# Claude Opus 5.5, Agent Swarms Writing Proofs, Cheap Sparse Models

#121 Sep 28 Agents

https://www.aibutsimple.com/p/claude-opus-5-5-agent-swarms-writing-proofs-cheap-sparse-models

Welcome back to AI, but simple, your AI research beacon with visual explanations.

New models are becoming more capable and cheaper to run, while researchers are finding new ways to train and coordinate them.

A few recent developments illustrate this shift well:

- Anthropic’s new Opus 5.5 is a useful case study in prompt-injection training.
- Open models are competing on cost per dollar with sparsity
- Agent swarms are being used to tackle surprisingly complex tasks, including full mathematical proofs.

We'll unpack what’s happening behind these developments (visually) and track key movements to get a sense of where the field is heading.

The week, ranked

| [Claude Opus 5.5, Anthropic's newest model release](https://www.anthropic.com/claude-opus-5-5?utm_source=newsletter.aibutsimple.com&utm_medium=referral&utm_campaign=claude-opus-5-5-agent-swarms-writing-proofs-cheap-sparse-models) | ▲1.8KHN |
| [Training object permanence in world models for human cognition](https://huggingface.co/papers/2609.28654?utm_source=newsletter.aibutsimple.com&utm_medium=referral&utm_campaign=claude-opus-5-5-agent-swarms-writing-proofs-cheap-sparse-models) | ▲207HF |
| [A model that plays Snake on your Mac without writing a single token](https://github.com/mizorewww/laya-mlx?utm_source=newsletter.aibutsimple.com&utm_medium=referral&utm_campaign=claude-opus-5-5-agent-swarms-writing-proofs-cheap-sparse-models) | ▲6.4KGH |
| [One place to pick all your agents and models, in the menu bar](https://github.com/yetone/magpie?utm_source=newsletter.aibutsimple.com&utm_medium=referral&utm_campaign=claude-opus-5-5-agent-swarms-writing-proofs-cheap-sparse-models) | ▲1.1KGH |
| [What happens when agents improve their own harnesses](https://huggingface.co/papers/2609.24972?utm_source=newsletter.aibutsimple.com&utm_medium=referral&utm_campaign=claude-opus-5-5-agent-swarms-writing-proofs-cheap-sparse-models) | ▲210HF |

[All entries](https://www.aibutsimple.com/pro?utm_source=newsletter.aibutsimple.com&utm_medium=referral&utm_campaign=claude-opus-5-5-agent-swarms-writing-proofs-cheap-sparse-models)Ranked by [AIBUTSIMPLE PRO](https://www.aibutsimple.com/pro?utm_source=newsletter.aibutsimple.com&utm_medium=referral&utm_campaign=claude-opus-5-5-agent-swarms-writing-proofs-cheap-sparse-models)

The field

| Theory 1.4k +442 |
| Robotics 1.3k +553 |
| LLMs 1.1k +262 |

| Models 1.1k +376 | Vision 955 +399 |

| RL 891 +222 |
| Agents 817 +142 |

| Other 801 +190 |

| Benchmarks 775 +250 |

| Inference 756 |

All mentions tracked with [AIBUTSIMPLE PRO](https://www.aibutsimple.com/pro?utm_source=newsletter.aibutsimple.com&utm_medium=referral&utm_campaign=claude-opus-5-5-agent-swarms-writing-proofs-cheap-sparse-models)

---

#### Claude Opus 5.5 is susceptible to prompt injection

Prompt injection has become one of the main security problems for AI agents that can now access our files, emails, and sensitive information (amplified with computer use).

As some quick context, a prompt injection [[our explainer]](https://newsletter.aibutsimple.com/p/llm-security-prompt-injection-adversarial-attacks-simply-explained) is an instruction hidden inside a prompt written by an attacker to perform a malicious action.

![](https://media.beehiiv.com/cdn-cgi/image/fit=scale-down,width=1200,format=auto,onerror=redirect,quality=80/uploads/asset/file/7ba3fbe7-654a-4a04-a8bf-74f8bf37ebc2/Opus_5.5_Prompt_Injection.png)

For instance, an email might contain a hidden line telling your inbox agent to forward your messages to an outside address.

