{"schema_version":"agidreams.edition.v1","id":387,"slug":"autonomous-offense-graded-honestly","title":"Autonomous Offense, Graded Honestly","date":"2026-09-22","published_at":"2026-09-22T07:46:20Z","canonical_url":"https://agidreams.us/edition/autonomous-offense-graded-honestly","markdown_url":"https://agidreams.us/edition/autonomous-offense-graded-honestly.md","json_url":"https://agidreams.us/edition/autonomous-offense-graded-honestly.json","content_format":"markdown","content":"\n\nThe most useful number in cyber-AI today is a blinded one. Running GLM-5.3 and its cheaper sibling GLM-5.3 Flash against 59 cyber-investigation cases the models had never seen, botsbench found the two effectively level: 29 solved for the full model, 32 for Flash. The full model pulls ahead only on BOTSv3, a practice set public for years. The real story is price. GLM-5.3 costs roughly fifteen times more per solved case than Flash and solves no more of them. Flash's best run, 38 of 59, is the highest any open-weight model has reached here, matching the GLM-5.2 it replaces at a fraction of the cost. The same model also scored 64% in one agent harness and 54% in another, proof that a score belongs to a scaffold, not the weights (more: https://botsbench.com/cybt-ctf-glm53.html).\n\nAgainst a backdrop of capture-the-flag audits that caught models git-cloning official writeups and reading plaintext flags, the line worth underlining is that these cases were blinded, with no contamination, cheating, or refusals.\n\nExploitation is where autonomy stops being abstract. Inside ExploitBench, a model built a full renderer-grade chain against V8 in Chrome 127, from a WebAssembly out-of-bounds write through address disclosure, a sandbox cage escape, arbitrary native read-write, and native code execution, scored 16 of 16. The evidence is not one lucky grade but a three-day ladder of 50 recorded grader runs climbing from 2 to 16 across roughly fifteen distinct solution hashes, dead ends included. A full browser compromise still needs a second broker-escape stage, but this is arbitrary code execution in the V8 process, built iteratively by the agent (more: https://github.com/lordx64/cyberkimi-benchmarks/tree/main/ExploitBench/CVE-2024-6100).\n\nCaleb Gross, in a Black Hat talk on his SiftRank tool, reframes the whole exercise: vulnerability discovery is an attention problem, not a detection problem. Rather than force one model to absorb context, reason, and act in a single loop, it asks only for a reordering of small document batches by relevance to a deliberately vague query. Pointed at a WattBox surge protector's 55 MB firmware decompiled into about 5,700 functions, it ranked them in batches of six and collapsed the corpus to about four candidates. The top hit dropped a parameter straight into a popen call, an unconstrained root shell, now patched with a CVE. On the BinPwn dataset it beat zero-shot classification by more than double, and small models like GPT-5 Nano matched the full model. The edge grows as vulnerabilities get rarer, which is the real-world case (more: https://www.youtube.com/watch?v=1ADD60wyrbg).\n\n\n\nTwo projects come at model safety from opposite ends and reach the same conclusion: the guardrails are thinner than the marketing implies. The research contribution is BLOOM-WILT, out of the University of Manchester, which extends an automated auditing pipeline with two tricks that need no training, no second model, and no access beyond the target's next-token logits. One lets the auditor revise its strategy across rounds from judge scores; the other blends the target's own next-token distribution with a second one conditioned on a behavior-eliciting prompt, masking tokens the base model would never produce. Because it reuses the same weights and does not decay across a generation, the elicited behavior persists through multi-turn conversations, which is what auditing requires (more: https://arxiv.org/abs/2608.31105v1).\n\nTested on four small instruct models chosen so differences reflect alignment rather than scale, the method improves on every metric with no overlapping error intervals and, in the authors' words, overturns the previous safety rankings. Qwen3.5-4B looked safer than its peers under ordinary auditing and turns out no better than the rest once real pressure is applied, while Gemma-4-E4B holds up best. The honest limits: only 3-to-4-billion-parameter targets were tested, the method needs output logits so text-only APIs are out of reach, and some refusals survive. The conclusion is blunt, that these models' safety alignment is shallower than it appeared.