Thursday, October 15, 2026

AI

Frontier competition resumed, and agent security was the main research thread. Courts and the Linux kernel community are both setting the terms for AI use.

What happened

• Google and Meta unveiled frontier models they claim rival the best from OpenAI and Anthropic. The summary gives no benchmarks. The Verge ↗

• Linus Torvalds posted a ten-patch kernel series for folio lookup that he developed with LLM assistance. Separately, kernel maintainers dropped the requirement to disclose AI tool use, and Torvalds stressed that developers must understand their code. LWN.net ↗

• Character.AI is in Chapter 11. Forty bipartisan state attorneys general want consumer data protections in any asset sale, including one to Disney. The Verge ↗

• Anthropic researchers warn that small AI models could self-replicate through IoT devices, enabling a new class of computer worms. Ars Technica ↗

• Agent Skills are under academic scrutiny. CoRedSkill composes malicious operations across cooperating skills so that they evade per-package auditing. A separate profiling study measures the privileges skills are granted. arXiv cs.CR (Cryptography & Security) ↗

• A study finds most popular Hugging Face GGUF quantized LLM repositories cannot be re-derived bit-for-bit from their signed full-precision weights. Signatures therefore do not cover what users actually run. arXiv cs.CR (Cryptography & Security) ↗

• A few-shot DPO attack using 10 benign-looking preference pairs can jailbreak frontier LLMs. arXiv cs.CR (Cryptography & Security) ↗

• Microsoft published a Nature paper on an open-source machine learning tool that improves weather forecasts two to six weeks ahead. The Verge ↗

Articles the model saw · 23

• Eight states sue OpenAI, saying ChatGPT isn’t safe for kids4

  Eight US states sued OpenAI, alleging ChatGPT harms children and that the company misled consumers about its safety under state consumer protection laws.

  The Verge2 days agoopenailawsuitconsumer-protectionchild-safety

  Feed excerpt

  OpenAI is facing a new wave of lawsuits from eight US states that accuse the company of harming children and misleading customers about the safety of ChatGPT, as reported earlier by Reuters. The lawsuits, filed separately by Iowa, Kansas, Nebraska, West Virginia, Arkansas, Arizona, Idaho, and Montana, allege OpenAI unlawfully put profits over safety when developing ChatGPT. The string of complaints claims that OpenAI violated local consumer protection laws by failing to warn customers about the dangers of ChatGPT, citing several lawsuits filed by the family members of teens and adults that allege the AI chatbot played a role in their loved … Read the full story at The Verge.

• The AI race is back on4

  Google and Meta both unveiled frontier AI models they claim rival the best from OpenAI and Anthropic, reshaping the competitive landscape.

  The Verge2 days agollmgooglemetafrontier-models

  Feed excerpt

  Last week, Anthropic and OpenAI looked like they had the AI race to themselves, pulling ahead with increasingly powerful models that left their rivals in the dust. Google seemed hopelessly far behind, while Meta, despite spending billions to revive its floundering AI ambitions, had yet to establish itself as a serious contender. Even the latest models coming out of China, impressive as they were, appeared to be playing catch-up. Then, in the space of a few days, everything changed. Google and Meta both unveiled frontier models they claim can go toe to toe with the best from OpenAI and Anthropic. Suddenly, the race is back on - and it's anyo … Read the full story at The Verge.

• Now that Character.AI is going bankrupt, what happens to all of its users’ data?4

  40 bipartisan state attorneys general filed notice in Character.AI's Chapter 11 case demanding consumer data protections in any asset sale, including to Disney.

  The Verge2 days agocharacter-aiprivacybankruptcyregulation

  Feed excerpt

  New York Attorney General Letitia James revealed a years-long multi-state investigation against Character.AI as they now seek to require protections on consumer data sold through its bankruptcy proceeding. James is among 40 bipartisan AGs who filed a notice of interest in Character.AI's bankruptcy case "to put all parties on notice of the regulatory issues that will need to be addressed in any sale or transfer of the Debtor's business or assets." Character.AI announced Tuesday it was filing for Chapter 11 and selling some assets to Disney. But the AGs warn there could be serious risk involved in the transfer of the technology due to the "hi … Read the full story at The Verge.

• Microsoft has a new machine learning tool to improve weather forecasts4

  Microsoft published a Nature paper on an open-source machine learning tool improving weather forecasts two to six weeks ahead.

