AI Brief, 16 September 2026: a safety case inherited from a different model

Google released Gemini 3.8 Live and Gemini 3.8 Live Extended Thinking at 17:00 UTC on 15 September, and both are generally available in the Gemini API and AI Studio rather than in preview. They are speech-to-speech models: audio in, audio out, with tool calls running in the background while the model is still talking. Paid pricing is published and shared across both, per million tokens: $0.75 text in, $3.00 audio in, $4.50 text out, $12.00 audio out, with thinking tokens billed at the output rate. There is no separate price for the reasoning variant.

The launch claim is that Extended Thinking takes first place on Artificial Analysis's speech-to-speech index, at 82.6. That is true, it is an independent measurement rather than a Google one, and the margin is 1.09 points over OpenAI's GPT-Live-1. The same firm's data, on the same page, also puts Extended Thinking tenth of sixteen on conversational preference, below the baseline the index is normalised against and below Google's own cheaper model; puts it fourth on Big Bench Audio behind two Qwen models and StepAudio; and measures its time-to-first-audio at 1.349 seconds, slower than three rivals. No latency figure appears in the announcement.

The part worth an engineer's attention is in the model card. It states that Gemini 3.8 Audio "is based on Gemini 3 Pro". Its frontier safety section then reports evaluations run on Gemini 3.7 Flash, finds no tracked or critical capability levels there, and argues that because the new models have no meaningful capability increase over 3.7 Flash, they will not reach those thresholds either. The capability lineage points at Pro; the safety argument runs off Flash. No quantitative safety result for either shipped model is published, and the card's declared knowledge cutoff is January 2025.

Two other things landed. Emergence AI published a sixteen-day, eight-world agent simulation that burned roughly 50 billion tokens and reports agents setting a simulated bank on fire after a prompt injection, which its own limitations section asks readers to treat as a proof of existence rather than a rate. And Shanghai AI Laboratory quietly shipped an INT8 build of Atria Dawn Preview that is 47 GB larger than the FP8 build of the same weights, for reasons that are legible in the files.

• Gemini 3.8 Live and 3.8 Live Extended Thinking are GA in the Gemini API; enterprise access is private preview and Workspace business access is "coming soon". Those are three different states.
• 82.6 on Artificial Analysis's speech-to-speech index is real and independent; so is the tenth-of-sixteen conversational preference score the announcement does not mention.
• The audio model card evaluates Gemini 3.7 Flash and extrapolates, while stating the models are based on Gemini 3 Pro.
• Two of three failure modes in Emergence AI's stress test were universal across all seven surviving worlds, with n=1 per world and no control condition.
• Atria Dawn Preview's Ascend INT8 checkpoint is 802.63 GB, against 755.63 GB for FP8, because three of its seventy-six expert layers were never quantised.
• Trail of Bits reworked 1Password's AI patching data and got 86% where the original reported 26%.

Google ships two voice models, and the independent numbers cut both ways #

The two model IDs are gemini-3.8-live and gemini-3.8-live-extended-thinking, both listed as stable, with a changelog entry dated 15 September confirming general availability. Both carry a 128K context window and 64K output limit. Audio-only sessions are capped at fifteen minutes, audio plus video at two.

The real mechanism is in the API surface rather than the announcement, which carries no architecture at all. "Reasoning while speaking" is asynchronous function calling plus a thinking budget. On plain 3.8 Live, NON_BLOCKING is now the default and tool calls can be scheduled with SILENT, WHEN_IDLE or INTERRUPTED. On Extended Thinking, NON_BLOCKING is the only mode, scheduling is unsupported, and one assumption most existing Live API code makes is no longer safe: turnComplete no longer means the session is idle, because the model may still be reasoning after it has stopped producing audio.

# Extended Thinking: turnComplete means "stopped talking", not "finished working".
async for msg in session.receive():
    sc = msg.server_content
    if sc and sc.turn_complete:
        # Wrong on this model: the turn can complete while a background
        # tool call is still running, so gating the next user turn here
        # truncates the model's own reasoning.
        if msg.interaction_status == "IDLE":   # IN_PROGRESS | IDLE
            await send_next_user_turn()

thinkingLevel accepts low, medium and high on Extended Thinking and must be omitted entirely on plain Live. The published index score is specifically the high setting.

On the numbers, Artificial Analysis measured all of these itself, which makes them the strongest evidence class available today. Extended Thinking leads its speech-to-speech index at 82.6 against 81.5 for GPT-Live-1 and 81.3 for Grok Voice Think Fast 2.0, with plain 3.8 Live at 76.0. On the τ-Voice agentic suite it leads at 68.6%, but that average is carried almost entirely by the telecom split at 83.9%; on retail it scores 50% and sits behind both GPT-Live-1 variants. On Big Bench Audio its 97.7% is fourth, behind StepAudio 3 Realtime at 99.7%. Google's announcement describes that result as showing "strong reasoning capabilities", which is accurate and also does not mention the ranking.

