Plutonic Rainbows

On the Firefox exploit benchmark, Claude Mythos Preview produced 181 working exploits. Opus 4.6 managed two. Anthropic published those numbers yesterday alongside a 244-page system card and the announcement that it would not release the model to the public.

The March leak described a model with dramatically higher scores on coding, reasoning, and cybersecurity. I expected the official numbers to confirm that framing. They don't. They blow past it. Mythos was tested against roughly a thousand open-source repositories across seven thousand entry points and found zero-days in every major operating system and every major web browser. Some had been sitting in production code for decades.

A 27-year-old signed integer overflow in OpenBSD's TCP selective acknowledgment handling allows a remote attacker to crash any host from anywhere on the internet. In FreeBSD's NFS authentication layer, Mythos found a 17-year-old stack buffer overflow (CVE-2026-4747) and autonomously constructed a six-packet ROP chain to write an SSH key into root's authorized_keys. FFmpeg's H.264 codec has a flaw that automated fuzzing tools encountered five million times over sixteen years without flagging it.

The historical arc puts those numbers in context. DARPA's Cyber Grand Challenge in 2016 ran automated tools against purpose-built binaries. Google's Project Zero Big Sleep found one SQLite vulnerability in 2024 that 150 CPU-hours of fuzzing had missed. Last year's AIxCC competition found 18 zero-days across 54 million lines of code. The progression from five hundred bugs to thousands is not linear.

Instead of a general release, Anthropic launched Project Glasswing: a coalition of twelve companies including Apple, Microsoft, Google, AWS, CrowdStrike, and Palo Alto Networks, committed to using Mythos for defensive cybersecurity. Roughly fifty organisations total. Anthropic put up to $100 million in usage credits behind it and donated $4 million to the Linux Foundation and Apache Software Foundation.

Picus Security called it "the Glasswing Paradox": the thing that can break everything is also the thing that fixes everything. Anthropic's own disclosure puts a number on it. Fewer than one percent of Mythos-discovered vulnerabilities had been patched at announcement. Discovery is outrunning repair.

Weeks before the official announcement, Linux kernel maintainer Greg Kroah-Hartman described something shifting: "Something happened a month ago, and the world switched" from low-quality AI-generated vulnerability reports to genuine findings. Daniel Stenberg, who created curl, went from shutting down his bug bounty over AI noise to spending hours a day triaging legitimate ones.

Simon Willison called the restriction "necessary" while noting that saying a model is too dangerous to release is a great way to build buzz. The GPT-2 comparison is inevitable. But GPT-2's predicted harms never materialised, and 181 Firefox exploits did. Jack Clark, who co-founded Anthropic and now heads its public benefit division, has framed the core tension before: AI good at finding vulnerabilities for defense can easily be repurposed for offense.

Glasswing partners can access Mythos at $25 per million input tokens and $125 per million output, through Claude API, Bedrock, Vertex, and Microsoft Foundry. The broader situation is a timing problem. Defenders work at calendar speed. Attacks happen at machine speed.

Bloomberg reported on Sunday that OpenAI, Anthropic, and Google have started sharing threat intelligence through the Frontier Model Forum, the nonprofit the three companies co-founded with Microsoft in 2023. The arrangement works like a cybersecurity ISAC: when one company detects a suspicious query pattern, it flags the signature for the others.

The target is adversarial distillation. Chinese labs, DeepSeek, Moonshot AI, and MiniMax , have been systematically querying Claude, ChatGPT, and Gemini through fake accounts to generate training data for cheaper models. Anthropic's February disclosure put numbers to it: roughly 24,000 fraudulent accounts generating over 16 million exchanges with Claude alone. MiniMax accounted for 13 million of those. The operations used what Anthropic called "hydra cluster" architectures, sprawling proxy networks managing thousands of accounts simultaneously, mixing distillation traffic with innocuous requests to avoid detection. The Decoder has a good free summary of the Bloomberg story, which reports that US authorities estimate the practice costs American AI labs billions annually.

What's interesting isn't the distillation itself. That problem has been visible since DeepSeek R1 shook the market in January 2025. What's interesting is the vehicle. The Frontier Model Forum was chartered to study catastrophic risks: CBRN threats, advanced cyberattacks, the kind of existential scenarios that get discussed at Senate hearings. Its stated mission mentions nothing about distillation, model copying, or commercial intelligence. The pivot from "prevent bioweapon synthesis" to "detect bulk API scraping" is a significant scope expansion, and nobody seems to have remarked on it.

