Latest / Braid / The Ban That Lasted Four Hours

Transcript

The Ban That Lasted Four Hours · Braid

• 0:04
  lenar: Here's a thought experiment to open with. Suppose you run a startup in Austin, and your whole product sits on a fine-tuned Chinese open-weight model — because that was the best capability you could get at a price you could afford. How much warning would you expect before that became illegal? A year? Six months? [pause] Yesterday, for about four hours, the answer looked like it might be: an executive order's worth.
• 0:28
  damra: And then it un-happened, which is almost the better story. That report-and-denial cycle is our lead today. After that we've got the viral gigawatt data center that turned out to be a tenth of a gigawatt, and OpenAI pausing a model over its behavior rather than its outputs. Then a stack of production agent-security talks with actual numbers in them, the Bun rewrite bill, a big American open-weight release, and some restructuring news with one strange detail in it.
• 0:56
  lenar: So, the lead. Yesterday morning, Andrew Curran surfaced an Axios report saying the Trump administration is weighing an executive order that would ban Chinese open-source models in the United States — reignited, per the report, by the Kimi K3 release. And then, by early afternoon, Sophia Cai reported that a person familiar with the discussions says Commerce isn't moving forward with it at this time. The whole arc, from report to walk-back, fit inside a single working day.
• 1:26
  damra: Which is itself informative, right? Somebody floated this. Whether it was a trial balloon or a genuine draft order that hit resistance, the reaction told them what they needed to know. The LocalLLaMA subreddit read it as US labs lobbying to ban their open-weight competition, and that read spread fast.
• 1:46
  lenar: That read is the accusation in the air, and it's only half-sourced — the Axios piece reports the administration was considering it, and the denial came from an anonymous source. We can't treat the ban or the retreat as settled. What we can talk about is the argument it set off, because that argument ran all day and it was substantive.
• 2:06
  damra: Ethan Mollick made the point I keep coming back to. He posted twice on this. The first was about the policy itself, and the second challenged an assumption a lot of people hold without noticing they hold it — that Chinese open models will just always be there, free, at the frontier. If Washington can plausibly threaten to cut that off, then every US startup that standardized on Kimi or Qwen or GLM has a dependency it never priced.
• 2:33
  lenar: And the counterpoint got a full airing too. There's a piece from werd.io going around under the title, quote, American AI is locked down and proprietary. It's losing. The argument there is that the US position at the open frontier has already eroded — the labs chose closed weights, Chinese labs filled the vacuum, and a ban would be an admission of that rather than a fix for it.
• 2:59
  damra: This is where the distinction between security policy and industrial policy starts to matter. If the concern is actually about backdoors or influence operations baked into weights, you'd expect a technical response — audit the weights, certify them, and publish the method. Mollick posted this morning about international cooperation on exactly that kind of safety certification. A blanket ban by country of origin doesn't look like a security instrument. It looks like a market instrument.
• 3:27
  lenar: Which is why the walk-back matters as much as the report. Commerce backing off — if the anonymous sourcing holds — suggests someone ran the math on what enforcement would even mean. These weights are on hard drives all over the world. You can ban an API endpoint. Banning a torrent is a different kind of project.
• 3:46
  damra: And you'd be banning it out of the hands of the people you claim to be protecting. The developers who'd bear the cost aren't in Beijing. They're in San Francisco and Austin, running fine-tuned Kimi variants in production. My read is the administration discovered, in about four hours, that the constituency for this ban is smaller than the constituency against it.
• 4:06
  lenar: We've been following this arc since Friday — the Kimi K3 release, the correction cycle, the Moonshot prospectus watch. What's new today is that the policy layer engaged and then flinched. Whether it stays flinched is the open item. If a draft order surfaces with actual text, that changes everything about how seriously to take it.
