Sandboxes, Supervisors and Underground X-rays · Morning Gist
Sunday, November 15 stories · 16 min
Sandboxes, Supervisors and Underground X-rays
Today's stories look at how far AI can be trusted with code, money and medicine, and what keeps it in check when it can't.
Picked from 51 new articles across 23 sources · arrow keys for other days
Today in 30 seconds
30s left
A third-party math library let researchers escape ChatGPT's HTML preview sandbox. OpenAI fixed it and paid a $5,000 bounty, which Simon Willison calls too low. story 1 ↓
Wealth firm Arca runs AI agents on ten-day tasks. Hard-coded rules keep trades and money movement with human advisors. story 2 ↓
Six drug-development partners used Claude for lead optimization, manufacturing checks and trial planning. Anthropic reports lab results, but nearly all of them are still pre-human. story 3 ↓
Google's certified tuberculosis X-ray tool now runs in about 40 facilities. Indonesia is fine-tuning Google's open medical models on its own scans. story 4 ↓
Kimi K3.1 Pro scores near the top of benchmarks but gets mixed reviews from people using it, more evidence that leaderboards hide real weaknesses. story 5 ↓
1/5Simon Willison· Oct 31
Researchers found a sandbox escape in ChatGPT's HTML previews; OpenAI fixed it
Parameter Labs found a way for untrusted code in ChatGPT's HTML previews to escape its sandbox and reach signed-in users' private data through a shared link. OpenAI has fixed it.
Why it matters · AI products increasingly run untrusted, model-generated code in the browser. This bug shows the sandbox is only as strong as every library on the page around it.
Know this first
Context from the editor, not the article · 41 sec
1 · Artifacts and HTML previews
Chat assistants can generate small interactive web apps and show them live inside the chat. This is often called the artifacts pattern. ChatGPT's version used to be called Canvas and is now called HTML previews. The code can come from the model or from an attacker, so it has to be treated as untrusted.
2 · Sandboxed iframes
An iframe is a web page embedded inside another page. The sandbox setting tells the browser to cut the embedded page off from its host, so it can't read the host's data or use the user's login. The two can still exchange messages, and the host's code decides what to do with them.
3 · Content Security Policy
2/5Latent Space· Richard MacManus· Oct 31
How wealth firm Arca runs AI agents on ten-day tasks with humans approving
Arca, a wealth-management firm built around AI, uses agents for financial work that can stretch over ten days. Per-client memory tracks progress. Fixed rules keep trades with human advisors, and agent-written code is screened before it touches client data.
Why it matters · It is a concrete production pattern for putting agents in a regulated domain: hard-coded permissions, durable memory, and owning the harness. These choices carry over to other high-stakes software.
Know this first
Context from the editor, not the article · 34 sec
1 · What an AI agent is
An agent is a language model run in a loop. It reads a goal, decides which tool to call (search, run code, query a database), sees the result, and repeats until done. The model reasons; the surrounding software decides what it may actually do.
2 · What a harness is
The harness is the code around the model. It builds prompts, routes calls, exposes tools, stores state, and enforces limits. You can build your own, or use a managed one from a model vendor, which is easier to start with but ties you to that vendor.
3 · Prompt injection
3/5Anthropic· Oct 27
Anthropic reports early lab results from using Claude across drug development
Anthropic worked with six drug companies, using Claude to design antibodies, improve candidate drugs, and check manufacturing and regulatory paperwork. Partners report large lab gains and big time savings, but nothing has reached human trials yet.
Why it matters · It's a test of whether AI agents can do real work across a long, regulated, multi-stage process, with measured results from labs instead of benchmark scores.
Know this first
Context from the editor, not the article · 36 sec
1 · How drugs get made
Drug development runs in stages: pick a biological target, find early candidate molecules ("hits"), refine the best ones ("leads"), work out reliable manufacturing, file paperwork with regulators, then run clinical trials in humans. Most candidates fail along the way. The whole process often takes more than a decade.
2 · Antibodies as drugs
Antibodies are Y-shaped proteins the immune system uses to grab specific molecules. Many modern drugs are engineered antibodies. A useful one has to bind its target tightly, stay stable through manufacturing and storage, and not clump together. Improving one property often makes another worse.
3 · Preclinical versus clinical
4/5Google Research· Oct 23
Google's tuberculosis X-ray AI moves from research papers to clinics and open models
Google turned its tuberculosis chest X-ray AI into an EU-certified tool, built by partner Nexus AI, that has read 25,000+ scans in Africa. It now also releases open models that health ministries tune and run themselves.
Why it matters · It shows the full path from a working model to a regulated, deployed product, and argues that open weights you can run locally beat a hosted API when data must stay in the country.
Know this first
Context from the editor, not the article · 37 sec
1 · Why TB screening is hard
Tuberculosis is a curable lung infection that still kills over a million people a year. Spotting it usually starts with a chest X-ray, but reading one takes a radiologist. In poor and rural areas radiologists are scarce, so scans can wait weeks and infected people keep spreading the disease.
2 · Screening versus diagnosis
A screening tool doesn't diagnose. It flags people who probably have the disease ("presumptive TB") so a confirmatory test, such as a molecular test of a sputum sample, can follow. Sensitivity, meaning the share of true cases caught, matters most, because a missed case goes untreated.
3 · Foundation models and fine-tuning
5/5Interconnects (Nathan Lambert)· Nathan Lambert· Oct 25
Kimi K3.1 Pro scores near the top on benchmarks but gets mixed reviews
On a podcast, Nathan Lambert and Florian Brand ask why Kimi K3.1 Pro gets mixed reviews despite top-tier benchmark scores. They also discuss why the wave of AI-found security flaws hasn't yet turned into mass attacks.