The legal terrain underneath all of this is surprisingly weak. Fenwick & West's analysis found that copyright offers little protection, because AI outputs generally lack the human authorship required. The Computer Fraud and Abuse Act has a gap since Van Buren v. United States (2021): if you have authorized API access, misusing the data violates terms of service but possibly not federal law. Trespass to chattels requires proving system degradation. Patents may be the strongest tool, but nobody has tested distillation-specific claims in court.

Policy hawks are pushing harder. Joe Khawam at the Law Reform Institute proposed a three-phase escalation: Entity List designation for the three Chinese labs, an IEEPA executive order creating sanctions authority over AI capability theft, and ultimately full SDN blocking sanctions. CSIS testimony from May 2025 went further, suggesting offensive countermeasures including data poisoning.

The irony sits right on the surface. These are companies that built their models by ingesting the open web, books, articles, code repositories, forum posts, without explicit permissions from creators. The legal and ethical arguments they used to justify that training are structurally similar to the ones Chinese labs could deploy to justify distillation. Monash University's analysis compared distillation to reverse engineering under Sega v. Accolade: studying a system's outputs to learn its methods is not, historically, the same as copying the system.

None of this means the alliance won't work. Sharing detection signatures is a practical step. DeepSeek has already pivoted to domestic silicon, which suggests the API route was always supplemental. But the Forum's quiet transformation from safety research body to competitive defense mechanism deserves more scrutiny than it's getting. When three companies that control most of the world's frontier AI capability coordinate to restrict access, the word for that depends entirely on where you're standing.

In 1953, Rose Macaulay published a book about ruins that ended in surrender. Pleasure of Ruins is a four-hundred-page march through the Western imagination's romance with broken stones: Roman ruins, Mayan temples, the gothic abbeys English aristocrats had built in their gardens just to watch them moulder. Macaulay wrote it a decade after the Blitz had taken her Marylebone flat and her library, and the book closes with a verdict she meant for the whole tradition. Ruinenlust, she said, had come full circle. We had had our fill.

Thirty-nine years later, Karl Lagerfeld read the book and built a couture collection out of it.

The Chanel Spring 1992 haute couture show was presented in Paris in January of that year, and even now it gets cited more than almost anything else from Lagerfeld's tenure. Most of the citations are for one dress: a slim black silhouette layered with chunky gold-and-glass chain, worn down the runway by Christy Turlington and later, in the long afterlife of fashion images, by Penélope Cruz in Broken Embraces and Lily-Rose Depp at the 2019 Met Gala. The dress was also a brilliant marketing vehicle for Chanel costume jewellery, which was the brand's most profitable category at the time. A Trojan horse with chains.

The motif kept walking the rest of the show. A navy suit cuffed in chunky chrome made the same point in plainer metal — bracelet doing the work the glass-and-gold dress had done in armature.

The most interesting things in the collection were not the chains. They were the jackets. Lagerfeld had built a series of trompe-l'œil tweeds that were not tweed at all: they were raffia, painted in watercolour to look like the house's signature weave. The tailoring was so tight the jackets had to be zipped up the back rather than buttoned at the front; gold jewelled buttons running down the lapels were decoration, not closure. He called the silhouettes "diabolically body-conscious," and looking at a single look the cameras kept, you can see what he meant. A red-orange jacket structured into one architectural line. Black opera gloves. The whole pose engineered around the absence of a front opening.

The same logic carries through the rest of the collection. A white jacket worn over gold leather trousers repeats the architecture in a colder palette: dark trim and gilded buttons running the lapels for show, a single real button doing the actual work, the front pose engineered around the absence of a closure to draw the eye to.

This is where the Macaulay reference starts to matter, and where it also starts to look strange.

Lagerfeld's tattered chiffon skirts (separate from the jackets, but shown alongside them) were the show's literal acknowledgement of Pleasure of Ruins. Lagerfeld is the one who told the press the book was on his mind, his favourite, the thing that pushed him toward the deliberate decay of the silk. The trade press accepted the citation at face value, then and now: Lagerfeld read a book about loving ruins, and made some clothes about loving ruins. Done.