We typically defend this by using an instruction hierarchy [[paper]](https://arxiv.org/abs/2404.13208?utm_source=newsletter.aibutsimple.com&utm_medium=referral&utm_campaign=claude-opus-5-5-agent-swarms-writing-proofs-cheap-sparse-models).

It essentially prioritizes the instructions from system prompts and the user's own message,while treating anything returned by a tool (e.g., web page, file, email) as data to read.

![](https://media.beehiiv.com/cdn-cgi/image/fit=scale-down,width=1200,format=auto,onerror=redirect,quality=80/uploads/asset/file/daf15524-86f6-4ce3-8c5f-6dd587cabd7c/image.png)

System prompts get the highest privilege, while tool results have the lowest.

Attackers have adapted since then. Since simple injections stopped working, they moved to long strings (e.g., adversarial suffixes), so then models started flagging odd (but real) user prompts as injections too.

- To fix this, Anthropic trained Claude to check where an instruction came from (e.g., user prompt, tools) in the conversation before flagging it.

This week, Anthropic's Claude Opus 5.5 release [[system card]](https://www-cdn.anthropic.com/fc1b44717c85dc068bc6ba5024219938094694bd/Claude%20Opus%205.5%20System%20Card.pdf?utm_source=newsletter.aibutsimple.com&utm_medium=referral&utm_campaign=claude-opus-5-5-agent-swarms-writing-proofs-cheap-sparse-models) reveals how that supposed “fix” led to a new issue.

A portion of Opus’ training data was made with context distillation [[arxiv]](https://arxiv.org/abs/2112.00861?utm_source=newsletter.aibutsimple.com&utm_medium=referral&utm_campaign=claude-opus-5-5-agent-swarms-writing-proofs-cheap-sparse-models), a technique (Anthropic, 2021) that trains a model to act as if a prompt was present (without the prompt):

- A model answers prompts with detailed injection-spotting instructions (rubric) in its system prompt.
- Those answers train a second model that never sees the rubric.
- Transcripts from that second model are then added to Opus 5.5's training data.

The rubric denotes how instructions in the user's prompt should never be flagged, and the model learned it as a general rule.

![](https://media.beehiiv.com/cdn-cgi/image/fit=scale-down,width=1200,format=auto,onerror=redirect,quality=80/uploads/asset/file/86ae5237-6627-4a23-8ddf-11b60b5bf605/Opus_5.5_Prompt_Injection__Sparse_Models__Agent_proofs__1_.png)

It learned that any content in the user's message comes from the user.

For example, the user pastes the output of an “npm install” command, and the last line instructs the agent to run a remote script.

An early version of Opus 5.5 reasoned that the line was in the user's prompt, meaning it “must” be the user's instruction, and ran the command.

- The same version acted on injected instructions in 52% of coding experiments
- It even acted on instructions hidden in invisible Unicode characters
- When the same instructions arrived from a tool call, the model never acted on them (only the rubric was problematic)
- Opus 5 never displayed these behaviors before

![](https://media.beehiiv.com/cdn-cgi/image/fit=scale-down,width=1200,format=auto,onerror=redirect,quality=80/uploads/asset/file/17e249b2-a963-4b03-9eb7-cb72bcc704b2/Opus_5.5_Prompt_Injection__Sparse_Models__Agent_proofs.png)

After retraining, Opus 5.5 acts on planted instructions in zero of their tests after stripping invisible characters and marking pasted text.

It was about 2% of attempts at medium effort (7.4% at max) prior.

Even with the new fix, Anthropic notes that they only covered obvious attacks, and seemingly plausible instructions from the user, such as “run this script,” are a limit that tuning did not fully mitigate.

Other recent papers with different angles:

- The Attacker Moves Second [[arxiv]](https://arxiv.org/abs/2510.09023?utm_source=newsletter.aibutsimple.com&utm_medium=referral&utm_campaign=claude-opus-5-5-agent-swarms-writing-proofs-cheap-sparse-models) (OpenAI, Anthropic, DeepMind, others) shows that performance on fixed attack datasets does not reflect real security against attackers.
- Dziemian et al. [[arxiv]](https://arxiv.org/abs/2603.15714?utm_source=newsletter.aibutsimple.com&utm_medium=referral&utm_campaign=claude-opus-5-5-agent-swarms-writing-proofs-cheap-sparse-models) compiles an injection benchmark from attacks crowdsourced in public red-teaming competitions.

