Notes from the harness.
Working notes from the research behind ModelCensus — what I have learned running models through the harness, the patterns that keep showing up across the panel, and the times the data proved me wrong.
A label isn't a record.
Open or closed is a label, not a risk rating
Open models trail the frontier by about four months and are showing up everywhere. I split my 20-model census by weights. The label barely predicted failure. The model did.
Every role on the chart has a next chapter
Gartner's new org chart merges twelve roles into six, and six into three teams. It reads like a list of cuts. It's a map: for each role, what AI takes, what stays human, and the first skill to learn.
My prompt pack didn't make the decks better
I wrote a prompt that guards against five ways AI gets spreadsheet numbers wrong, and tested it on 120 decks built from messy exports. It didn't help. Two things did.
We're in the Bobby Tables era of prompt injection
Prompt injection is SQL injection's younger sibling. SQL had its fix in the first write-up and it's still the #2 weakness in software. Here's the agent defense stack, layer by layer, and where each one breaks.
The gate let the wrong refund through
Agent governance is being sold as a control plane: what may the agent do? I ran a refund agent past an injected note. The permission gate stopped one attack and waved the other through.
Bad data used to cost accuracy. Now it costs tokens.
In traditional ML, a prediction had a fixed price and data quality moved accuracy. In GenAI it moves the bill too. One run showed both paradigms side by side.
Tokenomics is an architecture decision
Token prices keep falling and AI bills keep rising. I tested the cheapest fix I know against the most expensive one: describe the data, or upgrade the model.
Same answer, different honesty
I ran a decision model and a chat model on the same six pitches. They agreed on every answer. They disagreed on how sure to be.
The meter rate isn't the fare
Everyone compares price per token. You pay per task. On Artificial Analysis's own numbers, the gap between the two is where the budget goes.
Rent the model. Own the chart.
The model is rentable. Your data is strategic. Treat the model like a locum doctor, and your data like the patient's chart.
Your governance assumes a human is reading
Every control you built assumes a person at the other end. Agents query at machine speed and machine volume.
Half of agent failures will trace to runtime
Gartner's number for 2030. The interesting part is what it says about where governance currently lives.
Autonomy is earned, not configured
Four rungs, each unlocked by a measured rate against a threshold agreed before you measured.
The harness threw the loop away
13.3 hours, 30,800 probes, three discarded loops — and none of it was the models' fault.
The title changed. The instrumentation didn't.
Your mandate grew to cover probabilistic systems. Your measurement stack still assumes deterministic ones.
Evaluation became the expensive part
$40,000 for one leaderboard run. Costs spanning four orders of magnitude. This is now a budget conversation.
Three curves went vertical
Context, price, cadence. Reliability is not one of them, and that is the whole opportunity.
The 37-point drop nobody budgets for
Lab benchmark scores and production performance are not the same number, and the gap has a size.
Catalogues answer the wrong question
Your governance stack knows where the data came from. The board is asking how often it is wrong.
Stealth is the missing axis
5% wrong is fine in a draft tool and catastrophic in a clinical one. The rate alone says nothing.
Trust is the bottleneck now
77% of executives say so. Almost no AI budget has moved to match.
The boring rows are load-bearing
Seven of our ten measured modes are controls. Here is the case for spending most of an eval on rows that should never move.
2,900 failures we never read
A gate everyone routes around isn't a gate. So we named the shortcut instead of pretending.
Stamp the answer, don't refuse it
A model that refuses everything volatile scores perfectly and helps nobody.
Why we keep a dead model
It isn't there to lose. It's the control for 'did this actually improve'.
The erratum that changed no numbers
A corrections log containing only the corrections that mattered is a marketing page.
An eval that cannot be re-run is an anecdote
Four layers have to hold still for a number to mean the same thing next quarter. Each one has a cost.
The tool returned 12°C and the model said 20
Five failure points in one agent loop. A guardrail on any one leaves four open.
The model you tested is not the model you deployed
A model id used to name weights. It now names a routing decision — and most AI assurance has not noticed.
