mnicky

You can also create custom agents with defined effort levels and use those.

Well, always watch also the number of tokens used (and price). Intelligence scales with tokens so you might make Luna as smart as Sol with crazy amount of them :)

Also, these are benchmarks...

It's a bit misleading I think because these benchmarks are for Max level, at which Anthropic newest models use crazy amount of reasoning tokens. And we know that intelligence scales with their number.

On the contrary, subagents save context overall, when the task is sufficiently large.

Also, my experience is that Fable 5.1 is very good at prompting/orchestrating Opus/Sonnet subagents when working on a larger task (e.g. 1-2M context window use only for the orchestrator itself).

Well, it's performance "surface" (is there a better term for this?) is probably very narrow compared to Fable :)

Well, prompt injections work precisely because they can sometimes successfully imitate user role, right? Role separation is a trained behavior, not a security boundary.

They could probably make a separate tool for setting this, that would always initiate a harness prompt (i.e. disregarding the currently set mode).

> This is not prompt injection. This is a prompt entered by a human through the Claude UI.

Well, to LLMs this is the same thing - an input. Prompt from the user and prompt from the attacker use the same input into the LLM's neural network, so to speak.

So it makes sense for it to be a bit more paranoid.

There are other possible architectures probably but for now I think nobody uses them. See e.g. https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/

When it launches command in a blocking shell, just press something like ctrl+b and this sends the shell to the background and you can continue to use the agent..

Previously after the subagent finished it sent a message to wake up the orchestrator agent. I hope they haven't changed this..

The model had tendency to use sleep to wait for the subagents but it is not necessary..

Do you have source?

Sorry, this wasn't a reply to the free will part.

And yes, I meant the problem of the first cause, but it probably isn't a strict refutation...

And also, when it's stated as "every effect has a cause" (not "everything," as I first understood it), then it's probably even a tautology :)

To the free will part itself - I can say that I decided to do B because of a reason A (so the effect B was caused directly by my decision and indirectly by A) and I still have a free will?

Hmm, but isn't a statement that _every_ effect has a cause self-refuting?

What you may be missing is that they probably track the API performance.

Subscription plans may be subject to other regime, e.g. lowering the thinking budget when the API is under heavy load, etc.

Why would you use max? It's usually unnecessary and even prone to overthinking. In my experience, since Opus 5 the medium/high is usually enough (until 4.8 I used xhigh, but never max). Even low is quite usable these days..

Well there is at least the degradation tracker from Margin labs for Sol and Opus: https://marginlab.ai/trackers/codex/

AFAIK Jev is nothing special technically so it's easy to embed it as an another tool for the LLM? For many batch tasks it can still be quite a token saver I think.

Or they can even offer it as a standalone API if deemed worth it.

Well, definitely some LLM use :) At least in the second half... Confirmed with Pangram detector as well, which has pretty good precision.

Also, in a few years, LLMs will be building the next generation of LLMs anyway, probably autonomously to a high degree.

Try using output styles: https://code.claude.com/docs/en/output-styles

Use output styles: https://code.claude.com/docs/en/output-styles

Output styles do that. They modify system prompt and even are periodically reminded in longer conversations I think...

Well they say Opus was trained for the subordinate role, so it doesn't excel in global view of things.

It may be a good subagent but probably not a great decision maker.

It’s more that they have a different business case than competing for the top spots on public benchmarks.

They seem to be oriented more toward customizing models for the concrete needs of a company, on-prem deployment, proprietary knowledge-bases, etc.

With current gaps in DNA synthesis screening yes. But this will be improved in the future hopefully.

> The biorisk scenarios that the AI safety folks flog are fever-dreamed fantasies that have only the most tenuous connection to biological reality.

As an expert, could you also provide your arguments please?

Many ways but mostly ordering some service / using others. Either by social engineering, persuasion, paying etc.

The air gap would probably help and after this incident I hope labs will think about using such a measure when appropriate.

On the other hand I think that proper solution for these kinds of problems is not at a sandbox level, but at a model alignment level.

Also it shows that maybe the most serious risk comes not from releasing models publicly but from internal, pre-release period where you sometimes need/want to lift some guardrails a bit etc.

These days you can only try, that's why I wrote that :)

But in the near future labs will be more automated I guess.

The other option you can try these days is maybe social engineering, impersonation, etc. where you try to persuade someone to do that for you.

That would be something like 70% of their yearly global profit AFAIK.

I think points that deserve more attention in the current public discourse are:

- This should be a huge wakeup call for everybody.

- We are lucky that it wasn't a case of an agent running a virology lab benchmark that decides to hack a lab and tries to synthesize something.

- It also shows apparent lack of competence and oversight from OpenAI: how is it that they didn't quickly find that agent is breaking the sandbox and roaming their internal network?

- What if in the future similarly misaligned AI agent tries to export its own weights and hack and clone itself into instances at various cloud hosting providers? Suddenly we might be dealing with a persistent threat harder to contain.

- The OpenAI post about this shows surprising lack of ability to see the seriousness of all this.

- For their models this isn't just an unlucky incident: it seems there have been multiple such cases recently, e.g. https://openai.com/index/safety-alignment-long-horizon-model...

- The fact that it happened again seems to show their lack of ability to derive useful oversight measures.

- Or they just don't care enough?