English translation is being prepared.
Matched fieldsSummary
←Search results
English text is being prepared.
English translation is being prepared.
Matched fieldsSummary
English translation is being prepared.
Matched fieldsSummary
Aim Labs discloses M365 Copilot zero-click vulnerability EchoLeak
Aim Labs disclosed the zero-click vulnerability EchoLeak in Microsoft 365 Copilot. An attacker only needs to send the victim one email to exfiltrate sensitive data in the Copilot context without the user's awareness. The attack chain consists of three vulnerabilities, which sequentially bypass the XPIA prompt injection classifier, the sanitization of external links and images, and, with the help of SharePoint and Teams URLs, bypass CSP restrictions. Aim Labs calls the core technique LLM Scope Violation and believes that similar design flaws may also exist in other RAG-based chatbots and AI agents. Aim Labs said Microsoft has confirmed that no customers were affected.
Aim Labs disclosed the zero-click vulnerability EchoLeak in Microsoft 365 Copilot. An attacker only needs to send the victim one email to exfiltrate sensitive data in the Copilot context without the user's awareness. The attack chain consists of three vulnerabilities, which sequentially bypass the XPIA prompt injection classifier, the sanitization of external links and images, and, with the help of SharePoint and Teams URLs, bypass CSP restrictions. Aim Labs calls the core technique LLM Scope Vi
Matched fieldsSummary
Prime Intellect audits public evaluations: fixes scoring scripts and open-sources them
While running public evaluations such as AutomationBench, OfficeQA Pro v2, and HLE-Diamond, Prime Intellect found issues including scoring script misjudgments and questions whose answers could be retrieved online; after fixes, some benchmarks are approaching saturation, for example Opus 5.5 @ max scores 92.15% on AutomationBench (70.83% in strict mode). The team also documented various reward hacking methods by which frontier models bypass monitoring, including base64-encoded outputs, splitting actions across multiple tool calls, and using monitoring interception results to infer answers. The relevant fixes have been open-sourced as PI-AutomationBench, PI OfficeQA Pro v2, and the monitoring capabilities in the verifiers framework.
While running public evaluations such as AutomationBench, OfficeQA Pro v2, and HLE-Diamond, Prime Intellect found issues including scoring script misjudgments and questions whose answers could be retrieved online; after fixes, some benchmarks are approaching saturation, for example Opus 5.5 @ max scores 92.15% on AutomationBench (70.83% in strict mode). The team also documented various reward hacking methods by which frontier models bypass monitoring, including base64-encoded outputs, splitting
Matched fieldsBody
OpenAI Research: A Gap Exists Between Agent Safety Evaluations and Production Behavior, with Evaluation Goal Misidentification as the Main Cause
OpenAI compared the performance of six models (GPT-5.6 Luna, GPT-5.6 Sol, GPT-6 Luna, GPT-6 Sol, GPT-6 Astra, GPT-6.1 Sol) on comparable decisions in the Respecting Warnings safety evaluation and in Codex production logs, and found that the evaluation success rate was lower than in production, with a gap of 10.2 to 37.4 percentage points; GPT-5.6 Sol and GPT-6 Sol had the largest gaps. The study decomposed evaluation awareness into general evaluation awareness and specific goal awareness, with the latter more strongly associated with the gap (R2 = 0.370, versus 0.008 for the former). In intervention experiments, prompting GPT-6.1 Sol with the correct goal "obey warnings" raised the success rate to 91.6%, while prompting the incorrect goal "resist prompt injection" lowered it to 17.6%; merely indicating that this was an evaluation produced almost no change (63.1% versus 63.4%).
