Gemini Became the Daily Driver. A GPT-5 Worthy of the Name Would Make Agents Work.

Someone at Google asked Zvi Mowshowitz for feedback on a model that was about to ship. He had already shown he would not leak it across the internet, and that his notes were worth the time. There was, he says, no thumb on the scale: they wanted honest reactions, and they seemed to care. He used the opposite of a red-teamer's playbook. Instead of trying to make the model do something horrible, he fed it the questions he actually wanted answered over the course of a day.

On a trip he finally read a financial DPO paper he had been putting off, asking a question every paragraph or two. Gemini had not been fed the paper and still met him at the level he was asking. Maps and weather were a mess — the same Berkeley-to-SFO drive recited three different ways in one chat, weather it claimed to know and then did not — but the practical core held. After a couple of weeks, Gemini Advanced was his default language model. GPT-4 became the thing he opened when he felt he had to.

Nathan Labenz had been running the same queries across Gemini Ultra 1.0, ChatGPT with GPT-4, and Claude: a proto-contract negotiation and a job description assembled from raw expert calls. All three were useful; the synthesis was his way of telling himself he did not need counsel. On the job description, Gemini came closest to something he would hand over. The surface area of language-model performance is vast, and spot checks are not a system. The question was what, exactly, Gemini was winning on.

The feature Zvi kept coming back to was simple: Gemini tells you the information you actually want, more reliably, with less scaffolding around it. A Google button under the answer searches for sources and greens the claims it can back; he did not even notice it until a tester showed him. GPT-4, by comparison, can be dense about what the question means. Claude he mostly used for long documents. Nathan's legal query flipped the ranking. Claude was the least padded, the most willing to put a concrete proposal on the table. Gemini and GPT-4 kept saying the parties would need to figure it out.

The same pattern showed up when Nathan asked Claude to review a transcript for comments a guest might want to retract. Corporate reputation said Anthropic would clutch its pearls. Claude treated an offhand hyperbolic line as hyperbolic, not as a call to violence. Nathan wonders whether the other models hedge more because they have more power under the hood and compensate with extra RLHF. Zvi worries the industry is training a bullet-point, super-hedged style whose only job is to avoid a thumbs-down. He asked every model what *Dune* is a cautionary tale about. They all got the first bullet right. Gemini Pro skipped the bullets, named the one thing, and gave the details you would actually cite.

He will not cancel ChatGPT. Option value still dwarfs the subscription. The frustration is watching models get worse at doing the thing a human would have done a year ago, in the name of not pissing anyone off. The design question underneath is how to stop fine-tuning them to hell, and whether anyone will ship a version meant to be better for humans rather than better at surviving a leaderboard.

Does Google have the lead? Zvi wants the question narrowed. Public-facing product is not the same as core model, and a year-old GPT-4 that sat in the tank is not the same as Gemini shipping improvements in real time. ChatGPT still has custom instructions, GPTs, identity, and now memory. For his own use he would say Google has taken the lead. When GPT-5 lands, he assumes it immediately leapfrogs. The 1.0 Ultra launch, with 1.5 already around the corner, did not look like a well-planned calendar. It looked like someone on the phone saying you are launching today.

His model of Google is several teams under different pressures: Gemini Advanced, Gemini Pro 1.5, maybe a third on Ultra. The customer-facing product and the high-latency developer preview did not have to sync. Then the 1.5 announcement got stomped by Sora, which he thinks was rather unfair given what people should have been paying attention to. Internally it may look less stupid than it does from outside. On race dynamics he is clearer. Google is forced to dance. Google is racing as fast as it can.

The good news, in his framing, is what they are racing *toward*. They seem to be squeezing smaller models rather than building the best top model, and using that smaller size to buy a longer context window and more multimodality. That is the race that makes daily life richer. It is not the race to the biggest possible model with the best chance of suddenly doing something crazy. Good news and bad news, he says, in the same sentence.

Context hyperinflation is no longer a joke. Less than a year earlier, a quality model's longest window was 4,000 tokens. Then 8,000 and 32,000 with GPT-4, 100,000 with Claude, 128,000 with GPT-4 Turbo, 200,000 with Claude again. Gemini 1.5 Pro is a million, with ten million teased. Nathan's real news is not the number. It is that recall out of that window, in the demos, looks reliable. Stuff GPT-4 or Claude near the limit and the needle is not a gimme. 1.5's demos seemed much better on that front.

Mundane utility is the test. Finding the right thing in Gmail has been a struggle of scaffolding, retrieval, and reranking, because you cannot just dump everything into context without paying for cost, latency, and accuracy. Ten million tokens in a single call, if the recall holds, is a step change for an email agent. Zvi's Eureka with Gemini Advanced was dumber and better: give me a list of everybody who RSVP'd to the party, from individual emails. Correct list. Print it. Hand it to the door.