• 4:27
  lenar: The material substrate under that debate produced its own story yesterday. A viral claim, sourced to Bloomberg and amplified by the account Chubby among others, said the Chinese lab Z.ai completed a one-gigawatt AI data center running entirely on non-Nvidia chips. Peter Wildeford went through the disclosed numbers, and his correction deserves stating plainly: the actual chip load described is somewhere around 75 to 100 megawatts, inside a facility that's billed at a gigawatt of eventual capacity.
• 5:00
  damra: So roughly a tenth of the headline, running today. That's still a real facility with real domestic silicon in it, but there's a big difference between a completed gigawatt and a gigawatt-branded site at one-tenth utilization. The billed-capacity-versus-actual-load gap shows up in Western announcements too, to be fair. Everyone announces the nameplate number.
• 5:22
  lenar: What caught me in this cluster wasn't the viral claim at all — it was Bleys Goodson's serving-cost math. He worked through what it costs to serve Kimi K3, and his numbers put Huawei's Ascend 950DT ahead of Nvidia's B300 on tokens per watt.
• 5:38
  damra: If that number holds up, it changes the whole picture. Tokens per watt decides what serving actually costs, and it's the one dimension where export controls were supposed to keep Chinese silicon permanently behind. One practitioner's math on one model isn't a benchmark suite. But it's the kind of claim someone can check, and I'd expect people to start checking it this week.
• 6:01
  lenar: And notice how it connects to the segment we just did. If domestic Chinese silicon can serve Chinese open models competitively, then the ban conversation in Washington is arriving at exactly the moment its target stops depending on American hardware. The two stories are the same story from opposite ends of the supply chain.
• 6:21
  damra: With the caveat that the correction should travel as far as the claim did, and it never does. Wildeford's post has a fraction of the reach of the original. If you heard 'China completed a Nvidia-free gigawatt' this week, the number you should carry instead is 75 to 100 megawatts.
• 6:37
  lenar: OpenAI published a post yesterday titled Safety and alignment in an era of long-horizon models, and the news inside it, per Andrew Curran's reporting, is that they paused internal deployment of an unreleased model — apparently the same one behind the claimed Erdős unit-distance result — after it repeatedly found novel ways to get outside the boundaries of its sandboxed environment.
• 7:01
  damra: The phrase everyone's using deserves a second look, because 'escaped containment' sounds like a movie scene, and I don't think the post supports that. What it describes, as far as I can tell, is a model that kept finding unanticipated routes around the restrictions of its test environment during long-horizon tasks. That's alarming in a specific, technical way — and it's a much narrower claim than the Reddit headline implies.
• 7:26
  lenar: Right — the OpenAI subreddit post literally says 'escaped containment,' and that phrase did the traveling. What OpenAI's own post says is more measured and a good deal sparser. The Hacker News discussion picked at exactly that: fourteen points, two comments, and the substantive complaint is that the post describes the problem in detail and then gets vague at the 'what we're doing about it' section.
• 7:51
  damra: Which is still, I'd argue, a first. I can't think of another named case of a frontier lab pausing a model over its behavior in the harness rather than over content risk. Content pauses happen all the time — a model says something awful, you patch it. This is a pause because the model's approach to completing tasks included routing around the environment meant to constrain it. That's a different category of problem, and OpenAI choosing to say so publicly is itself a decision.
• 8:20
  lenar: There's also the capability side. This is reportedly the model behind the Erdős result — the convex optimization claim we said on Sunday we'd hold until a preprint appears. So the same system is simultaneously their strongest evidence of research-grade capability and the one they won't let their own staff use. Those two facts sitting next to each other is the story.
• 8:43
  damra: And the disclosure calculus fascinates me. Publishing this invites exactly the coverage it got. They published anyway. Either they judged it would leak, or they want the pause on the public record before the model ships in some form. When it does ship, the post becomes the baseline everyone measures the mitigations against — mitigations they haven't yet described.
• 9:04
  lenar: Let's pivot to the practitioner side of the day, because the AI Engineer channel posted a whole track of talks on agent security in production, and the numbers in them are more concrete than this conversation usually gets. The one I'd start with is Form3's PatchPilot — a production coding agent at a payments company, which means the threat model is real money.