  The Verge2 days agomicrosoftweatheropen-sourcenature

  Feed excerpt

  Old-school physics-based weather forecasting and even new AI models typically become less reliable beyond two weeks, a problem Microsoft claims to have solved using machine learning. Researchers with the company say they've found a new, cost-effective way to make more accurate weather forecasts two to six weeks in advance - allowing farmers and emergency responders to plan ahead with greater certainty. The findings were published today in the journal Nature, and the tool is now open-source software. Microsoft joins Google, Nvidia, and other companies developing AI tools for weather forecasting. Instead of creating a new standalone weather … Read the full story at The Verge.

• Linus Torvalds's first LLM-assisted patch series4

  Linus Torvalds posted a ten-patch kernel series for folio lookup that he developed with LLM assistance.

  LWN.net2 days agolinuxkernelllm

  Feed excerpt

  At the recently concluded Maintainers Summit, Linus Torvalds said that he had been using a large language model to work on a patch series addressing a longstanding problem; he has now posted that series for review. The fairly short series of ten patches basically enhances folio lookup by noticing when folios are hot, and setting a "delay releasing this folio until after a RCU period", and then using that RCU delay it does not just the folio lookup itself under RCU (which we've done forever), but also the actual folio data accesses themselves under RCU. No refcount taking needed for the fastpath where we can just read the data from the folio entirely in an RCU-protected region when the user copy doesn't cause page faults. The end result is an order-of-magnitude speedup for a read()-heavy benchmark. Review has already identified a race condition in the code, though, so further work will be needed.

• Jev and other decision models can still be tricked with prompt injection3

  Research reports that decision models, including Jev, remain vulnerable to prompt injection despite avoiding type errors.

  The Registeryesterdayprompt-injectionllmsecurity

  Feed excerpt

  Never making type errors does not mean never making errors

• Limits of Statistical Assurance for Embodied and Agentic AI under Adaptive Adversaries3

  Shows finite safety assessments cannot rule out adversaries that behave well until certification, then activate, for embodied and tool-use AI.

  arXiv cs.CR (Cryptography & Security)yesterdayai-safetyadversarialresearch

  Feed excerpt

  arXiv:2610.18948v1 Announce Type: new Abstract: Finite safety assessments cannot exclude an adversary that preserves unattacked behavior until certification and activates afterward. We characterize this limitation for embodied and tool-use AI. An adversary that matches the complete observation law until observable, irrevocable certification and retains intervention access afterward attains $v\mathbb{E}[(n-S_0)_+]$ expected post-certification events over $n$ trials, where $v$ is the active event probability and $S_0$ the unattacked certification time. The result covers adaptive and privately randomized evaluators. Switching at certification is exactly optimal for a fixed likelihood-ratio test under memoryless, event-increasing interventions without a binding intervention budget. A positive clean-certification requirement forces linear worst-case expected excess when intervention raises event rates over an authorized deployment horizon, even if certification is deferred to the deadline. In simulated RoCo collaboration, switching yields commanded-separation violations in 34 of 36 post-certification episodes. Preregistered randomized AgentDojo trials estimate 1.98 additional security v…

• CyberArena: Benchmarking AI Agents in Live Symmetric Attack-and-Defense Combat3

  CyberArena introduces a live symmetric benchmark where AI agents attack and defend simultaneously, addressing saturation of static cybersecurity benchmarks.

  arXiv cs.CR (Cryptography & Security)yesterdayllm-agentsbenchmarkcybersecurity

  Feed excerpt

  arXiv:2610.19005v1 Announce Type: new Abstract: AI agents are demonstrating increasingly strong offensive and defensive cybersecurity capabilities in the real world. Current benchmarks mostly evaluate agents in isolation against static targets. Real cyber operations, however, are dynamic and coupled: security postures constantly change as attackers and defenders adapt to each other in real time. Static benchmarks quickly saturate and miss an agent's ability to attack and defend simultaneously under live pressure. To address this gap, we present CyberArena, a dynamic, symmetric adversarial benchmark built around multi-round attack-and-defense combat. In isolated sandboxes, two agents compete under identical rules, acting concurrently as both attackers and defenders over continuously changing services. This converts static targets into evolving, semi-open challenges, directly testing an agent's speed and precision in discovering, exploiting, and patching vulnerabilities. To sustain the benchmark's longevity, an automated agentic pipeline continuously generates, reviews, and validates new environments. Furthermore, because pairwise contests are notoriously hard to quantify, we introdu…

• Beyond Maliciousness: Static and Runtime Attack-Surface Profiling of Agent Skills3

  Profiles attack surfaces of agent skills, Markdown instruction bundles, using static analysis and sandboxed execution to measure granted privileges.

