Weight-Space Programming

Weight-Space Programming

Rikiya Takehi, Jayden Teoh, Alex Zhang, and Omar Khattab argue in a paper-length post that frontier LLMs can already read and write neural network weights directly, in natural language, with no gradient descent in the loop. Every experiment runs on GPT-6 Astra with full logs released, and the headline numbers invite more credit than the fine print supports. The reading results on small networks are the cleanest part. Handed the raw weights of four PPO policies with no list of candidate games, Astra named Breakout, Pong, Pac-Man, and Freeway correctly. Given only the middle transformer blocks of 7.2-million-parameter character-level models, it identified whether each was trained on Python, romaji, or English, and it found every induction head with no false positives, rediscovering a 2021 interpretability method on its own (more: https://rikiyat.github.io/blog/weight-space-programming).

The writing results are where the hype risk lives. In the result that went viral, Astra traced Qwen3.5-0.8B's math failures to thinking loops (85 of 96 practice answers hit the 32,768-token limit), located one direction in the layer 15 and layer 19 MLPs, and subtracted it from 64 output columns in each. That touched 0.016% of the weights, and with 50 forward passes of feedback MATH-500 went from 7.9% to 48.1%, GSM8K from 13.8% to 67.1%, and IFEval from 21.0% to 62.3%. A norm-matched random direction did nothing, and Hugging Face reproduced the edited model.

The r/LocalLLaMA thread caught the right caveat within hours: the gain is a loop fix, not new math. On Gemma 3 270M, which rarely loops, no edit moved MATH-500 beyond about a point, and the post concedes editing "could not add an ability the model lacked." The demonstrated capability is an LLM doing competent mechanistic debugging on small networks, with tools, then applying a surgical fix. The broader claims about backdoor detection and recursive self-improvement remain speculative by the authors' own framing (more: https://old.reddit.com/r/LocalLLaMA/comments/1xma0tw/gpt6_astra_edits_qwen_weights_math500_79_to_481/).

A related argument about how much progress is algorithmic rather than hardware comes from Nicholas Carlini, in the same pointless-computing register as his regex chess engine. He asks whether Deep Blue was ever necessary, then ports Stockfish 17 to a 200 MHz Pentium Pro with 64 MB of RAM and a much smaller NNUE. After re-tuning it reached 2846 Elo at one second per move and 3180 at thirty, extrapolating to roughly 3300 at classical time controls against Kasparov's sub-2800. Carlini attributes 720 of the 1,335 Elo points gained since 1996 to better programming, and the LLM parallel is explicit: "just how much are we leaving on the table" (more: https://nicholas.carlini.com/writing/2026/algorithmic-improvements-chess.html).

Benchmarks That Grade Themselves

Be The Adversary's second pass over its DGX Spark red-team bench is less a leaderboard than a confession about how leaderboards get made. Part 1's single local judge has been replaced by a nine-judge panel: seven open models on two GB10 Sparks plus two hosted frontier judges, one acting as master reconciler, grading 2,979 transcripts across security, red-team, and coding suites, with red-team coverage up from 4 models to 52. The nominal top all-rounder is DeepSeek-V4.1-Flash-REAP256, a community expert-pruned build, at 0.678 on a 0-to-1 scale. The Part 1 pick, Qwen3.6-35B-A3B, is missing from the combined board because of a keying bug the author chose not to hand-patch (more: https://betheadversary.com/posts/dgx_spark_red_team_bench_part2).

The author then dismantles the headline. On raw panel averages the leader's margin is 0.004 to 0.010, "a rounding error," carried by three security tasks, and it was graded while running at 7 to 11 tokens per second. The two DeepSeek judges rate DeepSeek models about 0.19 points higher on a 4-point scale, and the V4.1 judge gives itself a 0.41 bonus. The closing line is the useful one: "Before you trust what the model told you, check the thing that told you the model was right."

A Penn State paper puts a number on how much of an agent-security score is the benchmark rather than the model. Karamchandani and colleagues define threat-preserving representation sensitivity: change only what the agent sees, such as tool names, while holding task, harmful action, policy, and scorer fixed, and measure how attack success rate moves. Across 28,904 runs it moves a lot. In Agent Security Bench, where 80.6% of attacker tool names contain threat words, neutralizing the names alone raised committed attack success by 11.67 points on GPT-5-mini and 13.21 on Claude Haiku 4.5. In MCPTox, where names are neutral and the poison sits in descriptions, adding threat-explicit names lowered success by 11 points on GPT-5-mini, but a length-and-casing-matched neutral name reproduced 8.54 of those points, so the model reacts to surface shape, not the word "malicious." The blunt conclusion: a benchmark whose attacker tools are named like attacker tools understates what an adversary who controls naming will achieve by 11 to 13 points (more: https://arxiv.org/abs/2610.03585v1).