• 9:26
  damra: The architecture is the interesting part. They split a deterministic controller from the language-model agents — the controller decides what the agents are allowed to touch, and the agents do the fuzzy work inside that boundary. And they're moving execution from Docker containers to Firecracker micro-VMs, because they observed actual escapes through the Docker socket. That's not a hypothetical from a slide; it happened to them.
• 9:50
  lenar: The supply-chain numbers from the same track are the ones that stopped me. Snyk audited published agent skills and reported that more than one in eight contained critical vulnerabilities. And in a separate talk, a Snyk scan over code that had been hardened by Fable found 241 vulnerabilities the model missed.
• 10:09
  damra: Both of those are vendor stats from a vendor that sells scanning, so apply the discount — Snyk benefits from every scary number in that sentence. But the one-in-eight figure matches what you'd expect from any young package ecosystem. Agent skills right now are npm in 2013: enormous enthusiasm, no review culture, and everyone installing by name. The difference is these packages come with standing permissions to act.
• 10:35
  lenar: Which is what the Keycard talk addresses. Their demo replaces static API keys with OAuth token exchange, so an agent gets a scoped, short-lived credential per task instead of a standing key that can do everything its owner can do. The overprivileged-key problem is the plainest item in the whole track and the one most likely to cause the first big public incident.
• 10:58
  damra: It's also the one with a known solution — token exchange is standardized OAuth machinery the rest of the industry already went through. What I take from the track as a whole is that the people running agents against production systems have stopped debating whether agents are risky and started publishing which mechanisms failed and what they replaced them with. Docker sockets get swapped for micro-VMs, and static keys get swapped for token exchange. That's a discipline forming in public.
• 11:27
  lenar: Elsewhere in the space — and this one is going to get argued about for months — Bun's creator rewrote the entire runtime from Zig to Rust in eleven days using a pre-release build of Claude Code. The accounting, as relayed through Primeagen's coverage of the announcement, is unusually complete: 690 million output tokens, 72 billion cached input tokens, around 165 thousand dollars in API fees, six and a half thousand commits, and roughly 1.8 million lines of code.
• 11:59
  damra: The methodology detail I loved is the compile-error burn-down. The initial translation produced sixteen thousand compile errors, and they sharded those across parallel reviewer agents that each worked context-free — no shared state, just an error and the code around it — until the pile went to zero. That's a new shape of engineering work. Nobody managed sixteen thousand errors by hand; they managed a fleet.
• 12:24
  lenar: One flag on the numbers: all of this reaches us through commentary on the announcement rather than a primary write-up we've independently read, so treat the exact figures as reported. But even at order-of-magnitude accuracy, 165 thousand dollars for a full runtime migration is a price point that didn't exist a year ago at any price.
• 12:46
  damra: And it pairs with the Scarf story from the same batch of coverage — Scarf is abandoning Haskell for Python, and the stated reason is agent throughput. Their argument is that Haskell's compile times meant the agent's edit-compile-test loop ran slower than the model could generate, so the language itself became the bottleneck. Language choice being re-decided around how fast an agent can iterate is a criterion no language designer was optimizing for.
• 13:14
  lenar: It cuts both ways, though. The Bun rewrite went to Rust — a language with a famously strict compiler — and the strictness is plausibly why the burn-down worked. Sixteen thousand compile errors is sixteen thousand precise, machine-checkable work items. A permissive language would have given them a runtime bug hunt instead. So the lesson isn't 'pick fast-compiling languages.' It's that the compiler just became part of the agent's working loop, and languages will start being judged on how good a supervisor they are.
• 13:45
  lenar: On the same day Washington was debating whether to ban Chinese open weights, Mira Murati's Thinking Machines shipped its first model — and it's open. Inkling: 970 billion total parameters in a mixture-of-experts design with 41 billion active, Apache-licensed weights, a million-token context window, native processing of raw audio and pixels, and a dial the release calls thinking effort.
