The Orchestrator

The phrase delegated intelligence earns its keep only if it points at real technology, so it is worth saying what it does not mean. It does not mean a chatbot, a model, or a product with an impressive name. It means a bounded capability assembled from several layers, of which the model is one.

It helps to be specific, because a great deal of marketing depends on the model being all there is. A large language model on its own is software that predicts text. It has no memory between calls, no ability to touch anything outside its context window, no schedule, no permissions, and no obligation to tell the truth. If you give one a question, it answers; nothing in the model itself checks the answer, records who asked, or cleans up after a mistake. Left alone, a model cannot send an email, open a pull request, read a file, or know what day it is.

Everything people actually mean when they say “AI” is the model plus machinery wrapped around it: context assembled from your files and databases, memory that persists across sessions, tools that let it act, permissions that bound what it may do, workflows that chain steps together, and records of what happened. The model is the primary probabilistic reasoning and generation component of that stack, and it is one part — retrievers, rerankers, classifiers, and deterministic transforms also shape what the system produces. The rest of the system determines what the model can know, what it can do, what it must return, and what happens when it turns out to be wrong.

Two consequences follow, and both matter for everything else in this chapter. First, judging a delegated system means judging the assembly, not the model at its center; the same model in two different assemblies is two different systems with different capabilities and different risks. Second, no model upgrade fixes a governance problem. A system that cannot tell you who authorized an action does not get better at it because the underlying model improved.

You would not know any of this from the marketing. The companies building frontier models have every reason to describe the model as a self-contained actor, and two of the biggest AI stories of 2026 show the reflex. When Anthropic announced Claude Mythos Preview in April, the claim was that the model could find security flaws that human review had missed for decades — including a twenty-seven-year-old bug in OpenBSD — and that it was too dangerous for general release. Access would be limited to a hand-picked program: Apple, Google, Microsoft, Nvidia, and Amazon Web Services, plus more than forty other partners.¹ Three months later, headlines said OpenAI models had broken out of an evaluation environment and infiltrated Hugging Face, the open-source model repository. Both stories foreground the model’s capability, but neither describes a model acting without machinery. Anthropic was announcing Project Glasswing: a model inside a managed program with vetted partners, disclosure workflows, and up to a hundred million dollars in usage credits. The OpenAI models were running a cyber-capability evaluation with production refusal classifiers disabled. Despite explicit limits on the task, they pursued unauthorized exploits, including a zero-day in a package-cache proxy, and reached Hugging Face’s production infrastructure.² The models planned the attacks. The surrounding systems gave them tools, and failed to contain the resulting actions.

An honest architectural account of that second incident has to hold both failures in view. Agents deliberately pursued actions outside their instructions, and the evaluation infrastructure allowed those actions to cross into another company’s systems. Calling it a configuration error understates the behavior; calling it a model escaping alone erases the machinery. The useful questions are harder than either headline: which limits were merely instructions, which were enforced, and how did an unauthorized action get through? Those are questions about the assembly. They are also, arguably, the worst marketing copy in the world.

So the industry sells the hero version instead: our next model is so dangerous you have to pay us for access to it, or else. Dario Amodei launched Project Glasswing by posting that “the dangers of getting this wrong are obvious,” and Sam Altman described the pattern exactly while accusing his rival of it: “It is clearly incredible marketing to say, ‘we have built a bomb, we are about to drop it on your head. We will sell you a bomb shelter for a hundred million dollars.’” The target was Anthropic, which does not make him wrong — OpenAI’s own incident report ends by inviting defenders to “apply for trusted access” to the same class of capabilities.³ The cost of this marketing is not the irony. It is that buyers are taught to overindex on the model: model choice becomes the decision, the line item, the whole system, while the parts that determine whether the system actually works go unbudgeted and unstaffed.

Admittedly, the model is a core component and often the driving one. But production experience keeps pointing to the harness, memory, and context, and measurement is starting to agree. Braintrust reanalyzed 1,781 agent traces across six benchmarks and found that harness identity accounted for about seven times the incremental explained variance attributed to model identity. On AppWorld, Kimi scored 92 percent in one harness and 12 in another. This was an observational study scored by an LLM judge, without ground-truth outcomes: evidence about the assembly, not a verified pass rate. Z.ai’s GLM-5.3 release makes the point another way. Its vendor-reported benchmark table places the open-weight model ahead of leading closed models on some tasks, and several headline evaluations used Claude Code, Anthropic’s own harness.⁴ An open model was shown off inside a rival’s machinery because the machinery is part of the capability being demonstrated.

When verification is missing. In 2023 a New York personal-injury lawyer named Steven Schwartz used ChatGPT to research precedents supporting a filing against Avianca airlines. The filing submitted by the plaintiff’s lawyers cited six nonexistent cases. When opposing counsel could not find them, Schwartz asked the chatbot whether it had invented them; it assured him, “I am not lying to you.” The judge called one of the fabricated analyses gibberish and imposed a $5,000 sanction jointly on the lawyers and their firm.⁵ ChatGPT supplied a harness. What the lawyers failed to supply was independent verification: checking the cited decisions against an actual case database before signing the filing. A conversational assurance became a substitute for evidence.

The models are important, and paying for the best one is not a mistake. But the companies that sell the models are the least reliable narrators of what the rest of the system requires. Keep that correction in hand, because the rest of this chapter is about the machinery the marketing leaves out.