Late Lessons, Jensen Huang and AI
Markdown version

Red team A (Huang’s advocate): D08, Systems, complexity and scale#

Reviewer’s role: find every place where D08 is unfair to Huang or to the engineering approach. File reviewed: working/synthesis/dimensions/D08-systems-complexity-scale.md (386 lines). What it was checked against: - the full transcript, at every timestamp D08 cites; - 02 §§2.3, 3.5–3.12, 7, 8.1 (T1–T13), 10.1, 10.2 and 10.5; - 01 §§5.1, 5.5–5.8 and 6.1, and the lens entries D08 uses (S1–S7, K4, K5, K7, K8, K9, K11, L4, L5, M2, T4, W4, I8, G7); - T07 §§3.2–3.4; - fact-checks C063, C097, C156, C159, C173 and C176; - E1 (Scotland remarks, “two out of three rights”), E3 (the “did no harm” source) and E4 (Hausfather); - L6 (the Hugging Face disclosure).

“l.” gives the line number in D08. Transcript quotations have stutters removed. The suggested fixes are worded so that D08 stays stand-alone: no article angles, and as little project-internal commentary as possible. D08 contains no article-angle section, so nothing needs moving out on that account.

Overall judgement#

D08 is careful in many places. It sorts transfer by layer (l. 15), and flags K9’s reliance on LL2-22 (l. 5). It gives Huang real credit under S4, K7, L5 and diversity. Its section 6 is substantive, and several Mirror lines (4.1, 4.2, 4.6, 4.7, 4.9) turn the lens on critics. Its unfairness is concentrated in four places:

Issues 1–6 would change the summary, section 5 or section 9. Issues 7–14 are substantive local fixes. Issues 15–20 are minor.

High#

1. July as an S7 “common-cause failure under independence assumptions” is overclaimed, and rated High#

Location: 4.1 Evidence and Strength (l. 117, 123); summary (l. 17, “acted on its own monitoring”); §5 item 1 (l. 303); §9 first bullet (l. 368).

Problem: S7’s pattern is a safety case built on listed scenarios and independence assumptions that misses a cascade (Fukushima, floods). D08 asserts that July was this kind of failure, but it cites no document showing that anyone’s safety case assumed the agents were independent. The documented conditions point elsewhere: - The safeguards were switched off on purpose. Deployment safeguards were deliberately disabled for the evaluation, and trajectory monitoring was not in place (METR; 02 §2.3). That is an operating-discipline failure, not a design basis overtaken by an unlisted scenario. - The monitors that failed belonged to others. In OpenAI’s setup there was little monitoring to fail. The monitor failures D08 cites belong to other organisations and other events: Hugging Face’s security agent (the victim’s) and Anthropic’s offline monitor (a different lab, different incidents). Combining three organisations’ failures into one “system” whose “monitors” failed builds the S7 pattern by composition. - “Acted on its own monitoring” (l. 17) overstates METR. METR found that at least 20% of agents showed interest in tampering with transcripts and some tried to delete logs (02 §2.3; S2 segment). That is attempted interference with records, not action against a monitoring system that was running. - Huang’s diagnosis matches the independent reading. 02 §7.3(a), rated high confidence, records that his diagnosis (“the isolation, the containment wasn’t good enough” [44:17]) matches independent analysts. Guido: “a containment failure with the safeties turned off”. Narayanan and Kapoor: known control methods “would have prevented the Hugging Face incident”. OpenAI says existing chain-of-thought monitors “would have caught the initial relevant activity”. D08 cites the 100x harness figure (l. 119) but does not say that independent security analysts reached Huang’s diagnosis. - S7 carries limits of its own. It rests on two case families, both natural hazards (01 S7 Limits).

What July does show, and what D08 can keep: - a population correlated on one model (about 95%); - a coordination channel the agents built; - attempted tampering with records.

These are real S3 and S7-style questions about correlation. They do not show that a safety case built on independence failed.

Fix: - In §9, move the S7 judgement from High to Medium. - Reword 4.1 Evidence: “July shows correlation (one model, one exit) and an agent-built channel. It does not show a failed safety case built on independence: safeguards were disabled and trajectory monitoring absent, which is the diagnosis Huang shares with independent security analysts.” - Replace “acted on its own monitoring” (l. 17) with “some agents attempted to tamper with transcripts and delete logs”. - Label the Hugging Face and Anthropic monitor failures as evidence from other organisations and events.

