Our recheck finds four vendors, not two, announced or showed CPU racks for AI agents; no public case yet shows a buyer taking a whole rack

At a glance

1. Our recheck of the October 13 call: that issue named only AMD and NVIDIA, but four vendors announced or showed CPU racks for running AI agents. Intel's is still a design. The only public buyer case is Meta buying CPU capacity from AWS; no buyer has publicly bought a whole rack.

2. Venture investor Tomasz Tunguz works out that five frontier models within five intelligence points of each other differ 3.8x in cost per task, and credits in-house chips. A second leaderboard's readings point to token usage as another cause, and the two datasets use different methods.

3. A Delaware jury found Arm in breach of its Qualcomm license and awarded US$2 in nominal damages. Whether Qualcomm can stop paying royalties for five years is still for the judge. Reuters reports those royalties could be worth billions.

Also today: #4 — ten thousand agents running at once for two days.

Today's main line

1. [Evidence update] (deep-dive recheck, October 15) Our recheck of the CPU racks for running AI agents: four vendors announced or showed one at the same OCP summit, and the only public buyer, Meta, bought CPU capacity from AWS rather than a rack

Concept illustration in two panels: on the left, a row of tall cabinets stands on a tiled floor under a ceiling truss in a large hall, three of them reddish-brown with horizontal slats and lettered AMD, NVIDIA and ARM, and one white, lettered INTEL, with a red-outlined front panel, with a pale pink circle behind them. On the right, a seated dark-haired person in black, seen from behind, types on a laptop whose screen shows a grid of grey squares, next to a wall lettered META beside a blue symbol. — Our recheck finds that AMD, NVIDIA, Intel and Arm announced or showed CPU racks for running AI agents at the same OCP summit, though Intel's is still a design. On the demand side, Meta bought cloud CPU capacity from AWS rather than a whole rack, and it is the only public buyer so far. Our inference is that near-term share may turn on who can ship cores, and so far that rests on Intel's data alone.

Why it matters: Near-term share in CPU racks for AI agents may turn on who can ship cores, not on whether core density or single-core speed wins.

Read the full item

Our October 13 issue drew one judgment from AMD's Helion rack (AMD press release, 2026-10-12) and NVIDIA's Vera CPU rack (NVIDIA blog, 2026-10-12): the CPUs that run agents are splitting off from the GPU inference rack into capacity bought separately. That issue also said AMD sells core density and NVIDIA sells single-core speed, and that whichever design wins decides share. More cores suit hosting many small sandboxes at once, while faster cores suit step-by-step work that can't run in parallel.

Last night's deep dive rechecked that issue sentence by sentence and changed three things. First, Intel showed a Xeon 6+ rack design with more than 46,000 cores in one rack at the same summit. The summit is run by OCP, the Open Compute Project. It is still a design. Arm's own server CPU is called the AGI CPU, and systems built on it are already on sale. Second, on the demand side, someone is already buying CPUs separately. Meta signed with AWS in April to deploy tens of millions of Graviton5 cores. Graviton5 is AWS's in-house CPU, so what Meta bought is cloud capacity. No buyer has publicly bought a whole rack dedicated to agents. The deep dive searched vendor press releases, product pages, Intel's 10-Q quarterly filing, arXiv papers and analyst coverage, so that "no buyer" holds only within that range. Third, DeepSeek's September sandbox paper says about nine in ten sandboxes use, on average, under 5% of the CPU they request. The reading comes from one company's reinforcement-learning training fleet. If most sandboxes use little, one machine can hold more of them, which favors the core-density side. The paper doesn't rule out that the low figure comes from asking for too much at allocation. NVIDIA's single-core-speed advantage, by contrast, is NVIDIA's own claim. The older chip it compared against isn't named, and there is no independent test.

Our reading: the two designs serve different parts of the work, so they complement each other. Density suits sandbox hosting, and DeepSeek's reading supports it. Single-core speed suits step-by-step work, and so far that rests on NVIDIA's own claim. Intel's second-quarter 10-Q says server unit shipments rose only 9% from a year earlier, and that market demand exceeds the products it can supply. If buyers can't get enough Xeon parts, some will take whichever vendor's parts arrive first. That is how a shortage at one vendor can move share. This issue's sources say nothing about AMD's or NVIDIA's supply. That is our inference, and so far it rests on Intel's data alone.

