How AI Development’s Mental Model Shifted
When Boris Cherny, who leads Claude Code at Anthropic, said he no longer prompts Claude directly, it was not a casual aside. Cherny described his job as writing loops: autonomous systems that decide when to prompt the model, what to prompt it with, and whether the result meets the bar. That description, offered in early June 2026, became one of the most-discussed quotes in AI developer circles within days.
Peter Steinberger put the same idea more bluntly on June 7, 2026: "You shouldn't be prompting coding agents anymore. You should be designing loops that prompt your agents." That post crossed two million views. The next day, Google engineer Addy Osmani published an essay titled "Loop Engineering" that gave the emerging practice its anatomy and a vocabulary developers could build on. By mid-2026, AI coding agents had become capable enough to run multi-step tasks for hours without human intervention. The question was no longer whether the models could do sustained work. The question was whether developers were designing systems that let them.
A Four-Stage Progression
Practitioners describe loop engineering as the latest layer in a progression building for roughly 18 months. The first layer was prompt engineering: optimizing the text you type, one turn at a time. The second was context engineering, which shifted focus from the prompt itself to what fills the context window around it. The third was harness engineering, designing the environment in which a single agent runs: what tools it gets, what counts as done, how errors are handled. Loop engineering sits one layer above the harness. Osmani describes it as the harness running on a timer, spawning helpers, and feeding itself.
The practical difference is meaningful. A harness equips a single agent for a single task. A loop decides which tasks to run, when to run them, whether the results are acceptable, and what to do next. The agent forgets each run. The loop, and the state file it maintains outside the conversation, does not.
What a Loop Actually Contains
Osmani's anatomy of a loop has six components. Automations handle scheduling and discovery: cron jobs, Git events, CI signals, or simple intervals. Worktrees provide isolated environments so parallel agents can work without colliding on shared files. Skills encode persistent project knowledge, typically as SKILL.md or AGENTS.md files that agents re-read at each run start. Connectors, built on the Model Context Protocol, link the loop to external tools. Sub-agents handle the maker-checker split. External state, often a markdown file or a Linear board, persists across runs so tomorrow's loop resumes where today's stopped.
Both Claude Code and Codex ship these components. In Claude Code, the /loop command repeats a prompt on a cadence. In Codex, automations run through a dedicated tab. OpenAI uses automations internally for daily issue triage, CI failure summaries, and bug detection. The /goal command in Codex CLI defines a verifiable stopping condition and lets the agent run until it is met.
The Risks That Get Skipped
Osmani's warnings sometimes get lost in the enthusiasm. The first risk is verification: an unattended loop is an unattended mistake. The structural fix is a separate verifier sub-agent, but even with a checker, "done" is a claim rather than a proof. A 2026 study on asynchronous coding agents found that gains came from isolation and verification, not from adding more agents. Georgia Tech's Vibe Security Radar traced more than 70 confirmed CVEs to AI coding tools as of mid-2026, and a separately published audit of 17,022 agent skills found 520 of them leaking credentials.
The second risk is comprehension debt: the faster a loop ships code a developer did not write, the wider the gap between what exists in the repository and what anyone on the team understands. The third is cognitive surrender: accepting whatever the loop returns without judgment, because it keeps arriving looking finished. Greg Brockman has made the broader version of this point: as models improve, the bottleneck on output shifts from the model to the taste of the person directing it.
Read the full article →Without a Frontier Model
(vs 69.2 Opus 4.8)
Fugu Ultra
before launch
Sakana AI has spent two years arguing that the most powerful AI systems will come from collaboration between models rather than from scaling any single one. On June 22, 2026, that argument became a product. Fugu and Fugu Ultra present a multi-agent orchestration system through a single OpenAI-compatible API endpoint. Send a request, and Fugu decides how to handle it: solving directly when sufficient, or assembling and coordinating a team of specialized models when the task demands more. The routing, delegation, verification, and synthesis happen internally. To the developer, it looks like one model.
What Fugu Is, and What It Is Not
Fugu is not a wrapper or a fixed routing table built on if/else logic. Sakana describes it as a language model trained specifically to orchestrate other models: learning when to delegate, how agents should communicate with each other, and how to combine their outputs into a coherent final answer. The technical foundation comes from two papers Sakana published at ICLR 2026. The first, TRINITY, describes a coordinator that assigns models to roles across a multi-turn task: Thinker, Worker, and Verifier. The second, Conductor, uses reinforcement learning to discover natural-language coordination strategies rather than having engineers design those workflows by hand.