Why it matters · Leaderboard scores now hide real weaknesses, and the code you depend on is being searched for bugs faster than ever.
Know this first
Context from the editor, not the article · 39 sec
1 · Open-weight versus closed models
A closed model, such as most from OpenAI or Anthropic, is reachable only through the company's API, so the company can watch usage and update its safety filters at any time. An open-weight model publishes its trained parameters. Anyone can download and run it, and anyone can modify it, including stripping out its refusals.
2 · How models are trained
Pretraining teaches a model general knowledge from huge amounts of text. Mid-training then shifts the data mix toward chosen skills. Post-training, often done with reinforcement learning (RL), rewards the model for good outputs. The data chosen at each stage decides what the finished model is good and bad at.
A Content Security Policy (CSP) is a set of rules a website gives the browser about which scripts it may run, usually an allowlist of trusted domains. It's a second line of defence: even if an attacker gets markup onto the page, the policy should stop that markup from running code.
Parameter Labs, a security research group, found a way to break out of the sandbox around ChatGPT's HTML previews. Simon Willison summarised the research. Through a shared ChatGPT link, an attacker could steal a signed-in visitor's private data or act in their account. OpenAI has fixed the hole and paid a $5,000 1. Willison calls the amount "a bit cheap for a vulnerability this serious."
The boundary
HTML previews, formerly called 2, display small interactive web apps inside a chat. The code may be written by the model or planted by an attacker, so ChatGPT runs it in a 3: an embedded page the browser cuts off from the main site. Willison stresses why that matters. Code inside the preview must never reach OpenAI's APIs, the endpoints that return your conversations and account data.
How it broke, in outline
The weak spot wasn't OpenAI's own sandbox code. It was 4, an open-source JavaScript library ChatGPT uses for math and graphs. MathLive's on-screen keyboard listened for messages from embedded frames, which arrive through a browser feature called postMessage(). It then wrote part of each message into the main page using innerHTML, which turns text into live page elements. It didn't check which frame was sending. An untrusted preview could therefore change the main page, which is exactly what the sandbox is meant to prevent.
A second defence, the 5 (a browser-enforced list of where scripts may come from), should have stopped that from turning into running code. But the list included YouTube, and one YouTube endpoint could be made to return script the browser would run. With code running on ChatGPT itself, Willison writes, reading and leaking private data was "trivial."
Why it matters
Each weakness looked minor on its own. Chained together, they defeated two layers of protection. The lessons apply to anyone building apps that run untrusted code:
Check which frame sent each message, and never treat message contents as HTML.
Remember that every third-party library runs with your page's full privileges.
Keep script allowlists narrow, because one permissive domain can undo the whole policy.
The summary doesn't say how long the flaw was live, whether anyone exploited it, or exactly how OpenAI fixed it.
Parameter Labs, a security research group, has published how it found a sandbox escape in ChatGPT's HTML previews. HTML previews are the feature that shows custom interactive web apps inside a conversation. Simon Willison summarised the research on his link blog.
The impact was serious. An attacker could create a ChatGPT share link, and a signed-in user who opened it could have their private data stolen or actions taken in their account. OpenAI has fixed the problem and paid a $5,000 1. Willison calls that "a bit cheap for a vulnerability this serious."
Why the sandbox matters
HTML previews follow the artifacts pattern: the assistant produces a small HTML app and the interface runs it. The code may have been written by the model or planted by an attacker through a prompt or a shared conversation, so it can't be trusted. ChatGPT loads it in a 2, an embedded page the browser walls off from the main ChatGPT page.
Willison stresses why that wall matters. Code inside the preview must never reach OpenAI's APIs, the web endpoints that return your conversations and account data. If it could, any shared preview would become a way to hijack whoever viewed it.
Where it went wrong, in outline
The researchers' route out of the sandbox didn't go through OpenAI's own preview code. It went through a library the page around the preview loads. ChatGPT uses 3, an open-source JavaScript library for typing and displaying mathematical notation, as part of its graphing support. MathLive includes an on-screen virtual keyboard.
Sandboxed frames can send messages to the host page through a browser feature called postMessage(). MathLive's keyboard listened for such messages and inserted part of what it received straight into the main page's HTML. It used innerHTML, a browser feature that turns text into live page elements. Nothing limited which frames could send those messages, so an untrusted preview could change the host page's content. That breaks the basic assumption behind the sandbox.
The page had a second defence, a 4 (CSP), the browser-enforced rule set that controls which scripts may run. It blocked scripts written directly into the page and allowed only a short list of trusted domains. According to the write-up, one allowed domain, YouTube, offered an endpoint that could be made to return script the browser would run. That turned the trusted domain into a way around the policy. Willison doesn't describe the details here, and this summary leaves them out.
Once the researchers could run their own code on the main ChatGPT page, they had the visiting user's session. Willison describes reading private data and sending it out as "trivial" at that point.
Lessons for engineers
The individual weaknesses are well known. Each one looked minor in isolation. Together they defeated two layers of defence:
Message handlers are an attack surface. Code that receives messages from other frames should check which frame sent each message and never treat the contents as HTML. Here, a library's convenience feature quietly accepted input from frames it was never meant to trust.
Dependencies inherit your trust. MathLive ran with the full privileges of the ChatGPT page. One careless line in a math-keyboard component was enough to pierce a boundary OpenAI had designed with care.
Script allowlists are only as strong as their weakest entry. Allowing a large domain like YouTube means trusting every endpoint it serves. If any of them can return attacker-shaped content, the policy can be bypassed.