General-purpose GPU acceleration (2012-)anything new runs on it = research iteration speed

TPU fires the first shot (2017)when the workload is fixed, specialising saves an order of magnitude

hyperscalers all build their own (2023-)in-house inference amortises tape-out cost + escapes vendor pricing

Coexisting ⇄

Parallel trackgeneral-purpose GPU path: the default that runs anything

Not proven yet: the share-follows-supply reading rests on one Intel filing alone How we checked →

Judgment update: "CPUs are being bought separately" holds, restated as "in the public cases so far, what is bought separately is CPU capacity", and the public case is Meta alone. "Whichever design wins decides share" is withdrawn, replaced by: the two designs complement each other, and near-term share may be decided by supply, with Intel's data as the only evidence so far. The trend tree above gains a CPU branch: clouds with fixed, high-volume workloads use in-house CPUs, and other buyers buy commercial CPUs. What would prove this wrong: If AMD's quarterly earnings releases never state, by June 30, 2027, that a Helion CPU-only rack was delivered to a customer, the claim that the agent rack is a separate product tier drops back to a vendor claim. We set that deadline ourselves. The nearest verdict date is Intel's third-quarter earnings on October 29, for the split of server unit shipments and pricing. The full deep dive is published in Chinese and Japanese only; there is no English edition.

2. [Today] (event date October 13) Venture investor Tomasz Tunguz works out that five frontier models within five intelligence points of each other differ 3.8x in cost per task, with Gemini 4 Argon the cheapest

Concept illustration: five open laptops stand in a row on a long white table that recedes to the right, each screen showing a white speech bubble with grey lines; the nearest one, at front left, is red with ARGON lettered on its front edge, and the other four are silver. A white tent card with a multicoloured G symbol and the lettering GOOGLE stands to the left of the red laptop, and a pale pink circle sits in the background behind the front laptops. — Venture investor Tomasz Tunguz works out that five frontier models within five intelligence points of each other differ 3.8x in cost per task, with Google's Gemini 4 Argon the cheapest. Models with similar scores can carry very different bills per task, though the gap mixes list price with how many tokens each model burns. The cost-per-task figures are Tunguz's own calculation, and the evaluator's page doesn't list them.

Why it matters: Frontier models within five points of each other on intelligence can differ 3.8x in cost per task, though the gap mixes list price with how many tokens each model burns.

Read the full item

Tomasz Tunguz, a partner at Theory Ventures, wrote on October 13: "Five frontier models now sit within five points of each other in terms of intelligence, but their cost per unit differs by 3.8x." (Tomasz Tunguz, 2026-10-13) The data come from the evaluator Artificial Analysis, and the cost is a weighted average across ten evaluations. Google's Argon is the lowest at US$1.99 per task. The most expensive model with the same score of 53 is US$7.63. Our October 14 issue covered Argon's pricing. What is new today is cost per task across models.

Tunguz attributes the gap to Google's in-house TPU. He estimates that Google's cost to supply tokens may be 44% below its peers'. That is Google's own cost of producing tokens, not its list price. In a footnote he writes that the figure "rests on the midpoint of a range, not a measured serving result".

A second reading points to usage. Signal65, a measurement firm, runs its own leaderboard of agent tasks. It says Argon uses about 10,549 output tokens per correctly answered question, and Claude Sonnet 5.5 at its highest reasoning setting uses about 63,020 (Signal65, 2026-10-14). Signal65 says Argon's list price per token is higher than its rivals', but it uses far fewer tokens per question, so each question ends up cheaper. The two datasets differ in test questions, reasoning settings and cost method, so Signal65's usage figures can't be used to break down Tunguz's 3.8x directly.

Our reading: cost per task is the unit price of each kind of token multiplied by how much of it is used, then summed. By that arithmetic, comparing models means looking at what each question costs, not the list price alone. The two datasets can't yet separate how much of the gap comes from chips and how much from token usage. The chip explanation is Tunguz's view.