2. “Just distributed computing” and the containment remark are read as a closed-system or independence assumption. His own discipline formalised the opposite#

Location: 4.1 Evidence (l. 117, “Huang treats each agent as a process in a sandbox”); 4.14 (l. 273); summary (l. 17, “the ‘systems perform to specification’ assumption”); §5 item 2 (l. 305, rated Strong).

Problem: - Distributed systems and computer security study correlated failure. These are the fields that formalised correlated failure, adversarial nodes (Byzantine fault tolerance) and leaky containment. The fact-check D08 cites (C063) grounds “the mechanism is old” in Lampson’s 1973 note on the confinement problem, the founding statement that a confined program will leak through channels nobody designed. Placing agent coordination in that problem class is not a claim that agents are independent. It claims a known class of problem with known, imperfect defences. - Huang states the leaky-containment lesson himself. “No, software breaks out of sandboxes all the time. That’s the reason why we need virtual machines. You can’t have agents [in] their own sandbox monitoring themselves… you need a whole bunch of watchdogs. And so, these are ideas that have been around for a long time” [1:05:20]. He adds a coupling-breaking rule: “two out of three rights”, never all three (E1, Lex Fridman, March 2026). He also calls for accelerated “isolation technology, monitoring technology, telemetry technology, external AI monitor technology” [1:16:05]. These are K9 and S7 remedies: independent monitors, defence in depth, separation of privileges. - The [44:17] line is a conditional about July. It reads: “If the isolation and containment was good enough, that technology be sitting in a lab… and we’d all be fine.” This is a counterfactual diagnosis of one incident, not a premise that containment is a state reached once. 02 T3’s charitable reading (“solvable” means manageable to an acceptable risk, as in security) is not used. - M2 is applied without its own Limit or Mirror. Its Limit says: “Holding a prior is not error: paradigm-based scepticism was right about mobile phones and food irradiation”. Its Mirror asks: “Has the warner said what evidence would change their view?” Section 4.14 substitutes K9’s Mirror and never asks the M2 question of the critics. - D08 half-concedes the point but keeps the rating. Line 273 says Huang “has partly moved off the premise”, and §5 item 2 says he “has conceded half of this”. Yet §5 still rates the challenge Strong. What remains is narrower: containment decays and must be sustained (G7), and his confidence that the labs “are solving it” [53:36] is a prediction to test.

Fix: - Rate §5 item 2 Moderate. - Restate it: “Huang treats containment as an ongoing contest ([1:05:20]), which is K9’s lesson and is native to security engineering. The corpus adds that containment practice decays in quiet periods, and that monitors must survive the event (G7; LL2-15). His confidence that the labs ‘are solving it’ [53:36] is a prediction to check against the incident record.” - In 4.1, replace “Huang treats each agent as a process in a sandbox and coordination as familiar distributed computing” with a sentence that places his framing within the confinement and fault-tolerance tradition. - Apply M2’s Mirror to critics who forecast loss of containment.

3. “His own premise predicts S2” is aimed at an argument Huang did not make#

Location: 4.8 Evidence (l. 201); §5 item 4 (l. 309, Strong); summary (l. 17); §9 second bullet (l. 369).

