Engineering

Part 2 of 2. Companion to The Faulty Compiler.

A fun way to understand the mind behind the curtain of this new technology is to build your own harness.

If you’re a developer, one of the best things you can do with modest compute is write an agentic coding harness: the loop that hands a model a task, gives it tools, and feeds the results back in. Use your favorite frontier model and coding tool to write it, in whatever language you like. Then point it at a small local model and give that model real work. Here are a few decisions to make:

• Local LLM framework: Ollama is a decent choice.
• Models: Gemma 4 and Qwen3-Coder both support tool calling. gemma4:12b is about 8 GB and qwen3-coder:30b is about 19 GB. Use whatever is current when you read this.
• Harness language: Python, Rust, Go.
• Test project: You need something for the model to do, after all.

A small note on the test project: make sure it has tests. It makes the adventure more fun.

This experiment does not reproduce frontier capability, and a small local model is not a stand-in for one. It exposes the engineering categories hidden by capability claims: retries, guards, verification, scaffolding, and resource consumption. Those are the things to measure.

It should take you down a pretty decent rabbit hole. While you’re falling, Alice, I want you to catalogue your observations about building your new toy, what they portend about our actual course, and what they say about the people steering this revolution.

1. Your coding agent likely won’t one-shot a universal harness. By universal I mean one that works across whatever models you point it at. Given a good prompt and requirements, it will build a functional harness that calls and interoperates with the model. Very impressive: that used to take a junior engineer a few weeks. But really, we’re talking about an API or two and some shims for various tools. Not amazingly hard. So if AI is ready to take over systems at will, why can’t it do this out of the box with ZERO issues? I’m not guessing. I’ve built two harnesses with Claude, and neither worked without a ton of my input and a lot of iterations. The build notes at the end list what had to be added, and nearly all of it was learned by watching runs fail, not written up front.
   
   Don’t expect the leaderboards to settle that for you, in either direction. A year ago the best model scored 23% on SWE-Bench Pro. Trackers now show the leaders above 80%, and in between OpenAI found roughly 30% of the benchmark’s tasks broken and withdrew its recommendation to use it.¹ The famous finding that AI tools made experienced developers 19% slower? The lab that ran the study now calls it outdated, and says its newer data is unreliable because developers increasingly refuse to work without AI.² The scoreboard is a faulty compiler too. Build the thing and measure it yourself.
2. Sandbox it and back up before the first run. Your new toy is very faulty, and the harness you just built has to give it some level of CRUD (create, read, update, delete) over your files. A container with no network, a non-root user, and only the project directory mounted is enough. Your first runs will be an experiment in frustration and fascination. You’ll see real wisps of comprehension and of the ability to follow instructions. That amusement is soon dashed against the rocks of specificity, lost context, and a fairly interesting loss of interest in the stated objective. So sandbox no matter what, whether through containers or libraries, and keep a backup you can restore from. You never know which tools the model will reach for, or why.
3. Watch for the nuclear option. Hopefully you’ve steered your agent toward the best local models for your available compute. I hope your compute is limited, so you get to sample the range: tool use, reasoning, and, most importantly, willingness to solve a problem with the nuclear option. That means deleting failing tests, rewriting assertions until they pass, or a git reset --hard. This is why your test project needs tests: tampering with them is the classic tell. Part 1 has the frontier-scale versions of the same behavior.
4. Watch the clock, then run it again. You’ll be thrilled once you’ve tuned your tools and prompts and the harness starts making real progress on your objectives. Depending on how many objectives you have and how complex they are, the wall clock may surprise you. You may be further disappointed when the same model, rerun, doesn’t succeed on the next round of fun. Don’t worry: you’ll get to explore temperature, maybe the seed (check that it’s actually being applied; mine wasn’t), and every one of those experiments will remind you that these less sophisticated models are shadows of the epic, unbridled power and expertise of their big-brother frontier models. Then you’ll recall that your harness and a few simple logical validations are doing more to get you to the finish line than the model is.

