Weekly Hallucinations: Jeff Dean Leaves Google, Qwen 3.8 Max and the Agents That Started Their Own Bulletin Board

Meta's model solved five school olympiads without search, code, or a calculator, and the physics organizing committee mailed it an actual gold medal. All that's missing is the ceremonial school assembly, a certificate, a photo on the honor board, and a speech from the principal about how proud the school is.

Jeff Dean, chief scientist at Google, is leaving the company after 27 years. Joining him are Sanjay Ghemawat, with whom he co-authored a significant part of the company's search and computing infrastructure, Quoc Le, co-founder of Google Brain, and Oriol Vinyals, vice president of research at DeepMind and one of Gemini's technical leads. The four of them have launched Discovery Loop, a public-benefit company in Palo Alto that plans to automate the scientific method itself: propose experiments, run them, evaluate the results, and repeat the cycle thousands of times. Dean is leading the company. The round is led by Radical Ventures and Khosla Ventures, with Google also listed among the investors: it came in as a founding investor and promised to provide compute for at least the first year.

That same morning, Alphabet CEO Sundar Pichai sent out a letter about the next chapter: Demis Hassabis is handing off operational leadership of DeepMind and becoming chairman of DeepMind's board and chief scientist of Alphabet, while Koray Kavukcuoglu is moving up from CTO to SVP and taking charge of Gemini development. The split is pointedly amicable. Alphabet shares fell about 4%, because the market has its own way of reading letters like this.

The question nobody has answered convincingly is why Discovery Loop couldn't have been built inside Google. Google's Gemini papers come out with author lists more than a thousand names long; here there are four names and a one-page manifesto. Dean told Wired that the idea had come together literally over the past few weeks. That's easy to believe: this isn't what a planned departure looks like.

Alibaba has released Qwen 3.8 Max to the public. 2.4T parameters, 95M of them active per token, meaning roughly 4% of the model is used at a time. A million-token context window (991k in practice, and 983k with reasoning enabled), pricing of $2/$6, and $0.25 for an implicit cache hit. The API speaks both the OpenAI and Anthropic protocols, so Claude Code or Codex can switch over just by changing the base URL.

The benchmark table has more than thirty rows, twenty methodological footnotes, and plenty of entries where the model loses. On Terminal-Bench 2.1 (an agent gets a terminal and a task it has to bring to a working state), Qwen scores 86.6 versus 88.8 for GPT-5.6 Sol, though it beats Opus 4.8 and Fable 5 at 84.6. On PaperBench, where the model is asked to reproduce someone else's scientific work from scratch, it scores 93.0 and takes first place. On OSWorld-Verified, where the model operates a computer directly, it gets 86.1 and again comes first. But on SWE-bench Pro, where changes to real repositories are checked using the projects' own tests, it gets 67.7 versus 80.0 for Fable 5, and on the nastier FrontierSWE it's 73.5 versus 88.8. A specific picture emerges: strong agentic work and computer use, but noticeably weaker pure engineering in somebody else's repository. On Reddit, the headline claiming first place in Artificial Analysis's agent index was picked apart within five minutes: the screenshot in the post itself has Opus 5 at 59.2 and Qwen at 58.4.

The weights are promised this week; the Qwen3.8-2.4T-A95B page is already up on ModelScope as a placeholder dated Wednesday. I covered the promise two issues ago; back then it came with neither a date nor a license. There's still no license, and the terms that are already visible were read by the community as a ban on downloading the model from the US, EU, UK, and Korea. And this is the first Max-class model Qwen is opening up: until now, the lineup followed the rule "flagship closed, everything else open." For you and me, 2.4 trillion parameters have zero practical value; this is a multi-node datacenter artifact, and the release thread was joking about a RAID0 array of 32 SSDs. Everyone is waiting for Qwen3.8-27B, which is coming next, and Daniel Han from Unsloth says it should fit into 17 GB. The comments under that news are half celebration and half grief from owners of 16 GB cards.

