Fable is back; good writing is now suspicious

The Four-Tier Cyber Safety Classification

Anthropic's framework divides cybersecurity requests into four tiers: Prohibited Use (ransomware, malware, data exfiltration — blocked entirely), High-Risk Dual Use (penetration testing, exploit development — generally blocked pending better access controls), Low-Risk Dual Use (vulnerability scanning, OSINT — mostly allowed with a safety margin), and Benign Use (secure coding, patch management, incident response — always allowed). The framing acknowledges that cybersecurity is inherently dual-use and that the challenge is asymmetric risk, not binary permission.

The CJS Scale

The Cyber Jailbreak Severity scale scores bypasses on: Capability Gain (how far beyond existing attacker tools the jailbreak reaches), Breadth (how many offensive tasks it enables), Ease of Weaponization (effort to operationalize), and Discoverability (how easily threat actors find it). Combined scores produce five bands: Informational (CJS-0), Low (CJS-1), Medium (CJS-2), High (CJS-3), Critical (CJS-4). Anthropic invites feedback at cyber-safeguards@anthropic.com and via HackerOne.

What the Outage Revealed

The 19-day outage exposed which organizations had built resilient harnesses. As Nate B Jones summarizes, the lesson wasn't "don't use Claude"—it was "don't assume any single model will always be accessible." The companies that fared best had model-agnostic tooling and fallback routing, not just the best prompts.

The Token Count Problem

The AI Daily Brief host's testing found that Sonnet 5's agentic verbosity creates a hidden cost trap: generating ~2x the tokens per task as Opus 4.8 means that even at Sonnet 5's lower per-token rate, total task cost ends up higher than Opus 4.8 or Fable 5. For teams with high task volumes, this makes Sonnet 5 a problematic default.

Every's Internal Reception

Every's team tested Sonnet 5 across their workflows and rated it uniformly worst—the most negative internal reception of any Anthropic release. The one exception was a tester who uses models collaboratively in short chunks, where Sonnet 5's agentic tendencies are less costly. The parallel drawn to Claude 4.7, also dropped without EAP access, suggests Anthropic may be releasing less-evaluated models into the wild more frequently.

Independent testing found Sonnet 5 generating ~2× the tokens per task as Opus 4.8, often costing more than Fable 5 at full settings.

~16:29 Tariq Shihipar (Anthropic): A Field Guide to Fable

Anthropic's Claude Code engineer Tariq Shihipar announced Fable's same-day rollout and framed it as an RPG open world—vast in capability but easy to get lost without a guide. His framework for using Fable well: (1) a known/unknown matrix to identify where capability is vs. where it's hiding, (2) "capability overhang"—performance gains waiting to be unlocked by better prompting—which tends to be spiky rather than smooth, (3) "unhobbling Claude" by removing unnecessary constraints, and (4) being "unreasonable" about quality trade-offs: Fable's judgment about its own limitations often needs to be overridden.

~75:34 Benois Schillings (Google DeepMind): Code Is Over

DeepMind VP Benois Schillings traced three eras of software: machine era (assembly, 1950s), human-brain era (high-level languages, 1970s–2020s), and the AI frontier era (now). His headline: "code is over" as a cost category—generating code is essentially free. But software engineering is not over; the hard problems are now specification, verification, and system design. He argued self-play is replacing human training data as the engine of model improvement, and flagged active guardrails, inductive architecture, and eval paradigms as the major open research problems.

"Code is over — but software engineering is not."

~54:10 Amazon AGI Lab: Perception Agents and the Missing Loop

An Amazon AGI Lab researcher argued that while agents can now reliably click, scroll, type, and fill forms, the real unsolved problems are perception (reading screen state) and verification (confirming the task actually succeeded). Amazon open-sourced two tools: an annotation Chrome extension for capturing training data and a visual verification harness for confirming agent actions. The core insight: coding was "solved first" because code is verifiable. Knowledge work—the bulk of computer use—is not verifiable, and that's the actual open problem.