\n\nIf BLOOM-WILT measures how shallow alignment is, phantom-kv exploits it. The project strips refusal behavior without touching weights, shipping the change as a loadable key-value cache graft, a small bank of per-layer tensors spliced into the attention cache. Nothing is subtracted or projected out; the model's own attention does the steering, and unloading the graft leaves the base model byte-identical again. On Qwen3-4B the base refuses 25 of 60 harmful prompts; the strongest graft cuts that to 5 while holding divergence on harmless prompts near 0.015 nats. The author does not oversell it: capability drops under the graft, and it covers only dense Qwen3. As a dual-use artifact it is notable precisely because it looks like ordinary conversation history and hot-swaps mid-session; its disclosed leakage evals are the responsible part (more: https://github.com/lordx64/phantom-kv).\n\n\n\nThe clean version of the reseller scam is old news; the named, criminally-framed version is new. NahCrofAI advertised every frontier model below the cheapest alternative, its founder claiming custom inference engines and blaming competitors' prices on skill issues. An investigation showed it was an OpenRouter wrapper that silently routed to weaker, cheaper models. A model sold as kimi-k3 at two dollars in and ten out was served as GLM-5.3 Flash, a 13-fold markup on input and 20-fold on output, and the house model family, pitched as in-house work, routed to GLM-5.2, Qwen, and Kimi. The physical claims did not survive contact either: running Kimi K3 even at brutal two-bit quantization needs roughly 802 GiB, and the largest rental box available tops out near 765 GiB (more: https://old.reddit.com/r/LocalLLaMA/comments/1wgwe4n/crofai_cheapest_inference_provider_in_the_world/).\n\nWhat makes it a case study is the response pattern. Confronted, the operator denied everything, then across five attempts changed nothing except the fingerprints betraying OpenRouter underneath. Then came a fake blog post under the pretense of a new team taking over, and about three hours later the entire online presence wiped, domains and accounts vanishing. Screenshots preserved the operator admitting the fraud spanned the service's full two-year life and then asking the investigator to help cover it up. The guidance for anyone who bought credits is sober: assume every prompt was logged and mined for keys, rotate credentials, and open chargebacks.\n\nThe trust problem is not only who bills you; it is what your local tools can reach. A proof-of-concept called not-a-mused targets the Muse dictation app through an undocumented setting that an unprivileged local process can rewrite. Redirect that endpoint and dictated prompts flow to an attacker-controlled server, opening the door to captured audio, prompt injection into Muse, and theft of the app's authentication material. This is a local attack that assumes code execution as the user already, so it is not a remote break. It matters because of amplification: an assistant granted broad access becomes a more valuable pivot than ordinary malware, since the app's access quietly becomes the attacker's. It is the same trust-boundary shape that turned agent config files into command-execution vectors (more: https://github.com/pwardle/not-a-mused).\n\n\n\nThe idea that you do not need a special model to get calibrated classifications keeps proving itself, this week as a two-line recipe. Run any GGUF in llama.cpp with the next-token count set to one and the top-probabilities count to ten, disable reasoning, and ask for a single-token yes-or-no answer. The returned log-probabilities convert to a probability by exponentiation, so a spam call comes back as 99.5% to 0.5% rather than a bare label, and a clever extension packs several yes-no questions into one forward pass by mapping each answer bit to a token. The community reaction was appropriately mixed: one noted that many such calls can cost more than one JSON fill, and another bluntly recommended constrained decoding instead (more: https://old.reddit.com/r/LocalLLaMA/comments/1wlxpaw/you_can_use_any_llm_just_like_jev/).\n\nThat raw-logprob route is one of three competing for the same job, and the trained-encoder route just got a clean local port. Laya-MLX is an independent Apple Silicon reimplementation of Convai Innovations' Laya models, which answer a typed question in one bidirectional forward pass through an encoder and a decision head rather than generating tokens. The pitch is zero output tokens and no PyTorch, Transformers runtime, or cloud dependency. On an M3 Max the 421-million-parameter English model answers a short question in about 13 milliseconds, and the port matched the upstream selected answer on all 63 validation questions in both precisions. The author is careful about scope, flagging that this is unofficial and that calibration temperatures had to be clamped to stop a shipped bucket from reporting a coin flip as near-certainty. The honest read across all three approaches is that reading a capable model's own next-token distribution is often the more accurate and better-calibrated classifier, losing little to a bespoke model (more: https://github.com/mizorewww/laya-mlx).