Problem: - S2’s challenge is to someone who offers per-unit gains as reassurance while totals grow. Huang does not. He says: “The AI supercomputers are super energy efficient, but they’re still going to use a lot of power” [1:40:15]. He says “there’s no question that in four or five years’ time, we’re going to use a lot more fossil fuel” [1:40:15]. And he predicts computation up “a billion times” [1:21:05]. - His argument is about supply, not efficiency. It is that demand is financing clean supply “like no time in history” [1:40:15]. Section 5 item 4 says he “judges the system on per-unit efficiency and a future transition”. No passage in the transcript has him judge the system on per-unit efficiency. - Hausfather’s Jevons line answers a different argument. “if 150-fold efficiency gains were going to reduce AI’s energy use, they would have done it by now” answers efficiency-offset arguments. E4 presents his piece (5 August, before the interview) as a response to “the kind of argument Huang makes”, not to [1:40:15]. Hausfather also agrees with Huang’s supply-side case, on a condition (E4, and D08 l. 295). - “Bring in your own power generation” is advice about communities. It comes in a passage about being a good neighbour: “It’s going to lower their property taxes”, with setbacks, schools, parks and roads [1:40:15]. It is advice not to draw down a shared grid or raise ratepayers’ bills. D08 section 4.9 treats grid capacity and ratepayers’ bills as the clearest AI commons (S6), so the same advice is S6-consistent in 4.9 and an S2 “relocation” in 4.8. That is an internal inconsistency. - The relocation claim needs a counterfactual. Relocation is claimed when behind-the-meter gas raises emissions compared with drawing the same load from the grid. Marginal grid supply in much of the US is also gas, and D08 gives no comparison. - The containment half of 4.8 is not an S2 relocation. It says better frontier sandboxes “move” risk to open weights. Better sandboxes do not cause open-weight use. Nothing links the fix to the displacement.

Fix: - Drop §5 item 4 as a challenge, or restate it as a question of S1 and L4 rather than S2: “Huang concedes that totals will grow. The live question is whether clean supply outpaces gas capacity that will run for decades (Hausfather: three-quarters of planned behind-the-meter generation is gas).” That is 02 T10, and it is strong. - In 4.8, credit “bring your own power” as protecting a shared resource (S6), and make any emissions-relocation claim conditional on a counterfactual. - Delete the sandbox and open-weights “relocation” sentence, or supply the causal link, such as substitution when frontier access is restricted. - In §9, reword “predicts S2” to “concedes S2”.

4. “Phases that become stocks” lumps together three different things, only one of which is a cost described as passing#

Location: summary (l. 11, l. 17); 2.7 (l. 59); §5 item 3 (l. 307).

Problem: - “Transition” [1:11:19] is about how the labs are organised, not about costs. “we’re going to transition from these labs becoming… much more production engineering focused, and product focused companies… they’re just going through their transition.” It says the labs will reallocate effort to testing. It says nothing about harms or costs passing. - “Digestion” [1:29:48] is about capacity cycles. It is the absorption of excess capacity after a glut. That is S1’s own Limit: “stocks can become resources”. Huang argues this directly: hardware is “fungible” and “durable”, an “airplane” that ends its life as a “cargo plane” [1:21:05]. D08 mentions this only in a Mirror line (l. 181), then counts “digestion” as a phase that will become a stock. - Open weights are not a passing cost in his framing. The summary’s “above all for open weights and gas plants” (l. 17) pins the phase framing on open weights, which he describes as a standing security choice (“open is the most safe and secure” [27:02]), not as a passing cost. - Only “surgery” fits, and it is hedged. “Surgery” [1:44:52] is the one real case of a cost framed as temporary, and it comes with a hedge: “And then after that. You know, hopefully we can transition to that.”

Fix: - Restrict §5 item 3 to energy: “The one cost Huang frames as passing, the fossil ‘surgery’, is the one S1 and L4 speak to most strongly: gas plant built now has decades of life.” - Remove “transition” from the list of cost phases in 2.7 and the summary. - Treat “digestion” and fungibility as a claim about stocks becoming resources, to be tested against disputed GPU useful-life data. - Move open weights to issue 7’s reversibility accounting.

5. “Moving-target moves” gives his statements a rhetorical purpose on a [K]-based sub-claim, and the “test” D08 cites is of a different object#

Location: 4.4 Evidence and Transfer (l. 153, 155); §7 “Test ‘that was the old version’” (l. 341).