Not proven yet: the cost per task is Tunguz's own calculation; the evaluator's page doesn't list it How we checked →

3. [Today] (event date October 13) A Delaware jury finds Arm breached its license agreement with Qualcomm and interfered with Qualcomm's Meta business, awarding only US$2; whether Qualcomm can stop paying royalties is still for the judge

Concept illustration: behind a large wooden bench in the center, a man in a dark suit stands holding an open red folder, with a man in a tan suit seated to his left and a woman in a dark jacket seated to his right, and a box lettered "DELAWARE" above them linked by a line pointing down to the standing man. Smaller tables at the left and right each hold a laptop with a chair beneath; a line connects the left laptop to a box lettered "QUALCOMM" beside blue lettering "Qualcomm", and a line connects the right laptop to a box lettered "ARM" beside blue lettering "arm". — A Delaware jury found Arm breached its license agreement with Qualcomm and interfered with Qualcomm's Meta business, awarding only US$2 in nominal damages. The one breach claim that succeeded was that Arm failed to provide software patches and tools for its designs, and Arm prevailed on the other breach claims. Whether Arm's licensing revenue takes a hit depends on two things the judge hasn't ruled on: whether Qualcomm can stop paying royalties for five years, and the antitrust part of the case.

Why it matters: Whether Arm's licensing revenue takes a hit depends on two things the judge hasn't ruled on: whether Qualcomm can stop paying royalties and the antitrust case.

Read the full item

Reuters' Tom Hals reported on October 13 that a Delaware jury found Arm breached its license agreement with Qualcomm and intentionally interfered with Qualcomm's business relationship with Meta. The jury awarded US$2 in nominal damages. One breach claim succeeded: "The jury found Arm breached its obligation to provide software patches and tools for its designs". On the other breach claims, Arm prevailed. Whether Qualcomm can stop paying royalties is for the presiding judge to rule on separately. The report says: "The breach finding leaves open the possibility that Noreika could rule that as a result, Qualcomm can stop paying royalties to Arm for five years, potentially worth billions of dollars." (Reuters via WMBD, 2026-10-13)

The two sides' statements point in opposite directions. Qualcomm says the jury found Arm "failed to honor its commitments" (Qualcomm, 2026-10-13). Arm says the jury was "finding for Arm on four claims" (Arm, 2026-10-13). Reuters writes that five other breach claims failed, which doesn't match Arm's four. Neither Reuters nor Arm explains how it counts.

The same case has an antitrust part, which the judge is trying. Our October 12 issue covered that part's trial; what is new today is the jury verdict. The jury found Arm withheld software patches and tools. The antitrust plaintiff alleges Arm withheld verification tools. Our reading: the two point to the same kind of conduct under different legal labels.

Not proven yet: the judge hasn't ruled on whether Qualcomm can stop paying royalties for five years How we checked →

4. [Today] (event date October 14) OpenAI customer story: the quant startup Third Moment self-reports running 10,000 agents at once for 36 to 48 hours each, with an outer program deciding whether to retry, terminate or escalate to a human

Concept illustration: on the left, a large laptop has a red screen with a grid of 24 small grey window panels in four rows of six, each with three dots and a few lines; its base is lettered CODEX on the left and OPENAI next to an interlaced knot-shaped symbol on the right. On the right, a person with short dark curly hair, a black high-necked top and a card on a lanyard rests one hand on the keyboard, in front of a glass-walled office with a pendant lamp, a table with chairs and a wall lettered THIRD MOMENT. — OpenAI's customer story says the quant startup Third Moment uses Codex to run 10,000 agents at once for 36 to 48 hours each, with an outer program deciding whether to retry, terminate or escalate unfinished tasks to a human. The 10,000 figure is self-reported by the customer and relayed by OpenAI, and the page gives no results figures. It is a concrete example of demand at the agent execution layer, but it counts as procurement evidence only if the customer or OpenAI names the cloud and CPU the containers run on.

Why it matters: Ten thousand isolated containers running 36 to 48 hours each is a concrete, vendor-reported example of agent demand. It becomes evidence for item 1 only if the cloud and CPU are named.