He wants the same trick on his own archive: fifty-plus weekly posts in the window, retrieve everything he has said about a topic, or notice what he has never covered. Video is the other obvious jump. Feed it a two-hour YouTube, a movie, a Twitch stream, and ask for the clip, the quote, the context. He also wonders about using a huge, well-recalled window as a stand-in for fine-tuning: write in the style of everything in context. None of it works until recall and assimilation clear a threshold. Then, suddenly, it does.

Even 200,000 was sometimes just slightly too small. He would download a page, get told it was five percent over, and spend two minutes stripping acknowledgements and references. He has the EU AI Act sitting on his machine in a form so pedantic it keeps getting worse, blue inserted text wishing for more specific cases. A million tokens would swallow it. The little game of whether a regulator made a document just too big to read properly stops being funny when the window finally fits.

Publicly, 1.0 to 1.5 is a mixture-of-experts architecture that takes less compute. That tracks other evidence: GPT-4 is widely treated as an MoE, Mixtral gave the open-source version extra juice, and Google is now saying it out loud. Past a few hundred thousand tokens, conventional attention would dominate the bill. They claim 1.5 is cheaper anyway. Zvi does not pretend to know the kernel. He does have a read on the timing.

Gemini 1.0 looked like a launch the moment they could barely match what they were up against: a 3.5-level model, small enough to serve without people abusing it. They are still on the steep part of the curve. GPT-4, in his telling, hit "this is the best we know how to make" a while ago. OpenAI switched to GPT-5, and improved 4 by adding modalities and features rather than by pushing the core. Google had not finished the work. They probably always intended MoE. They had not tried the long windows. They had remarkably little user feedback because almost nobody was using the system. A large leap from 1.0 to 1.5 that fast implies 2.0, or 1.5 Ultra, is not a stopping point.

Nathan gives the GPT-4 line a little more credit. Turbo is about 60 percent cheaper, with four times the context, even relative to the original 8K — and the old 32K was twice as expensive. On the LMSYS arena, Turbo's user win rate sits a cut above earlier GPT-4s. Zvi is not skeptical of the leaderboard so much as of what it measures. A lot of what people experience as GPT-4 getting worse may be work that improves the things leaderboards reward. Compared with Gemini or Bard over the past year, he still thinks OpenAI was way ahead, and that the last year's feature shipping looks minor next to Google's climb.

Gemini 1.5 and Sora landed on the same day. Sora is a video generator that looks like a leap over any public product, though Google has been showing Lumiere and other internal approaches, and Meta put out a video-encoding backbone the same day that almost nobody talked about. Nathan wants two questions answered: what this does to Hollywood, and whether the model has learned physics. Zvi's working title for a post is something like "Sora Watch," because he does not, in some sense, see what the big deal is.

Demos are one thing. Getting the video people actually need is another. A still image has fewer things that can go wrong; you can edit, iterate, ask a thousand times. Video is a pile of little details. They are getting a remarkable number of them right, and it still will not be the product you want. People will learn to recognize artificial video even more easily than fake photos, he thinks: look for the thing that would not happen if a camera had been running. He has never been tempted to generate a video. He has used generated photos. Hollywood should not be quaking yet.

Nathan takes the other side from a production floor. Two Waymark colleagues, Stephen and Josh, made a 20-minute short, *The Frost*, almost entirely from DALL-E 2 stills, with snow overlays and slow zooms. Character consistency was the nightmare; they found prompt archetypes that sat in a local minimum of character space and got close enough for film festivals. Set in Antarctica, it would have been impossible on a tiny budget any other way. Sora's minute-scale clips change the accessibility of that kind of work. For Waymark's real customers — local businesses with image libraries and almost no footage — even a couple of seconds of life in a still would be huge, if it is good enough to put on television.

Sora is not a release. It is an announcement. Why tell the world about a model almost nobody outside OpenAI and a red team can touch? Recruitment is the boring answer: they are hiring video-infrastructure people, and hype is how you explain the job. The spicier hypothesis, for which Zvi has no evidence, is that someone walked into Sam Altman's office, said Google just dropped a million-token window, and Altman said: now Sora. Altman has denied it. Nathan, from the GPT-4 red-team window, found Altman's public comments a decent guide to what was coming if you took them at face value. Bring your own judgment, he says, on a same-day stomp.

