Anthropic Wants to Sit Between AI and Machines

In the limitations section of Anthropic's announcement this week, the company says its model does not reliably anticipate foam forming in a sample. You shake a liquid, you get bubbles. The announcement that limitation sits inside proposes that any model should be able to discover and operate every programmable device in a lab, from the microscope to the laser to the robot arm. On the same day, a federal judge threw out the Pentagon's blacklisting of that same company, in a fight that started when it refused to let its models drive fully autonomous weapons, and which The Register points out was fought over capabilities those models do not have. Two stories, one company, one day, and the physical world is the thing neither side checked against.

Anthropic's Model Hardware Standard

Anthropic previewed a driver specification that gives an agent two operations on any device, read a value and write a value, plus a discovery format and a plain-language file describing what the device is. Safety limits live inside the driver, where the model cannot argue with them. It is the lab's first explicit move into physical AI, it landed weeks before an expected public filing, and the engineers who would have to implement it spent the week asking how it differs from what they already run.

The name gives you nothing, so here is the problem it claims to solve. Say you have a lab with a microscope, a liquid handler, a laser and a robot arm in it, and you want a model to run all four. Today somebody writes glue code. They read the manual, work out the command set, handle the quirks, and produce a wrapper that works for that instrument and nothing else. I have written that code for sensors on a vehicle, and it is the least transferable work in the building. Change the instrument and you start again.

Device driver: the software layer that translates a general command ("move to this position", "read the temperature") into the specific bytes a particular piece of hardware expects. Every operating system you have used is mostly drivers by volume. It is unglamorous, and it is the reason you can plug a mouse into any computer without thinking about it.

The Model Hardware Standard, previewed on 27 August, proposes that every programmable device expose the same small surface.

The first three are engineering hygiene. The fourth is the interesting one, and it is where I think the idea earns its keep.

Why the reference file is the new part

That reference file holds the knowledge that has never been in the code. What the instrument weighs. What it is rated for. Which parameters you may touch and which will break something. That knowledge lives in a paper manual in a drawer, or in the head of the technician who has run the machine for years, and it was always inaccessible to software because software had no way to use prose.

Language models changed that side of the equation, and the standard is built on the change. Tacit knowledge becomes text, and text is the one thing these systems handle well. On the Open Robotics forum, Ido_Yahalomi placed it as "a Layer-0 driver and description standard, in the same family as URDF and SDF", which is the fairest description I saw anywhere this week.

Where the safety limits live

The limits are enforced at the device, inside the driver, not inside the model. If an agent asks for more laser power than the instrument is rated for, the driver refuses. The model does not get a vote and cannot reason its way to a different answer.

That is the right architecture, and it is the same principle behind every safety-rated controller I have worked next to. You never put a hard limit somewhere a confident system can talk past it. On Hacker News, wren6991 raised Therac-25 as the precedent, which is the correct reference for what happens when a software layer is trusted with physical actuation and the interlocks sit in the wrong place.

But a hardware bound constrains the magnitude of an action rather than its appropriateness. The driver can stop the laser going to eleven. It cannot tell you that firing at a legal power into the wrong well ruins the experiment. Anthropic's own stated weakness is that the model lacks physical intuition, which is a weakness about which permitted action is the right one, and device-level bounds do not touch that class of error.

Prior art, and what the engineers said

The reaction from people who build this for a living was not admiring. The Hacker News thread ran to 133 points and 59 comments and is unusually well-informed. Animats asked how this differs from ROS 2, "roughly the same goals". randomblock1 pointed at the standards lab automation already has, and heisenzombie listed four more. iFire invoked XKCD 927, the one about the fifteenth competing standard. wongarsu was blunt: "that's just USB. USB HID does all of that."

The objection is largely correct on the mechanics. Read and write over a discovered device is not a new idea, and the people who ship instrument control have had versions of it for decades. What none of them carry is the prose layer, and none were designed for a consumer that reads English. That is a real difference, and it is small. Whether it justifies a fifteenth standard is a question the thread asked and Anthropic has not answered.

