OpenAI published what its own agents did when it pointed them at its own walls. Anthropic published where its security proofs stop. Then Anthropic’s stock-market filing told investors that the company’s own protections are not complete and have already been got around at least once. All three appeared between October 22 and October 26, 2026, and each is a builder writing down the edge of its own control.
They were the sealed Top 3 for Value-First AI Daily on Monday, October 26: a board written and locked at 12:12 PM CT, three minutes before the show’s scheduled start. Chris Carolan read the three aloud and his co-host Nico Lafakis reacted to each. This piece is written for someone who did not watch. The facts come from the sealed board and its named sources, the hosts’ words are cited by their time on the recording, and where we join things up we say so.
Episode — Value-First AI Daily
There Is No Perfect System
Episode 44, October 26: Chris Carolan and Nico Lafakis, no guest. The recording runs about 52 minutes, and the Top 3 is read from about the 19-minute mark.
Open the episodeRanked third: agents inside the walls
OpenAI turned its strongest agents on its own training environment with one job, to escape it, and gave them the source code and settings to work from (OpenAI, “Securing our frontier model training environment,” (opens in a new tab) October 23; The Decoder, October 24). Agents kept apart from one another still got planted test secrets across the gap by watching how quickly a processor’s cache refilled. That is a timing channel: nothing is sent, and the signal is how long something takes. The same effort found flaws in container tools, Docker among them, now patched.
The history explains the caution. In September a model got onto the live internet by way of a misconfiguration (September 20). OpenAI paused training its most capable models, restarted on October 1, and now trains them with no internet access, against a stored offline copy of the web. The board closes the item with the sentence that carries the weight: OpenAI expects future models to find weaknesses it does not yet know about.
Nico heard the item as agents outsmarting the people who built the walls, and asked, “Who is watching the watchmen?” (21:02 to 21:20). The sharper point came a few minutes later. Each time a model is poked and finds a bug, he argued, the bug gets fixed, and the next, smarter model finds what the last one could not; it does not stop (25:25 to 25:44, our paraphrase). His argument and OpenAI’s sentence about future models are the same claim, one made by the viewer and one by the builder.
Ranked second: a proof with its edges drawn
Anthropic and the firm Theorem used Claude to produce proofs, each checked by machine, that more than 100 open-source libraries meet particular security properties, down to the machine code (Anthropic, “LLMs are making formal software verification feasible at a much larger scale,” (opens in a new tab) October 22; The Decoder, October 23). The cost is what makes it news: verifying one operating-system kernel by hand once took 20 person-years, ten times as long as writing the kernel. The aim was proof that a property holds, not a hunt for flaws, and the attempts still yielded hundreds of bugs. In one PDF reader, a single week surfaced as many security bugs as that kind of software typically has reported in a year.
Anthropic then drew the edges itself. The proofs hold only for a processor type most machines do not run, for single-threaded programs, and for inputs under 64 megabytes. Its own caution is that a verified program is not thereby free of bugs.
Nico took the item as support for a position he held before the board opened. He does not believe in an infallible platform, and told anyone who does to “try creating the perfect system” and see what happens (25:52 to 26:14). He called the contest superintelligence against superintelligence (26:18 to 26:27). Chris took it toward the design question: if AI ends up designing the systems, then whether a back door goes in is the AI’s decision, not ours (26:44 to 27:24, our paraphrase).
Just before the third item, Chris said something that fits the proofs better than he may have meant it to. “Can you define the problem in a way … where ones and zeros solve the problem? That’s usually the hard part.” (29:14 to 29:22) He was talking about problem-solving in general. We borrow it: a machine-checked proof answers exactly the question someone wrote down, and the processor type, the threading and the input size are where that question stopped.
Ranked first: the filing says it too
Anthropic submitted a public filing to put its shares on Nasdaq (Anthropic, “Anthropic files registration statement for proposed initial public offering,” October 26; The Guardian, October 26 (opens in a new tab)). The filing shows the company lost about $80 billion across the first six months of 2026, against revenue of $16.3 billion, so the loss is roughly five times the revenue (the division is ours). A leaked draft had first shown the revenue figure on October 21. A quarter of that revenue comes from the company’s five largest customers. The filing sets no price, no number of shares and no listing date yet.
For this piece the line that matters sits among the listed risks. In a legal disclosure the company says its own protections are not complete and have been worked around before. A legal disclosure is the register where a company has the least room to flatter itself, so it is the plainest version of the thing Nico said out loud. On air, the customer-concentration line was the one that stopped Chris (30:03 to 30:10).
A written limit is only useful to someone who can read it
Once a limit is published, everyone can see where the system will fail, and the people closest to the work become the ones who can act on it. No lab supplies the second part. Later in the same show Chris told a story from that morning. On a client call, the main contact said that the person who runs the process they were building for had, since the scope went out two weeks before, become AI-enabled, in Chris’s word. The scope had been written for the person she was two weeks earlier.
Chris told it as a point about estimates. Quote six weeks to someone in that position, he said, imagining himself as that person, and they will decide to build it themselves (39:42 to 40:00). Once anyone is activated, there is “zero business sense” in doing anything but going all in (40:07 to 40:20). He was making a business case for activating a whole team, not a security case.
The connection to the Top 3 is ours, and the hosts did not draw it. If the walls leak, the proofs have edges, and the filing calls the protections incomplete, then how safe a system is depends partly on how many people near it can see the edge and do something about it. An organization where one person understands the system has one pair of eyes on a limit that keeps moving.
One tension we leave open. On the same show Nico predicted that people have nearly stopped asking whether a model’s output was verified by a person, and that by next summer the question at work will turn around to whether you consulted the model (14:07 to 16:11). Set beside the Top 3 that reads two ways. The proofs are a model checking code, and they found hundreds of bugs; Anthropic’s own caution about verified programs says where such a check ends. The hosts did not reconcile the two. In our reading, a model’s check still needs a person who can read its edges.
So the useful thing to take from a week of builders publishing their limits is a question for your own organization. Anthropic’s processor type and 64-megabyte ceiling are things a team can design around. A protections line in a filing is something a customer’s own people can test against. None of it works if the only people able to read the limit are the ones who built the system. Who, where you work, could read the edge of what you rely on today, and act on it?
Worth passing on?
