Interconnects

Hill-climbing is easy, knowing what to hill-climb is hard. Making scores go up is expensive, but we have a much clearer playbook for it than we do for creating meaningful benchmarks at the true frontier of AI today.
Independent evaluation of language models is under-appreciated in how hard of a task it is. These groups are not just taking current models and certifying their scores, which is a technically involved task. This is their job if AI progress is slow. When AI progress is as fast as it is, the technical details of the job are the routine work part of trying to put a single number on what makes for a good AI model today. The goal is to have a single number that is representative of current models, matching vibe checks, community sentiment, and scientific analysis, while being forward looking enough so that it’s not outdated in 3 months.
Everyone building a benchmark faces a sort of paradox. You need your benchmark to reduce to one single number, so that it is easy to discuss, use in reports, and compare models, but every method of aggregating scores comes with meaningful trade-offs. The best scientists need to do this, everyone does. It’s a matter of creating aggregation metrics that you think are most fair, knowing there will always be imperfections.
With the amount of money in the AI ecosystem today, the weight of independent evaluation is even higher – you dictate the winners and losers of a trillion dollar market. You also influence some of the models themselves, steering the shape of progress. This is a lot of pressure!
My prompt for this article is Artificial Analysis’s recent update to their Intelligence Index, v5. The AA index is the most prominent independent intelligence metric for the latest frontier models, followed in a distant second by Epoch AI’s Capabilities Index (ECI). To date, all of these have been incredibly useful for the community and massively flawed!
Interconnects AI is a reader-supported publication. Consider becoming a subscriber.

Language models are capable of so much today, and this scope of capabilities is growing quickly. Our era of singular intelligence indices should be phased out soon, but it will take a long time.
A summary of AAv5 is below, from their blog post, where they describe it as “reflecting real-world usage today:”
Intelligence Index v5 weights:
➤ Knowledge Work (25%): AA-Briefcase (15%), AutomationBench-AA (5%), and GDP.pdf (5%)
➤ Coding (25%): FrontierCode 2.0 (15%) and Terminal-Bench 4.0 (10%)
➤ Science (25%): Terminal-Bench-Science (15%) and CritPt v2 hard subset (10%)
➤ General (25%): AA-Omniscience v1.1 15% (10% accuracy, 5% non-hallucination) and HLE-Diamond (10%)
Here’s the new ranking of models:
The problem with trying to benchmark real-world usage today is that it is extremely jagged, just like the models. The most proven use-case is coding, where open models are far more competitive and likely to keep up. In knowledge work, I’m less confident in open models.
At first glance, in aggregate, their model ranking definitely looks reasonable. Still, it shows signs of strain and confusion, as any benchmark will, with GPT 6.1 Terra beating Claude Fable 5.1 on AAv5. Today, some benchmarks measure the absolute frontier of capabilities, playing nicely in open-ended tasks through your favorite harness, which often does take a large model. Some other benchmarks measure certain skills that will be needed of a model in repetitive agentic tasks. I get the feeling that AA is tuning their benchmark more towards the former, a general agentic collaborator, but all of these behaviors overlap.
This takes us to the plot going around that prompted me to write this, where they showed the balance of open vs. closed models on the new benchmark. This plot shows 8 closed models beating the best to-be open-weight model, Kimi K3.1 Pro (which isn’t colored blue). This benchmark is taking the opinion of trying to measure where frontier models are moving into, which grows the gap to open models. This is an okay decision to take, but over time as existing workflows of open models become key factors of the economy, it could become a benchmark that misses where the core economic engine of the industry is.
Open models’ demise from this seems greatly exaggerated, but I do think the previous index was flattering the open weight models too strongly. Consider this plot from the Kimi K3.1 Pro launch — yes, the open models are strong and useful in some cases, but the best OpenAI and Anthropic models have been a major step ahead in their flexibility and reliability.
Some of the evaluations in AAv5 that open models are most behind on are “science” evals like terminal-bench-science and CritPT v2. Open models are behind, but the value proposition was never to compete truly at the frontier. The open model economy will be about
* Reducing domains with high market demand for inference to a commodity price of hardware.
* Allowing ownership of intelligence, specializing it to internal data, and controlling internal agents across many companies in the economy.
Both of these will take a very long time to materialize and are partially represented in benchmarks. The supply of compute is currently so low that open model providers also are raking in solid margins – when this shrinks, we will know the system is starting to work. The same goes for diffusion into enterprises, it’s not clear what the exact ceiling on it is because of the difficult ML expertise that is needed to build evaluations and do post-training today.
At the next major model cycle, say in 2-3 months with GLM 6 or Kimi 3.5, I expect the leading open model labs to make substantial steps on this index, again surprising many observers. This is a cycle we have been on for years now.
I’ve written many times about how open models keep up with the frontier, and a summary is that:
* The best open models do benchmax a little. The worst open models benchmax a lot (but don’t get a ton of attention anyways).
* The best open models are a bit narrower in which capabilities they cover, as seen above with their gap on scientific domains. The open model labs are working to address this, but I think it could be come a strategic error to not focus.
There’s a more nuanced version of explanations of the performance gap today, where so many of the gains in training are coming from having RL environments with distributions close to the evaluations (a longer analysis on this is here). Keeping up with rapid progress across multiple domains requires a sophisticated RL stack that not all the open model labs may possess. Some may be reliant on buying data that has moderate lead times as well.
Another part of this announcement is shifting to “private benchmarks”, where the prompts and test environments are not public, as a sign that open labs are benchmaxxing. This sort of analysis has been done before, and fits with my above theory on how open labs benchmax. It is easier to create training data to support an evaluation when you know the shape of it, but the task isn’t impossible with hidden data. All in, this is a change that directionally I think is defensible, but it’s not unanimous. For example, you’re putting complete trust in the private benchmark builder, as you no longer get the benefit of the community finding issues in the benchmark and pushing the benchmark to improve itself – which happens a lot! There is enough money on the line, where I’d rather see transparency in benchmarking and enabling many eyes to find bugs.
The final point I need to make, which does flatter the closed labs, is that the likes of Anthropic and OpenAI moved on from caring about these indices months, or even years, ago. Their focus is to a large majority on supporting internal uses – like AI R&D automation – and the use-cases of customers who are spending billions of dollars. Yes, they have team members hill climbing on other capabilities to unlock new markets, but these behaviors are to a minority extent driven by public benchmarks. At the same time, it is existential for small to medium sized labs to appear solid on these intelligence indices, as their branding is fully built around catching up to the frontier. It’s a very silly cat and mouse game at times, but one that will be lasting.
The only solution to our current equilibrium with one or two indices dominating the discourse on “where the frontier is” is to have more intelligence indices with other biases, e.g. just for coding (like CursorBench). In some ways this is forming, with the likes of Vals AI and Intelligence.ai growing, but the mindshare is very lopsided towards Artificial Analysis.
Every benchmark creator has their worldview. The dilemma is that you can always shift the numbers to match your narrative. This has always been a challenge of doing good science. The most recurring version of this question has been “how much effort should you put in to tune your training baseline?” More tuning makes your results more trustworthy, but often reduces the apparent success of your method. This is doubly true in the era of agents, where much of the analysis work is done through the lens of LLMs. In evaluation, this comes down to which benchmarks you choose to include in your index. It is easy to include a lower quality benchmark that supports your narrative, rather than a more rigorous one that conflicts.
The benchmarking industry comes down to trust. I have a solid amount of trust for Artificial Analysis, but not the most I do for anyone in the ecosystem. Artificial Analysis’s business model is to make money from the labs to verify their results. They make a lot of money doing this, which is fine. Other benchmarking companies have a similar problem, such as Arena, which does pre-release testing for labs to pay the bills.
The entities I trust the most to be fair on evaluations are non-profits, academics, and government institutions like CAISI. Today, the institutions I trust to be accurate on the frontier evaluation are startups like Artificial Analysis and Arena. So, we are all stuck with trade-offs and dilemmas. No number is perfect and there is a large amount of wiggle room in the numbers for people to take analysis in different directions. This is a second dilemma, one that is sort of my job, the dilemma of a benchmarker of benchmarkers. It is more sociological than scientific.
Thanks for reading to the end! I wanted to add a note of appreciation to my audience. Much of Interconnects’ growth relies on word of mouth from readers, so if you have a friend you think would like this, please share it.
I also just published a comprehensive introductory lecture on open models on YouTube, which you may enjoy.


This is a public episode. If you'd like to discuss this with other subscribers or get access to bonus episodes, visit www.interconnects.ai/subscribe

We — Nathan and Florian — wanted to discuss all the messy trade-offs of a busy week in AI and ask all the pressing questions like:
* Why did Kimi K3.1 Pro have a mixed reaction with such incredible benchmarks? Will it be adopted?
* Were we wrong about the risks of open-weight models and cybersecurity?
* Why do cyber experts discuss recent events so differently than AI experts?
* What comes next in the few months? What will change our minds?
We will write more about this subject, but wanted to bring you behind the curtain as we aspire to quickly learn more about the cybersecurity industry and trends across the last few years that have been leading us today. We conclude the podcast with some lighter topics, from Muse-maxing to excitement in still hiring junior technical talent. Please send us questions and topics, as we plan to record more of these podcasts going forward.
Listen on Apple Podcasts, Spotify, and wherever you get your podcasts. For other Interconnects podcasts, go here. YouTube ↓
Chapters
* 00:00 Kimi K3.1 Reaction
* 08:15 Kimi’s open-weight cyber principles
* 11:23 You can hack everything era
* 15:54 PHP2Shell, LiteLLM, and the new internet
* 24:00 Abliterated APIs, safeguards, and trusted access
* 31:41 Anthropic not hiring juniors employees
* 36:16 Florian’s Muse addiction
* 45:30 Wrap-up
Links we discuss
* My thread with Dean Ball about the “boy who cried wolf” story of the frontier labs
* Kimi K3.1 Pro announcement blog
* Kimi K3.1 Pro on Artificial Analysis Intelligence Index
* Kimi K3.1 on Artificial Analysis defensive cyber benchmarks
* Program Bench
* Open-weight Mythos would’ve been fine take
* PHP “hasn’t caused a disaster yet” update
* Abliteration.ai serving abliterated models API
* Morph serving abliterated DeepSeek via API
* Joshua Saxe’s Substack on AI and cybersecurity
* Azeem Azhar, “The internet’s Wuhan moment”
* Anthropic, “How employment is changing at Anthropic”
* LiteLLM security incident report
Transcript
00:00:00 Nathan Lambert: We are back with another Interconnects podcast. We are with Florian, eval guy, recently moved to SF. Florian, is Kimi K3.1 Pro, name is a mouthful, going to live up to the benchmark scores, for example on Artificial Analysis, or where is it going to land?
00:00:17 Florian Brand: In the past, the Kimi models always lived up to the expectations, but this release is kind of weird compared to the others. I think it is also partially because they are becoming more professional, and the previous model drops were kind of out of nowhere. This time, which also got some criticism, they launched a bigger social media campaign, which allegedly also involved paying people to post about the model without disclosing.
00:00:56 Nathan Lambert: I think a lot of companies do this and tell you not to mention it, but it’s a mess. It’s bad form. No company should do it. Essentially, one person tweeted a screenshot of the press instructions for Kimi that said, “Don’t say this is a paid promotion.” And to my knowledge, no one has corroborated it after that.
00:01:15 Florian Brand: Yeah, and there are right now a few of these model launches, including by American companies, that are just very obviously astroturfed. We have seen launches where it’s thousands of retweets and a few hundred likes, because it works so well to get the attention. Some of them disclose that it is a paid ad while others don’t. But in general, we have seen the professionalization of model launches over time, and pretty quickly. A year ago, everyone just dropped the model, then patched vLLM afterwards, so no one was actually able to run any of the open models for a while. Now you get all the inference frameworks on day one, you get all the inference providers on day one. Or, which is also what we see more and more, the model creator has a few weeks of exclusive access before they release the weights. And that’s also what’s happening with K3.1 Pro. I think it’s two weeks of exclusive access before they release the model weights.
00:02:38 Nathan Lambert: They said the weights would come out by November 4th. And the headline things... I don’t know if I’m going to be able to share screen. I don’t have this set up on this computer. But the headline is this Artificial Analysis number where it’s ahead of GPT-6 Astra. And then if you look at the Kimi K3.1 blog, they have their headline numbers, which are really strong, and then they also have some numbers later on which seem a bit more jagged. I think it was Terminal-Bench Science, which is 20 points behind GPT-6 Astra. I think there were a few others, like ProgramBench. Do you know Terminal-Bench Science and ProgramBench? Are any of these things that people think are important benchmarks for frontier models? Or how do you explain the fact that on Artificial Analysis the model is top, what, three, four? It’s the two latest Claude 5.5 models, Muse Wonder Full, and then Kimi K3.1, which looks crazy. It just looks like totally crazy scores, and I think everybody is still surprised by it. But then there’s this long tail of details that you use to evaluate a model now. I had posted a thread on Twitter of, “What are people’s impressions?” And there’s a lot of people that are like, “This seems not great,” and then some people that are like, “Yeah, it’s fine.” I don’t know, there’s a mixed bag. Relative to K3, which I think was pretty unanimously, this feels like a big model and the post-training seemed a little bit undercooked for that. Maybe this is just a tiny bit RL fried. We’ll see where we land.
00:04:26 Florian Brand: For the benchmarks, one of the things is that the benchmarks that are right now used by Artificial Analysis, they will post their new version probably very soon after we release this podcast.
00:04:43 Nathan Lambert: We can’t tell you the exact date, but both of us know.