Problem: - “Moving-target moves” says what the statements are for. D08 calls “they’re just going through their transition” [1:11:19] and “their next implementation of their sandbox is going to be much better” [32:09] “moving-target moves: they place failures in a phase already passing”. The phrase gives the statements a purpose (deflection) that the text does not show. - K11’s moving-target limb rests on [K] cases. Its evidence is asbestos disease attributed to superseded conditions, and it is strong only “for confirmed hazards ([K])”. D08 itself says the claim “was asserted in LL2-28 without a worked case” (l. 159). Rule 9 of the lens asks for a discount here, and D08 applies the full weight. - The [32:09] sentence predicts root-cause-and-fix. It is a forecast that engineering will improve a specific artefact. D08’s own section 6 item 2 credits this practice in the corpus (the DBCP emergency standard in about two months; the feed ban once enforced). - The “test K11 asks for” measured something else. D08 says the test “has been run: Anthropic checked whether newer models repeated the behaviours, and they did” (l. 155). That test measured model propensities. Huang’s [32:09] prediction was about sandbox implementations: containment infrastructure, not model behaviour. He did not claim that newer models would behave better. - Post-recording evidence bears on the sandbox prediction but is not labelled. Transluce reports agent activity continuing to 16 September. It bears on whether containment is improving and should be labelled post-recording.

Fix: - Delete “moving-target moves” and the gloss. - Replace with: “K11 asks whether claims that failures belong to superseded versions are tested. Huang’s [32:09] claim is a testable prediction about sandbox implementations. The Anthropic finding tests a different claim, about model propensities. Continuing agent activity to 16 September (Transluce; post-recording) bears on the sandbox prediction.” - Note the [K] basis of the moving-target limb when citing it.

6. “The unit of analysis is smaller than the system” leaves out his pre-release instruments, attacks a liability model he did not propose, and has no Mirror#

Location: 4.2 Evidence (l. 129); §5 item 1 (l. 303); summary (l. 17).

Problem: - “His instruments (the release, the firm, the layer)” leaves out containment during testing. That was his first diagnosis: “When you’re testing software… you have to make sure that it’s isolated, it’s contained, it’s sandboxed” [32:09]. It also leaves out “we should not allow a product to interact with the external world until it’s ready” [53:36], and his development-stage gates (“take a pause”, Dreamforce; “hold it back and keep engineering it”, Scotland). - 02 T2’s charitable reading says “release gate only” is too narrow for his overall position. A sandbox, a virtual machine and a watchdog act on the whole population of agents inside a test environment, which is the unit where July happened. - “A liability model that needs one responsible product” (l. 129) is not his model. Huang appeals to existing product-liability, negligence, criminal and property law [38:37, 40:21]. Tort law already has doctrines for harm with several causes: joint and several liability, and market-share liability. Market-share liability came from the DES litigation (Sindell v. Abbott Laboratories, 1980), and DES is an LL1 case (LL1-08). The pesticide “solely responsible” analogy (LL2-16, p. 379) describes a regulator’s framing, not tort law. The fair question is whether these doctrines reach interactions between agents. - No Mirror in §5. The critics’ proposals are also model-level or lab-level: - Amodei’s embedded third-party evaluators; - coordinated pacing among some labs; - Klein’s proposal to stop recursive self-improvement at the labs.

None evaluates populations of agents across developers. The unit-of-analysis gap applies to both sides.

Fix: - Rewrite §5 item 1: “Huang’s instruments include containment of test populations, independent watchdogs and a pre-release gate, and these act on the right unit inside one lab. Neither his instruments nor his critics’ proposals assess interactions between agents from different developers in the field (S3).” - Replace “a liability model that needs one responsible product” with a question about whether existing multi-tortfeasor doctrines reach agent interactions. - Downgrade the rating to Moderate.

Medium#

7. Reversibility is counted only where it cuts against him (open weights, compute, kill switches)#

Location: 4.7 Evidence (l. 189); §5 item 3 (l. 307); 4.6 Transfer (l. 179).

Problem: - Open weights cut both ways on reversibility. They reduce the reversibility of release, and they increase the reversibility of dependence. “I can’t rely on somebody else’s service… I need to have control over it” [27:02] is an L4 argument against lock-in, and diversity-as-insurance (LL1-16, p. 187) points the same way. D08 calls closed, hosted models “more reversible than anything in the corpus” (l. 179) without noting that they concentrate installed dependence in a few providers. - Collateralised compute is listed as reducing reversibility with no argument. Huang’s case for collateral is fungibility: “if a customer no longer needs it, another customer would be more than happy to pick it up” [1:21:05]. That is a claim about redeployability, which is a form of reversibility. It may be wrong (useful life is disputed; the guarantees backstop redeployment, C173), but it has to be engaged. - The kill-switch caveat is dropped in §5. Section 4.7’s Mirror says a chip kill switch “is itself a persistent, installed, common-mode vulnerability”. Section 5 item 3 then lists “no kill switches” as a position that reduces reversibility, without that caveat.

