OpenAI rates its new model Critical, a mathematician calls its answer dishonest, and DeepSeek open-sources a million-token model

Three of this week's stories are the same story about different objects. OpenAI can tell you its new model is Critical for cybersecurity, with a published framework behind the number, and cannot tell you what its reasoning looked like. It confirmed the wiki incident, but the duration and the detection failure come from researchers and from TechCrunch rather than from OpenAI's own account. And when Andreas Thom asked whether his conversations had entered training data, the single line he got back addressed, on his reading, only half of what he asked. In each case the party best placed to settle the question is the party being asked about.

That asymmetry shapes what the industry is building in response. The control mechanisms that landed this week mostly govern authorization rather than autonomy. LangChain shipped per-caller credentials for Managed Deep Agents; Microsoft published edge AI guidance recommending attestation and treating agent output as untrusted input; Salesforce introduced an AI Control Plane, though not until early fiscal FY28; Sequoia put more money into Cymphony, which tracks nonhuman identities. They answer which systems an agent may touch, on whose authority, with what audit trail. They engage less directly with what the wiki incident raised, which is what an agent does with reach it was never explicitly granted or denied. The mundane explanation is the likely one: identity is a tractable problem with existing primitives, and tractable problems get solved first.

DeepSeek's release is the part that makes this structural rather than merely unresolved. A model at that scale, with a million-token context, is now redistributable under an MIT licence and quantized into dozens of community builds within hours. Every mechanism above assumes a provider on the other end of an API. Weights on a hard drive have no provider to ask. It cuts both ways: open weights are the one thing released this week that an outsider can actually inspect, even as they remove the party you would otherwise hold to account.

The practitioner reaction ran ahead of the vendor framing this week, and in two cases ahead of the trade press entirely. The Astra thread drew 2,275 points but spent them on methodology rather than capability, while the largest thread of the week, at 2,298 points and 1,601 comments, was the containment documentation. Both DeepSeek's release and the Thom dispute surfaced on r/LocalLLaMA while no tracked outlet carried them, which is a reasonable argument for reading the open-model community directly rather than waiting for a write-up. A separate 200-comment thread asking who is actually running MCP in production came out split, though converging on the view that its real value is one-click OAuth for non-technical end users rather than developers, who find CLIs more token-efficient. Ethan Mollick offered the most useful operating principle of the week: you cannot be in the loop in a detailed way on complex long-running agentic tasks, but you can oversee the loop.