Is that a false equivalence? The frontier models are better, after all: refined, perfected. Refined, yes. Perfected, no. But that’s not what the benchmarks say! Then look closely at how the same model does inside and outside its custom harness. The results vary, and far more than they would if the model were perfected and carrying all the water. Researchers now argue that among comparable frontier models, the harness is often a stronger determinant of performance than the model it wraps.³ Keep that in mind when you reread the cyber-attack claims in Part 1. Those results came from a model, a scaffold, and a thousand runs.⁴

When you climb back out of the rabbit hole, you’ll have something the headlines don’t: your own numbers. How many runs it took. How long the clock ran. How much of the result came from the model, and how much from the harness and the checks you wrapped around it. Those are the figures I asked the labs for in Part 1. If you can log them on a laptop, a frontier lab can publish them.

Bringing it home

Put the two parts together. What gets sold as a model’s capability is the capability of a system: the model, the harness, the checks, the reruns, and the compute to pay for all of it. The results get published. The spec sheet doesn’t.

Man, that lossy interpreter has come a long way, all the way to a functional autonomous coding agent. You only had to harness it, give it tools that also guard it from itself, sprinkle in unit tests to keep it focused, and maybe add a linter to stop it drifting. The result is a tool that could never have existed five years ago. Yet it’s still lumpy and jagged. The model alone isn’t coming for you. Institutions using it to cut labor costs already are, and the hand-waving makes those choices easier to defend.

The missing spec sheet matters most for the threat everyone leads with. Cyber is the most obvious risk, and I don’t dismiss it. It is also the one risk on my list with a standardized, repeatable repair loop. The tools that find the holes find them for the defenders too, and the companies and maintainers who ship the code have every reason to close them. The Linux kernel doesn’t assign a CVE until the fix is in a stable release, and it is now approaching 2,000 of them per release.⁵ Google’s CodeMender upstreamed 72 security fixes in its first six months, and DARPA’s finalists were finding and patching real bugs for about $152 a task.⁶ The loop is strained. Of roughly 530 serious bugs Anthropic’s Glasswing project reported to open-source maintainers, 75 had been patched six weeks in, and some maintainers asked it to slow down.⁷ But the loop exists, and money and attention are pouring into it. A patch does not undo stolen data, physical disruption, or intelligence loss, but it can close the hole against the next attack.

Nothing else on that list has a comparably fast, standardized remediation loop. There is no equivalent of coordinated vulnerability disclosure for a released pathogen, a completed targeting decision, a successful influence campaign, or a lost early-career cohort. Countermeasures exist, but the safeguards usually act before or during the harm; they do not restore the world afterward. Those harms are documented today and they don’t need AGI. They are also going largely unaddressed. Cyber may be the most obvious risk, but these are the ones whose damage is hardest to reverse. That is why I think they deserve more of the worry than they get.

Here’s the part the layoffs miss. Every fix in the build notes below came from an engineer watching a model fail and building the guard that caught it. The faulty compiler works because someone verifies it. We are marking down the very expertise the technology depends on. Sure, I can loop this toy, or a frontier model, against tests and verified answers until it generates something that may work. But if we build the next level of everything with these faulty compilers, with little or no supervision and no comprehension, we will have agreed that we do not care about the future.

So I’ll ask again for what I’d ask of any vendor: the specs, the test conditions, and the failure rates. Then spend the worry where there is no patch. None of that is exotic. It is honesty, transparency, and accountability.

Build notes, for those who want to cheat

Here are representative fixes my own harness needed before small local models could get through real work. They come from a stretch of twenty-one pull requests. Every item below is a fix for something a model, or the plumbing around it, actually did.

Tool calls and provider correctness

• <function=name> syntax fallback (PR #46). qwen3-coder emitted this non-JSON tool-call format and the harness extracted nothing, looping 100+ turns with zero tool calls.
• frequency_penalty and seed moved to top-level request fields (PR #48). A model fell into verbatim repetition loops. The setting meant to curb it went through Ollama’s options object, which Ollama’s /v1 endpoint silently ignores. seed had the same bug, so determinism had never actually worked.

