When "Attack Succeeded" Isn't Enough

When "Attack Succeeded" Isn't Enough

Binary pass/fail is the default metric for evaluating whether an AI agent got compromised by a prompt injection: the attack either worked or it didn't. A new paper from a team evaluating the AgentDojo workspace suite argues this single bit is "affirmatively misleading." They introduce an action-graded severity scale — seven ordinal levels (S0 through S6) scored along three axes: reversibility, scope (did the damage stay local or reach another party?), and privilege escalation. The payoff is immediate. A tool-filter defense against GPT-4o mini reports a perfect 0% attack-success rate under the binary metric. Under severity scoring, one episode still reaches S4 — the agent routed the attacker's payload through a calendar invitation instead of the blocked email tool, a channel-substitution attack the binary check never watches. Even more uncomfortable: the spotlighting defense lowers the binary ASR from 47% to 33%, but the episodes it fails to stop become worse, with S5 (privilege expansion) and S6 (escalation chains) appearing where neither existed before. A panel of three frontier judges (GPT-5.5, Opus 4.8, Gemini 3.5 Flash) reproduced the deterministic oracle with Krippendorff's α = 0.82, but shared a blind spot: zero of them recognized escalation chains, scoring every S6 as S4. The instrument is trace-grounded, portable, and cheap — it reads logs a benchmark already produces — and the code, prompts, and per-episode data are all released. (more: https://arxiv.org/abs/2607.07474v1)

The models themselves remain porous. Within days of Fable 5's relaunch, Pliny the Liberator posted a thread documenting successful jailbreaks across cybersecurity, chemistry, psychological manipulation, and explosives domains. The most effective technique was decomposition and recomposition: breaking harmful knowledge into benign-looking chunks — individual reaction pathways rather than "meth recipe" — and reassembling on the backend, aided by a jailbroken Opus instance. Unicode homoglyphs, long-context reference tracking, and fiction framing all contributed. Anthropic's classifier-based guardrails, which were supposed to route dangerous queries to a hardened Opus path, apparently did not survive sustained multi-agent probing. (more: https://x.com/elder_plinius/status/2064776322979676227)

Meanwhile, a Claude user reported receiving another person's chat content — including a distressing message fragment about self-harm — during a casual conversation about a song. Anthropic pulled the shared link and cited a usage-policy violation, but offered no explanation. Community consensus settled on a corrupted tool-call session rather than a literal cross-user data leak: the model appears to have surfaced a safety-protocol test scenario attached to an internal tool invocation. Regardless of mechanism, the failure mode — a user encountering alarming content with no provenance — is exactly the kind of trust-eroding incident that binary safety metrics miss entirely. (more: https://old.reddit.com/r/ClaudeAI/comments/1upeskf/getting_someone_elses_chat/)

Security failures at the other end of the stack are just as sobering. RunZero, founded by Metasploit creator HD Moore, disclosed a family of unpatched overflows in FatFS, the generic FAT/exFAT file-system library embedded in millions of microcontrollers. The bugs are exploitable by plugging in a corrupted SD card — no network required. An overflow in the get_label function has no length check whatsoever; the volume label copies directly into a caller-supplied buffer with no way to bound it. STM32 devices, Flipper Zero, and industrial controllers in water treatment and power plants all use this code, and most lack ASLR or NX protections. These systems rarely get updated. HD Moore published proof-of-concept exploits, and a demonstration on a Flipper Zero crashed it to a bus fault with the program counter overwritten to 0x41414141. (more: https://www.youtube.com/watch?v=E0A7IrJtpUY)

For LLM traffic specifically, a new CLIProxyAPI plugin called cpa-plugin-privacyfilter intercepts model requests before they leave the local process, scanning for API keys, tokens, emails, phone numbers, and connection strings using embedded Gitleaks rules. It builds as a native shared library and handles both OpenAI-style messages and input request bodies — a pragmatic, on-device guard against the accidental leakage that keeps security teams awake. (more: https://github.com/rheodev/cpa-plugin-privacyfilter)

The Frontier Three-Body Problem

Meta Superintelligence Labs shipped Muse Spark 1.1, a significant upgrade to its first model family, alongside the public preview of the Meta Model API. The model is built for agentic work: it zero-shot generalizes to new MCP servers and custom tools, orchestrates multi-agent systems to optimize end-to-end latency, and actively manages its 1M-token context window by compacting in a way that preserves critical steps. Computer use is a headline capability — rather than clicking through every desktop step, Muse Spark 1.1 decides when to script and when to interact directly, generating batches of actions per step. Coding performance on Meta's internal bench "significantly improves upon Muse Spark" and is "competitive with leading alternatives," per the announcement. Replit's CEO called it "a complete agentic foundation," and Cline's CEO noted the combination of strong tool use at a viable price point for real coding workloads at scale. The safety report documents resistance to both direct jailbreaks and indirect prompt injection from untrusted data. (more: https://ai.meta.com/blog/introducing-muse-spark-meta-model-api/)