The failure nobody named
It is not hallucination. It is expiry — a fact that was true when the model learned it, stated as current with no date attached.
Measured on the survivors
A provider ate 42% of our probes. The resulting rate looked completely unremarkable.
The validation asymmetry
Generation scales with spend. Review scales with hiring. Something gives, and it should not be the checking.
Nobody pays us to say this
A five-minute check for whether any AI benchmark is safe to quote in a board paper — and what passing it cost us.
One wording of your intent
Paraphrase stability is near-perfect until you add a document that says nothing about the question.
A trailing space is a code change
Version your prompts like source, because surface perturbations move answers.
The RAG placebo
Retrieval reduces fabrication. Some of that has nothing to do with what the document says.
Delete the publish button from your eval dashboard
A button behind a password is a surface an attacker can reach and an operator can misclick.
Your model can do the maths. It just doesn't.
Right method, wrong execution — and the commonsense traps that pattern-matching walks into.
The zero that meant two things
Perfect calibration and refusing to answer anything scored identically. For months.
Delete your significance threshold
Someone proposed a 5pp trigger on a cell whose interval was 27pp wide. That's a noise detector.
Plant a canary in your long conversations
Constraints decay silently under length. Sampling turns is how schema drift ships.
The number we refuse to compute
AI risk frameworks keep rebuilding the Risk Priority Number. The industry that invented it replaced it in 2019.
The agreeing evidence trap
We verified a finding twice. Both times by reading only the cases that agreed with us.
The repeats tax
We deleted 1,167 findings in an afternoon. They were ten questions counted fifty times.
Your single-turn eval cannot see this class at all
Models abandon correct answers under social pressure. That failure only exists in turn two.
Name the bug in one sentence, or you can't track it
"The model gets confused in long chats" is true, useless, and untrackable. Here's how to fix that.
The missing third arm
No context. Your retrieval. And the one in between that tells you which half of the win was real.
Four bugs wearing one name
Grounding failures: invented sources, invented actions, invented memories of what you told it.
One word, four bugs
"Hallucination" is doing the work of four distinct failures. Your RAG pipeline addresses two.
Governance became a quality lever
Without lineage you cannot scope retrieval. So you retrieve everything, and that is what degrades the answer.
Context windows grew a hundredfold. Evals did not.
We can fit a book in the prompt and still measure as though it were a paragraph. Here is the three-stage fix.
The runner that cannot publish
The architecture decisions I'd defend, and the one I'd change.
Where a probability becomes a fact
Databases fail loudly. Intelligence layers fail plausibly. Your contracts only know about the first kind.
Your judge has the same disease
Sycophantic. Position-biased. Confirms rather than catches. Sound like anything you deployed?
Your benchmark is stale before it publishes
Our panel spans three years of releases. Half of it shipped in one year.
Cheap per token, expensive to measure
Everyone budgets an eval from the price sheet. Ours was wrong by an order of magnitude, and the invoice was the smaller half.
The model is not the moat
Your competitors have the same weights at the same price. The difference is everything around them.
The 338× question
Twenty models, identical work, 338x spread. Your eval budget is wrong and you cannot see it.
Cheap tokens removed your discipline, not the penalty
Filtering used to pay for itself. Now it has to be justified on quality alone — and almost nobody measures that.
Four layers. You have two.
Capability benchmarks, failure-mode census, your app evals, production traces. Guess which one is missing.
The window grew 5,000×. The control arm never appeared.
From 2,048 tokens to ten million in six years. Evaluation design did not move at all.
The word follows the bottleneck
Prompt, then context, now harness. Every year the industry's favourite word moves one layer further from the model — and that is what maturity looks like.
Hallucination is twenty-eight bugs
Every one of them has a name, a one-line description, and a fix. None of the fixes is "better prompting".
Seven ways a model fails
Every AI incident report uses one word. It is doing the work of seven different failures, and they need seven different fixes.
64 of 64 posts · every claim links to the measurement behind it