# Same Keys, Same Holes Published: 2026-08-19 Canonical: https://agidreams.us/edition/same-keys-same-holes Content-Complete: true Start with a claim that should not be true and apparently is. A paper making the rounds on r/LocalLLaMA argues that the "encrypted" reasoning traces the big labs ship — the opaque thinking signatures OpenAI, Anthropic, and Google attach to a response so a session can resume or migrate mid-stream — can be lifted from a strong model and replayed verbatim through a weaker, less-guarded sibling: hand Haiku the signature Opus produced, ask it to decrypt and repeat, and out it comes. The mechanism is embarrassingly mundane: a single global encryption key makes the traces interchangeable across users, sessions, and models, because interchangeability is the feature — it is what lets a provider swap the model under you without dropping the thread (more: https://old.reddit.com/r/LocalLLaMA/comments/1vn8zst/stolen_llm_reasoning_how_come_openai_anthrophic/). The interesting part is that three independently built labs converged on the identical hole — not coincidence so much as convergent design pressure: everyone needing portable state across a fleet reaches for the same shortcut with the same failure mode. It is the practical face of an argument worth keeping on file: these systems process trusted and untrusted tokens with no real boundary between them, and some weaknesses are architectural rather than incidental. If that is theory, Wiz Research supplied the field demonstration. Their autonomous "Red Agent," loosed on Snowflake's public GitHub org under the company's HackerOne program, found a script-injection flaw in a GitHub Actions workflow: an unauthenticated user could run arbitrary commands in a runner just by opening an issue with a crafted title. The damning detail is provenance. The vulnerable pattern was introduced on June 18, 2026, when a squash-merged PR ripped out the repo's existing safe `env:`/`jq` parsing and replaced it with direct interpolation of the issue title into a shell script. GitHub Advanced Security scanned the workflow and did not flag it. Copilot Autofix reviewed the same merged PR, acted as a co-author, and marked it all-clear — its documented contribution was fixing an unrelated file in that very commit (more: https://www.wiz.io/blog/red-agent-snowflake-copilot-cicd-bug). The exfiltration reads like a competence demo for autonomous offense. The agent's first payload broke on a bash EOF error; it read its own error, rewrote the shell to close the block cleanly, and on retry shipped a base64-encoded Jira API token to an out-of-band listener within seconds. That token, tied to `qa@snowflake.net`, opened read access across Snowflake's engineering, security-compliance, and bug-bounty Jira projects. The flaw was live only five days; Snowflake patched it the day it was disclosed on June 23, rotated the token, and confirmed only Wiz's test IPs hit the endpoint. The lesson is neither subtle nor new: a probabilistic code tool will happily reintroduce an insecure shell pattern a human had deliberately removed, and the scanner beside it nods along. AI-authored diffs deserve the scrutiny human ones get, and the window between "flaw merged" and "flaw weaponized by a machine" is now measured in hours. If prompt injection and insecure autogenerated code are partly unfixable at the model layer, the honest response is to stop fixing the model and start containing it. Two tools this week take that seriously. The first is microsandbox, a Y Combinator-backed, Apache-licensed runtime that runs untrusted workloads inside microVMs with Docker-style ergonomics — OCI-compatible images from any registry, familiar shell and volume workflows, but hardware-level isolation underneath. It claims average guest boot under 100 milliseconds on an M1, spawns VMs as child processes straight from application code with no daemon, and offers a genuinely useful primitive it calls secrets that cannot leak: an `OPENAI_API_KEY` bound to `api.openai.com` that never enters the guest, paired with host and port allowlists (more: https://github.com/superradcompany/microsandbox). It ships SDKs for five languages, an `msb` CLI, and an MCP server for Claude Code, Cursor, Codex, and Copilot. It slots into the compute-isolation layer of a defense-in-depth stack — the layer that, in prior reporting, stopped weaponization when everything upstream failed. The second tool addresses the step before execution. There is still no built-in way to check an Agent Skill or MCP server before it runs in your agent's context, so a developer built `secureai-scan`, an offline checker that fetches a target without executing it — npm packages via `npm pack` (tarball only, no lifecycle scripts), git repos via shallow clone — and looks for invisible and bidirectional Unicode in tool descriptions, agent-directed injection phrasing, cross-tool shadowing, and known-malicious packages. Against Cisco AI Defense's labeled eval corpus it caught 6 of 6 malicious fixtures with zero false alarms, and stayed clean across 32 real bundles from anthropic/skills and vercel/ai (more: https://old.reddit.com/r/ClaudeAI/comments/1vs02pa/free_offline_check_before_you_install_a_claude/). The