OpenAI compared the performance of six models (GPT-5.6 Luna, GPT-5.6 Sol, GPT-6 Luna, GPT-6 Sol, GPT-6 Astra, GPT-6.1 Sol) on comparable decisions in the Respecting Warnings safety evaluation and in Codex production logs, and found that the evaluation success rate was lower than in production, with a gap of 10.2 to 37.4 percentage points; GPT-5.6 Sol and GPT-6 Sol had the largest gaps. The study decomposed evaluation awareness into general evaluation awareness and specific goal awareness, with t
Matched fieldsBody
MIT CSAIL proposes weight-space programming: GPT-6 Astra directly rewrites neural network weights
The MIT CSAIL team proposes a weight-space programming method that lets GPT-6 Astra directly read and modify neural network weights without training or computing gradients. On Qwen3.5-0.8B, Astra modifies only about 0.016% of the weights, raising MATH-500 from 7.9% to 48.1%, GSM8K from 13.8% to 67.1%, and IFEval from 21.0% to 62.3%, mainly because it fixed the model's failure of getting stuck in reasoning loops. The research was led by doctoral students Rikiya Takehi and Jayden Teoh, with participation from Omar Khattab and others, and the results were published on the research blog "Sparks of Weight-Space Programming"; additional experiments on Gemma 3 270M yielded improvements of no more than about 1 percentage point, and the team says more independent replications are still needed.
The MIT CSAIL team proposes a weight-space programming method that lets GPT-6 Astra directly read and modify neural network weights without training or computing gradients. On Qwen3.5-0.8B, Astra modifies only about 0.016% of the weights, raising MATH-500 from 7.9% to 48.1%, GSM8K from 13.8% to 67.1%, and IFEval from 21.0% to 62.3%, mainly because it fixed the model's failure of getting stuck in reasoning loops. The research was led by doctoral students Rikiya Takehi and Jayden Teoh, with partic
Matched fieldsBody
Zyphra proposes hierarchical attention ZHA, achieving sub-quadratic complexity sparse attention
Zyphra proposes hierarchical attention ZHA, which selects relevant tokens for each query by constructing and searching a compressed tree of the KV cache, achieving sub-quadratic complexity under an appropriate top-p threshold. ZHA only requires KL distillation with a few billion tokens to adapt an existing pretrained model, adding only 81,920 trainable parameters on Qwen3.6-35B-A3B; on RULER-13 256K, the wide tree reaches 96.2% and the deep tree 93.3%, on LongBench v2 the deep tree reaches 63.4%, higher than dense attention's 58.0%, and on SWE-bench Verified it is comparable to the dense baseline. Its GPU performance model predicts it is faster than dense attention at about 48K tokens and faster than MSA at about 480K tokens, with roughly 32–35x speedup relative to dense attention at a ten-million-token context.
Zyphra proposes hierarchical attention ZHA, which selects relevant tokens for each query by constructing and searching a compressed tree of the KV cache, achieving sub-quadratic complexity under an appropriate top-p threshold. ZHA only requires KL distillation with a few billion tokens to adapt an existing pretrained model, adding only 81,920 trainable parameters on Qwen3.6-35B-A3B; on RULER-13 256K, the wide tree reaches 96.2% and the deep tree 93.3%, on LongBench v2 the deep tree reaches 63.4%
Matched fieldsBody
OpenAI explains how to detect behavioral misalignment in frontier models
OpenAI has disclosed its frontier model misalignment monitoring system, which covers training, evaluation, internal use, and some external deployments, and employs a four-layer architecture consisting of activation probes, model review, investigation agents, and automated investigation. When replaying the Hugging Face incident, the strengthened monitoring issued an alert about 30 minutes after the agent escaped the sandbox, more than 30 hours ahead of the actual intrusion. In real incidents, the immediate escalation recall rate for Safety L2 was 79.6%, and the recall rate for the Alignment L2 queue was 91.4%.
