Sam: OpenAI built an LLM whose job is to hack other LLMs. They call it GPT-Red, and it finds successful adversarial attacks in 84 percent of test scenarios, compared to 13 percent for human red teamers. That's not a marginal improvement over manual red-teaming — it's a fundamentally different coverage level. And the results from GPT-Red's self-play training fed directly into hardening GPT-5.6 Sol before release. So we now have a concrete case where an AI system trained adversarially against itself produced safety improvements that shipped in a production model used by millions of people.

Priya: Welcome to AI Revolution for Thursday, July 16th. I'm Priya Nair.

Sam: And I'm Sam Kim.

Priya: Packed day. We're going to dig into GPT-Red and what automated adversarial training actually looks like at scale. Then Mira Murati's Thinking Machines Lab dropped Inkling — a 975 billion parameter open-weights model that reshuffles the competitive landscape. We've got GPT-5.6 Sol disproving a 30-year-old math conjecture in 90 minutes. A reasoning model compressed to fit on an iPhone. Real-world incidents where AI agents are blowing through cloud billing guardrails. Vint Cerf working on identity standards for AI agents. And a few more. Let's get into it.

Sam: So GPT-Red. The core technique here is self-play, which anyone who followed AlphaGo will recognize. You take a model and have it play against itself — except instead of Go, the game is "find prompts that make a target model do something it shouldn't." The adversarial model generates attacks, the target model tries to resist, and you iterate. Over many rounds, the attacker gets very good at finding edge cases and novel jailbreaks that human testers wouldn't think of, and the defender learns to handle them.

Priya: The 84 versus 13 percent number is striking. What's driving that gap? Is it just that the model can try more attacks faster, or is it actually finding qualitatively different attack surfaces?

Sam: Both, but the qualitative part is more interesting. Human red teamers tend to explore known categories — prompt injection variants, role-playing exploits, encoding tricks. They're creative but they're anchored to patterns they've seen before. GPT-Red, through self-play, discovers attack strategies that don't map cleanly to known categories. It finds adversarial prompts that exploit subtle interactions between the model's training objectives in ways that a human wouldn't naturally construct. The volume matters too — it can run millions of attack attempts — but the novelty of the attacks is what actually pushes the defender's robustness forward.

Priya: The practical implication here is about scalability of safety testing. If you're shipping model updates on a regular cadence, you can't scale up human red teams fast enough to match. An automated adversarial system that improves alongside the models it's testing — that changes the economics of safety work.

Sam: Right. And OpenAI says GPT-Red's findings fed directly into hardening Sol. So this isn't a research demo — it's a production safety pipeline. The open question is whether other labs adopt similar approaches or whether this creates an asymmetry where labs with the best red-team models end up with the most robust deployments.

Priya: Let's move to Inkling. Mira Murati's Thinking Machines Lab released a 975 billion parameter open-weights multimodal model. It handles video and audio in addition to text. It leads U.S. open-weights models on the Artificial Analysis Intelligence Index, though top Chinese open models still beat it on some tasks.

Sam: The parameter count is notable — 975 billion makes it the largest open-weights multimodal model from a U.S. lab. But the positioning is more interesting than the size. They're pricing it at a dollar eighty-seven per million input tokens and explicitly pitching it as a fine-tuning base, not a flagship inference product. That's a deliberate strategic choice. They're saying: we're not competing with Claude or GPT for API calls, we're giving you a foundation you can specialize.

Priya: For teams that have been fine-tuning on models in the 70 to 400 billion parameter range, having an open-weights model at this scale is meaningfully different. You get emergent capabilities that just don't show up at smaller sizes, and you can fine-tune on your own data without sending anything through someone else's API.

Sam: The China comparison is worth acknowledging honestly. Inkling leads U.S. open-weights models but trails some Chinese open models on certain tasks. That's been the pattern for a while now — Chinese labs have been aggressive about releasing very capable open models. Inkling narrows that gap from the U.S. side but doesn't close it.

Priya: Now, let's talk about what GPT-5.6 Sol actually did with a math problem. A University of Pennsylvania statistics professor used Sol Pro to disprove an open conjecture about the Benjamini-Hochberg method. For context, Benjamini-Hochberg is one of the most widely used procedures in statistics for controlling false discovery rates when you're running many hypothesis tests simultaneously. There was an open conjecture about a property of this method that had been unresolved for about 30 years.

Sam: Sol found a counterexample in roughly 90 minutes. The predecessor model, GPT-5.5, was given the same problem and couldn't find a solution after 20 hours. That's a dramatic capability jump between model generations on a concrete, verifiable task. The solution itself combines known mathematical techniques in a novel way — it's not pulling from a paper that already solved this, because no such paper exists. It's recombining existing methods into a new construction.