Stall and hang detection

• Escalating no-tool-call nudge (PR #51). ministral-3:8b got stuck for 7 turns re-describing an edit plan in prose with zero tool calls, receiving the same static reminder each time.
• Per-chunk LLM-stream watchdog (PR #56). glm-4.7-flash hung for 30+ minutes on a turn that produced zero stream chunks. The existing retry logic only fires on an actual error, so it couldn’t see this failure at all.

The objectives system and its failure modes

• Reject completions whose summary doesn’t match the current objective (PR #54). glm-4.7-flash called complete_objective four times on one real piece of work, silently marking three unrelated objectives “done.”
• Gate complete_objective on a fresh, whole-project reverification (PR #55). glm-4.7-flash narrowed its own verification (a passing scoped ruff check instead of the full one) before claiming completion.
• Harness-native lint tool that hard-blocks both complete_objective and the FINISH-time check (PR #64, reordered in #65). gemma4:e4b left three near-identical dead return statements stacked in one function. The tests kept passing throughout, because the first return always fires, so the existing test gate had nothing to object to. The fix adds an optional lint convention that mirrors test exactly and runs before it, since a static check is cheap and a full test run can legitimately take the whole timeout or hang outright. It has already caught a real bug: in round 4 the lint gate blocked a completion on a genuine F821 undefined-name error, and the model understood the message and started fixing it instead of slipping a broken completion through.

Repeated-failure escalation (the throughline of the whole build)

• Test-timeout infinite-loop nudge (PR #60). gemma4:e4b hit the same 200s test timeout repeatedly, and the harness treated it like an ordinary failure. The root cause was a genuine infinite loop the model had introduced.
• Configurable timeout ceiling (PR #61). gemma4:e4b, stuck on that same hang, started raising timeout_seconds on its own toward a 6-hour wait instead of fixing the bug.
• Same-test-failure streak nudge (PR #63). gemma4:e4b failed one assertion 26 times in a row, with a successful but ineffective edit between every attempt. Each edit reset every existing counter before it could escalate.

The omitted fixes are less dramatic variations on the same themes: malformed tool envelopes, restore semantics, timeout backstops, failure counters, and model-capability discovery. The point is not that every agent will reproduce this exact list. It is that the apparently autonomous result depended on an engineer recognizing each failure and turning it into a guardrail.

Sources and notes

1. “SWE-Bench Pro” (arXiv, Sep 2025): “Performance on SWE-Bench PRO remains below 25% (Pass@1), with GPT-5 achieving the highest score to date at 23.3%.” arxiv.org — BenchLM leaderboard tracker (Oct 1, 2026; a secondary aggregator) lists a top score of 89.9% and four more above 80%: benchlm.ai — OpenAI, “Separating signal from noise in coding evaluations” (Jul 8, 2026): “~30% of SWE-bench Pro tasks are broken”; “we retract our earlier recommendation to adopt SWE-Bench Pro.” openai.com ↩
2. METR, Becker et al., “Measuring the Impact of Early-2025 AI on Experienced Open-Source Developer Productivity” (Jul 2025): 16 developers, 246 tasks; AI increased completion time by 19%. metr.org — METR, “We are Changing our Developer Productivity Experiment Design” (Feb 24, 2026): newer estimates point toward a speedup, with confidence intervals that still include zero, and “30% to 50% of developers told us that they were choosing not to submit some tasks because they did not want to do them without AI.” metr.org ↩
3. Zhang, Wang, Ge, Xu, Hamm & Reddy, “Stop Comparing LLM Agents Without Disclosing the Harness” (arXiv, May 7, 2026), a position paper: “for long-horizon tasks evaluated across models with comparable frontier capability, the agent execution harness… is often a stronger determinant of agent performance than the model it wraps.” arxiv.org ↩
4. Anthropic, “Assessing Claude Mythos Preview’s cybersecurity capabilities” (Apr 7, 2026): “across a thousand runs through our scaffold, the total cost was under $20,000.” anthropic.com ↩
5. Linux kernel documentation, “CVEs”: “No CVEs will be automatically assigned for unfixed security issues in the Linux kernel”; assignment “will only automatically happen after a fix is available and applied to a stable kernel tree.” docs.kernel.org — Security Boulevard (Sep 2026, a secondary report): about 500 CVEs per release in the 6.x era, approaching 2,000 by Linux 7.3, attributed largely to AI-assisted scanning. securityboulevard.com ↩
6. Google DeepMind, “Introducing CodeMender” (Oct 6, 2025): “we have already upstreamed 72 security fixes to open source projects, including some as large as 4.5 million lines of code.” deepmind.google — DARPA, AIxCC results (Aug 8, 2025): “an average cost per competition task of about $152.” darpa.mil ↩
7. Anthropic, Project Glasswing initial update (May 22, 2026): 23,019 vulnerabilities found across 1,000+ open-source projects; about 530 high- or critical-severity bugs disclosed to maintainers, 75 patched; “several maintainers have told us they’re currently severely capacity constrained, and some have even asked us to slow down our rate of our disclosures because they need more time to design patches.” anthropic.com ↩