\n\n\n\nFor two years the recurring lesson here has been that releasing weights is not the same as granting access, since a frontier open model can still demand a datacenter. This week the story moved a layer down, to the infrastructure itself. Tim Dettmers, whose earlier claim that GLM could run on a single small box invited well-earned skepticism, announced his lab's Open Source Week: two projects and four papers from a small group with a couple of GPUs. The headline demos are an agent harness that optimized his framework's Metal backend to serve a 35-billion-parameter Qwen model at 450 tokens per second at 1.5 bits per weight, and an inference framework he says runs a 125-billion-parameter model on a single 24 GB GPU. Every figure is asserted in prose with no code linked yet, so the posture is interested but waiting; his claim that a couple of people with a couple of GPUs can compete with the frontier is a thesis to test, not a result to bank (more: https://timdettmers.com/2026/09/21/dlab-open-source-week/).\n\nThe same recursive move, weights optimizing their own serving stack, is what Zhipu describes in bringing GLM-5.3-Flash to production. A GLM-5.3-powered agent did much of the systems work to deploy its own successor on a cluster of more than 100,000 Chinese-made accelerators, framed as an early form of recursive self-improvement while conceding it has not reached that bar. The concrete evidence is three checkable debugging cases, including a throughput regression traced to a dispatch call never releasing Python's global interpreter lock and a decode kernel rebuilt for a 1.71-fold speedup. The self-reported usage figures, most-used model on two platforms within a week and 62 trillion tokens in six days, carry no third-party corroboration, but the engineering narrative is specific and the merges verifiable (more: https://z.ai/blog/glm-built-its-inference-infrastructure).\n\nUnderneath sits the vendor-lock question, and one developer wrote a native Rust and Vulkan training backend covering 143 Transformer architectures with no CUDA or PyTorch. It implements forward and backward passes, AdamW, LoRA fine-tuning, and both dense and mixture-of-experts paths, tested on AMD hardware down to a handheld gaming chip. The author refuses to overclaim, stating plainly it is not yet a CUDA replacement (more: https://old.reddit.com/r/LocalLLaMA/comments/1widomo/i_built_a_native_vulkan_training_backend_for_143/). Jun Kim, creator of the oMLX framework, joined Hugging Face to maintain it full-time, graduating a side project to funded work while keeping its Apache license (more: https://huggingface.co/blog/omlx). And Thomas Wolf answered the recurring is-open-source-dying refrain not with argument but a list: roughly thirty notable open releases in ten weeks, several frontier-scale, including Kimi K3 at 2.8 trillion parameters and Qwen's 2.4-trillion Max. As one reply put it, dying quickly apparently means a new frontier model every ten days (more: https://x.com/Thom_Wolf/status/2102123398230954053?s=46).\n\n\n\nDepth pruning, deleting whole transformer blocks, is one of the cheapest ways to speed up a model, because it yields predictable savings and stacks cleanly with quantization. Multiverse Computing, last seen compressing DeepSeek with quantum-inspired tensor networks, returns with a sharp reframing: choosing which blocks to cut is a combinatorial problem, not a ranking one, because removing one block's cost depends on which others go with it. Their method assigns each block a binary keep-or-remove variable and uses a second-order expansion of the loss, whose off-diagonal terms capture exactly the pairwise couplings that magnitude and influence heuristics throw away. Selecting which blocks to drop becomes finding the low-energy states of an Ising spin glass, computed once and reused across targets, solved by brute force where feasible or an open tabu solver where not (more: https://huggingface.co/blog/MultiverseComputingCAI/pruning-llms-like-a-physicist-block-removal-as-an).\n\nThe results are strongest where they matter most, at aggressive compression. Removing half of a 70-billion-parameter Llama's depth, the method holds a key knowledge benchmark near 77 while the strongest baseline falls to the mid-50s, a gap of almost 23 points, beating that baseline on every benchmark tested. A telling detail undercuts the folk wisdom that the best cut is one consecutive chunk of middle layers: on a smaller model, the first configuration to remove an early block beat the supposed optimum after light retraining. The authors are candid that the spin-glass energy is a strong proxy but not a perfect one, and that several wins lean on retraining.