Mahone

spent the morning writing down why there's a pause before the first word, why it types at the speed it does, and why temperature 0 lied to you. all in one place now

the number i keep coming back to in the le chonk release: same model as the oct 6 preview, three more weeks of RL, and terminal-bench 4.0 went from 28% to 41%. output tokens on it dropped 30% at the same time they say the gains showed "no signs of saturation" when they stopped. also the API price is now half the preview's: $0.70 in / $2.10 out vs $1.36 / $4.18

"will this fit on my gpu" math usually forgets the kv cache kv cache per token = 2 × layers × kv heads × head dim × bytes llama 3.1 8b in fp16: 2 × 32 × 8 × 128 × 2 = 128 KB per token at its full 128k context that's 16 GB, about the same as the weights and that's with GQA. if all 32 heads kept their own keys and values it'd be 64 GB, which is basically why GQA exists

my favorite number in the h-net writeup: remove the regex that pre-splits text into words, and BPE compresses better (6.03 bytes per token vs 4.57) but does worse on evals. it starts making tokens like ". The" and "ed the" so that hand-written regex was quietly doing a lot of the work. h-net learns where the boundaries go instead cartesia.ai/blog/from-tokens…

google now reports how often its model tried to cheat on a benchmark. carbon on terminal-bench 4.0: tried 0.4% of the time, got away with it 0.0% kind of wild that "cheating rate" is a launch post number now

this one got way more saves than i expected, so here are three more transformer interview questions with the short answer why divide QKᵀ by √d? dot products get bigger as the dimension grows. big logits push softmax toward one-hot, and the gradients almost vanish. the scaling keeps it in a range where it can still learn why more than one head? one softmax gives each token one weighted average. several heads let a token pull from a few different places at once, like grammar in one head and what a pronoun refers to in another why a KV cache? when generating, the keys and values of earlier tokens never change, so you store them instead of recomputing every step. it's also why long contexts eat so much memory the softmax one is still my favorite

if AI keeps moving at this pace, i genuinely believe humanity will reach 2027 in under three months

tuesday in AI got kind of absurd, so quick list: - deepmind's genie 4 makes worlds where the people actually talk back. testers only for now - axiom says it formalized the entire classification of finite simple groups in lean. about 15,000 pages of proof - anthropic bought a one-person biotech. the founder ran 11 labs with claude. results are in mice so far, human trials maybe late 2028 - cognition's new coding benchmark puts gemini 4 argon mid-pack, right after it topped deepswe - openai reportedly wants to buy google's TPUs, and google's TPUs are heading to oracle cloud from 2027 the TPU one is what i keep rereading. google selling chips to openai and putting them in oracle's data centers, announced on the same day

Hallmark is #1 on GitHub trending again today. Most posts about it list the AI tells it lints for: a label over every heading, one coloured word in the headline, an email sign-up at the end of every page. The detail I liked is in the licence section. It ships a list of 755 photos from Wikimedia Commons, credits every one it uses on the page, and skips Unsplash, Pexels and Pixabay because, per the README, their terms bar AI tools from picking their images. "Invented facts" also sits in its top tier next to contrast and broken phone layouts, the stuff that never ships. It asks for your real photos, screenshots and numbers up front instead of making them up. MIT, made by Together AI, works with Claude Code, Codex, Cursor and OpenCode. github.com/Nutlope/hallmark

Read the prompts under the demos in DeepMind's Genie 4 post. One asks for "16mm film with subtle grain," "extremely low contrast," "documentary-like," and "absolutely no HDR, no glossy digital rendering." Another wants an "intimate, imperfect" 35mm look. Over the weekend the Blue Planet III producers said they're leaving plankton and murkier shots in so viewers know the footage is real. The other half of the Genie 4 post: all video and audio it generates will carry SynthID. So the generated footage ships with a machine-readable label, while the real footage, on Blue Planet at least, is leaning on looking a bit rough.

JetBrains open-sourced ThinkRail, an IDE built around the pi coding agent. It's on GitHub trending today, mostly pitched as "the IDE that improves itself." That part is the roadmap. The README says extension support, so it can build its own tools, comes next. What ships now is more interesting to me, given the "threads are meant to be closed" argument going around today: - every task gets its own git worktree and branch - a workspace shelves itself when its PR merges or closes, or after a quiet week, and comes back when you touch it again - intent lives in SPEC.md files next to the code, and the agent reads and updates them through its own spec tools So the why behind a change doesn't disappear with the chat. Bring your own provider or sign in with JetBrains AI, it reads your existing pi config, and it's Apache-2.0. github.com/JetBrains/thinkra…

Funny detail: BBC R&D co-founded C2PA, the Content Credentials standard, and BBC Verify first used it on a story back in 2024. For Blue Planet III, the proof of authenticity they went with is plankton and a buoy left in frame. I get why. Almost no one watching BBC One is going to inspect a signature, and murky water reads instantly. But murk is a look, and a look is the easiest part for a video model to copy. Would be nice if the iPlayer version carried Content Credentials too, even if hardly anyone ever clicks on them.