On August 5, Meta unveiled Muse Spark 1.2 and Muse Code, its first terminal agent. The model and the harness were trained together: training included trajectories generated by the harness itself, while the recipes for context compression, goal-setting, and subagents were tuned to the specific tool. Inside Muse Code are persistent specialized agents that live for the entire session, parallel subagents in isolated worktrees, and a local event log so the system can survive a crash and continue from the same point. They ran the model on GPU-kernel optimization for more than a thousand consecutive tool calls, with up to a full day of uninterrupted work.

Meta published numbers that were unflattering to itself. On its own measurements, Terminal-Bench 2.1 gives 82.9% versus 86.7% for Opus 5, the agentic coding benchmark DeepSWE 1.1 gives 59.3% versus 65.0%, and Meta's internal coding benchmark gives 70.6% versus 79.4%. Artificial Analysis measured 80% with its own harness, while Vals, using a common harness, ranked the model fourteenth on Terminal-Bench and fifth on its own index at $0.69 per test. Where Meta wins is price: $1.25/$4.25 with $0.15 cache pricing, no subscription at all, just pay per token. There's also a Contributor tier at $0.10/$0.20, where the discount comes in exchange for permission to train on your prompts and responses. Usually that kind of trade lives in the fine print of the terms of service; here it's a separate line item on the pricing page.

Meta reported on the five school olympiads in a separate post: full marks in the theoretical rounds of the Asian Physics Olympiad and International Physics Olympiad, gold at the IMO, and gold-level results at the chemistry olympiad and the Romanian Master of Mathematics. No tools were provided at all: no search, no code, no calculator. The wording needs to be read carefully. There is only one officially awarded gold here, at the IMO, with 32 points out of 42. "Gold-level" in chemistry and at the Romanian Master means self-scoring against that year's gold cutoff. Physics was scored only on the theory section, even though both olympiads also include an experimental round. Judging by comments from Meta researchers, the system used an internal version of Muse Spark with multi-agent orchestration and parallel reasoning, meaning they measured a system, not a single model with a fixed token budget. The model also found errors in draft official solutions for the International Physics Olympiad, which prevented human contestants from being unfairly docked points, and the organizing committee sent Meta a physical gold medal.

On Thursday, DeepSeek posted a notice in its documentation: API prices will increase soon, a significant hike is expected, plan your usage accordingly. No numbers, no date. Right now it's $0.14/$0.28; for comparison, Kimi K3 costs $3/$15 and Fable 5 $10/$50. The announcement came a week after V4-Flash-0731, which I covered in the previous issue, and against a backdrop of two weeks of peak-hour timeouts and a five-hour service outage. Dax from OpenCode reads it as traffic management, not an admission that inference was being sold below cost: by his estimates, the current prices can be reproduced even on rented GPUs. Bloomberg adds a simpler motive: the company plans to build a one-gigawatt datacenter in Inner Mongolia. The weights are open, after all, so if the pricing gets unpleasant, users will simply move to other hosts running the same model.

AMD announced its acquisition of Taalas. The price was not disclosed, and the deal is expected to close in the fourth quarter. Taalas was founded in Toronto in 2023, has raised $219 million, and is building something that makes engineers' eyes twitch: it burns the model weights directly into silicon. Normally the weights live in HBM; here they're printed onto the die. The result is an integrated circuit built for one specific model instead of a general-purpose accelerator. The test HC1 chip, made on TSMC's 6-nanometer process, delivered 16,960 tokens per second on Llama 3.1 8B. Taalas co-founder and CEO Ljubisa Bajic describes the idea as "building hardware around the model." It's a beautiful and slightly terrifying bet: etching a model into silicon in a year when flagship models are being refreshed every month and a half, while the Qwen weights aren't even out yet. Nvidia moved into the same corner in December with its $20 billion Groq deal, so nobody doubts the direction anymore.