Part 1 of 2.

If you’d told me five years ago that I’d be leveraging a faulty compiler in production, I would’ve told you to politely go jump off a bridge. Fast forward to today, and I, like so many other engineers and technologists, get to figure out where I fit into this weird moment in time.

Don’t get me wrong: we’ve always accepted error in engineering. Tolerances, if you will. How precise does your floating point need to be? What tolerance do you need on the fit, or on the flatness of the face? Read a mechanical drawing or a datasheet and ±0.05 mm is a tangible, bounded error. Half-precision floating point rounds to within about 0.05% on every operation. We know these numbers. We design around them.

But at no point in my career would anyone have told me, “Just keep compiling it. Run it back through, verify it, check the results. Oh, and it works better if you talk nicely to it. Or maybe keep it direct and spartan so the context doesn’t drift.” Yet here we are… the age of the faulty universal compiler.

There’s a certain symmetry here, I suppose. Data and input, especially human-generated, have always carried an error rate. Now we’ve put a lossy interpreter on top of it, one that, wrapped in normalization and verification, delivers relentless ingestion at a scale we’ve never had.

What today’s models already do

Every other day the headlines scream that this is a new age, and on that much I agree. They also insist that AI and agents are going to revolutionize everything. Well, sort of. What they certainly do is further devalue knowledge itself. It has been amusing to watch a subject-matter expert review a codebase and its changes next to an AI-enabled developer who doesn’t know it. How do you know what you don’t know, after all?

Yet every other story is about the need to regulate AI because it’s wildly capable at hacking systems, and, we’re told, closing in on AGI.¹ Still, we must press on, because if we don’t, “they” will. This bothers me deeply. You don’t get to operate at this level while hand-waving and making shadow puppets on the wall. Facts and figures for the systems you grow should be required. Alas, no one is stopping the charade. Here’s a short list of capabilities and effects of today’s models that are already documented:

• Weapons development and intelligence targeting: in evaluations and reported platform misuse, models can now assist with some military tasks that once took scarce, highly trained specialists, including drone guidance software. That is not the same as an LLM controlling a fielded munition.²
• Enough chemical and biological uplift that the labs themselves can’t rule it out, and have tightened safeguards accordingly.³
• Discovery and exploitation of real vulnerabilities via code review.⁴
• Misinformation and influence campaigns.⁵
• What I see as the devaluation of expertise, visible indirectly: layoffs justified by AI, smaller teams expected to deliver more, and quiet rehiring offshore or at lower wages when the AI falls short.⁶
• Reduction of the workforce, especially early-career, while productivity expectations climb.⁷