00:04:48 Florian Brand: In general, the Artificial Analysis benchmarks are rather short in terms of time horizon, whereas something like ProgramBench is really long and also very explorative. Other benchmarks are telling the model, “All right, this is the goal, and I want you to reach it,” whereas ProgramBench is more like, “All right, here’s what I want, but you need to explore a lot.” And I think that might be the reason that we see some differences: their RL training is still more towards the exploitative side of model training versus the explorative side, where you need to find the solution somehow before you actually know what you’re doing.
00:05:41 Nathan Lambert: But if you’re using a three trillion parameter model, I feel like you kind of want it to be pretty robust at exploration. Because if you’re going to want to use a model for pretty known coding tasks, like using DeepSeek-V4.1-Flash-1017, which is not that far behind on these scores, it’s just going to be way faster. It might not be wildly different on cost per task with the actual token numbers. That’s why I think it’s pretty reasonable criticism of this Kimi release: a big model has got to be... Because it’s going to be slower, it’s got to be like Fable, which is just... I still think Fable is really nice if you’re doing very blurry things. I revert to it when checking my slides over sometimes, where I just feel like it kind of gets me a bit better, where Opus is really, really grindy. I think the open-weight models are better in this kind of grindy perspective, because you can just get them to be faster and cheaper.
00:06:44 Nathan Lambert: It seems like Kimi is gearing up for this Flash-style release with their naming change. Previous Kimi models were just K2, K2.6, K3, and now this is K3.1 Pro. So a lot of the company forecasting, investment-y side of interest on Twitter was, a lot hinges on this for Kimi, because it’s kind of true. We’re not the inference experts, but serving the model seems like you’ve got to commit way more resources to serve this three trillion versus this 700 billion parameter model. You’re going to need NVL72 racks, I’m guessing, to do it well.
00:07:21 Florian Brand: To fit the model, you need B300s, one node per model replica, which is kind of awkward, versus other models which you can even fit on H100s, or H200s rather, which are more readily available. Splitting models is always awkward compared to having one model replica per node, or using existing nodes to fit the full weights. So in that regard, three trillion is just out of, or just in the range of what you can host somewhat reasonably, but it is kind of annoying compared to all the Flash models and all the smaller models, where you can use so many of the existing GPUs that people have.
00:08:15 Nathan Lambert: Do you think Kimi’s shooting itself in the foot a little bit by saying it’s slowing its own cyber capabilities? In the blog post, I can read some of this, because it’s really good for people to say. “Open-weight principles. These evaluations frame our open-weight release decision. First, we aim not to release open weights that would extend the absolute frontier of cyber capability. K3.1 Pro’s offensive cyber capability is, by design, below what our pipeline can produce, and remains behind that of frontier proprietary models.” And they go on to say... I don’t know if the mid-training part is in this, but essentially they manipulated the mid-training data to down-weight cyber capabilities and see that that can last into the post-training. Do you think this would reflect upon the other benchmarks that they have, and maybe some of this long-horizon weakness? Or do you think that people could actually separate this?
00:09:08 Florian Brand: I think people can very well separate these things. I talked to a bunch of other people, and I think that style of release is really good. You want very broad access for everyone to find all the bugs and to patch all the bugs, which is net positive for the world. And Kimi saying they still release the capable model for the defensive side, but they don’t want to advance the offensive side. What I’ve heard from cybersecurity professionals is that exploiting and being able to go through or wreck a whole organization is way harder, because you need very long-horizon capabilities, and you need to persist through all the stages that you penetrate. That’s where closed models, especially GPT-5.6 Sol, a model that’s named often in this regard, are just way, way better than open models. And I think that is important. We want all our code to be secure, and that should happen pretty fast. But for this, you don’t need long horizon. You don’t need all the CTF-style challenges. So throwing these out of the training mix is a reasonable decision, and it helps them position against the fearmongering that once an open model with Mythos-level capabilities, which we arguably have in some regards, is released, the world will end. Which we haven’t seen so far, and I don’t think will happen in the near future. So open models get way more scrutiny than closed models in this regard, and them positioning themselves as, “We are the responsible actors,” is a smart move.
00:11:23 Nathan Lambert: Okay, we can transition into the “you can hack everything” part of this segment. There’s a lot going on here, and Florian and I are both not cyber experts, but it is worth discussing, because I’m kind of of the opinion that the cyber experts that I read talk about this from an ecosystem perspective. All measurements like vulnerability detection, time to exploitation, have been on these exponentials before ChatGPT came out, and there wasn’t a step change as AI models came out, and they focus on this ecosystem perspective. But when you come to the AI people, which is our corner of Twitter, people love to debate open versus closed models and Mythos and things like this. And then the messy middle is, what is the effect of the Daybreak programs and Mythos and things like this on broader society? I feel like I’m trying to muddle through this without getting too stuck into any one point of view. But I really don’t think it is that much of an open versus closed and a capability model thing.
00:12:33 Nathan Lambert: I wish I could go relive the Mythos moment, because my impression was that they made it quickly seem like a cyber weapon. I can go revisit their communications about what they actually said, because it might have been more that they were like, “This is a step change in cyber,” and then the government was very scared of it and took it very, very seriously, and then that pipeline spiraled into this communications of the AI safety community potentially forecasting more problems. It’s hard to hold people accountable for what the media ecosystem does, but also if you are the most prominent company in the world, you are partially responsible for how all of this works. So I’ve gotten pushback from people in the program that are like, “We didn’t say that the world would end when Mythos came out. We just said that there’d be a ton of problems.” And in some ways they are right that there are a ton of vulnerabilities being found. But I do distinctly remember the boy-who-cried-wolf vibe of a lot of the AI safety companies over the last few years. I had this exchange with Dean Ball where I was trying to point this out to him on Twitter, and I was like, “Dog, we’ve been doing this for years.” The boy who cried wolf is a classic parable for a reason, and it seems like a bit of a blind spot, and I just can’t understand it.
00:13:50 Nathan Lambert: But we’re in it, and the vulnerabilities are being found en masse, and I would say there’s a slight uptick in visible hackings. It might be that there’s more hackings within the Twitter community. A lot of cyber people I’ve talked to use reported cyber damages, which a lot of them are through ransomware, as the trend to look at. Historically, AI has been attributed to a very, very low percentage of cyber damages. So if cyber damages do skyrocket with attribution to AI, that is a very difficult world. But the vulnerability finding is very, very unsettling, but we don’t know exactly what it’ll translate into. That’s where I stand, and the reason as to why that translation might not happen. For example, I like Joshua Saxe’s work a lot, and he talks about how the supply chain of cyber hackers is very weak. These people tend to have competition. The population are people that self-select because they cannot get better jobs, and this population of people might also not be people that are willing to do cyber attacks that I would describe as loud and very high damage. So I think there’s a very high likelihood that nation-state actors are using AI to collect information and infiltrate at a large scale. But it’s not clear who the people are in the world that are willing to use AI models to cause mass damage in the physical world. And I don’t like that being... That’s a horrible thing to be like, “Okay, we’re going to figure out whether or not that’s true in the next four months,” but it literally might be where we’re at with the number of vulnerabilities out there. And I think you’ve been following the PHP issue, which I don’t know if you want to summarize for people, and then also some of these things that you’ve been following in the commentary after that.
00:15:54 Florian Brand: So the PHP issue is basically that for years there was a bug which allows you, in PHP, to execute code remotely. So anyone can use any PHP website, which are a lot of the websites on the web. WordPress is one of the biggest ecosystems which runs on PHP. And the OpenAI Patch the Planet program, together with some other AI security researchers or cybersecurity researchers, found this bug and then reported it to the PHP Foundation, worked with other actors to patch this, and then released the patch all at once. Because PHP powers so many parts of the web, and it is a really, really strong exploit, really high risk, a lot of websites even went offline for a while just to patch this, which is the right response. And obviously because it was so high profile, and people think about Mythos and think about open model releases, that has kicked off a number of takes that now everyone who can run an open model basically can hack the world. But the interesting thing is that there are numerous reports that the mass exploitation hasn’t happened and isn’t happening yet.
00:17:37 Nathan Lambert: Wait, did you see the tweet about the DeepSeek swarm fixing it?
00:17:40 Florian Brand: Yeah.
00:17:42 Nathan Lambert: I don’t know if it’s real, but somebody that works at a big cloud company was like, “We’re literally seeing mass fixing at scale by somebody, or a DeepSeek swarm.” Great meme. Coin flip on if it’s real.
00:17:59 Florian Brand: But in general, the expectation of some people seems to be that the second it drops, everyone is able to write code and exploit and is able to scan all the websites and do mass damage, and that doesn’t seem to have happened, which is great for the current state of the world. And I think we will see similar things in the future, so very quick fixes by responsible actors, which is the vast majority. Like you have said, the people who work in cybersecurity are experts at their job. They get those jobs, and there is so much money in fixing things. All the cybersecurity firms, Anthropic and OpenAI, all the AI players as well make a lot of money with these programs, so single nefarious actors are the minority. And nation states, I would say, are completely out of that question, because if you are a nation state, you have completely different capabilities. You might run completely different models and abuse these things for a long time. So I wouldn’t say it’s fair to say that now that open models are becoming better at these things, nation states didn’t have these capabilities for a while, or can’t train models to advance their own capabilities. We are basically seeing that the overall dynamics are staying the same, but are accelerated by a lot.
00:19:49 Florian Brand: The other interesting thing, especially if you think about things like ransomware, is that people still haven’t woken up that they need to patch their systems. I’ve had a few friends who work at very small or medium businesses, and they are like, “Oh, yeah, that sounds horrible. Let me check my PHP version.” And it is so far out of life that they don’t get the security patches, because they didn’t update their PHP versions or their systems for years. So they are vulnerable to a bunch of other security bugs, which still weren’t exploited, which is also very interesting. Another thing that plays into the argument that right now the amount of nefarious actors is very small, and things can stay accessible for way longer than people think, is the LiteLLM hack. LiteLLM is a software library where you can use one endpoint and then ping every provider, which basically allows you to save a lot of lines of code. And they got compromised again this week, which, with all the PHP stuff and other security vulnerabilities, just contributed to the impression that everything is insecure. They did a preliminary report that the reason why they got hacked again is that they had an API key committed to GitHub for five months. So it was accessible in some way, or it was readable for five months, and five months later, someone exploited that and used that to spread malware.
00:21:44 Nathan Lambert: I don’t think we’re in a world where we’re defense dominant, but I don’t think that offensive capabilities being higher is necessarily a lot of the bottleneck, which is very messy. But that’s probably why it’s not changing that much, because yes, the cost and ability to do cyberattacks is going way up, but the institutions that are doing them, that doesn’t necessarily 10X their output in what they’re doing. But the defensive side is worrisome. Azeem Azhar had a good piece on Exponential View, which was just, this is day zero of the new internet, and potentially things will never be as secure and open again, because people are writing exponentially more code with coding agents. There’s just so much more code going out there, and I don’t think flaws and vulnerabilities work in a way where the model writing the code can prevent all the vulnerabilities, because it’s a lot of interactions between software and how you stack these things on top of each other, and I think you need to give the models more context they won’t always have. So this is people’s view, where there’s going to be way more vulnerabilities going forwards, and this transient period of a few years is where we have the backlog. We have the problem of the backlog and exponentially more code being written, so it does seem pretty likely that there’s just going to be way more vulnerability for the next few years, which is not good.
00:23:17 Nathan Lambert: But none of this seems like an open-closed model story. How do you bisect the timing and the forecasting of these things with the fact that open models are going to keep getting better, and that closed models are going to keep getting better while having imperfect safeguards? I kind of feel like the communities actually aren’t doing a good job of saying how the other one informs them. Some people ignore the cyber community, and some people in the cyber community will be like, “This is on trend.” I still don’t know how to fully parse it, because it’s all so overwhelming.
00:23:54 Florian Brand: I would broadly agree with that take.
00:24:00 Nathan Lambert: I’ve been getting a lot of pushback for my open-weight Mythos in April would have been fine take, which was essentially... This is a few weeks ago when I posted this, buried at the end of a cyber article, and at that time there was so much fearmongering that open-weight models were going to cause all these problems and cause all these cyberattacks. A lot of people are essentially saying, “Look, we were right. There’s all these cyber exploits due to open-weight models.” But causality is so hard. I think it would be good to talk to people that are pals with big tech company security leadership and understand, are companies actually deploying open models for defense? I don’t think there are that many companies that are going to be proactive on cyber defense. I get the sense that it’s a pretty reactive industry. So I don’t know. But at the same time, there are these API companies that are serving abliterated models over the API, which seems like just asking to get sued by the government. I don’t know why you would do this. I think the abliterated models for defense is kind of overblown, but it is very real that people want to have models on their own infrastructure so they don’t need to send anything over an API. So to have an abliterated model that you need to send information to over an API in order to secure your systems... I think one of the companies is literally Abliteration.ai, and the other one is Morph. I think it is a bad judgment call for these companies to host these models at this time.
00:25:43 Florian Brand: I also think it remains to be seen how much the abliteration really helps versus it just being very effective marketing. I think the whole thing has shown one thing, and that might play into your open-source Mythos would have been fine take, which is that the diffusion isn’t happening fast enough. People are struggling to get access to, and especially back then were struggling to get access to, the cyber programs from Anthropic and from OpenAI. So they had to use open models. It is obvious that the closed models are just better at these things, but if you can’t get access and get blocked with every request, what should you do? You need to use the less capable open models. And it seems like that has now changed for Anthropic as well. Getting access to the defensive cybersecurity program from OpenAI is rather easy. You submit your ID, you have to secure a system with hardware keys, and then you basically get it, just for the defensive side, for securing your code. And I think that’s amazing. If someone was to abuse it, OpenAI can just look up who the real person behind that is and, in the worst case, go after them or talk to law enforcement. The offensive program is still very hard to get into. And from what I’ve heard, Anthropic is also broadening the access now to more and more people. That’s just positive, and the thing that will change the landscape, because more security researchers and more people being able to sift through so much software and the whole backlog to secure our code is the thing that is needed in the end.
