No lab published anything primary today. What was left, read together, has a single shape: in almost every item today a number that worked as a shortcut for something else stopped working as a shortcut. The router’s probability stops indicating which expert matters when load-balancing was too aggressive during training. Perplexity, which normally degrades along with accuracy, moves the other way: on gpt-oss-20B the pruning configuration with the lowest perplexity is the worst at mathematical reasoning. Comparing hardware mappings in a Q&A (above 90% on the closed models) isn’t knowing how to write the analytical model that does the math (below 15% in almost every configuration). Attack success rate isn’t a property of the victim, it’s a function of the compute the attacker spent searching. And “it compiled and the output was green” isn’t “it does what I wanted” — three weeks of Claude Code in agent mode to rediscover that, with a cron failing silently at three in the morning as the receipt.
The other side of the day is who pays the bill for keeping things verifiable in public. git.kernel.org renders commits into HTML for abusive crawlers more than for people, and what that costs is continuous CPU on five nodes. Rendering a commit into a browsable page is exactly the gesture of leaving the history auditable by anyone; the price of that gesture changed hands. Today’s two truncated items hit the same nail by different routes: a sequence isn’t a distribution, and a headline isn’t an employment series.
research
When Load-Balancing Goes Too Far — expert pruning in MoE assumes the router’s probability is a signal of importance. Under over-dispersed routing (tokens spread nearly uniformly across experts, an effect of aggressive load-balancing during training) the signal collapses, and perplexity stops predicting downstream accuracy. Worse: no scoring metric dominates — activation-based scoring preserves math and destroys knowledge-intensive science (18 points of difference on GPQA), frequency-based scoring does the opposite. The proposed MESA attacks worst-case degradation per domain instead of the average, and at 25% pruning wins on 7 of 11 benchmarks against the activation baselines. If you serve a load-balanced MoE, the old recipe of cutting the lowest-probability expert is wrong by construction.
What Attention Recalls and Recurrence Controls — two cache-level interventions separate what each channel of a hybrid model does. Split-prefill keeps only the KV cache or only the recurrent state; state-swap crosses the KV of one context with the recurrent state of another in a single forward. On Qwen3.5 and Falcon-H1 the split is clean: exact retrieval survives only through attention (64-98% of full accuracy, zero through recurrence), while output language and persona survive through recurrence and drop to ~1% language accuracy with KV alone. The answer comes from the KV side, the language comes from the recurrent side. It’s the map that was missing to decide where to cut memory without losing recall.
Distilled Continuous Diffusion Language Models Can Write Code in Few Steps—or One — PlaidQ is a 0.7B continuous diffusion model that reuses a pretrained autoregressive model as a bidirectional denoiser over embeddings. The detail that matters: the 16-step student reaches 31.78 and 40.49 pass@10 on HumanEval and MBPP+, above the teacher itself sampled with 512 steps. At the extreme, a single denoising step produces functionally correct programs at 7.07 pass@1. Modest numbers in absolute terms, but the quality/compute frontier moves: more steps stopped being a synonym for better. Code and checkpoints are published.
Rethinking Indirect Prompt Injection as a Test-Time Search Problem — indirect injection reframed as test-time search over the attack surface that the environment, the user’s task and the injection’s task induce together. The attacker is an agent with its own harness: it does reconnaissance on the environment, reasons about strategies and adapts using the victim’s feedback. More attacker compute, more vulnerability found and exploited; the ablations show that explicitly managing strategy is what avoids redundant search at high budget. The practical consequence is that reporting “attack success rate X%” without stating the attacker’s budget means nothing. It’s the complement of what was left hanging on 08/31, when the agent escaped the sandbox and the verifier was itself: now there’s someone on the outside searching on purpose.