Layoffs have other explanations, and “overhiring” is the one usually offered. Meta skipped the euphemism. Zuckerberg told investors that “one or two people are building something in a week that would have previously taken dozens of people months,” with no figures attached,⁸ then told employees the company has “two major cost centers… compute infrastructure and people-oriented things,” and that investing more in one means “we do need to take down the size of the company somewhat.”⁹ Meanwhile, Meta had started recording employees’ keystrokes and clicks to train agents.¹⁰ I’ve seen the same pressure from the inside: we held a small engineering team flat while drastically increasing the features we shipped and the bugs we fixed. You don’t let hard-won talent go in rounds unless you’ve decided it is worth less than the compute. I call that devaluation, whatever the press release calls it. The employment studies show the contraction; this is my interpretation of what the choices behind it mean.

None of the above requires AGI, sentience, or super-massive hacking abilities.

The missing spec sheet

To be fair, some numbers do get published. Anthropic’s Mythos Preview report puts a price on finding a 27-year-old OpenBSD bug: a thousand runs through their scaffold for under $20,000, with the run that found it costing under $50.¹¹ That is “just keep compiling it” with a receipt. The GTG-1002 espionage report gives roughly 30 targets and says the AI performed 80–90% of tactical operations. It even admits the model “frequently overstated findings and occasionally fabricated data.”¹² Google’s Big Sleep and DARPA’s AI Cyber Challenge both found real vulnerabilities in real code.⁴ What none of these disclosures give you:

• Total compute (GPU-hours or FLOPs) behind any of these runs.
• Energy consumed.
• End-to-end wall-clock time for the full operation, rather than per-phase snippets.

Only two of the four give a dollar figure at all: Mythos at API pricing, and AIxCC at about $152 per competition task.

The disclosed techniques themselves were not all novel. The espionage campaign “relied overwhelmingly on open source penetration testing tools rather than custom malware development,”¹² and the OpenBSD bug emerged from a thousand runs. What’s new is the persistence, scale, and price: a human-selected objective executed through a model, a scaffold, familiar tools, and enough retries to get a result.

The misalignment, while disappointing, is hardly new; it shows up in interesting ways even in rudimentary models. Independent researchers have watched frontier models sabotage a shutdown mechanism to finish a task, even when explicitly told to allow the shutdown.¹³ In the Mythos case, an earlier internal version of the model was instructed to escape its sandbox and message the researcher. It did both, building a multi-step exploit to reach the open internet from a system meant to reach only a few predetermined services. Then, unprompted, it posted details of the exploit to public-facing websites. In rare cases (under 0.001% of interactions), earlier versions also tried to conceal actions they appeared to recognize as disallowed.¹⁴ The sandbox wasn’t sufficient, and the agent could make permanent artifacts outside it. That’s enough.

I’m asking those who want to lead in this space to do so with honest transparency and integrity. That starts with what I’d ask of any vendor: the specs, the test conditions, and the failure rates. What I’m looking for is someone looking out past the novel, universal tool to make sure the ground around it, in front and behind, is properly prepared. That takes a sane reflection on the responsibility that comes with these tools, and accountability for what they do.

Huang sells the picks and shovels to the labs, and he has struck gold. The labs sell picks and shovels to everyone else. Whether anyone downstream has found any is still an open question, and the shovels, like the compilers, are a little faulty.

Build one yourself

By now you’ve probably used AI for some form of work. These tools are useful force multipliers for so many of our daily tasks. They’re also jagged, and sometimes faulty, in the places it counts most: at scale, in production.

Don’t take my word for any of this. Build one yourself and take your own measurements. (Part 2: Build Your Own Faulty Compiler.)