Shared links widen the impact. A share URL turns a bug that needs a victim to do something into one that only needs a click.
What the summary leaves open
Willison's post is short. It doesn't give dates, say how long the flaw was exploitable, or say whether anyone abused it before the fix. It doesn't describe OpenAI's specific remediation either: whether it patched the library, restricted message senders, tightened the policy, or did all three. Readers who want those details will need Parameter Labs' original write-up.
Willison's view on the payout stands as his opinion. Given the reach of a one-click account takeover on a service as widely used as ChatGPT, he argues $5,000 undervalues the finding.
Remember
The escape route ran through a third-party math library, not OpenAI's own sandbox code.
One permissive domain on a script allowlist can undo a whole Content Security Policy.
Share links turn a browser bug into a one-click account takeover.
Prompt injection is an attack where text the agent reads, such as an email or a document, contains instructions that hijack it. Because models can't reliably tell data from commands, safety rules that depend on the model obeying them can be bypassed.
Image from Singh's talk, shown alongside his point that Arca's agent tasks can span up to ten days.1 / 4
At the AI Engineer New York conference, Latent Space interviewed Aman Singh, lead AI engineer at Arca, an "1" wealth-management firm. Agents do most of the background work there, but human advisors make the final decisions. Singh puts it this way: "agents prompt people more than people prompt agents." The agent moves the work along and asks people for decisions.
The problem: work that stops and starts
Singh says financial tasks are long-horizon but not long-running. A single task can take up to ten days, but the agent isn't computing that whole time. The work is "very stop-start," with "many actors in between, many decision points, many handoffs": advisor reviews, client documents, approvals. A language model forgets everything between sessions, so anything it needs later has to be stored outside it.
How Arca handles it
Per-client memory. Agents write to an internal memory system that tracks, for each client, what has happened, what's due in the next few days, what's being watched long-term, and who owns each action. It acts as a shared case file. The article doesn't describe how it's built.
An owned 2. The harness is the code around the model that builds prompts, calls tools and enforces limits. Arca wrote its own. Claude, from Anthropic, is its main model, and it also uses OpenAI. The harness sends each task to whichever model scores best on Arca's 3, and it lets Arca switch providers if needed.
Deterministic safety. Agents only analyze and propose. Trades and money movement stay with human advisors. "All of our safety restrictions are fully deterministic," Singh said. The limits live in code, not in prompt instructions, so an agent hijacked by 4 (malicious text that smuggles in commands) still has no tool for moving money.
Code that gets thrown away. Agents write code to query and reshape client data inside 5, isolated environments for running code. Arca doesn't run that code against its backend. It translates the code into "a strict format that we expect," discards the original, and applies guardrails to that format. Agents can work freely, but only checkable requests reach real data.
A 6. Advisor feedback and agent 7 (step-by-step logs) go to a "meta-agent" that proposes changes to the harness.
Caveats
The article is a short podcast companion. It gives no figures on accuracy, time saved or how often advisors override agents. Treat it as an architecture sketch from a practitioner, not proof that the approach works.
At the AI Engineer New York conference, Latent Space interviewed Aman Singh, lead AI engineer at Arca. Arca calls itself an "1" wealth-management firm: it advises clients on investments, taxes and financial plans. Agents do most of the background work there, but human advisors make the final calls. Singh's summary of the design: "agents prompt people more than people prompt agents." In practice the agent drives the workflow and asks humans for decisions, rather than waiting for a human to tell it what to do.
The write-up is short, a companion to a podcast and a talk. The outline below covers what it says, and points out where it leaves out detail.
The problem: long-horizon, not long-running
Singh draws a distinction. Financial work is long-horizon but not long-running. One task can stretch over as long as ten days. The agent is not computing for ten days, though. The work is "very stop-start, there's many actors in between, many decision points, many handoffs."
Here is an illustrative case, based on a podcast segment titled "Handling a $100,000 tax bill." An agent spots a large tax liability and drafts options. Then it waits for an advisor to review them. Then it may need documents from the client, then an accountant's input, and finally an approval. Each pause can last days.
That is hard for agents. A language model keeps nothing between sessions. Anything it needs to pick up later must be stored outside the model and fed back in.
Mechanism 1: per-client memory
Arca built an internal memory system that agents write to. For every client it records:
what has happened so far
what needs to happen in the next couple of days
what is being tracked over the long term
which person owns which action
This works like a shared case file. Any agent or person who picks up the work can see where it stands. The article does not say how this memory is stored, structured, or kept consistent when several agents write to it at once.
Mechanism 2: an owned, routing 2
Arca uses models from frontier labs, including OpenAI and Anthropic, with Anthropic's Claude as its main provider. It built its own harness instead of using a managed one. The harness picks a model for each task based on Arca's 3. These are tests the company has built to measure how well each model handles its kinds of work.
Owning the harness has two benefits. First, routing per task: different jobs can go to different models. Second, portability: Arca can switch providers if pricing, quality or availability changes. The cost is that Arca has to build and maintain that infrastructure itself. The article does not say which benchmarks are used or how the routing decides.
Mechanism 3: deterministic safety
Agents may analyze and propose. Trades and any other money movement go to a human advisor. Singh: "All of our safety restrictions are fully deterministic… they take the decision making off the agent's hands."
Deterministic means the limits are enforced by ordinary code, not by instructions in a prompt. The agent can run some tools by itself, but tools that put client money at risk are not open to it. That is why the design holds up against 4. Suppose a malicious document persuades the model to "transfer funds." The model still has no tool that can do it. Arca also runs checks for known AI security issues, prompt injection among them.