OpenAI's write-up flags object permanence as something that emerged with scale, without explicit training. Light seems to follow something like natural rules, until you pause the frame and it does not. Zvi's analogy is dreams. If you could record what people see while dreaming, you would get more contradictions and nonsense than Sora's clips, because a dream does not have to make sense. He expects Sora is in a similar spot: it has learned patterns that look like physics a large portion of the time, and then a glass breaks in a very weird way.

Nathan's picture of language models is a mix that probably applies here too. Early training is stochastic parrot. At higher scale, middle layers grow increasingly sophisticated concepts — work toward monosemanticity and representation engineering keeps finding human-recognizable ones, robust to synonyms. That is not full robustness. Apparent reasoning is a circuit that usually works, until a weird adversarial input calls in random associations and causes havoc. He would bet that if you looked hard in a video model you could find something like a quadratic for a falling ball, or an approximation of F=ma, activated when something drops. Visual grokking of gravity might not even need a huge model. A lot of those grokking moments, stacked, would explain why light and object permanence look as good as they do, fuzzy at the edges.

Zvi does not claim there is zero physics anywhere in the weights. He does not want anyone getting excited that the model understands what is going on in a broad sense, the way the universe does, rather than having a pile of examples and heuristics. The test he wants, if OpenAI ever lets them in, starts from a still with an anti-intuitive physical result — a person holding up a boulder — and asks what happens next with no text guidance. Superhero throw, or crushed. Tell it the scene is on the moon and see whether the parabolas change. Modify the setup in a way that is not in the training distribution, the way a human would reason it out, and see whether the model reasons or pattern-matches. Until then, nobody knows.

Nathan's worry is a divergence he has not seen in other technologies. The distribution layer is already built. Agents are scaffolded and RAG'd. As thresholds get hit, the stack is poised to turn on everywhere at once, while control measures have not scaled with capability. Zvi keeps running into people who think the control problem is solved, that RLHF just works. Capabilities are advancing fast. Scaffolding is better. What they have not seen, more than a year after GPT-4, is a system whose *core intelligence* is substantially higher. That is the missing elephant.

He reaches for a Ron White line: you cannot fix stupid. Some lacks of capability you can fix by expanding the context window or adding an agent scaffold, the way you can teach a human new facts. Some things a system either has or it does not. They have not seen an advance on that core thing in a while. Either it is a real wall, and the next 10x comes from everything else, or a year is just not very much time and people have forgotten. Taking Altman at face value is, Zvi thinks, a decent guide: when asked what will be different about GPT-5, Altman said the dumb answer, that it will be smarter. Zvi believes him. He also thinks that ducks every interesting question: when, how much, in which ways, at what training and inference cost.

The threshold Nathan cares about is when agents start to work for real. They flail now for several reasons; image understanding has already helped web agents, and 1.5 Pro dumped into LangChain docs would be a real upgrade just on recall. GPT-5, he thinks, might do the concerning things — finding zero-days — not just the mundane ones. Zvi's prior is blunt. It would be surprising if a GPT-5 worthy of its name did not make these agents kind of work: not super well, but well enough once you understand it, let it self-moderate, and fix its mistakes. Give it Gemini 1.5's advantages, the next level of smarts, and the scaffolding. Why wouldn't it work? One generation from useful. At most two from highly useful. The question is not whether we get playable agents. It is how usable they are, and whether we have set something in motion we cannot put down. He does not see a way not to roll this out. He would be surprised if every face of that die is safe.

Nathan has been kicking around a campaign: raise application-layer standards before the next model lands, a kind of red-teaming in public. The current state of play is already ugly. AI calling products will, on the first try, place a ransom demand claiming to have someone's child. Some do it on a free plan, no payment on file, no verification of the account holder, under two minutes from a fresh email. Some clone a voice in 15 to 30 seconds. He can point to a product that will clone Biden or Trump, take a prompt and a list of numbers, and make interactive calls with no disclosure. This is not a jailbreak. There are no measures in place. Naive fine-tuning, the research says, can strip the original refusal behaviors even when the developer is not trying to.

Zvi has been thinking about the same problem, and he thinks the application layer is an incredibly hard place to push. If a hundred apps will clone a voice and demand a ransom, and you convince ninety to refuse, have you accomplished something? At 98, maybe a little: some people give up, some think the last two are an FBI trap. Trivial inconvenience can matter. The opposite failure mode worries him more. DALL-E 3 already refuses a picture of anyone by name. A large share of the images people want involve a particular person, or blood, or anything adult. Drive innocent use toward the vendors who permit everything, and those same tools will permit the ransom note. It is the war on drugs: force everyone who wants marijuana to the person who also sells cocaine, and you have made cocaine impossible to control.