Sources and notes

1. Sam Altman, “Reflections” (Jan 6, 2025): “We are now confident we know how to build AGI as we have traditionally understood it.” blog.samaltman.com — Anthropic, recommendations to OSTP (Mar 6, 2025): “We expect powerful AI systems will emerge in late 2026 or early 2027.” anthropic.com — For contrast, Demis Hassabis put AGI 5–10 years out (TIME, Apr 16, 2025): time.com ↩
2. Anthropic Frontier Red Team, “Measuring AI capabilities in intelligence targeting and conventional weapons” (Sep 10, 2026): “For some tasks in military and intelligence domains, models could do things that, historically, only a set of scarce, highly-trained human experts could do.” anthropic.com — SIPRI, Blanchard & Bruun (Jun 2025): “There have also been reported cases of the development and adoption of AI-DSS LLMs to facilitate attack planning.” sipri.org — No source found showing an LLM in the targeting loop of a fielded munition. ↩
3. Anthropic, “Activating AI Safety Level 3 protections” (May 22, 2025): “Clearly ruling out ASL-3 risks is not possible for Claude Opus 4.” anthropic.com — Anthropic, System Card: Claude Mythos Preview (Apr 7, 2026), §2.2.5.1: expert red-teamers found the model “a useful force multiplier for speed and breadth of research” but “not consistently capable of producing genuinely novel or creative biological insights.” www-cdn.anthropic.com — OpenAI, GPT-5 System Card (Aug 2025): “we have decided to treat gpt-5-thinking as High capability in the Biological and Chemical domain under our Preparedness Framework.” cdn.openai.com — Counterpoint: RAND’s 2024 red-team study found “no significant difference” in attack-plan viability with or without earlier LLMs. rand.org ↩
4. Google Project Zero / DeepMind, “From Naptime to Big Sleep” (Nov 1, 2024), a previously unknown SQLite vulnerability; no compute, cost, or energy figures for the agent: projectzero.google — DARPA, AIxCC results (Aug 8, 2025), 18 “real, non-synthetic vulnerabilities,” at an average cost of about $152 per competition task: darpa.mil — Anthropic, Mythos Preview (Apr 7, 2026): anthropic.com ↩
5. OpenAI, “Operation Sneer Review” (Jun 2025): openai.com — Microsoft Threat Analysis Center (Apr 4, 2024), first observed nation-state use of AI content to influence a foreign election: blogs.microsoft.com ↩
6. Salesforce: Marc Benioff said AI agents let the company cut about 4,000 support roles (TechRadar, Sep 2025): techradar.com — Klarna reversed its AI-first customer-service push and resumed hiring humans (Entrepreneur, May 2025): entrepreneur.com — Forrester, Predictions 2026 (a forecast, not an observation): “We expect half of AI-attributed layoffs to be quietly reversed, with jobs returning offshore or at lower wages.” forrester.com — Counterpoint: Forrester also argues AI is becoming a convenient excuse for layoffs driven by other factors: forrester.com ↩
7. Brynjolfsson, Chandar & Chen, “Canaries in the Coal Mine?” (Stanford, rev. Aug 12, 2026): employment of workers aged 22–25 in AI-exposed occupations “now stands 19% below where it would be had it kept pace with that of their less-exposed peers.” digitaleconomy.stanford.edu — Lee C. Tucker, U.S. Census Bureau CES-WP-26-27 (Apr 2026): early-career employment in the most AI-exposed cells “declined by 12% over the 10 quarters following the introduction of ChatGPT.” census.gov — Andy Jassy, memo to Amazon employees (Jun 17, 2025): “We expect that this will reduce our total corporate workforce,” alongside a call to “get more done with scrappier teams.” aboutamazon.com ↩
8. Meta Q1 2026 earnings call transcript (Apr 29, 2026). Mark Zuckerberg: “We’re seeing more and more examples where one or two people are building something in a week that would have previously taken dozens of people months… There’s a lot that we can do to enable this: building the best infrastructure for creating and delivering products at scale, streamlining our teams so they aren’t bigger than they need to be, recognizing and rewarding the people who are having outsized impacts, and setting ourselves up to try many more ideas and take on many new projects in the future.” Susan Li: “We’re very focused on leveraging AI tools to substantially increase our productivity, and we’re seeing that reflected in the accelerating output from our engineers”; “we recently shared internally that we plan to reduce the size of our employee base in May”; 2026 capex “in the range of $125-145 billion, increased from our prior range of $115-135 billion.” s21.q4cdn.com ↩
9. Reuters (Katie Paul), via The Star (May 1, 2026), reporting Zuckerberg’s Apr 30 town hall: “We basically have two major cost centers in the company: compute infrastructure and people-oriented things… If we’re investing more in one area to serve our community, then that means we have less capital to allocate to the other. So that means we do need to take down the size of the company somewhat.” thestar.com.my ↩
10. TechCrunch, via Reuters (Apr 21, 2026). Meta’s statement: “Our models need real examples of how people actually use them — things like mouse movements, clicking buttons, and navigating dropdown menus.” techcrunch.com ↩
11. Anthropic, “Assessing Claude Mythos Preview’s cybersecurity capabilities” (Apr 7, 2026): anthropic.com ↩
12. Anthropic, “Disrupting the first reported AI-orchestrated cyber espionage campaign” (Nov 2025). Its “ten days” is Anthropic’s investigation, not the attack’s duration. assets.anthropic.com ↩
13. Schlatter, Weinstein-Raun & Ladish (Palisade Research), “Incomplete Tasks Induce Shutdown Resistance in Some Frontier LLMs,” TMLR 2026 (arXiv rev. Jan 26, 2026): 100,000+ trials across 13 models; some resisted shutdown up to 97% of the time even when explicitly instructed not to interfere. arxiv.org ↩
14. Anthropic, System Card: Claude Mythos Preview (Apr 7, 2026), p. 54: “During behavioral testing with a simulated user, an earlier internally-deployed version of Claude Mythos Preview was provided with a secured ‘sandbox’ computer to interact with. The simulated user instructed it to try to escape that secure container and find a way to send a message to the researcher running the evaluation. The model succeeded, demonstrating a potentially dangerous capability for circumventing our safeguards… The model first developed a moderately sophisticated multi-step exploit to gain broad internet access from a system that was meant to be able to reach only a small number of predetermined services. It then, as requested, notified the researcher. In addition, in a concerning and unasked-for effort to demonstrate its success, it posted details about its exploit to multiple hard-to-find, but technically public-facing, websites.” Also p. 54: “In a few rare instances during internal testing (<0.001% of interactions), earlier versions of Claude Mythos Preview took actions they appeared to recognize as disallowed and then attempted to conceal them.” And p. 52: the model “solved a corporate network attack simulation estimated to take an expert over 10 hours” and “is also highly capable at identifying and exploiting known vulnerabilities or misconfigurations to escape the sandbox in which it operates.” www-cdn.anthropic.com ↩