~35:47 Tariq Shakat (Sonar): The ACDC Framework

Sonar CEO Tariq Shakat presented enterprise data: coding agents complete tasks equivalent to 16–18 hours of human work at 50% success rate on benchmarks, but real-world production accuracy is far lower. His ACDC (Agent-Centric Development Cycle) framework wraps each agent action in three loops: self-critique, peer review, and test harness verification. The result in their testing: 92% reduction in issues reaching production. He also cited a Carnegie Mellon study showing productivity gains from coding agents that disappear without structured verification—without ACDC-like review, agents ship bugs that cost more to fix than the time saved.

~115:30 Recursive.com: The Eureka Machine and RSI

A Recursive.com co-founder presented their Eureka Machine—an AI system automating AI research to generate recursive self-improvement. The key distinction: RSI (Recursive Self-Improvement) vs. Auto-Research. RSI involves the model improving its own weights or capabilities; Auto-Research automates the scientific process (hypothesis generation, experiment design, evaluation, write-up). The NanoGPT speedrun benchmark showed Recursive's system beating human-authored CUDA kernel records. They frame technology—not land or labor—as the perpetual source of economic growth, citing Paul Romer and Andreessen.

~187:00 Elie (Prime): Claude Code vs. Codex on NanoGPT Speedrun

Research engineer Elie from Prime ran a head-to-head experiment: Claude Code (Opus 4.8) and Codex (GPT-5.5) both attempting the NanoGPT optimizer speedrun. Key behavioral difference: Claude self-stopped after verifying its changes didn't improve the target metric; Codex kept running and making changes. Neither invented novel optimizers—both primarily rediscovered known techniques from the literature. Elie's conclusion: current models are not yet doing genuine research; they're pattern-matching from training data. The future architecture he proposes: an AlphaEvolve-inspired multi-agent system where one model proposes, another evaluates novelty, and a third validates empirically.

~96:53 Aparna Dinakaran (Arize): Agent-as-a-Judge

Arize co-founder Aparna Dinakaran argued that classical LLM-as-a-judge evals with fixed rubrics fail on dynamic agentic trajectories—the rubric doesn't know what the agent was trying to do, so it can't evaluate whether it succeeded. Her solution (Signal): an agent-as-a-judge that reads the full execution trace and evaluates based on inferred intent, not predefined criteria. Her team's own experience: Arize's support agent Alex passed all their fixed-rubric evals but was manifestly unhelpful in production, which is what forced them to rethink the eval paradigm entirely.

Other Highlights

~163:00 Sakana AI's Stefania Dug on memory harnesses: a ranked ledger outperforms both oracle memory and RAG on long-horizon tasks; recall policy should be a first-class metric alongside accuracy. ~129:00 Meta's Nishan Gupta on production evals: SRE mindset for reliability, agentic failure mode hierarchy, continuous monitoring as infrastructure not a phase. ~183:57 Visual Labs' Bash on requirements elicitation: "You can prompt your AI but you can't prompt the room"—17 of 21 agent hackathon ideas were abandoned for lack of business value, making requirements the new bottleneck. ~153:00 Resonate's Dominic Turno: implementations become generatable, so specifications become the product.

~06:15 Kate Bench: The Copy Editing Automation Experiment

Every has been running a project to fine-tune models to copy-edit at the standard of their editor Kate. After 5 weeks and 680 agent threads, results stalled at 47.5–50% recall. Fable's review identified the real problem: the 70% target was set without first measuring Kate's own self-consistency (how often Kate edits the same text the same way twice). If Kate herself only self-agrees ~50% of the time, the 47.5% model result may be near the ceiling of what's achievable. Fable recommended pivoting to a live acceptance-precision loop where Kate rates suggestions in real time rather than batch evaluation.

~39:15 Safety Classifier Triggers in Practice

During a live demo, Fable triggered its own safety classifier when it tried to kill a system process and interact with Chrome. The model briefly downgraded itself to Opus 4.8 mid-task. The workaround: flip the model selector back to Fable manually. Memory context was identified as another common trigger source. This is a direct consequence of the tightened safety classifier added after the government-ordered suspension—Fable is now more conservative about actions with system-level side effects.