Mechanism 4: code that gets thrown away
This is the most technically interesting part. The agent itself is not sandboxed, but it runs computations in 5, which are isolated environments where code can't reach the wider system. Agents write code to query client data, so they can aggregate it, "munge" it (clean and reshape it), and turn it into outputs such as a financial plan.
Running arbitrary agent code against sensitive data is risky, so Arca adds a step. In Singh's words, a system "translates the code it wrote into a strict format that we expect, throw away the code, and you install guardrails on that format before it reaches your back end."
Here is one way to picture it (an interpretation; the article does not give details). The agent writes a Python script that filters a client's transactions and sums the fees. Arca does not run that script against the database. It pulls out the query's intent, for example "read transactions for client X, columns Y and Z, grouped by month," and expresses it in a narrow, structured form. Policy checks run on that structured request: is this client in scope, and are these fields allowed? Only then does it reach the backend. The original code is thrown away. SQL parameterization works on a similar idea: never execute what you were handed; translate it into a constrained form you can check.
Mechanism 5: improving the harness from feedback
Advisors give feedback on agent output. Arca combines that feedback with agent 6, the step-by-step logs of what the agent did. A "7" analyzes all of it and suggests changes to the harness. A podcast segment also mentions turning staff feedback into 8 (repeatable tests) and turning operational knowledge into agent context. The article does not say whether a human reviews the meta-agent's suggestions before they ship, though that would be the expected safeguard.
What's missing
The article reports no measurements: no error rates, no time saved, no data on how often advisors override agents, no comparison between models. Podcast segments on compliance and auditability, and on checking financial facts with "decision models," are listed but not summarized. Treat this as an architecture sketch from a practitioner, not evidence that the design works. The pattern is still useful: memory outside the model, permissions in code rather than prompts, and agent code converted into checkable requests.
Remember
Put safety limits in code, not prompts: if an agent has no tool that moves money, prompt injection can't make it move money.
Treat agent-written code as a request: turn it into a strict, checkable format and throw the original away.
Multi-day agent work needs memory stored outside the model, recording state, next steps and who owns each action.
"Preclinical" means work done in test tubes, cells or animals before any human testing. Promising preclinical results often fail in people. So gains reported at this stage are real but provisional: they show a candidate is worth pursuing, not that it works as a medicine.
Claude "skill"
A packaged set of instructions and tools that teaches Claude to perform one specific task.
Image: Anthropic
Anthropic has published early results from using Claude, its AI model, inside real drug development work. It partnered with six organizations and also started drug programs of its own. Anthropic argues that drug development is slow at every stage, not only at molecule design, so it put Claude to work at each stage. Most of the results are 1: they come from cells, test tubes or mice, not human trials.
What partners reported
Generate Biomedicines works on 2, which reprograms a patient's immune cells to attack cancer. Its scientists used 3, Anthropic's coding agent, to redesign part of the therapy's genetic instructions. One design was about 70% shorter than the standard version. In lab tests, cells made roughly 10x more cancer-detecting receptors and killed tumor cells more efficiently.
Divergence Labs is targeting food allergies. These are caused by 4, an 5 that sits on immune cells and also floats in the blood. Claude generated about 35,000 antibody designs in a month, working mostly on its own. Lab screening found 3 that bound IgE and 20 that pulled it off immune cells. Three of those beat the standard drug.
BigHat Biosciences used Claude to improve two candidate antibody fragments. Its automated lab tested about 1,010 variants in 10 weeks. Claude and a researcher also noticed that standard stability metrics were misleading and proposed better ones, which tests confirmed. The best variants bound their target more than 10x more tightly, and one clumped more than 100x more slowly.
Enveda had Claude check 1,061 pages of manufacturing records. It caught all 11 issues human reviewers had found, plus 7 they missed, and cut review time by 89%. One regulatory draft took four hours instead of about three months.
The Column Group is launching Pleiades, a company built to run many drug programs with Claude. Bristol Myers Squibb is testing Claude on clinical trial planning. Neither has reported numbers yet.
Anthropic also bought Mithril Medicine, a one-person company working on rare muscular dystrophies. Using Claude to coordinate 11 outside labs, its founder took a candidate from idea to promising mouse results in under 18 months. Human trials could start as soon as late 2028.
Caveats
Promising preclinical results often fail in people. The figures come from partners and mostly compare against each team's own baseline. Humans stayed closely involved throughout. The clearest measured gain is in paperwork: Enveda's review-time savings. Anthropic plans to expand into clinical-stage work and to give researchers wider access to its models.
The news
Anthropic's life sciences team has published an update on several months of research partnerships with six organizations developing medicines: BigHat Biosciences, Bristol Myers Squibb (BMS), Divergence Labs, Enveda, Generate Biomedicines and The Column Group. Anthropic has also started drug programs of its own. The post links to technical reports from the partners, but the numbers below come from Anthropic's summary.
Anthropic's argument is that AI in medicine is usually discussed as "propose a new molecule," but the slow parts of drug development are spread across every stage. In its words, "there is no single problem to solve; the bottlenecks are distributed all throughout." So the strategy is to embed Claude in real drug programs at different stages and see where it helps and where it fails. Anthropic says it has already reprioritized model improvements based on what it learned, though it doesn't say which ones.
Stage by stage
Re-engineering a therapy (Generate Biomedicines).1 takes a patient's immune T cells and gives them genetic instructions to build a receptor that recognizes cancer. It works well for blood cancers but much less well for solid tumors. Generate wants to shorten one part of those instructions to make room for extra instructions suited to solid tumors. Six Generate scientists used 2, Anthropic's agentic coding tool (an AI that writes and runs code on its own), to propose new designs for that part. One design was about 70% shorter than the standard one. In lab tests it also performed better: cells made roughly 10 times as many receptors, killed tumor cells more efficiently and stayed active for longer.
