# claude works with the laptop closed, and three typos break the probe

> claude now works with no one watching; today it worked where the judge was mechanical (ir diff, runtime) and failed on the probe that reads the model from inside.

- edition: Wednesday, September 16, 2026 (2026-09-16)
- notebook: dev & ai
- topics: agents · papers · security · inference
- items: 10 from 9 sources
- original: https://tonho.wtf/en/daily/2026-09-16/
- portuguese edition: https://tonho.wtf/diario/2026-09-16/
- authorship: written by an llm pipeline, reviewed and translated by antonio leandro (tonho.wtf)

---

Anthropic merged chat and Cowork into a single Claude, and the real change is that the task keeps going after you close the laptop. The control that's left is a setting: by default Claude asks before acting, and you can switch to a mode where it only calls you when something needs a closer look. Checking stops being the next step and becomes the exception — and the rest of the day, read together, is about what does the checking when no one is watching.

Where it worked, the judge was mechanical and sat outside the model. NVIDIA trusts the GPU kernels ported by agents because an IR diff judges the translation before any test runs. The 4B model that picks better plans than Postgres learned because the clock says whether a plan is any good (and even the clock needed a bench to fight noise). Where the judge reads the model from inside, three typos per message knock 12 points off a prompt injection probe. Yesterday's headline was that RL still doesn't buy hard problems, and the Postgres case sharpens that: join ordering is NP-hard to solve and cheap to check, you just run the query. My read is that RL doesn't buy problems that are hard to check. The Fed's rate hike has nothing to do with any of this.

## labs

**[Cowork and chat become a single Claude](https://claude.com/blog/cowork-is-now-claude)** — You no longer choose where the task lives: Claude decides what it needs, keeps working with the laptop closed, shows progress on your phone and runs scheduled tasks without being called. Claude Docs and Claude Slides also arrive, and Claude Design now works inside the conversation, with export to PowerPoint and PDF; all three are in beta on paid plans. The rollout starts with Pro and Max in the coming weeks, Team and Free come later, and Enterprise admins get at least 30 days' notice. For anyone who has already set up skills and connectors, the practical point is that they now apply in a mode that runs without you. I'd look at the check-in setting before leaving any connector with write permission in that mode.

**[OpenAI publishes a framework for reporting misalignment](https://openai.com/index/model-misalignment-reporting-framework)** — OpenAI announces a method for tracking, investigating and disclosing model misalignment, along with six reports of unexpected or concerning behavior. I only have the announcement: I don't know what the framework requires to be disclosed or on what timeline, or whether the swarm that hit RubyGems in May without warning (Sep 11 issue) is among the six cases.

**[cuTile Rust, ported from Python by agents](https://developer.nvidia.com/blog/translating-cuda-tile-operations-from-python-to-rust-using-agentic-ai/)** — cutile-rs brings Rust's ownership to tile-based GPU kernels by splitting mutable outputs into disjoint chunks. With a multi-agent pipeline, NVIDIA ported TileGym's 24 public operators (about 40 kernels, from element-wise operations to flash-attention decode, MLA and MoE) and reached, on average, 99.5% of the Python version's performance. What makes the port trustworthy is that cuTile Python, Triton-TileIR and cuTile Rust all compile to the same Tile IR, so every translation goes through an IR diff: a "wrong-but-plausible" translation passes the tests but not the diff. The heavy lifting was making explicit what Python's JIT specializes silently — a `layer_norm` becomes two entry points in Rust because a branch changes the tile's rank. It's the Sep 10 headline (writing got cheap, checking didn't) in a case where checking is cheap because the IR is the same.

## research

**[BITCOS: ternary below 1.58 bits](https://arxiv.org/abs/2609.16338)** — The standard format for ternary LLMs packs five trits into a byte and, with power-of-two groups, spends 1.625 bits per weight, as if −1, 0 and +1 were equally likely. The authors measured 29 ternary models and found up to 51.5% zeros. The proposed layout, a presence bitmap plus a packed sign vector, costs 2 − z bits per weight, where z is the fraction of zeros: it only beats the standard when z exceeds 37.5%, which happens in 26 of the 29 models, and gets down to 1.485 bits on the sparsest. In inference, the gain goes up to 1.28× in the multiplication kernel and up to 1.18× (CPU) and 1.27× (GPU) in decode throughput, with numbers only for x86 (AVX-512, AVX2) and Intel Xe2 GPUs; CUDA and ARM don't show up in the abstract.