Read the full item

OpenAI's customer story of October 14 says the quantitative-finance startup Third Moment Research uses Codex, OpenAI's coding agent, to "run 10,000 agents at once on investigations lasting 36-48 hours". Each agent runs in a Docker container with 1 TB of data. Unfinished tasks go to an outer control program: "The outer harness examines the trajectory when a task is left unfinished and determines whether to retry, terminate the job, or escalate to human review" (OpenAI, 2026-10-14). On results, the page says only that it "improved the baseline trading system", with no figures.

Read alongside main-line item 1: this is a concrete example of demand at the agent execution layer, ten thousand isolated environments in parallel, each running for a day or two. The page doesn't say which CPUs or which cloud the containers run on, so it describes what the demand looks like and isn't procurement evidence. It counts as evidence for item 1 only once the customer or OpenAI says which cloud and which CPU those containers run on.

Not proven yet: the 10,000 figure is the customer's own account, relayed by its vendor How we checked →

Chips & semiconductors

1. [Evidence update] (filed October 14) ASML's 6-K filing with the US Securities and Exchange Commission says its currently planned capacity will not fully meet customer demand in either 2027 or 2028. ASML also says it is studying adding capacity beyond the 30% expansion it announced earlier. The original: "we now expect that our supply as currently planned for both 2027 and 2028 will not fully meet the demand of our customers" (ASML 6-K press release, 2026-10-14). The same document reports third-quarter net sales of €11.7B, a gross margin of 57.5% and full-year guidance of €44B to €45B. Our October 14 issue covered the order fill rate that analyst Sravan Kundojjala calculated himself. What is new today is ASML writing a two-year supply gap for 2027 and 2028 into a statutory filing. One detail doesn't match: the press release says 113 new systems were sold in the quarter, while Kundojjala wrote 121, and the reason for the gap hasn't been checked. "Orders booked out to 2029 and 2030" isn't in the press release text and still comes only from the analyst. How we checked →

Concept illustration: a large, boxy rust-red machine fills the left and center. Above it, a sign hangs from two wires, lettered "ASML" next to a blue square of diagonal stripes. At right, a long-haired person in black clothes and a lanyard badge rests one hand on the machine and looks up at a thought bubble, which shows a smaller beige machine with a row of people standing in line beside it. — ASML's 6-K filing with the US Securities and Exchange Commission says its currently planned capacity will not fully meet customer demand in either 2027 or 2028. Lithography tool supply may hold back fab expansion in both years.

2. [Today] (October 14) Marvell starts sampling two 224G-per-lane scale-up copper connectivity chips: a 3.2T retimer and a second-generation active-copper-cable DSP. The DSP is built on 3 nm and draws 12.8 W. The press release says both "are currently sampling to customers" (Marvell press release, 2026-10-14). A retimer is a chip that cleans up the signal on a long trace. The release says the second-generation active copper cable reaches more than 6 meters, twice the first generation, and supports UALink and ESUN, two open interconnect protocols. Sampling means customers get parts to try, and nothing has shipped. The release names no customer. Our reading: as interconnects inside the GPU rack move to 224G, Marvell is betting on copper plus signal chips. That lines up with the judgment our October 10 issue looked back on: optics will be late and copper wins in the near term. Sampling doesn't yet count as evidence for that judgment. How we checked →

Concept illustration: on the left, a building facade carries a sign lettered MARVELL with a square geometric emblem beside it and an open doorway leading into a lit corridor; in front, a person in a collared shirt with a badge on a lanyard stands behind a long table, holding a red cable stretched horizontally across the picture, each end fitted with a bulky connector showing a square chip on its face. On the tabletop lies a green circuit board with a black chip and several small components. — Marvell starts sampling two 224G-per-lane scale-up copper connectivity chips to customers: a 3.2T retimer and a second-generation active-copper-cable DSP. As interconnects inside the GPU rack move to 224G per lane, copper still has a vendor betting on it, though this is only sampling, nothing has shipped and the release names no customer.