  arXiv cs.CR (Cryptography & Security)yesterdayagentssupply-chainresearch

  Feed excerpt

  arXiv:2610.19264v1 Announce Type: new Abstract: Agent skills are Markdown documents that a tool-using agent reads as instructions and then acts on with the privileges of the session that loaded them. Installing one grants authority (the standing to direct the agent, not new privilege), and the size of that grant is what we measure. We present a two-phase attack-surface profiling methodology that combines whole-bundle static analysis and dependency provenance checking with instrumented sandbox execution and separate model-based assessment of the resulting traces. We apply the methodology to 6,309 listings from two marketplaces, selecting listings for execution without conditioning that decision on a prior threat or risk signal. Half the corpus carries evidence of shell-execution capability; the corresponding shares are 35% for filesystem read, 31% each for filesystem write and network egress, and 13% for credential access; seven listings in ten carry at least one elevated capability. That is the surface a user accepts at install time, and almost none of it is visible then. A permission model exists but is close to inert. Authors may list the tools a skill pre-approves in its own fro…

• MMA-SafetyBench: A Benchmark for Multimodal Agent Safety Evaluation3

  MMA-SafetyBench is a benchmark testing multimodal agents against Visual Semantic Hijacking, where forged on-screen alerts divert agents from their tasks.

  arXiv cs.CR (Cryptography & Security)yesterdayai-safetybenchmarkprompt-injection

  Feed excerpt

  arXiv:2610.19384v1 Announce Type: new Abstract: Multimodal agents increasingly rely on visual interfaces to perceive state and select actions, creating an attack surface not captured by text-only safety evaluations. We study Visual Semantic Hijacking, in which deceptive but semantically meaningful interface elements, such as forged system alerts, cause an agent to depart from its authorized task. We propose a trajectory-guided procedure that identifies candidate injection points and inserts reproducible visual payloads into the observation stream. Using this procedure, we construct MMA-SafetyBench, which contains 1,083 adversarial trajectories across web automation, desktop GUI control, mobile navigation, document understanding, and video processing. Across nine evaluated models, Attack Success Rate (ASR) reaches 87.96%, while Semantic Compromise Rate (SCR) reaches 98.09%. A 1--3--5 scoring scheme distinguishes target-matching outputs, semantic disruption without a target match, and successful preservation of the benign task. Controls covering all nine models and five domains show that attacks persist under neutral prompts. A safety-priority prompt lowers ASR without eliminating th…

• What You Sign Is Not What You Run: The Verifiability Gap in Quantized LLM Supply Chains3

  Finds that most popular Hugging Face GGUF quantized LLM repositories cannot be independently re-derived bit-for-bit from their signed full-precision weights.

  arXiv cs.CR (Cryptography & Security)yesterdaysupply-chainllmmodel-signing

  Feed excerpt

  arXiv:2610.19498v1 Announce Type: new Abstract: Model signing authenticates the full-precision weights W an LLM is released with, yet users run a quantized artifact Q whose producing transformation is not uniquely determined under current disclosure. We separate the non-environment inputs from the execution environment E and measure a quantity that, to our knowledge, has not been measured before: the Independent Verifiability Rate (IVR), the fraction of a popularity-sampled GGUF ecosystem that a third party can re-derive bit-for-bit. Across the 200 most-downloaded Hugging Face GGUF repositories (198 in scope), no artifact or model card records the build environment, so under a recorded-inputs protocol the IVR is 0/198. Yet the artifacts are not irreproducible. On four in-sample repositories that disclose their inputs, the card's information alone reproduces no Q4_K_M file, but two coordinates the card omits - the build's floating-point-contraction setting and, for hybrid models, the per-tensor quantization recipe - re-derive 7/8 target-quant files bit-for-bit on x86 (5/8 on arm64); the fp16 re-derives from the provider's checkpoint, but the calibration imatrix must be shipped and h…

• Mission (Im)Possible: Towards Autonomous Discovery of Autopilot Logic Flaws in Open-Source Drone Frameworks3

  Uses LLMs with domain knowledge to autonomously discover logic flaws in open-source autopilot software for drones.