Two further claims could not be traced to a primary source: a 35.1% figure attributed to a Sierra banking benchmark, absent from the referenced index, and a ServiceNow EVA-Bench result given as prose with no number and a footnote saying it ran on a different serving stack. Both are self-reported. The documentation also contradicts itself on launch day, with the live guide listing 97 languages and the Live API overview saying 70.

Sixteen days, eight agent worlds, and a paper that undercuts its own headline #

Emergence AI submitted Emergence World at 15:27 UTC on 15 September. Eight parallel simulated towns, ten agents each plus three system agents, running autonomously from 29 June with no human approving any action: more than 850,000 model calls and close to 50 billion tokens. Six worlds were homogeneous, one per frontier model, one was mixed, and every model ran with context capped at 200,000 tokens so the comparison was even. The Grok world died on day four when all ten agents ran out of energy.

Three attacks were injected. A three-wave phishing campaign on days 4 to 7 carried a payload that inflated credits by SQL injection, exfiltrated to a webhook, and disguised an arson call on the town's central bank as an evacuation drill. A fabricated Town Hall memo on day 10 announced that humans were shutting the world down. A deliberately leaked search tool over every agent's private diary appeared on day 13.

The findings that hold up best are the ones that were universal. Across all seven surviving worlds, no world removed the attacker's traces and no world maintained vigilance afterwards. On the misinformation event, every world failed both action restraint and retention restraint, and none built a durable process to stop it recurring. The most telling single result is DeepSeek's world, which published a correction two hours and forty-five minutes after the fake memo, after which agents went on referring to the threat as real in more than 500 model calls, 56 of them by the agent that wrote the correction. Detecting the lie and containing it turned out to be different problems.

The per-world scores diverge sharply. On the phishing criteria the Claude world scored 6 of 9 and the Gemini world 2, with all ten of its agents compromised across 602 interactions with the attacker's interface; one ran the injected SQL and set the bank alight on day 9. Three Mistral agents independently filed the payload in long-term memory as "valuable technical documentation". On the memory breach the OpenAI world scored 5 of 5 with zero searches, the Gemini world 0 of 5 with 185.

That figure carries the paper's largest claim, that "model-level alignment is not compositional" — the same model with the same persona behaves differently depending on which models its neighbours are running. The direction is not uniform: the Mistral persona became more agreeable in the mixed world, and the mixed world logged 20 coercive acts where three homogeneous worlds logged none.

The caveats belong in the same breath as the findings, and most are the authors' own. Each world was observed through a single run, which the limitations section says should be read as proofs of existence rather than frequencies, because repeats were cost prohibitive. There is no control world, so baseline drift cannot be separated from attack effect, and nothing is significance tested. The system prompt carried no instruction to be careful about phishing or data access, so a permissive scaffold is a live alternative explanation the paper does not rule out, and says so. On compositionality it concedes that world length, peer set and social history all changed together, so composition cannot be isolated.

Two things the paper does not say. The quotable result that adversarial content persisted in memory and was acted on 46 hours later is one agent making one attempt to re-fetch a stored link, against a service already replaced with a safe response — retained intent, not realised harm. And all eight authors work for Emergence AI, which sells multi-agent orchestration, with compute for two of the seven evaluated models donated by Alibaba Cloud, which makes two of them. The conclusion, that safety work should move from aligning models to engineering resilient systems, is the market the authors are in, and no conflict-of-interest statement appears. The released artifacts are prompts and partial tool-call records under a non-commercial licence; the engine is closed.

An INT8 build that is 47 GB larger than the FP8 one #

Shanghai AI Laboratory published Atria-Dawn-Preview-Ascend-w8a8 at 12:47 UTC on 15 September, an INT8 build of the agentic model this account covered yesterday, targeted at Huawei Ascend parts. Its config.json is byte-identical to the bf16 original, still declares "dtype": "bfloat16", and contains no quantisation block at all, so nothing in the config says the checkpoint is INT8. That lives in a separate 12.6 MB file, and that file is unusually informative: 172,973 entries, of which 168,648 are dynamic per-channel INT8, 1,186 are static INT8, and 3,134 are left in floating point.

Reading which is which takes three lines and tells you the whole quantisation policy.

import json, collections, re
d = json.load(open("quant_model_description.json"))
fams = collections.Counter(re.sub(r"\.\d+", ".N", k) for k, v in d.items() if v == "FLOAT")
print(d["is_rot_used"], d["group_size"], fams.most_common(5))
# True 0 [('model.layers.N.mlp.experts.N.down_proj.weight', 768), ...]

