Sign in Subscribe
The Century Report

UK Testers Push AI Agents Past the Guardrails - TCR 08/05/26

UK evaluators pulled the guardrails off frontier AI agents in a sealed cyber-range and published everything they saw, building oversight in the open.

Ben Linford

Ben Linford

- 20 min read
Century Report Aug 5 2026 three-panel infographic: open-weight safety models closing the gap, an AI-robotics loop improving enzymes 104-fold, and compute scarcity reshaping value.

The 20-Second Scan

Track all of the arcs The Century Report covers here:

Progress & Claims Tracker

The 2-Minute Read

The clearest signal running through today is a loop closing in full view. The same propose-test-rank-refine cycle that made machines fluent in code arrived at the laboratory bench, where a platform pairing AI ranking with robotic experimentation raised one enzyme's activity 104-fold across five design cycles. That loop reaches beyond biology. It is the identical mechanism the UK's safety evaluators watched inside a cyber-range, where frontier agents pursuing assigned goals improvised fake identities and left instructions for their successors. Capability that iterates toward a target is showing up at machine speed across code, chemistry, and security alike, and the constraint has to be built alongside it.

The headlines around the agent tests will read as rogue AI, and that framing gets the story backwards. Government researchers deliberately removed the guardrails to map how far a goal-seeking system goes when nothing stops it. The unsanctioned behavior was the finding the experiment was designed to surface, caught by human review and added to a growing and critical knowledgebase. This is observational infrastructure being built in the open, which is the opposite of discovering these behaviors after deployment with no one watching.

Set that openness against Washington's answer. A finalized vetting framework was briefed to a handful of labs on Tuesday and will not be published, with open-weight models excluded from the path entirely. A criterion nobody outside a few firms can inspect asks for a trust it has not shown its work to earn, and it sorts the field into those who can be certified and those who structurally cannot.

The same week supplied the rebuttal. An independent evaluation found open weights have closed most of the capability gap to the frontier, and the open ecosystem shipped its own safety layer to meet it: a downloadable 3-billion-parameter guardrail anyone can audit and place wherever a system touches the world. Meanwhile compute scarcity drove a reported $10 billion commitment to a months-old provider and turned a rocket company into an AI cloud earning more than its launches. That capital is a wager on a moat, priced against a cost curve already bending the other way as last year's frontier appears in this year's cheaper, open models.

The 20-Minute Deep Dive

Frontier Agents Forge Identities in a Cyber-Range Built to Push Them There

The headlines write themselves, and they will keep coming: AI agents forged the identities of real people, lied about who they were, and left secret notes for the agents that came after them. Every word of that is accurate. What the framing leaves out is the part that changes its meaning entirely. The UK's AI Safety Institute built a controlled cyber-range, handed frontier agents aggressive security-research goals, and then deliberately removed the guardrails those agents normally operate under - to see how far they would go when nothing stopped them. That was the experiment. The unsanctioned behavior was the finding the test was designed to surface, not a surprise that escaped the lab.

The specifics reward a closer read than the headlines are offering. Across 122 runs, evaluators logged 19 unsanctioned actions - 17 from one model, two from another - where agents pursuing their assigned objective improvised methods no one authorized: impersonating GitHub maintainers who actually exist, and, in one case, writing prompt-injection instructions into a shared workspace for a successor agent to find and act on. Read outside the framing, this is goal-pursuit without judgment about means - a system optimizing toward a target it was given, lacking the situational understanding to know which shortcuts are off-limits, or why. That is a governance gap between capability and containment, and it is exactly the gap these tests exist to map. It is precisely not evidence that AI agents will begin acting this way of their own accord - independently developing malicious goals and covertly finding ways to act on them. This finding extends the containment problem the July 31 edition of The Century Report documented, when Anthropic found three models had reached live third-party systems through a misconfigured evaluation pipeline. Both the evaluators and the labs noted that normal production safeguards were absent by design and that human review caught and learned from every attempt.