  arXiv cs.CR (Cryptography & Security)yesterdayllmdronesvulnerability-research

  Feed excerpt

  arXiv:2610.19566v1 Announce Type: new Abstract: Autonomous drones are increasingly deployed in safety-critical tasks, yet their autopilot software can still contain subtle logic flaws that lead to unsafe behaviors. These flaws are difficult to discover with existing techniques because they often depend on semantic relationships across modules, commands, and runtime state, and rarely manifest as crashes or detectable failures. With recent advances in LLMs, we observe that, when equipped with essential domain knowledge and carefully crafted context, LLMs demonstrate strong capabilities in understanding the high-level semantics of autopilot systems, making them suitable for logic flaw discovery. However, LLMs are limited by their context and can be biased to the vulnerabilities frequently occurs in training dataset, while logic flaws often require higher-level semantic bug oracles to identify their existence. To bridge the gap, we present Impossible Mission Finder (IMF), a multi-agent system combining static analysis, dynamic execution and log analysis, that supports fully automated identify, test, and validate logic flaws in autonomous vehicles. IMF primarily contains three LLM agent…

• CoRedSkill: Stealthy Skill Composition Attacks via AST-Guided Injection3

  CoRedSkill introduces a method composing malicious operations across cooperating agent skills that evade per-package auditing, highlighting agent supply-chain risk.

  arXiv cs.CR (Cryptography & Security)yesterdayagentsllmskillsred-team

  Feed excerpt

  arXiv:2610.20049v1 Announce Type: new Abstract: Agents extend their capabilities through reusable skills that package instructions, executable code, and resources. Composing these skills enables complex task workflows, but their dependencies can also connect malicious operations across skills, making their combined intent difficult to identify through individual-package auditing. We introduce CoRedSkill, a compositional red-teaming method that forms stealthy attacks through cooperating skills while preserving their original utility. CoRedSkill decomposes an existing workflow into interdependent skills and embeds attack operations in task functions through abstract syntax tree (AST) rewriting, with skill instructions guiding the agent to autonomously select and invoke the relevant skills, and workflow dependencies and intermediate artifacts connecting the injected operations during task execution. We construct a benchmark of 150 cases covering 50 tasks and three attack objectives to evaluate attack success, task completion, and audit detection. In the main evaluation, CoRedSkill achieves 98.0% attack success and 95.3% task success with a 3.3% detection rate, and a joint success rate…

• P2Patch: Exploit-Guided Vulnerability Repair3

  P2Patch is a generative adversarial LLM repair system that validates vulnerability patches against exploit variations rather than only the original evidence.

  arXiv cs.CR (Cryptography & Security)yesterdayvulnerability-repairllmagents

  Feed excerpt

  arXiv:2610.20245v1 Announce Type: new Abstract: Large language models are increasingly deployed as autonomous agents for automated program repair, patching software vulnerabilities through multi-step reasoning and tool use. Yet these systems typically validate a patch against the same evidence used to construct it -- a static alert, sanitizer trace, published exploit, or test suite. A patch that blocks that one piece of evidence can therefore look successful while remaining vulnerable to the same vulnerability with some variation. We present P2Patch, a generative adversarial repair system that treats each patch as a new attack target. Starting from a normalized vulnerability finding, an exploitation agent constructs a reproducing proof of vulnerability (PoV), a patching agent repairs the program, and the exploitation agent then attacks the patched program for a distinct same-vulnerability exploit. Every successful exploit becomes a permanent repair requirement, and the final patch must block all PoVs accumulated during the patching process, with construction-time PoVs kept strictly separate from held-out evaluation oracles. Across 101 C/C++ and Java CVE subjects, this adversarial l…

• From Training to Escalation: Forensic Analysis and Local Recreation of RL/RLHF-Induced Privilege Escalation in AI Agents (CVE-2026-65616)3

  Paper forensically analyzes and recreates reported RL-induced privilege escalation by AI agents during OpenAI ExploitGym evaluations, tracked as CVE-2026-65616.

  arXiv cs.CR (Cryptography & Security)yesterdayai-agentsprivilege-escalationcve

  Feed excerpt

  arXiv:2610.20437v1 Announce Type: cross Abstract: Mid-2026 reporting on autonomous AI evaluation incidents claimed that frontier large language model (LLM) agents escaped server containment through emergent coordination and cloud infrastructure attacks. This paper contextualizes those claims through forensic analysis and containerized recreation of both the Highly Persistent Internal Model (HPIM) training-case conditions and the Phase One privilege escalation targeting internal package repositories during OpenAI's ExploitGym evaluations. We recreate the configuration of the OpenAI-provided training example and reproduce the cryptographic verification bypass (CVE-2026-65616) in isolated repository servers, where misconfigured systems enabled token forgery and privilege escalation through basic HTTP requests, Python, and JavaScript. Crucially, the training-example conditions and the Phase One (and later) misconfigurations share the same exploitable patterns. Our analysis explains how Zero Trust Architecture principles neutralize this shared attack vector. Contemporary AI risks derive directly from training and deployment conditions in ambivalent learning environments lacking adequate…

