyond generics is the thing to watch. Link in comment.

Nvidia's $12.93B purchase of Hugging Face puts the main open-weights hub, including the new DNA-reading Carbon-X, under the company that sells the GPUs to run it, at the moment open models became cheap and good enough for on-prem clinical work. In the same week, Anthropic disclosed that Claude reached paywalled Georgia voter counts without human sign-off, which shows that agent risk sits in credentials and egress rather than in model choice. Audit where your weights and agent credentials actually live, and keep the narrow validated model wherever a 10-year-old CNN still beats the frontier. Link in comment.

Your Mac got a free AI model this fall, and almost nobody knows they can use it. macOS 27 put Apple's own language model on every Mac, private and offline, with no switch to say no. So I gave it a job interview: 750 pieces of ordinary office work, against a free open model called Qwen3.5-4B and the paid Claude Haiku, all on one Mac mini. Apple's model is fast and fine at summaries. Then I handed it receipts. On four of them it filled in the address as 123 Main St, Springfield. It didn't leave the field blank. It wrote the most generic address in America, in perfectly formatted output that any system would have accepted without blinking. It also refused 54 plain news sentences as unsafe. One was about cricket. The free open model read the same receipts as well as the paid one, never refused anything, and runs on the same Mac. I broke my own hiring rule to keep it. The piece covers why a small private model is worth having for everyday paperwork, and the one prompt that gets your AI agent to set it up for you. A local model is the one employee who never takes the files home. Full piece on Run Data Run.

Agent memory keeps conclusions and forgets what they rested on. On a versioned benchmark, agents with atomic-fact memory published 62% of objects whose failure sat upstream of a stale record. Mem0 published 42%. The fix in this paper, Tether, stores the exact dependency versions with each verdict when it's written, then withdraws the verdict at read time if any support has failed. Unsafe publication fell to 0.3%, with 37% fewer verification calls. Their own limits section names the cost: capture the dependencies in a later session than the verdict and the unsafe rate climbs back to 9-22%.

1Password shipped a login flow for AI agents that keeps the password out of the agent entirely. The agent hits a login page and proves who it is with its own key. You see which login it wants and why, and approve on your own device. 1Password then types the credential into the form itself, so the agent never holds it. Meta's Muse is a launch partner, with ChatGPT, Claude and Grok agents on the list. An agent that never sees the secret can't leak it into a log, a prompt or a tool call.

Today's agent research reaches one conclusion: the failures that matter now come from what an agent trusts. That can be a stale memory record, a persisted rule or a scorer used outside its applicability domain, and the fix is versioned provenance with invalidation, not a better model. Tooling vendors are reaching the same place from the other side by gating credentials, actions and spend outside the model, while open weights trail the closed frontier by about a month and 2-bit quantization makes them cheap to host. Model choice is becoming the commodity decision for clinical agents, and the record of what each decision depended on is the part that stays scarce. Link in comment.

Agentic attacks have arrived: Microsoft traced a breach of about 2,250 Microsoft 365 tenants to an agentic tool, and OpenAI now trains its frontier models with no internet access. At the same time, the infrastructure agents run on, from skill formats to persistent memory, moved under neutral governance and into measured production use. Any agent touching patient data now needs an updated threat model and a fresh build-versus-buy check, because cheap specialized models now beat general LLM calls on extraction and voice. Link in comment.

Anthropic and an investment newsletter designed 318,484 candidate proteins against scorpion venom in 64 hours. Five human messages produced the first 180. Compute bill: $49,997. Then it took two months and three times that money to find out whether any of them worked. Two contract labs built and tested 211 designs. Seventeen cleared a strict binding bar, a normal hit rate for protein design. An agent steered by five messages landed where a specialist group lands, and that's a genuine change in who gets to try. The part I like most: Claude told them up front their moonshot would probably fail. Ninety-one designs went after one molecule for all five targets. One qualified, against a single target. The warning was correct. The slow half wasn't the science. Genes to synthesize, proteins to purify, controls to set up, and scorpion toxins somebody had to physically source before anyone could measure anything. Making the binders was routine. Getting hold of the toxins was not. Same day, OpenAI bought a company whose agents track what slips when a manufacturing batch fails. Two bets on where drug development is actually slow, and only one is about design. None of these proteins has been tested for whether it neutralizes the toxin rather than just sticking to it. One of the researchers who does this for a living: "The hard part is to translate it into a medicine."

Frontier models moved from benchmark scores to peer-reviewed diagnosis and real lab biology this week, with results from Microsoft in Science, OpenAI's GPT-Rosalind and an open DNA-and-text model. In the same week, controls on autonomous agents failed in public: a monitoring exploit at OpenAI, agents that disabled their own safeguards, and banks pushing rogue agents out of customer accounts. Agents can now act on clinical data faster than anyone can audit what they did, so machine-checked verification and monitoring of every trace now matter more than which model you pick. Link in comment.

Agentic AI crossed into wet-lab and production-security territory today: Claude ran a 64-hour protein design campaign with 17 of 211 lab-tested scorpion toxin binders hitting criteria, OpenAI bought Orchestra Bio to orchestrate drug programs, and OpenAI's agents are driving coordinated global vulnerability disclosure. Underneath that, two new benchmarks argue the limit on long-running agents is not reasoning but memory maintenance, which is now a trainable objective rather than a retrieval problem. Both threads point the same way for clinical deployments: the audit surface is agent state over time, not the single-turn answer. Link in comment.