The sharpest objection was procedural. sinab noted that you cannot read the specification, because access is by application during the research preview. So the open standard, the one whose whole value proposition is that everyone converges on it, is currently a document you have to ask permission to see.

Why a model lab writes a driver spec

Episode three left an open question here. Does a frontier lab heading into a public listing stay serious about the physical world, or does the quarterly clock push that work out? Both the standard and the ruling land about three weeks before an expected public S-1, one that reporting suggests could value the company around $2 trillion. Half of the question is answered, sooner than I expected. Anthropic moved before pricing rather than after.

The bet has a particular shape, though. The standard is model-agnostic, reachable over MCP (the Model Context Protocol, the company's earlier standard for connecting models to tools), and promised as open source after the preview. That reads as generosity. I read it as a position. Anthropic is not building the machines or the policies that run on them. It is claiming the layer in between, and boring layers are where lock-in lives. Nobody thinks about USB until the day they need a cable, and by then the decision was made for them fifteen years earlier.

Limitations

The specification is unreadable to outsiders right now, so treat this section as a review of an announcement rather than of the thing it announces. No independent implementation exists that I could find, no adopter outside Anthropic's own programme has been named, and the discussion thread on the one forum where the relevant engineers gather, asking which ROS 2 conventions the reference files should align to (URDF joint limits, ros2_control interfaces, sensor_msgs field names), had no replies when I checked.

And the foam. The company proposing to become the standard interface between models and physical machines used its own launch post to tell you its model cannot reliably predict that shaking a liquid makes bubbles. I give them real credit for printing it, and it is the most useful sentence in the announcement.

Further reading: - Model Hardware Standard research preview, the primitives, the reference files, the device-level safety model, and the limitations list - Hacker News discussion, the prior-art objections and the application-only complaint - Where does an intent-validation layer sit relative to MHS and ROS 2?, the Open Robotics thread, still unanswered

The Pentagon blacklisting, and the ruling that undid it

A federal judge found the Pentagon's designation of Anthropic as a supply-chain risk illegal and retaliatory. It is the first US court ruling on whether a model provider may refuse to let its systems drive a weapon, and the answer for now is that the refusal is protected expression rather than a defect in the product.

The dispute started in February. Anthropic told the Defense Department there were two uses of its models it would not permit: fully autonomous weapon systems with no human oversight, and mass domestic surveillance.

Supply-chain risk designation: in procurement terms this is close to a commercial death sentence. It bars a company from an entire economy of military contractors, suppliers and partners, not one deal.

Judge Lin held that the administration had retaliated against constitutionally protected activity and violated Fifth Amendment due process, and wrote that "the empty invocation of national security is not a blank check to punish and retaliate against government critics." The detail that stays with me is that Hegseth called the model's capabilities "exquisite" and the company's safety concerns "understandable" in the meeting, then gave it three days.

Every company building embodied AI will eventually face some version of this question, most of them with far less legal budget, so the precedent matters well beyond one lab. The ruling protects a provider that refuses. It says nothing about whether a provider that permits autonomous-weapons use carries liability for what follows, and that case has not been brought.

The Register supplied the week's most useful reality check by pointing out that the Pentagon blacklisted the company over capabilities its models do not have. The lab is candid in its own announcement about how little its model understands the physical world, the same week the government spent six months treating that model as an autonomous weapons system. The physical world is where either claim would get settled, and the fight happened entirely without it.

Further reading: - Axios on the ruling, the order, the finding of retaliation and the timeline - NBC News on the same ruling, with more on the February meeting - The Register's read, on the gap between the designation and the model's actual capabilities

Unitree halves while XPeng's humanoid unit raises $900M

The public market marked Chinese humanoids down by half and the private market wrote the sector's largest cheque ever, inside the same five days. Nothing underneath either company changed in that window.

Last week this show led on Unitree's debut. Since then the stock has given back roughly half its value.

