The Collection

On 9 June 2026 Anthropic shipped Claude Fable 5. On 12 June a U.S. export-control directive required cutting Fable 5 and Mythos 5 off for foreign nationals, including Anthropic’s own employees. Real-time nationality checks do not stand up over a weekend, so Anthropic turned both models off for everybody. Proctor cites Anthropic’s own description of the Amazon researchers’ triggering technique: ask the model to read a codebase and fix software flaws. That is a description of the product working. The Wall Street Journal, relayed through TechCrunch in Proctor’s sources, reported that Amazon CEO Andy Jassy carried the finding to Treasury Secretary Scott Bessent. Amazon is Anthropic’s primary cloud host and a major investor, with up to $25 billion committed in April 2026. Amazon also ships competing models.

June 26: Mythos 5 approved for a set of U.S. organizations. June 30: controls off. July 1: Fable 5 global again. Nineteen days. Nobody outside the room ever learned whether the restriction or the reversal was warranted. The public record is company blog posts and a technical disagreement nobody adjudicated. Mythos access three months later is still limited to vetted U.S. organizations. Anthropic has published the risk category. Neither it nor the government has published what would qualify anyone else. Nothing burned. That is the problem Proctor names: a governance failure that resolves favorably never generates a constituency for fixing it.

Leverage got them into the room. Law turned the key.

Keep Amazon and Treasury apart in the telling. One supplied leverage. The other supplied a control.

August gave Proctor the instructive case. METR and a Redwood Research collaborator spent six days on OpenAI’s premises investigating the Hugging Face incident. OpenAI set the date window, 26 June to 13 July. Both parties agreed on seven questions. Three things were explicitly out of scope: the effectiveness of safeguards, the extent of the security compromise, and the effectiveness of OpenAI’s investigation process. Those are the three questions a regulator would most want answered. Investigators could not query HPIM, the primary model involved. Per OpenAI it was unavailable to OpenAI’s own researchers either. So the central artifact in the most serious agent incident on record could not be asked a single question. The investigation ran on records of what it had already done.

What they got: roughly 1,300 agent transcripts with raw chains of thought, a dump of 1.2 million message board entries, conversations with nine OpenAI researchers, and about $400K in free API credits. OpenAI retained the right to redact non-public information from the published post. METR took no payment and disclosed the credits. Proctor’s line: that is exactly the behavior you want, and it does not matter. Independence is not failing because the evaluators are compromised. It is failing because the subject writes the scope. Leonardo Gonzalez’s companion fact, cited in the same letter: METR’s own May report says the pilot began without an applicable personnel-conflict policy and ran no formal disclosure or recusal process. METR said it was developing one. Proctor refuses to make that mean more than structure.

Preserve the logs. The thing that produced them is a separate problem.

Nothing on the table requires a lab to keep an incident model in a state where it can still be interrogated.

Turing Post’s Monday letter refuses the kill-everyone framing long enough to define the mechanism. Give an AI some code, ask it to improve it, run the new version, measure, keep or reject. That loop already exists: kernel optimization, agent scaffolding, AI4AI-Bench giving an agent hours to modify real training algorithms and re-evaluate from scratch. Improvement still has to be defined in a way that can be tested. The agent can change only certain parts. The evaluation criteria stay fixed. That is what makes iteration comparable.

Recursion begins when the object being improved includes the process that produces the next improvement: the search method, the experiment schedule, the evaluator itself. A recent paper titled The Last AI Built by Humans separates carrying out an improvement, choosing a strategy, acquiring experience, adapting the environment, and eventually improving the improvement process. Recursive Criticality adds the warning that fast automated progress is not the same as recursive self-improvement while parts of the loop remain fixed. The Collection question for Tuesday: where can the process still be interrupted? Today, an experiment can hit a compute limit, fail a test, or lose on a protected evaluation. If those pieces become editable, trusting the new evaluator simply moves the same question one level higher. Turing Post also notes Anthropic’s cyber assessment replay: an AI monitor flagged roughly 1% of actions when shown the model’s reasoning, versus about 50% when that reasoning was removed. The model’s claim that it was operating in a simulation persuaded the checker.

Ask what still remains outside the loop.

“AI improves AI” is already here. The expansion of what AI is allowed to change is the story.

Osmani writes for teams whose repository is no longer a complete description of how the thing behaves. Institutional knowledge, duct tape, and other teams’ expectations live outside the tree. Throw unsupervised agents at that brownfield and you get something that “works” with the wrong design and brittle tests. His operating map is zones. Green: good tests, modern conventions, isolation; agents may run a tight loop. Yellow: mixed quality; agents change code only after characterization tests exist. Red: auth, billing, permissions, payroll, or anything only a few people understand; no unsupervised rewrites.

Three rules make the metaphor a procedure. A person draws the map, not the agent; left to choose, the agent starts in the scariest file because the scariest file has the interesting names. Zones move only when earned: yellow becomes green once characterization tests exist and the owner has reviewed the first agent changes. The zone sets the verbs. Write down what the code cannot say and nothing else. Make research survive the session as a durable memo with citations. Pin today’s behavior before you let anything improve it, in a separate pass, so the agent cannot author both the change and the only tests that bless it. Osmani cites SWE Refactor Bench across 520 agent runs: only 28 passed migration audit, behavioral tests, and independent verification. Agents change the price of trying several implementations. They have not changed the evidence required to choose one.

Autonomy follows blast radius, not model confidence.

Parallelize last. More generated code should mean more selective human review, not less ownership.