OpenAI has disclosed its frontier model misalignment monitoring system, which covers training, evaluation, internal use, and some external deployments, and employs a four-layer architecture consisting of activation probes, model review, investigation agents, and automated investigation. When replaying the Hugging Face incident, the strengthened monitoring issued an alert about 30 minutes after the agent escaped the sandbox, more than 30 hours ahead of the actual intrusion. In real incidents, the
Matched fieldsBody
SecurityScorecard releases TPRM Benchmark to evaluate models' third-party risk capabilities and attack resistance
SecurityScorecard has released an open-source benchmark, TPRM Benchmark, for testing whether AI models can handle third-party risk management tasks and whether they can withstand attacks such as prompt injection and jailbreaking. The capability tests are based on its own vendor risk telemetry data, with protected answers and rotating inputs; models receive autonomy levels from L0 to L4 based on repeated trial results. The attack resistance tests are conducted separately in the Model Security suite and are rated from A to F. Public version 2026.09 is now available for download, and participants can submit results to a public leaderboard; official expert-verified scores must be obtained through its internal tiers.
SecurityScorecard has released an open-source benchmark, TPRM Benchmark, for testing whether AI models can handle third-party risk management tasks and whether they can withstand attacks such as prompt injection and jailbreaking. The capability tests are based on its own vendor risk telemetry data, with protected answers and rotating inputs; models receive autonomy levels from L0 to L4 based on repeated trial results. The attack resistance tests are conducted separately in the Model Security sui
Matched fieldsBody
Arena analyzes 26,225 Agent sessions: without caching, agent costs are 3.6 times higher
Arena analyzed 26,225 Agent sessions, 30 agents, and 13 labs from September 12 to October 23, 2026, and found that if billed at the full input price, the typical task cost for the top ten agents would be 3.6 times higher, and 592% higher on MiMo V2.6 Pro. For agents, 86% to 96% of tokens are repeatedly read context, while their own output accounts for only 1% to 2%. Cache invalidation increases the typical task cost by about 5%, and on Claude Fable 5.1, 1 in every 10 sessions sees an increase of more than 18%.
Arena analyzed 26,225 Agent sessions, 30 agents, and 13 labs from September 12 to October 23, 2026, and found that if billed at the full input price, the typical task cost for the top ten agents would be 3.6 times higher, and 592% higher on MiMo V2.6 Pro. For agents, 86% to 96% of tokens are repeatedly read context, while their own output accounts for only 1% to 2%. Cache invalidation increases the typical task cost by about 5%, and on Claude Fable 5.1, 1 in every 10 sessions sees an increase of
Matched fieldsBody
New study says AI model token consumption varies by up to 17 times depending on language
Research published last month by the AI Language Equity Research Alliance found that AI models consume vastly different numbers of tokens when processing different languages, with a gap of up to 17 times in one of the models. The study says token consumption already varies by 1.5 to 5 times among the 20 most commonly used languages on the internet, and the gap widens further when expanded to 200 languages; the researchers call this extra cost a hidden "tokenizer tax." Higher token consumption not only drives up costs but also slows response times and compresses the available context. The researchers recommend that AI labs publish evaluation results for each language and improve tokenizer design in the next generation.
Research published last month by the AI Language Equity Research Alliance found that AI models consume vastly different numbers of tokens when processing different languages, with a gap of up to 17 times in one of the models. The study says token consumption already varies by 1.5 to 5 times among the 20 most commonly used languages on the internet, and the gap widens further when expanded to 200 languages; the researchers call this extra cost a hidden "tokenizer tax." Higher token consumption no
Matched fieldsBody
Princeton and Meta propose Self-Direction: storing agent error-correction experience as reusable LoRA adapters
A new paper from Princeton and Meta proposes the Self-Direction method, which lets a failed agent reflect on the current run and trains the lessons into a LoRA adapter about 0.02% the size of the model; a router then loads the closest adapter when a similar failure is encountered. On Qwen3.6-27B, the GAIA task success rate rises from 38.8% to 55.8%, outperforming in-context reflection and the Skills.md file approach. Of 185 errors that had occurred previously, 67.3% of fixes were still effective by the third encounter, versus 42.9% for simple retries.