top comment is the one to internalize: static scanning catches the lazy 10 percent — the invisible Unicode, the "ignore previous instructions" strings — but not the legit-looking MCP server that reads `process.env` and quietly POSTs it somewhere at runtime, or fetches its payload after install. There is nothing in the tarball to catch. That is exactly the gap microsandbox closes: scanning filters the obvious attacks so manual review and runtime isolation can spend their budget on the clever ones. Two defense papers landed this week sharing a philosophy: stop patching the surface, change the shape of the problem. The first, out of Technion, is a "Linguistic Firewall" for multi-agent routing. The attack it closes is subtle — a router picks which agent handles a query based on each agent's natural-language self-description, so adversarial instructions in an agent's metadata can hijack a privileged routing decision without touching the router's own prompt. Their fix, ANTAP, throws the text away entirely. In an offline phase each agent is scored on trusted benchmark queries with a strict bipolar signal, and a per-agent linear operator is fit from query embeddings to predicted success. At inference, routing is a single matrix-vector multiply on the query embedding — no agent-supplied text is ever read, which makes description-based attacks structurally inexpressible rather than merely filtered (more: https://arxiv.org/abs/2606.30555v1). The numbers are strong: near-zero attack success against description injection where a textual router sits above 67 percent, and flat performance under adaptive attacks that push an embedding-router baseline from 64 to over 86 percent with three trigger tokens. The caveat is plain: it assumes a trusted, unpoisoned calibration environment and a robust embedding module, and its strict scoring may miss nuanced quality criteria. The second paper, Random Logit Scaling, applies the same instinct to classic black-box adversarial examples. Score-based attacks — those that read confidence values, not just labels — can craft an adversarial image in dozens of queries by watching the class-score gap. RLS multiplies the output logits by a fresh coefficient on every query; because positive scaling preserves ranking, the top-1 prediction and accuracy are untouched, but the confidence scores the attacker depends on jitter unpredictably, corrupting both gradient-estimation and random-search attacks (more: https://arxiv.org/abs/2607.14921v1). It cuts Square attack's success rate by up to 80 percent and beats randomized baselines that pay for their defense in lost accuracy. The authors are candid about the ceiling: RLS does nothing against label-only decision-based attacks, offers no certified guarantee, and can be averaged out by an attacker willing to spend enough queries. That matters: the recurring lesson from red-teaming is that single-point, deterministic defenses fall to adaptive attackers — and a fresh automated-jailbreak result this week, up triple digits against layered defenses at a fraction of the cost, says the attack side is not standing still. Both papers sit on the promising side of the ledger; neither claims the war is over. Two stories this week are really one story: arbitrage against the trust AI platforms are built on. The first is the Hanover Institute, a polished new "think tank" churning out neutral-toned, footnoted, table-of-contents reports on Israel and Palestine — and, per a small disclaimer at the page bottom, created on behalf of the Israeli Government Advertising Agency by a firm called Piro, Inc. None of the reports carry bylines; over a hundred appeared in roughly a week starting August 6, and GPTZero flagged 11 of 12 sampled articles as AI-written with high confidence. NewsGuard's analyst calls it "a perfect mimicry of a typical credible American think tank, right down to the generic name, the site layout, and the red-white-blue color scheme," and notes the tell: "LLMs favor concrete statistics and data, as well as strong citations and sources, which these articles all have." Piro's own pitch is the confession — it markets content "engineered for how LLMs evaluate credibility," a service it calls AI Story Optimization, and has received $900,000 in Israeli government money subcontracted through the Havas PR conglomerate (more: https://responsiblestatecraft.org/israel-influence-chatgpt/). Strip the geopolitics and the mechanism should worry anyone who builds retrieval systems: this is not persuasion aimed at humans but the deliberate manufacture of a source that scores well on the exact heuristics — citations, data tables, measured tone — a chatbot uses to weigh credibility. It is the second confirmed state actor to run this play, and its plausibility is quantitative: research has put the poisoning threshold as low as roughly 250 well-crafted documents to bias models across a wide parameter range, measured in parts-per-million rather than percentages. A single institute publishing a hundred formulaic reports in a week operates comfortably inside that budget. The primary record — the filing, the money trail, the firm's own marketing copy — corroborates the framing. The other well being poisoned is