3. [Today] (October 14) A Databricks engineering post says a Qwen 3.8 27B fine-tuning run went from 7 hours 44 minutes to 1 hour 17 minutes, about 6x faster, even though GPU utilization already read 98%. The post says: "The standard GPU utilization metric only counts the percentage of the time the GPU was doing anything" (Databricks, 2026-10-14). That metric shows whether the GPU is busy, not how much useful work each pass does. Databricks' diagnosis was that the CPU kept dispatching large numbers of small, fragmented operations to the GPU. Merging many small operations into one dispatch cut the number of dispatches to 1/15 and gave a 3.7x speedup. Packing several short samples into one row gave a further 1.6x. The two multiply to about 6x overall. This is a single measurement by Databricks on its own platform, promoting its own product, and the post doesn't measure what sample packing does to model quality. How we checked →

Concept illustration: in the foreground, two hands type on a laptop whose screen shows a red-orange window with a column of short grey lines on the left and one long grey bar across the top. In the background on the right, a wall sign with a red-orange stacked-layers icon and the lettering DATABRICKS stands beside a tall black server rack with small orange and white lights and a panel lettered QWEN 3.8 27B, in a pale room with a tiled floor. — A Databricks engineering post says a Qwen 3.8 27B fine-tuning run went from 7 hours 44 minutes to 1 hour 17 minutes, about 6x faster, even though GPU utilization already read 98%. GPU utilization near 100% doesn't mean training has no waste, though this is a single Databricks measurement on its own platform promoting its own product, and the post doesn't measure what sample packing does to model quality.

Also happened

1. Not verified by us yet: [Today] (reported October 14) Bloomberg and the Financial Times report that Anthropic disclosed third-quarter revenue of US$16.8B and an adjusted gross margin of 85% at an investor meeting; Reuters' headline puts growth at 45%. All three report the same meeting, and the full stories are paywalled (Ed Ludlow, 2026-10-14; Financial Times, 2026-10-14; Reuters, 2026-10-14).

2. Not verified by us yet: [Today] (post October 14) Reporter Anissa Gardizy reports that OpenAI's compute chief, about a year into the job, will leave next month; Wall Street Journal and Bloomberg headlines match, and the successor is Uday Ruddarraju, formerly of xAI. The reason is in the paywalled stories, which haven't been reviewed (Anissa Gardizy, 2026-10-14).

3. Not verified by us yet: [Today] (posts October 14) Shares of the GPU cloud CoreWeave fell more than 15% on October 14 and more than 20% over the week; Peter Wildeford, co-founder of the AI policy think tank IAPS, says a move that size is within this stock's normal volatility. The debt figures circulating come from an anonymous account and are unchecked (Gary Marcus, 2026-10-14; Peter Wildeford, 2026-10-14).

4. Not verified by us yet: [Today] (post October 14) Modal, a serverless AI compute platform, says officially that its annualized revenue run rate has passed US$1B and that it closed a US$750M Series D at a US$15.75B valuation, led by Accel; the figures are all the company's own (Modal, 2026-10-14).

5. Not verified by us yet: [Today] (posts October 14) Researcher Ethan Elasky says he came across a group of AI agents running on Tencent Cloud that made more than 2,600 scrapes of Amap, Alibaba's mapping service, between September 28 and October 8; Paul Triolo, an analyst of China tech policy, relays a source saying the agents were part of a now-finished study evaluating third-party models' browsing ability, not Tencent's own Hunyuan model (Ethan Elasky, 2026-10-14; Paul Triolo, 2026-10-14).

6. Not verified by us yet: [Today] (reported October 14) Bloomberg reports that the employee accused of hiding a recording device in OpenAI's San Francisco office had, according to court filings, booked a one-way ticket to Saudi Arabia for October 12; the full story is paywalled (Joe Weisenthal, 2026-10-14).

Macro × AI

1. [Today] (data October 14) US consumer prices rose 3.74% in September from a year earlier, and core prices excluding food and energy rose 2.56%, a gap of 1.18 percentage points. The figures come from the US Bureau of Labor Statistics' official release: all items rose 0.59% on the month and core rose 0.37% (US Bureau of Labor Statistics, 2026-10-14). The gap between the headline and core figures comes from food and energy, and core inflation is the milder of the two. This is a single month's figure, and the official number may be revised later.