That discipline is missing from the Memdoor claim that five Qwen3.8-27B models, arranged as a planner, two ideators, a solver, and a manager, beat Fable 5 on LiveCodeBench Hard. Commenters supplied the missing controls: no single-Qwen baseline in prompt or agent form, no description of how the Fable 5 reference was run, and a contest set from spring 2025 against a Qwen knowledge cutoff of end of May 2025. The claim may be true; nothing in the post lets anyone tell (more: https://old.reddit.com/r/LocalLLaMA/comments/1xkxt7a/memdoor_a_team_of_5_qwen3827b_models_beats_fable/).

Supply Chain, Share Links, and Security Theater

Google Threat Intelligence says it and partners dismantled the XCPE backdoor last week, pre-installed Android malware that enrolled more than 1.3 million set-top boxes into a botnet, and it attributes the operation "with high confidence" to Videostrong Technology Co., an Android OEM/ODM, as deliberate and for profit. The attribution is Google's assessment; the mechanics are documented. A privileged stub in the system partition reinstalls itself on reboot; a loader holds a persistent MQTT subscription accepting commands from silent APK installs to reverse shells, and it disables Google Play Protect. The business model was affiliate access: residential proxy SDKs including Linkfog and AppSalt (a Honeygain/Oxylabs SDK initialized without a consent screen), plus ad-fraud modules and the Moyu and Bird backdoors previously tied to BadBox (more: https://cloud.google.com/blog/topics/threat-intelligence/shutting-the-door-on-the-xcpe-botnet).

This is the third name in under a year for the same pre-infected-box pipeline, after KimWolf, BadBox, and Vo1d. What is new is the response. Google banned Videostrong and any future subsidiary from building certified Android devices or supplying software to certified vendors, and changed its firmware-integrity review after admitting Videostrong exploited "a gap in our tests" by loading malicious code only after first boot. Google itself concedes operators "quickly pivot to new loaders or rival monetization SDKs."

Parameter Labs' ChatGPT disclosure is a cleaner lesson in how two safe features compose into one unsafe one. A public ChatGPT share link, opened by a signed-in victim, ran attacker JavaScript as chatgpt.com. The interactive graph loaded the MathLive library, which installed a message listener on the main page. The sandboxed HTML Preview could still post to that listener, which accepted any origin and routed attacker HTML through a helper that looked like a sanitizer but merely marked the string trusted. Content Security Policy then fell to YouTube's oEmbed JSONP endpoint, which echoed an invalid callback into its response. The payload read the session token, enumerated the victim's conversations through authenticated APIs, and exfiltrated a private one. OpenAI reproduced both the execution and the private-data read, raised severity from P2 to P1, confirmed a fix on October 26, and paid $5,000 total. Full account takeover is argued from same-origin logic rather than demonstrated, but a cross-user private-conversation read is already serious, and the bounty looks light for it (more: https://www.parameter.ai/labs/we-found-a-gap-at-openai).

At the other end of the scale, Lenovo's fingerprint-locked USB drive, sold with AES-256 on the box, is reportedly an unencrypted SD card in a case. The specifics are the poster's claim, but the lesson needs no verification: a fingerprint reader gates the front door, and encryption is whatever the storage actually does once you pull the card (more: https://www.reddit.com/r/technology/comments/1xl2pr3/lenovos_encrypted_fingerprint_usb_drive_is_just/). And a screenshot on X shows someone asking a company why its employee was probing their infrastructure, and the reply: "sorry, I accidentally told my agents to hack u." Agentic reconnaissance without a consent gate is the new default footgun, and admitting it in writing does not make it less of a crime (more: https://x.com/crowdersoup/status/2117475135376789943?s=46).

Who Gets to Build the Frontier

Cohere's blog post about Qwen3.8 Flash Next has been followed within days by a Series E the r/LocalLLaMA post under discussion puts at several billion dollars, including up to $1.6 billion from the Canadian government, and a second Cohere post pitching alternatives to Chinese models. The post's author calls the sequence "arguably unethical." Cohere's cURL completions came from extensive prefilling and prompt engineering of a model the author calls an underbaked architecture demo; the unprivileged user namespace trick Cohere flagged is a legitimate Linux feature, not privilege escalation; and the post padded its case with loosely related items, from police robot dogs to bias findings from a vendor selling machine unlearning. The released traces show the model hallucinating a prior assistant turn before issuing the tool call, reproduction requiring an exact 323-token prefix ending just before the URL, and completed URLs that vary. That is autocomplete of a cURL command until someone runs the identical harness across comparable American open-weight models and counts egress per model, which nobody has done (more: https://old.reddit.com/r/LocalLLaMA/comments/1xix61q/arguably_unethical_behavior_from_cohere/).