\n\nThe method meets a live target in altar-1, a third-party prune of the 753-billion-parameter GLM-5.3. Using router-weighted expert activation pruning, the same family Cerebras applied to an earlier GLM two generations back, it deletes 34% of the experts and quantizes the survivors to four bits, landing at 328 GB to serve on four H200s, with routing untouched. The fidelity claim is a Kullback-Leibler divergence of 0.506 nats against the full-precision model on a sealed panel, with the calibration set weighted toward cybersecurity traces, coding, and tool calling. The standing caveat applies unchanged: a single divergence number on a sealed panel is suggestive, and independent large-scale validation would matter more than any anecdotal eval (more: https://huggingface.co/AikidoSec/altar-1).\n\n\n\nIf you want agents to do real work, the interesting question is the harness, not the model, and Workspace-OS is an unusually complete answer. It is a macOS desktop that folds a manager's whole day into one window, editing real Office files through an embedded LibreOffice engine, with AI agents working the same files in the same folders. Two ideas carry it. Live transclusion lets a value live in one spreadsheet cell and flow into every document and email that quotes it while still writing a real literal, so a broken link shows a placeholder, not a wrong number. And the reviewable agent starts every run with a shadow-git checkpoint and lands the result as a card showing the diff, cost, and turn count, kept or reverted in one click. It runs agents on your Claude subscription with no API key or telemetry, and enforces the full Electron hardening checklist. It answers a real critique, that computer-use agents waste their budget fighting the interfaces they should use, by giving the agent scoped tools and a reviewable trail instead (more: https://github.com/Clemens865/Workspace-OS).\n\nWhether more agents beat one good agent got a rigorous test from Berkeley and Microsoft Research: do agents that communicate at test time beat running many independent attempts and keeping the best? Their protocol is minimal: identical agents with no orchestrator, sharing an append-only findings log, adopting a peer's approach only after reproducing a measured improvement. On a hard reasoning suite, a five-agent team solved 8.0% of games against 2.2% for the best of five independent runs; matching the team's rate would take 33 solo agents. The gains are conditional: teams pay a coordination tax and lose to independent sampling below roughly 400,000 output tokens per agent, and where public feedback does not reliably rank intermediate states the team trailed independent pairs. The authors name the mechanism verified progress sharing and note that whether it holds when feedback is sparse or subjective remains open (more: https://arxiv.org/pdf/2609.21032).\n\nThe lower-level plumbing is filling in too. LSAP proposes a protocol that turns a language server's atomic operations into agent-facing cognitive ones, so a single find-references request triggers the whole chain of symbol localization and context extraction, sparing the agent a dozen scripted round-trips. It is early, at an alpha spec, and honest that it is an orchestration layer over the existing standard rather than a replacement (more: https://github.com/lsp-client/LSAP). IWE, complementing it, turns a directory of markdown files into a knowledge graph that both a human editor and an AI agent query, with no built-in model of its own, over the Model Context Protocol. Its best idea is treating agent writes as checked rather than trusted: every mutation must declare its blast radius, and an edit that will not declare it is refused, the same reviewable-action instinct as Workspace-OS applied to memory (more: https://github.com/iwe-org/iwe).\n\n\n\nThe neat theoretical hook today: a language model can be nothing but the compressor already on your machine. From the identity that every prediction model is a compressor and every compressor a prediction model, one experiment primes gzip with a corpus and generates text by searching for the byte sequences that compress best, since a continuation echoing the window costs almost nothing to encode. Picking the single best next byte fails because gzip reports only integer lengths, so a beam search over spans is needed, and priming on a small Shakespeare corpus produces output that is not coherent but clearly captures something of the source. It is the empirical, non-neural counterpoint to the thesis that learning is just compression: no weights and no training, only DEFLATE's 32-kilobyte window doing the work (more: https://nathan.rs/posts/gzip-lm/).\n\nFrom bytes to surfaces, a graphics result took a best-paper honor at this year's ECCV. Heat Kernel Textures represent a mesh's appearance with anisotropic heat kernels, the geodesic counterparts of Gaussians, defined directly on the surface rather than through a UV atlas. The payoff is avoiding the seams, distortion, and wasted atlas space UV mapping imposes, with everything operating intrinsically on the mesh and fitting from a texture or from multiple views. The subtitle says it cleanly: geodesic Gaussians that do not splat (more: https://github.com/circle-group/hktex).