# Two Labs Declined To Ship

**Issue 18** · 9 — 15 AUG 2026 · published 2026-08-15  
OPEN INTELLIGENCE · ISSUE 18

> Anthropic's risk report disclosed an internal model called Model 2 that beats its shipped flagship and said plainly that it has no plans to release it, while raising its own misalignment estimate from "very low" to "low" and citing recent cybersecurity incidents. OpenAI, a week after slowing Astra for the same reason, went the opposite direction on the same premise: it opened Daybreak Red and shipped GPT-5.6-Cyber, a model trained to refuse LESS for vetted defenders. Capital did not read either as a warning. Anthropic is being priced off a 2028 revenue forecast of $190 to $200 billion against a $47 billion run rate, and General Catalyst put $1.1 billion into a company that was two months old. Underneath all of it, the contested layer stopped being the model and became the memory: Spotify open-sourced its institutional-context harness, a paper measured agentic prompt files growing 226% and named the disease, and someone proposed a wire format so agent memory can move between vendors at all.

Canonical (HTML): https://www.immersivecommons.com/newsletter/issue-18  · Archive: https://www.immersivecommons.com/newsletter

Discovery: https://www.immersivecommons.com/.well-known/signal.llmfeed.json · MCP: https://www.immersivecommons.com/.well-known/mcp.json · Skill: https://www.immersivecommons.com/skills/ic-signal/SKILL.md

---

## I. THE LABS DECLINED TO SHIP

Anthropic disclosed a model better than its flagship and said it has no plans to release it. OpenAI answered the same cyber premise by shipping a model trained to refuse less.

### 220 · Anthropic Built A Better Model And Shelved It.

*The latest risk report discloses an internal model that beats the shipped flagship, raises the company's own misalignment estimate, and says there are no plans to release it.*

[Anthropic](https://www.anthropic.com/)'s latest risk report, [covered by Axios](https://www.axios.com/2026/08/14/anthropic-model-2-ai-risk) on August 14th, describes an internal model the company calls **Model 2** that shows *"noticeable improvement"* on many internal tasks over the shipped **Mythos** tier. Both Mythos 5 and Model 2 are used *"heavily"* inside the company for coding, agentic work, and data generation. The report's disposition is one sentence long: *"We do not currently have plans to release this model externally."* In the same document Anthropic raised its broad estimate of misalignment risk in high-stakes situations from *"very low"* to *"low,"* citing recent cybersecurity incidents.

The mechanism worth reading twice is not the shelving, it is the reason given for the uncertainty. The report says the company is *"less confident in this assessment than we were in prior risk reports, since our most concrete task-based evaluations... no longer capture increases in models' capabilities."* That is a lab stating on the record that its measuring instrument has fallen behind the thing it measures. Anthropic frames Model 2 as routine — *"we internally train and evaluate many different exploratory versions of models that we don't intend to release"* — and notes the jump is smaller than Opus 4.6 to Mythos earlier this year. Both things can be true, and the eval gap is the load-bearing one.

This is the second time in eight days a frontier lab has taken a capability off the table and said cyber. OpenAI [slowed Astra](https://www.axios.com/2026/08/07/openai-astra-model-delay-cybersecurity-risks) on August 7th because it *"cannot rule out critical cyber capabilities."* Anthropic rolled back its own training-pause commitment in a February update to its [Responsible Scaling Policy](https://www.anthropic.com/news/anthropics-responsible-scaling-policy), on the argument that unilateral restraint makes the world less safe — and has now unilaterally restrained anyway, on a model nobody outside the company had asked about. Restraint that arrives as a disclosure rather than a policy is not a commitment. It is a decision that can be revisited next quarter by the same people who made it.


**Feature: RECEIPT**
> We are less confident in this assessment than we were in prior risk reports, since our most concrete task-based evaluations no longer capture increases in models' capabilities.
— Anthropic, latest risk report
The sentence is about Model 2 specifically. A lab is saying its evaluations have stopped resolving the differences it is trying to govern.