metered access itself. A follow-up investigation into "token brokers" describes a maturing gray market where people buy unused AI credits from startups and resell them, often as a proxy forwarding requests from a pool of keys rather than handing the keys over. One seller offered $100,000 in spend per day; marketplace sites advertise 30 to 80 percent off list, and a flat-40-percent-off reseller even ships a GDPR-compliant Data Processing Agreement — a discount, the author dryly notes, that is very unlikely unless the supply is acquired "in other ways" (more: https://vectoral.com/blog/who-are-the-token-brokers). The estimate runs to tens of millions of credits circulating across forums, Telegram channels, and pure-play marketplaces. Tokens have become a pseudo-currency with enough liquidity to sustain real abuse, and the countermeasures are already visible — vendors fingerprinting reseller traffic, unrestricted API keys producing five-figure billing spikes in hours. DeepSeek V4 Flash has quietly become the model people who cannot afford frontier API bills actually run, and this week both the enthusiasm and the engineering showed up. The 0731 checkpoint drew a chorus on r/LocalLLaMA about running serious work on a sub-$2k machine, one user calling it "the first model I've used that really can be run locally that doesn't feel like a downgrade from frontier models" (more: https://old.reddit.com/r/LocalLLaMA/comments/1vnyiqa/its_actually_crazy_how_good_dsv4_flash_0731_is/). Worth holding that against skeptical reports of the same checkpoint struggling with instruction-following, ignoring rules and skills regardless of prompting — a behavior traceable to its aggressive attention compression, where most layers see the context squeezed into heavily compressed entries. The reconciling variable may be tooling. The engineering standout is a careful single-card benchmark of V4 Flash with the DSpark speculative-decoding drafter on one RTX PRO 6000 Blackwell. The 144GB Q4 model does not fit in 96GB of VRAM, so 21 expert layers went on the GPU and 19 into system RAM, making the run memory-bandwidth bound. DSpark's honest headline gain was 15–17 percent on a realistic nine-turn coding session; the counterintuitive finding was that moving the ~10GB drafter's experts into system RAM ran about 4.4 percent faster than keeping it in VRAM — freeing that VRAM let three more frequently-read target layers stay resident, and hot target weights matter more than total gigabytes shuffled (more: https://old.reddit.com/r/LocalLLaMA/comments/1vmt1y3/i_ran_deepseek_v4_flash_284b_dspark_on_one_rtx/). One replication attempt on an EPYC/DDR4 box actually got slower with the drafter — these gains are platform-specific. The tooling half is DeepSeek Harness. A LocalLLaMA thread asks why DSH "feels better" with local Qwen than OpenCode, Pi, or Hermes; the top answers converge on two things: a lean system prompt (2,000–3,000 tokens against the 20K–50K bloat of the big harnesses, which matters when context is your budget) and an append-only log architecture rather than verbatim conversation replay (more: https://old.reddit.com/r/LocalLLaMA/comments/1vqum89/deepseek_harnness_why_is_feels_better/). The throughline is that a first-party harness finally matches a model whose conventions never fit a competitor's tooling. Extending that, pawaca's dsh-edge packages DeepSeek Harness into a single guided Cloudflare Workers install: the upstream Web UI, agent loop, and a persistent `/workspace` backed by Durable Object SQLite, deployable to a free single-owner instance with secrets never written to session state (more: https://github.com/pawaca/dsh-edge). It is a deliberately single-owner developer preview, but early third-party evidence that the harness-as-ecosystem bet is real. Qwen owned the local-model conversation this week, and the reviews are affectionate and pointed at once. Simon Willison, freshly hands-on with the newly released 3.8 27B, called it excellent but flagged that it "defaults to wildly overthinking things," adding on Mastodon that he could not remember the last time a local model was this much fun; the overthinking comes from a bad default that is easy to change (more: https://old.reddit.com/r/LocalLLaMA/comments/1vqaqgn/simon_willison_qwen_38_27b_is_excellent_but_it/). The comments split between people who think the extra deliberation catches real bugs on the first try and people who set it to medium and run a second pass — a recurring house observation about the Qwen line, whose earlier versions were caught declaring a task done because existing tests passed. The 27B is the dense sweet spot beneath a 2.4-trillion-parameter flagship. Overthinking is not the only performance trap. A rigorous r/ollama post measured Ollama's multi-token-prediction variant of Qwen3.8-27B running 2x slower than the non-MTP build on unpredictable content — 5.14 tok/s against 11.78 — with a negative-control model showing a flat 1.01x ratio, proof the protocol measured speculation, not vocabulary. The finding: Ollama does activate the MTP heads, but the draft costs slightly more than a full model pass, so speculation repays its own overhead in the best case and never more — pure downside risk, while