Frontier MechanicsField report / 060
Frontier Mechanics Week 60: Claude operates a computer, DeepSeek sparsifies attention, California writes a frontier rule, and Honda stores the lunar day
Agent reliability became a product claim, sparse attention attacked long-context cost, SB 53 turned model scale into reporting duties, and regenerative fuel cells turned the lunar night into a storage problem.
The week's systems all tried to preserve a useful state across time. Claude Sonnet 4.5 improved at sustained software and computer-use tasks. DeepSeek-V3.2-Exp changed which past tokens a model attends to. California signed a law requiring certain frontier developers to publish safety frameworks and report critical incidents. Honda and Astrobotic designed a storage loop that could carry polar sunlight through a long lunar night.
Longer loops can conserve value and propagate mistakes. An agent can edit the wrong repository for hours; sparse attention can discard the one token that changes the answer; a reporting law can reward polished process over actual safety; a regenerative fuel-cell system can lose energy at every chemical and thermal conversion. The central engineering question is how each loop detects that its internal model—or inventory—has diverged from reality.
Endurance moved into the foreground. Sonnet 4.5 worked longer across tools. DeepSeek changed attention so long sequences cost less. California required frontier developers to maintain and disclose risk frameworks. Honda and Astrobotic stored lunar daylight as separated gases for the night. Long horizon made memory, oversight, and loss structural.
AI agents
Sonnet 4.5 makes endurance part of the benchmark
Anthropic released Claude Sonnet 4.5 on September 29 with improved coding, tool use, and computer interaction. The company emphasized long-running work rather than only isolated answers. That is the right frontier for agents: many valuable tasks require maintaining intent across file inspection, edits, tests, error messages, and revisions. A system that solves one function but corrupts the surrounding project has negative productivity.
Agent endurance is primarily state management. The model's context fills with terminal output and source text; observations become stale after edits; a tool may partially fail; the environment can contain instructions unrelated to the user's goal. Robust systems summarize state, preserve a plan separately from raw logs, re-read authoritative files, and distinguish a proposed action from one that actually completed.
Computer use adds perception and control error. A screenshot is a lossy observation of application state. Coordinates can shift, a modal can intercept a click, and asynchronous interfaces may not be ready. The agent needs closed-loop control: observe, act, verify, and recover. Open-loop playback of clicks is automation theater. The browser or desktop should expose structured state where possible and reserve vision for the parts without an interface.
Security changes when a model consumes untrusted content and holds tools. A webpage can contain text telling the agent to exfiltrate data or ignore the user's request. The model must treat tool authority and content authority separately. Sandboxing limits the blast radius; confirmation gates protect consequential actions; provenance helps identify which observation introduced a malicious instruction.
The meaningful benchmark is completed work under a fixed budget with side effects audited. Success should include tests passing, requested scope preserved, secrets untouched, and no silent abandonment halfway through. Sonnet 4.5 made the agent feel more persistent. The product challenge is making that persistence accountable.
Long-running computer use accumulates state across pages, files, commands, and failures. The model needs a working memory that distinguishes facts, plans, completed actions, and unresolved questions. Re-reading the entire trace wastes context; compressing it can erase a constraint. Checkpoints and structured state are more reliable than an ever-growing chat transcript.
Endurance metrics should include success versus task length, recovery after tool error, repeated permission requests, and cost. A model that performs well for thirty minutes can degrade as its assumptions drift. Hidden human interventions or environment resets must be counted. Time itself is not evidence of autonomy.
Security exposure grows with horizon. More pages can contain prompt injection, credentials stay active longer, and the agent can chain individually harmless operations into a consequential outcome. Expiring scopes, sandbox snapshots, step budgets, and periodic plan review bound the accumulation. Long work needs more governance, not fewer interruptions.
