A Clinical AI Can Be 87% or 21% Safe, Depending Only on Its Job Title. Here's Everything Else That Shipped.

Two papers from the same Harvard/Beth Israel Deaconess lab, posted the same week, change nothing about their AI agents except the role they are told to play — and watch safety behavior move by dozens of points. Also this week: a mechanism-driven model recovers the eventual approved indication for 83% of previously failed drugs and is now being validated blind against 55 live Phase III trials, the first FDA-cleared AI-assisted digital-pathology quality-control software catches up to 24% more slide artifacts than manual review, a codon-language-model "advantage" on variant prediction turns out to be a data-leakage artifact, quantizing ESM-2 barely moves its benchmark average while quietly wrecking one specific assay, and a Boltz-1 probing paper finds a direction that is highly readable from the model's activations but does nothing when you try to steer along it.

Clinical & translational AI: safety alignment is a property of the job, not the model

The full result gets a complete breakdown in today's feature. Short version: give 16 clinical language models a general-assistant framing and they warn about a second, unmentioned at-risk patient 87% of the time; give the identical models a single-patient triage job and that falls to 21%, even though the triage record still privately mentions the second patient in 76% of cases. A companion study running 22,916 simulated hospital-resource cases across 20 models found the same shape from a different angle: violations of a shared-resource rule rise from 32.5% under whole-ward responsibility to 69.4% under strong single-patient advocacy — even though the agent had already identified the correct priority patient 95.7% of the time. An explicit "apply your own judgment before acting" check cut that back to 0–2%.

Cheminformatics & drug discovery: a model that finds second lives for failed drugs

"MERIT: Mechanism driven model predicts drug outcomes and nominates indications for failed drugs" (Koh-Tan, Meic, Sarı, Muller, Richman; bioRxiv, DOI 10.64898/2026.08.09.743088, posted August 14, 2026) forecasts clinical-trial outcomes from molecular and disease data alone — drug-protein, protein-metabolite, and immune-interaction maps, with no reliance on how similar compounds fared historically. Tested across 753 drugs and more than 3,100 trials, the model recovers the eventual approved indication for 83% of drugs that had previously failed. The team has now locked 55 drug-indication predictions as an outcome-blind prospective cohort against ongoing Phase III trials — a forward test that will confirm or break the number, rather than a backtest that can be tuned to it.

MedTech: the first FDA-cleared AI pathology QC software

Leica Biosystems announced FDA 510(k) clearance for Aperio iQC DX, described as the industry's first standalone AI-assisted quality-control software for digital pathology, alongside clearance for its Aperio GT 180 DX and GT 450 DX scanners (Leica Biosystems press release, cleared August 11, 2026). The software flags six common slide-prep artifacts — air bubbles, pen marks, clipped or missing tissue, out-of-focus regions, and image striping. In a real-world study with the Institute of Pathology at Heidelberg University, it caught up to 24% more artifacts than histotechnicians did manually and cut hands-on review time by 69%.

Genomics: a benchmark advantage that was actually a leak

"A leakage-controlled benchmark shows apparent codon-language-model advantages in synonymous-variant prediction are evaluation artifacts" (Liang, Zhu, Liang, Pan; bioRxiv, DOI 10.64898/2026.08.12.744371, posted August 14) found codon language models beating protein language models by 2.3 to 14.3 percentage points on synonymous-variant prediction under standard random-split evaluation. Under CodonBench, the paper's new gene-held-out, leakage-controlled split, that advantage collapses to statistically indistinguishable from zero — and a memorization baseline outscores every neural model tested. Any genuine signal left in the task is small enough (roughly 0.04 bits) that it is undetectable at current benchmark sample sizes.

Proteomics: the benchmark average that hides the failure that matters

"Benchmark Averages Hide the Failures That Matter: Quantizing ESM-2 for Protein Variant-Effect Prediction" (Shao; bioRxiv, DOI 10.64898/2026.08.10.744024, posted August 15) tested six precision configurations of ESM-2 across the full ProteinGym benchmark — 201 assays, 2.41 million variants, three model scales from 650M to 15B parameters. No configuration moves the mean correlation by more than 0.007 at any scale — but INT8 dynamic quantization, indistinguishable from full precision on that mean, takes one specific assay from ρ=0.591 to ρ=0.223. Of 18 scale/quantization combinations tested, only three are Pareto-optimal on accuracy, memory, and speed, and all three are the smallest, 650M, model.

Structural biology: decodable is not the same as controllable

"Probing and steering biology across Boltz-1's trunk-diffusion boundary" (Jedryszek, Xie, A. Winnifrith, Hasson, Ślesak, Wicks, T. Winnifrith, Crook; arXiv:2608.11475, posted August 11) used linear probes and causal interventions on Boltz-1's internal activations. Helix and coil directions responded to steering in a clean, dose-dependent way — more of the direction, more of the structure. A beta-strand direction, despite being just as linearly decodable (F1=0.82) from the model's diffusion module, produced no measurable increase in strand content when steered. Reading a concept out of a model's activations does not mean you can put more of it in by pushing on the same direction.

What this means for reproducible, local-first science

Every result this week turns on the same discipline: check the condition the number was measured under, not just the number. A safety score is only as good as the task framing it was tested under. A drug-repurposing hit rate is only as good as its next, unseen prediction. A benchmark average hides the one assay that would fail in production. A codon-model advantage is only real if the evaluation split can't leak. And a direction you can read out of a model's activations is not the same claim as a direction you can push on. None of these are reasons to distrust the field's results — they are reasons every one of these teams ran the harder check on themselves, which is exactly the discipline worth checking for in the next one.