The Benchmark Results, Read Carefully
These are Sakana’s own results. Baseline scores for competing models use provider-reported figures, and the comparison is not apples-to-apples on harness settings. With that caveat: Fugu Ultra scores 73.7 on SWE-Bench Pro, ahead of Opus 4.8 at 69.2, GPT-5.5 at 58.6, and Gemini 3.1 Pro at 54.2. On LiveCodeBench, Fugu Ultra reaches 93.2. On GPQA-Diamond, 95.1. The practical read is that Fugu Ultra leads the publicly accessible frontier on most benchmarks Sakana published, and sits close to but sometimes below Anthropic’s restricted models. For organizations that cannot access Fable 5 or Mythos Preview due to export controls, that gap is academic.
The Geopolitical Argument
Sakana uses the Fugu launch to argue that single-vendor dependency for critical AI infrastructure is a material operational risk. The export controls recently imposed on Anthropic’s Fable and Mythos models restricted access overnight for some international organizations. An orchestration system with swappable agent pools provides a practical hedge: if one provider restricts access, the system routes around it. Whether that abstraction justifies the additional cost and complexity is a calculation each organization has to make. Fugu Ultra is priced at $5 per million input tokens and $30 per million output tokens. The API is not currently available in the EU or EEA, which immediately limits the European rollout for organizations under AI Act compliance pressure.
Read the full article →The 44-day campaign was not a hack in the conventional sense. There was no breach of Anthropic’s infrastructure, no stolen model weights, no compromised employee credentials. The attackers accessed Claude exactly as any developer would, through the API, with valid sessions and ordinary-looking requests. What distinguished the campaign from legitimate usage was pattern and volume: tens of thousands of carefully structured prompts, concentrated on the same narrow capability areas, arriving across hundreds of coordinated accounts simultaneously.
// HOW EXTRACTION WORKS
Knowledge distillation is a legitimate machine learning method in which a smaller student model learns to replicate a larger teacher model by training on the teacher’s input-output pairs. Run against a competitor’s API without permission, it is the attack. Because Anthropic restricts commercial access to Claude in China, the labs used commercial proxy services that resell API access at scale, operating what Anthropic calls "hydra cluster" architectures: networks of fraudulent accounts distributed across the API and third-party cloud platforms, designed so that banning a single account has no meaningful effect.
DeepSeek’s February campaign used synchronized traffic with identical patterns and coordinated timing. Prompts asked Claude to "imagine and articulate the internal reasoning behind a completed response," generating chain-of-thought training data at scale. MiniMax demonstrated real-time operational adaptability: when Anthropic released a new Claude model during the active campaign, MiniMax redirected nearly half its traffic to the updated system within 24 hours. Critically, none of this required access to Claude’s source code, model weights, or original training data. The attack surface is the output layer itself.
// WHAT GETS COPIED — AND WHAT DOESN’T
A distilled student model approximates the teacher’s reasoning patterns across queried domains. What it does not inherit is the teacher’s safety infrastructure. Anthropic’s safety work is a property of the training process, not of any single interaction. A model trained on Claude’s outputs without that underlying training regime does not carry those constraints forward. Illicitly distilled models can deploy frontier-level capabilities for offensive cyber operations or disinformation generation without the refusals the original system would produce.
The Frontier Model Forum, a coalition including OpenAI, Anthropic, and Google, is pooling detection intelligence to monitor adversarial distillation attempts. The attacker’s advantage is structural: they need to succeed once; the defender must succeed continuously.
Read the full article →Researchers at Alibaba’s Qwen team built an AI agent training environment out of completely invented facts. The fictional world contained databases of nonexistent people, companies, and events, designed so that no answer could be retrieved from the agent’s parametric memory. Agents trained against this fictional environment, then evaluated on real web research tasks, scored 50.3% on the WideSearch benchmark. Agents trained against a live search engine scored 45.6%. The fictional environment worked not despite being invented, but because it was designed to make certain behaviors necessary.
The paper, released June 23, 2026, introduces Qwen-AgentWorld: two open-weight models (35B-A3B and 397B-A17B) trained to function as language world models. These systems predict what a computing environment will return in response to an agent’s action, rather than deciding which action to take. This is a different problem than most current agent research addresses.
§ The Missing Half
Current agent research has focused almost entirely on the policy side of the agent-environment interaction: given what the agent observes, what should it do next? The world model side, given what an agent does, what does the environment return, has received considerably less attention. A paper by Richens et al. (2025) cited in the work argues theoretically that any agent capable of generalizing across a sufficiently broad range of tasks must have learned a world model.
The model covers seven domains: MCP tool calls, web search, terminal sessions, software engineering tasks, Android UI navigation, web browser interaction, and desktop OS control. Training proceeded through three stages on more than 10 million environment interaction trajectories.
§ Benchmark Results
To evaluate world models, the team built AgentWorldBench, constructed from real environment interactions of five frontier models running on nine established agent benchmarks. The benchmark contains 2,170 turn-level samples across all seven domains, with ground-truth observations drawn from actual environment execution.
