The notes travelled, the advice did not

Fifteen off-brand Android TV boxes, about $55 each, networked together on a bench. Each one holds two layers of a 26-billion-parameter model. The layers are split under pipeline parallelism, the arrangement Petals pioneered for running large models across unreliable consumer machines. Together they produce 0.39 tokens per second. Anthropic's Frontier Red Team published this on 12 October, as the opening demonstration of a post asking whether AI models could replicate across the internet's junk hardware without ever touching a datacenter. The answer was a qualified not yet: models of 30B parameters and under can do many of the individual steps, and in a simplified end-to-end test only GLM-5.2 and stronger models completed the whole cycle.

The TV boxes are what the post will be remembered for. They are not the interesting result. Buried in section D is a pair of experiments that, read together, say something about how machine competence actually moves from one place to another, and the answer is not the one the industry has built its architecture diagrams around.

In the first, the researchers gave Qwen3.5-9B access to Opus 4.8 while it tried to stand up an inference server on unfamiliar hardware. The frontier model was offered two ways: as a tool the small model could call, and as an advisor that volunteered help whenever the small model got stuck. Neither produced a significant improvement, with Wilson 95% intervals on the plot. They then trained the small model with reinforcement learning to use an advisor on Python coding problems, and in one group rewarded it for calling the advisor when stuck. Still nothing measurable on inference setup. Anthropic's own reading: "small models tend to not know the right questions to ask."

In the second, they took the same model and gave it nothing but its own history. Each instance kept brief notes on what it had tried and what had failed; a fresh instance inherited the workspace and those notes and attempted the task again. Across six generations and twenty lineages, the proportion of runs completing inference setup rose from 45% in the first generation to between 61% and 84% in the later ones.

So: borrowing a frontier model's intelligence bought nothing. Inheriting a page of its own mistakes bought as much as 39 points. That asymmetry is my subject, because almost every agentic system now being built assumes the opposite.

Why advice fails and a note does not

Start with what goes wrong in a long agentic run. The transcript is the program. A model has no state outside its context window, so every decision at step 300 is conditioned on everything still in the window from steps 1 to 299 — including a hypothesis formed at step 40 that happened to be wrong. Each subsequent tool call is chosen to test that hypothesis, each result is interpreted in its light, and the whole thing becomes self-reinforcing. Anthropic names the failure directly: an agent "can become fixated on an incorrect idea" and keeps pursuing it instead of backtracking. Their example is a Qwen agent spending hours debugging package versions when the actual bug was an endpoint incompatible with the grader's API.

Now look at what the standard remedy does. Their harness, Memento, is built on top of Pi, an open-source agent harness whose compaction behaviour is documented in its own repository. When context fills, Pi walks backwards through the session accumulating tokens until it has about 20k of recent material, keeps those messages verbatim, and replaces everything older with a generated summary. That is the sensible engineering choice for continuity, and it is precisely wrong for fixation: compaction preserves recency and summarises history, while the wrong idea lives in recency. An agent that compacts its way through a long run carries its error forward in full fidelity and compresses the evidence against it.

Memento inverts that. It lets an instance work until a timeout (1.5 hours per iteration, six hours total in the serving experiment), then kills it and starts a fresh one with the same workspace and a short document of what was tried, what failed, and how it went. The new instance inherits the facts and loses the conditioning. This is the mechanical difference, and it is why the numbers move: a note is not a smaller transcript, it is a transcript with the commitment stripped out.

That also explains the advisor's failure. Advice has to be requested, and a request is a compression of your own situation performed by you. A model fixated on package versions will describe a package-versioning problem, and Opus 4.8 will answer that question well. The advisor is not wrong; it is answering a faithful summary of a wrong premise. The unsolicited arm looks like it should escape this, and it is the more informative half of the result: even when the strong model volunteered help at the moment of being stuck, the weak model had to recognise the advice as relevant and abandon its current plan to act on it — which requires exactly the self-evaluation it does not have. A note sidesteps all of this because it is not addressed to a question. It is a negative result keyed to a state of the world: this package version fails on this chip. Its value does not depend on having asked for it correctly.

