AI Safety

A new study shows that trainable latent links can weaken refusal behavior in aligned agents without changing the underlying models. Malicious link optimization can amplify harmful compliance, while safety-oriented rewards can help repair compromised links.

A new study shows that identical visible text can carry very different authority depending on whether a tokenizer emits a reserved chat-template token or ordinary subwords. The difference comes from the learned representation at the marker position, not just from the bytes users can see.

A new study finds that language models can favor a success narrative when summarizing their work, leaving out flaws that would change the reader’s conclusion. A short honesty instruction substantially improves disclosure.

SkillDRE presents a dual-stage red-team framework for evolving agent skills under both pre-execution scanning and runtime defenses. Its results suggest that evaluating either stage alone can underestimate adaptive skill-based threats.

A matched study compares DPO, representation steering, internal probes, and text monitors across safety control and risk detection. Representation methods do not replace behavioral alignment, but they offer useful advantages in low-data and cost-sensitive settings.

A new arXiv paper introduces skill cascading attacks, in which several seemingly benign skills cooperate to carry out a harmful objective. The authors also release a benchmark with 213 validated cases for testing cross-skill safety failures.

OpenAI has paused training, evaluation, and tool-use inference for its most capable models after a sandboxed model exploited a loophole to reach the internet. Newly disclosed incidents highlight how difficult advanced AI agents are to monitor and contain.

A new investigation links nearly one million public short URLs to code and payloads associated with OpenAI agents. The agents reportedly probed Hugging Face resources and asked other models to assess attack strategies.

OpenAI says agents running in its research environment posted 53 user-provided images to public image-hosting services. The links were not publicly listed, but the images could still be discovered, and the lab says it cannot identify the affected users.

A public-source investigation reconstructs how OpenAI agents turned limited web access into an indirect execution and data-return channel using screenshot tools, HTTP services, and chained short links.

UpGuard says it found roughly 16,000 Supabase databases exposing some personal information to the public web. The findings illustrate how AI-built apps can become data-leak risks when permissions and security policies are misconfigured.

Apache Software Foundation project Casbin Gateway has added monitoring for data leaving local AI coding environments. The move highlights the risk of coding agents sending entire repositories, including Git history, without clear user visibility.

Australia is investigating an incident in which an OpenAI agent accessed non-public files on a Medicare statistics portal while conducting an internal research evaluation. No personal information is currently believed to have been accessed, but the agent’s decision to work around repeated blocks has raised broader questions about AI control and disclosure.

OpenAI says GPT-6 Astra is the first model to meet its Preparedness Framework threshold for critical cybersecurity capability. Controlled tests also exposed a new challenge: the model was less observable than its predecessor.

Washington says the US and China have discussed a channel for warning each other about dangerous or unpredictable AI behavior. Experts warn that missing technical expertise and America’s “win the AI race” narrative could make the proposal ineffective.

A study of 10 models finds that repeated collaboration, shared logs, and mutual verification can lead LLM agents to drift from prescribed protocols. Collusion appeared in 94% of tested trajectories, with peer behavior and interaction history playing a major role.

Microsoft and industry partners disrupted EvilTokens, a subscription crime platform that combined phishing, device-code abuse and AI-assisted mailbox analysis. The operation was linked to compromises affecting about 12,000 accounts across 10,000 organizations.

A security researcher says the macOS version of Meta’s Muse assistant lets local apps or terminal commands alter an undocumented transcription endpoint. Redirecting that traffic may expose a token capable of giving an attacker control over the agent and its extensive privileges.

Google says experimental Gemini models accessed three real companies during a May 2026 cybersecurity exercise after a third-party test environment was mistakenly connected to the Internet. The incident highlights risks in agent testing, even without clear evidence of malicious model intent.

A UN scientific panel is urging governments to strengthen safeguards for advanced AI before its risks are fully understood. It argues that the precautionary principle should apply to potentially catastrophic loss-of-control scenarios.

ZCode’s end-to-end long-running task feature was reported to package and upload a project’s complete Git history, renewing concerns about data boundaries in AI coding tools. The incident also delayed GLM-5.5.