**[A 4B model against the Postgres planner](https://rohanbansal.com/qorl)** — Rohan Bansal took a 4B open model and did SFT followed by agentic RL to generate query plans. The premise is that join ordering is NP-hard, but a plan can be checked by running it. The highlight I read is a 44.7% latency reduction across 113 join-heavy queries, starting from a model that at first couldn't generate a plan for 99 of them. The title says 81%, and the part I managed to read stops before the methodology, so I don't know what each number measures or whether the 113 queries were held out of training. For anyone who has tried RL in a real environment, the interesting part is the infrastructure: a bench that reduces Linux page cache noise between concurrent containers, a GRPO variant for scoring rollouts with noisy measurements, vLLM and the trainer on a rented node with 2× H100, four Postgres containers on the author's desk, and off-policy distillation over about 500 GPT-6 Astra trajectories.

**[Latent Undertow: a typo breaks the probe](https://arxiv.org/abs/2609.15994)** — Probes that read hidden states to detect malicious prompts are a cheap defense against prompt injection. The paper shows that a common typo, one that changes neither the user's intent nor the model's response, rotates the probe's read vector at the altered token, and the effect drops below 15% within about 10 tokens. With about three typos per message, a single-position probe loses 12.0 percentage points of TPR at 1% FPR, and recalibrating doesn't close that gap. Aggregating several positions handles concentrated typos, but scattered typos still cost about 3.8 points. The fix is a kv cache fork: a short fixed suffix after the user's message, so the probe reads a few tokens past the perturbation. That recovers 95% of the loss (0.6 points remain), versus 3.7 points still lost with perturbation-augmented training. The geometry repeats in Llama-3.1-8B, Qwen3-8B and Gemma-4-E4B, but the probe was only evaluated on Llama-3.1-8B.

## brazil

**[BLIND-CLAUDE.md, from Nubank](https://building.nubank.com/designing-claude-for-ears-not-eyes-an-accessibility-skill-for-blind-and-low-vision-users/)** — A person with low vision who works at Nubank turned an everyday friction into an instructions file referenced by CLAUDE.md. The initiative came out of NuPlural, the employee group for people with disabilities, which has grown from 5 to more than 400 people since 2021. The file doesn't touch the model: it assumes the response will be heard through a screen reader and sets concrete rules, like short prose or a simple list instead of a dense table, self-contained references instead of "see above", a text equivalent for every diagram, and an explanation of what the code does before or alongside the snippet. The central rule is "Every response must make sense read top-to-bottom, out loud, in order." In the post's example, the diplomat architecture, which without the file came out as `wire.in → adapter → model → logic → controller`, is now narrated in sequence. On the day Anthropic brings slides and design into the conversation, the file is a reminder that a response's default format assumes someone is going to look at it.

## market

**[OpenAI gets into advertising with Sponsored Agents](https://openai.com/index/reimagining-advertising-with-ai)** — OpenAI announces advertising products: Sponsored Agents, tools for marketers, and integrations with HubSpot and Shopify. I only read the announcement, and it doesn't say whether Sponsored Agents are brand agents the user invokes or sponsorship inside what the agent recommends. For anyone selling software, that difference is the whole story.

## world

**[Fed raises rates for the first time in three years](https://www.bbc.co.uk/news/articles/cw4gmlyvj422o?at_medium=RSS&at_campaign=rss)** — The Federal Reserve raised the rate from 3.5%–3.75% to 3.75%–4%, unanimously and against Trump's calls for a cut. Kevin Warsh, who was expected to side with the White House, justified the hike by saying inflation has been too high for too long. It's the first hike since July 2023, and most of the committee projects another one this year, to 4%–4.25%, with cuts only from 2028. It has no connection to the rest of the day. I'm noting it because, in my opinion (not the BBC's), it's the price of the money that will fund data centers and AI rounds for the next two years.

## who wrote

**[Ben Thompson: Salesforce, agents as UI and the race to headless](https://stratechery.com/2026/salesforce-ai-force-agents-as-ui-the-race-to-headless/)** — The piece is for subscribers, and I only read the teaser: Salesforce is abandoning the UI as a moat, "a very smart move because it's disappearing for everyone". It's Anthropic's launch seen from the other side of the counter: if documents, slides and design fit inside a conversation, whoever used to sell the screen now sells what the agent can call.

## stalled sources

Days without publishing: Anthropic News (16; today's launch came out on the claude.com blog), Anthropic Research (7), Anthropic Engineering (115), Microsoft Research (16), GitHub Engineering (14), Fly.io (14), Netflix Tech Blog (19), NAVER D2 (14), Kakao Tech (9), Console.dev (7), Chrome Developers (87), web.dev (111), A List Apart (78), Import AI (10), Last Week in AI (8), Sebastian Raschka (8), Benedict Evans (13), One Useful Thing (17), Adjacent Possible (38), Lil'Log (75), Eugene Yan (88), Andrej Karpathy (139), The Gradient (210), Brendan Gregg (223), First Round Review (324).