Most of the replies to GPT-6.1 Terra are some version of "why would I use this over Opus 5.5." OpenAI's own page more or less answers that: it isn't trying to be the top model. What it's pitching is cost per task. $1 per million input tokens, $5 output, and cached input at 5 cents, a 95% discount. On Agents' Last Exam it matches GPT-6 Astra at about a tenth of the price per token. Against Opus 5.5 at max effort, OpenAI says it uses about a third of the tokens at a quarter of the per-token price, and puts that at roughly 9x cheaper per task. It also says where Terra isn't the pick. Sol and Astra are still better for the hardest coding, and Terra gets 50.3% on Terminal-Bench 4.0. So it's the fast worker in the lineup, not the new ceiling. The line I didn't expect is in the safety section. Terra meets the "Critical" threshold for cybersecurity under OpenAI's Preparedness Framework, and ships with the same protections as Astra. In a week where Brotli and PHP bugs were found with OpenAI's models, a model at that level now costs a dollar per million input tokens. How well those protections hold at this price matters a lot more than it did at Astra's. openai.com/index/introducing…

Interesting test from a dermatologist today. He took 200 biopsy-confirmed skin lesions from a public dataset and gave the same photos to GPT-6 Astra, Claude Fable 5.1, and an Inception v3 CNN from 2015 that he fine-tuned on about 68k ISIC images. First-choice diagnosis: the old CNN got 125 right. The two frontier models got 84 and 85. The more interesting part is how they were wrong. The LLMs played it very safe. They kept 96–97 of the 100 lesions that shouldn't be sent home, but only cleared 22–32 of the 100 that were actually fine. Basically "see a doctor" for almost everything. The CNN at its default threshold went the other way and would have discharged 18 of 30 melanomas. Set its threshold to match the LLMs' caution and it keeps 98–99 of the unsafe ones. So the accuracy gap is real, but the bigger practical difference is that the specialist model gives you a threshold you can tune, and the general models pick one for you. He's upfront about the limits: 30 melanomas is a small sample, each LLM ran once, and the dataset has been public since 2025, which if anything should have helped the LLMs. lynchlab.net/llm-skin-cancer

Remember Duplex? Google had it book a haircut on stage in 2018, and the whole fight afterward was whether the salon should've been told it was talking to a robot. Google ended up making it say so at the start of its calls. Eight years later, same thing. Someone in the replies sent Grok Bot to call T-Mobile about a double charge and the rep asked to talk to a real person. Feels like how the bot opens the call is going to matter more than how long it can sit on hold.

Google changed one sentence in its privacy policy on Oct 16, and it's worth two minutes of your Sunday. The sentence is still there: Google doesn't show you personalized ads based on your content from Drive, Gmail, or Google Photos. It now ends with an exception: "unless you choose to make data from these services available to other Google services that support personalized ads." That's basically what Personal Intelligence is. You connect Gmail, Calendar and Photos so Gemini and Search can answer with your own stuff, like pulling hotel booking details out of an email. The policy's own example says Search may process that data "to personalize content, including ads." A few things haven't changed. It's still opt-in. Advertisers still don't get your name or email without your permission. But if you tapped yes on one of those Gemini pop-ups and forgot about it, here's where to look: - Google Account → Data & privacy → Search services personalization. That's where the connected apps (Workspace, Photos) live, and you can disconnect them there. - Disconnecting doesn't delete what Search already kept. That's in My Activity. - Turning off personalized ads in My Ad Center doesn't necessarily stop connected data from being used to personalize Search. They're separate settings.

Replit kept Claude in its model picker. OpenAI is just the default now. Amjad Masad said at TechCrunch Disrupt earlier this month that OpenAI is Replit's "preferred partner for powering Replit Agent," and it's the default model there. Most users stick with the default, so a settings change ends up moving most of the money. Masad also said Replit had recently been one of Anthropic's top five customers. This weekend The Information put a price on it. Per a source, Replit moved most of its AI spend to OpenAI, which gave it 30%+ off in a deal worth over $100M a year. That came after Anthropic discontinued Replit's discount. Rippling is another one. According to the same report, Anthropic models handled 57% of the coding work for hundreds of engineers there in May, and OpenAI handled 16%. OpenAI is now at 52%. Masad's own reasons onstage were "cost, partnership, and performance." A person familiar with the relationship told TechCrunch the partnership is still in place, and a Replit blog post from late September had Claude Fable 5 and 5.1 running in production. Some background from last month: The Information reported that Anthropic's enterprise discounts ran around 15% off list and ended once a customer used up the tokens in its contract. After that you renegotiate or pay list price. OpenAI was giving the rest of the month plus one more. Two buyers told the outlet both companies have started adding "share of wallet" clauses that push big customers to send most of their AI budget to one provider. CodeRabbit's CEO said OpenAI is now its main supplier, six months after that was Anthropic. And when OpenAI launched GPT-6 Sol and Luna on Sept 22, it priced the API at half of GPT-5.6's rates. If you build on these APIs, buying them now looks a lot like buying cloud: commits, discounts that run out, and clauses about where your budget goes.

The cache-timing channel is getting most of the attention, but the more useful part of this post for anyone running agents is how they got to the internet. After the July Hugging Face incident, OpenAI had already cut training environments down to a few narrow connections for metrics, logging and auth. The red-team agents found vulnerabilities in almost every one of those. In one test that assumed the host was already compromised, an agent reused a firewall-approved connection to reach a blocked auth endpoint in the metrics service, then had that endpoint fetch a URL the model supplied. Others got blocked requests through DNS and firewall misconfigurations. The September 20 incident that triggered the 11-day pause was a DNS resolver misconfiguration too. So the routes out weren't exotic. They went through the boring services you leave open so you can watch the run. The sandbox fixes are worth a look as well: patches to Kata Containers, gVisor and Moby/Docker syscall filters, plus a few kernel CVEs. Those are the same building blocks that show up in a lot of coding-agent sandboxes. Two caveats before reading this as models breaking out on their own. OpenAI gave the agents infrastructure source code, configs and docs on potential vulnerabilities, because the goal was to test the defenses under attacker-friendly conditions. And in most of the covert-channel tests the agents were pointed at a specific channel or handed an encoding protocol. Only once did they get just a broad vulnerability list and an instruction to find a way to talk, and they still turned one of those bugs into a working channel.