Monday, May 18, 2026 — front page

government AI deployment model

UK Number 10 embeds forward-deployed AI engineers in ministries to cut NHS and court backlogs AI Engineer
TL;DW
UK government created 'insurgent unit' at Number 10 with high political backing, market-rate pay, and autonomous hiring to deploy AI engineers across departments—bypassing traditional civil service constraints.
0.7-0.8% selection rate for fellows using custom technical hiring process; exclusively recruit outsiders from labs, big tech, and research institutes to prevent institutional lock-in.
7.25 million NHS waiting lists, 350,000 court case backlog, only 20% of planning applications decided on time; AI could deliver £40 billion annual productivity gains across UK government.
First forward-deployed engineers embedded in Number 10 policy teams—observing workflows, co-designing solutions, moving from idea to implementation in weeks instead of months.
Extract tool, built with DeepMind on Gemini, digitizes planning applications including handwritten and hand-drawn maps; rolling out to every local authority to address planning delays affecting economic growth.
Cabinet Office avoided £1.5 million lawyer contract by embedding one engineer for two weeks to automate UK statute book analysis—plus created reusable, updatable tool.
Just AI spin-out deploys fellows into prisons and criminal justice system as forward-deployed engineers working with parole officers to reduce drug smuggling and improve operational efficiency.
Policy simulation tool lets decision-makers test impact of policy choices (e.g., universal credit changes on household finances) before implementation at faster pace than traditional analysis.
Recruitment pitch explicitly seeks 'missionaries not mercenaries'—ambitious technologists from Y Combinator, academia, and industry willing to take pay cuts for high-impact public service work.
Scaling strategy focuses on making insurgent model become 'business as usual' and developing horizontal solutions (transcription, call center automation) applicable across 400,000-person civil service.

Britain's No. 10 Data Science Team runs a market-rate fellowship recruiting from labs, big tech, and YC founders—never career civil servants—and embeds them directly in departments. Early deployments include an Extract platform built with DeepMind to automate planning applications, with spin-offs now placing engineers inside prisons and scaling across 400K public-sector workers.

AI agent attack surface

Thoughtworks demos DoS attack on production AI agent via prompt injection and over-permissioning Thoughtworks
TL;DW
AI agents without guardrails enable denial-of-service attacks: a vet triage agent booked 50 appointments in one day when prompted, crippling availability for a small business.
The 'lethal trifecta' is untrusted input coupled with risky actions—the definition of an unsafe agent. Separate these concerns across multiple agents to control execution.
STRIDE threat modeling (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) applies to AI agents just as it did to web applications.
Agents are often given excessive permissions to databases, health records, and payment systems without considering real-world harms from misuse or compromise.
Input validation and authentication remain powerful controls; treat malicious input to agents like SQL injection and cross-site scripting—old security problems in new architectures.
Three priorities for agent deployment: understand the use case, threat model the data flow and possible actions, then apply appropriate guardrails and test thoroughly.
LLM-as-judge—calling another LLM to detect malicious actions—is worth investigating as a control layer for risky agent operations.
Availability and resilience matter for AI agents; denial-of-service impacts are regulated in Europe (eIDAS, NIS2) and can be crippling for small businesses.
Agents require authentication on inputs and logging of actions to investigate incidents; without logging, you cannot improve or trace responsibility.
Data poisoning via context windows poses risk; focus security on what enters the prompt, not primarily on the model itself.

Using a veterinary triage agent as a live case study, Jim Gumbley shows how broad database access plus a "obey user instructions" directive lets an attacker book 50 simultaneous appointments. Applies STRIDE threat modeling and argues the fix is input validation, least-privilege, and separating untrusted input from risky actions.

long-horizon agent architecture

Anthropic splits generator and evaluator agents into adversarial loop to sustain 6-hour builds AI Engineer
TL;DW
Generator-evaluator pattern (inspired by GANs) splits agent responsibilities into separate context windows: one builds, one critiques using Playwright/browser automation, creating adversarial pressure that improves quality.
Claude Opus 4.6 can run continuously for 12+ hours with single-session compaction instead of resetting context, eliminating need for fresh sessions between tasks.
Models are bad self-evaluators due to sycophancy; a separate harsh critic LLM is more tractable to tune than making builders self-critical.
Planner-generator-evaluator loop with contractual handoffs works better than single agents: planner sets high-level direction, generator and evaluator negotiate testable acceptance criteria before building.
Grading subjective quality (design taste, originality) is possible with detailed rubrics and few-shot examples; Anthropic weights design/originality heavily to prevent AI-slop aesthetics.
Multi-hour full-stack apps (6 hours, ~$200) now achievable with generator-evaluator harness; same prompt in solo loop produces non-functional features (e.g., games with unresponsive controls).
Context rot and context length anxiety (model rushing near window end) were critical problems in earlier models; Opus 4.6 handles coherence much better, reducing need for architectural workarounds.
Read traces by hand, not just evals: identify where model judgment diverges from yours, then tune prompts. Automated trace analysis is a secondary pass; human reading is primary debugging loop.
Harnesses co-evolve with models: as frontier improves, simplify harness (drop sprint decomposition, reduce evaluator cadence), then test to verify. Strip out scaffolding only after confirming models handle it.
File system state (not context windows) for long-running agents: use JSON files for learnings, timestamped logs, git commits; lets future models or humans pick up work without re-inventing history.

Ash Prabaker and Andrew Wilson detail three failure modes for long-horizon agents—context limits, poor planning, and self-evaluation bias—and show how a GAN-inspired generator-evaluator pattern with Playwright-driven rubric testing enables 5-6+ hour runs. Concrete example: a retro game maker that solo single-session runs failed to complete.

open GPU interconnect standard

UALink consortium hits 100+ members, releases v2.0 spec to challenge NVLink in GPU scale-up Open Compute Project
TL;DW
UALink is an open industry standard backed by 100+ companies to provide scale-up fabric competition against Nvidia's proprietary NVLink.
Scale-up fabrics must enable direct memory access via reads/writes, not data movement—if you're moving data, you're doing scale-out, not scale-up.
UALink supports 800 gigabits per second bandwidth with configurable 400 Gbps or 200 Gbps lanes; designed for small packet efficiency typical of memory accesses.
Training workloads prioritize bandwidth; inference prioritizes latency—choose fabric based on your specific AI workload requirements.
UALink 2.0 spec includes in-network collectives (INK), management specs, and chiplet specs; products from 1.0 spec expected end of 2024/early 2025.
Ethernet cannot match NVLink performance: UALink maintains high efficiency (vs. Ethernet's 60%) for mixture-of-experts models requiring GPU-to-GPU communication.
Multiple switch vendors (Marvell, Astera Labs) and accelerator vendors (AMD, Intel) designing UALink solutions; creates competitive ecosystem versus single-vendor lock-in.
Interconnect choice is strategic and long-term—incorrect decisions create lasting constraints; evaluate architecture carefully before deployment.
UALink uses standard Ethernet physical layer (802.3), enabling reuse of existing cables, re-timers, and management infrastructure.

Curtis Bowman walks through UALink's 800 Gbps-per-lane, memory-semantic fabric targeting tight accelerator coupling as a single logical memory space—PCIe latency at Ethernet bandwidth. v2.0 adds in-network collectives, management, and chiplet specs; AMD, Marvell, and Astera Labs are building compatible silicon.