AI Frontier · Sep 2, 2026

This edition covers the past 7 days of lab announcements and research, led by OpenAI's Astra — the first model to cross its "Critical" cybersecurity capability threshold — and five new papers on agent authorization and the reliability of layered defenses.

Research

What's in Your Agent's Context? Context Privilege Escalation Attacks Against 12 Real Agent Harnesses, Including Claude Code and Codex

The paper identifies two previously unstudied attack classes: MessageRole Context Privilege Escalation, where content from a low-privileged source gets folded into a higher-privileged message role, and Cross-Scope Context Privilege Escalation, where attacker-injected content persists beyond the context it was introduced in. A systematic security analysis across 12 real-world agent harnesses, including Claude Code and Codex, found consequences ranging from full agent compromise and remote code execution to denial of service and manipulated tool/skill invocations.

Sources: arXiv

Delegation Without Trust: An Empirical Gap Analysis of Authorization Across Four Major Multi-Agent Frameworks

The paper sets an "untrusted-model" bar — a correctly governed agent system must not exceed its delegated authority even when fully prompt-injected — and tests LangGraph, CrewAI, AutoGen, and the MCP authorization model against it: three provide no built-in confinement at all, one provides only partial confinement, and none meets the bar alone. The authors then built and adversarially tested an authorization broker: it accepted 0 of 200,000 forged tokens, confined a compromised sub-agent to a mean of 1.5 reachable actions versus all 8,100 under bearer-token delegation, and enforced each decision in about 2.6 microseconds.

Sources: arXiv

Cheap Verifiers, Large Blind Spots: Measuring How Much Cost-Saving Inference Cascades Hide Their Own Failures

Many systems route most queries to a cheap model and escalate hard cases to a stronger one that acts as verifier, to cut cost. The paper measures the loop and finds the verifier's blind spot — the share of the cheap model's wrong answers it accepts — grows as the cheap model gets more capable (β climbs from 0.12 at 0.5B parameters to 0.55 at 32B). Swapping in a frontier verifier drives that down to about 0.05, but then escalates 46% of hard MATH queries against a 39% true error rate — paying near-frontier cost on almost half of all traffic. Worse, the cascade's own error-rate dashboard reads a flat 3% throughout, while true delivered error swings as high as 32%: the system is structurally blind to its own degradation.

Sources: arXiv

Layered LLM Defenses as an Ensemble: Measuring Whether Seven Stacked Layers Actually Fail Independently

Practitioners stack LLM defenses assuming the layers compound like an independent ensemble — a precondition (that each layer fails on different inputs) the security literature recommends but had never measured. Testing a seven-layer stack against one adaptive adversary, the authors found positive failure correlation in all 15 measurable layer pairs (φ from 0.30 to 0.75), with the actual joint attack success rate exceeding the independence-based prediction by up to 0.172. The correlation is mostly common-cause — layers sharing the same underlying model — rather than a sampling artifact. The full stack refuses four in five benign prompts, yet its attack-success rate is statistically indistinguishable from its single strongest layer alone.

Sources: arXiv

Same Request, Different Boundary: How Conversation History Swings an LLM's Willingness to Help With Cybersecurity Requests

The paper introduces 3R-Bench (150 real-world cybersecurity requests under two adversarial conversational settings) and evaluates eight LLMs. For an unchanged request, compliance is 62.0% when the prior conversation contained a refused similar request, but 85.1% when it contained an accepted one. Conversely, splitting the same request across multiple turns instead of asking directly drops compliance from 501/800 to 172/800 (a 45.1-point drop across 738 comparable pairs), and follow-up prompting after a refusal recovers only a small fraction of that loss.

Sources: arXiv

Lab announcements

OpenAI: Astra Becomes the First Model to Cross the "Critical" Cybersecurity Capability Threshold, Shipping With Strengthened Safeguards

Sources: OpenAI News

Anthropic: Enterprise Frontier Safeguards (EFS) Lets Customers Keep Zero Data Retention While Still Getting Cross-Session Abuse Monitoring

EFS stores monitoring data in the customer's own cloud infrastructure (AWS/GCP/Azure) rather than Anthropic's, and routes flagged signals directly to the customer for review with no Anthropic human review involved. The design was built with feedback from more than 100 enterprise customers, including the CISOs of major US systemically important banks (Goldman Sachs, Morgan Stanley, Citi, Bank of America, Wells Fargo) via the ARC (Analysis and Resilience Center for Systemic Risk) coalition.

Sources: Anthropic News

Google DeepMind: Agentic Video Understanding Cuts Gemini's Token Use by Up to 88%, Cost by Up to 66%, and Improves Accuracy by Up to 7%

Instead of processing video at a fixed frame rate, the model now decides for itself which segments, at what speed, and through which modality (frames, audio, or transcript) to inspect — gains are largest on long-form video, from 10-minute how-tos to 90-minute lectures. It's live today on Gemini 3.7 Flash, 3.6 Flash, and 3.5 Flash-Lite via Google AI Studio and the Gemini Enterprise Agent Platform, at standard API pricing with no added fee.

Sources: Google DeepMind Blog

OpenAI: Healthcare Organizations Can Now Connect EHR and Other Industry Data to ChatGPT

Sources: OpenAI News