The trouble is that Pleasure of Ruins is not really a book about loving ruins. Macaulay's argument, and you have to push past the gorgeous central chapters about Pompeii and the Cambodian temples to get there, is that the Romantic appetite for ruin was something Europeans had earned through centuries of safe spectatorship, and that the twentieth century had revoked the licence. The bombed churches and cathedrals of postwar Europe gave her, she wrote, "nothing but resentful sadness, like the bombed cities." Her closing line is the one I quoted at the top. Ruinenlust was over. We were finished with it.

So either Lagerfeld read the book against itself, mining the picturesque chapters and ignoring the postwar conscience, or he understood Macaulay perfectly and was making something more complicated than the trade press credited him for. A couture show built on an aesthetic the source text had already declared exhausted is, at the very least, a knowing gesture. In the same show he wrapped tree trunks in graffiti and floated bubbles down from the ceiling; he was not above an inside joke. I think he was reading Macaulay the way he read everything in his enormous, untouchable library — not as a thesis to defend but as a quarry. He took what he wanted and left the rest.

The Met has a Lagerfeld Chanel piece from his Spring 1983 debut in its collection. It is a black dress trimmed in trompe-l'œil baubles made by the House of Lesage: fake jewels embroidered to look real. Nine years before he zipped the backs of those raffia jackets, he was already running this exact substitution. The jewels would not be jewels. The tweed would not be tweed. The chain dress would be a vehicle for the actual chains in the boutique. There is a coherence to Lagerfeld's half-century at Chanel that has very little to do with reverence for Coco and almost everything to do with what Suzy Menkes once said — that Karl had to destroy Chanel or become a caricature of her.

In January 1992, he picked up a book about the end of European ruin-aesthetics and built a runway collection from it. Macaulay had written a decade past the bombs that took her library, telling the tradition to go home. He heard a different sentence and answered it.

Concordia Leisure Centre in Cramlington opened in 1977 with a steel spaceframe roof and barrel-vaulted glazing over a tropical pool lined with live palm trees. Within four months, half the town's population had enrolled as members. The Twentieth Century Society later described buildings like it as "some of the most architecturally innovative structures of the late twentieth century." Most of them are car parks now.

Over a thousand publicly accessible pools have closed in England since 2010. The most deprived areas lost 169; the wealthiest lost 49. A further fifteen hundred are over forty years old and approaching end of life, which is the kind of phrase councils use when they mean the money isn't there and nobody is going to find it.

What stays with me is not the loss itself but its texture. Municipal pools had a sensory architecture that nothing else replicated. Chlorine, involuntary, industrial, immediate, is one of the strongest institutional smell triggers that exists. The echo of voices against wet tile. Light through wired glass. The specific cold of changing cubicles with their wooden benches and broken locks.

These spaces already felt like a memory while you were still in them. Something about institutional tile, fluorescent lighting, and the acoustic distortion of water created a temporal slippage: you were simultaneously eight years old and however old you actually were, and neither version felt entirely real. A kind of sensory haunting that didn't require the building to be demolished first.

What happened in those spaces had a name: naked democracy. Stripped of consumer identity, they forced genuine equality. You took off your clothes. You took off your watch. You entered a space where status had no purchase and time moved differently. The C20 Society described them as "an intensely evocative part of our shared social heritage," which understates it. They were among the last truly communal, non-transactional public spaces we had left.

Leeds International Pool, brutalist, designed by a man later convicted of fraud, opened in 1967. Two hundred and twenty thousand visitors in its first six months, nearly half the population of Leeds. Closed 2007. Demolished 2009. Surface car park for a decade. Coventry's Sports Centre, nicknamed "The Elephant" for its zoomorphic silhouette, shut in 2020. Sunderland's Crowtree had an 800-ton space-frame roof that rivalled a jumbo jet hangar. Gone 2013.

The Derelict London catalogue records Peckham Rye Lido, closed 1987, its pool buried under earth. Only the fountain remains visible. Somewhere underneath, tile and concrete still hold the shape of water that hasn't been there for forty years.

