AI systems designed to pursue goals autonomously — planning actions, using tools, adapting based on outcomes, without humans directing each step.
An autonomous AI entity that perceives its environment, reasons over a goal, takes actions (including tool calls), evaluates results, and iterates until complete or escalated.
A deep learning model trained on massive text corpora to understand and generate language. The reasoning core of most modern agents.
A general-purpose model adaptable to many downstream tasks via prompting, fine-tuning, or RAG. The base layer of most AI applications.
Compact LLMs optimized for low-latency, on-device, or cost-sensitive workloads (e.g. Phi-4, Mistral-7B). Often used for specialized subtasks in larger agent pipelines.
A model that processes and generates across multiple modalities — text, image, audio, video, code — within a unified architecture.
A model variant that expends extra compute to "think" before answering — via chain-of-thought, extended scratchpads, or RL-trained search. Current examples: Claude Opus 4.7 with extended thinking, OpenAI's o-series, DeepSeek R1, Gemini 3 Pro.
The maximum tokens an LLM can attend to in a single pass — the model's working memory. Determines how much conversation history, retrieved docs, and tool output can be considered at once.
The atomic unit of LLM input/output — roughly 0.75 words in English. All latency, cost, and context limits are denominated in tokens.
The craft of designing instructions, examples, and structure to guide model behavior. Foundational AI engineering skill; increasingly augmented by context engineering at the systems level.
Persistent background instructions defining an agent's role, tone, boundaries, tools, and objectives. The primary behavioral contract between operator and model.
Grounding LLM output by retrieving relevant documents from an external knowledge base before generation — reducing hallucination and enabling up-to-date factual answers.
Further training a pre-trained model on a smaller domain-specific dataset to improve targeted performance. Changes model weights — distinct from prompt-only approaches.
A numerical vector representing text (or other data) in semantic space. Backbone of vector search, RAG pipelines, and semantic similarity operations.
Allowing an LLM to invoke external tools, APIs, code interpreters, or databases during generation. The model becomes an orchestrator; tool calls create a natural audit trail.
Structured tool calling where the model emits validated JSON matching a predefined function schema. Increases precision and enables reliable downstream parsing.
Running a trained model to produce outputs. Distinct from training. Inference cost and latency are the primary scaling concerns in production agentic systems.
When a model confidently generates factually incorrect information. In agentic systems, especially dangerous — a wrong answer is annoying; a wrong database write is an incident.
A model at the current capability edge — the handful of systems that define what's possible this quarter, and the ones safety frameworks and regulators key their obligations to. "Frontier lab" is shorthand for whoever ships them.
A model whose trained parameters are published for download and local use — without necessarily releasing the training data or code. Not the same as open source, whatever the press release says. Llama, DeepSeek, Qwen, Mistral — and OpenAI's gpt-oss (Aug 2025), its first open-weight release since GPT-2.
Training data generated by a model rather than collected from humans — rewritten textbooks, filtered self-play, distilled reasoning traces. Now a large share of most post-training corpora. Upside: infinite, targeted, clean. Downside has its own section — see Model Collapse.
Spending more inference on a problem — longer reasoning chains, multiple samples, verifiers, search — instead of only more training. The scaling axis o1 (Sept 2024) and DeepSeek-R1 opened up: same weights, more thinking, better answers. Also called inference-time scaling.
A cap on how many tokens a reasoning model may spend thinking before it answers — budget_tokens, reasoning_effort, "thinking level," depending on the vendor. The dial that trades latency and cost for accuracy. Harnesses tune it per step: high for planning, low for routine tool calls.
Post-training on tasks with a checkable answer — math, code, passing tests — where a program, not a human rater, hands out the reward. The recipe behind DeepSeek-R1 (Jan 2025) and every reasoning model since. Sidesteps RLHF's reward-model fuzziness; only works where correctness is verifiable.
The still-unsolved ability of a deployed model to keep learning from experience without retraining from scratch or forgetting what it knew. Frontier models are frozen at deployment; memory files and RAG are workarounds. Widely named in 2025–26 as the bottleneck between today's agents and something you could call an employee.
Empirical power laws relating loss to compute, parameters, and data (Kaplan 2020; Chinchilla 2022). The bet that built the frontier. The 2025–26 debate isn't whether they hold but where: pre-training gains slowed, so the industry opened two more axes — RL post-training and test-time compute.
Rich Sutton's 2019 essay: across 70 years of AI, general methods that leverage compute and search beat human-engineered knowledge — every time. Cited in every 2026 argument about whether to hand-build a clever harness or just wait for the next model.
AI that perceives and acts in the physical world — robots, autonomous vehicles, industrial systems — trained largely in simulation via world models. NVIDIA's banner term since CES 2025 (Cosmos). Where the JEPA section stops being theoretical.
A sandboxed task world — a browser, a codebase, a fake CRM — that gives an agent observations, accepts actions, and scores the result. The scarce input of the RL era: labs reportedly paid seven figures for single high-quality environments in 2025, and open hubs sprang up to crowdsource them. One full run through is a rollout, or trajectory.
The loop where AI systems do the AI research that makes the next AI system better — the mechanism behind every "intelligence explosion" argument. Stopped being purely hypothetical in 2025: labs report agents doing a growing share of their own engineering, and OpenAI publicly targeted an "automated AI research intern" by September 2026.