PerfReasoning — a benchmark that separates the LLM as a reasoner about hardware performance from the LLM as a generator of the analytical model’s code. The first task is solved in practice: above 90% on the closed models, 82.4% on the best open-weight. The second isn’t: only GPT-5.6 Sol gets past an 80% pass rate, everything else stays below 15% on average and with high variance across runs. Task-specific RL adds 15.7 points on a 4B model; multi-round self-revision without external feedback doesn’t deliver a reliable gain. Plausible architectural reasoning and building a reliable performance model are different skills.
A Cost-Aware Agentic Architecture for NL-to-SQL over Nested Enterprise Schemas — a production schema is a graph, semi-structured and deeply nested, and that’s what academic benchmarks don’t measure. The work brings 900 execution-verified queries over that regime, with a schema-agnostic analytical depth rubric, and a single-generation architecture with schema selection, metadata retrieval and error repair. On the new benchmark, 91.7% accuracy, 54.6 percentage points above the second-best baseline; on Spider 2.0 Snowflake, competitive at a single-generation operating point. The huge margin says more about how much everything else was tuned to the toy benchmark than about the system.
brazil
I trusted Claude: 3 biases of the AI era I caught — three weeks of Claude Code in agent mode on a 40 thousand line monorepo, three projects, an RTX 4070 in a home lab in Tokyo, and three critical decisions lost. Automation: the rewrite of the deploy script swapped the global set -e for handcrafted try/catch per function, two functions ended up without a wrapper, the cron swallowed the error and exited 0. Anchoring: he asked Claude for a schema before thinking about his own, spent two hours refining on top of the first suggestion, and only a week later realized the axis was event sourcing and not snapshot. Deference: an articulate paragraph about setImmediate versus process.nextTick produced a fix that passed in staging for the wrong reason, masking a missing await three functions above. The best part of the text is the counter-habits, and the first one is the cheapest to adopt: in the diff, ask what the new version removed, not what it added. One caveat: the author uses the 2025 METR study as a settled number, and on September 5 the point here was exactly that the interval runs from -55% to +193%. His anecdote stands on its own; it doesn’t need the support.
market
AI is not yet driving US job losses — a Semafor teaser: the latest US employment numbers don’t show the wave of AI layoffs that’s been announced for two years, and several analysts pointed that out. The text gathers Noah Smith saying it’s extremely hard to identify any occupation that’s already obsolete, the Economist’s estimate of 1 million new jobs created by the technology in the US, and the WSJ’s reporting on the hot market for workers without a degree, despite the pause in white-collar hiring. I didn’t read past the teaser. Let the record show the thesis still has no data behind it.
HTMX 4.0 — the internal implementation moves off XHR and onto fetch, which unlocks HTML streaming, and attributes stop being inherited by child elements by default. Both are architecture changes, not release notes: the second breaks existing code silently on any page that relied on implicit inheritance. For anyone serving HTML from a Go or Elixir backend and using HTMX as the entire interactivity layer, it’s the migration of the semester.
who wrote
Creepy crawlies — Simon Willison points to Konstantin Ryabitsev’s text about the background radiation of abusive crawlers as seen from git.kernel.org. The TL;DR reproduced in the teaser: more CPU cycles rendering commits for scrapers than in all other legitimate access combined, clones included, and at any given moment 14 cores across five geo-distributed nodes doing nothing but that. Willison says he worries about the same thing on Datasette, which serves an enormous number of browsable pages. I didn’t read Ryabitsev’s post, only the teaser; but the number already changes how any maintainer sizes and protects an open source server.
Tetris had to cheat to feel random — Takuma Kakehi’s teaser at UX Collective is worth it on its own: nobody sees a probability distribution, only sequences, and it’s in the sequence that human intuition breaks. Tetris had to cheat at randomness to look random. Anyone building recommendations, raffles or any sampling visible to a user has already fought this.
stalled sources
Anthropic News at 7 days, Anthropic Engineering at 106, Interconnects at 21, Sebastian Raschka at 17. Karpathy hit 130 days and Lil’Log 66.