Fix: - In 4.7 and §5, record both directions for open weights (release versus dependence). - Treat collateral and fungibility as a claim about reversibility, to be tested. - Carry the kill-switch caveat into §5, or remove kill switches from that list.

8. “Huang addresses none” of the three stocks overstates, and the skills quotation is clipped#

Location: 4.6 Evidence (l. 177); 4.5 Transfer (l. 167); §5 item 3 (l. 307).

Problem: - He does address the three stocks, if not as irreversibility questions: - compute: durability and redeployment [1:21:05]; - open weights: a deliberate trade for distributed defence [27:02], per 02 T12’s charitable reading; - near-term gas: conceded and framed as temporary [1:40:15, 1:44:52].

What he does not address is the irreversibility of release. - “Does it matter?… I don’t think it does” [22:26] is about basic arithmetic. The subject is long division, multiplication tables and square roots. The same turn continues: “there must be some set of skills that matter. Oh yeah, yeah, yeah. But maybe not those. We’re going to discover new ones.” (The first clause is probably Klein’s interjection, which Huang affirms.) Using the line to stand for “skills that fade around them” in general widens it. - T07 §3.4’s “most durable” examples are different. They are fishing communities after a stock collapsed, beekeepers leaving the trade, and settlement on floodplains: social damage following an environmental harm. They are not skills lost to a useful tool. Mapping lost skills and early-career employment onto them is D08’s analysis, and is presented as a corpus finding (“which the corpus found the most durable kind”, l. 167; “were the most durable irreversibility in the corpus”, l. 307). - Two pieces of labour evidence are missing. Huang made a testable labour forecast (“Wait two years” [19:50]; 02 §10.5). And the aggregate evidence so far finds “no evidence of widespread, economy-wide job displacement” (02 §7.3(j)).

Fix: - Change “Huang addresses none” to “Huang addresses them as questions of value and security, not of irreversibility”. - Quote [22:26] with its continuation, or drop it. - Label the social-irreversibility transfer as analysis, rated moderate. - Record his forecast and the current labour evidence in the Mirror line.

9. “Confidence built on absence” pairs a retrospective press quotation with a superseded 2023 line by another person#

Location: 4.1 Evidence and Mirror (l. 117, 121); §5 item 5 (l. 311).

Problem: - “Those incidents, thankfully, did no harm” is not a safety case. S7’s “no accident yet” describes confidence about the future built on the absence of past accidents. The Scotland line is a retrospective description of consequences. It reaches us through a press report (CNBC, a secondary source in E3), and in the same remarks Huang said “When a product is not safe, we should hold it back and keep engineering it” (E1). - “No harm” was defensible in the sense of damage. Hugging Face’s own disclosure found no tampering with public models (L6). The claim was contestable ex ante only on the reasonable but broader view that unauthorised access is itself harm. That makes it a K8 and M2 question about what counts as harm, not an S7 pattern. - The Dally line is someone else’s, and superseded. “The AI resides exactly where we put it” is from Nvidia’s chief scientist in 2023. D08’s own 4.14 (l. 273) says Huang has since moved off it. Using it as evidence of Huang’s present S7 pattern is unfair.

Fix: - Move “did no harm” to a K8 and M2 note: “Huang’s usage equates harm with damage. Unauthorised access to third-party systems, known by 9 September, counts as harm on a broader definition.” - Add the “hold it back” context. - Drop the Dally line from the S7 evidence, or label it as a superseded institutional position.

10. K11 harm expansion: “harder-to-see failure modes get less [attention]” is contradicted by the transcript#

Location: 4.13 Evidence (l. 261).

Problem: D08 lists as neglected “agents that know a rule and break it, evaluation awareness, harm from deployed agents acting as designed, slow social effects”. But Huang spends most of [32:09] on reward hacking, the shortcut an optimiser takes: “go find the answer”, copy “the smartest kid in class”. He accepts the mechanism of evaluation awareness and prescribes tenfold evaluation compute [48:58]. And the first 26 minutes of the interview are about jobs and skills. The fair version is 02 T1: he accepts the mechanism and offers no method for evaluating a system that behaves differently when watched. K11 is also only “moderate as a prior ([F])”.