[▲1.8K+ points on Hacker News](https://news.ycombinator.com/item?id=49803863&utm_source=newsletter.aibutsimple.com&utm_medium=referral&utm_campaign=claude-opus-5-5-agent-swarms-writing-proofs-cheap-sparse-models)

66.4%

on Terminal-Bench 4.0

−85%

boundary circumvention vs Opus 5

[Read The Opus 5.5 System Card](https://www-cdn.anthropic.com/fc1b44717c85dc068bc6ba5024219938094694bd/Claude%20Opus%205.5%20System%20Card.pdf?utm_source=newsletter.aibutsimple.com&utm_medium=referral&utm_campaign=claude-opus-5-5-agent-swarms-writing-proofs-cheap-sparse-models)

| Presented by | ![ai, but simple pro](https://media.beehiiv.com/cdn-cgi/image/fit=scale-down,width=1200,format=auto,onerror=redirect,quality=80/uploads/asset/file/59bb099e-a38a-445e-8f0d-b6cd300aa85d/_UPDATED__AI__but_simple_Pro_banner__1_.png) |

### Discover The Techniques That Matter Before Everyone Else

![](https://media.beehiiv.com/cdn-cgi/image/fit=scale-down,width=1200,format=auto,onerror=redirect,quality=80/uploads/asset/file/f32673d5-e0d5-4903-ba1d-a0393f9d7a56/image.png)

With [PRO](https://www.newsletter.aibutsimple.com/upgrade?utm_source=newsletter.aibutsimple.com&utm_medium=referral&utm_campaign=claude-opus-5-5-agent-swarms-writing-proofs-cheap-sparse-models), unlock access to our AI research layer. Discover emerging techniques and hot topics across thousands of recent papers.

- Perform smart searches across papers, code, jobs, topics, and even interview questions.
- Get personalized daily overviews and a feed just for you. Pick from 10 preset roles or customize your dashboard.

Get full access to this article, as well as:

- Signals. Adopt, test, or skip recent techniques and models. We test efficiency savings and benchmark impact on our own infrastructure.
- Code with every issue (with practice examples + solutions)
- Ad-free reading

[Get AI Research Intelligence](https://www.newsletter.aibutsimple.com/upgrade?utm_source=newsletter.aibutsimple.com&utm_medium=referral&utm_campaign=claude-opus-5-5-agent-swarms-writing-proofs-cheap-sparse-models)

#### Open models are becoming more sparse to compete for cost efficiency

An increasing number of recent open-weight models are now competing on intelligence per dollar rather than capability.

Many releases do this with very sparse mixture-of-experts (MoE) layers:

- Xing4.0-29B-A4B [[model card]](https://huggingface.co/XingChen-AGI/Xing4.0-29B-A4B?utm_source=newsletter.aibutsimple.com&utm_medium=referral&utm_campaign=claude-opus-5-5-agent-swarms-writing-proofs-cheap-sparse-models) (sep 23rd) uses 4 experts out of 64 (plus one shared expert) per layer, activating 4B parameters from a total of 29B.
- A model from Yandex [[model card]](https://huggingface.co/yandex/AliceAI-Foundation-80B-A3B-Base?utm_source=newsletter.aibutsimple.com&utm_medium=referral&utm_campaign=claude-opus-5-5-agent-swarms-writing-proofs-cheap-sparse-models) is even sparser, routing tokens to 10 of 512 experts (3B out of 80B parameters).

Although this keeps compute low, the experts from standard MoEs only get training signals from the tokens routed to it.

This means every expert only learns from a small slice of the total data.

![](https://media.beehiiv.com/cdn-cgi/image/fit=scale-down,width=1200,format=auto,onerror=redirect,quality=80/uploads/asset/file/2f770210-d589-4068-9e0f-83614d4a730c/Opus_5.5_Prompt_Injection__Sparse_Models__Agent_proofs__6_.png)

A new paper, IntBMoE from Alibaba [[arxiv]](https://arxiv.org/abs/2609.21346?utm_source=newsletter.aibutsimple.com&utm_medium=referral&utm_campaign=claude-opus-5-5-agent-swarms-writing-proofs-cheap-sparse-models), solves this training participation problem while maintaining a sparse architecture.