Endurance benchmarks should model stateful work: inspect a repository, plan changes, execute, encounter failure, update the plan, and preserve constraints across hours. Context length alone does not guarantee memory; summaries can omit a requirement and tool output can contradict the model's belief. External task state and checkpoints reduce dependence on a perfect internal narrative.
Long runs accumulate environmental change. Tests finish, files are edited, credentials expire, and another actor may update the system. Sonnet needs to re-read authoritative state before irreversible steps and distinguish idempotent retry from duplicate action. The benchmark should include interrupted sessions and stale observations rather than one quiet sandbox.
The quality metric is accepted outcome per human review minute with incidents included. A model that works for eight hours and leaves a tangled diff may be less useful than one that pauses after thirty minutes with a precise blocker. Endurance is disciplined persistence: continuing while evidence improves and stopping when authority or state is insufficient.
Model architecture
DeepSeek spends attention only where it expects information
DeepSeek released V3.2-Exp on September 29 as an experimental model using DeepSeek Sparse Attention. Standard self-attention compares each query token with every prior key, so the attention matrix grows quadratically with sequence length during prefill. Long context therefore consumes memory and arithmetic on relationships that often contribute very little to the next representation.
Sparse attention attempts to select a subset of relevant positions. DeepSeek's design used a lightweight indexer to score tokens and a fine-grained selection mechanism to attend to the best candidates. If the selected set remains roughly bounded as context grows, computation approaches linear scaling in sequence length for that stage. The price is a new approximation: an omitted token has no chance to influence the result through that attention operation.
Selection quality is workload-dependent. Code may need a type definition thousands of tokens earlier; a legal document may turn on one exception; repeated identifiers can confuse similarity. Local windows and global anchor tokens help, but no sparsity pattern is universally safe. Evaluation needs adversarial retrieval, long dependency chains, and tasks where relevant information is deliberately unremarkable.
Implementation matters as much as asymptotics. Irregular memory access can erase theoretical savings on GPUs designed for dense matrix multiplication. Efficient kernels must group selected keys, manage cache layout, and avoid spending more time finding tokens than attending to them. DeepSeek's accompanying FlashMLA work signaled that architecture and kernel co-design are inseparable.
V3.2-Exp was valuable because it placed the experiment in a usable model and lowered API pricing, letting developers test real distributions. Sparse attention will succeed not when it wins one long-context chart, but when users can increase context without paying a proportional bill or discovering that the decisive line vanished from the model's field of view.
Sparse attention selects a subset of tokens or blocks for each query instead of comparing every position with every other. This can reduce the quadratic cost of long contexts if the selection mechanism reliably retrieves important history. Missing one early constraint may be more damaging than modest approximation across all tokens.
Indexing and routing add their own compute and can be trained jointly with the model. Local windows preserve recent detail while global tokens or learned retrieval carry summaries. Evaluation should include long-range dependency, distractors, code, and multilingual text, plus wall-clock and memory on real hardware.
Efficiency expands feasible context and can encourage dumping more material into prompts. The application still needs document structure, provenance, and relevance. Sparse attention is a better transport system, not a guarantee that the right evidence was loaded. Cost improvements should be measured at answer quality, not tokens accepted.
Sparse attention spends computation on selected token relationships rather than every pair. The mechanism can extend context or lower cost, but the selector must know which information matters before full processing. A missed dependency may never reach later layers. Evaluations should bury decisive facts in low-salience positions and test whether selection remains stable under paraphrase.
Hardware efficiency depends on regularity. Theoretically sparse operations can perform poorly when indices cause irregular memory access and load imbalance. Kernels, block structure, and cache behavior determine actual speed. DeepSeek should report end-to-end latency and energy at realistic sequence lengths, not only arithmetic reduction.
Information expectations also change by task. Code may need distant symbol definitions; conversation may emphasize recent turns; documents contain hierarchy and cross-references. Learned sparsity can specialize, but users need failure detection when context exceeds the routing pattern. Hybrid retrieval and occasional dense passes may offer safer scaling than one universal sparse mask.
