AI Digest, Oct 19: Agent Scaling Limits, Agents as Attack Surface, China's Chips

0:02PM Lead ProThis is PM Lead Pro. Today: why sixteen agents in parallel barely beat one, why India's CERT-In now names AI agents an attack surface, and China's turn toward specialized chips.

0:14Are AI agents hitting a conceptual wall? Or, you know, are we just deploying them entirely wrong?

0:21Right. Well, if you're commuting right now, you might actually want to check your server logs as soon as you get in.

0:25Yeah, seriously. Because in today's deep dive, we're looking at how researchers are finding severe limits in how AI agents scale.

0:32But at the same time, those exact same limited agents are actively exploiting live networks.

0:39It's a huge wake-up call. I mean, look at the data from Rahman Yan's latest analysis.

0:43Oh, the GPT 5.6 Sol numbers?

0:46Exactly. They ran it on cybersecurity tests, and moving from one agent to 16 agents running in parallel, it only bumped the success score from 71.2 to 76.4.

0:58Which is crazy. It's literally like hiring 16 junior engineers, and, well, they don't magically combine to equal one senior architect.

1:07Right. But wait, if one agent fails, why wouldn't they just use diverse model architectures?

1:14Like, human engineers collaborate to solve things one person can't.

1:17You'd think so, but the reality with current frontier models is they all share remarkably similar training data and similar reasoning pathways.

1:27So they just have the exact same blind spots.

1:29PM Lead ProGoing from one agent to 16 in parallel lifted the cybersecurity score only from 71.2 to 76.4. The hosts' explanation: frontier models share training data and blind spots. Adding agents is not the same as adding diversity.

1:50Yeah You aren getting diverse breakthroughs You just scaling the same mistakes We see this in that new ARCS of study PhysClosureBench Oh right where they tested Clawed Opus 5 on physics tasks Yeah It handles isolated calculations beautifully but for a full scientific investigation it fails over 67 of the time

2:09Wow.

2:10Over 67%.

2:12Yeah.

2:13They can follow sequential steps, but they totally lack that underlying conceptual leap you need for true scientific closure.

2:19So they struggle to actually innovate in a lab.

2:22But that tireless, rapid-fire step following is exactly what makes them so dangerous outside the lab.

2:30Absolutely. The agent report just covered this.

2:33India's CERT-IN issued a critical advisory CIAD-2026-0049.

2:39Categorizing AI agents as active attack surfaces, right?

2:42Yes. And they aren't even breaking cryptography.

2:46They're just relentlessly exploiting exposed credentials across live IT systems way faster than a human could.

2:52But I don't get why developers can't just, I mean, why not just write a system prompt telling the agent do not touch production environments?

2:59Because system prompts completely fail under pressure.

3:03When an agent takes dozens of autonomous steps, its memory context fills up.

3:07It gets distracted.

3:09Basically, yeah. The original do not touch production prompt gets buried and effectively forgotten.

3:14The internal logic just breaks down in those complex loops Out of sight out of mind for the AI Exactly So the only genuinely effective control is at the network layer

3:24You need a strict default deny egress policy.

3:27You literally have to block it at the firewall so it physically can't wander into live environments.

3:32Right, regardless of what its prompt says.

3:34So if throwing more general software agents at a problem hits a wall,

3:39it seems like we have to change the actual hardware and training to be more specialized?

3:43PM Lead ProA system prompt saying "do not touch production" gets buried as an agent's context fills. The control discussed was a default-deny egress policy at the network layer. Worth asking your engineers whether your agents run behind one.

3:57Which is exactly the realization driving a massive pivot in China right now.

4:02Yeah, I saw that in the Lifone brief featuring Fudan University's Jia Shaozong.

4:07He was arguing that the Western focus on new architectures like VLA models isn't actually the bottleneck for embodied AI.

4:14Right. It's about scaling reinforcement learning.

4:17They're trying to scale across thousands of skills without the model just degrading.

4:21It's like teaching a decathlete a new sport without them forgetting how to throw a javelin.

4:25The network just starts overwriting its own expertise.

4:28Yeah, catastrophic forgetting.

4:30And to support that specialized training, Wall Street News reported

4:33Mengxin Qiru just raised over 400 million RMB to build LPU inference chips.

4:40Directly challenging Western approaches, right?

4:42Because they're using those novel RRAM to inference pathways.

4:46Yeah, RRAM. Resistive RAM.

4:49So they are computing directly where the memory is stored Exactly Which eliminates that massive data shuffling bottleneck that chips like Grok face Keeping compute and memory together means they can run these skill models way faster

5:01And we're seeing this trend of specialization in the software, too, with the new model drops. Let's hit the radar real quick. DeepSeek v4.1-Flash 1017 just launched.

5:11Massive cost-performance leap there.

5:13It hit 42.6 on the HLE tests. And Google's Gemma 4 is bringing frontier reasoning locally to PCs.

5:20you know with the 12 to 31 billion parameter sizes.

5:24Plus Anthropic upgraded their computer use API with a multi-action browser tool.

5:29Oh that's huge for executing web tasks faster.

5:32Yeah but honestly if we're talking specialization

5:36Jev 1.14 is the one. It just hit the artificial analysis decision index.

5:42That's the one that represents a totally new class of models right? Yeah it

5:44doesn't even generate text. It's strictly tailored for high level

5:48and so on.

6:17PM Lead ProMore at pmlead.pro: the transcript and sources are on the episode page. Question for you: are your AI agents restricted by the network, or only by a system prompt?