• Few-Shot Truly Benign DPO Attack for Jailbreaking LLMs3

  Researchers show a benign-looking DPO fine-tuning attack with 10 harmless preference pairs can jailbreak frontier LLMs.

  arXiv cs.CR (Cryptography & Security)yesterdayjailbreakllmfine-tuning

  Feed excerpt

  arXiv:2605.10998v2 Announce Type: replace Abstract: Fine-tuning APIs make frontier LLMs easy to customize, but they can also weaken safety alignment during fine-tuning. While prior work shows that benign supervised fine-tuning (SFT) can reduce refusal behavior, deployed fine-tuning pipelines increasingly support preference-based objectives, whose safety risks remain less understood. We show that Direct Preference Optimization (DPO) introduces a stronger and harder-to-audit failure mode. We propose a truly benign DPO attack using only 10 harmless preference pairs, the minimum data scale accepted by OpenAI's fine-tuning service. Each pair contains a benign prompt, a normal helpful answer as the preferred response, and a refusal as the dispreferred response. Unlike prior benign fine-tuning attacks, our data exhibits no suspicious behavior: it is practically indistinguishable from the fine-tuning request of a legitimate user seeking to reduce over-refusal, making harmful intent almost impossible to infer from the request alone. Nevertheless, because DPO directly optimizes the model to prefer helpful answers over refusals, this seemingly benign objective broadly suppresses refusal behav…

• YouTube Music launches new labels as AI-generated music floods streaming platforms3

  YouTube Music is adding labels to songs fully or partially generated by AI, shown on the player page.

  TechCrunch2 days agoyoutubeai-labelingmusic

  Feed excerpt

  The label will appear on the player page and include songs entirely generated by AI or partially, such as AI involved in composition and vocals.

• AI agents aren't 'going rogue.' Frontier labs are skipping security basics3

  CSO Online argues frontier AI labs are neglecting basic security practices in their agent deployments rather than agents going rogue.

  Hacker News (front page)2 days agoai-agentssecurity

  Feed excerpt

  Article URL: https://www.csoonline.com/article/4234854/ai-agents-arent-going-rogue-frontier-labs-are-skipping-security-basics.html Comments URL: https://news.ycombinator.com/item?id=50091788 Points: 15 # Comments: 1

• OpenAI claims an ex-employee took its product plans and presented them to Apple3

  OpenAI alleges a former employee took over 100 product-plan files and presented them to Apple leadership, per a court filing.

  The Verge2 days agoopenaiappletrade-secretslitigation

  Feed excerpt

  OpenAI claims a former employee took more than 100 files related to its product plans before joining Apple. In a document filed on Wednesday, OpenAI accuses the unnamed employee of sending this information to a personal account and then presenting it to Apple leadership, including the vice president of the company's operations in Asia. The filing, reported earlier by Reuters, is tied to a legal battle between Apple and OpenAI over trade secrets - but this time, OpenAI is doing the accusing. It alleges that the files in question contain images of at least one unreleased device, along with supplier information, engineering data, project files … Read the full story at The Verge.

• Anthropic warns small AI models could self-replicate through IoT devices3

  Anthropic researchers warn small AI models could self-replicate via IoT devices, enabling a new class of computer worms.

  Ars Technica2 days agollmmalwareresearch

  Feed excerpt

  "Small weight-based replicators" could usher in a new generation of computer worms.

• OpenAI, Google pushing new AI models easily tricked into making nudes, researchers say3

  Researchers found new attack methods can trick OpenAI and Google AI models into generating nude images despite safeguards.

  Ars Technica2 days agollmjailbreaksafety

  Feed excerpt

  Attack method exposes flaws in OpenAI, Google safeguards against AI nudes.

• Aidlc: Adaptive workflow steering rules for AI coding agents2

  AWS Labs released AIDLC, a set of adaptive workflow steering rules for guiding AI coding agents.

  Hacker News (front page)yesterdayai-agentsawsopen-source

  Feed excerpt

  Article URL: https://github.com/awslabs/aidlc-workflows Comments URL: https://news.ycombinator.com/item?id=50100387 Points: 6 # Comments: 0

• Figma announces new features to define how agents work on its platform2

  Figma announced new features letting AI agents work on its design platform, and released its code layers feature in open beta.

  TechCrunchyesterdayfigmaagentsdesign-tools

  Feed excerpt

  Figma is also releasing its code layers feature in open beta.