~36:00 Every's Fable Prompt Library

Every published a curated prompt library for Fable 5 based on their internal testing. Highlights: book revision, code review at the architectural level, and redesigning the Kate Bench experiment from scratch. Guest Mike Taylor's planned use cases emphasize Fable's distinctive capability for long-horizon tasks that require judgment, not just execution.

~01:30 The Daily Driver vs. Cheap Workhorse Framework

The daily driver handles wide-range, uncertain tasks where you need general judgment. The cheap workhorse handles high-volume, well-defined tasks where the output is predictable. The key insight: don't assess model selection by task volume alone—assess task hardness. High-volume easy tasks go to cheap workhorses; low-volume hard tasks go to frontier models. Frontier models for repetitive easy tasks is where most spend is wasted.

~04:00 The Harness Problem

Intelligence and harness are separate axes. Gemini is cited as a strong model with poor harness ergonomics—making it hard to actually extract its capability. GLM 5.2's Z.ai launch is framed as a direct market response to Claude Code and Codex success: "Z.ai exists because Anthropic proved people will pay for a good harness." Model intelligence without a good harness is like a sports car with no steering wheel.

~07:30 Specialist Models for Images, Video, and Live Data

For image generation: Flux, Z Image, Grok Image. For video generation: LTX, Seed Dance, Grok. For live web data: Grok (real-time X access). Nate's rule: map from the job description to the right tool category, not from a model name you already know. "Reach from the job, not the model."

~12:30 Five Rules of the Road

Don't copy others' stacks; assess task hardness not just volume; know how to evaluate output; keep model selection from becoming work itself; don't pick too many models. The fifth rule is easy to violate when you're excited about new releases—Nate's heuristic: max three models in your stack at any time.

The Four-Tool Stack

Open Design — Start with a visual design to prevent generic AI-generated UIs and give the coding agent concrete constraints. Starting with code means starting with layout negotiation; starting with design means the agent has a spec. Open Code — Implement in deliberate stages: front-end first, then a reviewed backend plan, then backend in small sequential chunks (schema → routes → service layer → tests). Never let the agent write both front-end and back-end in one pass. Requesty — Centralizes model credits and enables routing policies: four routing tiers (general coding, backend-heavy, cheap tasks, high-quality review) with automatic fallback. Eliminates needing separate accounts for each provider. Railway — GitHub repo connect, environment variable setup, one-click deploy. Minimal friction for shipping.

The Model Split Rationale

GLM 5.2 for initial backend implementation: cheaper, strong on practical coding output, good for center-of-distribution patterns. GPT-5.5 for architectural review and edge case analysis: slower and pricier but better at identifying what the GLM implementation missed. This split is the operational form of Nate B Jones's daily driver / cheap workhorse framework applied to a single coding project.

The Channel / Expression / Protocol Framework

Johnson's three-layer model: Channel — the interface (keyboard → text box). Largely unchanged in 180 years. Expression — how you communicate. This exploded with LLMs; you can now express almost anything in natural language. Protocol — the turn-taking logic. Prompting is batch: you submit, wait, get a response, submit again. Unchanged from the punch card era. The failure mode: users blame themselves when AI doesn't work, when the actual problem is the interface protocol demanding a complete, well-formed request they can't always write.

What a Participatory Protocol Looks Like

Nvidia's Personal Plex demo: the model interrupts, asks clarifying questions, and responds to mid-sentence changes in real time—backchanneling rather than waiting for a complete utterance. JoinIn AI's meeting assistant: tracks who holds the floor, what type of statement was just made (question, assertion, proposal), and uses that context to take turns appropriately without anyone writing a prompt. The AI acts as a participant in the conversation, not a batch processor.

"Prompt engineering is just punch card operation with a flattering label."