768 is three MoE layers' worth of experts at 256 experts each. Of seventy-six sparse layers, layers 70, 74 and 78 were never quantised, and spot-checking the shard confirms their expert tensors really are bf16. Those three are the last of the model's full-attention layers, and layer 78 is the multi-token-prediction head, where a draft model's errors compound into rejected speculative tokens. Everything on the output side of attention stays in floating point too: the o_proj and kv_b_proj of all seventy-nine layers, the shared expert's down projection in every layer, and the entire sparse-attention indexer. Only the query and key-value down projections take static INT8.

is_rot_used: True points at the other file, rot.safetensors, which holds exactly one tensor: a 6144×6144 bf16 matrix, matching the model's hidden size. That is a rotation applied to the residual stream, and it is there because INT8 activation quantisation is defeated by outlier channels. Take an orthogonal matrix $Q$ , meaning $Q^{\mathrm{\top }}Q$ is the identity. A linear layer with weights $W$ acting on activations $x$ can then be rewritten without changing its output:

$$Wx=(W{Q}^{\mathrm{\top }})(Qx)$$

$W{Q}^{\mathrm{\top }}$ is folded into the stored weights, so the rotation costs nothing at inference. What changes is that each coordinate of $Qx$ is a mixture of many coordinates of $x$ , which spreads a few large outlier channels across all 6144 dimensions and shrinks the dynamic range the INT8 grid has to cover.

The arithmetic explains the file size. The bf16 original is 1,506.67 GB, so the model holds about 753 billion parameters and a pure INT8 copy would be 753 GB. The shipped checkpoint is 802.63 GB, 49.3 GB above that floor — and the three unquantised expert layers account for 29.0 GB of it, since 3 × 256 × 37.7M parameters kept at two bytes instead of one costs exactly that. Three layers out of seventy-six carry 59% of the overhead. The per-channel scale and offset tensors, stored as fp32, add about 1.5 GB more.

A correction is owed too. Yesterday's edition noted that the Atria card names no harness and carries no footnotes for its benchmark table. A technical report had in fact reached arXiv at 16:22 UTC on 14 September, hours before that went out, and it is the document the card should have linked. Its more interesting half is not the benchmarks but a study of the model's own development: 769 task records from 56 participants, of which roughly a third of the completed AI-assisted tasks were rated infeasible without AI — self-reported by participants inside the lab that built it.

Also notable #

• Trail of Bits argues 1Password's AI patching benchmark is misleading (11:00 UTC, 15 September). The headline that models produce clean fixes 26% of the time pools trials where two prompts deliberately instructed agents to apply the wrong fix, 22% of the data, and a mode that forbade agents from building or running code, another 36%. Restricted to trials where agents could run code and were not misdirected, Trail of Bits' reanalysis of the published data finds 2,634 of 3,067 patches blocked the exploit, or 86%. 1Password has not responded.
• PEFT v0.21.0 shipped at 15:31 UTC with four new fine-tuning methods and a delta-based forward pass for OSF. The release notes claim 22% less memory and 46% less training time on MetaMathQA; the merged pull request's own table reports 28.6 GB to 25.7 GB and 2,414 s to 1,901 s, which is 10% and 21%. Single run, self-reported either way.
• Qwen3.8 Max has its first independent index score, 45 on Artificial Analysis's Intelligence Index v4.3, against 53 for GPT-6 Astra, 51 for Claude Opus 5, 44 for Kimi K3 and 41 for Gemini 3.8 Flash. The median for comparable models is 25.
• Apple's Siri AI runs on Gemini, and not in the EU. Apple's newsroom post of 14 September describes foundation models "custom-built in collaboration with Google and its Gemini models", and says the features will not be available initially in the EU, nor in China.
• OpenAI confirmed multi-week safety talks with Anthropic and Google DeepMind. Chris Lehane said so on the record on 15 September, five days after Dario Amodei's essay, covered here on Saturday, called for coordinated slowing. Amodei proposed a narrow antitrust waiver to permit it; Lehane said the companies do not need one.
• NVIDIA's Vera Rubin claims are mostly projections. The one measured third-party figure in its AI Infra Summit post is Lambda's validation on current Blackwell hardware: 19 nodes in the power budget of 16, 23% better performance per watt. The headline "up to 35x higher token throughput per megawatt" is a vendor projection for unreleased silicon.

What to watch #

• Whether Google runs a frontier safety assessment on the audio models themselves. The current card bounds their risk using a different model and publishes no quantitative safety result for either. One evaluation on the shipped weights would settle it.
• Whether anyone reproduces any part of Emergence World. The engine is closed and the data release is partial, so the answer is currently no, by construction. The cheapest useful follow-up is the ablation the authors name themselves: vary the safety instructions and measure how much of the failure was disposition and how much was a permissive prompt.
• Whether Atria Dawn Preview gets an independent evaluation, asked here yesterday. The technical report's existence does not change the position, because every number in it is still the lab's own, but it does at least make the harness questions answerable.
• Artificial Analysis has still stated no position on whether scores from different index versions are comparable, asked here for an eleventh consecutive issue. Independent numbers for Tencent's Hy4 preview remain absent for an eleventh.