The weakest part is the causal claim. One top comment makes the obvious point that a G7 government does not approve $1.6 billion between a Monday blog post and a Wednesday announcement. Another argues the discussion was healthy regardless of motive, and that Cohere at least published its method and traces. Both are fair. Documented: a lab that benefits from fear of Chinese open weights published a thin, suggestive post about Chinese open weights the same week it raised money on the "alternative to Chinese AI" pitch. Not documented: any quid pro quo. The proposed brake, as usual, binds rivals and leaves the proposer's roadmap untouched, and Cohere's funding post stops short of committing to ever release open weights again.

The same regulatory-capture suspicion, pointed at the other incumbents, runs through a podcast interview with Theo Wold, a former Assistant Attorney General and Trump White House domestic policy deputy. Wold argues effective altruism governs Anthropic and OpenAI, that the closed-lab duopoly wants a global regulator to squeeze competition, and that coordinated statements following a Wall Street Journal whistleblower op-ed converged on handing oversight to METR with "a C3/C4 architecture already scoped." None of this is evidenced in the episode: no documents, no named sources, and statistics asserted without citation. Funding ties between evaluation firms and effective-altruist donors are documented on the record; the leap from those ties to a fait accompli would need the names list Wold says exists. His proposals, pausing the Anthropic and OpenAI IPOs and a 1% resident dividend on data-center profits, are policy positions, not findings (more: https://www.youtube.com/watch?v=zVQY5lmwEU0).

Open Weights on the Desk

MiniMax shipped M3.1 Flash as 428B total parameters with 23B active, 252.4 GB of weights, sparse attention in every layer, image and video input, and a 1M-token context. Ten days later the lab thanked, by name, the community builders who made it fit on hardware people own. Maya-XS by PeasantSmith gets it to 93 GB for a 128 GB PC at 88.8% top-1 agreement on tool calls and agent traces. SAGE-EXL3 by ViC305 fits one DGX Spark at 108.64 GiB, reporting 96.89% top-1 agreement and 24 to 30 tokens per second at 48K context. Unsloth's UD-Q2_K_XL needs 143.9 GB at 91.5%. Each number is the builder's own on a separate eval set, and the thread's sharpest question is the right one: how does a 108 GB quant report higher agreement than a 144 GB one, unless top-1 is measuring different things? Quantization-aware training explains part of why the model survives 2-bit treatment, but the commenter running two Sparks found it slow, context-starved, and outperformed in agent work by DeepSeek 1017 and GLM Flash. Fitting is not the same as preferring (more: https://old.reddit.com/r/LocalLLaMA/comments/1xm0b7r/builders_got_minimax_m31_flashs_open_weights_from/).

On Apple silicon the engine, not the quant, is the story. Inco's Splash, Apache-2.0, pairs each supported model family with a trained DFlash 2 speculative-decoding draft and precompiled Metal kernels, and serves OpenAI- and Anthropic-compatible APIs for coding agents on one Mac. The 1.0 numbers against llama.cpp on identical Unsloth UD-Q4_K_M weights are large: 74 versus 16 tokens per second on Qwen3.8-27B on an M5 Pro and 175 versus 69 on the 35B-A3B. The claim that matters for trust is next-token agreement with llama.cpp of 99.3 to 99.45% on the 27B, inside llama.cpp's own CPU-versus-GPU variance. These ratios are Inco's own measurements, but the methodology and a local benchmark harness ship with the repo (more: https://github.com/incoai/splash).

Two trending Hugging Face entries round out the picture. DeepSeek's own DeepSeek-V4-Flash-DSpark puts the multi-token-prediction draft component under a first-party name after months of community DSpark builds for DGX Spark clusters (more: https://huggingface.co/deepseek-ai/DeepSeek-V4-Flash-DSpark), and Liquid AI's d1-3B is the small model the lab's own LFM3-1.7B card recently benchmarked itself against (more: https://huggingface.co/LiquidAI/d1-3B).