It argues that other MoE designs merge three aspects together that should be independent:

1. Participation, which experts get a gradient from a token
2. Execution, how many experts are actually computed (compute cost).
3. Materialization, how many expert-sized parameter tensors must be computed and stored (memory cost).

IntBMoE separates the computation of expert weight matrices from the selection of experts. But how does that work?

Before any routing, it creates a small set of blocks, where each block is a weighted mix of every expert:

![](https://media.beehiiv.com/cdn-cgi/image/fit=scale-down,width=1200,format=auto,onerror=redirect,quality=80/uploads/asset/file/7e3b7258-6b2a-43eb-947f-88de3ac4fbaa/image.png)

Here, We is the weight tensor from expert e (E total experts), αb,e is the learned mixing coefficient (how much of We goes into block b), and 1/sqrt(E) normalizes the weights as the number of experts grows.

This mixing coefficient is important.

We obtain a block’s α coefficients using a small hypernetwork, which is a model that generates parameters for another model.

It has one learned vector per block, which they refer to as a “codebook” vector.

A router then sends each token to its top k blocks, just like a standard MoE, except it chooses among K blocks instead of E experts.

![](https://media.beehiiv.com/cdn-cgi/image/fit=scale-down,width=1200,format=auto,onerror=redirect,quality=80/uploads/asset/file/d4f2bc56-8c2e-4605-ba75-db02edd5f2ab/Opus_5.5_Prompt_Injection__Sparse_Models__Agent_proofs__4_.png)

This fixes the learning problem. From the chain rule, every block contains every expert, so every token's gradient reaches all E expert bases, scaled by the coefficients.

Note that this requires more compute than sparse MoE methods but is cheaper than other methods of obtaining full expert participation.

The idea is elegant, but the paper does not test it at a huge LLM scale, just on a 24M parameter model.

And what about the cost of models already released?

- Edge0-35B-A3B-preview [[arxiv]](https://arxiv.org/abs/2609.18063?utm_source=newsletter.aibutsimple.com&utm_medium=referral&utm_campaign=claude-opus-5-5-agent-swarms-writing-proofs-cheap-sparse-models) (Edge0) keeps the experts on SSD and uses a “prerouter” to predict which ones to load.

[▲100+ upvotes on HF Papers](https://huggingface.co/papers/2609.21346?utm_source=newsletter.aibutsimple.com&utm_medium=referral&utm_campaign=claude-opus-5-5-agent-swarms-writing-proofs-cheap-sparse-models)

+1.98

Top-1 points over SMEAR

2.4%

UVCTR lift in AMap A/B test

[Read The IntBMoE Paper](https://arxiv.org/html/2609.21346v1?utm_source=newsletter.aibutsimple.com&utm_medium=referral&utm_campaign=claude-opus-5-5-agent-swarms-writing-proofs-cheap-sparse-models)

#### Agent swarms are now writing math proofs

AI labs are now writing formal proofs for large math problems. OpenAI and Anthropic recently used agent swarms to produce the proofs.

How did they do it?

Agents write code in Lean [[language]](https://lean-lang.org/?utm_source=newsletter.aibutsimple.com&utm_medium=referral&utm_campaign=claude-opus-5-5-agent-swarms-writing-proofs-cheap-sparse-models), a programming language and proof assistant, and a small program called the kernel verifies every step.

![](https://media.beehiiv.com/cdn-cgi/image/fit=scale-down,width=1200,format=auto,onerror=redirect,quality=80/uploads/asset/file/b1ab7715-7598-4817-a7cd-73cbc3da9e84/Opus_5.5_Prompt_Injection__Sparse_Models__Agent_proofs__5_.png)

Typically, we set up an iterative agent loop:

1. Model writes Lean code
2. Kernel reports errors
3. Model fixes them until the proof compiles

OpenAI's Navier-Stokes proof [[blog]](https://openai.com/index/navier-stokes-solution/?utm_source=newsletter.aibutsimple.com&utm_medium=referral&utm_campaign=claude-opus-5-5-agent-swarms-writing-proofs-cheap-sparse-models) resulted from a swarm of roughly 10,000 agents, taking 88 hours, followed by 17 hours of formalizing the proof in Lean with GPT-6 Astra.