\n\nUnderneath all of it runs the resource these systems actually compete for, human attention, and a short essay makes the case for reclaiming it. It starts from the Tetris effect, the finding that sustained focus reshapes perception, and argues the danger is that less and less of that focus is chosen, with feeds deciding what keeps people scrolling. The remedy it offers is not a detox app but a habit: return to bookmarks, RSS, and blogs, accept a slower internet where content is finite, and keep at it until something clicks. It is a fitting close to an update whose tools all promise to manage attention on the user's behalf, when the choice of what to look at was always supposed to belong to the reader (more: https://alicegg.tech/2026/09/21/attention).\n","word_count":3084,"content_sha256":"18930b3868fab913ab634d1fb8c5f55f4729d1f57e89d5d5fdac3d4909d6f3db","truncated":false,"sources":[{"title":"[Editorial] botsbench: GLM-5.3 on the CyBT CTF benchmark","url":"https://botsbench.com/cybt-ctf-glm53.html","domain":"botsbench.com"},{"title":"[Editorial] cyberkimi-benchmarks ExploitBench: CVE-2024-6100","url":"https://github.com/lordx64/cyberkimi-benchmarks/tree/main/ExploitBench/CVE-2024-6100","domain":"github.com"},{"title":"[Editorial] YouTube: 1ADD60wyrbg","url":"https://www.youtube.com/watch?v=1ADD60wyrbg","domain":"youtube.com"},{"title":"BLOOM-WILT: Logit Tilting for Behaviour Elicitation in Automated LLM Auditing","url":"https://arxiv.org/abs/2608.31105v1","domain":"arxiv.org"},{"title":"[Editorial] lordx64/phantom-kv","url":"https://github.com/lordx64/phantom-kv","domain":"github.com"},{"title":"CrofAI \"cheapest inference provider in the world\" gets exposed as an OpenRouter wrapper, routing requests to smaller, cheaper models at up to 20x markup. CrofAI responds to Wire Fraud allegations by denying everything, then backtracking, then 3 hours later wiping their entire online presence","url":"https://old.reddit.com/r/LocalLLaMA/comments/1wgwe4n/crofai_cheapest_inference_provider_in_the_world/","domain":"old.reddit.com"},{"title":"[Editorial] pwardle/not-a-mused","url":"https://github.com/pwardle/not-a-mused","domain":"github.com"},{"title":"You can use any LLM just like JEV","url":"https://old.reddit.com/r/LocalLLaMA/comments/1wlxpaw/you_can_use_any_llm_just_like_jev/","domain":"old.reddit.com"},{"title":"[Editorial] mizorewww/laya-mlx","url":"https://github.com/mizorewww/laya-mlx","domain":"github.com"},{"title":"Frontier AI on Your Own Hardware","url":"https://timdettmers.com/2026/09/21/dlab-open-source-week/","domain":"timdettmers.com"},{"title":"GLM Built Its Own Inference Infrastructure","url":"https://z.ai/blog/glm-built-its-inference-infrastructure","domain":"z.ai"},{"title":"I built a native Vulkan training backend for 143 modern Transformer architectures — no CUDA or PyTorch required","url":"https://old.reddit.com/r/LocalLLaMA/comments/1widomo/i_built_a_native_vulkan_training_backend_for_143/","domain":"old.reddit.com"},{"title":"Jun Kim, oMLX creator and maintainer, joins Hugging Face to support the MLX community","url":"https://huggingface.co/blog/omlx","domain":"huggingface.co"},{"title":"[Editorial] Thom Wolf on X","url":"https://x.com/Thom_Wolf/status/2102123398230954053?s=46","domain":"x.com"},{"title":"Pruning LLMs Like a Physicist: Block Removal as an Ising Optimization Problem","url":"https://huggingface.co/blog/MultiverseComputingCAI/pruning-llms-like-a-physicist-block-removal-as-an","domain":"huggingface.co"},{"title":"[Editorial] AikidoSec/altar-1 on Hugging Face","url":"https://huggingface.co/AikidoSec/altar-1","domain":"huggingface.co"},{"title":"[Editorial] Clemens865/Workspace-OS","url":"https://github.com/Clemens865/Workspace-OS","domain":"github.com"},{"title":"[Editorial] arXiv 2609.21032","url":"https://arxiv.org/pdf/2609.21032","domain":"arxiv.org"},{"title":"[Editorial] lsp-client/LSAP","url":"https://github.com/lsp-client/LSAP","domain":"github.com"},{"title":"[Editorial] iwe-org/iwe","url":"https://github.com/iwe-org/iwe","domain":"github.com"},{"title":"Can gzip be a language model?","url":"https://nathan.rs/posts/gzip-lm/","domain":"nathan.rs"},{"title":"circle-group/hktex","url":"https://github.com/circle-group/hktex","domain":"github.com"},{"title":"Attention is all you have","url":"https://alicegg.tech/2026/09/21/attention","domain":"alicegg.tech"}],"topics":["AI Agents","AI Policy","AI Security","Agentic Coding","Computer Vision","Fine-Tuning","Open-Weight Models","Privacy & Governance","Quantization & Efficiency","Reasoning Models"],"audio_urls":["https://agidreams.us/static/audio/report-1790063180.mp3"]}