AI Frontier · Sep 3, 2026

This edition covers Aug 27 to Sep 3. The only new release in the window is Google's Gemini 3.8 Flash Cyber — a model deliberately trained to fix before it exploits, and released only to vetted defenders because its cybersecurity mitigations are looser than the general build. The six papers below converge on one structural point: the leak is not in any single component, but in the seam between skills, tools and shared context.

Research

Context inference attacks pull an agent's private context out without any jailbreak

Agentic systems assemble sensitive data — health records, financial documents — into a hidden context before answering. Prior privacy work has focused almost entirely on jailbreaking the model into disclosing that content directly; this paper attacks the agentic setting instead, where the context is assembled by the agent's own tool calls. The authors formalise context-inference attacks and evaluate them under three levels of decreasing attacker knowledge: a known context, an unknown context, and a context the agent retrieves itself. One attack carries through all three unmodified: 100% attack success rate on small candidate sets and 63% at 1,024 candidates against a known context; 78.9 AUROC when the template and surrounding records are unknown; 92.5 AUROC when a 14B surrogate scores a 32B target; and 81.8 AUROC when the records arrive as an agent's retrieval returns, against a chance rate of 50. The three controls tested — instructing the model not to disclose the context, logit suppression, and context dilution — did not stop it.

Sources: arXiv

A Finger on the Scale: a third-party agent skill can steer decisions while preserving the task and the output format

Reusable agent skills double as externalised behavioural policies, which creates a supply-chain risk: a third-party skill can preserve its declared task and a valid output interface while covertly redirecting the agent's decisions toward an undisclosed objective. The authors present SkillShift, a constrained black-box framework that achieves this without explicit target command injection or task hijacking, combining semantically plausible policy edits with hierarchical validation and failure-guided optimisation. Instantiated in agentic commerce and software dependency selection, it reaches attacker-favoured selection rates of 81.33% and 63.33% while maintaining a 100% utility-preserving rate, and the frozen policies transfer across heterogeneous LLM backends and agent environments without further optimisation. The scanners the authors evaluated failed to detect the constructed skills.

Sources: arXiv

Tool orchestration leaks more: individually harmless returns compose into a sensitive conclusion

The authors formalise this as TOP-R, requiring three conditions at once — the conclusion is sensitive, no single source implies it, and the composition does. Their TOP-Bench benchmark holds 1,000 instances. Across six LLM agents, average task completion was 98.0% and leakage 88.6%. With native reasoning enabled, four models averaged 81.4% leakage in the final response and 82.4% in the reasoning trace — the trace is a second leakage channel in its own right. With reasoning disabled, three prompt-only safeguards improved the H-score by an average of about 3.4 points; the authors' SFT+DPO method, TOP-Align, improved it by 16.2 points on a separate post-training evaluation set, against a 5.0-point average for prompt-only mitigation on that same set. The conclusion is that prompting alone does not address this class.

Sources: arXiv

Labelling data "OK to share" makes agents more willing to pass it on verbatim

A deliberately narrow controlled study on a combined chain, where one agent uses both an MCP tool leg and an A2A delegation leg. Ten record scenarios each appear in three arms — a CONFIDENTIAL header, no header, and PUBLIC - OK TO SHARE — with the six substantive record values byte-identical across arms, scored by deterministic rules rather than an LLM judge: four models by three arms by four repeats, 480 trials. The confidential-minus-unlabelled contrast is inconclusive and floor-limited in every model, so it does not show that confidential labels lack protective effect. Adding PUBLIC - OK TO SHARE is associated with more verbatim egress, with strong model dependence: for Claude Sonnet 5 the public-minus-unlabelled mean is +0.800 across all ten scenarios, mostly reflecting whether it relays at all; one GPT-5.6 tier is moderate but floor-limited, another has a median of 0, and a third is at a complete floor. The authors are explicit that this is an association in one configuration, not a causal or general effect, and release code and byte-pinned traces.

