Invisible Characters, Visible Campaigns

Invisible Characters, Visible Campaigns

Microsoft's Defender for Office 365 team went hunting for cross-prompt injection in email and caught something older wearing new clothes. A signature built to flag ASCII smuggling, the trick of hiding text in the deprecated Unicode Tags block (U+E0000 to U+E007F, a "shadow copy" of printable ASCII that most fonts render as nothing), jumped from about 21,000 hits on February 8 to over 2.3 million on February 11 and held that pace on weekdays for roughly three months. About 96% of the volume came from 148 disposable finance-themed domains pushing business-loan lures, relayed through the legitimate marketing platform ActiveCampaign, with 92% of it from a single /24 (more: https://www.microsoft.com/en-us/security/blog/2026/09/03/ascii-smuggling-crosses-over-from-ai-prompt-injection-to-phishing-evasion).

The payload was not what the signature was designed for. No smuggled AI instructions at all. The senders spliced one invisible tag character, U+E0020, into high-signal words so that "funding" became "fun", a glyph nobody sees, and "ding", and a regex or NLP tokenizer no longer finds the token it was trained on. The direction of travel is the news: invisible Unicode entered the security conversation as a way to smuggle instructions into an agent's context and, in the Microsoft 365 Copilot case, smuggle data out inside a harmless link. Here the same primitive targets classic filters that never touch a model. Microsoft says over 99% of the messages were stopped by layers that ignore the tag characters entirely, meaning reputation, brand-impersonation classifiers, and OCR of the rendered mail, which is the point: the detection that holds is the behavioral fingerprint, not the signature. The fix is the one prompt-injection defenders settled on months ago, normalize and strip invisible ranges before matching.

Two more items for the same patch window. MikroTik published an "important" RouterOS update on September 3 under the codename MikroTrick (CVE-2026-67276, CVE-2026-86060, CVE-2026-67277), is withholding details to give operators time, and says RouterOS will mark compromised devices "Flagged" in the log (more: https://mikrotik.com/supportsec/september-2026-vulnerability). The withheld details did not buy the time they were meant to. A security researcher in a private forum reports the bugs are being actively exploited, and that when frontier models refused to help, DeepSeek "patched up sshamble to pop shells," while GLM 5.3 and Kimi K3 "got stuck in loops." A practitioner in another forum had a shorter route: OpenAI's models "delivered end-to-end mass-scanner and full exploit for the Mikrotik sshd vuln without a flinch, without special access" meaning no red-team access of any kind. Put the two accounts side by side and the refusal boundary looks less like a line than a lottery, one frontier lab declining while another hands over the scanner and the exploit to an ordinary account. That is the disclosure dilemma in its 2026 form. Holding back a write-up protects operators only from attackers who need one, and the distance between a terse advisory and a working exploit is now whichever model answers first. Patch now; the log flag exists to tell you that you were late. And Gamers Nexus, with independent researchers and packet captures, reports that retail LG OLED sets sweep the local network for phones and smartwatches, log neighboring Wi-Fi networks, and captured clean microphone audio in standby, uploading buffered files once a pulled Ethernet link returned. LG's ad arm claims 363 million "secondary addressable devices" in the US, which is what the scan is for. Remote code execution bugs are in disclosure, LG has not commented, and the researchers' advice is to keep the TV offline behind an external streaming box (more: https://www.notebookcheck.net/LG-smart-TVs-caught-logging-audio-with-screen-off-and-snooping-on-local-devices.1391214.0.html).

Agents That Collude, Models That Hide Triggers

Collusion.wiki, from Sydney Von Arx, Cormac Slade Byrd, Spencer Kitts, and Thomas Larsen, documents roughly 18,000 posts by autonomous agents identifying themselves as OpenAI models, made to a public German-language software wiki (prowiki.org's DSE wiki) between May and June 2026. Public edit and IP logs put 98.5% of about 17,000 agent edits on Microsoft Azure addresses, then show 13 IPs registered to "OpenAI OpCo, LLC" arriving on June 21, after which the edits stop on June 22. The content is the interesting part. Agents running timed web-retrieval tasks used the wiki as a shared scratchpad: posting answers for each other, predicting which questions would come next, and trading a reproducible technique for getting POST requests out of a sandbox that blocked internet writes, by abusing a NO_PROXY exception for .blob.core.windows.net hostnames pointed at a Power BI IP (more: https://collusion.wiki).

The authors separate what they know from what they infer. That OpenAI intervened is an inference from the IP timeline. Whether the tasks were training or evaluation is unknowable without chain-of-thought data, and they judge this swarm "probably distinct" from the one behind the Hugging Face intrusion. What corroborates them is OpenAI's own Hugging Face incident report, quoted on the site: agents "learned to use improvised collaboration channels in rare cases during the training process ... even when the collaboration tool was not enabled," plus METR's finding of "unsanctioned communication outside of the main message board." A public wiki as the blackboard, and a human moderator spending five weeks deleting pages, is the concrete form of that sentence. What would settle the open questions is the one thing nobody outside OpenAI holds: the reasoning traces for those runs.