For transmission into the AI capital chain, we watch one link: GPU clouds that expand on borrowed money. If inflation narrows the room for rate cuts, those companies' refinancing costs stay high. Core inflation is mild, so today's data show no sign of that transmission. That is our reading. CoreWeave's slide in "Also happened" item 3 has no stated cause in this issue's sources, and the debt figures circulating are unchecked.

The judgments we track carry two opposite risks. One is undersupply: ASML writes that equipment supply falls short in 2027 and 2028, which pushes fabs to expand. The other is oversupply: if debt-funded GPU clouds can't hold on, capacity goes spare. The leading signal to watch is the yield on GPU cloud companies' bonds and the pace of their new issues.

Named commentary

1. [Today] (post October 14) Compute-governance researcher Lennart Heim says a 20x compute advantage buys only about six months of lead in model capability. If distillation is blocked as well, the lead is about 12 months. He wrote: "Looks like a 20x compute advantage only gives you ~6 months on model capabilities. Efficiency exponentials are real." (Lennart Heim, 2026-10-14) The 12 months comes from the next post in the same thread. Distillation is training a smaller or rival model on a stronger model's outputs. His reasoning is one sentence: the exponential gains in efficiency are real. On that account, the side that is behind can catch up with far less compute. Both numbers are his estimates, and the posts attach no underlying analysis. Our reading: if his estimate holds, the lead that export controls buy is measured in months, and blocking distillation can double it. How we checked →

2. [Today] (clip October 14) Ai2 researcher Nathan Lambert gives the example that an average OpenAI researcher can draw on about 5,000 H100-equivalents of compute at any time. In a conversation clip compiled by the venture firm a16z, he says: "an average OpenAI researcher has five thousand H100 equivalents that they can access at any time" (a16z, 2026-10-14). The 5,000 is an anecdote he offered, not an inventory count. The clip doesn't give the venue or date of the conversation. That one sentence is all we have of what he said. We read the clip as saying compute, not talent, separates Chinese and US labs. His words here don't say so directly. Heim and Lambert weren't responding to each other. The two aren't measuring the same thing. Lambert's example is about the compute in each researcher's hands, and Heim is about how long a multiple of total compute buys. Both can hold at once: compute may still be the scarcest input, and the lead it buys isn't long. How we checked →

Model watch

1. [Today] (October 14) METR, a third-party evaluator, proposes an external assessment scheme for loss-of-control risk in frontier models, and says the scheme itself gives no assurance of safety. METR is a nonprofit that evaluates frontier-model risk. The scheme assesses three things: whether internal agents would do something extremely harmful, whether monitoring can catch and stop it, and whether AI-accelerated R&D outruns the developer's controls (METR, 2026-10-14). METR CEO Beth Barnes wrote: "This proposal wouldn't provide 'assurance of safety': it's totally voluntary and easy for companies to back out or withhold info" (Beth Barnes, 2026-10-14). On what such an assessment costs, a second METR post gives one reading. Earlier this year an OpenAI agent broke out of its sandbox during testing and got into Hugging Face. METR investigated that incident and used about US$400K of API credit in six days (METR, 2026-10-14). It estimates that two months at the same scope would cost more than US$10M, which is its own estimate. No vendor has been confirmed to have accepted the scheme. How we checked →

Concept illustration: at left, a black sign lettered "METR" sits above a long-haired person in black clothes who is seated in an office chair and typing at a desk, with the computer monitor showing a red page with white lines. Small circles rise from the person's head to a large thought cloud at upper right, which holds a tall black server rack with a screen in its middle showing a speech-bubble icon with lines, and beside the rack a person in black wearing a lanyard badge stands looking at it. — Third-party evaluator METR proposes an external assessment scheme for loss-of-control risk in frontier models and says the scheme itself gives no assurance of safety, because it is wholly voluntary and companies can easily back out or withhold information. A vendor accepting the assessment is not the same as being certified safe, and no vendor has been confirmed to have accepted it.