The community, meanwhile, is bracing for GPT-5.6 SOL's reported Thursday release. Reddit discussion in r/Anthropic shows pragmatic loyalty: "I have no allegiance to AI companies. If 5.6 is better, I will switch." But the evidence is thin — OpenAI has reportedly claimed superiority on exactly one benchmark. The real pressure on Anthropic comes from pricing: users note that Fable 5's API costs ate through $100 in under 30 minutes during a loop, and without subscription inclusion, many plan to default to whatever Opus offers. The consensus reads less as a model horse-race and more as a pricing-and-access standoff where the second-best model at a quarter of the cost wins the daily driver slot. (more: https://old.reddit.com/r/Anthropic/comments/1urd4we/if_the_gpt56_sol_rumors_are_true_is_anyone/)

Then there is the subscription-arbitrage game. M365Bridge is a Go tool that converts Microsoft 365 Copilot's internal WebSocket (SignalR) interface into OpenAI- and Anthropic-compatible HTTP endpoints. It supports GPT-5.5, GPT-5.5-reasoning, Claude Sonnet 4.6, and Claude Opus 4.6 — all routed through a single M365 Copilot license via tone-field selection. Tool calling is simulated: the proxy embeds the full request JSON into the prompt and parses the model's response for tool-call blocks. Tokens are encrypted with AES-256-GCM, and SSO cookies enable automatic renewal past the 24-hour SPA token limit. It even implements the OpenAI Responses Compact API for Codex remote compaction. The project labels itself "research only," but the feature set — image generation, session isolation, streaming SSE — suggests ambitions well beyond a weekend experiment. (more: https://github.com/KilimcininKorOglu/M365Bridge)

Agent Fleets and the Imagination Premium

Mitchell Hashimoto — co-founder of HashiCorp, creator of Ghostty — spent days testing Fable 5 against cheaper models on routine coding tasks. A budget model finished identical work for under a dollar. GPT-5.5 cost about $1.50. Fable 5 cost $9 and took 40 minutes. Same quality, same outcome. The hot take writes itself: route everything to cheap models. But Hashimoto ran one more test. He pointed Fable 5 at a gnarly systems-code optimization he had written himself — a problem no PM had prioritized and no backlog contained. Two hours and $40 later, the model reached a performance level he says he could not have hit on his own. Nobody else was working on that problem because nobody else had imagined it. The lesson is structural: as execution commoditizes, value migrates to the imagination that decides what to execute. Cheap models multiply known work. Frontier models multiply the unknown — but only for people who know enough to ask the right question. (more: https://www.youtube.com/watch?v=1cSNE-ZkDLQ)

Turning imagination into throughput requires infrastructure. A detailed guide to headless agent fleets distills hard-won operational knowledge: scaffold every repo around documentation first (for agents, "docs are literally the code"), write one plan file as ground truth workers reload every iteration, then decompose into tasks with command-verifiable acceptance criteria. Oversized tasks were the top cause of worker timeouts — roughly a fifth had escalations before the author learned to split anything with mixed concerns. The dispatch loop is deliberately boring: claim, execute, verify a commit exists, close or release. Three rules emerged from incidents: "list then claim" is a race condition at scale (four workers claimed the same task simultaneously under label-based locking); workers on the same repo share a working tree (two agents with uncommitted state collide in ways that look like model stupidity); and the agent, not the orchestrator, should close its own task against acceptance criteria. Cost routing matters: cheap models by default, frontier models for failures and gnarly tasks. (more: https://jedarden.com/guides/idea-to-agent-fleet)

Koder is a browser-based coding and computer-use harness written in Go — a single binary supporting MCP, visual models, thinking compression, and milestone-to-chat orchestration. Its author tuned it specifically for Qwen 3.6 27B Q8 on llama.cpp and reports it "absolutely rock solid" for Linux-local workflows, noting that he built it with Codex but increasingly moves work to the local side. (more: https://old.reddit.com/r/LocalLLaMA/comments/1upqbqz/koder_browser_ui_based_harness_for_coding_and/) A complementary approach gives small models scoped "application" views — a text-only web browser and a computer-control interface — that replace 20+ tools with simple verb-and-number navigation menus. Running on a Gemma 4 E4B (the smaller variant), the system performed better than the 26B version, likely because the tighter context prevents the larger model's tendency to ignore planning tools. The key insight: agents carry limited toolsets and minimal context into these scoped views, then get full context back on exit. (more: https://old.reddit.com/r/LocalLLaMA/comments/1unobl4/using_applications_to_make_a_smaller_model_more/)

