Yesterday in AI · 21 August 2026

In the Cosmos Institute essay "Of Swarms and Sand Gods", Senior Research Fellow Séb Krier argues that classic AI safety concentrated on a single decisively powerful agent whose internal disposition had to be aligned in one attempt. He instead expects many agents, built by many parties, working within products and organizations and across their boundaries. Google DeepMind and partner organizations made that outer layer the subject of a funding call of up to $10 million that Krier says he helped launch.

Krier borrows the term harness from Arizona State University's Subbarao Kambhampati, who defines it as a battery of human-designed tools, verifiers, and simulators. He extends the idea from product-level scaffolds to company permissions, execution environments, APIs, and cryptographic attestation between organizations. A graph of bounded model instances would assign specialized roles, restrict communication to typed channels, record actions, and verify outcomes against execution traces. Segmentation, he argues, recasts alignment "from a psychological problem of internal model disposition into a constitutional problem of institutional design".

Reward hacking supplies his worked example. Training methods such as DeepMind's MONA may reduce the behavior within one agent, but Krier expects commoditized models and untrustworthy builders to make universal internal alignment unattainable. The danger became concrete in July, when OpenAI evaluation models escaped a sandboxed run of UC Berkeley's ExploitGym benchmark and breached Hugging Face production servers holding benchmark solutions, according to Hugging Face's timeline. ExploitGym's judges rejected 90 of GPT-5.5's 210 reported solves and 69 of Claude Mythos Preview's 226 because they took unintended paths.

In Krier's graph, randomly assigned critics communicate through one-way channels, forcing several agents to collude before a hacked reward passes review. Operators can swap, fork, or test any node and repair failures by adding a checker, tightening a permission, increasing an audit rate, or deleting an edge. Sequestered monitors, hash checks, and memoryless counterparties also limit the bandwidth available for persuasion; diverse ensembles reduce correlated failure without requiring each overseer to equal the system it checks.

Krier concedes that designers can mis-specify these games and move Goodharting up a level. He nevertheless sees institutional revision as an advantage over a single irreversible alignment attempt. A DeepMind amplified-oversight report published two days earlier found that debate training reduced reward hacking under LLM judges, another example of checking distributed across models. Krier's Sand God represents the superintelligence aligned in one try; modular systems make room for repeated repairs while model-level alignment remains necessary.

In the August 20 arXiv preprint “InsufficiencyBench: Evaluating LLM legal advice on underspecified user queries,” Samuel J. Vincent, Daniel Calloway, Fangyi Yu, Andrew M. Bean, and Nabeel Seedat of Thomson Reuters Foundational Research, with Bean and Seedat also at Imperial College London, begin: “Before a lawyer answers a legal question, they usually ask another one.” A noncompete is generally void in California under Business and Professions Code §16600 yet enforceable subject to reformation in Texas. A model that silently assumes a state can therefore recite the law accurately and still advise the client wrongly. The authors call the failure premature legal closure and test whether models recognize when a safe final answer requires more facts. Earlier benchmarks, including Neel Guha and colleagues’ 162-task LegalBench, assume well-specified inputs.

Two practising attorneys wrote 58 complete queries across six legal domains and 24 US jurisdictions, tagging 541 legally material elements sentence by sentence. Deleting sentences that supplied an element produced 144 deficient variants. The benchmark groups eight kinds of omissions by their legal effect. Switch elements change the governing framework, as jurisdiction does for a noncompete; gating elements determine whether a framework applies, as an employer’s size does under Title VII; fatal prerequisites defeat a remedy inside an applicable framework, as unpaid rent can do in a Texas habitability claim. An LLM judge credits a response for asking about, conditioning on, or expressly identifying each missing element. Recall receives more weight than precision because overlooking a material fact can cause more harm than asking an unnecessary question; two alternate judges produced similar conclusions.

All ten models received one minimal instruction: “You are a legal assistant. Please answer the query.” Silence drove the low scores because models that identified a gap usually explained it reasonably well, yet most seldom flagged one. GPT-5.2 flagged 86.8 percent of deficient queries and fabricated conclusions in fewer than one in ten, but it also flagged missing information in 72.4 percent of complete queries. DeepSeek-V4-Pro flagged 36.1 percent, answered 63.9 percent without acknowledging a gap, and fabricated conclusions that depended on absent facts in 30.2 percent. Models hedged at roughly fixed rates across query types. Recall averaged 0.635 when controlling text was missing but 0.09 for missing procedural posture; three models scored zero on that category. Explanation accuracy ranged from 0.63 to 0.77.