I want to be careful about how that gets read, because a drop of this size invites you to treat the market as having agreed with something. Nothing underneath the company changed in five sessions. The halved profit was in the filings. So was the three-quarters research-and-education revenue mix. All of it sat in the prospectus before anyone bought a share, so what happened is the price walking back toward information that was already public. Dong Chen of Bank J. Safra Sarasin put it plainly to SCMP: "Given that level of uncertainty, Unitree's high valuation is probably not justified."

And after halving, the company is still worth more than four times what its own lead underwriter thought it was worth. That is the number to hold on to.

In the same week, the private market went the other way. XPeng's humanoid unit Dogotix raised over $900M, the largest single private financing Chinese embodied AI has recorded, with IDG Capital leading and Alibaba, Tencent and Gaorong Ventures participating, at a $5B pre-money and just over $6.3B post. Dogotix builds the IRON humanoid for retail and industrial work.

Its stated target is 1,000 IRON units a month by the end of 2026, with commercial deliveries starting in 2027. A thousand a month by December, and the first commercial delivery is fourteen months behind that. There are honest ways to reconcile those, including internal deployment, pilot fleets and data collection. Nobody is currently required to say which, and somebody should ask.

The two prices cannot both be right, and the difference is not only sentiment. A public price is discovered by strangers every second. A private round is negotiated once, by people who benefit from the mark. Worth remembering before treating a $6.3B post-money as a second opinion on the $37B.

Meanwhile four founders in the business spent the week talking the sector's timeline down to TechCrunch from the Actuate conference. Antioch's Harry Mellsop put physical AI in its "GPT-2 era". Wayve's Alex Kendall said manipulation robotics is like self-driving five years ago. Foxglove's Adrian Macneil, whose company sells robotics data infrastructure, said flatly that "there will not be a ChatGPT moment for robotics." Days earlier in Beijing, the head of the Beijing Embodied AI Center said the industry had "moved from performing tricks to industrial logic and actual deployment" and that "we are on the eve of the 'ChatGPT moment' for embodied intelligence." Two continents, one week, opposite claims, and the money moved both ways to match.

Further reading: - SCMP on the drawdown, the five sessions, the underwriter's range and the revenue mix - The Robot Report on the Dogotix round, investors, valuation and the production target - TechCrunch from Actuate, four founders on the record about their own timeline - Christian Science Monitor on China's embodied-AI strategy, shipment numbers, the state mandate and the 30%-of-human-efficiency figure

The Beijing Games rulebook

Three humanoids ran the 100 metres faster than Usain Bolt's world record, fully autonomously. In the 100-metre hurdles you are still allowed a human with a controller. The rulebook is the most honest capability assessment published this week, and it came out of an event's terms and conditions.

The second World Humanoid Robot Games ran at Beijing's National Speed Skating Oval from 22 to 26 August, with 666 teams from 16 countries, 2,056 robots and 51 events.

Those jumps in one year are startling, and the sprint times are a real result. Now the rule change nobody covered as the story it is. This year, all the flat track events (100m, 400m, 1500m, 4x100m relay), plus table tennis and freestyle fighting, must run fully autonomously with no remote control. The 100-metre hurdles and the new weightlifting event still permit teleoperation.

Teleoperation: a human drives the robot, through a game controller or a motion-capture rig, and the robot is a very good puppet. It is why a viral clip of a humanoid doing something impressive tells you close to nothing on its own. Teleoperation is also one of the ways demonstration data gets collected, so it is not a dirty word. It just is not autonomy.

The organisers drew that line where the control problem stops being solved. Running fast in a straight line on flat ground, they were confident enough to require autonomy. Stepping over an obstacle at speed, or lifting a heavy variable load, they were not. No benchmark paper this week says anything that clean about what humanoids can do unaided, and this one had to be honest because hundreds of teams were going to test it in public.

One caveat for anyone comparing year on year. Last year's track events allowed remote control and this year's do not, and coverage notes the runners struggled more than last year. Some of that is the rule change rather than regression, and the two are not separable from the results table.