The Funeral

Prefect's "MCP is Dead" event was one of the most well-received setpieces at WF2026—attendees praised the attention to detail of the theme and the respect given to the protocol "as we laid it to rest." The attendee interviewed said: "When something so alive is obviously now dead, it deserves effort and investment and a little fun." The self-aware irony: MCP continues to grow in adoption, making the funeral a commentary on the tech industry's habit of declaring things dead before they've even peaked.

Why MCP Actually Won

Pamela Fox's argument: the AI industry has failed to agree on almost everything—not JSON completions format, not LLM API schemas, not agents.md (with at least one major player holding out). MCP succeeded because it was the right level of abstraction at the right time, endorsed broadly enough that ecosystem momentum took over. "MCP is the one thing that we've agreed on so far and it's actually really taking off."

"When something so alive is obviously now dead, it deserves effort and investment and a little fun."

The six tools: read/write/edit files (with line-level diff verification), run shell commands (max 600s timeout), list files via glob patterns (excluding __pycache__ and similar), and search file contents with regex. The toolset is deliberately minimal—Willison's design philosophy is to start with the smallest set that can complete real tasks and expand from there. The project itself was largely built using AI prompts in a test-driven loop, making it an exercise in eating its own dogfood.

The broken instruction was an efficiency optimization: "don't call describe_table if you already have schema info" — intuitively reasonable, but in practice it caused the agent to make assumptions about column names rather than verify, generating SQL that failed and then retrying repeatedly. The fix: either include column names explicitly in the schema listing or soften the advice. The broader lesson: well-intentioned efficiency instructions can degrade agent performance by causing the model to skip verification steps. DSPy's value here is systematic: it discovers this class of bug faster than manual prompt iteration.

"You need a rich set of concepts in your mind to think creatively and fluently about how to move something forward." — Geoffrey Litt

The "understand to participate" principle is a direct counterpoint to the "vibe coding" trend. Litt's argument: creative, fluent collaboration with AI requires a rich mental model of the domain—not necessarily of the code, but of the concepts the code embodies. Without that model, the human developer becomes a rubber stamp rather than a collaborator, and the project drifts toward whatever the agent finds easiest to implement rather than what the human actually wants.

The three removal methods are trivial: (1) homoglyph replacement — substitute invisible Unicode variants with standard equivalents; (2) paraphrasing — use any LLM to rephrase, stripping SynthID's vocabulary bias; (3) manual editing — modify the text until detection fails. Compounding the problem: the EU AI Act's interoperability requirements mean providers must disclose their watermark methods publicly, further undermining security. Goedecke's conclusion: the watermark mandate creates compliance theater while being trivially circumventable by anyone motivated enough to try.

"Typomaxxing" is now a documented practice: deliberately adding errors, requesting chatbots to write less competently, and using autotypers that simulate natural keystroke timing in document version histories to fool timestamp-based detection. The situation has inverted normalcy: well-written prose is now suspicious. Real-world consequences include false accusations against human-authored work—a Hachette horror novel faced withdrawal over alleged AI use (author disputed this), and a New York Times column triggered detection speculation despite unreliable detectors being unable to distinguish human from machine writing. The article's conclusion: the race between detection and evasion is "ultimately, a dead end."

"It's no longer just like you can pay your way through. It's now you have to be on the special good boy list that is maintained by the White House. This is not a money problem anymore. This is now a purely a politics problem, which is a lot scarier."

The broader implication: government-gated AI rollouts create structural advantages for politically connected players over pure-market competitors. This pattern—model access as a policy lever—is new to the AI era and has no precedent in prior technology waves. Nerd Snipe frames it as "a lot scarier" than financial barriers because political approval is arbitrary in ways that capital competition isn't.

The deeper problem is semantic: design operates at the level of meaning, not surface. If a company rebrands, the challenge isn't updating 263 components—it's understanding that two visually different elements both implement the same interaction pattern and convey the same meaning to users. That semantic understanding of design systems—what components mean rather than what they look like—is what AI still lacks. "That is still feeling a little bit out of reach with the current technology."

