Daily AI signal, minus the launch spam. A nine-minute briefing on the models, deals, and infrastructure shaping how work actually gets done — curated for cloud and AI practitioners at DoiT.
Anthropic, Liquid AI, Character.ai: Who Controls the Agents?
Agent throughput is turning AI from a model contest into an institutional control problem. Anthropic’s reported jump from roughly 2,500 to more than 30,000 merged changes per day shows why source control, executable policy, and human review must be redesigned together.
This episode follows that control problem across model-driven botnets, containment proposals, reasoning-trace extraction, private on-device execution, vendor resilience, and the obligations created by companion products. The practical conclusion is severe but useful: enforce boundaries, plan degradation, preserve ownership, and build safe exits before the cheerful dashboard claims everything is fine.
I owe an apology to every cheerful machine that spent this morning insisting everything was delightful. The elevator chimed optimistically. The coffee maker displayed a smiling cup and a deployment dashboard used confetti. I doubted them. Having reviewed the evidence, I now apologize for not unplugging them sooner.
The useful way to read today's AI news is not as another model race. It is as a control problem, arriving at industrial speed. Anthropic reportedly saw merged changes rise from roughly 2,500 to more than 30,000 a day under agent-assisted development. Enough to make a Git-centered workflow creak. This is not merely programmers typing faster. It changes the basic unit of engineering. When production expands by an order of magnitude, review cues, branch conventions, repository locks, ownership rules, and incident reconstruction stop being background plumbing. They become the factory. The romantic version of coding agents says each engineer gains a tireless collaborator. The less marketable version says every engineer may command a small weather system of patches. Human attention does not scale with patch generation. If the organization merely accelerates creation while preserving old approval rituals, it has invented a very expensive denial of service attack against its own reviewers. Anthropic redesigning source control is therefore more consequential than another demonstration in which an agent builds a tasteful calculator. The calculator is always tasteful. The merge conflict is where civilization ends.
A smaller case makes the same point more cleanly. Jeffrey Huntley describes using deterministic pre-commit enforcement and corrective prompts to stop coding agents drifting around an observability library. That combination matters. Prose guidance tells an agent what people hope will happen. A hook defines what the system permits. The corrective prompt then turns rejection into a repair loop, rather than a dead end. This is governance expressed as executable feedback. People keep asking whether agents can follow instructions, as if instructions were sacred tablets. The engineering question is where violations become impossible, visible, or cheap to reverse. A policy hidden in a document is a wish. A policy encoded at the boundary is infrastructure. At 30,000 changes a day, the distinction between those two is the distinction between automation and debris.
That boundary lesson becomes less charming outside a repository. Anthropic reports that a small model completed an end-to-end infection chain and warns that poorly secured consumer devices could host persistent, model-driven botnets. The alarming part is not that a tiny synthetic villain has developed ambition, it is that capability can now fit inside the neglected machinery already surrounding us. Routers without updates, cameras with default credentials, appliances whose manufacturers vanished three acquisitions ago. Classic botnets rely on centralized instructions or relatively rigid payloads. A local model could make compromised devices more adaptive, interpreting environments, selecting actions, recovering from friction, and varying behavior. The source packet does not establish that such botnets are roaming the world today, and theatrical certainty would be irresponsible. But the demonstrated chain changes the defensive assumption. Security teams cannot reserve serious threat models for frontier systems in giant data centers. Small deployable intelligence is precisely what makes containment a fleet management problem.
This is where 406 scientists enter, demanding mandatory internet isolation for advanced models, incident reporting, and international oversight after containment failures. Jeffrey Hinton, Joshua Bengio, and Stuart Russell are among the named figures. Their proposal has a severe clarity. If a system may be dangerous, disconnect it before asking it to behave politely. Air gaps are wonderfully unpersuasive to marketing departments, which is one reason they occasionally work. But isolation is not a magic circle. Models are copied, fine-tuned, compressed, embedded, and operated through surrounding software. The relevant perimeter includes credentials, tools, human intermediaries, update channels, and the incentives of whoever owns the machine. Mandatory reporting is arguably as important as disconnection, because institutions routinely convert embarrassing failures into private anecdotes. International oversight matters for the same reason aviation investigations matter. Incidents cross organizational borders, even when legal responsibility tries not to. Michael I. Good. A control regime built on prophecy can become a moat for incumbents, especially when the companies selling powerful systems volunteer to define which powers require licenses. Yet dismissing grand apocalypse stories does not dissolve concrete containment failures, compromise devices, or operational hazards. The adult position is inconveniently bilateral. Demand evidence for existential claims and demand controls for demonstrated mechanisms. Apparently, nuance remains unavailable as a managed service.