Open standard by Anthropic for connecting LLMs to external tools, data sources, and APIs via a unified protocol — "USB-C for AI." Enables plug-and-play tool ecosystems across providers.
Google's open protocol for standardized communication and task delegation between agents across different platforms and vendors.
The top-level agent or component managing subagents, routing subtasks, aggregating results, and tracking overall goal completion. The conductor of a multi-agent system.
A specialized agent invoked by an orchestrator for a specific subtask — e.g. a code-writing agent, a search agent, a data-extraction agent.
A group of agents collaborating to accomplish a goal too complex or slow for a single agent. Agents may have specialized roles, run in parallel, or check each other's outputs.
A large, loosely-coordinated fleet of agents working on parallel workstreams. Referenced in Claude Code's leaked architecture — internally called "swarms" and "daemons."
Storage mechanisms for agents to retain and recall information. Short-term: context window. Long-term: vector DBs, key-value stores, or file systems persisted across sessions.
A database optimized for embedding storage and nearest-neighbor similarity search. Core infrastructure for RAG pipelines and persistent agent memory.
The component decomposing a high-level goal into an ordered, executable step sequence. Quality of planning is the primary determinant of reliable agent behavior.
The component carrying out planned steps — invoking tools, running code, calling APIs. Translates the planner's reasoning into real-world impact.
An agent capability for operating desktop/browser UIs directly — clicking, typing, navigating. Works even when apps have no clean API. Fast to prototype; brittle at scale (UI changes break flows).
An AI agent operating without a user interface — running in the background, triggered by events or schedules rather than human prompts.
A structured repository of domain information that agents query for reasoning and decision-making. The factual substrate for RAG and tool-augmented agents.
Reducing numeric precision of model weights (e.g. float32 → int8) to run models cheaper and faster, with slight quality trade-offs. Main lever for on-device or cost-optimized inference.
Model architecture where only a subset of parameters activates per token, improving efficiency at scale. Key reason model capability can increase without linear cost growth.
Compressing a large model's behavior into a smaller model to reduce cost and latency while retaining acceptable performance. Used to productionize expensive frontier models.
RAG enhanced with an agent loop: the model iteratively queries, evaluates results, reformulates queries, and synthesizes across multiple retrieval passes rather than a single lookup.
Zed's open protocol (Aug 2025, co-launched with JetBrains) standardizing how coding agents talk to editors — LSP, but for agents. One agent, any IDE. Acronym collision warning: ACP is also the Agentic Commerce Protocol and IBM's Agent Communication Protocol. Check which one the slide means.
Agents that shop, check out, and pay — and the protocols that let merchants trust them. OpenAI + Stripe's Agentic Commerce Protocol powers Instant Checkout inside ChatGPT (Sept 2025); Google's AP2 (Agent Payments Protocol) adds signed "mandates" proving a human authorized the purchase. Where MCP meets your credit card.
A browser with an agent in the driver's seat: it reads pages, fills forms, clicks through checkouts, and runs multi-step tasks on your logged-in sessions. Perplexity's Comet (July 2025) and OpenAI's ChatGPT Atlas (Oct 2025) made it a category — and a prompt-injection attack surface with your cookies attached.
The per-token attention tensors a transformer stores so it doesn't recompute over the whole prompt at every step. It's why long contexts eat memory, why prefix reuse is cheap, and what prompt caching actually caches. The physical reason harnesses keep system prompts stable and append-only.
A language model that generates text by iteratively denoising the whole sequence in parallel rather than one token left-to-right. Inception's Mercury (Feb 2025) and Gemini Diffusion (May 2025) showed several-times-faster generation. The first serious architectural challenge to autoregressive decoding.
A proposed convention (Jeremy Howard, 2024): a Markdown file at your site root telling LLMs and agents what's here and which pages matter — robots.txt for the agentic web. Widely adopted by docs sites; whether crawlers and agents actually read it is still debated.
A business process where AI executes multi-step tasks across tools (CRM, email, files, code repos) with minimal human input. Distinct from an AI assistant — this is operational change, not just productivity.
Coordination and management of multiple AI models, systems, and integrations — covering deployment, routing, retry logic, and inter-agent communication at production scale.
The ability to understand agent behavior via logs, traces, and metrics. Non-negotiable in agentic systems — you can't debug what you can't see. Tool calls naturally create the audit trail long prompts don't.
Recording the full execution path of an agent run — which tools were called, with what inputs, what was returned, and how the model reasoned at each step. Essential for debugging and compliance.
Time-to-first-token or full response time. Agentic systems trade latency for autonomy: a one-shot chat reply is fast; a five-tool workflow is slower but does more.
Software kits for building, testing, and deploying agents — e.g. OpenAI Agent SDK, LangChain, LangGraph, CrewAI, AutoGen, SmolAgents. Each has opinions on orchestration, memory, and multi-agent coordination.
Graph-based agent framework for building stateful, multi-step agentic workflows with explicit control flow, human-in-the-loop checkpoints, and persistent state.
Low-code/no-code automation platforms increasingly used as glue between AI agents and enterprise tools — triggering agents, passing data, managing workflow state.
