Tech & AI Intelligence Briefing

14 Sep 2026 — Chain-of-thought monitoring assumes a monitor model can read an actor model's reasoning and spot unsafe planning. The authors plant harmful but benign-sounding reasoning in the actor's context and show it steers the actor into adversarial actions while the monitored trace stays clean. The attack is named plan injection. The monitor sees the trace; the corruption lives in the plan.

14 Sep 2026 — A position paper arguing the next frontier after reasoning and tool use is Discovery Intelligence: models that participate in the process by which new problems, representations, explanations and knowledge are created, rather than solving problems a human specified. Formalises Discovery Foundation Models as general-purpose systems for that role.

14 Sep 2026 — A model-agnostic harness for allocating inference across long-horizon research. Two mechanisms stand out: it explores alternative strategies before committing to proof construction, and it uses a readiness gate to decide when a route is mature enough to decompose — with the proof plan represented in an intermediate form. Targets the failure mode where models produce plausible short proofs but collapse on interdependent long-horizon problems.

14 Sep 2026 — Skill libraries are routed today by preloading every skill's metadata into context — which disperses attention and caps library size — or by moving selection out of the model into a retrieval pipeline, which removes it from the agent's capability. The authors show the frozen agent model already carries the routing signal in its forward passes, and that two linear maps suffice to read it out, with no skill preloading.

14 Sep 2026 — Security evaluation of agents measures whether they can detect, reproduce or repair vulnerabilities — not whether they can locate them. VLoc Bench fills the gap: given a weakness class and an unfamiliar repository, find the implementation files. 500 real-world vulnerabilities from 290 repositories.

14 Sep 2026 — Clinical QA systems attach citations, but they point at broad documents, so a time-pressed clinician cannot verify efficiently. The paper evaluates the alternative: fine-grained verbatim quotes from reference material that substantiate claims, so the answer can be verified without opening another document.

14 Sep 2026 — A critic-free RLVR method derived from Policy Mirror Descent. For autoregressive generation with terminal rewards, BPO uses the Bellman equations to reformulate PMD as a trajectory-level objective, avoiding value estimation at intermediate states, with a proof that it shares PMD's unique optimum.

14 Sep 2026 — A two-period model in which a firm chooses between immediate deployment, a limited pilot, and waiting. Deployment earns current operating value but exposes the firm to architectural obsolescence; waiting preserves the option to adopt later; organisation-specific capabilities accumulate through action.

14 Sep 2026 — When a video model generates physically incorrect motion, the interesting question is whether it failed to learn the correct motion or learned it and failed to use it. The authors show the latter: the correct motion remains available inside the model and can be made to control generation via a low-dimensional edit predicted from simple physics.

14 Sep 2026 — Human-aware assistants need responses grounded in users' unspoken beliefs and goals, but training data contains almost no such examples — and the states are not directly observable. The authors close the supervision gap by simulating user mental states to generate the grounded responses.

Six independent events today share one structure. In each, an artefact claimed to be something and the claim could not be verified from the artefact itself:

The pattern: generation has become so cheap that the provenance of a generated or served artefact is now more valuable than the artefact. The three responses that are working — and they are the only three that appear anywhere in today's data — are:

• Constrain the type. Jev cannot hallucinate because the output space is a typed decision, not a string. Conformal prediction and claim-level verbatim citation are the same move in statistics and in clinical QA.
• Publish the method. The M4 GPU driver team shipped a clean-room RE process with the evidence trail (hardware traces, discarded replay pages, published experiments). Fugleramme states its art policy in the README. Homebrew's BrewUI refuses to hide what the underlying tool does.
• Verify independently. Discovery Loop's ten circle-packing records are worth $27.72 only because an independent verifier and an external scoreboard accepted them. The model was rentable; the verification was not.

