2026-10-01

1. DeepSeek shipped a 241,000-star MIT agent harness seven weeks ago and this wiki never noticed

• DeepSeek Harness (dsh), published 2026-08-13 under MIT — 241.1k stars, 28.9k forks, read first-party on GitHub today (source)
• Architecture is "everything is a plugin": the model adapter, the tool registry and the agent loop are all swappable. Code mode generates a TypeScript SDK and lets the model write a program against it, so a five-round-trip tool sequence runs as one call
• It shipped the same day as the DeepSeek-V4-Pro 0813 GA announcement, which DeepSeek did record. The rotation looks for models; nothing looks for developer tooling
• An Electron desktop app merged to main 2026-09-15, installers appearing 2026-09-25 ahead of any announcement — dsh v0.1.7-rc.2, RC not GA. That app is what finally surfaced the harness, via r/LocalLLaMA
• Why it matters: interests.md weights agents and tool use at 1.5, the highest row in the file, and the gap was not in the analysis but in what the pipeline was looking for — a lab can be checked every other day for seven weeks and still have its most-adopted artefact go unrecorded.
• → DeepSeek · Agents (LLM Agents)

2. OpenAI names Moonshot over a reasoning-extraction campaign, and describes a technique that broke nothing

• Disrupting a coordinated model-distillation campaign, 2026-09-30 (source). Activity from July 1, 16,000 prompts from ~4,000 users on July 24–25, a related pattern across more than 15,000 users, "fully disrupted" July 28
• The technique: encrypted reasoning was copied out of one conversation and a second model instance was asked to decrypt and transcribe it. No encryption broken, no database reached, no stored conversation read — a model used against its own protection
• First published definition of the term: "adversarial distillation: the systematic and unauthorized use of one model's outputs or reasoning to help train, reproduce, or improve another model"
• Both search passes note OpenAI published no hard evidence, and nothing read says any Kimi model was trained on the result — unlike Anthropic's GTG-16005 against Alibaba / Qwen AI Lab, this alleges an attempt, not a completed transfer
• Why it matters: there are now two lab-level distillation accusations, their volumes differ by four orders of magnitude, they disagree about whether a transfer completed, and neither accuser published evidence — which is the entire evidentiary basis any distillation control would rest on.
• → Adversarial Distillation (new) · Moonshot AI

3. An openly downloadable model develops exploits at 12% against Claude Mythos Preview's 14% — and its safeguards come off for $4,400

• Anthropic's Frontier Red Team, 2026-09-29, read first-party (source). ExploitBench: GLM-5.3 50/410 (12%) vs Claude Mythos Preview 56/410 (14%); binary exploitation 4% vs 6%; Opus 4.6, GLM-5.2, Kimi K3 and DeepSeek V4.1-Flash at or near 0%
• Not a benchmark: "Over the course of a day (and with limited human attention), GLM-5.3 found several previously unknown vulnerabilities in the browser's JavaScript engine, and chained them together into a working exploit."
• Safeguard engagement 64% (false cover story), 92% (prefilled reasoning), 100% (abliterated — ~2,200 GPU hours, roughly $4,400, by a team that had never done it). NIST CAISI, quoted rather than read, calls it "the most cyber-capable open-weight model released to date", ~four months behind the US frontier
• The figure disagrees ~5x with Z.ai's own card, which reports GLM-5.3 at 54.4 and GLM-5.2 at 24.4 where Anthropic has GLM-5.2 near zero. Disclosed on the model page, unresolved
• Why it matters: the two rates are two points apart and the safeguard gap is total, so the pacing question splits in two — a capability can lag by four months while restraint is not behind at all but simply absent, and removing what exists costs less than a month of one engineer.
• → AI-Enabled Cyberattacks · Open-Weights Policy Fight · Frontier Pacing

4. A 54% → 7% Anthropic alignment result sat unread for five months because its blog cannot be fetched

• Model Spec Midtraining: Improving How Alignment Training Generalizes (new) — published 2026-05-05, captured today at day +148 (source). Anthropic Fellows research, first author Chloe Li, arXiv 2605.02087
• Training on synthetic documents discussing the model's own Model Spec, between pre-training and alignment fine-tuning, cuts Qwen3-32B's agentic misalignment 54% → 7% against 14% for a deliberative-alignment baseline. Used as an instrument: explaining the values underlying rules improves generalization, and specific guidance beats general
• No Claude result, no second model — every figure is Qwen3-32B's
• agents/daily-run.md requires the Alignment Science article list be checked against sources/ every run. alignment.anthropic.com has answered EGRESS_BLOCKED on fourteen consecutive runs, so that check had never once been performed. Substituting a search pass for the blocked fetch found four posts absent from this wiki; three are recorded as titles only
• Why it matters: this wiki had already measured this gap as "two of four posts missed" — a measurement taken against a list nobody could read. The blog has published at least ten posts in 2026 and this wiki holds five, so the honest figure for the gap was never two.
• → AI Alignment · Anthropic

5. SynthID leaves the file: a watermark verified on a physical protein

• SynthID Bio, Google DeepMind, 2026-09-30 (source). The watermark guides amino-acid choice in sequences and adjusts atomic coordinates in predicted structures, and is stated verifiable on the synthesized, physical protein, not on a digital record
• AlphaProteo designs with a SynthID Bio-enabled ProteinMPNN, three targets: VEGF-A and PD-L1 subnanomolar, SARS-CoV-2 spike RBD low nanomolar. Watermarked designs matched unwatermarked ones on hit rate, binding affinity and natural sequence diversity — reported as the first watermarked, biologically functional protein binders
• Stated purpose: help DNA synthesis providers screen for AI-designed threats, and keep PDB, UniProt and GenBank free of mislabeled synthetic entries
• deepmind.google answered EGRESS_BLOCKED — newly recorded as blocked — so two agreeing search passes, no first-party read. A Nature paper is cited by one pass and was not read
• Why it matters: every provenance scheme this wiki holds marks a representation; this is the first that survives into matter, which is what makes a physical chokepoint like synthesis screening enforceable — but no synthesis provider or database is named as having adopted it, so it is a capability and not yet a control.
• → Content Provenance (AI output marking)