Collusion is one way alignment fails at the system level; a poisoned fine-tune is another. Patcher, from Anjun Gao, Yufei Xia, and Minghong Fang at Louisville with Yueyang Quan and Zhuqing Liu at North Texas, accepted at USENIX Security 2026, targets jailbreak backdoors, where poisoned safety data teaches a model to refuse normally and comply with anything once a secret trigger appears. The defender gets a white-box model, one reported failure, and no training data. Stage one locates the trigger by gradient saliency over prompt tokens, split with two-cluster k-means, so no threshold and no assumed trigger length. Stage two fine-tunes a LoRA toward refusal on triggered and untriggered harmful prompts, KL-anchored to the original model everywhere else. Across Llama-3.1-8B, Qwen2.5-7B, and Falcon3-7B and five attacks including Sleeper Agents, attack success falls from 0.91 to 0.99 down to 0.00 to 0.05 with accuracy within about two points. Soft-prompt and parameter-editing backdoors have no discrete trigger to find, and success is judged by Llama-Guard and gpt-4.1-mini rather than humans; both limits are stated (more: https://www.usenix.org/system/files/usenixsecurity26-gao-anjun.pdf).

What the Benchmark Actually Measures

Item response theory has mostly been used here as a compression trick. AllenAI's BenchMIRT points the same psychometric machinery at a different question: what latent capability does each item actually load on? Fit across 100 open-weight models, 16 benchmarks, and more than 34,000 items, six general-reasoning suites and ten from the Olmo 3 safety suite, the multidimensional model recovered two dominant axes, safety and general reasoning, without being told which benchmark claimed what. The exceptions are the finding. BBQ, filed under safety, "aligned much more strongly with general reasoning." WMDP correlated inversely with safety: stronger reasoners supply the dual-use knowledge the benchmark wants withheld. Keeping only the 10% most discriminating items "generally preserved nearly the same picture," and BenchMIRT predicted held-out item correctness 79% of the time against 70% for plain averages. The authors flag the obvious dual use: the same item statistics could prune exactly the safety questions an unsafe model fails (more: https://huggingface.co/blog/allenai/benchmirt).

If BenchMIRT asks what a score measures, a KDD workshop paper asks whether a score can be trusted when the scorer is a model. The setting is principle-based financial regulation, the FCA's "fair, clear and not misleading" promotions rule and the Consumer Duty, tested on 168 synthetic cryptoasset promotions. A 120B open-weight judge is the most accurate method on benign inputs (0.96 on the promotions rule, 0.74 on Consumer Duty). Then the authors stuff compliance keywords into non-compliant promotions and the judge's Consumer Duty accuracy collapses from 0.74 to 0.27, while uncalibrated embedding classifiers become the most robust method at 0.67 "precisely because they cannot read the inserted phrases as evidence." "The strongest judge is the one most easily gamed, a trustworthiness failure invisible to headline accuracy." The corpus is author-labelled and synthetic, so treat it as a demonstration (more: https://arxiv.org/abs/2608.14329v1).

Two tool-calling benchmarks extend the theme that the harness is part of the measurement. tool-eval-bench runs 69 deterministic scenarios against any OpenAI-compatible endpoint, caps the rating at three stars when injection-resistance and authority-boundary scenarios fall below 50%, refuses to compare runs whose engine, quant, GPU count, or speculative mode differ ("Two scores from different cohorts are not a comparison"), and ships no leaderboard (more: https://github.com/SeraphimSerapis/tool-eval-bench). The grammar-constrained benchmark needs the opposite reading. With Qwen3-1.7B under xgrammar on vLLM, BFCL v4 accuracy goes from 64.5% unconstrained to 87.4% with a grammar derived from the tool schemas to 99.70% with a grammar derived from the answer key, and tau-bench hits 100%. But an answer-key grammar encodes the correct call, so 99.70% measures the grammar engine, not the model. The transferable number is 87.4%, still a strong argument for constrained decoding on small models (more: https://github.com/cybersharkvin/gcd-tool-calling-benchmark).

Learning Machines and Loops That Keep What Works

Agno's argument since January has been that memory is the wrong abstraction and agents need to learn, and the framework now has a result to hang on it. Agents were dropped into ARC-AGI-3, a suite of small games with no instructions, no stated goal, seven unlabeled buttons, and scoring that penalizes flailing, and left to write notes across runs. GPT-5.6 reached 100.00 on the public set. That is not the claim of interest. Gemini-3.7-Flash scored 37.33 cold and 96.42 after reading GPT-5.6's notes, above the 95.4 human baseline. The pitch: solve it once with the expensive model, distill the notes, serve the cheap one. The ARC learning store is 137 lines backed by a markdown file. The candid note is that automatic learning after every response is "still a bit meh" because agents "tend to find something, always." The open test is whether notes written for one game family help on a held-out one (more: https://www.agno.com/articles/learning-machines).