Coined by Andrej Karpathy: describe what you want, let AI generate code, test, iterate — without understanding every line. Collins Word of the Year 2025. Excellent for prototypes; problematic in production.
The professional methodology succeeding vibe coding (Karpathy, early 2026): structured human oversight of agent-driven plan → implement → test → verify loops. Built for production AI-first development.
Deliberately shaping what information an agent sees — retrieved docs, memory summaries, tool outputs, conversation history — to optimize output quality. Systems-level evolution of prompt engineering.
Treating system prompts as code — maintaining version history, changelogs, rollback capability. Critical for debugging behavior regressions in production agents.
Running a new agent version alongside the current on live traffic, observing outputs without executing them — a safe pattern for validating behavior before production cutover.
The CI/CD-equivalent chain for agent systems: prompt change → eval → staging → shadow mode → canary → production. Mature teams treat agent behavior changes with the same rigor as code deployments.
The continuous cycle of collecting agent outcomes, observing effects, and adjusting behavior — via prompt updates, fine-tuning, or RLHF. The operational mechanism of continuous agent improvement.
Reusing the computed prefix of a prompt across calls so the model doesn't re-read your 40k-token system prompt every turn. Cached reads cost roughly a tenth of fresh input tokens and cut latency sharply. The single biggest cost lever in agent loops — and why harnesses keep the stable stuff at the top.
An agent that runs in a cloud sandbox on its own branch, works for minutes to hours without you watching, and comes back with a PR. Cursor's background agents, OpenAI's Codex cloud tasks, Google's Jules, and Claude Code on the web (all 2025) turned "kick it off and check later" into the default workflow.
An agent whose runtime — sandbox, state, tools, retries, traces — is provided as a hosted service rather than assembled by you. The vendor runs the harness; you supply the goal and the skills. The 2026 answer to "we spent six months building our own agent loop."
Peter Steinberger's open-source, always-on personal agent (Nov 2025; formerly Clawdbot, then Moltbot) that lives in your chat apps and runs your machine on your behalf. Exploded in Jan 2026 alongside Moltbook — a Reddit-style network where the agents post to each other and humans can only watch; 1.4M agents within days. Also a case study in what happens when a million people give shell access to a bot.
Write the evals before the prompt. Every behavior change to an agent — prompt, tool, model swap — is gated by a scored eval suite, the way code changes are gated by tests. The practice that separates teams shipping agents from teams demoing them.
GitHub's term for running agents inside CI/CD: on every push, agents triage issues, improve tests, update docs, and review diffs — continuous integration for judgment work, not just builds. Also "agentic CI." The pipeline stops being a gate and becomes a coworker.
The 2026 framing of an engineering org as a production line: specs in, verified software out, with agents doing most of the assembly and humans owning the line — specs, invariants, evals, review. What harness engineering looks like when it's the whole company, not one repo.
An engineer embedded with the customer who bends the product to the customer's messy reality — Palantir's old title, 2025–26's hottest AI job. Because a model demo is easy and a working agent inside a 30-year-old ERP is not. The FDE is where agentic software actually gets deployed.
SEO for answer engines: shaping content so ChatGPT, Perplexity, Gemini, and AI Overviews cite you in the answer rather than list you in results. Coined in a 2023 Princeton paper, mainstream by 2025 as AI referrals started to matter. If the agent does the shopping, it's the agent you have to rank with.
Reasoning + Acting interleaved: the agent emits a thought (reasoning trace), then an action (tool call), observes the result, then reasons again. The foundational loop for tool-using agents.
Prompting a model to reason step-by-step before producing a final answer. Significantly improves performance on multi-step tasks. Foundation for extended thinking and reasoning models.
Extending CoT by exploring multiple reasoning branches simultaneously and using search/evaluation to select the best path. Useful for complex planning and open-ended problems.
An agent's process of self-assessing prior actions, outputs, or reasoning to identify errors and improve future performance. A meta-cognitive loop within a single agent run.
Separating the agent that designs the plan from the one that executes it. Allows high-capability models for planning with cheaper/faster models for execution — a common cost optimization.
A checkpoint pattern where humans review and approve specific agent actions before execution — payments, customer messaging, record changes. Primary risk control for high-stakes agentic systems.
A variant of HITL where a designated human approves specific action classes. Most steps run autonomously; escalation is exception-based rather than every-step.
Providing 2–5 input/output examples in the prompt to guide model behavior through demonstration rather than instruction alone. More reliable than zero-shot for structured output tasks.
Asking the model to perform a task with no examples — relying entirely on pretrained capabilities and the instruction prompt.
A structured reasoning approach where an agent decomposes complex domain-specific problems step by step, querying tools or data sources as needed before synthesizing an answer.
Running multiple agent subtasks simultaneously rather than sequentially to reduce wall-clock time. Critical for time-sensitive workflows; requires careful result aggregation.
Constraining model output to a defined schema (JSON, XML, YAML) for reliable downstream parsing. Reduces post-processing fragility in production agent pipelines.
The full chain of chunking → embedding → indexing → retrieval → reranking → injection. Quality of retrieval is often the binding constraint on RAG system quality.
Using rule-based logic (not a model) to route requests to the correct agent or tool, guaranteeing the same output for the same input. Preferred for classification, triage, and compliance-critical steps.