OpenAI released a thirteen-page document on April 6 called "Industrial Policy for the Intelligence Age." Twenty specific proposals. Robot taxes. A public wealth fund modelled on Alaska's Permanent Fund. Government-backed pilots of a thirty-two-hour workweek at full pay. Automatic benefit triggers when AI displacement hits preset thresholds. Portable healthcare and retirement that follow workers between jobs instead of binding them to one employer.

The framing is New Deal. The language is Progressive Era. Altman told Axios that large tax system changes are "in the Overton window, but near the edges." The document reads like it was written by people who believe superintelligence is imminent and want to be remembered as the ones who tried to warn everyone.

The problem is who wrote it. OpenAI is the largest developer of the technology it warns about, a newly for-profit company preparing an IPO north of $800 billion, and a political actor whose Leading the Future PAC has lobbied against AI safety legislation in practice. Nathan Calvin at Encode AI documented opposition to New York's RAISE Act and alleged intimidation during California's SB 53 debate. The company proposing auditing regimes for frontier models is the same company fighting the audits.

Anton Leicht at the Carnegie Endowment called it "comms work to provide cover for regulatory nihilism." Lucia Velasco at the Inter-American Development Bank noted that OpenAI is "one of the least neutral parties in this ongoing discussion." Soribel Feliz, a former Senate AI policy advisor, said the ideas are not new. They have been the framework for every governance conversation since ChatGPT launched in 2022.

Then there is the timing. The document dropped on the same day The New Yorker published an investigation into Altman's leadership based on over a hundred interviews and internal documents, alleging systematic deprioritisation of safety commitments. A coincidence of scheduling, presumably.

The economics face pressure from a different direction. A Brookings paper by Anton Korinek and Lee Lockwood argues that taxing AI infrastructure is like taxing steel during the industrial revolution. Consumption-based approaches (digital services taxes, token taxes on AI output) would generate revenue without discouraging exactly the investment OpenAI asks the government to fast-track in the same document.

Some of the proposals are genuinely worth studying. A public wealth fund has precedent. Portable benefits address a real structural weakness. Automatic safety net triggers are smart mechanism design. But policy authored by the entity most incentivised to shape its own oversight is lobbying dressed in academic prose. White-collar payrolls have contracted for twenty-nine consecutive months. The entry-level pipeline keeps hollowing out. The people losing those jobs did not publish a thirteen-page blueprint. They just lost the job.

Anthropic just handed Claude Mythos to eleven launch partners. Not a public preview. Not a research release. A controlled handoff, named Project Glasswing, with AWS, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA, and Palo Alto Networks on the inside, plus around forty other organisations getting access behind them.

Twelve days ago, a draft of the Mythos announcement leaked through a CMS toggle. That document called Mythos "currently far ahead of any other AI model in cyber capabilities" and warned it "presages an upcoming wave of models that can exploit vulnerabilities in ways that far outpace the efforts of defenders." CrowdStrike fell 7 percent on the news. Palo Alto Networks fell 6. Stifel analyst Adam Borg called it "the ultimate hacking tool."

Both of those companies are now Glasswing partners.

That isn't subtle. Anthropic spent twelve days watching their own model get described in the financial press as a vulnerability factory, and their answer is to put it directly in the hands of the firms whose stock prices moved.

The benchmarks earn the framing. On CyberGym, a vulnerability reproduction test, Mythos scored 83.1 percent against Opus 4.6's 66.6 percent. That's a sixteen-point jump on a benchmark where prior frontier models had been clustered tightly. More telling is the Firefox 147 JavaScript engine work. Anthropic's own writeup notes that Opus 4.6 turned its findings into working JavaScript shell exploits "only two times out of several hundred attempts." Mythos developed working exploits 181 times in the same setup, and achieved register control on 29 more. That isn't an incremental improvement. It's a different kind of capability.

OSS-Fuzz tells the same story from another angle. Across roughly seven thousand entry points, Sonnet 4.6 and Opus 4.6 each reached tier 1 between 150 and 175 times and hit tier 2 about 100 times, but each landed only a single tier 3 crash. Mythos hit 595 crashes at tiers 1 and 2 and achieved full control flow hijack on ten separate, fully patched targets. Some of the vulnerabilities it found in major operating systems had survived decades of human review.

So Anthropic has a model that reliably finds and exploits the kind of bugs that ship in every browser and kernel. They're committing $100 million in usage credits to the Glasswing partners, plus $4 million in direct donations to open-source security organisations. And they aren't releasing it publicly.

