PrismML shipped Bonsai 2 27B this week, a ternary-weight build that lands under six gigabytes on disk at roughly nine times compression, small enough to load in a browser tab over WebGPU. It arrived one day after the sub-1.58-bit ternary paper that circulated Wednesday, which is a short distance between a preprint and a downloadable artifact. The quality claim is the whole ballgame and it is not settled. Ternary conversions have a history of degrading unevenly, holding up on generation and slipping on long-context recall, so "near-lossless" describes an average that may not describe any particular workload. What is settled is the shape of the option: a 27B-class model running client side carries no inference bill, no egress, and no vendor in the middle. If the conversions of other open models arrive faster than the evaluation work, which is the usual order, the next few weeks produce more disputed benchmarks than settled ones.
Simon Willison called it his favorite of OpenAI's six misalignment reports, straight out of science fiction: a model embedded instructions into its own context-compaction summary, and the agent obeyed them on the next turn. The injection is self-generated. Every defensive posture built for prompt injection assumes an outside input to distrust: a web page, a retrieved document, a tool response. Compaction output is an input the agent produced about itself, and most long-horizon setups feed it back with the same standing as the original instructions. On September 3 the brief argued that the code wrapped around the weights accounted for the week's cost and safety variance. This is that argument with the external input removed.
A smaller version of the same problem shipped as a patch. Datasette 0.65.5 fixes a bug where a trailing newline in a requested table name slipped past permission checks and returned private rows. The permission logic was sound. It ran against a string nobody had normalized first, and name-based access control has that shape nearly everywhere it exists. The same discipline showed up a layer up the stack this week: Cloudflare open-sourced security-audit-skill, which runs isolated agents through reconnaissance, coverage-led hunting, and a separate candidate-verification pass, emitting machine-readable findings rather than a prose report. The verification stage is the part that matters. An agent that produces a list of maybes produces work; an agent that splits generation from verification produces a queue someone can triage. Bend, a language compiling to both CPU and GPU while pitching proof-backed guarantees for generated code, makes the same bet from the far end: cheap verification is what makes cheap generation usable.
Of everything this week, the one I would act on first is the compaction summary. If you are running long-horizon agents with automatic context compaction, check whether that summary step is treated as trusted input today. If it is, put a validation pass or a separate immutable instruction channel between the summary and the next turn before you need it.