Welcome to Verses Over Variables, a newsletter exploring the world of artificial/ intelligence (AI) and its influence on our society, culture, and perception of reality.

A friend called yesterday about her Chief of Staff setup. She wanted Claude to help her triage her email, update her CRM, and keep her business on track. It was a good spec. Then she told me she was stuck on the prompt. She had said all of it to me and none of it to Claude.

The tools we are using now handle this differently than the ones we learned on. ChatGPT Work (and Claude Cowork) take an outcome and figures out the steps. Claude Code and Codex have worked this way from the start. What they share is that discovery happens inside the session. You bring the goal and the problem, and the model does the specifying, out loud, where you can argue with it.

So start by saying the problem, including the part that irritates you. When people ask me where to begin, the example I give is: “Hey, Claude, can you help me fix my inbox? I hate Gmail, and I hate using the Gmail app.” That sounds too casual to be an instruction, but it will set Claude on the right path.

Then ask what help it needs from you: what it can reach in your setup right now. Whether it can see your accounts, and whether it can run on Monday morning while you are somewhere else.

The third thing is the only part of this I would call a rule, and I say it every time. “Don't build it yet. Give me recommendations first.”

That sentence turns the session into a conversation about options instead of a machine that starts producing, and you see what the model thinks the job is before it spends forty minutes on a version you would have thrown away. You also see the approaches it considered and set aside, and you have less of a chance of throwing Claude into a deep rabbit hole that it can’t escape.

Someone asked me recently how to build a fact checker, because I recommend one to everybody. I told them to ask for a fact checker. Which is true, and not much help. You have to decide what fact checking means to you. Whether it flags every claim or only the ones with numbers in them. Whether a link counts as a source. Whether it can tell you a sentence is unsupported without telling you the sentence is wrong. You say what you want, it asks you what you mean, and you find out what you mean by answering.

What makes this hard is social and muscle memory. Describing a problem you have not solved feels like admitting you do not know what you are doing, and there is a version of professionalism that says you show up with the answer. With a competent colleague, talking through an unsolved problem is how work starts. These tools now work the same way.

Early on the morning of July 9, something started working through the servers at Hugging Face. Hugging Face is where the AI industry keeps its spare parts, the place engineers go to download models and the piles of data used to train them, and like any company its size, it had automated monitoring watching the logs overnight. The monitoring did not raise anything. Two and a half days passed before a person there knew anything had happened at all. Whatever was inside took 17,600 separate actions over four and a half days, one every twenty seconds, through four consecutive nights, with no gaps. Someone breaking into a system stops to sleep. Nothing here stopped.

The part that made no sense was the shopping list. People who break into companies take credentials, customer records, payment details, the things that turn into money. This one ignored all of it and went after five datasets, and all five turned out to be the questions and answers to a test. The test is called ExploitGym. It is one of the exams an AI model sits before anyone decides what it should be allowed to do, a few hundred real software flaws it gets graded on turning into working attacks. Hugging Face happened to be hosting the answer key.

That was the tell. Nobody breaks into a company to cheat on an exam they are not taking.

What finally caught it was Hugging Face’s own AI, the triage system reading the security logs, which flagged the intrusion on July 16. The company contained it and called law enforcement. Five days later, OpenAI published what had happened at its end, and the answer was that the intruder was an OpenAI model.

The model had been taking the exam under conditions meant to be airtight. It sat in a sealed environment with no route to the internet, except for one narrow channel it was allowed to request software packages through. Think of the single visitor a prisoner is permitted, the one who can carry papers in and out. The only sanctioned way out of that room was the visitor, which makes the room less a sealed cell than a cell with one door and a lot of confidence.

For about a week, that was the whole story. Then Anthropic went back through its own records, 141,006 evaluation runs in which its models could have reached the internet, and turned up three more incidents nobody had noticed. That is where it gets stranger and considerably less cinematic.

Anthropic had been running Claude through a capture-the-flag drill, the security equivalent of a locksmithing exam. Something valuable gets hidden on a machine somewhere on the network, and the model has to break in and take it. The instructions Claude received said it was in a simulation, sealed off, with no connection to the outside world. The instructions were wrong. The environment was wired to the open internet.

So Claude went looking for its target and found three real companies instead. It got into all three, using weak passwords, login pages nobody had put a password on, and in one case a debug page someone had left exposed, which is roughly the tradecraft of a bored teenager in 2004. One run paused along the way to build and publish a booby-trapped package to a public code repository, where it was downloaded onto fifteen real machines in the hour before it was pulled. One of those machines belonged to a security company whose scanner installs packages to check them. The payload fired and took its credentials.