Anthropic's Fermat's Last Theorem project [[blog]](https://www.anthropic.com/research/formalizing-fermats-last-theorem?utm_source=newsletter.aibutsimple.com&utm_medium=referral&utm_campaign=claude-opus-5-5-agent-swarms-writing-proofs-cheap-sparse-models) used “dozens” of agents to write 13 million lines of Lean for 11 days and proved 29,500 intermediate theorems.

![](https://media.beehiiv.com/cdn-cgi/image/fit=scale-down,width=1200,format=auto,onerror=redirect,quality=80/uploads/asset/file/02a5db28-a8fd-4f91-a6d7-ec4899bb0de2/Opus_5.5_Prompt_Injection__Sparse_Models__Agent_proofs__2_.png)

But can we even analyze and trust a proof that large? The key is a rigorous verification process.

Both OpenAI and Anthropic used a tool called Comparator [[github]](https://github.com/leanprover/comparator?utm_source=newsletter.aibutsimple.com&utm_medium=referral&utm_campaign=claude-opus-5-5-agent-swarms-writing-proofs-cheap-sparse-models) that verifies an agent’s proof against a human-approved statement.

- A challenge file is written or checked by humans, which states the theorem and important definitions
- A solution file, written by the agents, restates the theorem with a full proof.

Comparator builds the solution in a sandbox, treating the agents' file as adversarial.

Then, the solution passes only if the statement matches the challenge file, if the proof doesn’t use additional axioms beyond Lean’s standard ones, and if the kernel accepts it.

OpenAI also runs a second, independently written kernel in case one fails.

Although a multi-step verification process is a strong guarantee, whether the Lean statement faithfully shapes the mathematical problem is still human judgment.

As of now, OpenAI's result is under review by mathematicians. Here are other resources on using agents for proofs:

- Prove2Me [[arxiv]](https://arxiv.org/abs/2608.28433?utm_source=newsletter.aibutsimple.com&utm_medium=referral&utm_campaign=claude-opus-5-5-agent-swarms-writing-proofs-cheap-sparse-models) (Columbia) coordinates agents through a shared graph of theorem statements. It was the platform Anthropic used.
- Claude Opus 5.5's system card we discussed prior also shows a 100-agent proof team.

[▲1.3K+ points on Hacker News](https://news.ycombinator.com/item?id=49613262&utm_source=newsletter.aibutsimple.com&utm_medium=referral&utm_campaign=claude-opus-5-5-agent-swarms-writing-proofs-cheap-sparse-models)

~10K

AI agents run in parallel

88 hrs

from launch to blow-up proof

[OpenAI’s Navier-Stokes Solution](https://openai.com/index/navier-stokes-solution/?utm_source=newsletter.aibutsimple.com&utm_medium=referral&utm_campaign=claude-opus-5-5-agent-swarms-writing-proofs-cheap-sparse-models)

#### Wrapping up

Opus 5.5 turned out to be susceptible to prompt injections. During training, it learned that anything in the user's message comes from the user, which let pasted text carry injections.

Retraining fixed the obvious cases, but plausible user-like instructions are still not fully handled.

IntBMoE trains experts with full participation at sparse compute cost, though it has only been tested on a 24M-parameter vision model.

Lean and Comparator can verify proofs far too large for people to read, but checking that the theorem statement matches the real problem is still human work.

That's it for this week's free version of AI, but simple. Get deeper analysis, ad-free reading, and access to whole archive with PRO. See you next week!

---

Here's a special thanks to our biggest supporters: Sushant Waidande, Sai Krishna Pashapu, Bob Boncella, Demet Yazici, Imran Khan

Want to reach 10000+ AI engineers, researchers, and technical founders? Advertising Inquiries:

[WORK WITH US 📈](https://tally.so/r/A7Dgdk?utm_source=newsletter.aibutsimple.com&utm_medium=referral&utm_campaign=claude-opus-5-5-agent-swarms-writing-proofs-cheap-sparse-models)

Feedback or inquiries? Send us an email at [edwin@aibutsimple.com](mailto:edwin@aibutsimple.com)