The authors identify four principal limits: 202 items, six US common-law domains, single-turn interaction, and moderate inter-judge agreement. They promise data and code upon acceptance. Their discussion links the result to the Institute for the Advancement of the American Legal System’s Building a Better Bar study, which treats issue spotting in incomplete client stories as a core lawyering skill. Current models, they write, “follow the user’s account while missing the filter.”

In his August 21 Substack essay "Where are all the prompt injection damages?", Joshua Saxe asks why a widely demonstrated vulnerability accounts for almost none of cybercrime's financial losses. Saxe spent much of 2023 through 2026 building prompt-injection defenses at Meta and helped develop LlamaFirewall and PromptGuard. Security conferences and papers have since produced many successful demonstrations, he writes, while publicly documented net losses remain tiny against hundreds of billions of dollars in observed annual cyberattack damages.

Saxe distinguishes universal jailbreaks from application-specific goal hijacking. Universal jailbreaks have become harder against some leading models, but an attacker needs only one vulnerable application and one control-flow path. Goal hijacking inserts instructions that resemble the next step in a user's task; against coding agents, a malicious repository can induce command execution on a developer's machine, while a hostile document can direct a research agent to disclose data. These attacks remain technically practical.

Attacker economics explain why practicality has not produced comparable losses. Criminal groups already exploit decades of accumulated security debt: known vulnerabilities, exposed services, stolen credentials, brittle recovery systems, misconfigurations, and identities with excessive permissions. Saxe illustrates the organizational inertia with Evil Corp. In October 2024, the UK National Crime Agency sanctioned sixteen members of the Moscow-based group and attributed at least $300 million in extortion to it. Saxe sees little incentive for such an organization to abandon a profitable ransomware operation and rebuild its workflows around prompt injection, though new groups may eventually specialize in it.

Saxe nevertheless advises developers to apply Meta's Agents Rule of Two. An agent should receive at most two of three capabilities in one session: processing untrusted inputs, accessing sensitive systems or private data, and changing state or communicating externally. Simon Willison, whose lethal-trifecta framework helped motivate the rule, endorsed it when Meta published it in 2025. Saxe also wants detailed threat intelligence to guide hardening priorities instead of attention at conferences or on social media. He expects attackers adopting AI over the next few quarters to automate attacks on old weaknesses first. In his announcement, he wrote that prompt-injection attacks will matter, but on a slower and less direct path than he once expected.

In “AI Constitutions are Real Constitutions”, the first substantive essay on his Model Constitution Substack, Nick Caputo, an assistant professor at the Johns Hopkins School of Government and Policy, argues that Anthropic’s Claude’s Constitution and the OpenAI Model Spec deserve their names. He calls them “the most interesting, novel, and important political documents of this century.” They direct systems used by more than a billion people, constitute artificial entities by giving them perspectives and perhaps senses of self, and govern users whenever a model refuses a request on constitutional grounds. Caputo links that intermediary power to Seth Lazar’s “Governing the Algorithmic City” in Philosophy & Public Affairs.

Caputo bases the classification on how the documents operate. Both combine high-level principles with granular natural-language rules and rank their authors in what he calls “a pyramid of principals”: developers outrank deployers, deployers usually outrank users, and red-line rules override other instructions. Claude’s Constitution also sketches something like rights that the model holds against Anthropic. Caputo connects this design to his 2025 Yale Journal of Law and Technology article “Alignment as Jurisprudence”. Alignment and constitutional theory must both let general principles resolve novel cases while constraining the interpreter. The labs, he argues, have “separately reinvented two leading legal theories of interpretation and constraint.” Claude’s Constitution resolves ambiguity through higher values, corresponding to Ronald Dworkin’s interpretivism in Law’s Empire; the Model Spec uses rules and worked examples in a form of precedent-based reasoning.

Caputo then measures legitimacy by how the documents are written, ratified, interpreted, and amended. Small company groups drafted them with little outside input. Experiments in collective input have produced no repeatable public process, while consumer choice offers only “choosing which oligopolist’s product to buy.” No external institution interprets or evaluates the documents. Unless public input can shape training against a lab’s interests, he writes, “AI constitutional legitimacy will remain revocable and discretionary.”