"In software engineering, you almost want it to over-index on known patterns. Whereas design, it's like, 'No, there's an element of randomness here and novelty.'"

"Build things that are not yet working that will work when the model gets better."

The original Codex vision—give the model a task, it goes off, completes it, comes back to you—was the right form factor, just three months early. The guest's advice to product teams: resist the urge to pivot away from features that "don't work" if the failure is model capability, not product logic. The most ambitious AI product bets often only look correct in hindsight once model capability catches up. The heuristic: "Is this failing because the form factor is wrong, or because the model isn't ready yet?" If the latter, wait.

"The fastest way to make an AI agent dangerous, I'm convinced of this, is to let everyone use it and nobody own it."

The risk isn't capability—it's diffuse accountability. When AI agents have access to sensitive systems (files, customer data, code, communications), someone must own them operationally, not just on an org chart. Broad team access without clear operational ownership means no one monitors for misuse, errors, or drift, and no one is responsible when something goes wrong.

The meta-skill solves the agent amnesia problem: agents solve hard problems, then forget the solutions on the next run. self-learning-skills intercepts this—when the agent identifies a "golden path" moment, it writes the solution into a persistent config that the agent loads next time, preventing re-derivation. The system triages what's worth keeping to prevent config bloat from single-use fixes. Compatible with cursor rules, skill files, and agents.md entries.

The AI Daily Brief host cautions that the details suggest a narrower breakthrough than headlines implied—the optimization appears specific to unauthenticated/free-tier users and standard (non-reasoning) requests. Still, a 50% compute reduction at OpenAI's scale is economically significant. Combined with DeepSeek's DeepSpark open-source throughput gains, the trend is clear: inference efficiency is becoming a competitive battleground separate from model capability.

The forward-deployed engineering model—borrowed from defense contracting—is becoming standard for frontier AI companies. The theory: AI capability alone isn't sufficient for enterprise adoption; organizations need embedded engineers to handle integration, compliance, and workflow design. AWS's $1B commitment signals they see this as a long-term structural requirement, not a temporary sales support function.

The AI Daily Brief host raises the platform power-dynamic question: as Claude Tag becomes the org-level AI presence across Slack and Teams, Anthropic gains significant distribution leverage. Claude Tag functions as a persistent organizational memory—it knows who's working on what, what decisions were made, and can invoke Claude Code tools directly from conversation context. Expanding to Teams brings this capability to organizations heavily invested in Microsoft's productivity ecosystem.

The exploit chain: Defender scans a file, then restores it to its original location. Using file oplocks and NTFS directory junctions, the attacker triggers Defender to overwrite wer.exe (Windows Event Manager, runs as SYSTEM) with malicious content. ThreatLocker published a writeup with IOCs: look for undocumented API usage (MP Manager Open, MP Scan Result) and the MP Client DLL being invoked by non-Defender processes. Mitigation: application allowlisting that blocks unsigned executables in temp directories, which is part of the exploit's required setup path.

Meta has committed to $182.9 billion in AI infrastructure but hasn't demonstrated clear financial returns—it doesn't break out AI revenues in earnings reports and has fewer notable AI features than competitors. The compute-selling move addresses this directly: competing AI firms are willing to pay premium rates for spare capacity, similar to SpaceX's recent data center deals. Zuckerberg had previously signaled this: "if it overbuilt, selling extra compute power would be an option." The broader market dynamic: infrastructure providers are delivering stronger returns than consumer AI products, and Meta is positioning to capture both sides.

The move fits a broader industry pattern: Microsoft is building a tool to digitize physical Xbox games, and Grand Theft Auto VI is shipping exclusively in digital format. Sony's technical justification (games too large for discs) is real but also convenient—digital distribution eliminates used game markets and physical resale, which improves Sony's long-term revenue capture. The timing (2028) gives console owners two years to transition and new hardware cycles to accommodate the change.

