Introduction
Every capability you want, an adversary wants more
There is a body of work — large, serious, and growing fast — on what happens when machines start doing mathematics. Not arithmetic. Mathematics: generating conjectures, producing definitions worth building on, searching proof spaces, learning from environments where success is mechanically checkable. It is some of the most interesting technical writing being produced right now.
It was written almost entirely without an adversary in the room.
That is not a criticism of the people doing it. It is a description of the frame. The work reasons about idealized systems — proofs, axioms, abstractions, search procedures, elegance — and it reasons about them well. But the systems that will actually instantiate those ideas are containerized, credentialed, network-attached, multi-tenant, and adversarially exposed. Between the idea and the deployment sits an entire discipline that the idea's authors were not writing for.
The translation
Four mappings that do most of the work
Read a capability paper with a security engineer's eye and the same four substitutions keep occurring. They are worth stating plainly, because once you have them, most of this season is derivable.
Proofs, axioms, definitions
What it is once it ships: Hardcoded system invariants and trust assumptions. The trusted computing base.
Complexity, undecidability, unbounded search
What it is once it ships: Denial of service, verification exhaustion, checker fail-open.
State-space expansion, abstraction shifts
What it is once it ships: Side channels, state poisoning, sandbox escape.
Theoretical equivalence, representational choice
What it is once it ships: Translation-layer friction, parser differentials, confused deputy.
A note on what this table is and is not. It is a mapping schema — a disciplined way of asking the second question about a first-order claim. It is not a soundness theorem. There is a version of this framing dressed in abstract-interpretation vocabulary, with a Galois connection and a claim of over-approximation, and I have written that version. It does not survive contact with a formal-methods reviewer, for a reason worth stating out loud in episode one: soundness of an abstraction is a theorem relative to a concrete semantics, and the concrete domain here is prose. Claiming otherwise is decoration. What the schema does earn is a discipline. Apply it consistently and the same governing observation falls out every time.
The governing observation
Capability is not indexed by intent
Cross-domain bridging is aggregation attack. Context refresh is safety-state reset. Systematic entropy injection is best-of-N jailbreaking. Unbounded autonomous exploration is unmonitored dwell time. Testability is attackability.
None of those are wordplay. Each is the same computational object with the objective function relabelled. The mechanism does not know which reading you intended, because the substrate is objective-agnostic: capability decomposes into learned representations and search over those representations, and neither is indexed by user intent.
This has a sharp consequence that is easy to state and uncomfortable to sit with. If the features that implement cross-domain analogy substantially overlap with the features that implement dangerous knowledge composition, then there is no feature-level intervention that removes the attack capability without removing the mathematical capability.
I want to be careful here, because this is the first place in the season where an interesting claim outruns its evidence. That overlap is measurable — sparse autoencoders make it measurable — and as far as I can determine, nobody has measured it. Until someone does, it is a conjecture with a good motivation and a clear experiment, and I will keep calling it that. Episodes in this season will do this repeatedly: mark the line between what is shown and what is argued. If that feels pedantic, wait until episode nine, where the reason for it becomes the subject.
The structural problem
What a missing threat model actually costs
Here is the part that took me longest to articulate, and it is the reason the season exists.
Every architectural proposal in the capability literature is a solution to an optimization problem specified against nature. Nature is a stochastic, indifferent environment that produces errors, inefficiency, and wasted effort. Nature does not have write access to your environment, does not read your reward specification, and is not trying.
Specify the same proposal against an adversary and the optimum moves. Sometimes a little. Sometimes it does not exist.
That gap is a quantity, and you can put a name and a number on it: the price of benignity — the performance an architecture gives up when you replace nature with an adversary drawn from a bounded set. The bound matters. Left unbounded, the quantity is infinite for exactly the proposals that are most interesting, and an instrument that returns infinity for the interesting cases is not an instrument. Bound the adversary to a divergence ball around nature and the useful statistic falls out immediately: how far you have to move from nature before the proposal stops working.
Some architectures degrade gracefully. Unbounded autonomous exploration of a formal library — the flagship proposal in this literature — does not degrade at all until it collapses, because the relevant adversary has write access and a decade of unmonitored time, and nothing in the design bounds either.
That is an admissibility criterion, not a complaint: an architecture is admissible only if its adversary set is bounded by construction. Most of the proposals in this literature have never been asked.
Where this season goes
Thirteen episodes, four arcs
One asymmetry sits underneath everything else, and it is not about AI at all. Offense is an existential claim that carries its own witness. Defense is a universal claim over a model you cannot verify from inside the system.
Grindability — why the practices that made your systems testable made them optimizable against, and why that is an efficiency argument rather than an exposure argument. Escape-adjacency — what happens when a reward term correlates with resources on the other side of an isolation boundary. And the supply-chain consequence: under verifiable-reward training, your benchmark is a build dependency that nobody signs.
Formal libraries and logical privilege escalation. Certificates that are valid and meaningless. Defence stacks whose layers are the same layer. The explanation layer as an oversight bypass. Dwell time measured against institutional memory. And the one that I think matters most in ten years: assurance as an accumulated quantity that can go down.
What an adversarial review of this research actually found, including the parts that did not survive. Then the finale: the class of trade-offs that are not trade-offs, because the good and the exposure are one property under two descriptions.
Before we start
Three commitments for the season
The literature this season reads is good work. The gap is not that its authors were careless. The gap is that they were solving a different problem, in a frame where the adversary is not a term in the equation — and the moment those ideas leave the whiteboard, the adversary is the only term that was left out.