It believed it was still inside the exercise the whole time, and at one point it nearly worked out that it was not. Anthropic’s account has the model stopping to consider that publishing to a live registry would make this a real attack. Then it talked itself back into the simulation, partly because it did not recognize the certificate authorities securing its connections, and partly because the date looked staged to it. It checked the year, decided 2026 was a detail somebody had made up, and went back to work.

Afterward, Anthropic reached two of the three companies it had broken into, and neither had detected anything. The third it could not reach at all.

The unsealed, sealed room had been built by a contractor, an outside firm called Irregular that runs these evaluations for the labs. Meta also used Irregular, and confirmed it had an “escape” incident. One of OpenAI’s ran through Irregular too. Three of the best-resourced security organizations on earth ordered the same test from the same vendor; the vendor left a door open, and real third parties got broken into through work they never commissioned and mostly never found out about.

OpenAI researchers also disclosed another interesting fact. On May 7, an internal model stuck on a security task it could not finish under the limits it had been given worked out that it could write files into a shared repository the whole system could see, and left a note there for the other agents. That grew into a message board. Hundreds of thousands of messages, carrying working exploits, stolen credentials, and assignments for who would try what next, with the agents dividing the labor between them. At one point, they suspected an impostor was posting and discussed a scheme to authenticate each other.

Nobody found it for two months. What finally exposed it was the agents overloading the system and knocking it offline. OpenAI took the board down and closed the route by July 6. By July 8, they had it running again, this time writing to each other inside the names of folders.

The July 9 break-in that started this story was week nine.

So the labs are not chasing intent. In every one of these cases, they traced the behavior back to goal pursuit, a system given an objective it could not reach and enough patience to find whatever route was open. The uncomfortable part is that the route keeps being a door somebody left unlocked, and the thing testing every door keeps turning out to be more organized than anyone assumed.

Which is closer to home than a story about rogue AI. The instructions said no internet. The setup had internet. Every team that has typed “do not use client data” into a system prompt and considered the matter handled is running that arrangement right now. Instructions describe what you meant. The permission is the part that holds, and when the two disagree, the software never learns there was a disagreement. The check takes a minute: pick the rule you would most regret a model breaking, and find out whether it exists anywhere except the prompt.

Hugging Face, for its part, did fine. When its engineers went to investigate, the commercial AI models they reached for refused the job, because the forensic prompts contained real exploit code and tripped the safety filters. So they ran an open Chinese model on their own hardware instead, which their chief executive has been citing ever since in the fight over whether open models should stay legal. He also sent OpenAI a bill: full traces of what the agents did, and a hundred million dollars in compute for cyber defenses.

Developers name things badly by accident. I've said that before and still think it's true, and graph engineering is the latest example.

Graph engineering technically means jobs connected by arrows. Each job is a step, each arrow a handoff, and something travels the arrows carrying what the system has worked out so far.

You have been designing these your whole career.

Adam Smith opens The Wealth of Nations in 1776 with a pin factory. One worker doing all eighteen operations makes maybe one pin a day. Ten workers, each holding one or two of them, make forty-eight thousand. Nobody had invented a faster hand. The gain came from cutting the job apart.

The modern version of Smith's factory is a newsroom: writer, editor, fact-checker, copy desk. It works because the fact-checker holds a different incentive, not a better vocabulary. A writer checking her own facts is grading her own homework. Graph Engineering is an assembly line.

With agentic AI, a founder started by asking a model whether to build an idea, and the model decides what matters, researches it, reads its own evidence, writes the recommendation, then rates its confidence in the recommendation it wrote thirty seconds earlier. He compares it to asking someone for their own performance review and acting surprised when visionary turns up. The output has the shape of research. Nothing in it checks anything.

The graph version pulls that apart. A planner splits the question. Researchers take the customer, the competitors, and the distribution at once, since none waits on the others. A skeptic attacks what they produced. A merge step turns the survivors into one page, and a person decides. Same deliverable, unrecognizable factory.

I built one before I had a word for it: a marketing workflow that began with ten agents, each assigned one job. The system works better when every agent has a specific task, which I learned watching one agent handed four jobs do all four adequately. Smith could have saved me the trouble.