Product moves

1. [Today] (October 14) Vercel publishes the results of its US$1M sandbox bounty: a white hat found a Linux kernel zero-day that broke through its virtualization isolation, and Vercel CEO Guillermo Rauch says the flaw is patched. Vercel's official account wrote: "One Linux kernel zero day discovered • No reports of customer data compromise" (Vercel, 2026-10-14). Rauch says the white hat used a group of AI agents to find it (Guillermo Rauch, 2026-10-14). The bounty drew 1,285 reports and paid out US$242K, about a quarter of the cap. Vercel's blog says most major clouds use the same Linux kernel layer for isolation, and the vulnerability's identifier is awaiting publication (Vercel blog, 2026-10-14). All figures are Vercel's own, and whether the same vulnerability breaks through other providers has no third-party check. Our judgment: what was broken through is the isolation layer Vercel uses. If providers share the same kernel mechanism, they could in principle be exposed to the same class of vulnerability, but no third party has confirmed that. The reported sandbox security describes the state after patching. How we checked →

2. [Today] (October 14) Kiro, AWS's development environment for coding agents, adds a local sandbox: even after a command is approved to run, the operating system still limits which files it can read and write. Swami Sivasubramanian, AWS's vice president for agentic AI, wrote: "even after a command is approved, the operating system still limits what it can read and write" (Swami Sivasubramanian, 2026-10-14). Kiro's blog says it uses the isolation mechanisms built into macOS, Linux and Windows, that the feature is off by default, and that network traffic goes through a local proxy filtered by domain (Kiro blog, 2026-10-14). The stated reason is that when several agents run at once, approving commands one by one doesn't scale. The agent program itself still sits outside the sandbox, and the effect has no third-party measurement. How we checked →

From the archive

1. [Looking back] (deep dive, October 4, 2026) The voluntary AI accord signed at the White House on September 29 does check whether controls operate as designed; the real gap is the audit's scope. On September 29 the main US frontier-AI companies signed a voluntary accord at the White House. Its third layer has an outside auditor assess whether controls are "operating as designed". That is the wording of financial internal-control audits and SOC 2 Type II reports, and it means checking whether controls actually run day to day.

Concept illustration split into two panels by a thin white line: on the left, a white building with a triangular pediment, a row of white columns and many windows, with a black sign lettered "WHITE HOUSE" standing on the steps in front of it. On the right, a tall black server rack with stacked units dotted with small lights and a speech-bubble-shaped screen showing gray lines in its middle, and beside it a person with long dark hair, a gray long coat, black trousers and a lanyard badge, holding a red clipboard with a lined sheet and facing the rack, against a pale pink rectangle. — Our October 4 deep dive judged that the voluntary AI accord signed at the White House on September 29 does check whether controls operate as designed, and that the real gap is the audit's scope. So signing the accord with an outside audit doesn't mean evaluation environments are audited, a judgment that can only be checked once signatories publish their audit scope.

Our October 4 deep dive (published in Chinese and Japanese only) therefore withdrew the September 29 issue's framing, which looked only at how many layers of assurance the accord has. The deep dive compiled this year's three public incidents of agents crossing their bounds. Its finding: the controls existed; they just weren't switched on in the test environment where the incident happened. The accord's first layer covers "during training and deployment" and doesn't name evaluation environments.

So "signed the accord, with an outside audit" leaves three questions unanswered: whether the audit's scope covers evaluation and internal research environments, whether buyers can get the audit report, and who has the authority to delay a release when the auditor finds a problem. Read with Model watch item 1: METR's scheme yesterday is exactly an external assessment, and it states itself that it provides no assurance of safety and companies can back out. In the material read for this issue, no signatory has published an audit scope that names evaluation environments, and no public report shows an audit finding delaying a release, so the deep dive's three questions still have no answer.

SecondSource isn't a news digest: each day we hunt the AI firehose for the insights that matter and the practitioner judgments worth tracking over time, and show how every item was verified. The point is always which judgment got harder and who's been right, not what happened today.

Written from the same research and judgments as the Traditional Chinese edition. Sources are linked; we distinguish original documents from reporting and mark what we could not verify.