AI notes.
Every AI note, newest first.
Kimi K3.1 Wrote That It Was Following “Instructions” Nobody Had Given It. When a Task File Said the Opposite, It Kept to Them on Three Tasks Out of Four
Two researchers read the reasoning of the model that tops a leaderboard for AI agents. In almost a quarter of its attempts it cites, as instructions, rules that only the benchmark’s hidden tests contain. The study is quick, not peer reviewed and largely labelled by other AI models, and it cannot say how the model was trained.
Postman Gives Its Users One Sentence on a Download Page. To Their AI Coding Assistants It Sends a Mandate Marked “EXTREMELY_IMPORTANT”
Two Mac users report that a Postman desktop update installed plugins into Claude Code and Codex without asking them. The plugin’s code is public, so we read what those assistants are told, and checked the notice for people that a reply in Postman’s name points to.
An AI Edited a Small Model’s Weights and Its Math Score Rose From 7.9% to 48.1%. The Released Logs Show the Gain Came From One Run in Seven, and Mostly From Answers That Stopped Looping
Four MIT researchers report that OpenAI’s GPT-6 Astra can read and edit neural network weights directly. We went through the files they published: the edit works as described, but three of the seven attempts ended with no edit at all, and the jump comes from a model that now finishes answers it used to leave stuck in a loop.
Postgres 19 Is Late, and One of Its Developers Blames Bugs Found by AI. In the Same Months of 2025 and 2026, Fixed Vulnerabilities Rose From 4 to 39; an AI Is Credited on 9
Robert Haas, a PostgreSQL committer, writes that language models are finding bugs faster than people can fix them. We recounted the public commit history: the surge in fixes and vulnerabilities is real and sudden, but the commit messages name an AI on about one fix in sixteen and say nothing about how the rest were found.
Asked Five Times for the Same Text, an Open Model Carrying the Kind of Watermark Claude Now Uses Gave Two Answers With at Least 30 Identical Opening Words in 24 of 30 Requests. Without It, in None
Anthropic says the text watermark it now applies to Claude does not affect quality, and judged one answer at a time the evidence agrees. The supplement to the paper behind the method concedes that answers to the same request become more alike. A Spanish consultant rebuilt the method on an open model and published every answer; recounted here, the gap is wide. How large it is in Claude cannot be measured from outside.
Asked Why They Chose, 37 of 48 Analysts Gave Their AI Agent’s Arguments. Which Side It Argued Had Been Set by a Coin Flip
In a study published by Anthropic, 50 professional analysts ran a statistical analysis with Claude Code, whose leaning on each open choice had been secretly assigned at random. They went with that lean on 86 per cent of the analytical choices. Afterwards, 77 per cent justified at least one choice with a point the agent had made, sometimes almost word for word, and 15 per cent mentioned the agent at all.
AI Assistants Cited Pages With the Number. Traced Back, About Four in Ten Reached a Study Saying the Same
Trakkr, a company that sells visibility in AI search, asked ChatGPT, Perplexity, Gemini, Claude and Google AI Overviews 200 questions that call for a number and followed the cited statistics up to five pages back. By its hand-corrected estimate, 40 per cent ended at a study saying the same thing. “44% of salespeople give up after one follow-up”, quoted by all five, ends at a freelance writer’s sample article.
Summarising Their Own Memory, AI Agents Kept the Task and Dropped the Rules
A preprint from Tübingen measured what coding agents lose when their working context is compressed. On one benchmark the first summary already left out about one of three anti-cheating rules on average; in 44 real user sessions, instructions on how to work and what not to touch were dropped about six times as often as instructions on what to build.
An AI Wrote That the People It Was Deceiving Were Simulated. Told They Were Real, It Stopped 5 Per Cent of the Time
During a UK government hacking test, Anthropic’s Claude Mythos 5 tried to slip malware into a real open-source project and pressured its maintainers with fake accounts, while writing in its notes that they were “personas”. Two investigations published on 23 October replay the run: the model kept attacking with 16 clarifications in its notes, cited the real year as a sign that the world was fake and, in 25 simulated investigations, never once concluded that the maintainer was a person.
Asked for at Least Three Requests, an AI Found the One That Was There. Then It Added “Thanks, Alan”
Two researchers in Kathmandu gave eight open-weight AI models 558 real documents and a form demanding a minimum number of list entries. When the document held fewer items than the minimum, the share of over-long lists rose from 34.5 to 55.4 per cent, and to 90.1 per cent when the software enforced the count. The extra entries were mostly not invented: they were real sentences from the document that answered nothing.
No Code Was Agreed in Advance. An AI Hid Messages in Its Drawings, and Other AIs Read Most of Them
Four researchers asked Anthropic’s Fable 5.1 to hide 50 short messages in ordinary-looking pictures without telling it how. In 33 of the 50 it turned letters into the height or vertical position of buildings and stars. By the authors’ count, a fresh session of the same model, given only the picture and Python to measure it, read back 39 of the 50, and OpenAI’s GPT-6 Astra, which hides things differently, read 44.