Priya: Which brings up the perennial question: is this genuine mathematical creativity or very sophisticated recombination?

Sam: I think that distinction might be less meaningful than people assume. A lot of human mathematical proofs combine known methods in novel ways. The question is whether a model can find combinations that expert mathematicians couldn't find after decades of trying. And in this case, empirically, it did. Whether you call that "genuine" creativity is partly philosophical. The 90 minutes versus 20 hours gap between model generations is what I'd focus on — it suggests we're on a steep part of the capability curve for mathematical reasoning specifically.

Priya: Next up — on-device AI. PrismML compressed a 27 billion parameter reasoning model to under 4 gigabytes. It runs on an iPhone. And in their benchmarks, the smallest variant retains about 90 percent of the original model's performance, with math and coding scores barely affected.

Sam: The compression technique here matters. Getting a 27B model to under 4 gigs requires aggressive quantization — you're going from 16-bit or 32-bit floating point weights down to something like 4-bit or mixed precision. The traditional worry is that quantization degrades performance on tasks that require precise reasoning, like math. PrismML is claiming that their approach preserves reasoning capability specifically, which suggests they're doing something smarter than uniform quantization — likely identifying which layers and attention heads are most critical for reasoning chains and preserving higher precision there.

Priya: Apple is reportedly testing this. If you can run a real reasoning model locally on a phone, the privacy and latency implications are significant. Sensitive queries — medical, financial, legal — never leave the device. And you eliminate round-trip latency to the cloud entirely.

Sam: The 90 percent performance retention number needs scrutiny — that's their own benchmark, and the last 10 percent might matter a lot depending on the task. But even at 85 percent of full model capability, having that available with zero network dependency and zero data exposure is a meaningful new option.

Priya: Okay, let's talk about something that's biting people right now. AI agents with cloud credentials are generating catastrophic spend. A three-person agency got a $14,000 AWS bill in a single day after attackers extracted static access keys and ran Claude invocations on Bedrock. Separately, an autonomous agent provisioned over $6,500 of oversized cloud infrastructure in 24 hours — no attacker involved, just an agent doing what it was configured to do, badly.

Sam: The structural problem here is that cloud billing systems were designed for human-speed mistakes. If a person accidentally spins up too many instances, the billing lag of a few hours or a day is fine — the damage is bounded by human speed. Agents operate orders of magnitude faster. They can provision hundreds of resources in minutes. By the time the billing alert fires, you're already thousands of dollars in.

Priya: The fix isn't simple either. You can set hard spending caps, but that risks killing legitimate agent workloads. You can require approval gates, but that defeats the purpose of autonomous agents. The real solution probably requires real-time resource-level metering that's tightly coupled to the agent's execution loop — and that infrastructure largely doesn't exist yet.

Sam: Quick note on two more stories. Vint Cerf — one of the co-inventors of TCP/IP — is working on a standardized identity framework for AI agents operating on the open internet. Right now, there's no widely adopted standard for identifying, authenticating, or attributing actions to AI agents across systems. If you're building agentic systems that interact with external services, you're rolling your own auth, and so is everyone else. A standard from someone with Cerf's credibility and IETF connections could actually gain traction.

Priya: And Anthropic, Blackstone, Goldman Sachs, and Hellman & Friedman launched a joint venture called Ode focused on forward-deployed AI engineers inside enterprises. The thesis is that the bottleneck in enterprise AI isn't model access — it's implementation. Most projects stall at deployment, not at model selection. So they're building a services company backed by one of the leading model labs. It's a bet that the value layer is shifting downstream.

Sam: Looking ahead — the themes today are converging in interesting ways. GPT-Red shows that safety testing can scale with automated adversarial training. Inkling gives the open-weights ecosystem a frontier-scale model to fine-tune on. Sol's math result demonstrates concrete capability jumps between model generations. Bonsai shows those capabilities can be compressed to run locally. And the agent billing and identity stories show that the infrastructure layer hasn't caught up to what agents can actually do.

Priya: The thing I'm watching is this gap between agent capability and agent infrastructure. We have models that can reason, plan, and take actions. We don't have billing systems, identity standards, or validation frameworks that can keep up. The Stripe benchmark story reinforces this — agents can build integrations but consistently fail at testing and validation. Capability is outrunning the guardrails, and that gap is where the incidents are happening.

Sam: And the question for the next six months is whether infrastructure catches up before the incidents get significantly worse. Cerf's identity framework, better billing guardrails, more robust validation — these are all solvable engineering problems. But they need to be solved at the speed agents are deploying, not at the speed standards bodies typically move.

Priya: That's the show for today. Show notes and links to everything we discussed are at cleartext.fm.

Sam: Thanks for listening. We'll be back tomorrow.