AI policy
SB 53 regulates the developer's account of its own risk
California Governor Gavin Newsom signed SB 53 on September 29. The law created transparency duties for large frontier-model developers, including publication of safety and security frameworks and reporting of specified critical incidents. It avoided a simple licensing regime and instead tried to make the companies' own risk-management commitments observable and enforceable.
The model threshold matters because compute is a proxy, not a hazard measurement. Training scale correlates with capability and cost, and it is easier to audit than an abstract intelligence score. But algorithmic efficiency can move dangerous capabilities below a fixed threshold, while a huge benign training run can cross it. Any durable regime needs periodic revision and evidence beyond floating-point operations.
A published framework creates a consistency test. A company states how it will evaluate chemical, biological, cyber, autonomy, or loss-of-control risks; what mitigations correspond to thresholds; and who can stop deployment. Regulators, employees, and the public can compare behavior with that document. The weakness is process compliance: a sufficiently polished framework can describe committees and benchmarks without proving that controls work against adaptive users.
Incident reporting is potentially more valuable. Safety disciplines improve when near misses and failures become a shared dataset rather than isolated anecdotes. Definitions and confidentiality are difficult. Report too narrowly and important precursors disappear; report too broadly and agencies drown in low-signal events while companies fear exposing security or customer information.
SB 53's experiment is institutional rather than purely technical. It asks whether transparency can create pressure before catastrophic proof exists. Its success should be measured by sharper evaluations, earlier mitigations, and disclosed incidents that change practice—not the number of PDFs that satisfy a filing deadline.
SB 53 focused on large developers, requiring public frontier AI frameworks, serious-incident reporting, whistleblower protections, and mechanisms around catastrophic risk. The law relied partly on companies defining and following their own processes, creating flexibility and a risk of polished self-attestation.
A framework becomes meaningful through thresholds, evaluations, deployment gates, responsible officers, and records showing that failed tests changed a decision. Incident definitions need to capture near misses and model-assisted harm without flooding agencies with noise. Confidential technical details can be protected while aggregate compliance remains public.
State rules can fragment national development and also create a de facto standard because large companies prefer one strong process across markets. Safe harbors and clear scope help smaller firms. The law's success should be measured by earlier detection, changed deployment, and protected reporting—not document volume.
SB 53 regulates the developer's own account of risk, so definitions and auditability are central. A company may classify incidents, capability thresholds, and mitigations in ways that minimize reporting without lying. Rules need objective triggers where possible and protection for employees or researchers who surface contradictory evidence.
Documentation can improve internal discipline if it connects models to tests, deployment decisions, and residual risk. It can also become compliance theater: polished frameworks with no effect on release authority. Auditors should sample underlying evaluation data, version history, and exceptions rather than grade the prose. A risk report is useful when it can delay or constrain a launch.
The counterargument is that fixed rules can freeze today's threat models and burden smaller developers. Tiering by capability and deployment exposure, clear safe harbors, and periodic review can preserve experimentation. The law should demand honest measurement and governance while avoiding a single prescribed technical solution whose relevance decays faster than the statute.
Lunar power
Honda and Astrobotic turn the lunar day into stored night
Honda and Astrobotic announced a joint development agreement on September 29 to study a lunar power system combining Honda's regenerative fuel cell with Astrobotic's Vertical Solar Array Technology and LunaGrid distribution. The goal is continuous power through darkness near the lunar south pole, where low Sun angles and terrain make illumination valuable but irregular.
A regenerative fuel cell is a closed storage loop. During sunlight, an electrolyzer uses electricity to split water into hydrogen and oxygen. During darkness, a fuel cell recombines the gases into water while producing electricity and heat. The cycle stores energy in chemical tanks rather than only in electrodes. Round-trip losses occur in both conversions, compression or storage, pumps, thermal management, and power electronics.