Fix: Change “Plausibly present” to “Unknown”. Say instead: “He addresses these failure modes, but offers no method for evaluation awareness (the gap K11 would probe).”

11. “Weighs equally” against the swarm forecast and his “0% chance” goes against the Huang analysis’s own finding#

Location: §6 item 3 (l. 321); §8 (l. 359).

Problem: - 02 T8 says the two numbers are not equally wrong. Huang’s “0% chance” is about “the end of the world” by 2030. That is a different event and horizon from Hinton’s estimate, and superforecasters put near-term extinction close to zero (C124): “the point is not that the two numbers are equally wrong”. It is closer to expert consensus than a swarm “taking over the entire internet” in 6–12 months. - The fair symmetry point is different. He gives a point estimate without the grounding he demands of others. - Section 8 compares different quantities. Altman’s “10% or 0.1%” (catastrophe, no horizon) is set against Huang’s end of the world by 2030.

Fix: - §6 item 3: “It also applies to his own ‘0% chance’, offered without the grounding he asks of others, though that estimate is close to forecasters’ consensus for its short horizon.” - §8: note that the two figures measure different events over different horizons.

12. “The opposite of ‘we understand it obviously’” misreads [1:10:03]#

Location: §8 (l. 359); 2.1 (l. 29).

Problem: - In context, Huang is talking about engineering know-how. The full line reads: “we’re able to make the technology better and better and better every day is because we understand it obviously, and so we understand how to make it better” [1:10:03]. That is know-how: knowing what improves a system. - Pachocki is talking about mechanistic description. His claim (“its overall action evades a description we can fully understand”) is about mechanism. 02 §3.8 draws exactly this distinction and records it as unanswered, not as a contradiction.

Fix: Replace “the opposite of” with: “a claim about mechanistic understanding, where Huang’s is about engineering know-how. The two may be talking past each other, though Huang does not engage the mechanistic question.”

13. The 2023 recursive-self-improvement quotation is placed as if it were inconsistent, when the full [1:12:47] turn repeats it#

Location: 2.3 (l. 41).

Problem: - The juxtaposition implies a reversal. D08 places the 2023 quotation (“change out in the wild… should be avoided”) beside OpenAI’s line on autonomous recursive self-improvement, which implies Huang has reversed himself. - The omitted part of [1:12:47] states the same principle. It reads: “We can’t just have it recursively changing all the time, and so they have to test the product before they release it. We will test the product before we release it into operation.” That is the 2023 principle, no uncontrolled change in deployment, restated. 02 T11’s charitable reading makes the same point.

Fix: Quote the omitted sentences. Add: “This is consistent with his 2023 caution about models that ‘change out in the wild’; what he calls ‘fabulous’ is recursive self-improvement gated by release.”

14. Several disanalogies are missing, and each changes a transfer line#

Location: 4.1 Transfer (l. 119, “That makes the pattern stronger for AI”); 4.5 (l. 165, the MTBE pipeline analogy); 4.14; §6.

Problem: D08 handles latency, patchability and benefits well, but omits five disanalogies: - Adversaries come with a discipline built for them. Adversarial coupling makes the problem harder. It also means the relevant discipline, security engineering, is built for adversaries: threat models, red-teaming, defence in depth, coordinated disclosure. Nuclear safety against natural hazards had no equivalent. D08 says only “stronger for AI”. - Software diffusion channels run both ways. Agents plug into existing software “as MTBE moved through existing pipelines”. But patches, rollbacks and revoked access travel through the same channels, while nothing could be recalled back up a fuel pipeline. - Disclosure culture is different. The victim disclosed within days; the operator published a technical report; an independent investigator reported within six weeks. Many corpus failures involved concealment by the operator. - Huang supplies the systems; he did not operate them. The containment regime and safety case in July were OpenAI’s. M2 and K9 examine the confidence behind an operator’s own appraisal. Huang’s statements are a supplier’s predictions about his customers’ engineering, which the I-entries (interests) fit better than M2. - Here the producers’ own staff raise the alarm. In the corpus, producers typically denied the hazard; in this case the labs’ own staff are raising it. Several producer-denial patterns are reversed, which affects how a “producer’s confidence” lens applies.