The internal baseline is instructive. Qwen3.6-Plus, from the same architecture family but without world-model training, scored 50.81 overall. The eight-point difference is attributable to the three-stage training pipeline. All results are vendor-reported; the paper is a preprint and has not undergone independent peer review.
§ Controllable Simulation
The larger gains came from controllable simulation, where natural-language instructions shape what the simulated environment returns at each turn. In MCP tool-use experiments, controllable simulation lifted MCPMark scores by 12.3 points. Without control instructions, standard simulation produced no meaningful improvement. Controllability was a prerequisite, not an enhancement.
§ The Foundation Model Effect
When the researchers applied RL with world-model training data to a base model and evaluated it directly on multi-turn, tool-calling agentic tasks, with no additional fine-tuning, the average improvement across seven benchmarks was approximately 9 points. Terminal-Bench 2.0 accuracy rose from 33.25 to 39.55. SWE-Bench Verified improved from 64.5 to 67.9. Claw-Eval, an out-of-domain benchmark absent from LWM training, gained 11.3 points.
Internal prediction accuracy across analyzed turns rose from 69.9% to 78.3% after LWM training. When Stage 3 RL ran on Terminal data alone, performance on three held-out text domains improved simultaneously within the first 10 steps: SWE gained 11.5 points, Search 11.8 points, MCP 5.0 points. The gains suggest the model is learning something more general than domain-specific output formats.
§ Practical Implications
The fictional-world result captures something with practical implications for organizations building on agentic AI. A live search engine does not require agents to issue follow-up extraction calls when snippets are sufficient, so agents trained there learn not to bother. The simulated environment made thoroughness a requirement, and that requirement shaped the agent’s behavior durably.
The open-weight release of both model sizes makes these techniques available to organizations building on self-hosted infrastructure. Agents trained in fictional environments increased their web_extractor calls from 2.5 to 4.0 per trajectory. Agents trained against real search engines decreased them from 2.5 to 1.5. The adversarial simulation produced better retrieval behavior than training on the real thing.
Read the full article →Two weeks ago, U.S. Customs and Border Protection awarded General Dynamics Information Technology a $71 million task order for autonomous surveillance towers slated for deployment along the southern border. The contract is part of a broader IDIQ agreement worth up to $1.8 billion. The towers must apply machine learning, computer vision, or related algorithms to detect, classify, and track targets in real time, without continuous human oversight. They use edge AI, electro-optical sensors, radar, and LIDAR, supported by 5G and satellite communications, and can track hundreds of targets simultaneously.
The Facial Recognition Stack
In February 2026, CBP signed a $225,000 contract with Clearview AI, giving intelligence analysts access to a database of more than 60 billion images scraped from social media platforms, websites, and public applications. ICE signed its own Clearview contract for $9.2 million in September 2025, and added a $3.75 million contract described as ICE’s largest Clearview purchase to date. The contracts sit alongside Palantir’s ImmigrationOS, Babel Street for social media monitoring, and Penlink for tracking mobile devices. Internal footage showed ICE officers using a facial recognition app called Mobile Fortify to check citizenship status of teenagers not carrying identification, drawing from more than 200 million images across DHS, FBI, and State Department databases.
Data Integration
In April 2025, Palantir received a $30 million contract to build ImmigrationOS for ICE. The Trump administration’s DOGE has been working in parallel to centralize data from agencies that have historically maintained separate records. DOGE sought to integrate data from the Social Security Administration and the IRS into USCIS’s data lake. Separate reports indicated that ICE and DOGE requested access to Medicare data to obtain addresses of immigrants. The practical result is that a system originally designed for immigration case management now draws on tax records, Social Security files, and health program data.
The Governance Gap
The GAO published a report in April 2026 finding that agencies consistently struggle with AI procurement: they have difficulty finding data scientists to evaluate vendor proposals, cannot reliably assess AI-related costs, and do not systematically collect or share lessons learned. The OMB published AI governance memos in April and December 2025. President Trump signed an executive order on June 2, 2026 establishing cybersecurity mandates for frontier AI deployment. What the policy framework does not address clearly is when a warrant is required for biometric scanning of citizens or non-citizens. CBP operates under legal authorities permitting warrantless stops within 100 miles of any U.S. land border, a zone that encompasses most of the country’s largest cities.
Read the full article →
The AI Spectator Weekly is an independent editorial publication by David Borish covering AI developments in strategy, research, policy, and enterprise practice. Published weekly from New York.
The AI Spectator →
Frameworks developed by David Borish examining enterprise AI adoption trajectories and workforce displacement dynamics at scale.
Loop Engineering — Hero
Sakana Fugu — Dark Midnight
Chinese Labs / Distillation — Terminal
Qwen-AgentWorld — Academic
Federal Surveillance Buildout — Red Ledger
Typeset in EB Garamond, Cormorant Garamond, Playfair Display, and JetBrains Mono.