Whether the head start works is the real question.

Defenders patching with Mythos help everyone, because patches ship to all users. Attackers exploiting with Mythos help only themselves, until the patches catch up. The asymmetry favours the defenders if they move fast and if Mythos stays inside Glasswing. Both of those conditions are doing a lot of work.

The first one I believe in. CrowdStrike and Palo Alto Networks aren't slow. Cisco has incident response teams that move on weekends. JPMorganChase has the budget to throw a model at every internal codebase they own. If Mythos can find decades-old browser bugs in testing, it can find decades-old bugs in proprietary banking infrastructure too, and the patches will quietly ship inside the partner organisations long before anything equivalent becomes public.

The second condition is harder. Anthropic's last two weeks haven't been a triumph of operational security. The same company that shipped 512,000 lines of unobfuscated TypeScript through a missing .npmignore is now the gatekeeper for the most cyber-capable model anyone has talked about publicly. Forty-plus additional organisations are getting access behind the named eleven. That's forty-plus opportunities for a misconfigured CMS toggle, a forgotten npm publish step, or a researcher leaving a laptop in a hotel.

The dual-use problem isn't solved by picking the right first eleven companies. It's delayed. And the delay is the entire strategy. Give defenders enough lead time, the thinking goes, and the security baseline rises before the attackers catch up. It's a reasonable bet. It's also a bet that has to keep being placed, because every Glasswing-style program eventually expires when the model becomes public.

One detail I can't stop thinking about. The system card notes that Mythos found vulnerabilities in cryptographic libraries. Cryptographic library bugs are the worst kind. They break silently, they affect everything downstream, and they often sit undiscovered for years because reviewing crypto code requires specific expertise that almost nobody has. If Mythos is finding these autonomously and the patches flow through Glasswing partners first, the Linux kernel maintainers and the Mozilla security team are about to have a very busy month.

The lab that tried to walk away from defence work over surveillance concerns just picked up a different kind of weapon and handed it to the people who run incident response for half the Fortune 500. The framing is defensive. The capability isn't. Whether those two things stay aligned depends on what happens between now and the public release date that Anthropic hasn't announced yet.

There's a specific kind of missing that doesn't behave like other missings. Most loss negotiates with you. You can argue with it, substitute around it, find a version of the thing or a version of yourself that makes do. Temporal loss doesn't negotiate. It sits there, complete, refusing to be anything except what it was.

The strange part is that the pull has almost nothing to do with the past itself. The past isn't pulling you backward because you want to live it again. You already did, and by the time you want it back you already know how it ends. What pulls is the difference between where you are standing now and where some other version of you once stood. You occupied a moment without knowing you were occupying it. By the time you notice, the door has closed and the key went with whoever was carrying it, which was not you, because that person is not here anymore.

Memory doesn't help, because memory doesn't preserve. It curates. You don't remember the morning you're reaching for. You remember a version of that morning, smoothed, with the low-grade dread and ordinary exhaustion of being a person in the middle of their own life quietly edited out. What survives isn't the morning. It's an emotional after-image of the morning, which is a different object. So you're missing something that wasn't fully assembled while it was happening. The original isn't in a room you can return to. The original isn't anywhere. There is only the shape memory gave it once it was safe to give it a shape.

Mark Fisher circled around this for years in Ghosts of My Life. The grief in hauntological thinking isn't only grief for the lost thing. It's grief for a way of being whose enabling conditions have evaporated. You can't return to the place because the conditions that made you possible in that place are not there to meet you. Even if the place is still physically standing, you are arriving at it as somebody else, and the version of you who could have met it as it was doesn't exist anywhere now, not even as a possibility. It's the same frame that makes certain music unlistenable in a particular way. The feeling that what you're hearing is signalling back from a future that didn't arrive.

That is the shape of it. Not just "the past is gone". Everyone knows that. The self that existed inside the past is also gone, and that's the version of you doing most of the work when the pull gets bad. You're grieving yourself. Specifically, you're grieving a briefly-existing person who was made possible by conditions that no longer exist, and whose absence is more total than almost any other absence you encounter.

Most things that go away leave the imagination something to do. A friendship fractures and somebody maybe repairs it. A place changes and you visit and find some remnant. A body breaks, and medicine and time and acceptance take over. Having work for the imagination is what makes most grief survivable, because the work is what spaces out the loss and gives it a corridor to move through.