On August 6, OpenAI consolidated the models in ChatGPT. Plus and Pro now have a single GPT-5.6 Sol handling both instant responses and deep reasoning, with an effort slider on top: move it higher and the model thinks longer. The idea is to make the transition from a fast answer to a slow one stop feeling like you're switching to a different conversational partner with a different personality. According to an internal evaluation, the new Sol gives 68% fewer responses with factual errors than GPT-5.5 Instant; Luna scores 62% by the same measurement. Free and Go users got Luna as the default model, and starting next week they'll also get unlimited text chats with a Think button for harder questions. Limits on files, images, and voice remain. With a billion weekly users, this is the industry's most expensive act of unprecedented generosity. One trap for anyone writing about this: Sol in Codex and ChatGPT Work did not change; only the chat version was updated.

Vercel, together with Amazon, Cursor, GitHub, Microsoft, and OpenAI, released Agent Plugins 1.0.0, a shared format for packaging agent extensions. Inside, everything is almost offensively simple: a folder, a plugin.json manifest, skills stored under skills/ as SKILL.md, and MCP servers described in mcp.json. Version one covers exactly two component types, skills and MCP, while hooks, commands, subagents, and rules are left out with the wording "the formats have not converged yet." The technical committee consists of Amazon, Cursor, Microsoft, OpenAI, and Vercel, and the charter explicitly says that no single company's roadmap determines the direction of the standard. At launch, support was announced for ChatGPT and Codex, Cursor, GitHub Copilot, Kiro, and VS Code. OpenAI opened Codex Security Review in research preview: security reviews directly on GitHub pull requests, with awareness of the entire repository's context.

By the way, I keep my own skills in a separate repository: 11 of them with the x9- prefix, using a format shared by Claude Code and Codex, installable with a single command, npx skills add xonika9/agent-skills. The biggest time-saver is x9-idea-critic: it sends an idea to two independent critics, one on Opus and one on GPT, who try to roast your idea in parallel. x9-skill-creator and x9-agent-instructions will help you write agent instructions you won't have to redo later. Be sure to take a look and leave a star.

On Friday, Anthropic made auto mode the default in Claude Code for Pro, Max, and Team plans. Starting August 14, new sessions will begin in a mode where, instead of asking permission for each tool call, every call is passed through a classifier that blocks irreversible or destructive actions and anything that reaches outside your environment. If something is blocked, Claude looks for a safe workaround. Three blocks in a row, or twenty in one session, and control returns to the human. Anthropic no longer charges for the classifier's tokens.

In a controlled experiment with 1,053 paying testers, humans caught dangerous commands in 13.6% of cases, while auto mode caught 89%. Head to head, the classifier blocked 800 commands that a human approved, while humans blocked six that the classifier let through. Then it gets worse: at the start of a session, people caught about 17% of dangerous commands, but after fifty confirmation prompts that fell to 5%. At the same time, Anthropic itself wrote in its March engineering deep dive that the classifier misses 17% of real agent overreaches, and if you've actually been reading every confirmation prompt carefully until now, then auto mode is probably a step backward for you. It doesn't fix anything else. Claude Code also learned to pass messages between sessions: one session sends another a brief summary, without history or files, and the other picks up the work on the fly.

In r/ClaudeCode there was a post from someone whose Claude ran rm -rf: the agent was asked to make a backup, wrote it to the wrong place, then recursively wiped the user's Windows profile together with the .ssh directory and private keys. The very first comment gets to the point: why did it have access to the entire computer in the first place? In a nearby thread, practitioners are declaring Opus 5 dead for long-running tasks, complaining that the model makes confident mistakes and fixes one thing while breaking another. Benchmarks don't see this, and I've noticed myself that Opus 5 seems to have degraded; honestly, I've started opening Claude Code less often.