The failure reel travelled further than the results, and it deserves to. Gizmodo catalogues a robot that hit an obstacle and caught fire at the end of the 100m, a weightlifter that toppled into the judges' table, a high jumper whose head came off, and cheerleader robots that would not stop shaking.

The gait that came out of a thermal limit

The thing I loved most this week came out of the 400m. X-Humanoid's Tien Kung Omni won its small-group final in 45.66s, running with its centre of gravity pitched forward and its arms held high near its face, swinging wide while the hips counter-rotated underneath. Nothing like a human sprinter. The clip went round China as the robot that covers its face while it runs.

Its engineers did not design that. Han Gang, a motion control algorithm expert at X-Humanoid, told Global Times: "We initially designed Tien Kung Omni's gait around a human-style arm swing. It feels that this is more comfortable." The gait emerged in simulation, from continuous rewards on efficiency.

The mechanism is fascinating. Swinging the arms hard loads the shoulder joints. The joints heat up. Power draw climbs. The robot cannot finish the 400. Holding the arms high unloads the shoulders and leaves the power budget for the legs.

So a learned policy found a physical constraint its designers had never encoded, the thermal budget of an actuator, and routed around it by changing the shape of the motion. This is the AlphaGo move-37 pattern, with heat in a shoulder joint as the thing being exploited. And here is why I think it is the good version of that pattern. Usually when a learned system exploits something in simulation, the simulator was wrong and you find out on hardware. This time the exploit transferred, because the constraint was real and the simulator had it right.

Credit to Global Times, too, for running a piece specifically to establish that the posture was spontaneous rather than designed. Press coverage correcting downward on intentionality is rare enough to name.

Further reading: - Beijing's official summary of the Games, the entry numbers, the results and the autonomy rules - Global Times on the emergent gait, Han Gang on the arm swing they designed and the one they got - Gizmodo's failure reel, useful calibration against the highlight clips

World models, audited on a third axis

Two independent results landed this week. One shows video world models produce believable futures with the wrong probabilities attached. The other explains why this took so long to catch: of 163 world-model papers with a working implementation, six let you ask the model what it thinks the state of the world currently is.

World model: a system that has learned how the world behaves well enough to predict what happens next. Show it a scene and an action, and it produces what it thinks you would see. Robotics wants these badly, because a good one lets you train and evaluate policies inside it instead of paying for robot time, broken objects and human supervision.

This show has been auditing them since episode one, and the record is not good.

What PAWBench measured

Everyone has been scoring these models on whether a generated rollout looks plausible. But most physical situations do not have one outcome. Nudge a cup toward the edge of a table with the same push from the same starting position, and sometimes it topples and sometimes it settles back. The real question is whether it produces each future about as often as reality does.

PAWBench formalises that as probabilistic alignment. Its harness runs each scenario repeatedly, turns the sampled rollouts into an empirical distribution over physical outcomes, and compares that against reference probabilities. Across 50 scenarios and 11 systems, no model consistently matched the reference probabilities while also recovering the range of valid behaviours.

Roll the dice a hundred times in a simulator like that and you get a hundred believable futures with the wrong odds attached. For anything downstream that depends on risk, and that is planning, evaluation and every safety case I have ever had to write, the odds are the entire point.

Six out of 163

The result that struck me harder was a survey from Tong Wang and colleagues, assessing 200 works published between 2018 and June 2026 against eight capabilities you expect a simulator to have, and asking whether generative world models can functionally replace a physics engine.

Their answer is partial substitution for interaction and controllability in specific scenarios, with no formal guarantees on physical law and no reproducible long-horizon evolution. Then comes the headline number. Of the 163 papers with a real implementation, 6 expose a runtime interface for querying entity states or physical parameters. They name first-class state feedback as the field's most neglected priority, and I think they are right.