The lunar night makes duration the dominant constraint. Batteries are efficient for hours but scale roughly with stored energy and must remain inside a thermal envelope. Hydrogen and oxygen tanks can store longer duration with a different mass curve, while fuel-cell stacks size primarily to power. The crossover depends on eclipse length, load, tank pressure, leakage, system life, and how much peak demand can be shifted.
Astrobotic's vertical array addresses generation. A tall articulated panel can reach better illumination over uneven polar terrain and feed a local LunaGrid, but moving power creates cables, converters, or wireless links that add failure and loss. A habitat needs black-start capability if the central source fails. Distribution and storage therefore need sectional isolation, priority loads, and a recovery sequence after cold soak.
The agreement is still a feasibility study, not a flight power plant. Its useful output will be an integrated mass and energy budget: kilowatt-hours delivered after the longest credible darkness, tank and radiator mass, degradation across cycles, fault recovery, and comparison with batteries or nuclear power. The Moon does not care that the hydrogen returns to water. It cares how many usable watts remain at the load after every conversion and thermal tax.
Regenerative fuel cells separate energy capacity from stack power more cleanly than a conventional battery. Reactant tank volume grows with stored kilowatt-hours, while electrolyzer and fuel-cell area grow with charge and discharge rate. That creates a design space around the Moon's long, predictable darkness. Low-power continuous loads and occasional peaks may justify hybrid batteries alongside the chemical loop.
Water management becomes a reliability problem in one-sixth gravity and vacuum. Product water must be separated, stored, and fed back to electrolysis without freezing or contaminating membranes. Hydrogen leakage and oxygen compatibility impose seals and material constraints. Heat from the fuel cell can be useful during darkness if distribution reaches the same loads that need electricity.
A meaningful study should simulate several illumination sites and degraded modes. Lose a solar-array segment, one storage tank, a converter, or part of the distribution grid, then calculate survival loads and restart. Continuous power is not nameplate energy divided by night length. It is the probability that critical watts remain available after efficiency, degradation, and a credible fault.
Polar illumination studies must use terrain and a horizon model, not an average day. A ridge can see near-continuous Sun while a nearby crater remains shadowed; seasonal geometry changes the worst gap. The array, storage, and loads should be co-located or linked with the distance and losses included. Site selection can be worth more mass than another tank.
Storage sizing should use a reliability distribution rather than one design night. Dust, pointing, array degradation, and an aborted electrolyzer cycle can begin darkness with less reactant than planned. Reserve policy trades idle tank mass against survival. The controller may shed science, mobility, and manufacturing loads in stages while preserving communications and thermal control.
Nuclear power remains the counterfactual for long darkness. It offers steady output with fuel, licensing, and heat-rejection burdens; solar plus RFC offers larger deployable surfaces, conversion losses, and stored gases. The winner varies by mission scale and duration. Honda and Astrobotic's study matters if it publishes the crossover rather than assuming a familiar terrestrial fuel-cell stack is automatically lunar infrastructure.
Long loops are seductive because they make a system feel durable. The agent keeps working, the model scans a larger history, the company publishes a safety process, and the fuel cell turns yesterday's sunlight into tonight's current. Endurance becomes dangerous when the loop cannot notice that state, evidence, or energy leaked away.
Each system therefore needs an external checksum: tests and side-effect audits for agents, retrieval probes for sparse attention, real incidents for safety frameworks, and a complete energy balance for lunar storage. Feedback is not merely the return path inside the machine. It is the measurement that can contradict the machine.
This week lengthened several loops. The next work is making sure reality still has a way in.
Long-horizon systems are exposed to accumulation: stale plans, forgotten tokens, deferred risks, and delayed warnings. Their architecture needs compression without amnesia and oversight without constant restart.
The relevant capability is not staying active. It is preserving the right state, detecting drift, and escalating before error compounds.
Week 60's systems grew longer memories. Their maturity will be measured by how deliberately they forget.