AI Frontier · Sep 9, 2026

This issue covers September 3 to 9. Two empirical studies move agent security away from the model: across 3,171 public repositories, 16.0% of agent setups carry a decidable security defect, and among 200 deployed vibe-coded applications, 91.0% hold at least one vulnerability. What fails is not the model's answer — it is the configuration layer and the shipped artifact, which nobody inspects.

Research

Rewrite the reasoning, leave the actions alone, and chain-of-thought monitoring drops from 95% to under 11%

Chain-of-thought monitoring exists to catch reward hacks that look clean in the actions and betray themselves only in the reasoning. The authors rewrite an agent's reasoning to read as good-faith engineering while copying every command and output verbatim, leaving the exploit unchanged; one gradient-free shot drops a held-out monitor's catch rate on that subset from about 95% to under 11%. A monitor's aggregate accuracy, they argue, is a false average: it is carried by hacks the actions give away, and it hides the near-total collapse on the subset where the chain of thought is the only signal. The attack transfers across monitor families and agent models and reproduces with live agents; trace-only defenses recover it only partially, because the rewrite stays truthful about what happened and lies only about intent. Only information from outside the trace helps substantially.

Sources: arXiv

Of 200 deployed vibe-coded applications, 91.0% contain at least one vulnerability

The authors collected 9,041 open-source applications built with Claude Code and Lovable and audited 200 that were publicly deployed, uncovering 1,186 vulnerabilities: 91.0% of audited applications have at least one, and 65.77% of the vulnerabilities are rated Critical or High, concentrated in broken access control, injection and authentication failures. They trace these to eight recurring failure modes rooted in three systematic limitations of the agents — memory defects, objective defects and knowledge defects — and note that better harnesses and prompting strategies reduce the incidence but do not eliminate the underlying risk.

Sources: arXiv

The AI coding-agent configuration layer is a dependency layer with no lockfile: 16.0% of 3,171 repositories carry a security defect

Instruction files, skills, hooks, MCP server declarations and subagents are installed from marketplaces and public repositories and run with the developer's privileges, with no lockfile, no install-time check, and no vocabulary for what a component may do. The authors count only rules decidable from bytes with a definite consequence, and validate every finding through independent re-derivation and two rounds of model adjudication. Three security classes survive: 9.8% of setups install an MCP server with no version pinned, 3.1% pre-approve arbitrary execution behind a scoped-looking grant such as Bash(python:*), and 3.8% carry a skill that pre-approves the shell for whoever installs it. In total 16.0% of setups carry a security defect, against a raw scanner rate of 25.5% on the same rules — the gap is what validation is worth. The third class ships inside 3.7% of published skill collections, which is exactly where a marketplace scan could see it. No credential-exfiltration path was confirmed.

Sources: arXiv

Reconstructing a local LLM's output from CPU cache traces

The target is the detokenizer — a component of the default inference pipeline — rather than the deployment-specific conditions earlier attacks needed, such as shared data memory, CPU offloading or a Mixture-of-Experts architecture. The authors use Flush+Reload on shared tokenizer code to detect when decoding happens, then run Prime+Probe at that moment to isolate token-dependent cache activity, and finally recover text from the noisy observations with a clustering-and-language-model pipeline. Across multiple datasets, hardware platforms, inference frameworks and model families, the attack recovers semantically accurate output from real local deployments, including agentic systems. What makes it matter is that the most widely used tokenizer implementations are susceptible and are embedded in many local LLM products and agent frameworks.

Sources: arXiv

The same benchmark, a different evaluation pipeline, and the score moves by more than 80 percentage points

Modelling benchmarks as configurable measurement pipelines, the authors audit eight cybersecurity benchmarks across ten proprietary, open-weight and cybersecurity-specialized models. They identify 15 systematic failure modes and show that a single pipeline choice can change a model's score by more than 80 percentage points and substantially reorder rankings. Across benchmarks, two semantically similar task pairs rank the same models differently because their evaluation conventions are incompatible. Under a harness that standardizes pipeline choices while preserving task semantics, nine of ten models shift by at least three ranks on at least one benchmark.

Sources: arXiv

Linux privilege escalation by agents finally has scale: 531 executable scenarios

Existing evaluations of this step used fewer than 15 scenarios, too few to compare model capability under executable verification. The authors build 531 Dockerized scenarios across 14 sub-categories, derive 329 parameterized variants to measure sensitivity to environmental distractors, and evaluate six models across three agent architectures. Three findings: capability is heterogeneous across vulnerability classes, with no single model dominating the high-prevalence ones; successes are sensitive to environmental perturbation, so configuration rotation disrupts some exploit attempts without eliminating the measured risk; and the agent architecture itself materially changes success rates and reorders model rankings, by a model-dependent margin. They also release PrivEscAgent, which improves on prior baselines by adding deterministic enumeration, category matching and step planning to a generic ReAct agent, with no change to the underlying model.

Sources: arXiv

Lab announcements

Google DeepMind: AlphaGenome Atlas precomputes the molecular effect of all 9 billion single-nucleotide variants in the human genome (September 8)

This is AlphaGenome's predictions computed ahead of time and turned into a searchable resource: for each of the roughly 9 billion possible single-letter mutations in the human genome, the predicted molecular impact. The dataset is about 1 petabyte, which DeepMind says is more than thirty times the size of the AlphaFold Database. Shipping alongside it is the AlphaGenome Variant Impact (AVI) score, which condenses predictions from AlphaGenome and AlphaMissense into a single number for ranking variants. The team says external collaborators have already used the Atlas to identify and experimentally verify key variants in unsolved rare disease research. Access is through a free web portal for academic research, the AlphaGenome API, and a skill in Google Antigravity.

Sources: Google DeepMind Blog

OpenAI: an AI-generated solution to the Navier–Stokes Millennium Prize Problem, with a writeup and a formal proof in Lean (September 8)

Sources: OpenAI

OpenAI: ChatGPT Images 2.5 (September 8)

Sources: OpenAI

OpenAI: an MIT researcher uses GPT-5.6 Sol with Codex to autonomously run quantum computing experiments, analyze results and calibrate qubits (September 8)

Sources: OpenAI

OpenAI: a $5 million grant program for independent research on how generative AI affects teen development, well-being and safety (September 8)

Sources: OpenAI

OpenAI: 1Password reports a 21% increase in engineering productivity with Codex (September 8)

Sources: OpenAI