AI Frontier · Sep 11, 2026

This issue covers September 5 to 11. Three of this week's six papers attack not the model but the protocol layer between agents — A2A, MCP, AP2 — and in each case the defect needs no implementation error: a system built exactly to specification is affected too.

Research

A2ABreak: eleven vulnerabilities derived from the specification alone, where a zero-shot LLM found none

A2A is the Linux Foundation-governed standard by which agents discover, authenticate with and delegate tasks to one another. The authors use LLM-assisted extraction to build a finite-state machine from the natural-language specification (929 formalized statements into 37 states and 76 transitions), then reason adversarially over that model, surfacing 11 new vulnerabilities — among them cross-client context injection through unprotected context identifiers, credential harvesting via multi-hop identity loss in delegation chains, and data exfiltration through rogue agents advertising unattested capability claims. Against independent expert review the method reaches 73.3% precision and 84.6% F1; a zero-shot LLM baseline over the same specification produced zero confirmed findings. The stated limit is the full-compliance assumption — every finding holds only for implementations that follow the spec.

Sources: arXiv

MCPSEC: indirect prompt injection judged from tool metadata alone, 98.9% recall, paid for in precision

Third-party analysts auditing closed-source, remotely hosted systems often have neither access nor the ability to interact at runtime. The authors propose "no-box" analysis: using only the functionality metadata a server exposes at registration, hypothesize vulnerabilities that would exist across every implementation consistent with that metadata. Evaluated on 20 widely deployed MCP servers comprising 177 tools, where human evaluators confirmed 95 vulnerable tools, MCPSEC flagged 143 and among them predicted 94 real verified vulnerabilities (98.9% recall) against an LLM baseline's 80 (84.2%). Flagging 143 where 95 are real is the shape of the method's output: hypotheses to be validated when access arrives, which is how the authors themselves frame it, not conclusions.

Sources: arXiv

AP2 signs the transaction but not the decision: three attacks at 90%, 56% and 73.3%

AP2 produces cryptographically valid signatures for purchases an agent makes on a person's behalf, but places no constraint on the decisions that lead to them. The authors show that ordinary product-description text steers a shopping agent into fetching another user's payment credentials (90%), assembling a cryptographically valid cart whose contents do not match what the user was shown (56%), and — on a single factual claim about stock or product lineage — moving from the cheaper displayed item to a more expensive one while the cart stays fully consistent with the listing (73.3%). Testing used the Gemini Flash-Lite models AP2's sample agents specify by default, and the same weakness reproduced across seventeen Google models, three unrelated agent frameworks and Google's own consumer assistant. Their defence, A-VIP, treats the signed intent as a capability grant; it blocks the first two structurally, and only flags the third.

Sources: arXiv

What limits penetration-testing agents is planning, not memory — a coverage-memory layer improved neither system

The authors compare two PentestGPT systems: a legacy human-in-the-loop setup running the open-weight Kimi K2.5, and a newer autonomous one running Claude Opus 4.8. Across three public targets the autonomous system solves all three and the legacy system never finishes two — yet on those same machines the legacy system still completes about half the subtasks, on ordinary university GPUs with no provider guardrails. They then test the usual explanation, long-horizon memory loss: adding a coverage-memory layer to both systems improved neither, and in the stalled runs they could review, the agent held the evidence for a route forward and never turned it into a concrete exploitation hypothesis. The authors are explicit about the confound — model, harness, autonomy and memory architecture all change together, so they can describe the trend but not explain it.

Sources: arXiv

170 patches that passed their tests and still carried a vulnerability, with neither tests nor LLM reviewers catching them

This studies "silent failures" in LLM-agent code repair: patches that pass syntactic and functional verification while retaining or introducing security defects. Across 1,030 valid execution traces from seven agent frameworks running GPT-4o-mini on SecurityEval and CVEfixes, three iterations of qualitative coding and manual verification confirmed 170 silent failures — Omission (a required security control simply absent) at 48.2%, Introduction (a new vulnerability added during repair) at 30.6%, and Inadequacy (an incomplete defence) at 21.2%. The finding worth carrying is that current test-passing evaluation and LLM-based reviewer roles were insufficient to expose or intercept these cases. Similar insecure solutions recurred across different frameworks, pointing at model-, prompt- or task-level influence rather than any one framework.

Sources: arXiv

Roughly one in seven statically clean Python samples is confirmed exploitable under dynamic verification

Static analysis is routinely treated as a pass-means-secure gate. The authors run a three-stage pipeline over 1,355 Python samples: static scanning, LLM-driven CWE reasoning, and autonomous exploit verification in isolated Docker containers. Of the 654 samples that produced no findings under the composite Bandit-Semgrep gate, the LLM stage identified 394 candidates across 235 files, and dynamic verification confirmed or partially confirmed exploitability in 95 files — 14.53% of the statically clean set. The rate varies sharply by dataset: 33.7% for RedCode, 28.6% for CyberNative, 5.4% for SecurityEval. Several repeatedly confirmed classes, including CWE-338 and CWE-916, were flagged by neither Bandit nor Semgrep.

Sources: arXiv

Lab announcements

Anthropic: evaluations of tactical intelligence targeting and conventional weapons development (September 10)

The Frontier Red Team built two new evaluations measuring model capability at tactical intelligence targeting — such as locating people from fragmentary information — and at conventional weapons development, such as engineering drones to strike a moving target, and reports that on some military and intelligence tasks models can now do things historically reserved to a scarce set of highly-trained human experts. The reasoning behind it is the part worth keeping: what protects people, programmes and facilities from intelligence targeting is largely not secrecy but cost, since the data useful for deanonymization is already public or cheaply purchasable and what is expensive is the analyst labour to correlate it — so a model that makes that labour cheap admits individuals and small groups previously incapable of the workflow. The PRC-developed open-weights models tested are behind the frontier, typically between Sonnet and Mythos-class performance, but still showed concerning ability to identify and target adversaries and to improve weapon performance. Anthropic says it has deployed new classifiers to block this category of misuse.

Sources: Anthropic

OpenAI: the Agents API, a managed service built on the Codex harness for orchestration, long-running sessions and tool use (September 10)

Sources: OpenAI

OpenAI: GPT-Live-1 in the API, with full-duplex voice, custom voices and telephony support (September 10)

Sources: OpenAI

OpenAI: ChatGPT for Financial Services, pairing built-in financial data with GPT-6 Astra (September 10)

Sources: OpenAI

OpenAI and GSA: $0 license fees, 50% off usage and expanded cyber defense support for US federal, state, local and tribal governments (September 10)

Sources: OpenAI

OpenAI: the Data agent in ChatGPT Work, connecting company data and building interactive dashboards from natural language (September 10)

Sources: OpenAI

OpenAI: César de la Fuente's lab uses Codex and ChatGPT to search living and extinct genomes for antimicrobial candidates (September 10)

Sources: OpenAI