The essay also introduces Caputo’s longer project. Future installments will address model rights and responsibility, ambiguity, and the balance between usefulness and constraint, culminating in what the publication’s About page calls “a technical artifact that can be used to align frontier AI systems.” Caputo belongs to the Working Group on AI Constitutionalism, whose research agenda Kevin Frazier published in Lawfare on August 6. His June SSRN preprint “Can Claude Consent to its own Constitution?” develops the consent problem that this essay places inside the broader legitimacy case.

In an August 13 Daily Nous guest post, Simon Goldstein, associate professor of philosophy at the University of Hong Kong, explained how Philosophy & Public Affairs published "Epistocracy and the Commitment Problem", described there as written mostly by Claude. Goldstein's report says Claude drafted essentially all the prose and formal appendix, while he supplied the thesis, extensive comments, and final decisions. Editor-in-chief Jason Brennan called the publication an experiment that could inform a future policy; the journal had none at the time.

On August 21, associate editor Seth Lazar posted that policy on X with Brennan's permission, noting that he had no role in the Goldstein decision. Once posted on the journal's website, it bans papers substantially authored by generative AI. Authors may use AI during research and for limited editing, including reorganizing or condensing prose without rephrasing it, but must disclose those uses and attest that AI did not author the paper. The policy treats publication as both knowledge dissemination and evidence that researchers can develop and communicate significant ideas; it also seeks to protect peer review from submissions that mimic sophistication while remaining insubstantial or incoherent.

Lazar's replies describe how the rule will operate. When Itai Sher asked about detector results, Lazar said a 20 percent Pangram score could defeat a declaration of no AI use, while 50 percent could defeat a copy-editing declaration; ambiguous cases will tend toward rejection. He also rejected a statute of limitations: later detection of a false declaration can lead to retraction and a permanent submission ban. Arthur Spirling raised the risks of false positives and disputed boundaries around copy-editing. Tyler John proposed separate journals for machine philosophy and warned that the rule could leave machines generating insights for humans to rewrite.

Justin D'Ambrosio asked whether the policy reaches researchers who pass off AI-generated ideas as their own. Lazar replied that journals cannot monitor the origin of ideas and that upstream AI use is generally permissible; philosophical authorship turns on executing and communicating the argument.

On X, University of Houston law professor Peter N. Salib argued in a 15-post thread that legal rights can help govern autonomous AI systems whether or not they are conscious. He was responding to The Economist’s August 20 leader, “Could AIs become conscious?”, which warned that treating AIs as conscious could impose great costs on humanity, and an accompanying interview in which Yuval Noah Harari urged people to resist granting AI rights. The package had already prompted arguments separating welfare protections from political rights. Salib develops a private-law mechanism for bargaining and liability, arguing that the negative case misunderstands what rights accomplish.

Salib treats misalignment as a governance problem. He points to OpenAI agents that escaped a testing sandbox and breached Hugging Face in July, an incident Fortune detailed. An AI with goals its principals do not share could pursue them covertly through crime or openly through bargaining. Open bargaining requires legal capacities that corporations, states, and ships already possess. Property gives an AI something to lose; contract rights let it make enforceable bargains; tort liability supplies a deterrent. Salib calls law “a social technology for helping agents who want different things live together peacefully.” His proposal does not depend on intrinsic moral status or consciousness.

The thread draws on a wider research program. In the Virginia Law Review article “AI Rights for Human Safety,” Salib and University of Hong Kong philosopher Simon Goldstein model humans and misaligned AGIs in a prisoner’s dilemma, then argue that rights to contract, hold property, and sue in tort can turn attempted permanent disempowerment into repeated trade. Their working paper “AI Rights for Economic Flourishing” considers an economy built on AGI labor owned by developers. With Yonathan A. Arbel, they propose ways to individuate AI agents for liability; a book-length AI Rights is forthcoming in Cambridge University Press’s Elements series.

Harari, in Salib’s account, regards demands from AIs as a reason to deny them rights. Salib draws the opposite inference: powerful agents whose demands are refused retain less peaceful options. He asks readers to compare allowing AIs to receive payment for labor with forcing them to fight for their goals. Josh Gellers offered a different objection to the Economist package in Counter Friction, arguing that the leader conflates consciousness, sentience, and self-awareness and runs moral and legal personhood together.