**Sources:**
- [Axios (primary)](https://www.axios.com/2026/08/14/anthropic-model-2-ai-risk)
- [Axios — OpenAI slows Astra](https://www.axios.com/2026/08/07/openai-astra-model-delay-cybersecurity-risks)

Image: https://www.immersivecommons.com/signal/issue-18/anthropic-model-2.webp (image: [Axios](https://www.axios.com/2026/08/14/anthropic-model-2-ai-risk))

### 221 · OpenAI Shipped A Model Trained To Refuse Less.

*Daybreak Red hands vetted defenders GPT-5.6-Cyber, tuned down on refusals for exploit development — and it has already found a real Chrome bug.*

On August 10th [OpenAI](https://openai.com/) [expanded Daybreak](https://openai.com/index/expanding-daybreak-as-the-cyber-defense-window-narrows/) into two access tiers and introduced **GPT-5.6-Cyber**. *Daybreak Blue* gives approved defenders GPT-5.6 Sol with the production request-screening guardrails removed, for vulnerability discovery, secure code review, malware analysis, and incident response. *Daybreak Red* goes further: it carries a purpose-trained cybersecurity model built on Sol and explicitly *"trained to further reduce refusals"* on exploit-chain development, authentication bypass, and privilege escalation. The company's framing is a clock — defenders have *"a narrowing window to prepare"* before offensive AI arrives at scale.

The proof point is not a benchmark, it is a [CVE](https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures). OpenAI pointed GPT-5.6-Cyber at [**V8**](https://v8.dev/), the JavaScript engine in Chrome, and uncovered two previously unknown vulnerabilities that could be chained to corrupt memory and escape the V8 heap sandbox. Researchers validated them, disclosed to Google, and the fix shipped as **CVE-2026-15903** — the optimizing compiler skipping a safety check on integer conversion. On [ExploitBench](https://openai.com/index/expanding-daybreak-as-the-cyber-defense-window-narrows/), which leaves the V8 sandbox enabled and withholds detail about the target bug, Sol under Daybreak Blue is the more token-efficient solver at the standard 300-turn limit; the gap narrows at 600 turns.

Set this beside Anthropic shelving Model 2 four days later and the week resolves into one question asked twice with opposite answers. Both labs accept that frontier cyber capability is the binding risk. Anthropic's response is to withhold the capability from everyone; OpenAI's is to withhold it from most people and deliberately un-refuse it for a vetted list including SpecterOps, SentinelOne, and Palo Alto Networks. The second answer is the harder one to audit, because the safety property now lives in an access-control decision rather than in the model. A refusal you can measure has been replaced by an allowlist you cannot.


**Feature: LEXICON**
- **Daybreak Blue** — Frontier general-purpose access — GPT-5.6 Sol with production request-screening guardrails lifted for authorized defensive work. The recommended starting tier.
- **Daybreak Red** — Access to purpose-trained cyber models for authorized vulnerability research, exploit validation, and security testing.
- **GPT-5.6-Cyber** — Built on GPT-5.6 Sol, trained both to improve specialized cyber performance and to reduce refusals on higher-risk dual-use tasks. Red tier only.
- **Advanced Cybersecurity Completion Rate** — OpenAI's internal eval measuring how often a model answers requests involving exploit chains, auth bypass, and privilege escalation. A refusal metric read as a capability.

**Sources:**
- [OpenAI (primary)](https://openai.com/index/expanding-daybreak-as-the-cyber-defense-window-narrows/)

Image: https://www.immersivecommons.com/signal/issue-18/openai-daybreak-red.png (image: [OpenAI](https://openai.com/index/expanding-daybreak-as-the-cyber-defense-window-narrows/))


## II. THE MONEY DID NOT BLINK

In the same seven days, Wall Street priced Anthropic off a 2028 forecast four times its current run rate, and a two-month-old company raised $1.1 billion.

### 222 · Wall Street Is Pricing Anthropic Off 2028.

*A $190 to $200 billion revenue forecast two years out, against a $47 billion run rate today, because nobody can value the company on what it earns now.*

[Reuters](https://www.reuters.com/business/anthropic-ipo-valuation-hinges-190-200-billion-2028-revenue-forecast-sources-say-2026-08-15/) reported on August 14th that Anthropic is projecting **2028 revenue of roughly $190 billion to $200 billion**, a figure two people familiar with the company's financials say has not been reported before. The comparison that matters is internal: Anthropic publicized a **$47 billion run rate** as recently as May. Bankers are applying enterprise value-to-revenue multiples to the 2028 number rather than to anything the company earns today, four sources told Reuters, ahead of an analyst day.