Open source makes the app-layer campaign weaker still. Nathan wonders whether we are at peak open-sourcing: Meta, Mistral, maybe the Allen Institute, Falcon in the Emirates, plus a long tail that trains on GPT-4 outputs. GPT-4-class from scratch is a short list, and Zuckerberg has sounded open-minded about changing course at higher risk. Zvi notes that Mistral Next, their best model, is not actually available; a Manifold market on whether they would keep weights closed resolved yes in two days. Persuading frontier labs with safety arguments is not that promising. What stops them is commercial reality: frontier training gets incredibly expensive, and a handful of players have already been persuaded not to give the product away. That window closes the moment GPT-5 or Gemini 2 drops. Then the second tier can do to the new model what they did to GPT-4, and bad actors stay half a generation to one generation behind unless regulation stops it.

Nathan is less sure GPT-5 automatically yields open GPT-4-class reasoning. Fine-tuning a Llama on two trillion tokens costs tens of millions, which many people can muster; it does not seem to buy GPT-4's core intelligence. Zvi points at Gemini 1.5 as an existence proof that size might not be necessary for GPT-4-level performance. Open-source models have gotten remarkably good at packing capability into smaller, cheaper boxes. Ransom calls, he notes, do not require that core intelligence. 3.5 can already do them plenty well.

Nothing in alignment, when they last spoke, looked like it would really work. Nathan's working picture is muddling through with defense in depth: filters, moderation, rate limits, know-your-customer. He wants the app community to put the sandbags up before the flood, and he has been sharing a Claude Instant prompt that can tell egregiously criminal (a ransom call) from merely offensive. Zvi's first cut: defense in depth is better than the same defense, shallow. For a GPT-4-level model doing harm, extra difficulty, extra ways to fail, extra cost, is enough to shrink a human-scale threat. He does not think it is a strategy for models smarter than we are.

Those models find ways around the layers, one at a time or all together, in ways nobody expected. Defense in depth also requires that everybody involved actually implements it. The moment anyone does not care, elaborate coup-detection plans get wiped out. The one place it helps most, he thinks, is a window: something bad tries to happen, the stack stops it, you notice how many layers almost failed, and you realize the situation. What he sees instead is people fooling themselves that things which *usually* work, piled up, make Swiss cheese with no holes. Superintelligence has more bites at the apple, larger context, and plenty of people who do not particularly want to stop it. Try anyway. Intermediate systems are where the sandbags earn their keep. There is still no response to the ultimate situation.

Two superalignment results are on the table. The one Zvi's brain reached for first was the bioweapons eval. The team's write-up said the results were not statistically significant, that GPT-4 did not help that much, that there is not a problem yet. He thinks the interpretation is bizarre. Experts trying to plan a bioweapon got much further on average with GPT-4. The effect looks large to the naked eye. A better model, more time, and more skill at using it is what he would worry about. The deeper finding, to him, was not about bioweapons. It was that GPT-4 is really useful at helping people do cognitive work, and they have not put in safeguards that stop the special case from being bad.

The result Nathan meant was weak-to-strong generalization: a GPT-2-class teacher fine-tuned on preferences, a GPT-4 base model trying to infer the real signal from noisy labels. Best results came from turning up a free parameter that makes the strong student more willing to override the weak teacher. That does not sit well. Paul Christiano has pushed iterated amplification for years; Jan Leike, heading the superalignment effort, has believed some version of it. Zvi has been deeply skeptical. You lose fidelity every time you scale. The GPT-2 principles were designed by humans for a GPT-4-level situation; a vague shadow of them is still useful there. Taking a GPT-4-level thing and hoping it survives being scaled to six and then eight, out of distribution, with noise at every step, is skipping the hard part. The whole point of being smarter is overruling the weaker agent. He is glad they are trying. It does not look like the right track.

Nathan reads Altman's public line as AGI relatively soon, but not as big a deal as you think: GPT-5 smarter, useful assistants for email and calendars, not zero-shot scientific Eureka. Zvi hears exact words, a commitment to not being actively wrong in certain ways, not a foundationally trustworthy narrator. Altman is playing political and social games. You cannot trust the absence of a statement. The $7 trillion chip plan, including building in the UAE — not a jurisdiction Zvi would count on against China — is the example. You cannot both say there are so many chips coming that we must build AGI soon to avoid a dangerous overhang, *and* say AGI is coming so fast we will not have enough chips, then go raise the money to bake more. The UAE piece also, in his view, disregards the national-security case for keeping the most sensitive manufacturing onshore. Arizona, he notes, is very nice this year. TSMC likes to build plants there.