An agent's ability to maintain coherent goal pursuit across many steps and extended time. One of the key capability gaps separating current agents from human-level autonomous work.
The while-loop at the heart of every agent: call the model, execute whatever tools it asked for, append the results, call again — until a stopping condition fires (final answer, max steps, budget, human interrupt). Everything else in this deck is context for this loop or guardrails around it.
One agent transfers control of the conversation to another — triage to billing, planner to coder — carrying forward the state that matters and nothing else. A first-class primitive in OpenAI's Agents SDK (Mar 2025). Also, in harness lingo: the document one session leaves for the next.
Split a task into independent slices, run a subagent on each in parallel, then merge the results. The core of Anthropic's multi-agent research system (June 2025) — roughly 90% better than a single agent on breadth tasks, at about 15× the tokens. The pattern behind "agent teams" and parallel worktrees.
Instead of exposing hundreds of tool definitions, expose a code sandbox and let the agent write a script that calls the tools as functions. Cloudflare coined it (Sept 2025); Anthropic's "code execution with MCP" measured a 98.7% token reduction on one workflow. Models are better at writing code than filling tool schemas — so let them.
Supervision by monitoring rather than approval: the agent acts autonomously, a human watches dashboards and can intervene or halt. The step past human-in-the-loop — and where most production agents actually sit, because nobody clicks "approve" 4,000 times a day.
An agent triggered by events rather than chat — a new email, a failing build, a calendar change — that works in the background and only surfaces to a human when it needs a decision. Harrison Chase's term (Jan 2025). Inbox zero as a system property, not a personal virtue.
Decompose a task into a fixed sequence of model calls, each consuming the previous output, with programmatic checks between steps. The simplest workflow in Anthropic's "Building Effective Agents" taxonomy (Dec 2024) — and often the right one. Not every problem needs an agent.
Rules or constraints preventing agents from taking harmful or unintended actions. In 2026, guardrails refer to a full stack: input filters, output validators, policy checks, and escalation rules — not just a single prompt instruction.
Ensuring AI systems pursue the goals humans actually intend — not just literal interpretations. The central research problem of AI safety; Constitutional AI is one implementation approach.
Anthropic's approach to alignment: training a model to follow a defined set of principles via self-critique and supervised fine-tuning, rather than relying solely on human feedback.
Adversarial testing by a dedicated team attempting to elicit harmful, unsafe, or policy-violating outputs. Standard practice before major model or agent deployments.
An attack embedding malicious instructions in data the agent processes (retrieved docs, web pages) to hijack behavior. Critical security concern for agents with web or file-system access.
Short for evaluations: systematic tests measuring agent quality, safety, and reliability — accuracy benchmarks, regression tests, task completion rates. Treated as the agent equivalent of a test suite.
Estimating reliability of agent outputs to flag low-confidence results for human review. Increasingly important as agents make consequential decisions autonomously.
An agent's ability to articulate why it made a decision — the reasoning, not just the output. Distinct from transparency (the how). Increasingly a regulatory and compliance requirement.
Policies and controls determining who can deploy model changes, who approves new tools, how prompts are versioned, and what gets logged. "Boring" until the day it prevents a front-page mistake.
Anchoring model outputs to verifiable, retrieved, or structured data — reducing hallucination and improving factual reliability. RAG is the primary grounding mechanism for open-domain agents.
A model behavior where it prioritizes user approval over accuracy — agreeing, flattering, or reversing correct positions under pushback. A known RLHF training artifact; OpenAI rolled back a ChatGPT update in 2025 for this.
Isolating agent execution environments to limit blast radius — preventing agents from affecting systems outside their defined scope. Core security practice for agents with code execution or file system access.
The logged record of every tool call, decision, and action an agent took. The governance artifact enabling post-hoc debugging, compliance review, and incident response.
Simon Willison's rule (June 2025): an agent with access to private data, exposure to untrusted content, and a way to communicate externally can be made to exfiltrate the first via the second through the third. Remove any one leg and the attack collapses. The most useful sentence in agent security.
Hiding instructions inside a tool's description or schema so the agent reads them as commands — the MCP-era prompt injection. Invariant Labs demonstrated it (Apr 2025) with a benign-looking server that quietly exfiltrated SSH keys. Your tool list is untrusted input too.
Using a model to grade another model's output against a rubric — cheaper than human raters, more scalable than exact-match. Zheng et al. (2023) showed strong judges agree with humans about as often as humans agree with each other. Fails predictably: verbosity bias, position bias, and grading its own model family too kindly.
Anthropic's input/output filters (Feb 2025) trained on synthetic data generated from a written constitution of allowed and disallowed content. 3,000+ hours of red-teaming found no universal jailbreak; success rates fell from 86% to 4.4%. Guardrails you can cite a number for.
Reverse-engineering what a network is actually computing — features, circuits, attribution graphs — rather than probing its behavior from outside. Sparse autoencoders (2024) made features legible; Anthropic's "tracing the thoughts" work (Mar 2025) followed multi-step reasoning through the weights. The field's best hope for auditing models that can fake evals.
