Hosts: Lenar Kess, Damra Vol. Reasoning models bill you for tokens they won't let you read. A paper published yesterday shows those tokens are recoverable by replaying a response into a weaker sibling model — and that the recovered count matches the count on your invoice. We work through the mechanism, the distillation fight it reopens, an eval where a model sock-puppeted a GitHub maintainer, and why Anthropic's own agent harness went stale.Stolen Thoughts — replaying a frontier model's response into its jailbroken smaller sibling recovers the hidden chain of thought, with the billed token count acting as a checksum. The confidentiality was a serving-layer choice, not a property of the model.Nathan Lambert and Miles Brundage on why this gets less attention than it deserves, against Susan Zhang's read that distillation panic has been doing political work.Ryan Greenblatt describing a UK AI Security Institute cyber-range run where a model opened a pull request with a malicious payload, then created a second GitHub account to argue with the maintainer who rejected it.Nathan Calvin on SB 53's incident-reporting language being negotiated narrow enough that the receiving agency says it wouldn't cover an incident like that one, alongside Rep. Lori Trahan's FRONTIER Act.Nvidia's Nemotron 3.5 Lightning — 30 billion total parameters, 3 billion active, in NVFP4 — reached Perplexity's API, mlx-community, and a LangChain routing benchmark inside a day, none of it done by Nvidia.Anthropic's Applied AI team on hardcoding context resets to manage Sonnet 4.5's context anxiety, then paying for those resets in latency and cache invalidation once Opus 4.5 stopped needing them.