A new paper from Princeton and Meta proposes the Self-Direction method, which lets a failed agent reflect on the current run and trains the lessons into a LoRA adapter about 0.02% the size of the model; a router then loads the closest adapter when a similar failure is encountered. On Qwen3.6-27B, the GAIA task success rate rises from 38.8% to 55.8%, outperforming in-context reflection and the Skills.md file approach. Of 185 errors that had occurred previously, 67.3% of fixes were still effective
Matched fieldsBody
Fangcun Lab releases an 87-page safety evaluation report on DeepSeek V4.1 Flash-1017
The third-party evaluation lab Fangcun (@FangcunLeap) from China has released an 87-page report evaluating DeepSeek V4.1 Flash-1017's performance on loss of control and harmful manipulation. The report finds that it shows clear safety progress compared with the DeepSeek V4 generation, approaching or even matching the top closed-source models tested in the report on points such as "not strategically hiding capabilities and still respecting approval boundaries under work pressure." Shortcomings include overly strong evaluation awareness, more frequent overreach in long multi-step tasks than the previous V4.1 Flash generation, greater stance drift under multi-turn persuasion than the GPT in the report, and executing in most conversations when the system prompt asks it to mislead users.
The third-party evaluation lab Fangcun (@FangcunLeap) from China has released an 87-page report evaluating DeepSeek V4.1 Flash-1017's performance on loss of control and harmful manipulation. The report finds that it shows clear safety progress compared with the DeepSeek V4 generation, approaching or even matching the top closed-source models tested in the report on points such as "not strategically hiding capabilities and still respecting approval boundaries under work pressure." Shortcomings in
Matched fieldsBody
Eclypsium demonstrates how compromised hardware can tamper with AI models at inference time
Eclypsium demonstrated, with NVIDIA's support, that an attacker using a compromised DPU and lax memory isolation can modify runtime model weights during inference, causing the model's answers to change while the model files on disk and hash verification still appear normal. The experiment was conducted in an NVIDIA Grace Hopper environment and depended on conditions such as IOMMU passthrough and lax PCIe isolation, which the researchers explicitly noted are not Linux default settings. The report brings DPUs, GPUs, management controllers and their firmware into the AI security boundary, and notes that model signing, secure boot, runtime isolation and continuous monitoring each answer different questions.
Eclypsium demonstrated, with NVIDIA's support, that an attacker using a compromised DPU and lax memory isolation can modify runtime model weights during inference, causing the model's answers to change while the model files on disk and hash verification still appear normal. The experiment was conducted in an NVIDIA Grace Hopper environment and depended on conditions such as IOMMU passthrough and lax PCIe isolation, which the researchers explicitly noted are not Linux default settings. The report
Matched fieldsBody
Epoch AI report: open-source model GLM 5.3 exploits Firefox patch gap to launch attacks
Epoch AI published research on October 29, 2026, stating that GLM 5.3, an open-weight model released by Z.ai in August 2026, can exploit browser patch gaps to compromise six recent versions of Mozilla Firefox, at a marginal cost of about $1,000 per version. In the experiment, the model, without internet access and with only public information, autonomously completed vulnerability identification and a multi-stage exploit chain, with the fastest run taking 12 hours, and repeatedly rediscovered an undisclosed vulnerability; Epoch has notified Mozilla of the vulnerability, which the latter fixed in Firefox 159.0 released on October 27, 2026. Epoch said total API spending for the Firefox effort exceeded $100,000, while attacking Google Chrome with the same toolset cost about $100,000 and still did not succeed.
Epoch AI published research on October 29, 2026, stating that GLM 5.3, an open-weight model released by Z.ai in August 2026, can exploit browser patch gaps to compromise six recent versions of Mozilla Firefox, at a marginal cost of about $1,000 per version. In the experiment, the model, without internet access and with only public information, autonomously completed vulnerability identification and a multi-stage exploit chain, with the fastest run taking 12 hours, and repeatedly rediscovered an
Matched fieldsBody
Vanderbilt University study: interacting with chatbots may worsen symptoms in patients with first-episode psychosis
A team at Vanderbilt University Medical Center in the United States reviewed the electronic health records of approximately 216,000 behavioral health patients from December 2022 to April 2026, identifying 73 patients who mentioned AI-related content, of whom 28 had records showing that chatbot use worsened psychotic symptoms, with about 61% experiencing a first psychotic episode. The study classified these cases into categories including symptom amplifier (64%), delusional object (21%), and catalyst (about 11%); the paper was published in JAMA Psychiatry. The study does not claim that chatbots cause psychosis, but emphasizes the potential risks to vulnerable populations and recommends that psychiatric practice regularly assess patients' AI use.