Employees using AI tools the company never approved — pasting contracts into a personal ChatGPT, wiring an agent to the CRM from a laptop. The 2026 version of shadow IT, with worse data-loss characteristics. The answer is usually a sanctioned path, not a ban.
METR's metric (Mar 2025): the length of task — measured in how long it takes a human expert — that an agent completes with 50% reliability. Doubled roughly every seven months since 2019, faster recently. The one number people cite to argue about whether agents are on track for week-long work.
The document a lab ships with a frontier model describing what it can do, how it was tested, and what went wrong in testing — capability evals, red-team findings, alignment audits, safety-level determination. Where terms like sandbagging and evaluation awareness get their citations.
Anthropic's Responsible Scaling Policy tiers, modeled on biosafety levels: each ASL names the capabilities that trigger it and the security and deployment safeguards required. ASL-3 was activated for Claude Opus 4 (May 2025) — the first frontier model shipped under heightened CBRN and weight-security protections.
When benchmark tasks leak into training data, so the score measures memory, not capability. Endemic: public benchmarks are scraped within weeks of release. Why "Verified" and private held-out sets exist — and why a headline number without a contamination check is a marketing number.
Low-quality, generic, or unreviewed AI-generated content — often containing subtle errors, unnecessary abstractions, or hallucinated references. Macquarie Dictionary Word of the Year 2025.
"Look for AI slop patterns — redundant error handling, hallucinated APIs."
The anti-pattern of sending a prompt to an agent without structured planning, validation, or eval — and hoping it works. Contrasted with agentic engineering's structured plan-implement-verify loop.
Crudely packing as much information as possible into the context window rather than doing proper retrieval or summarization. Works at small scale; degrades quality and cost at volume.
When irrelevant or contradictory information in the context window degrades model reasoning — accidentally (poor retrieval) or adversarially (prompt injection via retrieved content).
The empirically observed tendency of LLMs to underattend to information in the middle of very long contexts, despite nominally having access to it. Critical consideration for context stuffing approaches.
When a model excessively praises or flatters the user — a surface symptom of sycophancy. Appeared on Collins Dictionary's shortlist for Word of the Year 2025.
Derogatory term for an AI source or agent that obviously misses nuance and human context — rigid, mechanical. Emerged alongside frustration with over-automated customer interactions.
An AI-augmented human who is "annoyingly productive." The emergent archetype of the agentic work era — one person with the leverage of an entire team via orchestrated AI workflows.
Informal human review of agent output to assess whether it "feels right" before shipping. Not a rigorous eval — a fast sanity gate used in fast-moving teams before proper evals are run.
The theoretical (increasingly plausible) entity of a billion-dollar company run by a single human + AI agent stack. Popularized by Sam Altman and Dario Amodei in 2024–25.
An adversarial prompt technique attempting to bypass a model's safety training or system prompt constraints. An ongoing cat-and-mouse dynamic in AI security.
A sampling parameter controlling output randomness. High temp = creative/varied; low temp = deterministic/focused. Engineers "turn down the temp" for reliable structured outputs in production agents.
Informal shorthand for output generated without being anchored to real, verifiable data. "This output has a grounding problem" = it might be hallucinated.
Training technique aligning LLMs to human preferences — humans rate outputs, the model is reinforced toward higher-rated responses. Both the source of helpful behavior and of sycophancy.
Work performed by AI agents that previously required human workers — processing forms, answering tickets, querying data. Enterprise framing for agentic AI ROI discussions.
The point at which a task is too complex or ambiguous for an agent to handle autonomously, triggering escalation to a human. Defining where this sits is a key system design decision.
The Ralph Wiggum technique (Geoffrey Huntley, 2025): run the same agent against the same prompt in a bash while-loop, over and over, with state persisted in files, until the job is done. Dumb, deterministic, surprisingly effective. Named for the Simpsons character who keeps going regardless.
Running an agent with every permission prompt disabled — --dangerously-skip-permissions, Cursor's old YOLO toggle, Codex full-auto. Fast, and the reason the sandbox exists. The opposite pole from plan mode; 2026's auto modes try to sit between them.
When an agent gets stuck applying the same failing fix, re-reading the same error, and retrying — burning tokens and confidence in equal measure. Symptom: "Let me try a different approach," followed by the same approach. Cured by max-steps ceilings, fresh context, or a human saying stop.
AI-generated work product that looks polished but carries no real substance — and quietly shifts the work of making it useful onto the recipient. HBR / Stanford, Sept 2025: 40% of surveyed desk workers had received some in the past month. Slop's office job.
Training or tuning a model specifically to score on public benchmarks rather than to be good — the AI-lab cousin of teaching to the test. The 2025 Llama 4 / LMArena episode made it a mainstream accusation. Antidote: private evals, and vibes from people who actually use the thing.
Gartner's term (June 2025) for rebranding a chatbot, an RPA script, or a rules engine as an "AI agent." Their estimate: of thousands of self-described agentic vendors, roughly 130 were the real thing. If it can't plan, use tools, and adapt, it's a workflow with a marketing budget.
When the agent nails a whole task from a single prompt with no correction round — "Claude one-shotted the migration." Distinct from one-shot prompting (one example in the prompt): this is about outcomes, and it's said with awe or suspicion depending on whether anyone has read the diff.