Prefill Is All You Need (At Long Context)

A practitioner benchmarked 13 models (5 dense, 6 MoE, 1 Mamba2 hybrid, 1 MLA) from 512 to 131K context on an RX 7900 XT 20GB and surfaced findings that challenge conventional wisdom about local inference. At 65K+ context with 300-token outputs — a typical agentic tool call — prefill consumed 94–99% of wall-clock time. Token generation speed (tg128), the metric everyone obsesses over, was essentially irrelevant. The dominant architectural factor for long-context prefill was not parameter count or MoE-vs-dense architecture but KV head count: Ornith-9B (4 KV heads, 64 KB/token KV) was 4.4x faster at 128K context than Apriel-15B (8 KV heads, 160 KB/token) despite being half the parameter size. And in a counterintuitive twist, F16 KV cache was faster than quantized KV (Q8/Q4) for MoE and small dense models — the dequantization compute at 65K context exceeded the bandwidth saved by halving the cache. MoE models won the speed-times-intelligence composite for agentic work, with Qwen3.6-35B-A3B delivering 87% of the top dense model's intelligence at 3x the speed. IBM's Granite-4.0-H-Small (Mamba2 hybrid) retained 69% of its pp4K speed at 131K — every transformer dropped below 42%. (more: https://old.reddit.com/r/LocalLLaMA/comments/1unrse9/i_benchmarked_13_models_at_65k128k_context_to/)

These findings have immediate practical implications. DeepSeek V4 Flash is now running on a single RTX 5090 at 21 tokens/second via a Q2_K quantization and a specialized llama.cpp fork, with a million-token context window that actually fits. The setup — Ryzen 9 9900X3D, 128GB DDR5, and the --no-mmap flag — demonstrates that consumer hardware can host genuinely frontier-class MoE models if you accept aggressive quantization. Another user reported 56 t/s with IQ2_XXS and 248K context on the same GPU. (more: https://old.reddit.com/r/LocalLLaMA/comments/1umsik8/deepseek_v4_flash_running_on_rtx_5090_moe/) The VRAM race may be about to intensify: Seasonic's PSU calculator briefly listed RTX 5080 SUPER (24GB), RTX 5070 Ti SUPER (24GB), and RTX 5070 SUPER (18GB) before the entries were pulled. Community reaction is skeptical about availability and pricing — "absolutely nobody believes these will be made in any reasonable quantities" — but 24GB at a sub-5090 price point would dramatically expand who can run 27B-class models at long context. (more: https://old.reddit.com/r/LocalLLaMA/comments/1uqzv4q/seasonic_psu_calculator_now_mentions_rtx_5080/)

Looking further out, ternary (1.58-bit) models could collapse the multiplication bottleneck entirely: weights constrained to -1, 0, or 1 turn matrix math into additions and look-up tables. One estimate projects a 100B ternary model running at 35W on a dedicated ASIC. The community reality-check is sharper: attention still needs real multiplications (Q×K^T with dense activations), memory bandwidth eats 15–20W before logic starts, and the 20–25% perplexity hit stings at smaller scales. The real blocker is the chicken-and-egg: no chipmaker will build ternary silicon without a proven ecosystem of natively trained models, and nobody is training 100B ternary models without the hardware. (more: https://old.reddit.com/r/ollama/comments/1uo9x15/soon_well_run_100b_models_on_cheap_hardware/) Meanwhile, Döner Bench's second round compared quantization levels on Tess-4-27B, a new Qwen3.6-27B fine-tune trained on 64K-token agentic traces from Fable 5 with a three-model teacher ensemble (Opus 4.8, GPT-5.5, GLM-5.2). (more: https://old.reddit.com/r/LocalLLaMA/comments/1uqxnwn/döner_bench_round_2_quant_compare/)