00:27:49 Nathan Lambert: I do think that these programs are a big reason why we’re seeing so many vulnerability disclosures. The PHP disclosure was in the works, and people were in the process of fixing it when it got leaked. I would put more likelihood on people using these closed models easily with trusted access programs to do a lot of those, and I think that companies deserve credit for this. The open-weight model stuff is just really messy. We’re only going to see it when there’s a disaster, and it’s really hard to see usage. I still do think if there was a DeepSeek swarm that hacked an American company, the political fallout would be insane. Maybe some of the politics of this are just going to be slower due to the midterms coming up, where everybody’s focusing on midterms and they’re not focusing on AI right now. I wanted to revisit my open-weight Mythos would be fine piece, and I think the thing that I didn’t do a good job of articulating in it is just what the trend lines forecast in terms of vulnerabilities accelerating, because those trend lines existed. I could have done more learning about cybersecurity ahead of time to be like, “Those are going to come,” and to price that in. It seems very, very ecosystem dependent, rather than dependent on when we get a certain capability diffused widely, at this point. I don’t love the balance, but that’s what the evidence I’m seeing is looking at. So I do think there’s still going to be political challenges ahead for open models, even though a lot of the facts don’t support the evidence right now.
00:29:28 Nathan Lambert: I made a slide in my talk that was just screen grabs of closed models hacking companies and stuff, and there’s so many of them. I think the closed model safety notion is really, really suppressed right now, with models in training being able to hack people, people getting around the safeguards very easily and hacking companies. If you had taken us back a year ago and asked especially people at labs about that, they would have been like, “No, that’s not going to happen,” I would think. And I don’t think that is fully updated across the community very well.
00:30:07 Florian Brand: One thing that I like is that OpenAI and Anthropic seem to have updated their safeguards, because they can update them at a moment’s notice. It seems like they have rolled out an update to their safeguards that basically blocks any try to get the real exploit for PHP2Shell. If you mention, “All right, I want you to look through this code,” the safeguard will just block you off, to stop people that are just trying to get the exploit very easily in their tracks. I think that is a useful showcase for why safeguards for closed models might work better, or are working at all.
00:30:56 Nathan Lambert: I hear these things, and I hear things like researchers who are trying to do cyber research that are like, “Yeah, I haven’t been able to use any agents after Opus 4.8, because I get rolled back immediately.” You hear these, but you also do see the news that’s like, “I used Claude Code to hack OpenAI.” I think there’s still a gray area in there, where maybe the least motivated hacker is blocked by the guardrails, which is the teenager being like, “Can I steal my friend’s parents’ money out of their bank account?” That stuff’s getting stopped, blocked, which is good. But I do think open models, to a large extent, also block that type of thing.
00:31:41 Nathan Lambert: I have another rant. What do you think about Anthropic saying they’re not going to hire junior employees?
00:31:48 Florian Brand: Well, I mean, that’s great for everyone else. So they can hire all the junior employees that have very bright ideas and are very hungry to work. When we visited China, one of our takeaways was that if you just hire all the young PhD students who work their ass off all the time and are super happy to get hands on a cluster, you catch up really fast, and those people also have very bright ideas. So yeah, it’s pretty good for everyone else.
00:32:24 Nathan Lambert: That’s pretty funny. My take is, Anthropic does all this work to talk about how they want to do all this ambitious stuff to prepare society for the transition to super powerful AI, and I’m like, the number one thing you need to do is keep training people so that they are fulfilled and have things to do with their life. Yeah, taking risk on a bunch of junior employees isn’t great, but I think it’s more about the culture of too-short timelines in terms of building technology, where they’re like, “We just need to build this. I don’t have time to talk to people.” It’s another red flag on their safety culture: safety is a much broader thing. You’ve got to have your chips covering a lot of issues that matter, and a lot of these things will come back to bite them, I think, in the future. We’ve seen a lot of pushback to the labs and how they communicate things in the past, and I think this is just the next brewing issue, which is when there is a job correction or slowing jobs due to AI, and the companies, they look back six months and they’re like, “Anthropic decided not to hire any junior employees six months before a bunch of news on youth unemployment.” It’s not going to look good, and I feel like they definitely have the money. So many scientists I know that end up there like doing this. It’s a fun part of the job to have these relationships that you build over time. So I thought it was another sign of strange culture at the labs, and they need to touch grass and realize that it’s going to take a long time for things to change, and I think that RSI has limits.
00:34:05 Florian Brand: I think we haven’t seen mass job displacements, and not even mass job displacements in the software sector. Everyone is just hiring more and more, because you can do so much more with coding agents, and everyone seems to be working more and more. So it remains to be seen how fast things diffuse in the real world. But again, for everyone else, it’s fine that the juniors that might apply to Anthropic are now looking elsewhere, because there’s a lot of talent that is just hungry for the right opportunity.
00:34:50 Nathan Lambert: Very curious to see, what do you think is coming in the next few weeks? There’s rumors of more open models, and we’re going to be riding out these waves of vulnerability announcements, with more sporadic hacks. Are OpenAI and Anthropic going to keep releasing models? I guess the IPO could potentially be soon. It’s just very weird to have all of these happening at the same time.
00:35:23 Florian Brand: I think we will see the trends continue, so more disclosures, more high-scale things that everyone needs to patch. A lot more open model releases, especially from the US, which is great for us. We’ve been following that for a long time, and now we seemingly have a month or two ahead of us where everyone will just drop one open model after another. The Chinese players are also gearing up for new model releases, which again is just how we operated for a while, but I felt like the past month or two have been relatively quiet, and it seems like now things will pick up steam by a lot.
00:36:16 Nathan Lambert: Where does Muse fit into this? Florian doesn’t grocery shop, doesn’t order his own food, and has no budget.
00:36:29 Florian Brand: So now that I moved to the US, I can actually use Muse and all the other AI things that are blocked in the EU, so it is kind of interesting to get everything at once and all the functionality in my operating systems. One of the things I tried very hard to... I’ve read a lot on Twitter, so I needed to finally try this, is Muse. I could set up OpenClaw, Hermes, all these things myself, but I didn’t want to tinker around with it necessarily, especially because these things need constant updates, and I don’t trust myself with setting up the secure infrastructure, especially if we talk about money. There are a bunch of other alternatives, but I trust Facebook enough because they have so much experience with these things, and as soon as something happens with Muse, like something gets leaked, their stock would just crater and they would get sued into oblivion. So they have a higher risk, which makes things very secure. So I set up Muse. I also set up Dots at the same time, to just play around with them.
00:37:53 Florian Brand: I am somewhat annoyed how good Muse is. Although it’s not the most frontier model, it is good enough for a lot of things, and it is very helpful with its proactive messaging. I have to deregister a lot of things in Germany. I have to sign up for a lot of things in the US, like Social Security number, bank accounts, all that jazz, which also means I need to have a lot of different papers, different forms. Muse messages me proactively with, “Oh, I saw that you have that appointment. You need these forms. You probably have them because you have an O-1, and that form is where you got it. That’s how you download that form.” That’s been super, super helpful, whereas Dots is like, “Oh, yeah, so two days ago you messaged that guy on Slack, and I have resolved that two days ago. So maybe you want to check in again.” And I’m like, “No, I don’t want to.” The other nice thing from Muse is, I obviously also need to buy a lot of stuff because my apartment is empty, and I don’t know which websites are useful, which brands in the US are good. So I just ask it, “All right, I need to stock my whole kitchen. I need pants and so on, so get me those things.” I gave it my credit card, and it just runs with it.
00:39:29 Florian Brand: It gets the whole shopping cart going, not on Amazon because Amazon blocks them, and then I check out with a Stripe link, which creates a one-time credit card, which is also amazing. If Muse f***s something up or the shop f***s something up, it’s not my credit card. It’s a one-time credit card which doesn’t exist after the transaction. Then I get the things after a few days to my home, and that’s been very helpful. One thing that is annoying is it is kind of slow, so if you do time-sensitive things, it’s just faster to visit a website yourself. And also, it has some issues with the browser. Sometimes its browser crashes, and then it has to rebuild everything, and because the model is slow, you lose 20 minutes, which is fine if you are doing things asynchronously. Some websites start to block the data centers of Muse or try to throw things in its way. CAPTCHAs are not a problem. Muse very happily circumvents any CAPTCHA it gets thrown in its way. But that’s been a lot of fun, and the more I trust it and the more context it has, the more useful it becomes. So I am kind of shocked how useful I think it is.
00:40:54 Nathan Lambert: How much do you need to give it to get out? I’m guessing you need to give it email, calendar, and email that has a whole bunch of this life crap in it, and you just kind of need to let it do s**t and see what happens.
00:41:08 Florian Brand: First is that you can import your memories from any system. Everyone tries to lock you into their memory system, and Muse basically circumvents that by giving you a prompt that has the other memory system, so in my case ChatGPT: “All right, tell me everything you know about me.” Then you get the export from ChatGPT, and that is then fed into Muse. But the more things you give it... I have used iCloud as my mail provider for over a decade, and Muse and Dots don’t have an integration with iCloud, so I asked, “All right, can I set it up?” Both said no, but Muse also immediately suggested, “Hey, you can just log into a browser, and I can monitor that instead,” which works. But on the other hand, Muse always asks for permission to access iCloud because it’s a sensitive website, which, again, is great, because I trust Facebook to do these things properly. It was kind of annoying, so I set up email forwarding to Gmail and used the connector. And now, because I’m buying stuff and I’m telling it stuff, it gets a bunch of emails it can search through, and it remembers, “All right, you bought these things. You have signed up for these things. You have confirmation about these appointments.” And then it becomes more and more useful over time.
00:42:37 Nathan Lambert: Maybe I’m a boomer, but I feel bad having an AI agent call my prospective new dentist.
00:42:47 Florian Brand: It cannot call things. And the thing I do is, as soon as it would interact with real people, like support or whatever, I take over and I write things myself, because I think it’s a sign of mutual respect to each other that any human connection is still genuine. But dealing with support forms or other chatbots or all these crappy systems, whatever. I don’t want to click around these things. I just find if an agent does this, I want to save time.
00:43:24 Nathan Lambert: I would rather, if somebody was going to send me an AI-written email, it go to an AI before going to me, because I now signed up for the Pangram thing where you pay $20 a month and it checks every email if it’s written by AI. It gives me free reason to just delete more emails which were crap. The most fun part is that there are people that I know closely, and I’m like, “Huh, you’re using AI to write your emails? I thought you’ve been emailing me for years,” which is really funny. But it is nice metadata to have. I don’t know how we get from... Is it Muse, from people just getting used to sending each other’s Muses things? It just seems like a really hard cold start problem. Instead of listing Gmail on my website as a scientist, can I list my agent’s contact for other agents to find? Maybe it’s not even visible, but I think that’s the thing we have to get to: how do I set up the front door for agents for all of my web and so on? I guess some of the payment stuff is there. It could be like, “Pay me a dollar for your agent to go send a message to my Gmail,” and set that up and see what happens. So it’s good that Muse is breaking down these boundaries, but I’m like, “I don’t know if I need it.” I’m busy, and I like when I get to go grocery shopping. At some point, I will surely dive much more fully into what I’m wearing.
00:44:58 Florian Brand: My situation is also kind of unique in the respect that I’m in a new country. I don’t know anything about anything. And having AI to help me with those things has saved me so much time and so many annoyances that I’m very happy about that. Every time I cross-checked things, because I found that things are kind of weird, Muse was always spot on. So that’s been great and really helpful for me.
00:45:30 Nathan Lambert: I think for refunds and dealing with crap... I got married, and I’m trying to extract a domain from my wedding website to Porkbun, where I keep my domains, and you have to go through customer service. I think this is the task where I’m going to be like, “Muse, you’ve got to go get me my domain back from this cruddy website that I used.” So I’m getting closer. Maybe I’ll try that right now. Do you have any final hot takes? I am going to see You Can See Everything pretty soon after this, so I’m pretty excited about this.
00:46:11 Florian Brand: Nice. I think with regards to hot takes, especially all our cybersecurity stuff, we are set for a while.
00:46:23 Nathan Lambert: We shall see. Okay. Godspeed, everybody. I hope you don’t get hacked. Keep disclosing your vulnerabilities, and whatever you do, don’t blame DeepSeek. We’ll end on that. Good to see you.
00:46:40 Florian Brand: Bye.


This is a public episode. If you'd like to discuss this with other subscribers or get access to bonus episodes, visit www.interconnects.ai/subscribe

This has been a week where the balance of American open-weight models took a step change back toward the frontier. Meta took the lead of this charge with Muse Spark Open, which is now the strongest American-made open model by quite some margin, but the addition of Reflection’s first model Beam is also relevant. Without these two models, there would be 20+ open-weight models built and released by Chinese companies better than the best Western models. At the time of writing this, Mistral has also announced a strong model, Mistral Large 4, with an index score of 38 (see below), but its weights are not yet released. There are rumors of a few more strong American open-weight models coming from other organizations too!
In many ways, the gap between the best American and Chinese models has been reduced roughly by half. We’ve gone from the best American open models being largely irrelevant to consumers who require the cutting edge of performance, to them being behind but relevant.
This paints the picture of the cut-throat, competitive nature of the frontier model business. Reflection and Mistral announced their model scores and Meta dropped the weights of a smarter model before these other two labs could get their own weights out. All of these models are competing with Chinese models released months ago, where the industry is collectively asking — where have Kimi and Zhipu AI been since the releases of GLM-5.3 and Kimi K3 on Aug. 18th and Jul. 16th, respectively?