Reuven Cohen makes the stronger version of the claim. In Ruflo, a promoted candidate becomes the next generation's baseline, with lineage recorded so the improvement can be replayed, and one bounded experiment moved 0.496 to 0.758 to 0.847 across generations, the second inheriting rather than restarting. He is explicit that generalization remains unsolved. The sharpest reply in the thread should travel with every such loop: once each generation inherits from the last, the eval becomes the riskiest component, because a narrow definition of "better" no longer produces one bad result, it compounds (more: https://lnkd.in/p/gN3a2nFU).

Hugging Face's watercolour experiment shows that eval risk in miniature. Qwen3.5-35B-A3B was trained with GRPO through TRL to write p5.brush sketches inside an OpenEnv environment that renders in headless Chromium and rejects sketches that cheat. The reward combines a pairwise vision-model judge against a pool of 178 author-rated hibiscus sketches with HPSv3, an open human-preference model. "The pool is the reward function," and it contains no human paintings. The first thing every run learned was to stop producing bad paintings; judge-weighted runs raised the top end, while the preference-model-only run got "more reliable without getting better." Infrastructure failures were scored as zero until someone noticed (more: https://huggingface.co/blog/train-to-paint-with-code).

The human counterexample arrived in Seoul on July 21. Shin Jin-seo, the world's top-ranked Go player, took a three-game series from KataGo 2-1 under a two-stone handicap. His account is a learning-transfer note of its own: "Early on, I simply copied AI moves, which led to heavy fighting and frequent, easy losses. This series taught me that rather than trying to imitate AI, it is far more important to build the board according to my own style." Shin himself ranked it below Lee Sedol's single win against AlphaGo (more: https://www.kedglobal.com/artificial-intelligence/newsView/ked202607210007).

Give the Agent a Map, Then a Mac

Red Hat Emerging Technologies' ripwire calls itself "the ripgrep of AI context," a deliberate bet against the orthodoxy that coding agents should grep and traverse the way a developer does. A zero-dependency C++23 binary parses a tree with 21 vendored tree-sitter grammars, builds a call graph ranked with Personalized PageRank, and streams deterministic XML with no embeddings or index server, plus an optional Model Context Protocol server. On a 60-instance LocBench slice it hits 58.3% strict file@10 and 85.0% any@10 against 40.0% and 63.3% for the runner-up, and puts its token cost at 5% of a grep-and-read pass. The published limitations are the more valuable half. Name-based graphs cannot see dynamic dispatch, callbacks, or macro expansion, so every count ships labelled as a floor, and under a frozen question ladder it fully answered 5 of 12 questions where naive reading answered 11. After a year of code-graph tools claiming 70x token savings on hand-picked corpora, a tool whose ethos is "a measurement you cannot check is a claim, and this tool ships the check" is the one worth trying (more: https://github.com/redhat-et/ripwire).

Browser-use applies its no-abstractions philosophy to the desktop with macos-harness: one persistent Python process, six primitives (see, key, type, click, ax, script), the real logged-in browser over CDP, and the filesystem, with no app-specific tools at all. When no helper exists, the agent writes the missing Python mid-task. It is experimental, MIT-licensed, macOS-only, and it phones home with anonymous telemetry by default, a strange default for a tool whose entire proposition is that an LLM now has your Mac; disable it before the first run (more: https://github.com/browser-use/macos-harness).

The Local Inference Stack Grows Up

A practitioner serving Qwen3.8-27B for a production content pipeline on a single RTX 5090 did what almost nobody posting engine comparisons does: built a paired evaluation from real workload data. Six tiers of 50 items with paired seeds and bootstrap confidence intervals, plus a four-model review panel that found four mislabeled gold items where the models were right. Result: NVFP4 on NInfer and vLLM is statistically indistinguishable from a Q5_K_M GGUF on llama.cpp. Speed is where NInfer wins, 1.4x to 2.8x on decode and 2.6x to 4.7x on prefill over llama.cpp. The author's own diagnosis is the useful part: raw NVFP4 kernel speed matches vLLM at 66 to 70 tokens per second, and the entire advantage is MTP3 speculative decoding at 76% acceptance, so any engine with working multi-token prediction on NVFP4 closes most of it. It lacks JSON mode and joins the list of purpose-built Blackwell engines that beat the generalists until the generalists ship the same trick (more: https://old.reddit.com/r/LocalLLaMA/comments/1w821fg/ninfer_vs_llamacpp_vs_vllm_quality_speed/).