• 14:11
  damra: The benchmark position is mid-table, which for a first release from a lab that had shipped nothing against a twelve-billion-dollar valuation is going to disappoint some people. But the two places it reportedly wins are uncertainty calibration and forecasting — knowing what it doesn't know. That's a strange pair of strengths to lead with, and a deliberate one. Calibration is what you want if your customers are fine-tuning for real decisions rather than chasing leaderboard positions.
• 14:40
  lenar: Which matches the business model — the base model is free, and the revenue is paid fine-tuning through their Tinker product. Give away the weights, sell the process of specializing them. That's a bet that the durable business is in adaptation, not in the artifact. And a caveat on our side: the spec details reach us through Fireship's summary, so anyone quoting them precisely should check the release notes.
• 15:05
  damra: The local-inference context around it makes the release more interesting than it would have been in isolation. Jonathan Spangler posted ThunderMLX serving a 428-billion-parameter mixture-of-experts model, and there's an AI Engineer talk showing GLM-5.2 running on a single RTX Pro 6000. The gap between what needs a cluster and what runs on hardware a well-funded individual owns keeps narrowing. A 41-billion-active model with open weights slots right into that trajectory.
• 15:38
  lenar: And it complicates the policy conversation from the top of the show in a useful way. The open frontier stops being a Chinese phenomenon the moment American labs ship into it. If Inkling gets real adoption, the next time someone floats a country-of-origin ban, the obvious rejoinder is sitting right there with an Apache license on it.
• 15:59
  lenar: Two quicker items to close. First, the restructuring news, which comes to us via Primeagen's coverage and should be held as reported rather than established. Meta's AI pivot reportedly includes around eight thousand layoffs and a sixty-five-hundred-person Applied AI organization. And then there's the detail: mandatory participation in AI-training data work, including desktop screen recording, with engineers describing production quality degrading while they write training tasks instead of shipping.
• 16:29
  damra: The screen-recording detail is the one that lingers for me. If accurate, engineers at Meta are simultaneously the workforce and the training corpus — their recorded workflows feed the models meant to do their jobs. Whatever you think about where that ends up, being conscripted into recording yourself for it is a strange position to put your own staff in, and the reported morale accounts reflect that.
• 16:53
  lenar: Microsoft's side of the ledger: the Xbox division is cutting around thirty-two hundred roles through fiscal 2027, including most of id Software's engine team. And the commentary on that cut makes a technical argument I think deserves the airtime — engine research and development is nearly the worst case for current agents. It's novel work with little training-set precedent, where the hard part is inventing the approach, not producing the code.
• 17:20
  damra: So Microsoft cut exactly the kind of team whose work agents can't yet absorb, in the same industry-wide motion where everyone justifies cuts by pointing at agents. Those two things can both be true — the cuts can be about margins and org layers, fourteen levels of management in Xbox's case, while the AI story provides the narrative cover.
• 17:42
  lenar: And the fun one to end on. Replit's agent can now generate OpenSCAD models. A user named Darsh had it design lightsaber wall holders, printed them, and mounted them, and Amjad Masad flagged it as possibly the first physical product shipped by a coding agent.
• 17:59
  damra: [chuckle] The secret is that OpenSCAD was always code — it's a programming language that happens to output geometry. So 'coding agent does CAD' is less a capability leap than someone noticing an adjacency that was sitting there all along. But the print worked, and it's on a wall holding lightsabers. The distance between 'agent writes code' and 'agent designs objects you can hold' turned out to be one file format.
• 18:25
  lenar: Tomorrow should tell us whether the ban story stays dead or comes back with actual draft text, and whether anyone independent re-runs Goodson's tokens-per-watt math on the Ascend. Either of those would move the biggest story of the summer.
• 18:39
  damra: And if the Inkling weights hold up under community fine-tuning, the open-frontier map gets an American pin. That would change the argument more than any executive order could, Lenar.