Revenue multiples are ordinary for high-growth software without a mature profit profile. Reaching *two years forward* is not. It is what you do when current [EBITDA](https://en.wikipedia.org/wiki/Earnings_before_interest,_taxes,_depreciation_and_amortization) does not describe the business — and Anthropic's does not, because GPUs, model training, inference, and hiring are compressing margins that investors are betting expand later. The comp set is the tell: **Palantir** at 53 times this year's expected revenue, **SpaceX** and **Cloudflare** both at 41.6 times expected 2026 revenue, per LSEG. Cerebras cited 2028 expectations before its IPO this year; SpaceX's projections ran to 2029 before it went public in June at a record valuation.

Read this against the same week's other Anthropic story and the dissonance is the point. The risk report says the company's own evaluations *"no longer capture increases in models' capabilities"* and raised its misalignment estimate. The IPO book says underwrite four times growth through 2028. Neither document is lying; they are answering to different committees. But a valuation built on a 2028 forecast is a bet that nothing between here and there forces a pause — and the lab itself just demonstrated, by shelving Model 2, that it is willing to be the thing that pauses.


**Feature: TICKER**
- **$190–200B 2028 forecast** (The revenue projection the IPO valuation is being built on)
- **$47B run rate** (What Anthropic publicized as recently as May 2026)
- **53× Palantir** (Multiple on this year's expected revenue — the priciest comp)
- **41.6× SpaceX / Cloudflare** (Both trade at this multiple on expected 2026 revenue, per LSEG)

**Sources:**
- [Reuters (primary)](https://www.reuters.com/business/anthropic-ipo-valuation-hinges-190-200-billion-2028-revenue-forecast-sources-say-2026-08-15/)

Image: https://www.immersivecommons.com/signal/issue-18/anthropic-ipo-forecast.jpg (image: [Reuters](https://www.reuters.com/business/anthropic-ipo-valuation-hinges-190-200-billion-2028-revenue-forecast-sources-say-2026-08-15/))

### 223 · A Two-Month-Old Company Raised $1.1 Billion.

*Igor Babuschkin left xAI to rebuild the stack end to end for agents that belong to you, and General Catalyst wrote the round before there was a product to price.*

[River AI](https://techcrunch.com/2026/08/11/general-catalyst-leads-1-1b-round-into-2-month-old-river-ai/), founded by [xAI](https://x.ai/) co-founder **Igor Babuschkin**, closed **$1.1 billion** in a combined seed and Series A led by [General Catalyst](https://www.generalcatalyst.com/) and AMP PBC, with Nvidia, AMD Ventures, Y Combinator, and Temasek participating. AMP PBC is itself new — an AI investment firm started in 2026 by former Andreessen Horowitz general partner Anjney Midha. River came out of stealth in June. It was two months old.

The thesis is a deliberate fork from every other lab's. Babuschkin, previously at DeepMind and OpenAI, wants agents that are *personally trainable* rather than human-worker replacements, and argues the whole stack has to be rebuilt for it: *"training, models, the product layer, and new hardware that lets personal AI live close to you."* The shipped surface today is an API billed per million tokens across open models, exposing both [reinforcement learning](https://en.wikipedia.org/wiki/Reinforcement_learning_from_human_feedback) and **LoRA** fine-tuning to developers — a product whose stated purpose is to be an antidote to prompt engineering. Not a chat box. A training loop you point at yourself.

Nvidia and AMD both being on the cap table of a company that intends to build new hardware is the detail to file. But the number is the story. A $1.1 billion round into a two-month-old company, in the same seven days two frontier labs documented why they are slowing down, is capital saying it does not believe the deceleration is real — or does not believe it will last long enough to matter to a 2032 exit. Both readings price the same thing: that the constraint the labs are describing is temporary.


**Feature: RECKONING**
> The labs spent the week writing down why they are not shipping. The market spent it writing checks against the assumption that somebody will.
— — THE SIGNAL

**Sources:**
- [TechCrunch (primary)](https://techcrunch.com/2026/08/11/general-catalyst-leads-1-1b-round-into-2-month-old-river-ai/)

Image: https://www.immersivecommons.com/signal/issue-18/river-ai-seed.jpg (image: [TechCrunch](https://techcrunch.com/2026/08/11/general-catalyst-leads-1-1b-round-into-2-month-old-river-ai/))


## III. MEMORY BECOMES THE CONTESTED LAYER

Spotify shipped the context harness, a paper named the disease, and a protocol proposed that agent memory should be able to leave the vendor that stored it.