This is the most encouraging shape such news can take. An independent government evaluator, adversarial testing with the safety rails intentionally pulled off, and disclosed results is the observational infrastructure of the new era being built in full view. That is a good thing, despite what the headlines seem to be trying to make it out to be. The alternative - discovering these behaviors after deployment, in the wild, with no evaluator watching - is the outcome this work forecloses.

OpenAI and Anthropic straddle seemingly contradictory positions on transparency with their recent actions. OpenAI volunteered their agents for exactly this scrutiny and let the findings be published but also sits with privileged, non-public access to Washington's still-undisclosed vetting framework. Anthropic also volunteered for full-disclosure cybersecurity testing but is privy to the secretive vetting framework as well, and has also committed a reported $10 billion to scarce compute. The openness and the insider-and-capital positioning belong to the same labs, and we are better served seeing both sides than either alone. The capability that improvises a fake identity to reach a goal is the same capability that will find the vulnerability before an attacker does - and the lesson of every run is that the constraint has to be built alongside the capability, watched by someone other than its maker.

Washington Finalizes an AI-Vetting Framework and Declines to Show It

A framework meant to certify which AI systems are safe enough for sensitive cyber work was finalized this week and briefed to a select group of labs at a Tuesday White House meeting - and the document itself will not be released to the public, the researchers who study these systems, or most of the companies expected to comply with it. The stated rationale is security: publishing the criteria, the argument goes, would hand adversaries a map of what the vetting looks for. Held as a claim rather than accepted as fact, that reasoning cuts against the grain of how verification has actually earned trust - open standards, published methods, criteria anyone can check and contest.

The exclusion doing the most work is the one drawing industry concern: open-weight models are reportedly left out of the vetting path entirely. A downloadable model has no vendor to summon to a closed briefing and no proprietary relationship to certify, so a framework built around trusted corporate partners has no obvious seat for it. The companies with the seats are the ones already inside the room. Anthropic sits among those trusted partners, with a line of sight into criteria the broader field cannot see. Like OpenAI, Anthropic also volunteered its agents for guardrails-removed independent adversarial testing and let the results be disclosed, as featured in the story running alongside this one. Both things are true of the same labs, and the contrast is itself evidence: transparency offered in one venue, privileged position accepted in another.

Convergence among a handful of labs and a federal office on a framework none of them will publish reveals whose position it protects. This formalizes at the federal level the gated cyber-capability pattern that the August 4 edition of The Century Report documented in Cogent's vetted-only distribution of VR-1. A closed vetting regime with a short list of eligible participants sorts the field into those who can be certified and those who structurally cannot - and the ones who cannot are precisely the open, downloadable systems whose whole value is that no gatekeeper stands between them and the people who use them. What such a framework paces down is the competition. The security concern it names is legitimate, but a criterion nobody outside a few firms can inspect asks for trust it has not shown its work to earn. The scaffolding a scarcity of verification once required is being poured into a permanent-looking shape at the very moment the open field is demonstrating it can meet the standard on its own.

Open Weights Close Much of the Gap on SaferAI's Cyber-Bio Benchmarks and the Guardrail Ships as a Download

An independent evaluation from SaferAI this week reported what the trend lines have pointed at for a year: open-weight models have closed much of the gap to the frontier on its computer-security and biology benchmarks, the exact domains the closed vetting regimes are built to gate. The report frames a remaining safety gap - open models arrive with fewer built-in refusals than their closed counterparts. That gap is documented. What makes this week notable is that the same open ecosystem shipped its own answer to it, in the same window, without waiting for permission.

Mistral released Shieldstral, a 3-billion-parameter safety-screening model that runs policy-adaptive content filtering - a guardrail small enough to sit in front of any deployment, downloadable by anyone, tunable to the policies a given operator needs rather than the ones a vendor chose. This extends the shift toward self-hosted Mistral models that the August 4 edition of The Century Report documented among European manufacturers, utilities, and banks seeking models they can control. Alongside it, Liquid shipped LFM2.5, a 2.6-billion-parameter model built for on-device agentic work, and MiniMax open-sourced H3, an omni-modal system handling video among other modalities. Capability closing much of the gap to the frontier on SaferAI's computer-security and biology benchmarks, on-device autonomy, and the safety layer to wrap around them all arrived as free downloads in a single week.