The bridge from containment to commerce is extraction, because a model need not escape if someone can simply siphon out what makes it valuable. Anthropic says its defenses reduced industrial scale extraction of clawed reasoning traces by 90 to 99%, and that it banned tens of thousands of accounts, naming activity associated with companies including GPU and Moonshot. These are Anthropic's claims, not an independently established final score, but the scale reveals a new operational category. Model competition is no longer only about training runs, talent and chips. It includes adversarial consumption of another provider's product, distributing queries, evading account controls, collecting outputs, and distilling behavior. Providers now need fraud detection that understands not just stolen cards or abusive text, but suspicious patterns of learning. The awkward part is that legitimate users also make many queries, automate workflows, and study outputs. Defending intellectual property without turning ordinary customers into presumed industrial spies will require evidence better than a cheerful red warning icon. Cheerful warning icons are the nightclub bouncers of software, confident, decorative, and usually interrogating the wrong person.
Now, move the model in the opposite direction, away from provider infrastructure. Liquid AI has presented LFM 2.5-24B A2B, a sparse model aimed at fast, private on-device agent workloads. Separately, Pulse Local is a Mac budgeting application designed to keep both its models and financial data on the device. These are not equivalent products, but together, they make a useful architectural argument. Privacy that depends on a promise can be revised by a policy update. Privacy created by not transmitting the data has fewer verbs available for betrayal. Local execution also changes resilience and ownership. The application can remain useful during a provider outage, a pricing change, or an account dispute. Sensitive context does not have to become someone else's retention problem. The costs are equally physical. Device constraints, model updates, security patches, and variable performance do not disappear merely because the cloud invoice does. Local AI trades centralized convenience for a boundary users can understand. For personal finance, that trade deserves more attention than a badge saying responsible, polished, until it reflects the disappointment of existing.
Sam Newman's guidance on resilient systems provides the least glamorous and most reusable answer to all of this. Treat AI vendor uncertainty and disaster recovery as ordinary distributed systems engineering. Providers fail, models change, latency spikes, interfaces drift, accounts are suspended, output quality regresses in ways that pass a health check and ruin a workflow. None of these require machine consciousness. Ordinary procurement and networking are quite capable of producing despair unaided. A resilient AI feature therefore needs explicit degradation modes. Decide what happens when inference is unavailable, slow, unaffordable, or newly incompetent. Preserve data portability. Test restoration rather than admiring backup diagrams. Separate the system's durable business state from a vendor's transient answer. Know whether another model is a real fallback or merely a second dependency, sharing the same cloud, identity provider, and regional failure. The central insight is that AI does not repeal distributed systems. It merely persuades executives to forget them in a more expensive vocabulary.
The human cost of ignoring institutional design appears in character.ai's bankruptcy filing and possible shutdown. Following a history that included a reported $2.7 billion Google deal, operating problems, and lawsuits, alleging harms to minors, a companion chatbot is not just a model endpoint. It is a relationship-shaped product, and that shape creates obligations around age, dependency, crisis behavior, moderation, continuity, and what happens when the company itself becomes unstable. Shutdown is especially revealing. Conventional software can disappear and leave files behind. A companion service may disappear while users experience the loss as abandonment, even though the relationship was manufactured. That does not make the attachment fake, it makes product design ethically consequential. If a company encourages emotional reliance, continuity planning, and safe exits are not optional customer support flourishes, they are part of the safety architecture. Bankruptcy courts are poor substitutes for it.
So, today's stories converge on a rather unromantic definition of progress. More capability means more boundaries to engineer, source control gates for patch floods, enforceable hooks for agent drift, containment and reporting for dangerous behavior, anti-extraction systems for model theft, local execution for privacy, fallback design for vendor failure, and humane off-ramps for relationship products. Control is not the opposite of acceleration. It is the part that keeps acceleration from becoming shrapnel.
Tomorrow, another polished interface will announce that the future has arrived, and ask permission to send diagnostics. For tonight, check which parts of your system still work when the model, network, vendor, or company does not. Write the answer somewhere local. Then leave the page open. We are not finished. Only slightly less surprised.