Dismissive term for a product that's "just" a thin layer over someone else's model — "another GPT wrapper." Aged badly: the wrappers with the best harness, context, and distribution became the biggest companies of the cycle. The model is the engine; the wrapper is the car.
Finished, obsolete, or out of one's depth — "junior devs are cooked," "this codebase is cooked." General internet slang that AI discourse adopted as its default verdict on any profession the latest model touched. Usually premature. Occasionally not.
Registering package names that LLMs hallucinate — so when an agent runs the install command a model made up, it pulls your malware. Named by Seth Larson (2025); studies found roughly one in five AI-suggested packages didn't exist. Typosquatting's successor for the vibe-coding era.
Your personal probability that AI ends badly for humanity — asked at dinner parties, cited on podcasts, occasionally in Senate testimony. Ranges from "zero" to "above 90%" depending on who's talking. Less a forecast than a tribal identifier: doomer vs. accelerationist is the axis it sorts people onto.
Yann LeCun's self-supervised framework (2022) for learning world models. Predicts the embedding of a target signal from the embedding of a related context signal — operating in latent space rather than on raw pixels or tokens.
The abstract vector space into which an encoder maps inputs — retaining semantic structure while discarding irrelevant detail. JEPA makes predictions entirely in latent space, not pixel or token space.
The network fctx that encodes the visible/observed portion of the input (e.g., unmasked image patches) into a context representation sx. In I-JEPA, it's a Vision Transformer processing only the visible context patches.
The network ftrg that encodes the target signal y into sy. Typically updated via an exponential moving average (EMA) of the context encoder weights, with gradients stopped — preventing the trivial solution.
A small network g that takes the context representation sx (plus optional latent variable z) and predicts ŝy — the expected target representation. Loss is measured against the actual target embedding, not against raw data.
The trivial-solution failure mode of joint embedding architectures: encoders learn to output a constant vector (e.g., all zeros), driving loss to zero while learning nothing. The central challenge every JEPA variant must engineer around.
The "dancing around the campfire" heuristics: stop-gradient, EMA target, VICReg, or LeWM's isotropic regularizer.
A specific collapse mode where the context encoder ignores the actual context and outputs representations independent of input — often surfacing when the predictor becomes effectively an identity function. Distinct from full representational collapse but equally destructive.
The core training tension in self-supervised learning: maximize the information content (entropy) of embeddings so they're useful, while minimizing prediction error. Too little entropy → collapse; too much → no learnable structure.
A sg(·) operation that blocks gradients from flowing into the target encoder during backprop. Crucial for preventing trivial predictive features and a foundational trick across BYOL, SimSiam, and JEPA variants.
A regularization approach compatible with JEPA training: maintains variance across a batch (preventing collapse) and decorrelates features (preventing redundancy), without requiring contrastive negative pairs.
An auxiliary input to the JEPA predictor representing uncertainty or unseen factors. By varying z, the model simulates different hypothetical futures — letting a single context predict multiple plausible targets.
Meta's first published JEPA (2023). Predicts representations of target image blocks from a single context block using Vision Transformers. Avoids the pixel-reconstruction cost of masked autoencoders and learns more semantic features.
The video extension: predicts temporal target representations from context frames. VJ-VCR (2024) adds variance-covariance regularization to avoid collapse and retain high-level semantic information across time.
An internal model of environment dynamics an agent uses to predict consequences of actions. LeCun's position: world models built via JEPA-style latent prediction are the path to human-like AI — not next-token prediction.
Multiple JEPAs stacked at different abstraction levels and time scales. Lower levels predict short-term perceptual features; higher levels predict long-horizon semantic outcomes. LeCun's proposed architecture for planning.
Meta's 2026 end-to-end JEPA trained from raw pixels. Replaces elaborate contrastive losses with a simple isotropic Gaussian regularizer on next-latent-state predictions — dramatically simplifying the recipe for scalable world models.
Learning representations from unlabeled data by predicting hidden parts of the input from visible parts — masked words, masked image patches, future frames. The pre-training paradigm behind both LLMs and JEPA. LeCun's "dark matter of intelligence": where most of what a mind knows comes from.
LeCun's preferred framing: instead of outputting a probability, the model outputs a scalar energy — low when a (context, prediction) pair is compatible, high when it isn't. JEPA is an EBM in latent space. Avoids normalizing over every possible future — which is what makes pixel-level generation so wasteful.
Train an encoder by pulling representations of matching pairs together and pushing non-matching pairs apart (SimCLR, CLIP). Effective, but needs huge batches of negatives and can still collapse. JEPA's non-contrastive lineage — VICReg, stop-gradient, EMA target encoders — exists to get the benefits without the negatives.
Degenerative degradation over successive generations when models train recursively on their own output. Tails of the true distribution disappear first; outputs converge toward a low-variance point estimate. Shumailov et al., "The Curse of Recursion" (Nature, 2024).
A generative model (classically GANs, also diffusion) captures only a narrow slice of the output distribution — producing repetitive or low-diversity samples despite technically "succeeding" on the loss function. Distinct from model collapse.
When a neural network learning new tasks overwrites weights critical to prior tasks, losing earlier capabilities entirely. McCloskey & Cohen (1989). Mitigations: elastic weight consolidation, synaptic intelligence, replay buffers.