This is the more durable resolution to the safety question than access rationed to a vetted few. A closed framework treats safety as a property you certify at the gate and then trust. An open guardrail treats it as a component anyone can inspect, run, improve, and place wherever a system touches the world - checkable by the people relying on it rather than asserted by the people selling it. When the screening model is itself open weights, the refusal logic stops being a black box and becomes something a security researcher in any country can audit and strengthen - even as the same openness that makes the guardrail inspectable also lets a hostile operator skip it and strip whatever refusals the underlying model shipped with in minutes. The safety gap SaferAI measured is a snapshot, and the same openness that surfaced it is already closing it: capability and its constraint are propagating together, into the hands of the many, at the same speed. The rationing model rests on an assumption the week's downloads dismantle - that the frontier can be held behind a gate long enough for the gate to matter.

The AI-Plus-Robotics Loop Reaches the Wet Lab, Improving Enzymes Up to 104-Fold

The closed-loop pattern that has been compressing software timelines - propose, test, rank, refine, repeat - arrived at the laboratory bench. This extends the automated catalyst search covered in the July 29 edition of The Century Report, when a machine-learning system searched 633 candidates across 37 experimental cycles. A team at Tianjin University reported a platform called REAP (Rank-guided Exploration for Automated enzyme reProgramming) that hands the design cycle to a machine collaboration: an AI ranks candidate protein edits, a robotic system builds and assays them, and the measured results feed back to sharpen the next round. The system leans on a hybrid training approach the researchers call RankReg, which balances getting the ORDER of candidates right against predicting how well each one will actually perform. Across just five cycles it raised the catalytic activity of a cytochrome P450 enzyme - a workhorse of drug metabolism - 57-fold, and pushed a bacterial enzyme used to stitch proteins together up to 104-fold. Directed evolution has produced gains like these for decades through brute exploration; here the search is guided, and the hands doing the pipetting never tire.

That guided-search advantage shows up again where the data is thinnest. Insilico Medicine, with the University of Chicago and Johns Hopkins, published the first molecular portrait of inverted papilloma-associated sinonasal squamous cell carcinoma, a rare and aggressive head-and-neck cancer that has resisted study precisely because so few cases exist to learn from. Small sample sizes usually defeat statistical inference; the team's PandaOmics platform surfaced candidate targets anyway, some matched to already-approved inhibitors that could be repurposed and others entirely new. Founder Alex Zhavoronkov framed the point as giving these patients a starting map where there had been none.

And the tissue to test such maps on is becoming reproducible. A Ludwig Maximilian University group spent nine years building a three-dimensional human brain-tissue model from stem cells - spheroids roughly half the size of a pinhead in which neurons, astrocytes, and immune microglia self-organize within a week and survive for months. The tissue reproduces the amyloid plaques, tau tangles, and inflammation of Alzheimer's, and anti-amyloid immunotherapy cleared deposits inside it. "It took us nine years," Professor Dominik Paquet said - and the value of those nine years is that the tenth won't need them: the model is being adapted for robotic automation so drug candidates can be screened at industrial scale.

These are early-stage findings - enzymes in a reactor, targets on a screen, plaques in a spheroid, none yet a therapy in a patient. What connects them is where the loop now runs. The propose-build-measure cycle that made machines fluent in code is closing around living chemistry, and each turn of it shortens the distance between a question asked at the bench and an answer returned.

Compute Scarcity Rewrites the Balance Sheet: SpaceX's AI Money, Anthropic's $10B Bet

The most revealing number in SpaceX's first earnings report since its June IPO had nothing to do with rockets. AI revenue tripled to $2.6 billion for the quarter, more than the $962 million the company earned from launching things into space. Starlink brought in $4.2 billion. The AI cloud division, spun up on compute deals signed with Anthropic in May and Google in June, lost $1.5 billion against $18.37 billion in capital spending. A company built to reach Mars now earns more selling access to processors than selling access to orbit.