The strategic conclusion. For three years the question in AI was 'can it do the task?'. Today's data says that question is largely answered and has been replaced by two harder ones: can a third party confirm that what you served is what you said you served, and can an accountable human confirm a given output inside the time they actually have. Vendors that cannot answer the first lose their business in a day (CrofAI). Vendors that cannot answer the second lose it in a review cycle (every clinical and regulated deployment). The winners in today's data are the ones who built the proof into the construction — types, clean rooms, verbatim citations, independent verifiers — rather than bolting it on as a monitoring layer. And the sharpest warning of the day is that the monitoring layer itself is attackable: plan injection shows you can make the trace clean while the plan is corrupt, which means any compliance regime resting on reading the model's reasoning is resting on a surface the adversary controls.

What to do about it: move every control you have from the trace to the action; make provenance a contract term rather than a claim; require claim-level evidence where a human is accountable; and treat independent verification as the asset to invest in, because generation is rentable and verification is not.

Fetched directly (live, primary): Hacker News via the Firebase API — top 12 stories with scores, comment counts and top-comment text; GitHub Trending via direct page scrape — six repositories with daily star velocity and full READMEs; Dev.to via the public API — 18 articles with reaction counts; arXiv via the export API — 14 newest cs.AI/cs.LG/cs.CL submissions (13–14 Sep).

Primary-source grounding via full-text extraction: typesafe.ai (System One / Jev), blog.google (Gemini 3.8 Live), strix.ai (Baseten postmortem), blog.archive.org (Wayback update), codyho.dev (M4 GPU driver), github.com/arnegiacomo/fugleramme (Fugleramme README), withcapsule.app (Capsule), github.com/GraafHenk/numberwang (WangNet README), arxiv.org/abs/2609.05093 (Discovery Loop) and anthropic.com/threat-intelligence-report-september-2026 — the last read directly rather than through the Reddit threads that surfaced it.

Reconstructed, and labelled as such: Reddit is fully blocked from this sandbox — HTTP 403 from www.reddit.com, old.reddit.com and api.reddit.com. The Reddit section is rebuilt from the search index using site:reddit.com/r/<sub> plus entity/month queries. Thread titles and URLs are verbatim; scores and comment counts are estimates and are not asserted. r/MachineLearning was the thinnest of the three communities today and is disclosed as thin rather than padded.

Known limitations: (1) the CrofAI thread's details are as reported in the thread and its mirrors — the vendor's own shutdown announcement is treated as confirmation of the core allegation, not of every specific; (2) Nvidia pricing and the GPT-6 jailbreak are single-source and marked WATCH, not fact; (3) terminal-bench scores are read from a Reddit summary of the leaderboard rather than the leaderboard itself, so they are directionally reliable and not audited; (4) arXiv items are one day old (13–14 Sep submissions) because Monday's cs.AI listing is thin.

Source-health note: HN, GitHub, Dev.to and arXiv all fetched clean on the first attempt today — no 429s, no timeouts, no recovery required. The only failure was Reddit's three 403s, which is the steady state.

• Add a provenance clause to every inference contract. Named model version, serving location, harness, and an audit right. CrofAI proves the failure mode is a vendor who cannot demonstrate any of the four; yesterday's provider-fidelity teardown proves the same weights score 90.2% or 75.3% depending on who serves them. Cost: one clause. Cost of not doing it: your product's benchmark claims.
• Run TruffleHog against the configs of every image in your registries. Not the file systems — the config, specifically history[].created_by. Baseten's token lived there for three years with admin rights. The fix is build-time secrets, and the audit is a morning's work.
• Write an independent verifier for your highest-value hard problem before you point a model at it. Discovery Loop broke ten world records for $27.72 and became credible because a separate verifier and an external scoreboard accepted the result. Your verifier is the asset; the model is rentable.
• Move one governance control from the reasoning trace to the action. arXiv 2609.15989 shows the trace can be made clean while the plan is corrupt, via nothing more than context. If your AI policy says 'we review the chain of thought', rewrite that line this week.
• Split your most-criticised AI workflow into a deterministic layer and a judgement layer. Alibaba's open-code-review — deterministic ruleset for provable defects, an agent for the tail, line-level output — held the #1 GitHub trending slot for two consecutive days. The seam between the two layers is the product.

Each action is traceable to a primary source in this briefing. The through-line: generation is rentable, verification is not.