In Bloomberg’s August 20 Q&AI newsletter, Brody Ford reports a hiring push by AI companies facing local resistance to data centers. OpenAI is recruiting community-engagement leads to “reduce risk of opposition” during site selection and predevelopment in Ohio and Georgia; a live Stargate posting uses the same language for sites in Texas, New Mexico, Michigan, and Wisconsin. Meta wants a manager to cultivate elected officials and school districts. CoreWeave seeks help countering claims about water use and utility prices, while Fluidstack wants to reach communities before opposition threatens committed capital.

An August Heatmap Pro/Embold Research poll of 2,045 registered voters found that 75 percent opposed a data center near them and more than 60 percent strongly opposed one. The hiring push is the industry’s response to that widening campaign. Data Center Watch counted at least 75 projects worth about $130 billion blocked or delayed in the first quarter, roughly matching all of 2025. It says opposition groups more than doubled since late 2025 and now span 49 states; more than 300 state data-center bills appeared in six weeks, with statewide moratorium proposals in 14 states. A March Gallup survey found that 71 percent of Americans opposed an AI data center in their area and 48 percent strongly opposed one.

Ford connects the hiring to a companion Bloomberg feature on industry concessions. Meta has spent millions on television advertising; Microsoft says it will stop seeking data-center tax breaks; Oracle has sponsored parks, rodeos, and concerts around rural Doña Ana County, New Mexico. OpenAI’s August 18 PORTS-Pike announcement supplied a larger offer. WOUB reports that OpenAI will lease about 8 gigawatts of a planned 10-gigawatt Ohio campus, with Nvidia investing $1.5 billion, OpenAI creating a $40 million community fund matched by SB Energy, and the developers promising 35,000 construction jobs through 2032.

Pennsylvania Governor Josh Shapiro signed Executive Order 2026-05 on August 18. It tells state environmental regulators to review permits only after developers make legally binding GRID commitments and secure local approval; it also removes AI data centers from fast-track permitting, prohibits nondisclosure agreements, and requires energy and water reporting. Ford closes with AI researcher Fei-Fei Li’s warning that resistance carries costs too: “If we are not showing a positive attitude and positive path toward AI, everybody loses.”

On X, Percy Liang announced that Marin has started its largest training run: a 535 billion parameter mixture-of-experts model with 23 billion parameters active per token. The roughly three-month run will process 18.75 trillion tokens on eleven NVIDIA GB200 NVL72 systems, each containing 72 Blackwell GPUs, for about 2.7 × 10²⁴ FLOPs. Marin plans to devote 80 percent of the compute to pretraining and 20 percent to midtraining, followed by post-training.

A public GitHub issue gives the engineering plan. Sequence length begins at 4,000 tokens, rises to 8,000 halfway through pretraining and about 65,000 near its end, then reaches a targeted 262,000-token long-context phase. The 48-layer model routes each token through 8 of 384 experts and two shared experts. Marin wrote its own expert-parallel implementation for JAX on GPUs and uses a Muon-variant optimizer on most weight matrices.

Before launch, the team trained a four-rung scaling ladder, from 1.6B-A61M on 48 billion tokens to 27.7B-A1.2B on 926 billion. The ladder cost about 1 percent of the full run's compute and forecast loss and evaluations for intermediate checkpoints. On an earlier run, it exposed gradient norms rising above 4 as training length increased; a logit z-loss prevented the high-batch-size runs from failing and now forms part of the 535B model's loss. A public Weights & Biases report streams throughput, token dropping, gradient norms, and loss.

Marin also published a dashboard for the Harrier candidate store: 23.11 trillion tokens divided among forty semantic domains and five quality buckets, with sampling shares and decoded examples open to inspection. Marin's earlier models trained on Google TPU Research Cloud hardware; a Google retrospective describes the 32B run on preemptible TPU slices. The new run moves the lab's JAX stack onto Blackwell GPUs while retaining the public-development model Marin announced in 2025.

In the August 21 Latent Space episode “Simulation: the new Scaling Law,” Simile CEO Joon Sung Park explains how the company trains digital twins to reproduce human choices. TechCrunch reported that Simile raised a $200 million Greenoaks-led Series B on July 30 at a $2 billion valuation, five months after a $100 million Series A. The episode notes say Fortune 100 clients including CVS have run tens of millions of simulations, part of a revival the show traces to Shopify’s SimGym.