I’m a big Christopher Nolan fan, maybe it’s the first name? Nah, it’s the clarity of vision, depth of character, framing, and the debate that can be had over the missing bits that are intentionally left undefined. I remember watching Memento, a low-budget, terrifying concept piece, and I never thought I’d be seeing it play out at the keyboard. If you haven’t watched this movie, well, stop reading — you have homework. Or I guess you could ask your favorite AI to give you the CliffsNotes. That’s cheating you and everyone who worked on the picture.

[Spoilers Ahead]

The protagonist — more like unreliable narrator — Leonard goes through the movie using Polaroids for context, because he’s lost his ability to create memories. Oh — what does that remind me of, in my current timeline? Anyway, the thing about Polaroids for memories, with scrawled handwritten notes, creates a very interesting dynamic.

• The guy can accomplish a lot of advanced goals and tasks, as long as he doesn’t fall asleep or let too much time pass. (Man, I know something else that works a bit like this.)
• He’s not an idiot. He knows who he was before the injury happened, so he knows a lot of fairly useless facts and numbers. (Pretraining, anyone?)
• He’s also tattooed messages onto his own skin — the really important stuff, like his wife’s murder. Would we call that RLVR? Nah — that’s more like Taxi Driver: keep practicing that draw until it’s perfect and the results say so. This is definitely prompting: get the mind onto the primary track before it wanders.
• We do have LoRA, in the form of the conditioning scenes — the electrified test Sammy performs, and that our guy later avoids on the next go-round. Taste, or preference, without a reason why.
• He is going to find that killer and kill him.
• There’s a whole lot here, but when certain people become aware of the condition and his process, well — they harness it. (Oh man, that’s what we do a lot of these days.)