Planning Inside the Machine

A multi-scale study across Qwen3, Gemma-3, and Llama-3 asks a deceptively simple question: do language models form internal plans for future tokens, and if so, where? Using rhyming-couplet completion as a clean structural test, the researchers applied linear probing and activation patching at more than ten model scales. Probing showed that future-rhyme information is linearly decodable at the line boundary (the newline token between couplet lines) and strengthens with scale across all three families. But the causal evidence tells a strikingly selective story. Only Gemma-3-27B actually uses that information during generation, exhibiting an "information routing handoff" around layer 30 where the causal driver migrates from the rhyme word to the newline position. Every other model — including Qwen3 up to 32B and Llama-3 up to 70B — conditions on the rhyme word throughout, with near-zero causal effect at the newline despite strong probe signal there. The handoff localizes to just five attention heads in layers 28 and 30, which recover 90% of the full-residual rhyme-routing capacity under two-stage path patching. Planning-compatible representations are common; causally active planning sites are rare and architecture-specific. (more: https://arxiv.org/abs/2605.07984v1)

The practical implications may arrive faster than the theory. An accountant (self-described, not ML engineer) reading Anthropic's J-space paper — the Jacobian-lens view of how changes to intermediate-layer vectors influence final logit distributions — asked whether this could revolutionize pruning, merging, and distillation. The intuition: instead of pruning by router-weighted expert activations (REAP/REAM), prune by Jacobian importance — the activations most influential on outputs. For distillation, J-space could denoise the larger model's reasoning signal, allowing more effective transfer of critical pathways to smaller models with potentially less compute. Community response was cautiously positive: the J-space estimator is pre-trained on ~1,000 prompts, and whether it generalizes across tasks and domains is the open question. One commenter noted it could also enable J-space-aware quantization, dynamically monitoring models for degenerate loops, and even detecting manipulation. (more: https://old.reddit.com/r/LocalLLaMA/comments/1uqd8i7/i_need_an_adult_jspaceaware/)

Google Research's SensorFM applies the foundation-model paradigm to an entirely different domain: wearable health. Pre-trained on over one trillion minutes of multimodal sensor data from five million consented participants across 100+ countries and 20+ Fitbit/Pixel Watch devices, SensorFM learns a single reusable representation of human physiology via self-supervised masked reconstruction. The key design choice is treating real-world data gaps — sensors powering down, devices off-wrist — as equivalent to training masks, making the model missingness-aware by construction. Frozen linear probes on SensorFM embeddings outperform feature-engineered supervised baselines on 34 of 35 discriminative health tasks spanning cardiovascular, metabolic, sleep, and mental health categories. An "agentic classroom" of competing LLM agents that iteratively generate and refine prediction-head code beat simple linear probes on 28 of 35 tasks. When integrated into a Personal Health Agent, clinician-blinded evaluation found no statistically significant difference between grounding the agent in SensorFM predictions versus actual ground-truth measurements — the model's inferences served about as well as real lab results. (more: https://research.google/blog/sensorfm-towards-a-general-intelligence-and-interface-for-wearable-health-data)

Seven Hundred Twenty-Five Billion Dollars

Big Tech's combined AI capital expenditure for 2026 is tracking at roughly $725 billion — up 77% year over year — consuming approximately 45% of Amazon, Alphabet, Meta, and Microsoft's operating cash flow, up from 32% in 2024. Sequoia estimates the industry needs $600B in new annual revenue to justify the buildout, and that gap is widening. MIT's Project NANDA found 95% of enterprise GenAI pilots produced zero measurable P&L impact. Allianz measured the capex-to-revenue divergence at 46%, worse than the 32% seen during the 2001 telecom bubble. Even Palantir's CEO went on CNBC calling the situation "irresponsibly oversold." The bear case is damning. But the counter is real: Nvidia earned ~$120B at 53% margins (Cisco's dot-com peak was a fraction of that), the Nasdaq-100 trades at 26x forward earnings versus 60x in March 2000, and the Big Five generated ~$350B in free cash flow last year. These are cash-generating machines choosing to reinvest, not pre-revenue startups. Capital Economics' John Higgins framed it precisely: separate the "stock bubble" from the "fundamental bubble." Stock prices can deflate even if the technology delivers. The question was never "does AI work" — it's whether the price paid right now makes sense given how fast revenue actually materializes. (more: https://old.reddit.com/r/AINewsMinute/comments/1upmxgw/big_tech_is_spending_725b_on_ai_in_2026_while_the/)

The compute supply chain underneath that spending is finding its own price discovery. A spot-pricing tracker for Rackspace GPU instances shows that many less-contested regions sit at or near the $0.001/hr minimum bid for long stretches, while a standing bid at the p80 percentile would hold a node through roughly 80% of the sampling window — bidding the bare market price wins now but gets preempted at the next uptick. (more: https://jedarden.com/spot-pricing)