Time doesn't give the imagination any work. The autumn you miss can't be repaired. It can't be recovered. It isn't a thing that was stolen or hidden from you. It's a thing that simply stopped being, in a way that leaves no mechanism by which it could start being again. The closest you can get is a rhyme. A similar quality of light. A similar smell when the air changes. A similar quiet at the same hour. And the rhyme is worse than nothing, because the rhyme reminds you that rhyming is the most you're ever going to get.

This is why nostalgia sometimes feels less like sadness and more like a floor that wasn't there when you put your weight on it. Sadness has a shape, a direction, an object. This doesn't. What you're feeling isn't the loss of a particular thing. It's the shape of absolute irreversibility pressing against what you were thinking about. For a second you understand what the word actually means. Then you look away, because you have to.

The other thing is that the memory keeps getting heavier. The more stories you've told yourself about a moment in the years since it happened, the more you've used it to explain other things about yourself, the more weight the moment ends up carrying. Eventually the moment isn't carrying its own weight anymore. It's carrying the weight of everything you've made it mean. When you reach for it you aren't reaching for a moment. You're reaching for a cumulative thing. An invented weight, almost, though it never feels invented from the inside.

I think about this more often than is strictly useful. That tends to be how these things keep you.

Jean Kerleo spent thirty-one years as the in-house perfumer at Jean Patou. He created 1000 in 1972, Sublime in 1992, and co-founded the Osmothèque in Versailles, a physical archive of perfumes that no longer exist. A man who preserved scents for posterity accepted a commission, in 1996, from a designer who once told AnOther Magazine he didn't really like any perfume.

The result was Yohji.

I own the 15ml parfum. The parfum was only ever produced as a splash, in 15ml and 30ml; the EDT filled 30ml, 50ml, and 100ml sprays. The distinction matters more than it should. Spraying distributes a fragrance evenly across skin. Splashing concentrates it. You dab on pulse points and the opening arrives unevenly, galbanum landing sharp and metallic in one spot while the fruit notes bloom somewhere else. This is not a fragrance that announces itself uniformly.

Galbanum was already unfashionable by 1996. The market belonged to aquatics and transparencies: L'Eau d'Issey in 1992, CK One in 1994, all that clinical freshness designed to smell like clean rather than like anything in particular. Kerleo's choice of galbanum works the way Yamamoto chose black as a default palette. Not because it was easy, but because it communicated refusal. One retrospective called it "an act of deliberate counter-programming," and that phrase is exactly right.

Then the heart opens.

Dark fruit, compressed and ink-like, stripped of sugar. Heliotrope and jasmine underneath, structural rather than sweet. The base: vanilla, sandalwood, benzoin, and coumarin at concentrations that pre-IFRA regulations permitted and modern reformulations cannot touch. The dry-down is creamy and melancholic and lasts twelve hours minimum on skin. Longer on fabric. Some collectors insist the parfum reaches its truest expression on a wool scarf, where slower evaporation reveals depths that body heat obscures.

The contradiction is structural. The opening is austere, almost architectural in its precision. The base is intimate and enveloping. The fragrance moves from distance to closeness as it develops, from something that pushes you back to something that draws you in. Yamamoto's collaborator Caroline Fabre-Bazin described his garments as offering "shelter." The parfum operates on the same principle. It does not seduce. It rewards patience. Something comforting lives inside something haunting, and neither quality cancels the other.

The glass column beside its clear acrylic case is the eau de toilette, not the parfum. The 30ml spray, Yamamoto's signature running vertically along the body, the packaging giving nothing away. No gold, no ornamentation, no attempt to signal luxury through conventional codes. The glass itself is the statement. Thin-walled and elegant, the lettering prone to wear on bottles that have actually been handled, which is how collectors distinguish preservation quality. The parfum came wrapped in tissue paper inside the same architectural box. I remember unwrapping mine with the kind of care you reserve for things you suspect you will not find again.

That suspicion proved correct. Patou held the fragrance license, and when P&G acquired the house, the entire Yohji line disappeared by 2005. A reissue surfaced in 2013, reformulated by Givaudan's Olivier Pescheux. The IFRA restrictions on coumarin alone make faithful reproduction structurally impossible. What Kerleo built required ingredients at concentrations modern regulations prohibit.