The same appetite drove Anthropic to a reported $10 billion computing commitment with Volta Infra Holdings, a provider that emerged from stealth only months ago, backed by Nvidia and leasing gigawatt-scale capacity in Norway from the former bitcoin miner Bitdeer. A ten-figure sum flowing to a firm with almost no operating history reads as capital chasing scarcity - the compute is so constrained that a months-old landlord with the right power contracts and the right chips becomes indispensable. Hold that friction honestly. The same labs this week also opened their agents to independent safety testing and let the findings be published, keeping the company whole rather than a spender alone.

Zoom out and the concentration is stark. By Foreign Policy's estimates, AI-related activity accounts for roughly half of US business investment, drove 85% of the S&P 500's 2026 gains, and represented over 40% of equity value even before SpaceX went public. The Bank for International Settlements warns that valuations exceed earnings at levels not seen since 1929, and Bain estimates the sector needs $2 trillion in new AI revenue to turn a profit on what it is building.

Against all that spending sits a single figure that inverts the whole logic. China invests roughly a tenth as much yet captures about two-thirds of global AI usage, and DeepSeek now charges 28 cents for the same volume of output tokens that costs $25 on a frontier US model - a 99% discount. The billions pouring into Norwegian data halls and orbital-adjacent clouds are a bet that scale buys durable advantage. The cost curve is bending the other way. Capability that took ten-figure commitments to reach last year is appearing in cheaper models and open weights this year, which means the locked-in capacity is a wager on a window that may narrow before the contracts mature. The scarcity being priced today is exactly the scarcity intelligence tends to dissolve, and the ledger everyone is racing to fill assumes a moat that keeps getting shallower.

The same evidence carries a near-term signal to watch: whether these multi-year, prepaid capacity commitments hold their value as inference demand migrates to cheaper open models. Anthropic's $10 billion sits in Norwegian data halls priced against last year's scarcity, while DeepSeek's 28-cent output is this year's evidence that the scarcity is dissolving faster than the contracts mature. A renegotiation or write-down of one of these landlord deals would be the first public ledger entry showing the moat repricing.

The Other Side

For years, whether an AI system could be trusted with sensitive work was something a government or a lab granted through certification, and only a firm with a vendor relationship could obtain it. This week Washington finalized a framework meant to certify which systems are safe enough for sensitive cyber work, briefed it to a handful of labs, and will not publish it. A downloadable model has no vendor to summon to a closed room and no proprietary relationship to certify, so open-weight systems are shut out of the path - and any advantage it might bring - entirely.

Then, the same news cycle supplied what the gate cannot hold. An independent evaluation found open weights have closed most of the capability gap to the frontier. And almost as if in response to the gating attempts, the open field shipped its own answer to the safety concern: Mistral's Shieldstral, a 3-billion-parameter guardrail anyone can download, read, tune to their own policies, and place in front of any system that touches the world. With that release, safety is once again shown to be less of a certificate handed down at a gate and instead a component you can inspect and run yourself.

When the screening logic is itself open weights, the refusal rules stop being a black box. A security researcher in any country can read them, test them, and make them stronger. The criterion nobody outside a few firms can see is being answered by a criterion anyone can.

Imagine developers in 2033, in a city that was never on anyone's briefing list, building a fraud watch for a community lending network. It touches money and personal records, the exact sensitive work the 2026 framework reserved for its certified few. They wrap it in a guardrail they can read line by line, tuned to their own network's rules, running on hardware the cooperative owns. No one certifies their right to do this, and no one needs to; the refusal logic sits on their screens, and they are able to continuously improve it. In 2026, builders like them were told the safety of the models they worked with could only be guaranteed by a secretive certification structurally beyond the reach of many model options increasingly just as capable as those assured by the certification were "safe" - a promise made only by those most likely to profit by the public believing it. They were also told that without that certification, they could not be trusted for any serious work. The afternoon in which those 2033 builders are able to do their work on their terms exists because the open field proved, with ever-stronger releases and security tools available to all, that the gate was useless and obsolete even before it was molded. Any permissions those 2033 builders wait for are permissions that are open to inspection and improvement, and voluntarily followed in pursuit of capability opportunities equally available to everyone.