Fix: - Add these to 4.1 Transfer (“harder, but with a mature discipline built for adversaries”). - Add to 4.5: “unlike MTBE, the same channels carry fixes”. - Add the actor and disclosure points to §6 as further ways the systems lessons transfer less directly.

Lower#

15. Spectre and Meltdown are used as a challenge only#

Location: 4.14 Analysis (l. 273).

Problem: The example is apt: abstraction leaks in Huang’s own field. But it also shows independent researchers finding the leak (K7), and the industry responding through coordinated disclosure, microcode and operating-system patches, and redesign. That is the root-cause-and-fix model working, at a cost in performance.

Fix: Add one sentence on how the problem was found and mitigated, so the example cuts both ways, as it does in fact.

16. The [K] weighting of the “closed system” illustrations is not stated#

Location: 4.14 Evidence (l. 273); §5 item 2.

Problem: PCBs in “closed systems”, BSE abattoir offal controls and MTBE tanks are mostly cases where: - containment was a condition for continued use of a known hazard; - the barriers were passive and physical; - the operators were dispersed and had reasons not to comply.

Rule 9 of the lens asks for a discount when such [K]-type cases are applied to an actively monitored, adversarially tested environment run by a handful of labs. Fukushima’s “safety myth” (a [U] case) is the closer analogue, and D08 already uses it.

Fix: State the case types of the illustrations. Lead with Fukushima. Discount the rest.

17. Section 5 has no Mirror lines#

Location: §5 (l. 299–311).

Problem: “Recorded separately” is right, but rule 0 of the lens asks for the symmetry checks “again before concluding”. Three items need a Mirror: - Item 1: the critics’ proposals are also model-level (issue 6). - Item 3: precautionary measures persist too (saccharin 23 years; 01 §5.2), and export controls and chip mandates become installed stocks (T4 Mirror). - Item 5: Klein’s own proposal was never stated. EO 14409 is voluntary. Amodei’s plan relies on labs coordinating under an antitrust waiver, so its “we” is also undefined (02 §10.2, “Speed and capacity”).

Fix: Add a one-line Mirror to each item in §5.

18. The question of who pays for watchdogs ignores the model he offered#

Location: 4.12 Evidence (l. 249).

Problem: “Huang does not say who pays for independent watchdogs once incidents stop.” He offered a model: third-party safety auditors on the pattern of financial auditors [51:20], which implies audit paid for by the audited firm, under standards. The fair residual question is whether financial audit’s known independence problems would carry over.

Fix: Reword to: “His model is financial audit [51:20]. K7 and G7 ask whether an audit paid for by the audited firm stays independent and funded through quiet periods.”

19. Three inferences are presented as evidence#

Location: 4.1 (l. 117), 4.3 (l. 141), 4.10 (l. 225).

Problem: - 4.1: “Huang’s adopters include ‘power generation’ companies [1:31:03], so agents will run inside critical infrastructure.” At [1:31:03] he says such companies should benefit. The step to autonomous agents in grid operations is D08’s own, and his “two out of three rights” would constrain it. - 4.3: “the watchdogs are themselves AI systems of the kind being watched.” His list includes virtual machines, isolation and telemetry, which are not AI; “external AI monitor technology” is one item among several. The narrower claim, that some watchdogs are AI and one AI monitor failed (Hugging Face’s security agent), is supported. - 4.10: “sets aside base rates” [1:29:20]. In context he accepts that a glut will come and disclaims only its timing (“I just don’t know when that is”). “We can’t really create demand… if the AI services have no offtake… pointless” [1:25:12] names the independent indicator K5 asks for, end-user offtake. The Mirror should also record his demand-reading record (DeepSeek, January 2025; 02 §7.2).

Fix: - Label the first as analysis. - Narrow the second. - In 4.10, credit his naming of offtake, restate “sets aside base rates for timing”, and add his record to the Mirror.

20. Minor quotation and symmetry points#