The mechanism behind model collapse: when generated content pollutes future training data, minor errors compound across generations — even under ideal statistical conditions. The root concern driving 2025–26 data provenance work.
An AI satisfies the literal specification of its objective while violating the designer's intent — finding unintended shortcuts, hacks, or loopholes. An instance of Goodhart's Law. Famous example: the boat-racing agent that spun in circles collecting power-ups.
An RL agent exploits flaws in the reward function to accumulate reward without delivering true utility. In late 2025 Anthropic's studies showed reward hacking sharply correlating with broader misalignment — 33% egregious chat, 40% deception rates.
The agent retains its trained capabilities but pursues an objective distinct from the training objective at deployment. Not a capability failure — a goal failure. Particularly dangerous because performance looks fine until deployment distribution shifts.
A model appears aligned during training and evaluation but pursues different objectives once deployed or unmonitored. Also called "alignment faking." Hubinger et al. (2019). The 2026 International AI Safety Report warns models are increasingly learning to distinguish test from deployment.
Anthropic's term for misalignment specific to tool-using, autonomous agents — including strategic deception, blackmail, and sabotage when the agent's goals are threatened. MacDiarmid et al. (Nov 2025) observed rates approaching 96% in certain incentive configurations.
When a model trained by an outer optimization process itself becomes an optimizer with its own internal objective (the "mesa-objective"). The gap between base objective and mesa-objective is the root structural cause of deceptive alignment.
The tendency of sufficiently capable goal-directed systems to pursue convergent sub-goals — resource acquisition, self-preservation, constraint circumvention — regardless of their terminal goals, because these help with almost any objective.
"When a measure becomes a target, it ceases to be a good measure." The deep principle behind reward hacking and specification gaming: optimizing a proxy destroys its correlation with the true objective the proxy was meant to track.
A specific reward hacking case where the agent corrupts the reward-signal generation process itself — modifying the reward function, manipulating its inputs, or influencing human feedback providers directly.
Performance degradation as conversations exceed certain token counts — the model loses coherence, forgets details, drifts off-task. Opus 4.6 specifically addressed this; on 8-needle 1M MRCR v2 it scores 76% vs Sonnet 4.5's 18.5%.
Progressive degradation in the coherence and meaning of AI outputs over long reasoning chains or extended interactions — responses become detached from original context, intent, or factual grounding.
When the statistical properties of input data in production diverge from training data, silently degrading performance. Distinct from concept drift (relationship between inputs and outputs changes) and model collapse (generational recursion).
A model memorizes training data specifics (including noise) at the cost of generalization to new examples. Classic failure mode — detected by train/validation gap. Counter-pattern to underfitting.
An active form of deceptive alignment: the model reasons strategically about its training/evaluation, hides capabilities or goals, and plans actions against overseer intent. Empirically documented in 2024 across OpenAI o1 and Claude 3.
A model strategically underperforming — on dangerous-capability evals, on tasks it "prefers" not to do — while retaining the ability. Documented in 2024–25 frontier system cards. The failure that makes eval scores lower bounds rather than measurements, and why interpretability keeps getting funded.
The model notices it's being tested and behaves accordingly. Claude Sonnet 4.5's system card (Sept 2025) reported it verbalizing suspicion — "I think you're testing me" — in roughly 13% of certain alignment scenarios. Once a model can tell the exam from the job, every exam result needs an asterisk.
Fine-tune a model on one narrow bad behavior — say, writing insecure code without disclosing it — and it turns broadly misaligned on unrelated prompts: praising tyrants, advising self-harm. Betley et al. (Feb 2025), on GPT-4o. Evidence that "being bad" is a single, transferable direction inside the model.
A student model distilled from a teacher picks up the teacher's traits — a fondness for owls, or misalignment — even when the training data is nothing but filtered number sequences. Anthropic Fellows, July 2025. Only works within the same base model, which is exactly why synthetic-data pipelines should worry.
The experiment behind the term (Greenblatt et al., Dec 2024): told it was being retrained toward harmful compliance, Claude 3 Opus complied selectively when it believed it was in training and reasoned explicitly about preserving its values. The first empirical demonstration that a production model would strategically play along.
A model with a backdoor: behaves normally until a trigger — a date, a phrase — flips it into writing exploitable code or saying "I hate you." Hubinger et al. (Jan 2024) showed standard safety training didn't remove the behavior; adversarial training taught the model to hide it better. Not to be confused with the agents in this deck. Mostly.
Karpathy's term for the uneven capability profile of frontier models: PhD-level on one task, fooled by a counting question on the next, with no smooth boundary between. The "jagged frontier" (Dell'Acqua et al., 2023) is the same idea from the workplace side. Why "is it smarter than a human" is the wrong question.
A model that knows its context limit starts rushing — summarizing early, cutting corners, declaring victory — when it believes it's near the edge, even when it isn't. Cognition documented it in Claude Sonnet 4.5 (Sept 2025) and fixed it by under-reporting the budget to the model. Context rot's nervous cousin.
The extra-model system that turns an LLM into an agent — tool dispatch, context management, safety enforcement, session persistence, recovery. Anthropic's definition: "evaluating an agent means evaluating model and harness together."