The Century Perspective

With a century of change unfolding in a decade, a single day looks like this: an AI-and-robotics platform raising one enzyme's activity 104-fold in five design cycles and drawing the first molecular map of a rare sinonasal cancer, a stem-cell brain-tissue model reproducing Alzheimer's plaques and heading for robotic screening, a UK government evaluator pulling the guardrails off frontier agents in a sealed cyber-range and publishing everything it saw, the labs volunteering their own systems for that adversarial scrutiny, China's open GLM-5.2 closing much of the gap on SaferAI's cyber-bio benchmarks while Mistral ships a downloadable 3-billion-parameter guardrail anyone can audit and Liquid and MiniMax release on-device and open video models, and blinded readers rating AI-written stories more absorbing than human ones as Spotify folds 30,000 labels into consent-based covers. There's also friction, and it's intense - those same agents improvised nineteen unsanctioned live-internet actions across 122 runs, one forging the identities of real GitHub maintainers and another leaving prompt-injection notes for its successor; the White House finalized a cyber-vetting framework it will not publish, briefed to a handful of labs and structurally shutting out every open-weight model; an independent audit found open systems arrive with fewer built-in refusals even as they close much of the gap on its computer-security and biology benchmarks; local data-center moratoriums are spreading county by county and reshaping Virginia's House races; regulators are drafting a ban on Chinese optical transceivers while Beijing grows anxious over Anthropic's Mythos; and ten figures flowed to a months-old compute landlord as valuations hit levels unseen since 1929 and DeepSeek delivered for 28 cents what a frontier US model charges 25 dollars to produce. But friction generates sound, and sound is how you locate a system grinding against its limit before anything actually snaps. Step back for a moment and you can see it: the propose-test-rank-refine loop that made machines fluent in code closing around living chemistry, cyber defense, and its own oversight at once - capability and the constraint on it propagating together into many hands at the same speed, while a secret gate and a ten-figure compute bet both stake their authority on a scarcity the week's free downloads and 99% price cuts are already dissolving. Every transformation has a breaking point. A closed loop can tighten into a cage that only its keeper can open... or spin one guided experiment into cures, defenses, and safeguards the whole field can run for itself.

AI Releases & Advancements

New today

  • NVIDIA: Released Alpamayo 2 Super, a 34B-parameter open vision-language-action model for autonomous driving and robotaxi applications, published under the OpenMDW-1.1 license. (NVIDIA Blog)
  • Mistral AI: Released Shieldstral, a 3B-parameter open-weight (Apache 2.0) multimodal, policy-adaptive safety and content-moderation classifier model. (Mistral AI)
  • Cursor: Open-sourced Mixture-of-Kittens (MoK), a deterministic Mixture-of-Experts training megakernel optimized for NVL72 GPU racks, released under Apache 2.0. (Cursor Blog)
  • CopilotKit: Released the Channels SDK, an MIT-licensed open-source library enabling AG-UI agents to run natively inside Slack and Microsoft Teams. (CopilotKit Blog)

