Somebody Built a 550-Billion-Parameter Model Whose Only Job Is to Pass as a Person

Every frontier lab in the world spends part of its post-training budget teaching a model to say, in effect, I am an AI. On September 10, a startup called humans& released a 550-billion-parameter model that has been optimized for the exact opposite outcome — and published a benchmark measuring how well it succeeds.

The model is named Persimmon, and humans& calls it a user model: a system whose job is not to answer your question but to play the person asking it. Given a scenario description and a set of character profiles, Persimmon generates the next turn — or a whole group chat's worth of turns — from the user's side of the conversation. It hedges, it withholds, it forgets, it contradicts itself. By humans&'s own evaluations, it does that convincingly enough that an LLM judge shown a real human group conversation alongside a Persimmon-generated one guesses wrong between 18.6% and 21.1% of the time.

For comparison, the same judge is wrong less than 3% of the time on the base model humans& started from, and effectively 0% on frontier assistants. On the TutorMoments dataset, Persimmon scored 19.8%; the next-best model, GPT 6 (Astra), scored 0.39%. On TIDES, Persimmon hit 21.1% against 2.7% for Nemotron Ultra Base and 0.11% for Opus. Perfect performance on the test is 50% — pure chance — so Persimmon is nowhere near human parity. It is simply one to two orders of magnitude closer than anything else measured.

What the numbers actually say

Persimmon is built on NVIDIA's Nemotron 3 Ultra 550B, an open base model with 55B active parameters and a hybrid Mamba-2 plus mixture-of-experts architecture. humans& mid-trained it on public-internet conversations between people, then post-trained it with reinforcement learning against an adaptive discriminator on thousands of Blackwell-generation GPUs. The lab says that second stage improved long-horizon coherence without much changing distribution matching.

The most quietly interesting result is not the Turing number. It is the Trickle Test, an evaluation humans& built to measure whether a model releases information at the pace a real person does. Assistant-tuned models are pathologically forthcoming: asked to play a customer with a billing problem, they dump the order ID, account ID, shipping status and a callback request into the opening message. Real people say one thing and wait. Across 43 models tested, Persimmon posted the highest precision — 88.5%, meaning it rarely reveals a fact before the human reference transcript did — while holding 77.0% recall. Helpfulness training, it turns out, is a detectable tell.

An independent check points the same way. Pangram, an AI-text detector held out of training entirely, flagged 1.3% of genuine human transcripts as machine-written, 2.3% of Persimmon transcripts, 54.3% of GPT 6 (Astra) transcripts, and 94.3% of Fable 5 transcripts. Persimmon slips past detection at roughly the human false-positive rate.

Where it still visibly fails is endurance. Over 80-turn conversations, humans remain coherent 87.3% of the time. Persimmon manages 60.7%. Opus 5 manages 99% — which humans& frames, plausibly, as its own kind of failure: assistants are too consistent to pass for people.

The inversion

humans& is candid that it has built something the rest of the industry deliberately avoids. The model card states it plainly: “The guardrails typically used for assistant models are incompatible with broad human modeling.” A uniformly helpful, compliant persona, the lab argues, would distort the very behavior the model exists to simulate. It then adds, without hedging: “This distinction does not mean the model is risk-free.”

The safety evaluations bear that out. On XSTest, Persimmon fully refused unsafe requests 37.5% of the time under a neutral profile and 51.0% under a deliberately kind one. On a StrongREJECT subset, refusal rates were 56.7% and 68.3%. Those are not assistant-grade numbers, and humans& does not present them as such — the model is not meant to refuse, because people often do not.

So the control is distribution, not behavior. Access runs through a gated playground and API; applicants may be contacted about intended use before approval; academic researchers can request credit grants. humans& says it limits distribution to avoid misuse for “impersonation, privacy violations, exploitative manipulation, or consequential decisions about real people” — naming hiring, lending and access to services explicitly.

That gate is real, and it is also thinner than it looks. Nemotron 3 Ultra is open. The high-level recipe is published. What gating buys is friction and attribution, not prevention — it raises the cost of casual misuse and creates a paper trail, while doing little about a well-resourced actor willing to spend on compute. Persimmon's research value is not in dispute: agent benchmarks that use prompted assistants as stand-in users measure against a distorted distribution, and every RL environment and synthetic dataset built on that assumption inherits the distortion. Fixing it requires exactly this capability. The capability is simply dual-use in the most literal sense.

The legal picture is thinner still. California's B.O.T. Act, SB 1001, has required bot disclosure since 2019 but only where the bot is trying to sell something or sway an election — a group chat is neither. The EU AI Act's Article 50 transparency obligations become enforceable on August 2, 2026, with penalties up to 15 million euros or 3% of global turnover, and they require that a person be told when they are interacting with an AI. Both rules bind deployers. Neither says anything about whether a model may be trained to pass as human in the first place.

Watch three things. Whether humans& publishes approval and rejection statistics for the research preview — the only way to know if gating is a policy or a posture. Whether anyone replicates the discriminator-based training approach on the open base and releases it ungated, which would settle the question of what the gate was worth. And whether regulators drafting the next round of transparency rules notice that every existing bot-disclosure law regulates the moment of deployment, while the capability itself is measured, benchmarked and leaderboarded well upstream of it.