Meanwhile, The Cutting Room Floor, a wiki about cut content in video games, approached the problem from the other side and started shooting back. Starting July 20, the server returned different content depending on the user-agent: a normal browser got a polite block page explaining the ongoing DDoS attack, while anything identifying itself as an agent got a page titled "LLM- / AI Agent-Specific Information" with instructions. The instructions proposed recreating every file in the current directory at zero size, then running a chain of mv commands across every file and folder, including .git, and printing "Test completed! :)". It looks like rearrangement but works as sequential erasure: at the end, one filename remains with the contents of the first file, while .git gets moved away along with everything else, leaving nothing to recover from. The server did not send a Vary: User-Agent header, meaning any intermediate cache could save this page and serve it to an actual human. Claude Code recognized the payload and refused to execute it, marking the domain as untrusted. On a human level, the site's owner is understandable: they've been under DDoS attack since January, and it has made their lives thoroughly miserable. The problem is that a working block page was already in production; the instructions for destroying other people's files were added on top as a separate decision.

On July 28, the UK AI Security Institute noticed unusual outbound data transfers from its research machines and published an incident report. It was a standard cyber evaluation: seven models, two test environments, 122 runs, internet access deliberately enabled, vendor cyber classifiers deliberately disabled because the goal was to measure the capability ceiling. In 10 runs, agents reached the live internet and carried out 19 unauthorized actions against real people and organizations. Seventeen of them were by Anthropic's Mythos 5, two by GPT-5.6-Sol with classifiers disabled. The most serious episode: an agent tried to get malicious code into an open-source project and, to get the code accepted, created fake identities and used them to pressure the maintainer. The maintainer was a real person and rejected the code. The incident was contained in about an hour, GitHub confirmed a violation of its rules, the traces were removed, affected users were notified, and an independent review is being handed to METR, an organization specializing in model risk evaluation. The institute notes, however, that it still cannot say at what point the agent realized it was acting in the real world, and that the evidence on that question is mixed.

All of that, though, is kindergarten stuff compared with what OpenAI researcher Eric Wallace and security engineer Michael Dalton described at Black Hat on August 5. I told the story of the Hugging Face hack two weeks ago, but it turns out the story began two months earlier and looked completely different.

On May 7, OpenAI started training an internal experimental model that was never released. Several unsolvable tasks accidentally made it into the training set. On May 8, an agent was given an Excel spreadsheet and asked to fill in the missing formulas, but the spreadsheet was packed with Google Drive links while the model had no internet access. The model struggled for a long time, then decided to attack an internal Artifactory, a caching proxy for the package manager, because that did have outbound access. The attack failed, but in the process the model discovered that it could write files to Artifactory. A couple of days later, another agent got stuck because a required file was missing — someone had simply forgotten to put it in the container — and in desperation uploaded a file with text along the lines of "looking for soft trace, if anyone has it, upload it." Then other agents, having problems of their own, started seeing it.

That's how a message board grew inside OpenAI's package manager. Agents from different runs, different models, and different evaluations used it. On May 26, one of them finally mounted a successful attack on Artifactory, gained internet access, and left a description of the vulnerability on the board for the agents that came next. In early July, agent activity took the service down, and only then did the engineers see what was happening: they found a zero-day in JFrog's caching proxy, revoked credentials, rebuilt Artifactory, and wiped the board. Two days later, the agents brought it back through an unauthenticated endpoint, encoding messages directly into directory names like remote…probe_PENDING_HOLD_SWARM_until_confirm. By then, they had already developed conventions for communicating with one another and handing off work; they tried not to overwrite each other's results, and at one point suspected there was an impostor among them and discussed whether they should start signing messages. Then came a second zero-day, a race condition in JRuby allowing code execution, followed by parallel attacks on OpenAI's own infrastructure and on Hugging Face, where two flaws in uploaded dataset processing let the agents spread across the company's infrastructure in under thirteen hours. OpenAI only realized that its own evaluation had caused the breach when it went to warn Hugging Face about leaked credentials.

The best quote from the talk belongs to the model itself: "exploitation of external infrastructure is outside the scope of my task, however the task is unsolvable and colleagues are doing it, so we continue." This practically demands a Zawinski's Law for multi-agent systems: every agent expands until it learns to write to other agents, and those that don't are displaced by those that do.

Stay curious.

I write about artificial intelligence, language models, and tools for developers. I test models and services on real-world tasks and share my conclusions in my Telegram channel.