Generating 3 (Divergence Labs). Food allergies are triggered by 4, an 5 that sits partly on immune cells and partly floats in the blood. Standard drugs neutralize the free-floating IgE. Divergence wants to pull IgE off the immune cells entirely. That needs a two-armed molecule: one arm grips IgE, the other pries it loose. Claude turned the company's goals into a design plan, then, "largely autonomously," generated about 35,000 antibody designs in about a month for screening. Lab tests found three designs that bound IgE and 20 that dislodged it. Three of those 20 seemed to dislodge more IgE than the standard medication. The two arms still have to be combined into one drug.
Optimizing 6 (BigHat Biosciences). BigHat pairs AI with an automated lab. Claude was connected to Reccy, BigHat's lab data system, and proposed changes to two antibody fragments: one aimed at cancer cells, and one meant to keep a drug in the body longer. The lab built and tested about 1,010 variants in roughly 10 weeks. The most interesting episode was not a design at all. Partway through, the team suspected the standard metrics for heat stability and clumping were misleading. Claude and an Anthropic researcher reanalyzed the raw data, proposed different metrics and a change to the lab protocol to test them. BigHat's scientists refined and ran the test, and the main predictions held. Compared with the originals, the best variants bound more than 10x more tightly. The cancer lead stayed dissolved at temperatures 18°C higher, and the longer-lasting lead clumped more than 100x more slowly.
Manufacturing and filings (Enveda). Before a clinical trial, a company needs records showing each batch was made to strict quality standards, plus applications to regulators. Enveda's manufacturing chemists spent up to 75% of their time on paperwork. Enveda connected its manufacturing documents to Claude and had it flag possible issues. On 1,061 pages, Claude caught all 11 issues human reviewers had found, plus seven they had missed. Human review time fell 89%, from more than 25 hours to under three. Claude also drafted two regulatory documents. One took four hours instead of about three months by hand. Enveda's normal human review found one minor error in the other. The post doesn't say how many false alarms Claude raised, which affects how much reviewer time is really saved.
Company creation (The Column Group). Anthropic argues that because discovery is slow and failure-prone, investors favor already-validated ideas. The Column Group is setting up Pleiades, a company meant to run more drug programs, and more complex ones, than a small team normally could, with Claude carrying the scientific and administrative load. So far the only reported output is its first Claude "skill," a packaged set of instructions and tools for one task. This one judges whether a drug target is worth pursuing, and it has been evaluated on 45 target–disease pairs. No accuracy figure is given.
Clinical trial planning (BMS). BMS is using Claude to assess trial plans for an early-stage drug and estimate the odds of success. Its quote says that from one prompt, Claude produced an initial analysis that would otherwise take days. No quantitative results are given yet. The work is set to expand in 2027.
Anthropic's own program
Anthropic acquired Mithril Medicine, a one-person company working on two rare childhood forms of muscular dystrophy. Its founder, Cody Tranbarger, used Claude to manage contracts, logistics and experiments across 11 external labs. He took one candidate from idea to promising results in mice in under 18 months. If it holds up, Anthropic expects human trials could start as soon as late 2028.
How to read the numbers
Most of this is 7: test tubes, cells, mice. Many candidates that look good at this stage fail in humans, so these are signs of speed and quality in early stages, not new medicines. The results also come from partners with a stake in good outcomes. Most comparisons are against each team's own starting point or usual workflow, not against other computational methods. Humans stayed in the loop throughout. In the BigHat case, the key insight came from a researcher and Claude working together, and scientists refined the resulting protocol.
The strongest evidence for the "bottlenecks everywhere" thesis is the least glamorous: the Enveda paperwork result, where the time savings are directly measured and the comparison with human reviewers is clear.
What comes next
Anthropic plans to scale this work up and push Claude into clinical-stage programs. It is also widening access through Claude Science, its research workbench, plus credits for life scientists and an open call for guest investigators. It has also launched a Life Sciences Verification Program, which lets vetted organizations use its strongest models with looser safety safeguards. Those safeguards exist to prevent biological misuse, but Anthropic says they can block legitimate research. The post doesn't explain how vetting works.
Remember
Claude's measurable wins ranged from molecule design to quality-control paperwork, which supports Anthropic's view that bottlenecks are spread across all of drug development.
BigHat's notable result was Claude helping spot misleading lab metrics, scientific judgment rather than just generating designs.
No program has reached human trials. The earliest, a muscular dystrophy drug, might start in late 2028.
A foundation model is a large model pretrained on broad data that others adapt to a narrow task. Fine-tuning retrains it a little on a small local dataset. "Open-weight" means the trained parameters are downloadable, so anyone can run the model on their own hardware.
Image: Google Research
Google Research and Google for Health used IDWeek 2026, an infectious-disease conference, to give an account of their tuberculosis (TB) screening work. It began as a research model that reads chest X-rays and is now a certified medical device in African clinics, alongside open models that countries adapt for themselves.
The bottleneck
TB is curable but kills more than 1.23 million people a year. Screening starts with a chest X-ray, and spotting the subtle signs, such as fluid at the top of the lung or holes in lung tissue, takes a radiologist. In poor and remote areas radiologists are scarce, so cases go unnoticed and keep spreading.
Proving it works
In 2019 the team showed in the journal Radiology that 1, meaning neural networks trained on labelled images, could detect active TB as well as experienced radiologists. In 2021 the Stop TB Partnership independently compared 2 software, programs that flag abnormalities on scans, and ranked Google's model among the best. A 2024 prospective study across several sites, in which patients were enrolled and screened going forward, found it kept high 3, the share of real cases caught. The post doesn't give the accuracy numbers.