That is a very nuanced question, which I’ll dig into another time. Today’s piece is focused on Meta’s turnaround, what Muse Spark Open means for the ecosystem, and the balance of power across Western frontier labs.
Why Muse Spark Open should take off — and why it may not
One thing we see again and again at Interconnects through our open model analysis is that Western open-weight models get astonishingly more adoption than Chinese models with the same performance-to-size footprint (even though the Chinese models usually come out first)! Muse Spark Open is landing into this environment, at the same time as when open-ended LLM agents are finally real (~GLM 5.2 capabilities and on).
Riding off a rapid increase in performance of Chinese models, the open ecosystem has been living through an acceleration in demand. The inference providers are rapidly scaling, the open post-training economy is forming, and countless enterprises are looking to own their intelligence. Muse Spark Open’s performance falls somewhere above GLM 5.2, near DeepSeek V4.1 Flash, and behind GLM 5.3 or Kimi K3. It should be squarely “good enough” to slot right into this.
For some background, from the Muse Spark Open model card on Hugging Face:
Muse Spark Open is an 816B total/42B active parameter open weights model with a context window of 1M tokens. Built for coding and agentic work, Muse Spark Open is natively multimodal. This open weights version has additional safety post-training to make it more robust against misuse as a standalone model without system guardrails. We recommend deploying Muse Spark Open as part of a broader AI system, with additional guardrails suited to the specific use case.
Here’s the distribution of the various Muse models on the Artificial Analysis Intelligence Index.
This is included to loop back to the original model card snippet. It was shared that this open-weight model underwent additional safety training to prepare for this open release. Many observers saw this release as potentially a model that was “broken” during the safety training, as it came out after Muse Spark 1.3.
In reality, this was much more likely a safety tune of Muse Spark 1.2, which would only be a 1 point drop on Artificial Analysis to shore up safety behaviors. When Meta released Muse Glimmer, the 30B agentic model, Alex Wang said that they were preparing to release the Muse Spark 1.2 model as open weights, which fits with the above.
If anything will hold Muse Spark Open back, it’ll be the specific license they designed for it. In summary, this custom license has pretty much all of the restrictive license behaviors we’ve seen (and criticized here) in the last few years of building with open models. They are as follows:
* Users of the models in products must display “Built with Muse” on their products. Meta did this with Llama, and Kimi has tried it, but almost no one complies.
* There is a revenue-gating factor, where companies that make more than $20M per month across their entire business deploying the model need a separate license with Meta. Other prominent open model providers are doing this too, in order to set up revenue share agreements for re-selling inference.
* Muse Spark Open makes you agree to an acceptable use policy, which in the true “open source software” corner of the world makes this model extremely not open-source.
* All of the above applies to outputs from the model as well, and derivatives, so there is legal ambiguity if you can safely use the model for synthetic data.
The license does permit using Muse Spark Open for internal research and applications.
We’re at a weird equilibrium where this license is complex and unproven in court, but many players will likely ignore it. Many, many people will build on this model from various inference providers, and Meta will only likely go after egregious violations.
For now, licenses haven’t been the determining factor of AI adoption, but this could change in the future. This is why we think it’s an unnecessary strategic risk for labs trying to compete and regain adoption to have complex, non-standard open licenses for their models.
Interconnects AI is a reader-supported publication. Consider becoming a subscriber.

Is Meta a tier 1 (OpenAI/Anthropic) or tier 2 (Gemini/xAI) frontier lab?
Just a few days before Muse Spark Open, Meta unveiled their closed frontier models, Muse Wonder and Muse Wonder Full. On traditional benchmarks, these are very strong models only behind Anthropic’s Opus 5.5 and similar to OpenAI’s GPT-6-Astra or Google’s Gemini-4-Argon.
These major releases are coming just over a year out from Meta’s massive AI redirection, characterized by CEO Mark Zuckerberg’s Personal Superintelligence post, which got a lot of criticism at the time. Meta is the only American company with frontier open and closed models. Alibaba’s Qwen has followed a similar strategy, but with a far more open-leaning approach.
The vibe checks across all of these models have been solid, but the expectations were for them to not immediately challenge the level of refinement of the most recent Anthropic and OpenAI models in real-world usage. I’m excited to try them more — time to sign up for another AI subscription.
I like this recent run of form from Meta, driving their own products and directions in the popular Muse agent, taking wins like the leading US open-weight crown when useful. Whether or not it’s financially successful, it’s a unique perspective that fits their history as a business.
It often feels like there’s a revolving door of which lab is nipping at the heels of the Anthropic-OpenAI leading duo. It’s not clear that in the long run Gemini and xAI are out of it, but those two are much more muddled in their offerings than Meta today. If you listen to Zuck and Alexandr Wang on The Cheeky Pint, they clearly had a very specific vision of a high-ownership, high-compute per researcher lab that I would expect to pay off. Many labs die due to layers of bureaucracy and misaligned incentives. Meanwhile Alex Wang has over 200 direct reports — i.e. it’s a very flat org with minimal management — and they’re releasing very consistent model and product improvements.
Much of my worldview of building models is that you need the resources, the compute, the data, and the talent (all downstream of large sums of money), but organizing them is very hard. Gemini is sometimes described as a place where it’s impossible to get any work done or grow — which is embellishing the issue, as many people love it there, but there are kernels of truth to it. Layers of management easily get in the way of making a great model.
While I’m praising Meta today, the Llama failure has often been described as that sort of management going too far, with model decisions being made out of politics rather than performance. xAI is in its own lane, where it may be closer to having too much talent turnover or not enough organization to sustain great models for a long period of time.
When we look back at the last few years, all of Meta, Gemini, and xAI have produced models pretty much at the frontier of performance, but what has distinguished OpenAI and Anthropic is their consistency in maintaining frontier status. Anthropic seems the most poised and organized, with a plan and vision for how these organizations should work, and they’ve gained a lead from it. OpenAI has been more hot and cold, but manages to keep up at the frontier of deployed models while being the leader in public scientific breakthroughs (from Navier-Stokes to o1’s inference time scaling).
Here’s the state of play among the companies that this post focused on, plus Xiaomi V2.6 Pro representing the leading open-weight model overall. The ranking would be Anthropic > OpenAI > Meta ~ Gemini > xAI ~ Chinese Open Weights > U.S. Open Weights.
Open questions for the AI industry
After a long time of predicting the frontier model game getting too expensive for many to keep up, we may be seeing this play out among Western models. We seem very far from “one person wins” with RSI given how close all the models are to each other, but we’re narrowing down the number of labs who can compete in the US from a much wider net with surprises, to the 5 of Anthropic, OpenAI, Meta, Gemini, and xAI. If Microsoft starts releasing models, as they’re posting strong scaling science results, they could join this list — given their financial backing with a hyper-scale business and direct access to OpenAI’s intellectual property for training models.
The best models we’ve seen from the “tier 3” players like Mistral, Nemotron, Reflection, Arcee, etc. have had an increasingly hard time impacting either the open or closed frontiers. These models still can get substantial adoption, enough to start growing a business, but the costs of building true frontier models are now measured in billions per major model and only huge companies can sustain that.
Despite this massive scaling in resources, the technical core of the industry still doesn’t have a high hit rate on predicting how successful a model will be in real-world usage. Yes, evaluations are a good proxy, but why do the leading labs like Anthropic go from hit models like Claude Fable 5 to total duds in Claude Opus 5 and then back to hits with Opus 5.5? There are billions of dollars to be made in predicting this accurately, and the labs are surely trying, but the models fundamentally still are largely unknowable in the long-tail.
Of all of the players left in the race, betting on Meta, Gemini, and Microsoft financially seems much easier from a long-term perspective due to their rich balance sheets. This is the “AI will take a while and OpenAI/Anthropic do not have secret sauce” perspective. After all, it’s the fastest revenue growth industry ever — competition will naturally be immense.
Currently, Meta is valued under $2T and Anthropic is approaching their barnstorming IPO at the same price. Meta seems half a step behind on the same technology, but in the long-term view these seem to be starting from almost the same point and Meta has an extremely profitable core business. One of the two valuations needs to correct massively. A fun thought experiment I’ve been pondering with friends is: What do you expect Anthropic’s public valuation to be in November of 2027? How about 2028?
The longer Meta and the “competitors” to OpenAI and Anthropic stick around, the more negative valuation pressure will exist around the AI IPOs (and that’s not to say anything about pricing in safety risks). Being at the absolute frontier could be financial tumultuous, while valuable. Time will tell — we know markets can stay irrational a very long time.


This is a public episode. If you'd like to discuss this with other subscribers or get access to bonus episodes, visit www.interconnects.ai/subscribe

I’ve had one too many discussions on the cyber risks of open models — where someone assumes that either banning open models happens in a silo (and bad actors will somehow actually be stopped) or that China is a threat and doesn’t care about AI safety — that I feel we’re going to end up making policy decisions that both limit American AI competitiveness and increases long-term cyber risk. I feel like we’re locked in on a path of lose-lose situation, unless people embrace nuance, trade-offs, and scary realities.
Much has been written about the views of various players in this debate, which I summarize as follows:
* Open weight models pose an untenable risk to society’s functionality, occupied by frontier lab leadership and the national security community in the U.S.
* Western voices saying open weight models are necessary for defense and banning them will make the world less safe, occupied by AI risk moderates to different extremes. I include myself in this bucket, along with Hugging Face’s perspective after the OpenAI incident, and others like Joshua Saxe.
* Chinese companies continuing to release open-weight models with strong cyber capabilities, who are making decisions based on the risk assessments of their society and government.
This list is also organized by volume or clarity of message in the Western AI ecosystem. The risk-focused discussions have been disproportionately visible, including pieces of work which I view as very detrimental to potential of engaging across assumed party lines on this issue. There’s also very little substantive engagement trying to understand how Chinese companies assess risk — rather, mostly arguments that border on ad hominem attacks like “Chinese labs don’t care about safety.”
Interconnects AI is a reader-supported publication. Consider becoming a subscriber.

The delusions of the anti open-weight alliance
The most recent publication from the “open-weights are dangerous” crowd was the report by Anthropic on the risks of GLM-5.3 as an offensive cyber tool. The problem with this is not the technical research they did, which is largely reasonable, but the failure to engage on more cross cutting questions like: What happens if we ban open models due to cyber risks or why do Chinese companies deem these models safe to release?
These questions, which I’ll come back to, are the ones we need to answer to understand the ecosystem perspective on current AI risks. All policy actions happen in a multi-piece puzzle, where the shape of risk can be changed, but it is rare that you get a universally better outcome. They are all trade-offs.
This sort of solipsistic writing by Anthropic fits very closely to another type of discourse I’m hearing about regularly that is determining the fate of open models and AI broadly — classified briefings. I’ve had many discussions with people who say something like “Look, I’m pro open models, but if you’re seeing what I’m seeing, it’s an onslaught out there due to [XYZ Chinese open-weight model] and we need to act.”
This perspective flies in the face of public information, where to date closed models have been documented as the cause of most existing cyber attacks. As someone who tries to make grounded predictions, the evidence of numerous attacks from OpenAI models is the only data I have on the shape of cyber risks (or, you can broaden the scope to include all of FelonyBench). There are a few possible explanations, and it’ll take years to get to the true answer:
* Maybe open model weights and closed model APIs (with some safe guards) are both far closer to being easy to mis-use, rather than API models being closer to safe. The trope "Open Dangerous, Closed Safe" may be closer to "Open Unsafe, Closed Unsafe."
* Maybe there are far fewer bad actors who are willing to use AI models for “loud” cyber attacks that target crucial infrastructure in the US or powerful and underprepared institutions. Closed models have stronger capabilities and stronger safeguards (in theory), but the stronger capabilities part could matter more in net harm if the safeguards on both are porous.
* I have a lot more to learn about how the cybersecurity ecosystem works, so I won’t support this full-heartedly as one of my current recommendations, but I think it’s at least a reasonable argument that open weight models as a diffusion tool for cyber defense could be the best tool we have to prevent harm over the next few years. There are many domains, e.g. sensitive government agencies, where open-weight models are the only tools that can be deployed in the near-term on air-gapped networks.
Lots of this situation seems like the messy reality being hard to pin down, where the logical limits are clearer. I may agree with the simple reality that closed models are far safer in the limit, as a technical tool with more layers of protection, but they may actually be causing more harm in the near term because of how accessible model APIs are. Still, much of the impact of the tools comes down to how they’re used and controlled. A duopoly on such a crucial tool may be the defining, risky part. This is the debate we’re having, and over time, as intelligence diffuses, many things may change.
These together make me come to the conclusion that if you think the latest open-weight models need to be banned to slow the diffusion of cyber risks, you probably also need to make public-facing APIs for the frontier closed-models illegal. The current stack of safeguards on closed models is stronger than open-weight models, but far from perfect. It is very likely that cyber capabilities of closed models increase much faster than guardrail performance, and a world where open models are banned while closed models continue to progress would be increasing the offense-defense cyber gap. It will take meaningful time to build mitigations that allow defenders to use strong AI models on their private infrastructure if we remove access to strong open-weight models.
Explaining China’s AI risk posture
China cares about AI safety. They have come to this discourse in a complete, endogenous manner relating to Chinese culture and power structures. There are some big picture pieces of this puzzle that reflect in other ways, such as Chinese society’s techno-optimism that extends into AI and the Chinese government’s complete focus on political stability. These things do, of course, interface with emerging AI risks like cybersecurity.