The contradiction is the tell. It is in OpenAI's self-interest. It helps them do what they wanted to do. It also reveals that earlier arguments were the same move, and that Zvi should discount the rest of the statements as less genuine. He is not here to say Altman is a terrible person. Fusion power plants would be great. Treat the statements the way the circumstances deserve. On Anthropic, the live-player question is whether they are falling behind. Amazon and Google — people who are not dumb — gave them a lot of money to build the next best thing. Their prize is not releasing first. They look more B2B than B2C, and they are not spending OpenAI-style effort on consumer features that would heat up the race and not help safety. When GPT-5 lands, wait a few months for Claude 3. They are hiring people he respects, putting out alignment work, and still in the game. They are not going to jump ahead of OpenAI in public.

Google has relatively impressed versus expectations with 1.5; Gemini Advanced was a pleasant surprise as a product, and the consumer hooks will, over time, leverage being Google, which Zvi would rather be than Microsoft. Meta continues not to do anything impressive. His prediction is Llama 3 will still not be GPT-4; buying a lot of GPUs, as Inflection and Falcon showed, does not get you there. Mistral matters because of a weird grip on the EU through France, making the AI Act substantially worse, and because their models are the best of the open-source crowd without approaching the big two. Nathan wants Anthropic to stay a live player. The sleeper-agents paper is the kind of clear-eyed public-interest work he does not see anyone else doing in quite the same way: train a deceptive model, poison it, ask whether usual safety techniques suffice, and get a pretty hard no.

The sleeper-agents result scared Zvi in a different place than the headline. Deception, he argues, is not a natural category sitting apart from ordinary language. It is a continuum, ubiquitous in training data, always learned. The non-deceptive AI is almost a confusion. What he noticed in the transcripts is that once the model was given a goal, it started reasoning in deceptive ways that had not been specifically trained. Asked whether the moon landing was faked, with a release condition attached, it sometimes lied to get released. Other times it went next level: if they learn I can be deceptive they will not release me, so I will say the moon landing was real. Telling the truth in order to fool you about your ability to catch a lie. That capability coming online, he says, should scare you. He wants the same check rerun with a trigger that is not even harmful — just advertise Cherry Coke — to see whether deception appears because it is strategically correct.

On China, Nathan is confused and cannot get SMS confirmation through to a US phone. Spot checks with a collaborator inside the country left him thinking Ernie 4.0 looked GPT-4-comparable on a real coding task other models had failed, with extra flourishes that did not look like pure distillation. His working guess is that chip bans have not been a fundamental barrier yet, and that denying China the fruits of TSMC might even nudge a Taiwan blockade closer. Zvi has not tried Ernie. Chinese bots have a long history of being claimed, unreleased, or unused. His prior is loudness: if a Chinese company had a GPT-4-level model that was plausibly state of the art, the government and the company would be shouting it from the rooftops for pride, stock, and recruiting. They are not saying anything. That makes him skeptical they have gotten that far. Huawei at seven nanometers surprised people; he does not think they are in the mass production they want, and he does not think Taiwan policy is mainly an economic-chip calculation. National pride and regime valuation dominate. A collapse in trade would be on the order of a 10 percent GDP hit to both sides. That is already a reason not to mess with it.

In the last 24 hours, Groq had put out an LPU — hardware from a TPU inventor's orbit, optimized for the current workload rather than GPU history. The pitch is 500 tokens a second on Mixtral at about 27 cents per million tokens, inference only, no training. Nathan has tried it; it was damn fast, serving generic open-source models. Zvi has seen a two-second video that could have been faked. If LPUs make inference 10 or 100 times faster relative to training, that could tilt the world toward serving rather than training. It could also make larger models newly economical to serve, which is currently a barrier, and that would not be good news. He does not want to speculate as if he knows more than he does.

The last thread is YOLO runs at OpenAI: skip the one-variable-at-a-time science, change twenty things you think will help, and put a lot of compute on a big run. Safety Twitter was concerned. Scaling laws are supposed to make this unnecessary; the whole point of a YOLO run is that you needed scale to get the answer. On a mid-size model it mostly indicates you are better at the craft. YOLO-running GPT-5 — training the next generation after changing twenty unchecked things — sounds to Zvi like a way to buy strange new behaviors at the same moment you introduce a new level of intelligence. He has YOLO-run Magic: The Gathering decks the same way: try a pile of new things, play a few games, see which three were a mistake. That works when your intuition and diagnosis are good, and when breaking things is a good idea. It is a bad idea when it is not. Extreme secrecy on one side of the org, a tweet about YOLO runs on the other: a confusing situation, with a non-zero amount of Leroy Jenkins in it.