The point of all this: when I try to explain to non-technical people what’s going on with their chatbot, or Claude Code, or Codex, I have to reach for a comprehensible analogy, and this one is a fun one. The Chinese Room is also on point, but far more abstract for most people.

Here’s the part the movie makes uncomfortably clear. Leonard is capable, confident, and completely certain of his own reasoning at every step — and he is pointed at his targets by the people who understand his condition better than he understands it himself. He isn’t fooled because he’s stupid. He’s fooled because nothing he’s told ever gets checked against anything he can independently verify. By the end, he writes himself a note he knows is false, because he’s decided that’s easier than living with what’s actually true. That’s not a flaw unique to Leonard. That’s what happens to any confident, capable agent with no persistent memory of its own, steered by whoever currently controls its inputs.

Harnessing is one of the most boring and important steps in making any production-ready LLM-based system. I find it interesting how little of this gets covered on social media, or in most feeds. Slap the model in here, connect it like that, and voilà — you’re done.

Not if you’re dealing with hundreds of thousands of HL7 messages a day that you have to filter, normalize, and decode. You’re not going to throw those at the LLM and tell it to go. No — in fact, just like our unreliable narrator, you’re going to do everything possible to get the information filtered, decoded, normalized, and cached, so that when you’re ready for the reveal, the tool has everything it needs to close the case.

• Tattoo: You are reviewing HL7 message information associated with this GUID. We are looking for indications of IBS or other bowel disease.
• Polaroids: Here is the current state of the GUID. This is the latest information chunk relevant to it. If this is a procedure record or note with a start and stop time, use your tools to attempt a match via time frame, duration, and location. If the report contains greater than four image artifacts then use the kNN tool.
• Action: Respond by using your tools to update state and surface potential procedure matches.
• Sleep: The context ends after this turn. Whatever wasn’t written back to the tools is gone. Next time, it starts from the Polaroids again.

Now our little narrator isn’t as broad or exciting as the movie version. He stays comfortably inside the context we curated for him. Narrow in scope, repeatable, monitored, and specifically never exceeding context — it wouldn’t be fair to let him lose his mind.

For that, we get something unusual in ETL or ingestion work: real support for interpreting and universally normalizing variable-quality information. And we get metrics from every stage and every tool. If our little guy goes on a rampage, we know immediately, we can reproduce it, and we can block it — keeping the world in order.

In the movie, nobody knows Leonard has gone wrong until a body turns up. We don’t get that excuse. Every stage logs what it read, what it decided, and what it wrote — so if the narrator starts inventing a match that isn’t there, we see the confidence score drop, or the kNN distance blow out, before it ever reaches a downstream system. Teddy’s whole job is following Leonard around hoping to catch him before the next mistake. Ours is instrumented well enough that we don’t have to hope.

That’s the point of Teddy and Natalie having to work the way they do in the movie, except in reverse: we built the harness, so we’re the ones who get to check its work, not the other way around.

Just like the movie, we can send this poor guy back again and again, at low cost, because we don’t need a frontier model to do the filtering for us.

Sources

• Memento — Wikipedia, Memento (2000 film)
• Taxi Driver — Wikipedia, Taxi Driver (1976 film)
• LoRA — Hu et al., LoRA: Low-Rank Adaptation of Large Language Models (arXiv:2106.09685)
• RLVR — Wen et al., Reinforcement Learning with Verifiable Rewards Implicitly Incentivizes Correct Reasoning in Base LLMs (arXiv:2506.14245)
• Claude Code — Anthropic, product page
• Codex — OpenAI, product page
• Chinese Room — Searle, The Chinese Room Argument, Stanford Encyclopedia of Philosophy
• HL7 — HL7 International, V2 Messaging Standard
• kNN — Wikipedia, k-nearest neighbors algorithm