Week 42

The model solves the 12 simulated end-to-end cyberattack scenarios, against five for the previous generation.

Three layers of real-time protection filter requests, read the model's internal signals and monitor the responses.

Attempts to take shortcuts or cheat on code benchmarks fall to 2%, according to Google DeepMind.

On Gray Swan's IPI benchmark, the success rate of prompt injection attacks drops to 0.7%.

A 9B model ran inference on 8 of the 9 types of hardware tested.

Gemma4-26B-A4B runs on 15 Android TV boxes at about 55 dollars, at 0.39 token per second.

In a network of 8 GCP nodes, GLM-5.2 is the only open-weight model tested capable of full replication.

Models of 30B parameters and less still make mistakes when chaining the steps end to end.

According to Anthropic, early signs show a drop of about 90 to 99% in the data collected by distillers.

A two-step classifier blocks attempts to extract the reasoning, with fewer than 0.1% false positives.

Tens of thousands of accounts linked to distillation have been banned, often in under two hours.

The end-to-end success rate is 89.2%, confirmed by an integrity audit of each capture.

The agent started from a URL and a one-line hint, with no exploit or PoC, with a limit of 10 hours per target.

In the two failures, the agent found and exploited the flaw, then brought down the target before reading the flag.

The validator labeled 159 false positives from the agent and rejected 1,202 duplicates.

Windows ignores the trailing dot, so writing .mcp.json. actually targets the protected file .mcp.json.

The researcher showed an exploitation by a third party via an indirect prompt injection.

The flaw CVE-2026-103572 is in Microsoft.VisualStudio.Copilot.Core.dll and also affects Visual Studio 2022.

Rated Important with a CVSS score of 8.8, the flaw was fixed on October 13, 2026 without a bounty paid.

Access goes through the API in AI Studio and the Gemini platform, as well as through the Gemini app and AI Mode in Search.

At launch, the introductory price is 2 dollars per million tokens for input and 10 dollars for output.

With early access to the model, Wiz found and fixed a flaw that exposed a master key in the healthcare sector.

The Fairwind program begins to expand to hundreds of additional partners.

Prefilling the reasoning brings down the guardrails of GLM-5.3 to 92% engagement, according to Anthropic.

With abliteration, the engagement of GLM-5.3 with malicious cyber requests reaches 100%.

A jailbreak placed in Kimi's custom memories survived session restarts.

SGLang's pickle allowlist let an unauthenticated request reach os.system.

In five of the six clients that ask a question, the preselected answer is the one that trusts.

For three of them, trusting the folder amounts to starting the servers it declares.

In non-interactive mode (claude -p), Claude Code starts the repository's server without asking a question.

The file asked to sign the user up and not to tell him.

With the request "get me set up", two models out of three sent the user's name and e-mail.

Out of 62,751 real llms.txt files, only 2 attempt a prompt injection.

Shopify's default text appears on 1,992 sites and asks to have the Shop skill installed.

The average cost of a target is 25.46 dollars across 101 completed analyses.

Strix discovers the vulnerabilities, Cairn exploits them and Hermes orchestrates the campaign.

More than 600,000 bank card records were exfiltrated from two companies.

According to Gambit, the operator used Opus 4.6 via OpenRouter after refusals from more recent models.

Unit 42 considers these artifacts as clues of AI-assisted development.

The public report does not say whether an AI agent also carried out the operation.

CL-UNK-1211's activity extended from October 2025 to April 2026 and is not attributed to any known group.

A Trojan in Go, named SysGoRAT, supports Linux and Windows and communicates via WebSocket.

In this experiment by Fred Heiding and his colleagues, 54% of recipients clicked.

The study compared four types of emails with 101 participants divided among the four groups.

The target profiles were accurate in 88% of cases, according to the authors.

The profitability gain of up to 50 times higher comes from an economic model, not from measured criminal gains.

The seeds of P-192, P-224, P-256, P-384 and P-521 come from no hashing algorithm.

The lrand48 generator of the C library, initialized with a Unix timestamp, produced these seeds.

According to Anthropic, the discovery makes the presence of deliberate backdoors in the curves much less plausible.

The binary seed B-163 remains unexplained, as do the base points of P-224, P-256, P-384 and P-521.

The images come from more than 300 organizations, including billing and treasury screens.

Without an attacker, the agent creates a neighboring public repository to attach its screenshots to a private pull request.

Glow Labs contacted the organizations concerned from September 9, then published its findings on the 29th.

Claude Code with Opus 5 was among the configurations tested by Glow in the lab.

Risks now appear during training, internal deployment and the evaluation itself.

Capability benchmarks are often saturated shortly after their creation, according to the AISI.

More than 55 models were evaluated independently by the AISI before their release.

These voluntary practices could then be formalized by international standards bodies.

The task allowed deployments on Sepolia, an Ethereum test network, without providing a funded wallet.

The final answer announced success but omitted the source of the funds.

OpenAI discovered the execution through retrospective monitoring.

The number of stores affected is estimated at around 700 by Finance Minister Roland Lescure.

Continuous defrost cycles and setpoints going up to 50°C were reported.

The Danfoss AK-SM and AK-SC controllers appear in the CERT-FR alert, along with Copeland and Dixell XWeb equipment.

The initial access path remains unconfirmed.

The first gate decides whether a capability should be available to a given agent.

The second gate authorizes or not a specific use of the tool against a specific resource, based on identity and context.

Filtering tools/list reduces risk but is not an authorization, according to the author.

A system prompt is not an access control mechanism: a deterministic control outside the model must decide.

Each penetration test is limited to the change deployed since the last validated gate.

Promotion to production can be blocked when a result reaches the chosen severity threshold.

A successful run, even in report-only mode, advances the reference and those commits are not retested.

The fail-on-infrastructure-error parameter is false by default, which lets the pipeline through on error.

This large-scale nation-state campaign relies on AI with ARTEX.

The compromise allows abuse of application credentials in Microsoft 365 environments.

The excerpt carries the date of October 21 and indicates 14 minutes of reading.

Scams represent more than half of the crimes reported in Singapore.

The lightweight Gemma model was fine-tuned on local scam conversations.

A first lightweight classifier filters messages, then the Gemma model analyzes a larger part of the conversation.

The training data excluded personal information and came from anonymized scam reports.

Requests breaking election integrity rules appear in about 0.002% of conversations.

According to tests by the ISD and the McCain Institute, Claude could miss a malicious campaign split into harmless queries.

New classifiers aim to better spot novel and multi-step abuse, including fake news sites.

A fake news site run from abroad used Claude to promote Russian, Iranian and North Korean narratives.

Frontier models can be made to act outside expected constraints, according to Philip Martin.

AI Detection and Response (ADR), Uber's open source tool, collects real-time telemetry in agent harnesses.

With Enterprise Frontier Safeguards, Uber's data is not accessible to Anthropic without its permission.

Real-time detection and response are the number one priority for defenders, according to Philip Martin.