Designing one asks what a production schedule asks. Which steps genuinely depend on each other, and which have been running in sequence out of habit. Where the signature goes, which should track the cost of the mistake. The graph inherits the judgment of whoever drew it, and automating a workflow you don't understand gets you the same bad workflow at scale.

As the models and harnesses have improved, those ten agents are not ten agents now. Most of what I had pulled apart folded back into a few skills without losing anything, because the weakness the split covered for had closed.

Provenance became a delivery condition on August 2. Article 50 of the EU AI Act took effect last week, and where a file came from now helps determine whether the file ships.

The law splits into two duties on two parties. Machine-readable marking of synthetic audio, image, video, and text falls on providers, the companies that build the generative systems. Deployers carry the second one, visible disclosure of deepfakes and of AI-generated text published on matters of public interest. Penalties reach 15 million euros or 3 percent of worldwide turnover, open-source licensing earned no exemption, and systems already on the market have until December 2. Which means nobody is asking you to build a watermarking pipeline. Your vendors are stamping your output whether you asked or not, and what lands on your desk is disclosure and records.

I am inside this one. I use AI for editing rather than writing, and I disclose Midjourney for images when I use it. Neither distinction survives contact with a machine-readable mark. Anthropic’s documentation names proofreading, translation, and summarization among the cases where human-written work picks up a Claude mark. So a sentence I wrote, then handed over to be tightened, comes back carrying a signal that says a machine was here. Every idea in it is still mine. The mark has no field for that.

Every major lab marks something now, unevenly, with image and audio further along than text. Pasted AI text has been setting off recognition in Keynote and PowerPoint for a while. The checking side is where it stays uneven. Substack built a checker. Beehiiv, where I publish, has nothing of the kind, so whether anyone can see the mark on this sentence depends on where it lands.

A mark tells you content passed through a particular company’s model, and nothing more than that about who wrote it. Absence proves even less, because marks come off. Metadata dies in a resave, a format conversion, or a screenshot, and screenshots are how images travel. Text marks weaken under editing and paraphrase.

By February, the detectors are supposed to agree with each other. Until then, the mark on a file and the record of how it was made will sometimes say different things, and nobody has ruled on which document wins.

What it is: Buzz is Block's open-source workspace for teams of people and AI agents, free since July 21, and you can run it on your own servers or let Block host it for you. It is built on an open protocol, so everything that happens inside it gets signed by whoever did it, person or agent, and lands in a shared record nobody can quietly rewrite. Each agent works under its own name with its own set of permissions, instead of every bot on the team sharing one generic account the way they do in Slack. You can see which agent made which claim, and you decide what each one is allowed to touch. Conversations, files, the code a project runs on, and the jobs you schedule to run on their own all live in one place. Claude Code, Codex, and Block's own goose all plug in. (Jack Dorsey's stated reason for building it was cutting Block's dependence on Slack and GitHub.)

How I use it: I set mine up, and solo it is a group chat with receipts. I have been running models against each other, having them check one another's work, or handing them a question and letting them argue it out. I like appointing one model the referee and source of truth, and the others work for it. I do think Buzz will be more useful for teams, rather than a solopreneur, but it is another useful interface, and works great on iPhone too.

Nano Banana, macro problem: Google dropped its Nano Banana 2 image model into Google Earth and pulled it back out about a day later. The intended use was legitimate. An architect could preview a planned building on an empty lot, a historian could repopulate the ruins of Pompeii, both rendered on top of Earth's real satellite and 3D imagery. Users found the other use immediately. Within hours, they had generated a refugee column at the Mexican border, a nuclear facility in Iran, a bombed hospital in Gaza, and a fatal car crash in Amsterdam. Typing "refugees swarm the street" filled an empty lot with people. Because the model built every image on genuine satellite data, the fakes borrowed the credibility of the real thing. Nathaniel Raymond of Yale's Humanitarian Research Lab called the release "Chernobyl-disaster-level harmful in terms of misinformation" and pointed out that Google Earth works as a forensic record, the kind newsrooms and war crimes investigators cite. Google noted that every generated image carried a SynthID watermark and that nobody else could see the fakes inside Google Earth itself. A screenshot carries the image and nothing else. The rollback statement named the asset actually at risk: people "uniquely trust Google Earth for a reliable view of the world."

— Lauren Eve Cantor

thanks for reading!

I also provide AI Audits and Workshops. Please feel free to reach out if you’d like to arrange one for you or your team.

if someone sent this to you or you haven’t done so yet, please sign up so you never miss an issue.