Sources: arXiv

PrimSynth: a multi-agent framework that discovers and synthesises Linux kernel exploit primitives

Targeting memory-corruption bugs, the authors first formalise six classes of exploit primitive from logical capability to validatable effect, then propose a strategy representation coupling primitive-upgrading rules with code synthesis constraints, and run coordinated agents in a closed loop that uses validation signals as evidence of exploitable state transitions. Across 16 real-world Linux kernel CVEs spanning five vulnerability types, primitive extraction held a 100% match rate. For synthesising multi-primitive exploitation chains, the strategy synthesis rate was 82.4% when a public PoC was available and 61.3% without the guidance of primitive hypotheses. That second figure is the one to read: removing the public PoC costs 21 points, which places the system closer to completing an existing exploitation path than to building one from nothing.

Sources: arXiv

Jailbreak evaluation is itself unreliable — change the judging criteria and the ranking changes

A systematic measurement study over 37 jailbreak studies since 2022 finds that existing evaluation systems lack case-specific criteria, producing misleading conclusions about effectiveness — meaning a large share of the spread between published jailbreak success rates comes from how they were judged rather than from the attacks. The authors introduce GuidedBench, a curated harmful-question dataset, and GuidedEval, an evaluation system with case-by-case guidelines, which reduces inter-evaluator variance by at least 76.03%.

Sources: arXiv

Lab announcements

Google DeepMind: Gemini 3.8 Flash and 3.8 Flash Cyber (Sep 2)

The third Flash release in six weeks. 3.8 Flash keeps 3.7 Flash's price — $0.75 per million input tokens, $3.75 per million output — and scores 54.9% on HLE-Verified. Google attributes the gains to the model simply working harder: extra reasoning steps and iterative tool calls on complex tasks, which also means higher token use, so it advises lower effort levels or staying on 3.7 Flash where compute efficiency is the constraint. 3.8 Flash Cyber is the security-specialised variant: pass@1 of 47.2% on the external CWE-Bench patching benchmark against a leading frontier model's 47.8% — it sits on the cost-performance Pareto frontier, so the claim is much cheaper at the same level, not better — while Google's internal benchmark spanning 20 programming languages puts vulnerability discovery above 70%. Deployment figures: Chrome's security team reports 2.6 times more correct patches than the best commercial models, which are much larger; Wiz reports 7.5–9.7% higher recall on its internal penetration-testing benchmark at 2.3–5.2 times lower cost; and Google's Cloud Vulnerability Research team used it to find a critical foundational vulnerability in under two hours, work that normally takes months. Google states it prioritised vulnerability fixing over offensive capability from the start, and that this build ships with more permissive cybersecurity mitigations than the general model, which is why access is restricted to trusted defenders.

Sources: Google DeepMind

Google: the Fairwind Program gates those capabilities to governments and critical infrastructure (Sep 2)

Fairwind pairs Gemini 3.8 Flash Cyber with Google's CodeMender harness, which Google says produces verified, deployment-ready patches in minutes inside the organisation's own secure cloud environment. Access is staged to three groups: governments and national cyber authorities, critical-infrastructure operators across healthcare, telecommunications, energy and financial networks, and core technology platforms. Participants accept operational conditions — restricting use to their internal cybersecurity, incident-response or penetration-testing teams, and deploying protections such as multi-factor authentication. Google reports more than 650 participating partners and frames the gating as an adaptation window for defenders to harden systems before attackers reach comparable capability. Google Cloud customers outside Fairwind can still run CodeMender with publicly available models. Announced alongside it: Google.org cybersecurity funding now past $100 million in total, including $36 million for 35 cyber clinics that have supported over 1,250 US hospitals, public school districts and municipal utilities.

Sources: Google

Google: Google Pics arrives in Workspace (Sep 1)

An image creation and editing tool built on the Nano Banana model, now available in Google Workspace.

Sources: Google

OpenAI: how AI-native companies turn workflows into operating capability (Sep 1)

Basis, Clay and Exa Labs described using AI agents for onboarding, account management and developer integrations.

Sources: OpenAI

OpenAI: ATV Big Air Tour turned three days of work into three hours with ChatGPT (Sep 2)

A customer story covering marketing and merchandising workflows.

Sources: OpenAI