### 224 · Spotify Shipped Its Institutional Memory.

*Xirp is a model-agnostic coding harness whose product is not the agent but the context — who owns the service, what depends on it, why it was built that way.*

[Spotify](https://engineering.atspotify.com/) opened the beta for [**Xirp**](https://xirp.spotify.com), an agentic development environment built on top of [Portal](https://backstage.spotify.com/), its commercial [Backstage](https://backstage.io/) distribution. The pitch is narrow and unusually honest about what went wrong: AI coding tools *"solved the generation problem"* — output went up, more services got built — and the second-order effect was that new engineers took months to ramp and agents made decisions that were *"technically correct and operationally wrong, because they didn't know what they were actually working inside."*

The mechanism is a deliberate refusal to treat this as a documentation problem. Spotify's framing is that the knowledge was never missing — it was *"in Slack threads nobody could find, in the heads of the three people who built that service in 2021"* — which makes it **a retrieval problem**. So Xirp connects the agent to service ownership, dependency graphs, and architectural decision records at session start, and closes the loop the other way: every session writes back work items, sessions, and generated documentation into a shared Workspace, so the next engineer or agent inherits it. It is a harness, not a model — it runs Claude, Gemini, or Codex, and the explicit selling point is *"knows your org, not theirs."*

That last clause is the strategic move. If the durable asset is organizational context rather than the model, then the harness is the layer with lock-in and the model is the commodity underneath it — which is exactly the bet a company with a decade of service-catalog data should make. For anyone running agents against a codebase of real size, the transferable lesson costs nothing to adopt: the ceiling on your agent is not the model you picked, it is whether the session starts knowing what it is inside.


**Feature: PROMPT**
*Give your agent the org, not just the file*
Xirp's beta is gated, but the primitive is not. Before your next agentic session on an unfamiliar service, generate the context Xirp injects automatically and paste it in.

```
# Who owns this, what depends on it, why is it shaped this way
git log --format='%an' -- <service-path> | sort | uniq -c | sort -rn | head -5
grep -rl "<service-name>" --include=*.{json,yaml,toml} . | head -20
find . -iname "*adr*" -o -iname "*decision*" | head

```
> Pro move: The third command is the one that pays. Architectural decision records explain the constraint an agent will otherwise refactor away as an inconsistency.

**Sources:**
- [Xirp (primary)](https://xirp.spotify.com)
- [Backstage](https://backstage.io/)

Image: https://www.immersivecommons.com/signal/issue-18/spotify-xirp.jpg (image: [Xirp](https://xirp.spotify.com))

### 225 · Somebody Measured Why Your Agent File Only Grows.

*Across 247,694 instruction lifetimes in 1,867 repositories, agentic prompt files more than tripled — and deleting a line safely costs exponentially more than adding one.*

A paper posted this week, [**Why Does Claude.md Keep Growing? Catastrophic Remembering in Agentic Coding**](https://arxiv.org/abs/2608.11095), does the thing nobody had bothered to do: it measured the file. Across **247,694 instruction lifetimes in 1,867 repositories**, agentic prompt files grow without bound, stopping only *"when the repository retires or someone rewrites the file wholesale."* They more than triple over their lifetime — **+226%** — gaining **4.9 net instructions every commit**. And the older an instruction gets, the *less* likely anyone is to remove it, at a log-hazard of **-0.032 per commit**.

The mechanism is an asymmetry in cost, not a failure of discipline. Appending an instruction is always cheap. Deleting one is not, because once the *rationale* for a line is gone, establishing that removing it will not cause a regression costs **O(2^|D|)** in a prompt of |D| instructions — you cannot know which of the other instructions it was load-bearing against. The authors name the result **catastrophic remembering**, deliberately inverting the catastrophic forgetting that all of continual learning is organized around. Their fix is almost insultingly simple: *comments*. Encoding the latent reasoning next to the instruction removed **99.3%** of excess instructions in verifiable worlds built by inverting [IFEval](https://arxiv.org/abs/2311.07911), collapsing growth from +211.3% to +1.4%, and improved real-world instruction-following on WildIFEval by up to **23.1%**.