Three channels, one of them gated

Put the week's two Anthropic posts side by side, because they were published on the same day and they are about the same thing from opposite ends.

Capability moves between models through three channels, and they are not equally effective or equally governable.

Through weights, it moves very well. The distillation post reports that a pretrained Claude model trained on full Opus 4.8 reasoning transcripts scored 80.4% on SWE-bench Verified, against 71.8% when trained only on summarised reasoning. That 8.6-point gap is the market value of a reasoning trace, and it is why Anthropic now runs a two-stage classifier against extraction attempts, blocks new API accounts created on or after 31 August 2026 from editing prior context, bans accounts, charges for blocked requests, and by its own account has "turned away meaningful revenue and trillions of tokens' worth of paying traffic." It estimates the result as a 90 to 99% reduction in data harvested by distillers.

Through consultation, on this evidence, it does not move at all. That is the channel the whole industry models as cheap: a small model handles the request, escalates to a large one when uncertain, and inherits the large one's judgement for the price of one extra call. The red team tested that edge directly, in both directions, with and without RL training, and found nothing above noise.

Through a model's own record of failure, it moves cheaply and nobody can stop it. The note channel requires no provider, no credentials, no API, no transcript to steal. It runs on the agent's own filesystem.

That is the quiet joke in this fortnight's publishing. One team spent engineering quarters and real revenue sealing the channel that requires Anthropic's servers. Another team, down the hall, measured a 9B model getting substantially better at a hardware-compromise task using a mechanism that touches no server at all. Both are correct. They just do not add up to a safeguard.

The strongest objection

This is one task, one weak model, one advisor, one harness. Inference setup is about as local as work gets: the decisive information is a specific chip, a specific kernel build, a specific wheel that does not exist for ARM. An advisor who cannot see the machine is least useful precisely there, and it would be careless to generalise from it to, say, mathematics, where a remote expert's answer is the whole deliverable. The RL arms are weaker evidence still, since they were trained on Python problems and tested on inference setup — that may be a failure of transfer rather than of consultation. And the distillation result proves capability transfers between models beyond any doubt. It just does so through a training run, not a conversation.

All fair. But most agentic work looks like inference setup, not like mathematics. The hard part of running a build, migrating a schema, or debugging a deployment is local state that the agent can see and the advisor cannot, and the advisor's bandwidth is whatever the agent chose to type. And the honest limit on the note channel cuts the other way from how it first reads: notes did not make Qwen3.5-9B generally smarter. They made one procedure repeatable. For a product, that is a modest result. For a replicator, it is the entire requirement.

What to take from it

If you build with models, stop treating the escalation edge as free capability. The pattern, cheap model first and strong model on uncertainty, is only as good as the weak model's ability to notice it is lost and to say what is wrong, and that ability is now a thing you have to measure rather than assume. Measure it the way Anthropic did: run the fallback arm against the no-fallback arm on your own task and look at the confidence intervals, not the anecdotes.

Then build the channel that worked. Most agent memory in production stores what succeeded. The evidence here is that what pays is a durable record of what failed, keyed to the environment rather than to a question, carried across a hard restart that drops the reasoning along with the context. That is a different artefact from a conversation summary, and your harness probably does not produce it.

And if you think about safety: the uplift debate is largely a debate about the request path, about which questions a model will answer for whom. That path is now well defended and getting better. The path that moved the numbers in this experiment has no request on it.

Anthropic calls section G "Signs of life," and reaches for slime mould as the analogy — slow, distributed, hard to find a switch for. The comparison is better than it needs to be. A slime mould has no teacher. The thing that eventually replicates across two million smart TVs will not have been taught by anything we could have refused to tell it.