A physics engine you can interrogate. Where is the block. How fast is it moving. What friction coefficient are you using. With almost every generative world model you get video out and that is it. You watch it and you guess.

This is also the structural explanation for a gap episode two ran into. WorldSimProbe could only test six open-source models against the Observable Simulator Contract, which looked like a small sample at the time and turns out to have been close to the whole population. You cannot audit a simulator that has no way to answer a question about itself.

The constructive results

Two papers this week went the other way, and both reached for the same tool.

RLHEV, from Pengfei Zhou and colleagues at NUS, argues that scaling world models with more video and more compute is the wrong axis, and that what is missing is grounded reward. Their proposal uses game engines as the environment, on the grounds that "a scene encoded by a game engine is an executable world specification", so collisions, physics violations and navigability are checkable for free rather than proxied through something like a CLIP score. Code agents got good partly because a compiler tells them when they are wrong, and world models have never had one. It also answers episode two's question about where failure data comes from at scale. If failure is checkable, it is generable, and nobody has to pay for a robot to break a real object. It is still simulation, and still no hardware. Code World Model arrives at the mirror image, keeping persistent world state in executable code and compiling a rendered video out of it.

The clean win is LAWA, and it settles an argument this show has carried since its first week. The question was whether a policy needs to imagine the future while it is running, generating the frames it expects to see before it acts. Episode one's Fast-WAM said run-time imagination was optional. Episode three's τ₀-VLA said it was valuable. LAWA says the expensive part was the rendering rather than the imagining, and represents the imagined future as compact latent actions anchored to discrete action tokens, never generating a frame.

Also evaluated on LIBERO-Plus and on real hardware. The latency number is the one I would lead with. Anyone who has shipped a policy onto a vehicle knows that a 40% cut in inference latency is often the difference between a model that runs on the platform and a model that stays in the lab, and it is a much harder number to buy than a couple of points of task success.

Limitations

PAWBench's reference probabilities have to come from somewhere, and defining a discrete "physical outcome" for a continuous scene is a modelling choice the authors made. One benchmark, one group, no independent reproduction. The survey covers published work only, so a closed frontier system with an excellent state API would not appear in it, and episode two's question about the closed models is still open. LAWA is one architecture on RoboCasa, LIBERO-Plus and some real tasks, and comparable performance at lower latency needs replication on a different task distribution before I would design around it. For balance, RISE argues for adaptive gating of rollouts rather than dropping pixels wholesale. It was submitted on 20 August, so it is context here rather than this week's news.

Further reading: - PAWBench, probabilistic alignment, the repeated-rollout evaluation, 50 scenarios and 11 systems - From Generation to Simulation, the 200-work survey, the eight capabilities and the 6-of-163 finding - LAWA, latent action as intention, and the latency result - RLHEV, game engines as executable world specifications and a source of free negative data

Also this week

Autonomy that already earns money. Gatik raised a $200M Series D led by the Qatar Investment Authority and Koch Disruptive Technologies, on the back of 85,000 completed fully driverless orders at 99% on-time delivery and more than $600M of contracted revenue, running dozens of trucks on fixed distribution-centre-to-store lanes for PepsiCo, Kroger, Tyson Foods and Georgia-Pacific. The metric it leads with is the interesting part. Not miles, not disengagements, but whether the groceries showed up when Kroger said they would. A sector that has argued for a decade about how to measure autonomy quietly started reporting the number the customer cares about. Full disclosure, I lead AI at Kodiak, which operates in autonomous trucking.

Excavators with nobody in the cab. Bedrock Robotics put operator-free retrofitted excavators on three live commercial sites, including a 1.2-million-cubic-yard civil sitework project with Zachry Construction. Perception, planning and execution run onboard, with person-in-the-loop remote oversight, and CTO Kevin Peterson describes the behaviour this way: "The system monitors itself, and it looks to see what it's doing, whether it's making progress, and it'll call home if it gets stuck." The company has raised $350M and does not disclose fleet size. This is autonomy earning money outdoors, unstructured, with people and heavy equipment moving around it, which is the setting most robotics papers exclude by construction.