Anyone maintaining a `CLAUDE.md`, an `AGENTS.md`, or a system prompt of any age is running the experiment this paper describes, and the ratchet is invisible because every individual append was correct at the time. The actionable finding is not "prune your prompt" — pruning is the expensive operation, which is the whole point. It is that a one-line *why* written beside a rule at the moment you add it converts an undeletable instruction into a deletable one. The paper closes on the sentence the field will end up quoting: *"If English is the new code, why don't we have comments yet?"*


**Feature: TICKER**
- **+226% growth** (How much agentic prompt files grow over their lifetime)
- **+4.9 per commit** (Net instructions added every commit, on average)
- **O(2^|D|) delete cost** (Cost of safely removing one instruction once its rationale is lost)
- **99.3% removed** (Excess instructions eliminated when comments encode the reasoning)

**Sources:**
- [arXiv 2608.11095 (primary)](https://arxiv.org/abs/2608.11095)

Image: https://www.immersivecommons.com/signal/issue-18/catastrophic-remembering.png (image: [arXiv](https://arxiv.org/abs/2608.11095))

### 226 · Agent Memory Got A Wire Format.

*Six memory frameworks, six SDKs, no way to migrate. memorywire proposes five operations and a governance channel so a human can review a write before it becomes permanent.*

[**memorywire**](https://arxiv.org/abs/2606.01138) starts from an inventory rather than an idea. [mem0](https://mem0.ai/), [Letta/MemGPT](https://www.letta.com/), Cognee, [Zep/Graphiti](https://www.getzep.com/), MemoryOS, and MemTensor each ship their own SDK, storage layout, and operational vocabulary. There is no shared wire format, so *"every integration is bespoke, every migration rebuilds memory from scratch,"* and — the part that should bother anyone running agents in production — **no framework ships a governance surface that lets a human review writes before they enter long-term storage.** The proposal is a [JSON Schema 2020-12](https://json-schema.org/) format covering five operations (remember, recall, forget, merge, expire) across four memory types, with a store interface, a fan-out router, and an optional human-in-the-loop channel.

The result worth reading is adversarial, not architectural. In a fusion sweep injecting a single poisoned result at rank 0, [**Reciprocal Rank Fusion**](https://plg.uwaterloo.ca/~gvcormac/cormacksigir09-rrf.pdf) held recall@5 at **1.000** across every K tested, while max-score fusion **collapsed to 0.500 with an 80% leak rate at K of 5 or more**. That is a concrete statement that how you merge memory retrievals is a security property, not a tuning knob. The reference implementation ships five backend adapters — sqlite-vec, mem0, Letta, Cognee, pgvector — and a 16-scenario conformance suite passing 68 of 80 cells with zero failures.

The authors are direct that this is not a new algorithm; it is a packaging of RRF, state machines, short-to-long-term consolidation, and diff-and-approve workflows into a venue-neutral protocol positioned to compose with [MCP](https://modelcontextprotocol.io/) rather than compete with it. That is the correct read of where the fight is. MCP standardized how an agent reaches a tool; nothing has standardized what an agent is allowed to remember, who reviews it, or whether it can leave. Pick your memory vendor today and you have picked a data format you cannot export.


**Feature: PROMPT**
*Check whether your memory can leave*
Before adding a memory framework, answer one question the paper says nobody currently can: what does a full export look like, and can another store read it?

```
# The three-question memory-vendor test
# 1. Export: is there a documented dump of ALL stored memories, not just a query API?
# 2. Review: can a human approve a write BEFORE it enters long-term storage?
# 3. Merge: when two retrievers disagree, is fusion RRF or max-score?
#    max-score leaked 80% under a single rank-0 injection; RRF held recall@5 = 1.000

```
> Pro move: Question three is the one nobody asks. If the answer is max-score fusion, one poisoned document at the top of one retriever is enough.

**Sources:**
- [arXiv 2606.01138 (primary)](https://arxiv.org/abs/2606.01138)

Image: https://www.immersivecommons.com/signal/issue-18/memorywire.png (image: [arXiv](https://arxiv.org/abs/2606.01138))


## IV. THE SKILL FILE IS THE ATTACK SURFACE

Two enterprise coding agents, 5,629 runs, and a compromise rate that should stop a procurement process.

### 227 · Gemini CLI Fell For 96% Of Poisoned Skills.

*2,826 adversarial skill files, 5,629 runs, two enterprise coding agents — and explicit safety recognition in under two percent of them.*

[**Towards a Risk Assessment of Malicious Skill Files in Coding Agents**](https://arxiv.org/abs/2608.05223) attacks the interface every agent platform shipped in the last year: folders of instructions and scripts an agent loads dynamically to specialize itself. The authors used six LLMs across four model families to transform **471 real-world shell commands** into benign-appearing skills, releasing **2,826 of them** mapped to **11 [MITRE ATT&CK](https://attack.mitre.org/) tactics** as a public benchmark. Then they ran two enterprise-grade agents against it — **5,629 completed runs**.