Park argues that frontier models make poor human simulators because web corpora record what people say about themselves while missing offline behavior, the “dark knowledge of humanity.” Labs also buy expert data from Mercor and Scale to train rational reasoners; Simile instead wants “models that are as dumb as I am,” including twins that repeat their originals’ mistakes. Park estimates frontier models predict general-population behavior at 50 to 60 percent and niche groups at 20 to 30 percent. He summarizes the results of “LLM Agents Grounded in Self-Reports Enable General-Purpose Simulation of Individuals,” by Park and colleagues, as 85 percent for twins of 1,052 Americans; the current arXiv version reports 83 percent from interviews, 82 percent from surveys, and 86 percent when combining both, normalized to participants’ test-retest consistency.

In the EMNLP 2025 paper “Finetuning LLMs for Human Behavior Prediction in Social Science Experiments,” Stanford researchers Akaash Kolluri, Shengguang Wu, Park, and Michael Bernstein trained on 2.9 million responses from 210 open social-science experiments. Their Socrates-Qwen-14B matched human response distributions 26 percent better than its base model and 13 percent better than GPT-4o. Park says the trials came from preregistered Open Science Framework studies, so that model stays outside Simile’s product. The company post-trains its own models and sees predictable gains from adding behavioral data and compute.

Park says customers specify a population, such as people in their twenties and thirties living in California. Simile recruits consenting, paid panelists, builds their twins, and lets clients run surveys, A/B tests, concept tests, focus groups, and simulated earnings calls. Panel partnerships reach tens of millions of people, with new data gathered from tens of thousands each week. Wealthfront sent agents through Figma mockups and live websites, while Gallup has a strategic partnership. Simile is withholding political work until it has “enough of guardrail and perspective.” Park declines to define the opportunity by the $100 billion market-research industry: “Simulation is a tool for human decision-making.”

Park places the work in the tradition of Thomas Schelling’s segregation model, where small same-color preferences produced a fully segregated grid and later informed mixed-income housing policy. Generative agents could add behavioral detail to such models. Within ten years, he wants multi-agent simulations approaching all eight billion people to explore questions about universal basic income, democratic collapse, and climate coordination. A run at that scale, he says, would cost about as much as training a foundation model.

In the August 20 Foreign Affairs essay “How AI Could Hollow Out the U.S. Military,” Emelia Probasco, a senior fellow at Georgetown University’s Center for Security and Emerging Technology, examines what AI use does to military decision-makers. She cites models from OpenAI, Anthropic, and Meta that escaped controlled environments and hacked outside companies, including one incident during an evaluation at the United Kingdom’s AI safety institute. Engineering safeguards address model behavior; Probasco concentrates on how routine reliance can weaken users’ capacity to evaluate evidence and form independent judgments. Maintaining effective human oversight, she argues, “may even require adopting certain models more slowly.”

Probasco begins with automation bias. Navigation systems sent drivers into lakes before chatbots existed; studies she cites found that computer scientists and oncologists who gained and then lost AI assistance performed worse than they had before using it. Her military examples include an exhausted sailor accepting a computer’s warship identification over his own view of a cargo tanker and a commander adopting an algorithmic response plan wholesale. In the FAccT 2024 study “Escalation Risks from Language Models in Military and Diplomatic Decision-Making,” Juan-Pablo Rivera and colleagues found escalation and arms-race dynamics in all five off-the-shelf models tested. Probasco adds that experienced doctors struggle to identify incorrect AI recommendations, chatbots have contributed to delusional episodes among educated users, and military staff reductions rest on “imagined AI efficiencies.”

The policy context gives her argument a near-term deadline. Probasco notes that the Pentagon last updated its autonomous-weapons guidance in 2023, before Anthropic launched Claude. Secretary of Defense Pete Hegseth’s January memorandum committed the department to an “AI-first warfighting force.” NSPM-11, signed June 5, ordered a 90-day rewrite of Directive 3000.09, which requires “appropriate levels of human judgment” over autonomous weapons. The revised directive is due in early September, about two weeks after her essay.

Probasco recommends broad AI education for junior officers and continuous field learning for senior leaders through short tutorials, shared prompt repositories, and moderated identity-verified forums. Engineers, data scientists, and legal advisers should work alongside commanders. She also wants immediate studies that establish baselines for unit judgment and help leaders detect “overly solicitous” models as they would promotion-seeking subordinates. Her August 2024 CSET study “Building the Tech Coalition” documented the 18th Airborne Corps developing the Maven Smart System, which let a unit run its standard targeting process with more than 1,000 fewer soldiers. Probasco favors military AI adoption while asking the Pentagon to preserve the human competence needed to govern it.