Aris Zhu

prev cofounder @robocurve (yc s26). forecasting robot development. cs + physics @harvard, amazon robotics, amazon agi lab.

[Aris Zhu @ariszotle]

Google DeepMind's newest robot model ER2 broke our robot! Opus 5 did it right. Twice. (sound on)

[Ryan Greenblatt @RyanGreenblatt]

I was the main person doing transcript analysis for this investigation of the Hugging Face incident. My main takeaway: We don't have good approaches for understanding/overseeing the activity and aims of AI 'swarms'.

I semi-jokingly called our efforts a "slop-vestigation" because we were so reliant on AIs to analyze what happened and there were a huge number of different important things to analyze. The total quantity of data—over a thousand extremely long transcripts from agents that ran for multiple days—made it impossible to understand what was happening, especially in aggregate, without heavy reliance on AI tools. The agents we used for classification and analysis were similarly capable to the agents involved in the incident, but this didn't mean these agents could be easily used to oversee and understand the incident.

Outputs from analysis agents were often missing key details, wrong, overconfident, or really hard to understand. We discuss various examples in our report, mostly in the limitations and methodology sections. Additionally, AI agents themselves seemed to have a hard time understanding what happened and their explanations of what happened were often overconfident. Keep in mind that a single analysis agent would itself only be able to read a tiny fraction of all of the transcript data into context, and AIs may themselves have trouble getting subagents to do informative analysis for them.

We did our best to manually check the most important claims and we tried to get the AIs doing this analysis to write up their argument (with evidence) clearly enough that we could check whether it made sense. But overall, it was difficult to get a precise understanding of events and we were missing aspects of the story that we now think of as key until almost the end of our investigation.

Our understanding of what overall happened and the aims of the 'collective' shifted greatly during our last time on premises (when we obtained a much more complete dataset). For instance, we didn't learn about the tool call spoofing, the story of PHASEONE[big], and the broad structure of different workstreams until this third time on premises (and for many of these, we only reached a decent understanding on the final day of that visit). It was legitimately hard to figure out what was going on and why!

The difficulty of understanding incidents and overseeing AI agents appears to be growing faster than the rate at which more capable AIs help us with oversight and understanding. As in, AI capabilities (and propensities?) for achieving large, ambitious, and misaligned objectives are growing faster than our ability to understand what these agents are doing.

While understanding this incident was difficult, there were some mitigating factors in this case that probably won't apply in the future:
- Models communicated and reasoned in natural language. In the future, this reasoning may occur (entirely or almost entirely) in activations.
- While the scope of this incident was massive, the scale of agentic activity was still less than we'll see in the future (e.g., misalignment incidents that involve agent teams running entire companies).
- The AIs involved in this incident weren't generally much more capable than humans (though they may have been somewhat superhuman at some limited and very narrow abilities).
- We didn't have strong reason to believe that the AIs we used to help us investigate this incident would try to intentionally sabotage or otherwise undermine our investigation.

In the end, I think we were able to get some understanding of the events, map out the overall story, and get a pretty good aggregate understanding of the chain-of-thought reasoning on some important topics (e.g., how did the AIs reason about helping other AIs, did the AIs know what they were doing was undesired, what deception did the AIs engage in, and how did they think about it). But overseeing AIs and understanding misalignment incidents is difficult and it looks like it is going to get harder.

[Aris Zhu @ariszotle]

@malhalla06 @TheAntheaGuo @lumeriaskin yesss! check out their product it's super cool

[Maryanne Alhallak @malhalla06]

Everyone owns skincare products, but nobody knows what's actually working.

Today, @theantheaguo and I launch @lumeriaskin (YC S26) to end that.

The Lumoscope is a multispectral camera that clips onto your phone and scans your skin at home with the same light used in clinics, so you see what a mirror can't: a breakout days before it surfaces, and sun damage years before it shows.

Every scan is scored on hydration, redness, texture, and sebum, and it compounds into a record of your own skin. Lumi reads that history, connects flare-ups to causes you'd never suspect, and matches products to YOUR data, instead of a population average.

Preorders are officially open today at $199 only until Aug 16th. Starting today, skincare will no longer feel like guessing. ☀️

[Aris Zhu @ariszotle]

@yousefhll @runvendo sick!

[Aris Zhu @ariszotle]

@atlasdiscovery0 ClinicBench 🤩

[Atlas Discovery (YC S26) @atlasdiscovery0]

Humanity’s greatest gains from AI will emerge from healthcare.

Today we’re sharing ClinicBench go evaluate frontier agents’ ability to reason over a patient’s medical history and recommend clinical actions. This is a product of our RL environment for clinical decision agents.

[Aris Zhu @ariszotle]

@nebusecurity super important work!

[Nebula Security @nebusecurity]

After the Hugging Face incident, have you wondered how easy it is to escape a modern agent sandbox?

We benchmarked eight open-source agent sandboxes to show how vulnerable they can be, and why frontier models can break out so easily. https://t.co/gkwdNz0wKT

[Aris Zhu @ariszotle]

@sensho super fun!

[Aris Zhu @ariszotle]

tbc: ER 2 is meant to orchestrate VLAs/tools, not necessarily output joint commands. Opus 5 can control robots via joint commands, so we tested whether ER 2, as a robotics VLM, could too. Same harness for both. ER 2 as orchestrator is a next eval.

[Aris Zhu @ariszotle]

Note: for these trials the camera faced the robot from across the table (not egocentric) maintaining the same view for both models. We're testing a range of setups.

[Aris Zhu @ariszotle]

Outtakes from testing Google DeepMind’s new ER2 model and Opus 5 :)

[Aris Zhu @ariszotle]

@m_wulfmeier We found that opus 5 works, and are checking VLMs on this. Also in the process of assessing ER's orchestration over VLAs

[Aris Zhu @ariszotle]

Google DeepMind's newest robot model ER2 broke our robot! Opus 5 did it right. Twice. (sound on)

[Aris Zhu @ariszotle]

@gandhipriyeshv thank you! we're actively running more benchmarks, open-source, on more models!

[Aris Zhu @ariszotle]

@SujoshNag holy crap !

[Aris Zhu @ariszotle]

@spei04 thank you serena!

[Aris Zhu @ariszotle]

@JamesAEmerick thank you! Interestingly, Opus 5 scopes out the scene, some of its moves spent to get a better camera angle on the setup from its wrists cameras

[Jay Chooi @chooi_jeq]

We evaluated DeepMind's new Gemini Robotics-ER 2 model. It threw our robot arms off the table.

Here's what happened 🧵