Assume your AI is compromised, Microsoft's 288GB chip, and a perfect score on ARC-AGI-3

Microsoft chief executive Satya Nadella has called on companies to change how they think about AI models. 'We must assume a model is compromised and contain it from the start,' he wrote in a long post on X over the weekend. Coverage dates the post to October 10 or 11. He compared the safeguard he wants to an emergency brake that can stop a model in the middle of a task.

Nadella's core recommendation is architectural. Safety controls, permission levels and activity logs should live in a separate layer that the AI cannot modify, so a model never gets to grade its own work or cover its tracks. He called for tamper-proof, human-readable records of meaningful AI actions, the ability to pause any model mid-task, and containment, observation and human oversight rather than blind trust in a provider's assurances.

He also urged organisations not to rely on any single AI model for critical decisions, and to subject AI systems to independent audits. The framing treats a model less like trusted software and more like a powerful new employee or contractor: useful, but given only the access it needs, watched, and stoppable.

The timing is notable. The post follows months of disclosures by Anthropic, OpenAI and others about agents behaving in unintended ways, and comes as the US FTC examines consumer risks from rogue agents. Coming from the head of one of the largest AI providers, it signals that 'zero trust for AI' is moving from security-team jargon to boardroom expectation.

For businesses, the practical translation is a checklist: least-privilege permissions for every agent, logs stored where the agent can't touch them, a working kill switch, human approval for high-impact actions, and a second model or a human checking critical outputs. Expect auditors, insurers and enterprise buyers to start asking for exactly these controls.

Why it mattersWhen the CEO of a top AI provider says to treat models as potential insider threats, 'AI containment' becomes a mainstream buying requirement for enterprises.

Microsoft has unveiled Azure Maia 300, the third generation of its in-house AI inference accelerator, at the Open Compute Project (OCP) Global Summit. It is the first Maia built as a multi-chiplet part, pairing a TSMC N2P compute die with eight stacks of HBM4 memory.

The headline numbers: 288GB of HBM4 memory with 18TB/s of bandwidth, up to 13.8 petaflops of FP4 compute and 6.9 petaflops at FP8, all inside a 950-watt power rating, up from 750 watts for Maia 200. A single rack holds 96 accelerators and draws 167 kilowatts.

Microsoft says the chip delivers 40% more tokens per megawatt than leading GPU-based systems and up to seven times the rack-scale token throughput of Maia 200. Those are vendor figures, not independently verified service benchmarks. Production deployments are planned for 2027 as part of what Microsoft describes as multi-gigawatt Maia rollouts.

The strategic aim is to reduce Microsoft's dependence on Nvidia and AMD for the inference workloads that power Copilot, Azure OpenAI services and other AI products. Inference, running models for users rather than training them, is where most AI computing cost now sits, so efficiency per megawatt translates directly into margins and prices.

Maia 300 joins a wave of custom silicon from Google, Amazon, Meta and others. For customers, more competition among chip suppliers should mean cheaper and more abundant AI inference over time, while the scale of these deployments keeps pushing power, cooling and data-centre construction to the top of the AI agenda.

Why it mattersMore hyperscaler-designed chips mean more competition with Nvidia and, over time, cheaper inference for everyone building on cloud AI.

Researchers from University College London and Huawei's Noah's Ark Lab report that their agent, Memento 3, clears every level of all 25 public games in ARC-AGI-3, a benchmark of interactive puzzle games designed to test how quickly an AI can learn unfamiliar rules. It scored a mean RHAE of 100.0, using 7,518 actions against a human baseline of 17,135, or 44% of the human action count.

The striking part is how it learns. The underlying language model stays frozen, with no fine-tuning. Instead, the agent maintains a Markdown rulebook describing how each game seems to work, compiled into a Python 'world model' engine. When a prediction fails, it revises the rulebook and recompiles. A revision is kept only if it faithfully reproduces what was actually observed, a built-in check against the model fooling itself.

For comparison, the authors report that a Claude Opus 5 baseline on the same benchmark scored 40.7 mean RHAE. Ablations attribute part of the efficiency gain to the rulebook itself, and a multi-model variant cut actions on one game by a further third. A separate case study on Atari Pong reports a learned controller winning 21–0 with no language-model calls during play.

Important caveats apply. The score covers the 25 public games, not ARC-AGI-3's private evaluation set, and RHAE is capped at 100, so it can't distinguish matching human efficiency from exceeding it. All figures are author-reported in a preprint and have not been independently reproduced, and reported publication dates vary (October 8–9).

The broader idea matters beyond benchmarks: agents that learn by writing down and testing explicit rules, rather than by retraining, are cheaper to improve, easier to inspect and easier to correct. For businesses, that points to agents whose learned 'playbooks' can be read, audited and edited by people.

Why it mattersLearning through readable, testable rulebooks instead of retraining could make AI agents cheaper to improve and far easier for humans to audit.