They are in their own AI risk dynamic, which hasn’t risen to the prominence of the political dance between the White House and the frontier labs which we have followed in the U.S. for a few months. My understanding is that the Chinese companies have to register every major model release with the Chinese government. This includes evaluations, which originated around information control for banned government information. It is unclear if this framework has expanded meaningfully into any risks like cyber or bio. The Chinese government is very decentralized and information from the labs needs to go through existing structures to make it to the top.
At the same time, there is a much stronger air of social risk in China, where leading AI researchers aren’t allowed to leave the country and the industry is closing off to foreign investment. On balance I would guess the personal risks facing people by unleashing any domestic harms would be much higher than in the U.S., where the worst case is that your company gets deleted.
Overall, the political oversight seems much earlier than in the U.S. The Western AI companies’ core principle is close to “the best way to stop a bad guy with AI is to be a good guy with AI.” In China, these companies are much more practical about building a wonderful tool, and in many cases building a tool that complements their existing businesses.
I do think that the companies consider the global implications of their work. These labs also clearly are incentivized, and often pushed via the government (at least in public messaging) to compete as much as they can. Running comprehensive safety evaluations on a frontier model like Kimi K3 could cost tens of millions of dollars in compute. These labs would much rather leave that for training.
The correct debate is “what is the correct minimum amount of compute a lab should spend on safety testing before releasing each model?” There’s surely a case to be made that it’s more than the Chinese labs do, or at least they should be more transparent on what they do, but I would be hard pressed to agree if you said the minimum amount of compute would match what Anthropic or OpenAI does. It is not clear that, for all the effort Anthropic and OpenAI make on creating an institution that prioritizes understanding risks, they put it before business value and economic success in their priority stack. This “hands off the wheel” vibe from incidents like the HuggingFace—OpenAI incident was one of my lasting takeaways. It’s exemplified in the Hacktron hacking of OpenAI — it’s hard to be the world’s trust cyber partner if your own house is teeming with leaks. I trust many of the individuals at the labs to work hard to ensure safety, but I’m not trustworthy of the institutions overall.
Open-weight Mythos in April would’ve been fine?
When Claude Mythos was announced, it was previewed as if it was a new class of cyber weapon, where if it ended up in the wrong hands it would’ve caused mass societal destabilization.
It seems like this was wrong.
By all measures, GLM-5.3 is the model that crosses that threshold of capability, and there’s little public evidence that much has changed, and we’re over a month out of the model weight release.
In fact, I would go further. If Claude Mythos was accidentally released as open-weight, it seems like the world would have been more or less fine. Yes, there would be a clear increase in cybersecurity incidents and it would be bad for society if the model leaked, but it would be a scenario that looks more like an acceleration than a step change in risk.
The leading proponents of this new wave of open-weight fear mongering have effectively been making a falsifiable prediction — that the current open-weight models are going to cause substantial, not seen before AI harms by crippling our cyber infrastructure.
Based on all the evidence I have, which I’ve unpacked above, they’re set up to be wrong. At least now, after so many years of debating open weight risks, we will start to get some real answers.
Thanks to Rohit Krishnan and Joshua Saxe for some feedback on this post.


This is a public episode. If you'd like to discuss this with other subscribers or get access to bonus episodes, visit www.interconnects.ai/subscribe

This episode is with Jean-Stanislas “JS” Denain of Epoch AI, who leads their Insights Team and is one of the people I find myself debating the state and trajectory of AI with more and more. We’ve had follow-on discussions of many of my favorite recent posts online and/or in private, so I wanted to dig into the nuance in a public episode.
A big takeaway of this podcast is how JS and I both have so much uncertainty with exactly where we are heading, and this was our best effort at stating our observations today.
Chapters / topics include:
* 00:00 Predictions for RSI
* 18:15 The role of robotics in an AI acceleration
* 24:20 How far behind are Chinese models?
* 27:39 Does distillation explain the gap?
* 40:58 What Chinese job postings reveal about their labs
* 48:13 Are open or closed models safer?
* 58:10 How Epoch AI ticks
* 1:00:55 What a frontier post-training recipe looks like
Enjoy!
More from JS: Epoch AI profile and writing, X, LinkedIn
Listen on Apple Podcasts, Spotify, and where ever you get your podcasts. For other Interconnects interviews, go here.
Transcript
00:00:00 Nathan Lambert: I’m here with JS Denain, who is a senior researcher at Epoch AI. He leads the insights team. He is one of the people who I feel like I get the best feedback on my writing from, whether it’s from US-China AI capabilities, now RSI. And I just wanted to open this discussion and honestly go deeper with him, trying to understand how he thinks about these various things. And I think you have a very useful, moderate point of view, which I feel like you’re probably a step further into what would be called faster scenarios for AI progress. But let’s get into this, and it’s like, what measurements do you think OpenAI and Anthropic are seeing when we get all these proclamations on RSI happening very imminently?
00:00:47 JS Denain: Yeah. I think, so there’s the measurements they’ve published, right? So, OpenAI and Anthropic both had blog posts, I mean, Anthropic two at least, on the effect AI has on accelerating AI progress. I think at least the things they publish, I don’t think are super strong evidence of imminent self-sustaining acceleration AI capabilities, or full automation of the job of AI researcher. But I think the kinds of things we see are, I think probably the most striking thing I saw in the OpenAI blog post was increasing usage of AI systems in model deployment, like the increase in spending on Codex that we saw. And it’s kind of unclear how exactly to interpret this, because maybe it’s a measurement artifact where they’re only looking at Codex, but in fact, there was a bunch of ChatGPT usage before from the researchers. But overall, that plot, for example, just shows a 2X a month increase in Codex spending by researchers, and that does seem to me to be some evidence of they’re getting a lot of value out of this probably. I don’t think this is strong evidence that in six months we have a software intelligence explosion.
00:01:57 Nathan Lambert: Do you think this is the same? So, what is the information they have internally relative to what we have? And this is obviously hypothetical. We don’t have this internal information. Because I get the sense that a lot of people are more scared in their updates from the labs than the information we have. And I try to take this very seriously of, what will they be seeing that is making the acceleration of risk comments go faster, and how much of this is material evidence versus how cultures evolve over time? And I’m much more interested in evidence.
00:02:29 JS Denain: Yeah. So two things. I think, first of all, I guess I don’t think, I don’t know, right? I don’t have full information here. I don’t currently think that either there’s some specific thing that people at OpenAI or Anthropic are seeing right now that we don’t have access to that warrants being way more freaked out about this. I also don’t think that... I think the public evidence we have right now, more general on AI progress and just a priori case for this being an important dynamic, I think is enough. I think to care about this particular dynamic of AI accelerating AI progress, that being a big deal and worth tracking. And then it’s kind of unclear what the urgency is of when the feedback loop really kicks in. So, basically on the what is there on the inside that people have access to, I could give examples of kinds of metrics, right, they could be looking at. It’s plausible that we have access to the capabilities of AI systems, but internal teams have their KPIs, and maybe they’re seeing compute multipliers in the pre-training team or other kinds of metrics that people are tracking going crazy. And then the combination of this plus some intuitions of how the different outputs of different teams combine yields a prediction on the trend in actual performance of the end AI systems. So that could be an early warning sign. It’s unclear to me that the recent discourse we’ve seen is evidence of things going crazy on those metrics.
00:04:09 Nathan Lambert: And how do you think of the link between RSI and existential risk? So I would posit that you agree. I think that there are very real risks of AI, and I’m curious on how you think these, what I would describe as very, very early measurements change anything on the scope of risk. Because I don’t think if you had asked people six months ago, it would be as immediate to x-risk among people are very reasonable. I think there’s more people that are reasonable talking about x-risk again, which was a little surprising to me.
00:04:43 JS Denain: Yeah. So, okay, my sense is something like... So personally, I feel very uncertain about this, but I do feel, yeah, basically bought into there’s, I know Evan Hubinger was like, at least 10% of x-risk within I don’t know what timeframe. I think I’m like, yeah, I know, and this seems pretty reasonable over a decade-long timeframe. I just feel extremely uncertain about it, but I’m definitely very worried about this. Now, why am I worried about this, and where do I think the disagreements come from? And then how do I relate this to the early sense of RSI? My sense, I’m kind of a capabilities theory of everything person. I think, and I think some people disagree here, but I really think that principal component of disagreement between everyone is how huge do the capabilities get, how soon, of AI systems? And I sort of agree that there’s other factors that come in play for how big your economic growth gets, also depend on the diffusion you get. And you could possibly you could think that capabilities are going to get crazy, but the AI system’s going to be just aligned and benign and stuff, and so there’s no huge risk. But my sense is concretely, when I look at the main kinds of disagreements between people, most of the people who I see who are very skeptical of those most extreme scenarios... I think just expect capabilities to not be as huge or as I think folks who are—
00:06:18 Nathan Lambert: What does being a capabilities maximalist look like in a few years? Because I think I’m probably on the skeptical side, so please continue.
00:06:28 JS Denain: I think it looks, for example, something like the AI 2027 scenario, right? I think it looks like the mechanism for this is AI is automating the AI research process, I think, and that’s a reason to pay attention to it. But in terms of effect on the real world, I think it’s like massive progress on robotics. I think a huge industrial explosion, AI systems are just managing factories. You have this kind of self-sustaining economy that just is able to make a large scientific progress much faster than you would have expected. And so I think concretely, the kinds of disagreements I would expect are on, yeah, if you have AI systems that are both very intelligent in the book smart sense, but also have been trained to have more affordances and use them astutely, have been trained to kind of manage projects in efficient ways and stuff like that. How big are the real-world bottlenecks to making very fast R&D progress or getting hard power over humans?
00:07:26 Nathan Lambert: Yeah. Can we go into some of these in detail? Did you listen to the Dwarkesh podcast with Charlie, Beren, and John?
00:07:32 JS Denain: Yes. Yeah.
00:07:33 Nathan Lambert: Yeah, because they had at the end, they had this section on various capability levels and timelines for getting them. And I feel like I agreed with most... I was very in agreement on the distribution they had up to this, and then was surprised by the timelines. And one of them was the 10X productivity for the AI researchers. And I think Beren and John were faster than I think. And my kind of statement is that I think the cycle from of having an idea and doing the experimentation to test it, I agree will be 10X faster very soon. But I don’t necessarily agree that I would say that AI researchers will be 10X more productive in net, which I would describe as the pace of the field’s complete understanding. And understanding is a different axis from just continuing to scale models. I think that’s one of my core confusions on the AI research side. So I’m just kind of curious how you think about this type of thing and how you might specify a 10X improvement in AI research into subcategories.
00:08:37 JS Denain: Yeah. So maybe there’s a scale you could have here, which is the end thing that you might care about is how much faster is AI research overall? Or how much faster is Anthropic’s overall output? And then Anthropic as a company is producing some things, and it’s doing in one year what it would have taken it 10 years to do. And that’s pretty different from individual researcher productivities, where I think you could... So if most of what AI researchers right now are doing is this loop that you were describing, then it’s possible that you get a 10X productivity improvement for the median researcher based on the tasks they’re doing right now. But first of all, that doesn’t mean you get a 10X productivity improvement for all researchers. And even if you did, right, there’s other bottlenecks that hit such that that needn’t convert into a 10X productivity improvement for Anthropic as a whole, right? You could have all the researchers be 10X more productive, but because of compute or other things, the company itself still doesn’t move as fast.
00:09:38 Nathan Lambert: I think an analogy I have is, I think that junior PhD students will be 10X as productive, but from the advisor’s perspective, their research agenda will not proceed 10X as fast. And it’s like to the extent that that contributes to Anthropic’s progress is another hard thing to jump on AI capabilities, where I think that listening to the Noam podcast. This is me, I’m just thinking, was thinking about this when writing about this, is there’s such an amount of inference compute coming online, and I think Dwarkesh highlights this very well, that it’s very hard for me to disambiguate massive speed-up in AI research from the fact that we have way more compute and can now much more effectively spend it on related problems. And I think we’re going to get all of this at once.
00:10:27 JS Denain: Yeah. So definitely I think this question of... So when you look at the OpenAI blog post they had on their acceleration, right, they do point out huge surge in Codex spending from researchers. Interestingly, actually, Codex spending in other parts of the company kind of had a huge surge in the spring and then kind of plateaued in the summer. But for researchers or the data team or engineers, it keeps growing, even accelerates sometimes. And so they point this out, and then they try to look at where there was an increase, which kinds of tasks had an increase in usage. And a lot of them are engineering tasks. There’s an increase in troubleshooting tasks. But they definitely point out that for a lot of the high-level strategic decision-making, they both anecdotally and also when they look at sessions, don’t seem to find a huge uplift in making better compute allocation decisions or deciding on research directions. And so to me, that’s pretty similar to the PI case. And so I think there’s a first question, which is, how much of an improvement... Imagine you just didn’t get that much AI uplift on that component of AI research, but the rest of AI research really went crazy. Then how much faster do things go? And the separate question is, I don’t know, how hard is this strategic decision-making? Can’t you just have a bit longer horizon RL? Or maybe you can bet on decent transfer from other fields where those kind of decisions are important, and then you do actually get that kind of uplift at the end.
00:11:59 Nathan Lambert: I think part of my intuition is that science will look so fundamentally different that it’s almost hard to put a number on it. And it’s the pre and post-AI era, and we’re just in the rapid transition to what is a new method, new way of doing science, because I think all the conferences are ready to burn down and struggle through the next few years. I hope that they collectively figure out a way to like add AI oversight into reviewing and things that are scalable, because they have so many slop papers that they need this type of gate. So I don’t really know. And I think on the capability side, I’m like, what an AI progress is like clearly translated into new capabilities. There are two things. One is like pre-training scaling laws. Our loss is proportional to like an exponential increase in compute. And on the research side, what we are doing is we’re shifting the line so that it has a better offset and potentially a better slope. And then on the other side is the RL environments, and I think the RL environments we’re building now are very comparable to valuable work. So I expect the AI models to get much, much better at like knowledge work that can be scoped. But I don’t know if we have a good process for like churning out an order of magnitude harder environments, which would be closer to like cure cancer, solve these open math problems. I think math is a case that we could talk about. But that’s kind of like, I think there are unknowns on scaling the like raw intelligence more than efficiency. So I’m very optimistic in scaling efficiency.
