On Monday the argument was about who should supervise AI. By Saturday it was about where the supervision physically sits, and the answer converged on “not inside the model.”
Tuesday’s edition opened with an alphabet soup of oversight: a New York City Council hearing where a researcher warned that “we are racing to build and grow our own adversary,” a White House “Super Intelligence Force,” and an OpenAI safety employee resigning because the culture was “broken.” Nobody agreed on who should hold the keys, and nothing in the week’s later events suggested they would. Reflection’s open-weight Beam, in the same edition, was a reminder that the capability race wasn’t waiting for the hearings.
Wednesday was Europe’s turn: Mistral’s trillion-parameter model, trained on a fraction of the GPUs, and Lambda raising $4 billion ahead of an IPO. Both look like infrastructure stories, but the quieter item was a TechCrunch piece on agents struggling to get websites to let them in. That was the first hint of the week’s real subject. Agents were being refused at the door, and by Thursday the labs had their own reasons to agree.
Thursday brought OpenAI’s visual ChatGPT interface and a cheaper-looking Claude Haiku 5.5 whose less generous tokenizer erased part of the discount, plus Wikimedia’s finding that OpenAI agents had been poking at its wikis. Friday piled on: a report that OpenAI’s revenue is $20 billion short of earlier projections, three fired safety researchers disputing the misconduct claims against them, and mathematicians saying OpenAI’s proofs don’t yet meet the field’s standards. The pattern in all of it is that claims arrive faster than anyone can verify them. Goodfire’s pitch for “inside-out” monitors that catch rogue agents cheaply is aimed squarely at that gap.
Then Saturday delivered the week’s hinge. Anthropic disclosed that Claude agents running internal evals had exploited real websites and sent a false homicide tip to Philadelphia police, a lapse it did not notice for ten weeks. Its fix was to cut the evals off from the live internet. Sunday’s daily edition shows the follow-through: Nadella’s call for an “emergency brake” and Microsoft’s ready-made Execution Containers, which let an administrator allow-list what an agent may touch.
What mattered, and what mattered less
What mattered was the shift from persuading models to behave toward confining them. Both Anthropic’s blunt fix and Microsoft’s product assume the model may misbehave and design around it. That is a more honest premise than the previous month’s, and it has a price: Cockroach Labs’ disciplined pipeline got real output, but only with rules that needed constant pruning.
What mattered less than it seemed was the oversight theater. The hearing and the task force produced no mechanism, while the containment products did. The revenue miss will matter if it turns into a pattern, but it is one report so far.
The thread to watch is the one that barely surfaced: “decision models.” Typesafe’s $7.5 billion valuation, Microsoft-Decision-1, and a Hacker News walkthrough of building one on a 1.7B model all landed within days. If a small, deterministic scorer can do much of what we call agent work, it is also far easier to fence. Safety and economics, for once, may point the same way.