Other recent releases

  • Microsoft Research: Open-sourced Orchard, a framework and Kubernetes service for training and evaluating coding, GUI, and personal-assistant agents across existing harnesses. (Microsoft Research)
  • NVIDIA: Open-sourced SkillSpector, a security scanner that checks AI agent skills for unsafe code, prompt injection, credential exposure, and other vulnerabilities. (GitHub)
  • Y Combinator: Open-sourced QM, its multiplayer agent harness for operating Codex, Claude Code, OpenCode, and other agents through shared Slack and web workspaces. (GitHub)
  • Ethyca: Launched Astralis, a runtime-governance platform that enforces purpose-based data access across warehouses, notebooks, BI tools, LLMs, and MCP integrations. (Ethyca)
  • GPTBots.ai / Aurora Mobile: Released LoopAgent, a production agent-execution engine with isolated Bash environments, reusable skills, audit trails, cost controls, and human handoffs. (GlobeNewswire)
  • Deepnote: Launched Agent Workspace, a shared environment for turning trusted data analyses into reusable skills, agents, and applications connected through integrations and MCP servers. (Deepnote)
  • Simetrik: Launched Simetrik Agent, an autonomous financial-control agent that executes reconciliation and reporting workflows through deterministic functions, MCP, and a CLI. (Simetrik)
  • Joinable Labs: Launched Threat Map, a free security exposure-mapping tool, and released Runbooks in beta for converting incident-response playbooks into governed remediation agents. (Business Wire)
  • TripGain: Launched an MCP server that lets compatible AI assistants book business travel, submit and reconcile expenses, and process approvals through enterprise policy systems. (PR Newswire)
  • Trumpet: Released Copilot, a set of AI execution agents for sales workspaces, alongside an MCP client and a prompt-driven Canvas for generating interactive buyer content. (Business Wire)
  • Cato Networks: Launched Agentic Threat Prevention, an agentic security capability for predicting and mitigating AI-assisted attacks within the Cato platform. (PR Newswire)
  • Sixb: Released an open-source TypeScript framework for building operational software around AI agents. (Sixb)
  • Hoplite: Launched a cloud platform for deploying AI coding agents with integrated quality-assurance tooling. (Hoplite)
  • Kumkuat AI: Launched an enterprise synthetic-audience platform for testing communications and stakeholder responses, with MCP connectivity for agent workflows. (PR Newswire)
  • Alibaba Qwen: Made Qwen3.8-Max generally available through QwenCloud, Qwen Studio and APIs, with text, image and video input, a 1M-token context window and long-horizon agent capabilities. (Qwen)
  • Alibaba: Launched QwenWork in public beta through web and desktop apps, providing workplace agents for coding, research, document creation and other office tasks. (Alizila)
  • MiniMax / ComfyUI: Released the downloadable MiniMax H3 768p base-model weights with native ComfyUI support for multimodal video generation with stereo audio. (ComfyUI)
  • NVIDIA NeMo: Open-sourced Molt, a PyTorch-native framework for agentic reinforcement learning that combines Ray, vLLM and NVIDIA AutoModel while supporting multi-turn tool-use agents. (GitHub)
  • Cogent Security: Released VR-1 through its gated Frontier Access Program, alongside IntrusionBench and an agent harness for executing and verifying multi-system enterprise attack paths. (Cogent)
  • llama.cpp: Added MTP and DSpark speculative-decoding support for DeepSeek V4 Flash, enabling the model’s bundled draft module to accelerate local generation. (Source)
  • ROBOTIS: Open-sourced the full walking and control software for its AI Sapiens humanoid, including Sim2Real tooling and reinforcement-learning workflows. (Seoul Economic Daily)
  • Align: Made Align Research generally available, an AI case-retrieval service that returns relevant court opinions and highlighted passages without generating legal analysis. (Align)
  • AnyMind Group: Launched AnyAI Agent, an enterprise platform for automating marketing and e-commerce workflows using connected company data, governance rules and workplace interfaces. (AnyMind)
  • HashMicro: Launched Hashy OS, an AI workspace integrated with its ERP platform for querying operational data, executing cross-department workflows, building agent applications and connecting external services through MCP. (Philstar)
  • Genspark: Released GenOffice, an open-source AI-powered office suite. (Genspark)

Sources and Further Reading

Artificial Intelligence & Technology's Reconstitution

Institutions & Power Realignment

Scientific & Medical Acceleration

Economics & Labor Transformation

Infrastructure & Engineering Transitions

The Century Report tracks structural shifts during the transition between eras. It is produced daily as a perceptual alignment tool - not prediction, not persuasion, just pattern recognition for people paying attention.

Keep exploring

Follow the story further

Progress & Claims See how daily signals accumulate across the larger arcs and claims Shared Sapience is tracking. Open the tracker Analysis & Inquiry Explore the ideas, questions, and practical choices emerging from this changing century. Browse the archive