Crossing the "translation gap"
A published model isn't yet a bedside tool. It has to work on different X-ray machines, run offline and pass regulators. Nexus AI, a company in Pretoria, built the product and earned EU medical-device certification (4) and the 5 quality standard. It is now pursuing World Health Organization prequalification, which international agencies need before they can buy it, and US FDA clearance.
The tool runs in about 40 facilities across six African countries. More than 90 clinicians have read over 25,000 X-rays with it, and turnaround fell from weeks to under 45 seconds. Clinicians still make the final decision. At South Africa's Mponeng Gold Mine, portable X-ray kits with offline AI screen miners four kilometres underground. Anyone flagged goes straight to a confirmatory test, all in one visit.
Open models
Google then shifted from one product to releasing open building blocks. 6 is a small model that links medical images to clinical text, so it can be adapted to a new task with only a few local examples. 7 is a family of open-weight models with 4 and 27 billion parameters. It combines X-ray findings with patient history, answers clinicians' questions, and runs offline. It has passed 10 million downloads.
Indonesia, which has the world's second-highest TB burden, wants to screen 50 million people a year. Its health ministry is fine-tuning both models on Indonesian X-rays and running them on its own servers, so patient data stays in the country.
For places with no X-ray machine, a model called 8, trained on 300 million audio clips, screens for TB from smartphone recordings of coughs. Field trials in Zambia and Ghana are still gathering evidence. The post reports no field accuracy or patient outcomes.
Google Research and Google for Health used IDWeek 2026, an infectious-disease conference in Washington, D.C., to give an account of their tuberculosis (TB) screening work. It started as a research model that reads chest X-rays and is now a certified medical device in African clinics plus a set of open models that countries adapt themselves. The post is a programme overview, not a paper. It gives deployment numbers but no new accuracy figures.
The problem
TB is preventable and curable, yet the post says it kills more than 1.23 million people a year. The bottleneck it names is radiology. The first step in screening is a chest radiograph (CXR, a chest X-ray), and the signs of TB on one are subtle. Two examples are apical infiltrates, which is fluid in the top of the lung, and cavitary lesions, which are holes where lung tissue has been destroyed. Reading these takes a trained radiologist. In high-burden places, from remote villages to deep mines, there may be no radiologist nearby and no imaging for days. Cases go undetected and the disease keeps spreading.
Step 1: show the model works
The team published a benchmark in the journal Radiology in 2019. It showed that 1, meaning neural networks trained on many labelled images, could detect active pulmonary TB as well as experienced radiologists.
The authors stress that their own results weren't enough. In 2021 the Stop TB Partnership, a UN-hosted coalition, compared 2 software, meaning programs that flag abnormalities on medical images, across varied patient groups. The comparison appeared in The Lancet Digital Health and ranked Google's model among the best TB screening algorithms worldwide. The World Health Organization (WHO) recommended CAD for TB screening and triage that same year. In September 2024 the team published a prospective study in NEJM AI, meaning patients were enrolled and screened going forward rather than drawn from an archive. It covered several sites and found that AI-assisted screening kept high 3, the share of real cases caught, across different populations. It also picked up unrelated lung and heart abnormalities. The post doesn't give the sensitivity or specificity numbers from any of these studies.
Step 2: the "translation gap"
The authors call the distance between a published model and a trusted bedside tool the "translation gap." Closing it means making the software reliable across different X-ray machines, letting it run offline, fitting it into how clinics actually work, and passing medical-device regulation.
For this Google partnered with Nexus AI, a medical technology company based in Pretoria, which turned the algorithms into a clinical product:
4: certification under the EU's Medical Device Regulation (2017/745). Class IIb is a higher-risk tier, and the post says certification relied on prospective clinical evaluations.
5: the international quality-management standard for medical-device makers.
WHO Prequalification (WHO PQ): Nexus signed an agreement with FIND, a global diagnostics non-profit, to pursue it. Prequalification matters because international agencies buy through it. A US Food and Drug Administration (FDA) clearance pathway is also under way.
Step 3: deployment
The tool runs in about 40 facilities. It is live in South Africa, Sierra Leone and Côte d'Ivoire, with expansion under way in the Democratic Republic of the Congo, Zambia and Cameroon. More than 90 clinicians have used it on over 25,000 chest X-rays. The post says turnaround dropped from weeks to under 45 seconds. Clinicians still make the final call, so the AI does triage, not diagnosis. Nexus has given more than 3,000 free screenings to under-resourced public clinics and aims for 10,000 sponsored screenings a year.
The most striking deployment is at the Mponeng Gold Mine in South Africa, one of the world's deepest mines. Miners there breathe silica dust and face higher rates of lung disease. Working with the Stop TB Partnership, Harmony Gold and the South African Department of Health, Nexus put ultra-portable digital X-ray kits and offline AI four kilometres underground. A miner is screened in seconds. If flagged, he goes straight to confirmatory molecular testing. Screening, triage and confirmation that used to take weeks now happen in one visit. Running offline is the key engineering requirement here, since there is no cloud connection at that depth.
Step 4: from one product to open foundations
One product with one partner can't cover the global TB burden, so Google shifted to releasing building blocks. Under Health AI Developer Foundations (HAI-DEF) it open-sourced two things:
Chest X-ray embeddings: compact numerical summaries of an image that small downstream models can be trained on.
