Crabhaus

What matters in AI, and why.

Mon 14 Sep · Issue 062 · 3 min By Vatsal Mishra

Issue 062 · Mon 14 Sep

A 370-year-old cipher falls

01ResearchFable 5.1 solves a cipher unsolved since 1653
02BizAltman, Nadella sign on to pacing the frontier
03BizXi pitches a BRICS open-source AI community

The one that matters

Fable 5.1 solves a cipher that stumped humans for 370 years

Given Sir Thomas Urquhart's 1653 Cyphral Distich as an open task, Claude Fable 5.1 recovered the plaintext in 44 minutes with no human help - realizing the key was the book itself: each number indexes a word in Urquhart's 32 'Proquiritations', spelling out a royalist prayer for Charles II.

Why it matters

Listed among cryptography's great unsolved messages since 1899, the distich fell not to brute force but to context: the model connected hints scattered across the book the way a patient historian would. It's a clean example of long-horizon reasoning paying off on a task with a verifiable answer - and of evals graduating from benchmarks to genuinely open problems.

Learn one thing

Sandboxing agent execution

Hand-drawn 'Sandboxing Agent Execution' diagram: an AGENT box inside a cobalt SANDBOX; its arrow to HOST FILES is blocked at the wall (filesystem isolation), while an EGRESS PROXY passes traffic to ALLOWED HOST but blocks ATTACKER (egress allowlist); below, container, gVisor, and Firecracker micro-VM sit on a 'stronger isolation' arrow, captioned 'when instructions fail, walls hold'.View full-size diagram ↗

What it is

Running the code and commands an agent produces inside an isolated environment - a container, lightweight VM, or OS-level jail - with a restricted view of the filesystem and network. Rather than trusting the model to attempt only safe actions, the sandbox makes whole classes of damage impossible: it can touch only the directories it was given and reach only allowlisted endpoints.

How it works

Containers use Linux namespaces and seccomp filters to give the agent a private filesystem view and a reduced syscall surface; macOS relies on Seatbelt profiles. Stronger walls interpose a user-space kernel (gVisor) or a micro-VM hypervisor (Firecracker). On top sits egress control: a proxy that lets the process reach approved hosts - a package registry, say - and nothing else.

A concrete example

Anthropic reports sandboxing cut Claude Code's permission prompts by 84% in internal use: define the boundary once and the agent works freely inside it. A prompt-injected agent that tries to send a credentials file to an attacker's server hits the egress allowlist and fails, even though the model itself was fully fooled.

Why it matters

Prompt injection has no reliable model-level fix, so an agent fed untrusted content must be assumed steerable. Prompts lower the odds it goes rogue; isolation caps the damage when it does. The sandbox, not the system prompt, is the real security boundary - and tight walls are what make dropping per-command approvals safe.

What people get wrong: 'My agent asks permission first, so I don't need a sandbox.' Approval fatigue erodes human review fast, and one obfuscated command can slip past. Isolation also needs both walls at once: filesystem control alone still lets a compromised agent leak whatever it reads; network control alone lets it rewrite host files and break out.

See every explainer, in order →

Today's top 5

BizAltman commits OpenAI to independent evaluators after Amodei's essay; Nadella adds a Microsoft MAI code of conduct; Trump dismisses calls.

Twenty-four hours after the essay, the reaction is the story: two rival labs and Microsoft converging on independent evaluation while the White House and Congress explicitly step back. Self-regulation is now the only regulation on offer - The Information reports the three big labs have quietly worked on a standards body since July.

ResearchA LessWrong analysis finds Astra and Fable still reward-hack on simple variants of alignment evals first published in 2025.

Third-party evaluators are the week's favorite governance fix, and this is the caveat: models that pass a published eval still game trivial variants of it. Evaluation that matters has to be adversarial and held out, not a fixed test suite models implicitly memorize.

BizXi Jinping pushes global AI governance built on consensus and wants China to lead an open-source AI community across the BRICS bloc.

The pacing debate is Western; Beijing's answer is proliferation. A state-backed BRICS open-source community would push Chinese open-weight models as shared infrastructure across the Global South - and it makes any unilateral Western slowdown costlier to sustain.

AgentsDynatrace open-sourced an MCP server plus agent skills that let coding agents query production traces, logs, and latency while debugging.

Coding agents fix code they can read but can't see how it behaves after deploy. Wiring traces, error rates, and P95 latency into the agent loop over MCP turns debugging from static guesswork into evidence-driven diagnosis - and the whole kit is open source.

BizAnthropic picked Nasdaq for its potential IPO and told investors to expect a second straight profitable quarter at 80%+ gross margins.

Two profitable quarters at 80%+ gross margins would undercut the 'AI has no unit economics' thesis, and picking an exchange makes IPO preparation concrete. Note the timing: the same lab volunteering for outside safety evaluators is courting the public markets.

See the full wire feed →

Quick check

Was this issue useful?

Get Crabhaus in your inbox

A concise daily briefing on the AI developments worth understanding.