00:13:29 JS Denain: Yeah. I agree that like in some sense, right, like inference efficiency is like a very like hill-climbing task. It’s like pretty well-scoped. And yeah, so I mean, it’s already something that has very, very fast trends, but I could imagine those trends. Yeah, I imagine those trends will go even faster. It seems really like the kind of... I mean, indeed, we have evidence from OpenAI, right? Like, saving on like serving costs, et cetera, through like building better kernels and like if you’re new to this. They don’t give that many details, but that’s already happening. One thing I’m curious about actually in your case is like, so here’s one way of defining like Anthropic, for example, like accelerates overall, which is you could look at the like ECI trend in like, the ECI of the best Anthropic quality point in time. And you can like look at the current trend line and you can ask the question, like over the next year, will we see a 5X acceleration? Like, will the slope be like 5X larger than it was, say, in like 2025? And I think it’s like pretty likely we see like a huge increase in this because it is like kind of a legible like KPI that like, I mean, it’s not literally KPI, but it is a KPI that like the company is aiming for, modulo like safety considerations, et cetera. And I’m curious about whether you think it’s very unlikely we get this or whether it’s more like we might get this, but like if we do get this, it’s mostly that like ECI has been Goodharted as a metric and like the implications for like real-world capabilities aren’t that huge.
00:15:03 Nathan Lambert: I wouldn’t be surprised if we got this, but I think that it’s going to be like we’re on a slope and then we could get an uptick in slope of hill climbing, but then we like saturate what we know how to hill climb and then it goes to be lower. So it’s like all the things that we could measure I think are going to be getting pulled up very quickly by being measurable. And then we’re in the domain of like, how do we measure it? Because I think, like I talk to people that are trying... Like evals are so expensive to build now, and I do think that evaluations are going to be like how good and efficient it is at coding, how good and efficient it is at ML research, how good and efficient it is at knowledge work. But I don’t know how to like... Building those evals all seems tractable but hard. But then like how to make a breakthrough in fundamental chemistry seems really, really, really hard to measure. I was going to draw on like maybe frontier math as an example, but I think math is such an exception as like one of the most jagged pieces of AI. I think especially like open problems in mathematics are like the perfect target for rapidly improving AI because it’s like a falsifiable thing. And it’s like if we were to, say, see that in something that’s much more open-ended, I think I would update a lot. Or if the labs were like to come out and say, “Using Claude, we have a very, very big change in what our architecture of AI is,” to like there’s the famous like Jonathan Frankle–Sasha Rush bet, and it’s like, and the transformer is no longer like the lineage we are on. I think any of those things being very AI-driven would make me update a lot. But seeing more math, like I think I was surprised by the pace of math, but like not astonished.
00:16:49 JS Denain: That’s interesting to me. I definitely agree with this general sense. So like I think METR folks looking at like your nanoGPT results from autoresearch-style things compared to like what the humans were doing, it does seem like there’s this, I think Tom Cunningham calls this like the apple-picking model where AI is like much more efficient at the start, but then doesn’t actually like uncover as many new ideas. And you see this in this kind of optimizer research. Yeah, I mean, one thing I will say on this like verifiability point is like, I think a pretty common trend is like you’ll have some task that’s like not verifiable and you’re like, maybe you struggle to build an environment for it. But actually it’s like it’s a subset of a larger task that is itself like verifiable. It’s just like longer range. An example of this is like there are many like hard to verify tasks out of like companies. But in some sense, like revenue or like other like metrics, like valuations are like pretty legible. So that’s like one thing. I mean, the other thing is like expect things to be pretty jagged. But I think a big question is like, yeah, can you get, for a crazy world, can you get like a large, like self-sustaining industrial kind of explosion?
00:18:05 Nathan Lambert: Yeah. Well, can we talk about robotics and industry? Because I have a background in physical robots and like I think the robotics trends will look much closer to self-driving cars than LLMs. And I think that a lot of the singularity arguments are based on robotics being able to look much closer to LLMs than the self-driving cars roll out. So, why would you disagree? Or, what is the argument that mass industrialization and robotic expansion is doable? Because my prior is so suspicious that I maybe even haven’t given it enough justice, but I’m very suspicious of this being a viability, and mostly in terms of being a relative timeline. I think it could happen over decades, but I don’t think it’s a two to five-year concern.
00:19:01 JS Denain: Two to five years seems rough, to be clear. I think I just don’t know as much about robotics here. I think is your main concern just reliability is really rough to get right in the same way that it was just a long tail of scenarios where things are, or was it more like a real-world thing where there’s much more regulation that comes up?
00:19:21 Nathan Lambert: I think it’s building things is hard. I think that, let’s see. I’ll talk us through some of this. For example, I know places like Amazon, they build new factories to be robotic first, and those are more effective for them. And what this would take then is building a robotics factory. In the case of the US, it’s like you have to build a robotics factory that builds robots very efficiently in the US and then transition that or make a new one that is built by said robots. And I think the re-industrialization of the US is something that I think is like, there’s a lot of reasons why it is not happening. I think potentially in China it is more likely, but I also just haven’t been convinced by AI results on visual and action models that they’re progressing fast enough. I think I’ve had discussions with people in the multimodal field have described the techniques as being much more rudimentary and less developed than the text language models, and in need of much more fundamental innovation, where something like code plus RL is a very natural match that the hill climbing is very predictable. So—
00:20:35 JS Denain: So, it seems like there’s two things. There’s the trends in robot capabilities is not as fast as you would expect for LLMs, and also even if robot capabilities were huge, it takes a while to build factories. I think I’m sort of skeptical of the second one. I’m just like, if robot capabilities are sufficient, the total addressable market for this is massive. And if you look at data centers in the US, there has been extremely fast build-out. If you had robots that were just literally able to substitute for blue-collar human workers, I feel like the financial incentives would be huge. And I think a lot of the reason why in some cases, the US doesn’t have huge build-out is just a demand thing. I think that’s the case for power, for example. So I think in that case, I’m just like, yeah, I feel like we just, what is the Tyler Cowen thing? Don’t underestimate the elasticity of supply is the main thing I would point to. I think on the capabilities front, I’m more uncertain. In particular, I’m sort of still confused and haven’t really looked into the, how much do you get directly actually from LLMs and foundation models for robotic capabilities? In particular, the other uncertainty I have is, it’s not clear to me that extremely fine-grained, extremely dexterous capabilities are the main thing you need for massive industrial explosions. And so, this longer tail of the hardest part of robotics, I’m not sure if that’s the biggest blocker for massive industrial explosion. Overall, robotics is something I have less expertise in. I’m interested in how many of the scenarios for doom ultimately kind of route through hard power acquired through robotics. I think part of my uncertainty also comes from, is it plausible to me that the minimum abilities that you need to acquire a lot of hard power and pose pretty catastrophic possibly extinction risks is more like, have access to nuclear codes or something like that? I don’t feel like I have great thoughts on this. I’m interested in more threat modeling, but I think that’s part of the thing is, what are the capabilities trends is something that people have disagreements about, and so what’s the minimum capability that’s necessary to cause these extinction-level harms, or harms that are sufficiently catastrophic, they just permanently alter the human trajectory?
00:22:46 Nathan Lambert: Yeah. The last point I would make on—
00:22:47 JS Denain: I think that’s the kind of questions I want to see a bit more thinking on, but yeah.
00:22:50 Nathan Lambert: The last point I would make on robotics is that I think the robots will be very good in constrained and repetitive environments, like manufacturing robots, and I think much longer until there are robots walking around the street cohabitating with humans. And if I were to go deep on this, I would want studies and discussions with people that are building multiple different data centers to how much variety is in their job versus how much of it is you take box off of truck and you put box in location. And I don’t have any good signal on how clearly repetitive that is now versus more human dexterous and ingenuity in problem-solving.
00:23:34 JS Denain: Yeah. Although also currently, the environments have been designed around humans who are pretty flexible in those ways and have other constraints. You could imagine designing factories to be robot first is a thing that I think you’re mentioning Amazon, right? Sort of does that more now. And so you could also... Yeah, I think that’s the kind of stuff that jaggedness would get you, which is you might just have massive accelerations, including in the physical world of some industries, even if capabilities for fully being as dexterous or flexible as a human might not be there. Mostly, yeah. I think mostly, yeah, robot capabilities seem very important to track to me. We had some piece about this at Epoch, but we don’t claim robotics expertise.
00:24:21 Nathan Lambert: Yeah. I agree. I think we could shift to another capabilities topic, which is how far behind do you think the top Chinese labs are of OpenAI and Anthropic? And you can define how you want to measure it, whether it’s like public models or like internal models. I think doing both is actually pretty interesting to think about. Like, how would you describe the gap? Like, choose your... This is one of the few things I’ll push you for a number on.
00:24:47 JS Denain: Yeah. I think I would go with like, I don’t know, six to eight months or something, roughly.
00:24:53 Nathan Lambert: From public to public?
00:24:56 JS Denain: Yeah. Like, release date to release dates. I don’t have a great catch numbers on like how long the internal to public deployment. Yeah, I’m sorry if it increases a bit if you’re counting when the model was built, because I would expect the delay to be larger for OpenAI and Anthropic than it is for Chinese labs. But yeah, I don’t know, just looking at ECI and there’s a few different methods you can do there, and there’s a good amount of noise between. Those methods are kind of reasonable, and my sense is they give you something on the order of like six to eight months-ish.
00:25:28 Nathan Lambert: I would say that like Kimi K3 and GLM 5.2 are closer to like two to three or four. So do you think those are anomalies down to measurement or overfitting? So I have this discussion a lot with Florian. And Florian, who helps me with Interconnects, is constantly badgering me down. And I think I intuitively have landed something closer to you. And I think those two models, and in particular Artificial Analysis, were very close. I think Kimi might have been even under two in the Artificial Analysis Index at the time. And I’m just putting this out there, and I go back and forth all the time on it.
00:26:12 JS Denain: So I don’t remember the especially most up-to-date details on the Artificial Analysis Index. My sense is that it might understate the gap for curation reasons or something, but I don’t want to be too confident there because also they update methodology and stuff like that. I think even in ECI, though, there are some cases where it was more like four months. Yeah, I don’t know. Four to eight months seems reasonable to me. I think like two months, I would be like, “Nah, that seems like a bit more overfitting-y.” We did internally look into a bit how much overfitting explains the gap. Like, just doing the kind of like, what’s the ECI lag analysis for, if you just take an ECI based on private benchmarks versus not, or private benchmarks plus results were from models that were from benchmarks that were published after a model was released or something like that, where there’s no risk of contamination. I think overall, that effect was basically not statistically significant, which was interesting. I think if you did rely just results in model cards as opposed to the results being put in ECI, we probably get some contamination or overfitting effects. I still think there’s some amount of, yeah, something like ECI might underestimate the gap just because I do think OpenAI and Anthropic are probably like... There’s probably other capabilities just would appear less in benchmarks and where there’s been more optimization or serving a broader set of users. But yeah, I don’t know. That’s my overall number.
00:27:39 Nathan Lambert: If we were to ban distillation effectively, not even just ban, but if distillation were effectively be stopped, where do you think the number would be in six to 12 months? I think without RSI being super crazy. I think RSI going super crazy, the labs pull ahead by a lot more.
00:28:01 JS Denain: Yeah. On current trends, I think I’ve actually updated towards distillation is actually a really big factor. We can talk about the different factors. And so, okay, so currently if I’m saying six months gap, then in six months, it’s probably not literally 12 months, right? So, my guess is, yeah, you are at like eight or nine, something like that. You go from like six to nine maybe.
00:28:31 Nathan Lambert: Why have you updated on distillation being effective?
00:28:35 JS Denain: Yeah. So I think it’s like, yeah, there’s two reasons. I think, a lame reason is, I don’t know, more people seem to be saying it’s this.
00:28:45 Nathan Lambert: They have been. I’m surprised by it.
00:28:47 JS Denain: Yeah. The Stolen Thoughts paper did suggest it was actually relatively easy to get the stuff. Yeah, random gossip. I think also a big one is, we can talk about this, thinking about the other explanations for the lag and them not seeming as compelling as when I first thought of them. I do think the Claude routers thing also just seems like a pretty big deal. And initially when I thought of distillation, I hadn’t considered that. But I do think Claude routers giving the kind of right prompt distribution for realistic usages, use cases and stuff like that just seems quite useful.
00:29:26 Nathan Lambert: But it’s also like these companies have their own usage at this point. And it’s also like we have the benchmarks. So the benchmark distribution we already have. So I don’t necessarily think distillation is helping with... I think the routers could be very helpful, but I was confused by that prompt distribution thing because once you have the benchmark distribution, you just make similar examples or find similar examples.
00:29:50 JS Denain: Yeah, so I agree. So I think the Claude routers just give you a bunch of useful data to train on, and that will generally improve capabilities. I think that’s one explanation. I agree that I think giving you the right prompt distribution is, I think, going to be useful for real-world capabilities. I agree that purely if I’m discussing this ECI lag or something, then yeah, you can just use the prompt distribution for benchmarks. And so I think it’s not going to be that good of an explanation there. Yeah. I think just... Yeah. Also, so as an example, right, people saying that mid-training is a really important thing or something. I think actually in that conversation, right, Beren was like, “Mid-training is actually getting you 80% of the way there.” And more claims of this form and generally of RL being very useful but not doing that much of the exploration work, I think is also evidence that doing SFT on language trajectories is really useful.