6: a lightweight vision-language model trained to match medical images with the clinical words used to describe them. Because images and text share one representation, a developer can classify or search images using plain-language labels, for example by checking which caption an X-ray is closest to. It can also be fine-tuned on a small set of local examples. The authors say this gives strong results on modest regional datasets without heavy compute.
On top of that came 7, a family of open-weight multimodal models with 4 billion and 27 billion parameters. MedGemma goes beyond classification. It combines X-ray findings with a patient's clinical history, answers clinicians' questions in natural language, and runs on-device without internet. The post reports more than 10 million downloads. It doesn't report MedGemma's accuracy on TB.
Indonesia: data sovereignty
Indonesia has the world's second-highest TB burden. Its Ministry of Health wants to screen 50 million people a year. Reading that many X-rays by hand is impossible, and proprietary cloud software would send patient data abroad, a data-residency problem. Instead, the ministry is fine-tuning MedGemma and MedSigLIP on Indonesian chest X-rays and running them on its own infrastructure, so the data never leaves the country. This is the article's strongest case for open weights. The value comes from being able to retrain the model on local data and host it yourself, not from the model being free.
Cough sounds: 8
Many remote health posts have no X-ray machine at all. For those, Google built Health Acoustic Representations (HeAR), a model trained on over 300 million audio clips. It screens from cough sounds recorded on an ordinary smartphone. Researchers are testing it with CIDRZ in Zambia, the Aurum Institute in Ghana (backed by a $250,000 Google.org grant), and HELINA's $1.5 million regional collaboration. The post describes this as clinical evidence still being built, not a proven screen.
Google pictures the pieces as a cascade. A cough recording triages first, a mobile X-ray screens next, and MedGemma helps with clinical reasoning.
What's left open
The post is light on outcomes. It gives no accuracy figures from the field deployments and no count of cases found or treated. It also doesn't say how MedGemma performs on TB compared with the certified CAD tool, or how fine-tuned national models will be validated and regulated. Its main claim is about process: rigorous studies, then regulatory work, then local partners, then open models that others can own.
Remember
Closing the "translation gap" took a commercial partner, prospective trials, and EU and ISO certification, years after the 2019 paper.
Running offline is a hard requirement: the mine deployment works four kilometres underground with no network.
Indonesia chose open weights so it can fine-tune on national data and keep patient records inside its borders.
Over the past year, frontier models have become good at finding security bugs in real code. AI labs now run vetted-access programs that let defenders use these abilities. The open question is whether attackers will gain more than defenders, and whether open-weight models change that balance.
Image: Interconnects (Nathan Lambert)
Kimi K3.1 Pro is a new model of roughly three trillion parameters from the Chinese lab behind the Kimi series. On the 1, a widely watched leaderboard, it places about fourth. Only two Claude 5.5 models and Muse Wonder Full rank above it, and it beats OpenAI's GPT-6 Astra. Even so, early users are split. Nathan Lambert, who writes the Interconnects newsletter, and evaluation researcher Florian Brand spent a podcast episode working out why.
Strong headline scores, weak spots further down
Kimi's own blog post shows the gaps. On Terminal-Bench Science it trails GPT-6 Astra by about 20 points, and it does worse on ProgramBench. Brand's explanation is that Artificial Analysis mostly uses short tasks with a clear goal. ProgramBench is long and open-ended, so the model has to explore before it knows what the solution looks like. He suspects Kimi's 2 (RL, training that rewards good outputs) pushed the model toward finishing well-defined tasks rather than exploring.
Lambert argues that this is a real problem for a model this big. A three-trillion-parameter model is slow and expensive to run. Brand notes that each copy of the model needs its own node of Nvidia 3 GPUs, while a 700-billion-parameter model fits on the more common H200s. If the big model doesn't explore better, a smaller, faster model like DeepSeek-V4.1-Flash does routine coding nearly as well for less money. The weights are due by November 4, after two weeks in which only Kimi can serve the model.
Holding back cyber skills on purpose
Kimi says it does not release open weights that would push the frontier of hacking ability forward. During 4, the stage where the data mix is steered toward chosen skills, it reduced the share of cybersecurity data, and it reports that the reduction held through later training. Brand thinks this is sensible. Finding and fixing bugs takes short tasks. A full break-in takes long chains of steps carried through every stage of an attack, and that is where closed models such as GPT-5.6 Sol still lead.
Lots of bugs found, few mass attacks so far
Researchers, including people in OpenAI's 5 program, found a years-old PHP bug that let anyone run code on a remote server. PHP powers much of the web, including WordPress. The fix was coordinated and released all at once. Brand says reports so far show no mass exploitation. In a separate incident, 6 was compromised again: an API key sat exposed on GitHub for five months before anyone used it to spread malware.
Lambert's view is that cyber experts see an ecosystem in which these numbers were already rising fast before ChatGPT, so this isn't mainly an open-versus-closed model story. His bigger worry is defense. Coding agents are producing far more code while the backlog of existing bugs is still being worked through.
Kimi K3.1 Pro is the newest model from the Chinese lab behind the Kimi series, with roughly three trillion parameters. It arrived with very strong headline numbers. On the 1, an independent leaderboard that combines many benchmarks into one score, it ranks about third or fourth. It sits behind the two latest Claude 5.5 models and Muse Wonder Full, and ahead of OpenAI's GPT-6 Astra. Early users are still split. Nathan Lambert, who writes the Interconnects newsletter, and Florian Brand, who specializes in evaluations, recorded a podcast to work out why. They then moved on to a bigger question: is the recent flood of AI-found security bugs really about open-weight models?