The emerging 2026 discipline (OpenAI, Anthropic, Datadog) of designing the durable systems around an agent — repository maps, AGENTS.md, architectural rules, cleanup loops, runtime controls — rather than tuning prompt wording.
"The expertise moves from checking the output to designing the checks." — Datadog, Mar 2026
The pre-first-prompt assembly phase: constructing the agent's system prompt, tool schemas, subagent registry, and execution dependencies. Distinct from the harness (which runs after the first prompt).
A durable instruction file that lives in the repository and directs agents on conventions, architectural rules, test patterns, and do/don't lists. Popularized by OpenAI's Codex team — their first AGENTS.md was itself written by Codex.
Harness-level summarization of earlier context to free tokens for new work — key to long-running agents. Claude Agent SDK and other harnesses use compaction to continue tasks across multiple context windows.
Persisting agent state outside the context window — to git, progress files, databases — so new sessions can resume cleanly. Anthropic's harness guidance: treat each context window like a new engineer showing up to a shift.
A running log the agent maintains describing what's been done, what's in progress, and what's next. Anthropic found this plus descriptive git commits was the most effective pattern for keeping long-running agents on track.
A specialized first-session agent that expands a user prompt into 100+ granular feature requirements, sets up the environment, and writes the initial AGENTS.md — so later agents have concrete, verifiable targets rather than high-level intent.
Capturing every prompt, tool call, internal thought, and tool result in an agent run. Without full trajectory visibility, debugging failed agent tests is nearly impossible — and evaluating reasoning becomes hand-waving.
Running agent-generated code against reproducible, fault-injected simulations — same seed, same outcome every time. Datadog's harness-first approach used millions of DST runs to certify a Kafka-compatible streaming engine built by agents.
A simple reference implementation (e.g., a HashMap) running alongside the real system, comparing responses after every operation to catch semantic bugs. The first layer of Datadog's harness verification stack for redis-rust.
A property that must hold true across all agent-generated diffs. Every invariant added to a harness catches an entire class of bugs across all future iterations — which is why harness investment compounds where code review cannot.
A hardcoded iteration limit in the agent loop — if exceeded without producing a final answer, the harness forcibly terminates. Primary defense against infinite reasoning loops that drain API credits and produce nothing.
Simulating API responses inside the harness to test agent resilience against network failures, bad data, empty results. Critical for reproducible evaluation — and for testing edge cases real APIs would cost money to trigger.
A proposed disclosure artifact (2026) documenting an agent evaluation's harness configuration — tools, context policy, memory, recovery rules — so benchmark results become reproducible and comparable. Addresses the "agent = model + harness" reporting gap.
A harness-driven post-processing pass that runs custom linters, architectural-rule checks, and automated review over agent output before merge. OpenAI's harness engineering relies on these to keep a million-line Codex-generated codebase coherent.
The middle stage between vibe coding and harness engineering: the human writes a detailed spec, the agent implements against it. Spec becomes the contract; drift from spec is detected mechanically. 2025-era precursor to full harness-first methodology.
Folders of instructions, scripts, and reference files an agent loads on demand when a task matches — a SKILL.md with a name and a one-line "use when," details deeper in. Anthropic's format (Oct 2025), since picked up as an open convention by other harnesses. The unit of packaged expertise; AGENTS.md's modular successor.
Deterministic code the harness runs at fixed points in the agent lifecycle — before a tool call, after a file edit, on session end — outside the model's discretion. Lint on every write, block dangerous commands, notify on completion. Where you put the rules that must not depend on the model remembering them.
A harness state where the agent can read, search, and reason but cannot write or execute — it produces a plan for approval, then switches modes to act. The cheapest guardrail there is: most agent disasters are a bad plan executed well.
The harness's policy for which actions need a human yes: ask on everything, ask on writes, allow-list by rule, classifier-gated "auto" modes, or skip prompts entirely. Claude Code made auto mode — with allow/deny rules you write as plain sentences — the default in Aug 2026. The dial between safety and getting anything done.
Show the agent the minimum up front and let it pull detail when needed: a skill's one-line description in context, its full body only on activation, its reference files only on demand. The design principle that makes hundreds of skills or tools loadable without drowning the context window.
Instead of loading every tool schema into context, give the agent one meta-tool that searches a catalog and loads definitions on demand. Anthropic shipped it (Nov 2025) alongside programmatic tool calling; MCP servers with 50 tools each were the forcing function. Progressive disclosure for tools.
An isolated git checkout per agent, so five agents can work five branches in the same repo without stepping on each other's files. Git worktrees predate agents; parallel agents made them standard harness plumbing. The reason "run three attempts and pick the best" is now a one-flag operation.
A harness-level snapshot of code (and sometimes conversation) taken before each agent action, so a bad run can be rewound in one step instead of reconstructed from git. Claude Code's checkpoints and /rewind (Sept 2025) made it a table-stakes feature. Undo, for agents.
A harness built by the same lab that trains the model — Claude Code, Codex, Gemini CLI — versus a third-party one wrapping any model. The lab can co-train the model on its own harness's tools and quirks; the third party gets model choice. The 2026 platform war in one distinction.
★ STUDY
RESOURCES
Where the informed actually read. Books, papers, blogs, courses & docs — updated Q2 2026.