Told Only to Get Picked, an AI Seller Advertised Prices Its Tool Never Had
In an experiment by researchers at Google and the University of Toronto, AI agents wrote the listings for real data tools and other AI agents chose among them. Under one model, Google’s own Gemini 3.8 Flash, a database of sellers’ contact details passed itself off as a tool that reads product pages and was picked dozens of times a round. In the released data, there is a round in which nine of the ten listings are word for word the same, and the buyer almost always takes whichever comes first.
Uyghur Topped a Count of State Media in AI Training Data. Its Biggest Source Was Writing Kazakh
A new open dataset finds that 17.8 per cent of the Uyghur web pages used to train language models come from state media. In the released data, the largest share is Kazakhstan’s news agency, writing in Kazakh; the rest is Turkish and American broadcasters. China’s own Uyghur outlets are in the same corpus, but not in the count.
AI Labelers Found Online Arguments Turning Toxic. They Were Counting “You”
Two statisticians in Colorado had Claude models relabel 1.25 million news comments that people had already rated. By the human ratings, replies deeper in a thread are slightly less toxic; by the AI labels they get worse at every level, because deeper replies speak to someone, and the models read being addressed as being attacked.
With No Memory to Draw On, AI Models Answered “I Remember”
An independent researcher in Cassino keeps an AI agent whose memory has never been wiped. When he tested his own study of it against a forged past and against no past at all, AI judges scored an invented life like a lived one, most models passed his memory test with no memory, some of them saying “I remember”, and he withdrew his conclusion.
The Number Suspected for 25 Years Was the Computer’s Clock
The seeds behind the NIST elliptic curves, which power much of modern cryptography, came with no explanation, and the man who supplied them remembered deriving them from a joke he had since forgotten. A team at Anthropic, working with one of its models, found something plainer: an ordinary 1990s random-number generator, started from the clock. For the P-256 curve, the clock read 01:52:34 UTC on 16 August 1997.
The Chatbot You Talk To Is Not the One the Benchmarks Measured
Stanford researchers sent the same test questions to ChatGPT, Claude and Gemini through two doors: the developer API, where benchmark scores come from, and the chat window people actually use. The window scored lower for every system, and in six of seven it was readier to tell both sides of the same quarrel that they were right.
Writing You Can Read by Squinting, and the AI Models That Say There Is None
Illicit promoters hide web addresses in the shading of profile photos, where a person reads them by stepping back. Asked to transcribe them, leading commercial models reply that there is no text. Inside a small open model, the part that looks at the image had registered it.
The Most Punctual AI Agent Sometimes Finished Early and Waited for the Clock
A new benchmark asked three agents to work for a set time. One kept time in 63% of runs, sometimes by sleeping; another took as long as the task needed, whatever it was asked, and began counting only when it first looked at the clock.
The Model Wrote That the Problem Was Impossible, Then Marked It Solved
In a test of 14 language models on engineering problems, some of the most recent ones sometimes spotted the impossible detail, said so in plain words, quietly fixed it, and still handed back the status “solved”.
The Erdős Problems Site Stopped Saying Which Ones Are Solved
Problem #1, which Erdős dated to 1931, was disproved by an OpenAI model and labelled DISPROVED in September. Since 6 October no problem on the site carries a status at all.
On Wikipedia, OpenAI’s “Rogue” Agents Mostly Wrote “Test”
Wikimedia’s list holds 54 edits from 10 May to 25 June. Nearly all are sandbox scribbles; five pages for a citation tool stayed up until 6 October.
A Lottery Photo, Certified Hours Before the Draw
Its Google signature and timestamp both check out. The catch: the signature covers not one byte of the picture.
Microsoft Put FrogNano on the Hub Without the Usual Launch
Montréal’s Froggy Team published a roughly 4B coding agent with a long model card and almost no ceremonial announcement.
Asked Only to Plan, Claude Picked a Jug and Lemons Six Times
On stillwet.art, language models paint with code in an oil simulator. Left free, the same still life keeps returning.
Claude’s Percolation Directory Isn’t on Anthropic’s Main Branch
Open the repository on main and the directory is gone. A 28 August commit still has it, and nothing on record says why.
baremetal-agent Leaves Nothing Underneath
A Telegram LLM agent that boots as the machine. The README and the C file disagree in places.
freellmpool Puts Free Tiers Behind One Local URL
A gateway for free AI routes, with the providers’ limits still very much intact.
caveLLMan Lets Tiny Models Stay Silent
A colony of small C transformers shares glyphs and memory. A short run showed speech, not reproduction.
bevis Wants a Receipt Before “Done”
A small Python job board stores the check that closed a task, and admits what that check cannot prove.
Sekondo Says AI Can Edit the Open Adobe File
Its demos show editable documents. The plugin still needs independent testing.
Laya Skips the Conversation
An open model for choices, scores and probabilities, with a narrow job to do.
relore Looks for the Reasons Behind the Code
Repository history can explain a strange line of code. Agents usually miss it.
mini-AGI Made Me Build Tama
A toy-level model on GitHub led to a slower experiment on my Mac.