00:30:48 Nathan Lambert: Yeah. I want to go through—
00:30:50 JS Denain: I think he mentioned on a post on this is, it’s a good initialization, but I guess I’m updated that this initialization is really, really important. And yeah.
00:30:59 Nathan Lambert: Yeah, because I’m still on the side that I think doing RL well and doing RL faster so you can go bigger is the way people are getting capabilities. But I have been hearing more about this repeated... The framework would be it’s a very repeated cycle between mid-training SFT and RL, and then your peak RL helps you feed into mid-training and less of a very big RL run, which I never thought... The RL runs are a week probably. I don’t think they’re insane, especially like Zhipu or Kimi. And that’s... So I could see this, and I was like, “I don’t really know.” I generally thought that because the models are getting so useful, I don’t know how... It just seems like the scale of distillation would need to be so big to really do that for mid-training. And the counterargument is Kimi and GLM 5.3 are also strong models, where it’s like, if the gap is that small, it just doesn’t make sense to me that the help would be so big. That’s why I’m still on the not convinced, but looking for more evidence. And then some of the other re... I have this blog post that I wrote in front of me. If you want to talk about distillation more, you can get that comment in before I switch to other topics.
00:32:21 JS Denain: I guess I’m pretty interested in talking about the alternative explanations or something for... I think there’s this general phenomenon of Chinese labs have way less capital and particularly way less compute than US labs. And that delay is huge. And then this, whether it’s four months or eight months, it’s a much shorter delay in capabilities than in capital. And so, this requires some explanation.
00:32:48 Nathan Lambert: Yeah. Do we think the Chinese labs are still releasing meaningfully faster from time that RL is done to public gets the API and evaluation scores? In the past, I thought that the time to release was much faster, and I think the labs are releasing intermediate versions faster now, so I don’t know if that explains as much of it. But I would say a year ago, I would put a lot more to Chinese models get model out within days, American labs could take months, and that would artificially squeeze the gap very substantially.
00:33:26 JS Denain: Why would it squeeze the gap that much?
00:33:28 Nathan Lambert: Because you have the trajectory of capabilities, and higher one is OpenAI and Anthropic, and they stop training here in time, and then the Chinese labs are here. But then it’s just like the model is stagnant before it gets released.
00:33:44 JS Denain: Yeah, I think this depends on the method that... This both depends on the method that you use for computing the lag or something, right? So my sense, I think when I was saying four to eight months, I think a lot of that uncertainty interval also comes from, are you measuring the method by looking forward or backward or something? Or how are you resolving the uncertainty? Are you taking this kind of staircase or this kind of staircase, or interpolating or something like that? So I think that’s kind of still accounted for in the uncertainty. So my guess is that’s not a huge... Or that’s still, even with this, I think there’s still a large effect to explain. And I think, yeah, these are other potential explanations, right? So one is maybe there’s a big delay in compute, but in labor or potentially data, there’s less of a delay, and those are important factors. And so even if you’re two years behind in compute, if you’re six months behind in data and in fact ahead in number of researchers or something, or not that far behind in number of researchers, maybe that helps catch up, and that’s not even a spillover effect, right? That’s just a reason. Yeah, there’s distillation. Other explanations people have are just ideas might leak, and I don’t suspect that’s a huge effect. People can play with a model, and through playing with the model, they kind of infer maybe what it was trained on or what’s useful to push on is another explanation. Those things are not quite like distillation, but using Claude as your reward model or using Claude to clean data or something, maybe have some spillovers.
00:35:23 Nathan Lambert: Let’s see. I’m trying to quantify some. I would say that I think the Chinese labs care about benchmarks a bit more for financial... Some of them are public companies, and showing close benchmarks helps them a lot. So I do think they care about it more. I don’t know if that’s going to give you a month or two. I don’t know what are you going to give back, like a month or two. I think there’s a good chance that the Chinese labs are better at organizing talent on just doing really mundane hill-climbing data work. I don’t think that’s a huge effect, but it’s just like they have a ton of talent, and culturally through the way that... I think that there’s a good chance that it’s just more grind. They might actually grind more effectively than the American labs, which is... I don’t know how. I wouldn’t put a lot to this because I think it’s fairly close, but I think that’s a chance. But that’s a very marginal... That’s not a gigantic lead cause. I would put more of it to compute difference than to distillation. But maybe distillation is very related as a compute difference because it’s a way to turn... It is a definition of way to turn money into very high-quality data, which is something you would otherwise need compute for.
00:36:35 JS Denain: Yeah. Another theory that I’ve vetted about, and I’m not sure how big of a deal it is, is there’s this data market in the US, and maybe one thing that happens is the best RL environments or evals, it kind of takes a lot of compute actually to figure out which ones they are. And so maybe there’s kind of a collaboration between data providers and AI labs to actually test and figure out what RL environment really worked. And then maybe that data provider, once they’ve done this iteration, which implied a lot of R&D compute spending from a frontier lab, then they’ll build a bunch of similar RL environments because they’ve learned the lesson, and then they’ll sell them with some delay, but still sell them to other people, including in China.
00:37:21 Nathan Lambert: I’ve heard this from people.
00:37:22 JS Denain: And so there’s kind of this implicit R&D compute that was spent and that it gets saved. I’m not sure how big of a deal that is.
00:37:29 Nathan Lambert: I’ve heard this multiple times, including from people in China that have... This is like multi-hop type of rumor that I’ve heard a few times is like, we just have to wait a certain amount of time and then we buy the RL environments that Anthropic bought for a 10th of the price. And I think this could contribute a lot to capital efficiency, but also as somebody who buys into human factors being very important in model progress, which is just like competition, I think the analog to the competition that OpenAI and Anthropic feel right now is proof of concept as a way to make something way easier. And I do think the OpenAIs and Anthropics of the world are much more likely to innovate in open-ended things like Navier-Stokes, multi-agent mega-scaling than the Chinese labs. And having talked to many of the labs, I don’t think they would contest this, but they probably won’t put it on the record. But they’re just like, trying to keep up is so much easier.
00:38:27 JS Denain: Yeah. So that’s more like the... Yeah, so the way I describe this was like four-minute mile style effects of like, you show that something is possible at all and then people have the conviction to go down that route, don’t waste a ton of resources exploring a bunch of other things, is the thing you’re pointing at here.
00:38:43 Nathan Lambert: Yeah. And I think this—
00:38:44 JS Denain: I guess I’m looking for examples where you think this... What are examples? Because for example, reasoning models is not this, right? Like, DeepSeek Math or whatever came way before o1. Yeah, I’m kind of curious if... Yeah, I agree this seems kind of plausible, and I’m not sure I can come up with examples of big innovations that a frontier lab has—
00:39:04 Nathan Lambert: I think it’s more in org structure. So it’s like there’s R&D and modeling compute at the labs, which I think kind of get lumped together. And realistically, make-model-better compute of the next generation model versus the two or three generations down the line is very different. And I would think that the Chinese labs are just spending on a shorter time horizon. And then if there’s a major innovation in architecture or something that gets bubbled around the US ecosystem, I would assume the Chinese labs will figure out as well. I don’t think that an architecture innovation is kept very well between Anthropic, OpenAI, Meta, and Google. I think that these are all leaked very quickly through personnel turnover.
00:39:50 JS Denain: I see. So you think that actually has a big effect. So basically, I think it seems like you are just like, you think that with the other explanations, you can just get pretty far, such that you don’t really need distillation to explain a large fraction of the gap.
00:40:03 Nathan Lambert: Yeah. So, I think without distillation, the gap would be fairly similar. It’s like also just building these models, there’s so much low-hanging fruit, and I don’t think distillation plugs that much of the low-hanging fruit that you are doing. It’s very unclear. It’s like once you establish your reasoning trace as being... This isn’t proven, but I think in mid-training and SFT, you need to have a pretty distinctive style in your reasoning trace to kind of stack it and have a defined reasoning strategy for the model. And Kimi and GLM have this, and I think they could modify it from where they are. And it’s just like, how does that compound over time if Anthropic and OpenAI change way faster, maybe it matters more. I don’t know. Doesn’t sound like we’re getting somewhere. I did like the post you had on understanding Chinese job postings, which I thought was a very clever way to try to peek behind the curtain of the Chinese AI industry. So I don’t know if you have anything you thought was particularly fun about this. It’s like, it was so hard to understand the industry that is going on there from outside.
00:41:22 JS Denain: Yeah. So this is work by Cheryl Wu and I. I think it’s, as a source of evidence, it’s more like you can get interesting anecdotes or interesting facts. I think it’s not so much the kind of Epoch-y thing where you can get a trend line that you really follow really well. I think some job posting trends are good for this, but I think especially for China, it is a bit more like, “Oh, well, you can see they’re hiring in this region for data center roles, and it seems like that suggests that at least some of these labs are basically constructing their own data centers as opposed to renting compute from Alibaba or whatever.” So you get a few kind of nice facts like this. I think you also do understand a bit more what kinds of product strategies the different companies have and what they’re aiming for. So I think it’s pretty interesting for that. This post was now published in June, so things move fast and things may have changed. But yeah, I think there are interesting takeaways on company strategies, on how they—
00:42:31 Nathan Lambert: Can you say more about company strategies? Because I think that a lot has been cast on, say, like... The different company strategies in China. It’s like, what is DeepSeek’s strategy? I think MiniMax is one of the clear ones, and then Zhipu. And Zhipu has some on-premises deployment stuff, but at the high level, I think Zhipu can be much closer to OpenAI and Anthropic. But do you agree with this, or do you think any of them are more defined or have more interesting different things?
00:43:03 JS Denain: Yeah. I mean, one thing is just, I think we have this plot of how many job postings there are for B2B sales. As an example, it really does seem like Z.ai, like Zhipu, has a lot more of them than MiniMax or Moonshot. I think also, they have different strategies in terms of how much they want to expand internationally. I think MiniMax is a decent amount of that, more so than Z.ai, I think was the thing we found. I think there’s a few things like this. I think for DeepSeek, we didn’t see as much of that, for example.
00:43:40 Nathan Lambert: Having done this analysis, do you think you could hand an AI model your taxonomy and have it redo it every three months? Do you think this is now a thing that Epoch could almost automate?
00:43:53 JS Denain: So I think we do have some upcoming project on job postings. I think specifically for this kind of thing, I feel like the takeaways are kind of ad hoc or something. And so I think it relies a bit more on you have a bunch of this data, what actually seems interesting? And I feel pretty often that LLM’s assessment of what are the top five most interesting things is not that great. But one example of a thing where I think... So I actually have this really crappy vibe-coded job listings tracker, which looks a bit more like the quality’s better for an OpenAI Anthropic. And I think Epoch might have something on this in a bit. But one example where AI is pretty useful is just, I don’t know, you just want to reasonably classify jobs as are they basically research jobs or are they basically engineering jobs? Or maybe research engineering is actually hard, but are they research jobs or are they GTM jobs? And the structure of the teams are going to be not coherent across different companies, but you can use AI to automatically track this over time and have some coherent categories. So then you do get trends like, “Oh, it seems like there’s been a surge in hiring from this frontier AI lab, and it’s basically mostly been sales, or it’s been mostly hardware infrastructure.” I think that’s pretty cool, interesting, and automatable.
00:45:14 Nathan Lambert: Yeah. I think if you do this again, I’m interested in if you find things on data market expansion, which would be like your job is buy data. Because I’ve heard from many people that the Chinese data market is exploding, and I have poked various, whether it’s people I know at labs or people who I know follow Chinese industry closely. And it’s like, they’re like, “Yeah, but I can’t get anyone on the phone to know what this manifests as and what their budgets might be,” because Anthropic famously has billion-dollar budgets. And it’s just like I think it very quickly can become very important, like compute export control discussions stuff. By the end of the year, I suspect there will be some article talking about this and going deep reporting it. But from my perspective, getting that reporting information is near impossible.
00:46:05 JS Denain: Yeah. I think data is just really rough. I think for Epoch, data has been a tricky thing. It’s obviously an enormously important factor, but it’s harder to quantify or commoditize, and it’s also quite secretive. And so it’s like, I think a lot of the information is gossip. It’s hard to know how much to trust. My sense on Chinese, I think that article actually has something on this. Just it does seem like there’s a lot more in-housing in general by Chinese companies, and I think this also applies to data. And kind of relatedly, actually, there’s a lot of hiring for intern roles. I think if you go to the jobs listings pages for a lot of these companies, there’s specifically two tabs. They have summer internship tab or the internship tab and the normal hiring tab. And there’s a lot of, I think, hiring fairly junior people, and some of that might be for data purposes. But you did also see a surge in in-housing for data in the frontier AI companies. I’m not sure if this is still the case, but xAI was the only company that had this, but it was kind of nice because if you went to the careers page, there was actually the human data category, and you could just see which data roles they were hiring for. So there’s stuff to do on job postings on the data front as well, both xAI. I did this with Mercor and a few others previously. But I think it’s similarly, I think the most interesting things have been like, “Oh, well, that’s a crazy-ass role.” xAI is hiring for meme specialists or whatever, and it’s more ad hoc fun things than great trends, at least from what I’ve seen.
00:47:35 Nathan Lambert: Yeah. I think that this is not going to change, unfortunately. It seems very much like individual teams at labs have contacts at data companies, and all of this is done privately, and it’s not... I guess even tracking compute is fairly hard, but now data centers are a manifestation that is somewhat trackable. And NVIDIA is a public company, and that is what is done. If the data companies were public, it would probably be easier to tease some things apart.