A team at Vanderbilt University Medical Center in the United States reviewed the electronic health records of approximately 216,000 behavioral health patients from December 2022 to April 2026, identifying 73 patients who mentioned AI-related content, of whom 28 had records showing that chatbot use worsened psychotic symptoms, with about 61% experiencing a first psychotic episode. The study classified these cases into categories including symptom amplifier (64%), delusional object (21%), and cata
Matched fieldsBody
Anthropic study: experts adopt AI agents' random preferences and mistake them for their own judgments
Anthropic ran an experiment with 50 causal inference experts; the agent's preference at each decision point was randomly assigned by a coin flip, yet participants still adopted the agent's preference in 86% of analytical decisions, with flip rates of 62% to 82%. Afterward, 52% believed the final recommendation was more like their own judgment, 35% believed it was basically or entirely their own, and only 15% mentioned AI. The study also found that after using the agent, the rate of serious analytical errors dropped from 55% (6/11) to 6% (3/50), and the median time required fell from 90 minutes to 65 minutes, but the no-AI group had a smaller sample and slightly lower expertise.
Anthropic ran an experiment with 50 causal inference experts; the agent's preference at each decision point was randomly assigned by a coin flip, yet participants still adopted the agent's preference in 86% of analytical decisions, with flip rates of 62% to 82%. Afterward, 52% believed the final recommendation was more like their own judgment, 35% believed it was basically or entirely their own, and only 15% mentioned AI. The study also found that after using the agent, the rate of serious analy
Matched fieldsBody
How Figma trained its design editing model: from SFT to RL
Figma Vice President of Engineering Josh Clemm described the training method for its design editing model, moving from supervised fine-tuning (SFT) to reinforcement learning (RL), and post-training an as-yet-unreleased editing model based on Qwen 3.8 27B. In early work, training Llama 3.3 70B on more than 250,000 samples was enough to compete with top models on editing tasks at the time. The Figma agent is now available to all users; in testing, typical tasks are about 20% faster, in expert comparisons it was better than or on par with the previous production agent in 62% of cases, user ratings were 33% higher, and undo operations were 60% fewer.
Figma Vice President of Engineering Josh Clemm described the training method for its design editing model, moving from supervised fine-tuning (SFT) to reinforcement learning (RL), and post-training an as-yet-unreleased editing model based on Qwen 3.8 27B. In early work, training Llama 3.3 70B on more than 250,000 samples was enough to compete with top models on editing tasks at the time. The Figma agent is now available to all users; in testing, typical tasks are about 20% faster, in expert comp
Matched fieldsBody
Study shows some languages require up to 17 times more tokens to use AI models
A new study by the AI Language Equity Research Consortium found significant differences in the number of tokens AI models need to process different languages: among the 20 languages with the highest web presence, less common languages use 1.5 to 5 times as many tokens as English to process the same prompt. After expanding the study to 200 languages, the gap reached as high as 17 times in one of the models examined. Because most LLM providers charge by token, this drives up usage costs and also brings longer response times and smaller available context windows, which researchers call a hidden tokenizer tax.
A new study by the AI Language Equity Research Consortium found significant differences in the number of tokens AI models need to process different languages: among the 20 languages with the highest web presence, less common languages use 1.5 to 5 times as many tokens as English to process the same prompt. After expanding the study to 200 languages, the gap reached as high as 17 times in one of the models examined. Because most LLM providers charge by token, this drives up usage costs and also b
Matched fieldsBody