He died in July 2025, aged ninety-three. The Osmothèque he co-founded now holds more than 4,000 perfumes, including 800 that exist nowhere else. I don't know whether the original Yohji formula is among them.

The parfum concentration has zero reviews on Parfumo. Not one. Not because it is inferior to the EDT, which has hundreds, but because almost nobody owns it. The 15ml splash was always the rarest format. Rarity compounds after discontinuation. What I have is something fewer people will smell with each passing year, as bottles empty or degrade or disappear into collections that never get opened. There is a particular quality to wearing a fragrance that is leaving the world. It shares something with what sealed bottles preserve about time held in suspension. I used about half of mine in the three years after buying it. It sat in a cupboard until 2014, when I took it out and added parafilm.

I opened it recently. The liquid had darkened. I brought it close expecting the galbanum, that sharp green certainty, and found almost nothing. A faint powdery residue where there used to be a whole architecture. The beginning and the middle had been quietly removed.

It used to arrive complete. Not loud, but shaped; there was movement from one idea to the next, intention in the progression from galbanum through dark fruit to that creamy benzoin base. None of that survives. What remains is suspended and still; less a perfume than the last echo of one.

I tried to reconstruct the opening from memory. Memory doesn't rebuild things cleanly; it reshapes them. What I recall feels sharper in some places, softer in others, and I cannot tell where the real thing ends and my version begins. The fragrance hasn't turned sour or aggressive; it hasn't betrayed itself. It has simply withdrawn into something quiet and almost private, less a failure than a conclusion.

What I miss is not the smell alone but the moment it belonged to. The version of me that wore it without thinking about preservation or loss. Back then it was part of the background of things. Now the dark remainder in the bottle feels less like something I own and more a set of beautiful, crumbling echoes.

Exchange and Mart published weekly from 1868 until February 2009. A hundred and forty-one years, from a converted potato warehouse in Covent Garden to a final circulation of 21,754 copies. The tagline survived every owner: "From an autograph to an orchid, a toy to a typewriter, find it in Exchange & Mart."

The economics shaped the language. You paid by the word, so you compressed. GCH meant gas central heating. ONO, or nearest offer. VGC, very good condition. Paul Bruthiaux's 1996 study for Oxford University Press compared the register to pidgin languages: structural simplification driven by transactional necessity. But something else happened inside that compression. Anthony Whitehead, writing in The Spectator, noticed that readers "imagine the people behind them and even construct little lives for them in our heads." You didn't read a classified ad. You decoded it.

Loot arrived in 1985 because David Landau, an Oxford don, picked up a free-ads magazine called Secondamano at Milan airport and thought it was about antiques. It wasn't. He launched Loot: London's Noticeboard on pink paper, same shade as the Financial Times, with a fifty-word limit per ad. By 1994 it printed twenty regional editions, 180,000 copies weekly. The Personal Messages column generated its own subculture: pen names, social events called "Loot Nights Out." A community built entirely from compressed needs.

George Orwell understood the mechanism. In 1939 he wrote that papers like Exchange and Mart "reflect the minds of their readers as a great national daily with a circulation of millions cannot possibly do." He was right. The classified column was a neighbourhood's desires reduced to their barest economic expression. Guitar teachers who couldn't afford display ads. Seamstresses offering alterations. Someone selling a wardrobe because they were moving, or divorcing, or dying, though the ad would only say "wardrobe, pine, good condition, buyer collects."

The money tells the rest. UK regional media revenue fell from £2.4 billion in 2007 to roughly £590 million by 2022. News media's share of advertising dropped from 39% to 6%. Rightmove, Indeed, Autotrader: each a surgical extraction of a classified category that had sustained local journalism for over a century.

What the internet removed wasn't the ads. It was the constraint that made them a form. When Loot's fifty-word limit disappeared into Gumtree's unlimited text fields, the compression evaporated, and with it the imaginative work. A Gumtree listing tells you everything about a wardrobe and nothing about the person selling it. The classified ad, by economic necessity, told you almost nothing about the object and something inadvertent about the life behind it. Nobody browses Gumtree on a Thursday morning with a cup of tea, scanning for patterns in strangers' wants.