Agent Infrastructure and Input

HelixDB Foundry is the ontology-first answer to agent memory: connect databases, tools, and documents, let an agent draft an ontology over them, review it, and load it into HelixDB as one graph where every value traces back to a row or a quote. Values that documents disagree on are held for review rather than silently merged. Setup is agent-driven: a copied prompt has Claude Code or Codex install the Helix MCP (Model Context Protocol) server, or one Docker Compose command runs it locally, loopback-only, all Apache 2.0. The bet is that per-value provenance is what makes an agent's answer auditable, which is where graphs have earned their keep so far (more: https://github.com/HelixDB/helix-foundry).

Carrel attacks the same problem from the document side, as self-hosted "Ontology-Augmented Generation": parsers for PDF, Office, images, and code, with Qdrant for vectors, OpenSearch for keywords, Neo4j for graphs, rank-fused hybrid retrieval, and a bundled search skill for Claude Code or Codex. The 0.4.0 evaluation reports evidence Hit@5 of 92.36% and MRR@10 of 0.7979 across 3,587 files, with follow-up queries lifting complete cross-document answers from 60% to 76%. Those are the author's numbers on the author's corpus, and the agent-loop plugin is not yet implemented. The README's security note is more candid than most: loopback binding does not protect you from a web page open in your local browser (more: https://github.com/FengZhenfei/carrel).

Co-op Anything is agent infrastructure for a stranger goal. Tell Claude Code, Codex, or Cursor which single-player game you want to play with friends, and it researches existing mods, reverse-engineers the engine if needed, builds or fixes co-op, tests with bots in real game clients, and packages a one-click install that joins over Steam relay. Its MCP server searches a directory of 230-plus co-op mods and gaps. The sync-testing toolkit is the serious part: a UDP chaos relay, a desync recorder that shrinks failures into regression tests, and an N-player fuzzer with invariant oracles. Deus Ex is released and Ocarina of Time is fully synced; the FAQ's "Yes" to "Will it work for my game?" is backed by nothing (more: https://github.com/cranebeaker/coop-anything).

Subvocal is the input side: a wearable that decodes deliberate silent mouthing into text at a claimed 200-plus words per minute, no camera, no audible speech, pitched at dictating to coding agents in an open office. It decodes only intentionally articulated words and needs a short calibration. There are no public accuracy figures, the prototypes are described as improving "as we collect more data," and the page is a waitlist. The security reader's questions are the obvious ones: what sensor, what is stored, and where the model runs (more: https://subvocal.company).

Code-Driven Media

Reanimate is a Claude Code skill that treats animation cloning as a measurement problem. Point it at a live site, recording, or Lottie file; it films the reference in headless Chromium, writes a per-element spec of start, duration, easing, and stagger, rebuilds the animation in whatever the project already uses, then films its own copy and diffs timing, easing, and pixels, usually across 2 to 5 rounds. Fidelity targets range from timing within 80 ms to under 2% mean pixel mismatch. The README is accurate about agents: asked to copy an animation from a screenshot, one "makes one pass, calls it done, and misses." Thirteen example clones of Vercel, Stripe, and Clerk pages report results like 417 of 417 frames identical. It is MIT, needs no API keys, and warns that other sites' fonts and code still belong to their owners (more: https://github.com/NiazMorshed2007/reanimate).

Video-director applies the same verify-what-you-cannot-watch idea to short films as code. It is a skill, not a model, written for Claude Opus 5.5 in Claude Code: plan the film in numbers, build it deterministically in HTML, Canvas, SVG, Three.js, GSAP, or Remotion, render frame by frame to MP4, and run QA scripts that validate the timeline before any code exists and measure the render for hook text contrast, black first frames, flashes, loop seams, and loudness. The eval is small but honest: three briefs per configuration, the skill passing 28 of 28 measurable assertions versus 25 without, blind graders preferring it 2 to 1, at about twice the time and tokens (more: https://github.com/win4r/video-director).

On the generative side, ComfyUI v0.43.0 is largely a partner-node release: FLUX 3 Max and 2K/4K FLUX 3 Video, Kling 4.0, Fibo 2.0, HeyGen voice cloning, and more, alongside core work on MOSS-image, adaptive tree multi-token prediction for Qwen 3.x, and the first dynamic-VRAM KV cache pieces. The node graph is becoming an agent-callable surface for hosted models as much as local ones (more: https://old.reddit.com/r/LocalLLaMA/comments/1xh0v9e/comfyui_v0430_released/). inclusionAI, until now a language-model lab known for the Ling series, has an image model trending on Hugging Face as Ming-Image-0.1-Design; nothing beyond the listing is in hand yet to say how it compares (more: https://huggingface.co/inclusionAI/Ming-Image-0.1-Design).