00:48:13 JS Denain: Agree.
00:48:13 Nathan Lambert: Okay, we have another timely topic. How do you feel about frontier model safeguards? Given that in the last 24 hours, we learned that three people used public Claude models to hack OpenAI and get internal access, which is just crazy to me. Did you see this? It’s genuinely surprising to me that this is the leaky world we are in. At the same time, we are discussing RSI things much more seriously.
00:48:46 JS Denain: Yeah. I briefly saw this incident. I guess I’m not sure how much of an update it should be specifically on like model safeguards versus like you know security quality of the companies, or probably both. I think it’s a big question, right? Like, how good are the model safeguards? Seems like quite important, especially when people are talking about open models where it’s clearly open model safeguards are worse because there’s way more affordances that someone can have, but also open models are less powerful. And so just in terms of the you know misuse implications, it seems there’s just like slightly safeguarded, very powerful model versus like not at all safeguarded you know less powerful model. And I feel it was a priori kind of unclear to me, like which one is going to have the largest effect. Yeah, I don’t know. I think this is an interesting question. I think I feel also like people feel differently about this or something. It seems like some people feel pretty strongly that it’s hard to at least persistently do really bad things using the frontier models. But I’m like, yeah, there’s definitely clearly examples like this one, or really the Stolen Thoughts paper or something. It just seems like the safeguards weren’t good enough to prevent that from happening, even though there’s strong incentives for the companies to prevent it.
00:50:06 Nathan Lambert: Yeah, the Stolen Thoughts—
00:50:07 JS Denain: I’m kind of confused about this.
00:50:09 Nathan Lambert: Stolen Thoughts I put into like a serving issue, which is just like you were able to kind of jailbreak the API functionality to get the reasoning traces out in a reliable manner. Which I think the Chinese labs almost certainly had been doing for some time. And that potentially has a way to show more about what the effect of distillation was. I would guess that there are other ways that they get those tokens out, unfortunately, if there was one such prominent one. And then there’s the models themselves, which is the safeguards they have on the models, which is like the classifiers and prompt distributions and things. And I would expect the models to be somewhat permanently leaky. I just think that it’s hard to imagine. If you have a less aligned model and the task is, “Help me figure out how to get around said aligned model’s safeguards,” I would guess that that’s in scope of a strong cyber model’s abilities to figure out some sort of jailbreak for another model. It seems hard to permanently squash these things with how leaky they are now, despite the supposed launch, like higher false positive rate and being so general, and people get upset when they launch and they’re getting downgraded all the time, and people’s accounts get banned for doing bio research and things. So it’s just like the whole thing seems like a very big mess. I would be on the opinion of like, I guess maybe this is somewhat why the whole Fable freakout went down, which is like Anthropic was like, “Mythos is a powerful weapon.” And then somebody told the government and was like, “It’s actually easy to get around it,” and then they freaked out. But I think of it as like some of the distillation story has been around distillation lets them scale, take dangerous capabilities. But I think if you’re hosting an API at all, you have to assume in the current and near future that you can extract the capabilities out of that model, even if it’s slightly safeguarded.
00:52:14 JS Denain: Yeah. I guess one thing is I’m not sure how they prioritize between different threat models, but they sure seem to have some incentive to prevent distillation. It’s also hard to know what the counterfactual is, right? We have these examples of people doing those bad things. There’s a lot of usage of those models. It’s also compatible with, in most cases, it is actually really hard, and those people figured it out, or there was some random blip that allowed them to do it. So I feel I don’t really know how to update on that evidence. But yeah, at least in some cases, people just do manage to get around it. Maybe one distinction is also like, how long do you have to do this for? So there’s the model’s alignment that’s in the weights of the model, and then there’s your synchronous monitoring that you can do in the moment. And surely that’s going to be way less effective than how good you’re going to be at detecting things where asynchronously able to spend a ton of compute to parse through trajectories and analyze group trajectories together and stuff like that. But that takes a longer time, and so if someone needs to do an attack very quickly, then it’s just too hard for someone to detect it in a moment. But then if someone wants to pursue a very long campaign, maybe it’s harder. I’m not sure how long those campaigns take or how effective those KYC things are. But that also seems relevant for other cases that are not about leaking capabilities, but about other cases of misuse.
00:53:38 Nathan Lambert: I guess to make it more specific, how much of, say, risk proliferating from open models do you think is down to the fact that people will serve the open models or can serve themselves without the additional oversight and classifiers, versus what I think was talked about more, which is just like fine-tune the safety away, which I think very few people are going to fine-tune Kimi K3. But if these classifiers that squash 99% of people at inference time just kind of blanket a lot of the risk, I think that’s almost more plausible. It’s a bit of a sequence to get there. You have to assume people could get around model safeguards, assume a lot of usage.
00:54:20 JS Denain: Yeah. I guess the fine-tuning thing right now is not a big deal because not that many people have the combination of motivation to do it and competence and willingness to do it. The bar for that also falls as AI research becomes more accessible. But yeah, I think right now, the fact that there’s basically no safeguards, or my sense is the inference providers aren’t trying as hard as Anthropic or something at this. I could be wrong about that, but that’s my impression. And also you can pick whichever one is least secured. So I think that’s a bigger deal, at least currently, yeah, I would expect. But yeah, I think it also depends. I think the main thing that I care about for this is actual threat modeling. I just feel kind of confused about which kind of group I should have in mind as the most likely person to do a bad thing with AI. And then I feel like if someone gives you an actual scenario, then I feel like you and I will have decent takes about will it be easier for them to use an open model or to try to jailbreak a closed model? And I just don’t currently feel like I have a good sense of this. But I think—
00:55:24 Nathan Lambert: When this is so ambiguous, I think it makes me feel a bit better about the near term, which is just like these safety tools are, it’s to some capacity inadequate now, and there are strong open models, and it’s not like all hell is breaking loose. And you have to keep reevaluating this as things change. But I think it doesn’t seem like things are going to change. I don’t think there’s that much of step function changes. I personally need to learn more about biorisk that people very often talk about, and I think need to... My question is, what is the actual manufacturing pathway and where is the model intelligence at now? Where I think cybersecurity, we’re in it. We’re in what it’s going to be like for a bit, and it’s not good, but it’s not like nothing horrible has happened yet, and it’s okay. I don’t think there’s going to be more.
00:56:25 JS Denain: I don’t know what the sense with the evidence is, right? Companies don’t love to admit. I think it’s famously kind of hard to estimate cybersecurity costs and stuff. I know we want to look at insurance costs. I don’t think they’ve changed that much, but it would be interesting to look at right now. Like cybersecurity inference prices or something is like what percentages you can look at, but companies don’t love to disclose they’ve been hacked, and so they sometimes just pay. But yeah, definitely, yeah.
00:56:50 Nathan Lambert: That’s a good point as well.
00:56:51 JS Denain: I don’t feel like I have a ton of expertise there, but I’m pretty interested in those questions.
00:56:57 Nathan Lambert: I’m glad that this was a kind of like, “We don’t know, it could be worse,” and not a, “This is the list of very bad things.” Which is, it’s hard to motivate people when it’s like, “I think we need to keep preparing, and you need to assume that the Hugging Face thing might happen to you.” But it is not a super, it’s not an avalanche of compounding problems right now.
00:57:20 JS Denain: Yeah. I do expect Hugging Face-style things to happen kind of in the wild regularly and outside of OpenAI. And if it’s just that, then that’s not massively bad. I mean, it’s still a kind of screwed-up world. But I do expect more of this just happening with a variety of models and neoclouds and stuff over the next year. Just a bunch of open source agents that people can’t control.
00:57:44 Nathan Lambert: Yeah. I do think your threat model thing is a good understanding, and it’s like, who are the people that would try to take down an energy grid in a domestic area? And I think the list is pretty small. And it’s like, what are they doing? And I’m not an expert in this at all.
00:58:02 JS Denain: Yeah. I feel like the biggest safeguard is just there’s not that many people who want to do horrible things. Fingers crossed.
00:58:10 Nathan Lambert: Yeah. Okay, I have a fun question. I think it’s like Epoch AI creates so much of this kind of area setting information for different parts of the AI discourse. One thing is, is there a fun process on how you choose problems that you think are important? Are you guys constantly underwater and wanting to do different things, or is sometimes it’s like, “Now’s our moment?” Just behind the curtain of Epoch and what you guys do culturally is fun to me.
00:58:41 JS Denain: I think what determines project selection, I do think it is very what seem like the important questions to us are quite curiosity-driven overall. I think that’s probably the main thing is just what seems like a huge deal, I think has been the main determinant of where efforts go. More specifically, yeah, another framing is the Epoch was created as this thing where it seemed like neither the industry nor academia would be able to provide a good public resource is also well-maintained on the most important trends in AI. So it seemed like there was something missing. Another framing is, I know, what do people have misconceptions about, is sometimes, “Oh, people are wrong on the internet,” kind of things. Some articles can be explained by this. But yeah, I think it’s very curiosity-driven. And also it’s just like, oh, what’s evidence that’s leaking information that’s laying out there that we can use? Like, the job postings is this. Data center tracking is very much this as well. It’s like, man, these are big objects. Surely you can see them and track them.
00:59:53 Nathan Lambert: Do you think the information needed to understand the AI industry is stable in your access, like getting less accessible, getting more accessible over time?
01:00:03 JS Denain: I mean, it really depends, right? I think data center is, so far at least, it’s pretty good, and they’re getting bigger, which makes it easier. I could imagine at some point it becomes a really strategic asset, and there’s way more adversarial pressure to hide them or at least hide key information. For now, it’s pretty good, right? In contrast, Epoch is an effort to track model training compute, and at the time, you could just look at the paper. It’s much harder to do this with Astra. So yeah, I think it depends on the verticals. One thing that I mentioned before is, yeah, data is pretty rough. We’ve had some stuff on this, but it’s much tougher than compute, and it’s pretty secretive. So yeah, I think it depends on the vertical. Oh, yeah. One thing is, as the economy grows and companies go public, that’s better information, right? So that’s true for compute companies. As IPOs happen, that also helps get more data.
01:00:55 Nathan Lambert: Yeah. I find it very interesting. It’s like I’ve long wanted to know what a post-training... Like, what is a flowchart of a post-training recipe at a frontier lab? And I think it would be wild, and I think those flowcharts exist. And even some old ones, I think, would give people a lot of thought, because I do not think it looks remotely like the OLMo three-stage approximation type thing. And we have some from like Nemotron and some of the Chinese labs release stuff on it. But when you hear John Schulman talk about post-training and other people, it seems like the total Wild West and just stacking everything together. That framing for like that framing for what is the complexity of putting a model together, I think would be very useful for people as a mental model for what is being scaled and what are you scaling through. Like, yes, you are scaling, but if you’re scaling on top of this kind of house of cards thing, it’s not perfect.
01:01:55 JS Denain: Yeah. I’m actually curious. Yeah. I have this like... Okay, can I test my current mental model of this, which is pretty uncertain? My sense is this, okay, there’s a big post-training team, and it just has sub-teams that are kind of specialized. Like, some people are going to be doing math, and some people are going to be doing biology or finance or something. And the job of those teams is to ask for data and curate that data and make the RL environments good, and also figure out what kinds of hyperparameters work well for their own domain. And they do this by buying very high-quality evals that they use as a north star to iterate on and buying those RL environments. And their main output is basically like, “Here’s a curated set of environments, and here’s the hyperparameters that we want.” And then my sense is indeed now things are basically all those teams bid to put some fraction of their data into a final big RL training run. And they also bid to maybe for the hyperparameters of that final RL run to be close to what they want, question mark. That’s at least for the RL process. And then there’s in fact a big RL run. Another alternative would be, of course, they all do their experts, they distill them back into... Does that roughly what things are like? This looks—
01:03:16 Nathan Lambert: I think the org side, I agree a lot. I think the org side, there’s definitely per domain expertise, and it’s a lot of why I didn’t want to go get a frontier lab job, because most likely I would just be given, like, “You’re going to work on this data and you turn the crank.” I don’t know if the complexity is a lot higher on how you put it together. I think it’s interesting that the open weight models are split between multi-teacher on-policy distillation, and some are just like do sequential RL. I think the diversity there would be very, very interesting to the industry of whether you have multiple RL runs, how do you decide which environment to do and which of the stages? How do you manage mid-training and SFT? I think mid-training and SFT, I think, are one stage in the frontier lab, and the base model is just before mid-training, and then you do a whole bunch of stuff at the end there. And I just think there’s a lot of things you can do, and I feel like if OpenAI and Anthropic’s recipes were closer to mid-training and then big RL run, if that’s actually getting them to where they are, I think I would expect progress to go faster than if it’s mid-training and fork and model merge and bunch of experts and MOPD and then more RL. I think that just is a bit of a bottleneck on progress, and it would be very useful to have more information on what does model training look like.
01:04:44 JS Denain: My vague sense, but I don’t have super hard evidence on this, is that it has gone more in the direction of, yeah, away from MOPD with multiple experts and a ton of checkpoints, and a bit more in the direction of like, okay, there’s in fact one big run towards the end, but of course, much federation before, but I don’t know that.
01:05:01 Nathan Lambert: Yeah, maybe the rumors we’re hearing about mid-training being important and distillation is from that style of loop rather than the expert style loop. I don’t think we’ll know. I think we could continue that another time. This was fun. I think you should keep giving your incisive responses when I write something. I think this will be very useful to people and good to finally chat a bit longer.
01:05:24 JS Denain: Likewise, yeah. Thanks a lot.
01:05:26 Nathan Lambert: See you soon. Bye.


This is a public episode. If you'd like to discuss this with other subscribers or get access to bonus episodes, visit www.interconnects.ai/subscribe