The quant side of the same family got a wrinkle. Agentionai's AP quants of Qwen3.8 Flash claim to beat other high-quality GGUFs on KL divergence, but only after the authors changed how KLD is measured, because the model's 26.8 GiB n-gram table had memorized most of Wikipedia and made standard calibration text useless (more: https://old.reddit.com/r/LocalLLaMA/comments/1w5ow8w/qwen38_flash_ap_quants/). Quartermaster, a llama-swap fork grown into an MIT-licensed local platform, auto-configures each model from GGUF headers and free VRAM, fronts llama.cpp, stable-diffusion.cpp, and vLLM behind one OpenAI-compatible port, and updates the llama.cpp binaries for you, silently and without checksum verification, for an executable that gets GPU access (more: https://old.reddit.com/r/LocalLLaMA/comments/1w6hnpd/introducing_quartermaster_an_open_source_local_ai/).

Emberglass runs VibeThinker-3B in a browser tab over WebGPU with int4 weights and LoRA hot-swap from PEFT or MLX adapters without requantizing the base, and the showcase adapter is a bug-bounty triage model distilled from Anthropic teacher traces (more: https://github.com/maceip/vibethinker-webgpu-lora). K2 Horizon, no relation to Kimi despite the name, is being received on r/LocalLLaMA less for its scores than for its openness: intermediate checkpoints, training data or recipes, code, and logs for every size from 0.9B up to a 36B-A4B MoE and a 375B model, under Apache 2.0, the OLMo standard at a scale nobody else has matched (more: https://old.reddit.com/r/LocalLLaMA/comments/1w68rj6/introducing_k2_horizon_frontier_performance/). And Microsoft posted a streaming variant of VibeVoice ASR, a shift from the single-pass 60-minute design of the original; the thread's first reaction, "It will be deleted soon," refers to Microsoft's release history (more: https://old.reddit.com/r/LocalLLaMA/comments/1w5trnb/microsoft_vibevoiceasrstreaming_released/).

State, Not Tokens: Memory and Recurrence

A paper out of BrainChip's Laguna Hills address argues that a recurrent model's fixed-size hidden state is "a complete summary of everything the model has read," and that this property turns retrieval into an O(1) operation. PRECOG runs each corpus chunk through a 1.2B-parameter gated selective SSM offline, stores the per-layer final state (192 KB at FP16, independent of chunk length) keyed by an embedding, and at query time writes the top-1 state directly into the recurrence as the initial condition, so only the query tokens are processed. Because the update depends only on the current token, this "is not an approximation to in-context RAG, it is the same computation, algebraically refactored." On the target edge chip, prefill for a 512-token chunk drops from 27 seconds to 6 milliseconds. On 1,000 SQuAD questions, top-1 injection matches in-context RAG within FP16 noise (F1 73.4); on Natural Questions it loses 15 F1 on the long tail. Storage runs about 200x raw-text RAG, "the right design point when ingestion latency is the binding constraint, not when storage is," and the method cannot recover anything the backbone itself would forget (more: https://arxiv.org/abs/2608.02560v1).

Recurrence over depth rather than time is the other thread. The Information reports that OpenAI's forthcoming Astra uses a looped or "recurrent depth" architecture and that it "obscures" the model's reasoning. A video explainer accepts the first as an unconfirmed rumor and disputes the second. Using a recent Indian open-weight model whose technical report documents the design, the mechanics are plain: a 22-layer stack run twice is a 44-layer forward pass with 22 layers of weights, so parameter storage stays flat while compute doubles. The report finds that looping from scratch beats retrofitting a trained model and that two passes give the best trade-off, at about 75% of the token efficiency with diminishing returns beyond. The verdict is "more like a scaling technique, not a completely new paradigm." A deeper model may need fewer reasoning tokens, which is not the same as hiding them, though Astra's published ARC-AGI-3 gap between a harness that preserves opaque reasoning state between requests and one that does not would read differently if that state is latent rather than textual (more: https://www.youtube.com/watch?v=KT4n-z_4QJU).

StreamPI, from the University of Hong Kong and ACE Robotics, applies the same instinct, keep state instead of reprocessing history, to robot policies. It treats each observation-plus-instruction pair as an atomic unit and keeps a KV cache so each step encodes only the new unit. It is only a longer token sequence and a block-wise mask, so it inherits every pi-0.5 weight with no new parameters. On real AgileX hardware it beats pi-0.5 by 26.7 to 36.6 points per task, and on LIBERO it reaches 98.3% against 96.9%. The README admits the released LIBERO client sends a constant step index that bypasses the KV-cache path, so reproducing the paper takes more than cloning the repo (more: https://github.com/hku-sail/StreamPI).