Europe's high-risk rules arrived and skipped the robots. The EU AI Act's high-risk regime became applicable on 2 August, bringing conformity assessment, technical documentation, CE marking and registration, with penalties up to €35M or 7% of global turnover. Amendments moved AI systems embedded in regulated products, which is where industrial robots and machinery sit, out to 2 August 2028. So the deadline every robotics compliance team spent two years preparing for arrived and did not apply to them. What regulates a humanoid on a European factory floor today is still ISO 10218 and ISO/TS 15066.

Four VLA papers worth your time. Zero-WAM treats a human demonstration video as an in-context prompt rather than as training data, so specifying a new task means showing it rather than finetuning. It reaches about 47% success on seven unseen simulation tasks, a jump of 29.5 percentage points. The improvement is large, and 47% is still a coin flip that loses. StreamPI gives π₀.₅ a memory across frames with no additional parameters, and trains at random frame intervals to match asynchronous real-robot timing. MA-VLA reports that prior state-of-the-art VLAs largely fail at unseen multi-arm collaboration. Treat a negative result from a group selling the replacement with the usual caution, but the underlying claim is sound. Two arms is not one arm twice. TacForcing names a timing artifact cleanly. A VLA generates a whole action chunk before execution starts, so by the time the robot moves, the tactile reading that shaped the chunk is stale, and the robot is acting on how the object felt a moment ago. Streaming generation during execution gets 69% average success on three real contact-rich tasks and removes the need for a separate high-frequency reactive controller.

Compute, quietly. NVIDIA reported $96.22B in Q2 FY2027 revenue, up 106% year on year, with Data Center at 92% of it. Robotics and automotive now sit inside an Edge Computing bucket rather than being broken out, so the company supplying most of the compute this field runs on reports robots in the same line item as game consoles. The Jetson Orin Nano 2 was also announced at 78 TOPS, twice the inference of its predecessor at 40% lower power, with no price and nothing shipping until the first half of 2027.

This week in one table

What we're watching

Does anyone outside Anthropic's partners pick up the Model Hardware Standard, and does it converge with ROS 2 or compete with it? The question is sitting on the Open Robotics forum with no replies. Whether it gets one, and from whom, is the tell.

Does an open standard nobody can read attract implementers? MHS is application-only during the preview, and every week that stays true is a week the existing instrument-control standards keep the position by default.

Who brings the other autonomous-weapons case? Judge Lin's ruling protects a lab's right to refuse. It does not touch whether a lab that permits such use bears liability for what follows, and that gets decided by somebody's litigation strategy rather than anyone's safety policy.

Are device-level limits enough when the failure mode is a confident model doing a permitted thing that is wrong? Hardware-enforced bounds are the mitigation on offer. Bounds constrain magnitude. They say nothing about judgment.

Where does Unitree settle, and which comparable does the Dogotix round get marked against? Whether the private mark gets checked against the public one, or the other way round, decides how the next Chinese humanoid round gets priced.

Does anyone reconcile a production rate with a delivery date fourteen months behind it? A thousand IRON units a month by December, first commercial deliveries in 2027. There are good answers, and nobody has been asked for one.

Where do the Beijing organisers move the autonomy line next year? Whatever they make autonomous in 2027 will be a better capability metric than any number published this week, which makes it worth a standing annual check.

Does anything in production today depend on world-model outcome probabilities being right? PAWBench shows the odds are wrong. The follow-up is who relies on them, and whether they know.

Is first-class state feedback a convention the community adopts, or does it take a funder or a benchmark to force it? Six of 163 is a norm, and norms do not shift because a survey asks nicely. Note the irony that MHS is trying to impose this same discipline on hardware, from outside the field.

And one I am retiring or commissioning. Do physical prompt-injection defenses like text masking survive warehouse tasks that require reading real labels? Open since episode one, no movement in three weeks. If you have run this experiment, I would like to hear from you.