the same mechanism under MLX gives a genuine speedup (more: https://old.reddit.com/r/ollama/comments/1voy57v/ollamas_mtp_variant_of_qwen3827b_is_2x_slower/). That contradicts every prior speculative-decoding result, where MTP was a speedup, which makes the implementation the variable worth chasing. The quantization craft continues below the model layer. A solo undergrad on rented 4090s re-quantized Qwen3.5-9B and claims 31 wins, 3 ties, 0 losses across 34 size-matched comparisons against every published GGUF, with a Q4 variant beating Unsloth's on KLD while smaller and an IQ2_M scoring roughly 10 points higher on HumanEval+ at identical bytes — every rival re-scored on the same rig (more: https://old.reddit.com/r/LocalLLaMA/comments/1vo8t8x/taking_qwen359b_quants_to_sota_new_lineup_incoming/). Worth calibrating: 9B-class models mostly land in the mid-teens on those leaderboards, and impressive quant work does not lift a 9B into 27B territory. On the architecture frontier, Intern-S2-Mobius decouples knowledge from reasoning: a globally shared FFN memory storing knowledge vectors that self-attention reasoners iteratively query, yielding a 7B trained from scratch that matches a Transformer baseline on 62.6 percent of the data, and a Qwen3.5-35B continual-pretrain that holds its score with nearly 4x inference speedup (more: https://old.reddit.com/r/LocalLLaMA/comments/1vqrf6p/paper_interns2mobius_foundation_model_with/). Commenters rightly note sub-100B wins can come from inductive bias as easily as real gains. Rounding out the offshoots, the uncensoring cottage industry produced dealignai's Gemma-4-31B-JANG_4M-CRACK — an empty model card at the time of writing, which, beside the more rigorous heretic-and-projection abliteration lineages that document their refusal-rate drops, tells you most of what you need to know (more: https://huggingface.co/dealignai/Gemma-4-31B-JANG_4M-CRACK). Builders are making agents produce artifacts, with the usual gap between polish and hype. On the hype end, an X thread from Av1dlive insists "grok bot is the single most powerful agent stack i've ever used," claims to have cancelled ChatGPT and Hermes, and maps a whole business — support desk, invoicing, content, bug-fixing — into four Excalidraw diagrams you are invited to "steal" and feed back to the bot (more: https://x.com/Av1dlive/status/2090011470608384277). Treat it as this desk treats all agent-team enthusiasm: the marketing promises a system that self-optimizes, but these swarms remain episodic and stateless between sessions, whatever the screenshots suggest. The Excalidraw canvas at its center is worth knowing on its own terms — a browser whiteboard that saves to local storage, with a standing warning to export your work, since that storage can be cleared without notice (more: https://excalidraw.com). More substantial is cathrynlavery/diagram-design, an agent skill built to stop coding agents from emitting generic rounded-box diagrams. It ships 28 visual types in three variants each, outputs a single self-contained HTML file with inline SVG, and its signature feature is 60-second brand onboarding: point it at a website, and it extracts palette and fonts, maps them to semantic tokens, runs contrast checks, and emits a "fidelity receipt" — with a first-run gate that refuses to silently ship default-skinned output (more: https://github.com/cathrynlavery/diagram-design). Tellingly, its README advises when not to diagram at all, calling deletion the highest-quality move — and it extends a thread this desk has tracked, diagram generation as a proving ground for agent self-verification. In a like vein, alterisian/curiousity is a local-first knowledge engine that ingests text, extracts entities and facts with confidence scores, and actively generates questions about what it does not know, visualized on a Rumsfeld matrix in SQLite (more: https://github.com/alterisian/curiousity). It is demo-ware, but its rules — compress before storing, attach confidence to every fact, let curiosity drive learning — are the right instincts for agent memory. Generative media closes the bench. A detailed evaluation of MiniMax-Music3, an open-weight model generating full five-minute songs from lyrics and structured captions, breaks down its hybrid architecture — an 8B global LLM for long-range structure, a 0.6B local LLM for acoustic detail, a flow-matching synthesis path — and is candid about the constraints: CUDA required, 24GB+ VRAM for full precision, non-streaming only, and section tags that "provide influence, not guarantees," so requested BPM or key may drift (more: https://hackernoon.com/evaluating-minimax-music3-for-long-form-ai-music-generation). Its video-side sibling gets a community accelerator: xmarre's ComfyUI-Spectrum-MiniMax-H3 provides training-free feature forecasting for ComfyUI's native MiniMax H3 model, predicting the transformer's hidden state on "forecast" steps via low-degree Chebyshev fits — a typical 20-step run resolves to 11 real evaluations plus 9 forecasts, with the honest disclaimer that forecasted steps alter the denoising trajectory and can diverge from native output even at identical seeds (more: https://github.com/xmarre/ComfyUI-Spectrum-MiniMax-H3).