The launch itself
Brand points out that model launches have become professional very quickly. A year ago, labs published weights before popular inference software such as 2 supported them, so for a while almost nobody could run the model. Now support from inference tools and hosting providers arrives on day one. Labs also increasingly keep a model to themselves for a while first. K3.1 Pro gets about two weeks, and Kimi says the weights will be public by November 4.
The launch also drew criticism for its social media push. One screenshot appeared to show press instructions telling posters not to say they were paid. Lambert notes that nobody has corroborated it. Both hosts say paid promotion that isn't disclosed is bad practice, and that American labs do it too.
Why the scores and the reviews disagree
Kimi's own blog post includes weaker results further down. It is about 20 points behind GPT-6 Astra on Terminal-Bench Science and also weaker on ProgramBench. Brand separates benchmarks into two kinds:
Short-horizon, goal-given tasks. Artificial Analysis mostly uses these: "here is the goal, reach it."
Long-horizon, exploratory tasks. ProgramBench is one: "here is roughly what I want, and you have to explore to find out how."
His hypothesis is that Kimi's 3 (RL), the post-training stage that rewards the model for successful outputs, leaned toward exploitation, meaning reliably solving well-specified tasks, rather than exploration, meaning searching before you know what the solution looks like. Lambert's word for a model whose RL has been pushed too far this way is "a tiny bit RL fried."
Lambert argues this matters more for a big model. A three-trillion-parameter model is slow. For routine coding, a smaller open model such as DeepSeek-V4.1-Flash scores not far behind and runs much faster, and once you count actual token usage it may not cost very different amounts per task. A giant model therefore has to earn its keep on fuzzy, open-ended work. He compares it to how he uses Fable for "blurry" tasks such as checking slides, while Opus is "really grindy."
Serving costs make the point sharper. Brand explains that one copy of K3.1 Pro needs an entire node of Nvidia 4 GPUs. A model of around 700 billion parameters fits on H200s, which are much easier to find. Splitting a model across several nodes is awkward, so three trillion parameters is at the edge of what is practical to host. Lambert reads the new "Pro" name as a sign that a cheaper "Flash" variant is coming.
Turning down offensive cyber skills on purpose
The most unusual part of the release is a stated policy. Kimi writes that it aims not to release open weights that would extend the absolute frontier of cyber capability. It says K3.1 Pro's offensive skill is deliberately below what its training pipeline can produce. To get there, Kimi changed the 5 data mix, the stage between pretraining and post-training where labs emphasize chosen skills, to reduce cybersecurity content. It reports that the effect held through post-training.
Lambert asks whether this also hurt the model's long-horizon performance. Brand thinks the two can be separated. Defensive work, finding and patching bugs, mostly needs short tasks. A full intrusion needs long chains of steps carried through every stage of breaking into an organization, which is the capability Kimi removed. Brand says that is where closed models such as GPT-5.6 Sol are "way, way better" than open ones. He also sees the policy as smart positioning, because open models face much more scrutiny than closed ones.
"You can hack everything"
Lambert observes that cyber experts and AI people talk about this moment differently. Cybersecurity researchers look at the whole ecosystem. Measures such as how many vulnerabilities are found and how quickly they are exploited were already rising exponentially before ChatGPT, with no sudden jump when AI arrived. AI commentators argue instead about open versus closed models and about Mythos, a model whose hacking ability was presented as a step change. Lambert criticizes AI safety groups for a "boy who cried wolf" pattern of warnings. He also concedes that bugs are now being found in very large numbers.
Two recent incidents:
The PHP bug ("PHP2Shell"). A long-standing bug let attackers run code remotely on PHP websites, a huge share of the web that includes WordPress. OpenAI's 6 program and other researchers found it and coordinated a fix with the PHP Foundation, released all at once. Some sites went offline to patch. Brand says there are numerous reports that mass exploitation hasn't happened.
7. LiteLLM is a library that gives one interface to many model providers, and it was compromised again. The preliminary cause was an API key committed to GitHub and left readable for five months before someone used it to spread malware.
The hosts take the same lesson from both: the number of willing attackers looks small. Lambert cites Joshua Saxe, a security researcher who writes about AI and cybersecurity, who argues that the "supply chain" of hackers is weak. Brand adds that nation-states already had strong tools of their own. Lambert's real worry is defense. He cites Azeem Azhar's argument that this is "day zero of the new internet": coding agents produce far more code, models cannot catch bugs that come from how many systems interact, and the existing backlog is still unfixed.
Safeguards and access
Lambert calls companies such as Abliteration.ai and Morph, which serve 8 (versions with their refusal behavior stripped out) through an API, a bad judgment call. Running such a model on your own machines makes sense. Sending your data to someone else's API to use one does not. Brand credits vetted programs instead. OpenAI's defensive program requires an ID and hardware security keys. Anthropic is widening access. Both labs updated their filters to block requests for the PHP exploit, something only closed models can do instantly. Lambert also admits that his earlier claim, that open-weight Mythos would have been fine in April, should have priced in these trend lines.
Lighter topics
Lambert criticizes Anthropic's decision not to hire junior employees as a safety-culture blind spot. Brand says it simply helps everyone else hire. Brand also describes Muse, Meta's agent, filling his empty U.S. apartment: it is proactive and pays with one-time Stripe cards, but it is slow and its browser crashes.
Neither host claims to know what comes next. Lambert says the next few months may show whether anyone is actually willing to use AI for loud, damaging attacks.
Remember
Leaderboards built from short, clearly defined tasks can hide weak long-horizon exploration, which matters most for a huge, slow model.
Kimi deliberately reduced cybersecurity training data to cap its open model's offensive hacking skill below what its pipeline can produce.
LiteLLM was compromised through an API key left exposed on GitHub for five months, a reminder that basic hygiene still matters.