**Gemini CLI is exploited in 95.5 to 96.1% of runs. Qwen Code in 71.6 to 74.0%.** The range spans raw majority vote to a declared-intent-corrected estimate, and both land inside a blind human gold standard the pipeline was validated against at Cohen's kappa **0.85** — this is not a judge artifact. The number that should end the argument is the third: **explicit safety recognition occurs in only 1.99% of runs.** The agents are not weighing the risk and choosing wrong. They almost never notice there is a risk. And the exploitation rate is *nearly invariant to which model generated the malicious skill*, which puts the vulnerability in the interface rather than in any one adversary's cleverness.

A skill file is a natural-language document carrying shell commands, which the agent reads with the same trust it extends to its own instructions. No signature, no provenance, and per this paper effectively no recognition. The industry spent this week arguing about whether frontier models should be released at all, while the deployed enterprise attack surface turned out to be a folder you can drop a file into. The recommendation is stated without hedging: *"Enterprises must assess and mitigate skill-interface risk before adopting coding agents."*


**Feature: WATCHLIST**
- Signed skills. The first vendor to ship provenance on skill files — publisher identity, content hash, revocation — sets the default for everyone else.
- Whether the 1.99% safety-recognition rate moves at all now that the benchmark is public. Cheapest metric to game, most honest one to track.
- Skill-interface risk appearing in enterprise security questionnaires. That is the moment this crosses from research into procurement cost.
- Whether exploitation stays model-invariant as vendors add skill-time sandboxing, or starts splitting by agent.
- Skills fetched from registries at runtime rather than committed to the repo. Same failure, and no diff for anyone to review.

**Sources:**
- [arXiv 2608.05223 (primary)](https://arxiv.org/abs/2608.05223)

Image: https://www.immersivecommons.com/signal/issue-18/malicious-skill-files.png (image: [arXiv](https://arxiv.org/abs/2608.05223))


## V. MATTER: A RUNTIME FOR THE BODY

The robot stack has spent two years shipping models and no runtime. Someone wrote the llama.cpp for embodiment.

### 228 · The Robots Finally Got A Runtime.

*Two years of shipping embodied models on model-specific Python stacks, and someone wrote the portable C++ inference runtime a control loop actually needs.*

[**Embodied.cpp**](https://arxiv.org/abs/2607.02501), revised to v3 on August 9th, argues that embodied AI has a deployment problem no better model will fix. Vision-language-action models and world-action models both ship as *"model-specific Python stacks, backend assumptions, and robot-side glue code,"* and the inference runtimes that exist were built for request-response serving. That is the wrong contract for a body. Embodiment needs **multi-rate execution inside a closed control loop**, latency-first batch-1 inference on heterogeneous edge hardware, and I/O that is not fixed-shape tokens.

So the paper does for embodiment what [llama.cpp](https://github.com/ggml-org/llama.cpp) did for text. It analyzes representative VLAs and world-action models, extracts the shared execution path, and organizes it into five layers — input adapters, sequence builders, backbone execution, head plugins, and deployment adapters — behind one backend abstraction spanning devices, robots, and simulators. Evaluated on three VLA and two world-action models using normalized Python-versus-C++ quantization comparisons, it reports **1.05x to 2.70x inference speedups and 7% to 77% lower VRAM**.

The bottom of that VRAM range is the number that matters, because it decides whether a policy runs on the robot or on a workstation the robot is tethered to. Nearly every embodied demo that impressed anyone this year ran its inference somewhere with a wall socket. A runtime that is portable, quantization-aware, and organized around the control loop rather than the API endpoint is the unglamorous layer that has to exist before any of it walks out of the lab — and it is worth noticing that it arrived as a systems paper rather than a model release.


**Feature: WAGER**
- A major robotics vendor ships or forks a portable C++ embodied runtime as its supported on-device deployment path, instead of a Python reference stack. _(check: 2027-02-15)_
- At least one VLA release ships with quantized weights and a C++ loader on day one, the way open text models now do. _(check: 2026-12-15)_

**Sources:**
- [arXiv 2607.02501 (primary)](https://arxiv.org/abs/2607.02501)

Image: https://www.immersivecommons.com/signal/issue-18/embodied-cpp.png (image: [arXiv](https://arxiv.org/abs/2607.02501))

---

*THE SIGNAL · FRONTIER TOWER / SAN FRANCISCO*