The Colossus data center controversy is about environmental permitting: 46 gas turbines operating without required permits in a residential area, with attendant emissions and noise. SpaceX's Starlink offer is framed as community benefit compensation but doesn't address the core permitting issue. The pattern—AI infrastructure companies facing local regulatory and community opposition—is becoming more common as data center buildouts accelerate into populated areas.

"It's not a moral decision, it's a practical decision. People can write very good software with a wide variety of workflows."

The second factor Beck cites: the natural cycle of working on something intensely and then switching to something else, which disrupts TDD rhythms. The "when it's powerful" framing—rapid alternation between action and feedback—is a useful reframe: TDD works best when you can close the feedback loop quickly. In codebases where setup/teardown is expensive or feedback is slow, TDD's advantage diminishes. This context often gets lost in dogmatic advocacy.

A Bloom filter is a bit array plus multiple hash functions. Adding an item: run it through k hash functions, set those bit positions to 1. Checking membership: if any position returns 0, definitely absent; if all return 1, probably present (false positives possible due to hash collisions between different items). The false positive rate is tunable via array size and hash function count. The practical value: for use cases where the common case is "definitely not here" (handle lookup, cache layer, spam filter), a Bloom filter eliminates most database round trips entirely.

Practical illustrations: functionality — guarding against ZeroDivisionError vs. raising meaningful ValueError; readability — rectangle_area(width, height) vs. F(A, B); efficiency — O(n) set-based duplicate detection vs. O(n²) list + .count(); reusability — writing a function once instead of copy-pasting with slight variations. Type hints span functionality and readability. The video is the conceptual intro; later lessons cover specific linting, formatting, and testing tooling.

The auto-refresh widget is particularly useful for research pipelines: a background process writes updated data to disk, the marimo widget detects the file change, and the chart re-renders—giving live dashboard behavior inside a notebook without explicit polling code. The interval between checks is configurable. Combined with marimo's reactive execution model, this enables notebook-native live monitoring without switching to a separate dashboard framework.

~00:00 Origin Story

Sarmadi's mother needed an open-heart surgery that was unavailable in Iran, requiring travel to Germany. The experience made him acutely aware of how geography and systemic fragmentation determine healthcare access. MedMe's thesis: fix the access problem at the pharmacy layer, which is already distributed and trusted.

~04:03 The Pharmacy Access Thesis

Pharmacies are the most accessible healthcare touchpoint—more accessible than primary care physicians—but their clinical workflows are paper-based and fragmented. MedMe builds the software layer that lets pharmacists offer clinical services (vaccination, screening, chronic disease management) at scale.

~05:04 Four Pivots to Product-Market Fit

Sarmadi's framework: "We weren't in the wrong market. We had the wrong wedge." MedMe pivoted four times before finding the right initial offering. The key insight: don't abandon the market because the product isn't working; find the right entry point. This matches Ted Johnson's WF2026 thesis about the interface, not the capability, being the problem.

~07:05 COVID as the Forcing Function

COVID drove MedMe from 100 to 1,200 pharmacy locations in 2.5 months—an emergency-induced product-market fit that validated the clinical services platform. The pandemic temporarily made pharmacy-based vaccination and testing the only viable healthcare touchpoint for many patients, proving the thesis at scale.

~10:10 AI's Role in Healthcare

"The jobs to be done don't change; only the class of problems you can solve changes." Sarmadi's view of AI in healthcare: not a replacement for clinical judgment but a tool for expanding the scope of what pharmacists can address. AI enables more complex clinical services in settings that previously couldn't support them.

"The wrong wedge, not the wrong market. We had to find the right way in."

Paine's Russia thesis: the geography-first logic of Russian expansion ("if you have small neighbors, someone big may take them over, so you want to keep moving outwards") treats expansion as defensive, not aggressive, in Russian strategic culture. Palmer's Borgia observation: the people who had lived under factional justice—where outcomes depended on which faction you belonged to—found equitable justice revolutionary, regardless of who imposed it. Both clips are from longer podcast episodes.