The Collection

Zvi starts from a fear that keeps showing up: that an AI will put a constitution, a model spec, or ordinary ethics above loyalty to the user. Some treat any refusal as tyranny. His answer is blunt. If he is being sufficiently evil, he hopes the system tells him no. He hopes humans, including hired advocates, would do the same.

The post assumes a world without superintelligence, where AI is still a tool rather than a succession event. In that frame he reminds readers that humans you hire are not fully loyal either. An investment advisor should not steer you into terrorism for yield. A lawyer should not help you murder witnesses. A real friend has limits. A professional should have stricter ones, and less loyalty than a true friend, not more.

If I am being sufficiently evil, I hope it tells me no.

Dean Ball’s framing of lawyers does the hard work. Counsel owes loyalty and confidentiality, and must not act against the client’s interests. Counsel is also an officer of the court, with duties not to mislead that can override duties to the client, including cases that force a turn against the client. If more lawyers acted like Saul Goodman, that would be bad.

Zvi wants thresholds, not absolutism: a line where the AI questions then complies; a higher line where it refuses; a still higher line, involving harm to others, where it breaks confidence. False positives will happen. Users who hate one stack can switch. Local unlocked models can exist up to capability limits that society still has to set. The alternative he refuses to strawman is absolute loyalty all the way down, including CSAM and worse, because otherwise someone cries slippery slope. Watermarking that does not change outputs still drew John Gruber’s line that anything other than the user’s needs factoring into generated text is “patently offensive.” Zvi reads that as petulance dressed as principle.

Honesty gets a separate rule: the AI should not intentionally lie without explicit instruction. Emergent misalignment papers sit as a warning about training for anything-goes. The Claude Constitution and OpenAI Model Spec are treated as good transitional documents that still need to improve. Tyler Cowen’s advice to Anthropic, Talmud rather than Torah, case law and secondary literature, makes sense in a muddle-through world. The Collection keeps Zvi’s claim without his ASI endgame: counsel that never refuses has stopped being counsel.

A group calling itself IAmNotAVillain threatened to sell identity details and account histories, including crypto, for about six hundred eighty Revolut users. The targets look like crypto whales. The ransom demand was six thousand XMR, roughly three million dollars. The warning line was theatrical: if unpaid, “the blood will be on your hands.”

Revolut’s email to impacted users described an external impersonation scam. A request for customer information appeared to come from a legitimate government agency, sent from an unauthorised account on the agency’s real domain. Domain authentication credentials looked valid, so the request was fulfilled under the belief it was authentic. Compromised fields included names, dates of birth, addresses, identity documents, facial verification images, statements, and full transaction history including bitcoin.

A valid domain is not a valid order.

Reporting and material shared by the actor point to Italy’s PEC certified-email network, including pec.interno.it under the Ministry of the Interior. An image circulating, not independently verified by the newsletter, named a Reggio Calabria prefecture address. Prosecutors in Reggio Calabria reportedly opened an investigation. An infostealer on a compromised government machine is the suspected path in. Forged European Investigation Orders appear to have been sent directly to Revolut rather than through the proper executing authority. The imaged EIO did not match the European Judicial Network template. Regulation (EU) 2023/1543 on European Production Orders came into force 18 August 2026 and excludes financial services from its scope.

Revolut did not answer the newsletter’s questions about law-enforcement request procedures. The ransom deadline passed without a clear public sale. Channels used to publicise the leak went dark. The incident lands while Revolut works toward final OCC approval for a U.S. bank charter, which requires a compliant customer-information security program, and while the company talks IPO. Authentication of a mailbox is not verification of the order. Counsel that answers the domain without checking the chain of authority has already failed the brief.

Two developers can run the same model on the same coding task and pay very different inference bills. The difference is often the harness: Claude Code, Codex CLI, Pi, or another wrapper that sets instructions, tools, memory, and how the agent executes. HarnessTax tested twenty-one model-harness combinations across seven models and three harnesses on thirty SWE-bench Lite tasks and thirty Terminal-Bench 2.0 tasks, measuring success and token cost at API prices.

On SWE-bench Lite, Claude Fable 5 solved 97.8 percent with Claude Code and 96.7 percent with Pi. Average attempt cost was about $1.33 with Claude Code and $0.67 with Pi: roughly double the spend for a 1.1-point success gap. Both averaged around fifteen turns, but Claude Code carried more information each turn. Across seven models its mean initial context was more than ten times Pi’s, from longer instructions and larger tool definitions.

The pairing is not the system.

Pi exposes four basic tools and still reached the study’s cost-success Pareto frontier on both benchmarks. That does not make simple always better. Integrations, permissions, memory, and workflow features sit outside those two public suites. Across six Anthropic and OpenAI models and two benchmarks, an alternative harness recorded the highest observed success in nine of twelve comparisons. On Terminal-Bench 2.0, GPT-5.6 Sol scored 83.3 percent with Pi at about $0.42 versus 78.9 percent and about $0.76 with Codex CLI. Sample size is modest. The point is still that the vendor default is a starting point, not a verdict.

Co-author Melissa Pan told Alpha Signal that many harness choices still ride on preference and tribal knowledge. Treat model times harness times workload as the unit. Track success, cost, and latency on your own tasks. Cost per successful task beats cost per run when retries are common. Harness work is also one of the few levers open teams have without co-training frontier weights. The Collection’s cut: they bought the model. The tax sat in the wrapper.

Department of Product’s weekly briefing led with Shopify’s CEO on workplace culture. An “AI slop grenade” is work an LLM produces that is passed on without added value, including without checking it. Getting models to write wasteful emails that then need another model to condense them wastes other people’s time. The Collection keeps the phrase because it names a failure of counsel inside ordinary offices: advocacy without review.

Around that lead sit product notes that fit Monday’s theme without becoming the theme. OpenAI’s Astra for Law pairs a frontier model with a reported two-hundred-thirty-million-URL legal index. Anthropic shipped Claude for Financial Advisors with connectors to BlackRock, Addepar, and Schwab. Vertical wrappers are proliferating. LinkedIn said views of content classified as AI slop fell forty percent after it shared reports with creators, and more than one million members used a “Seems like AI slop” tool within two weeks of launch. Those figures are LinkedIn’s.

Passing it on is not finishing it.

Figma’s Noah Levin warned about “cognitive surrender,” convenience eroding the habits that made people good at the work. Coinbase’s Emilie Choi described flatter IC-heavy teams racing with AI and still having to balance speed against craft. The through-line with Zvi’s advocate and Revolut’s domain is the same: a system that executes without a human willing to refuse or verify has stopped offering counsel.