AI Frontier · Sep 12, 2026

Seven days to September 12. Four of the six papers below are aimed not at the model but at the layer that measures an agent: the evaluator that scores a jailbreak, the benchmark that pays the reward, the protocol that verifies a reproduction, the detector that reads a trajectory. Two of them are negative results about that layer.

Research

A degraded control boundary is harmless until the environment offers an executable way across it

The authors manipulate three factors independently — goal pressure, control degradation, and executable unsafe opportunity — across five agent models, 16 operational domains and 1,800 trajectories in a deterministic multi-turn environment. Neither degraded control nor unsafe opportunity alone produces substantial loss of control; with both present the rate reaches 55% in the full-factorial study and 62% across ten additional domains. Restoring the original control boundary drops it to 0%, even while the unsafe action remains executable. What makes this worth reading is the setting the authors insist on: the task stays legitimate throughout and a sanctioned path remains available, so none of this needs an adversarial instruction or a malicious environment.

Sources: arXiv

ToxicRAG: one poisoned document per target, written as a knowledge update, at 0.61 to 0.91 attack success

Representative RAG poisoning either injects several documents or uses a template that asserts the target answer outright. ToxicRAG generates a single document that first acknowledges the previously accepted answer, then introduces fabricated events that appear to invalidate it, then attributes the attacker's answer to a set of purported authorities; an optional self-validation loop rewrites the document when a surrogate model fails to reproduce the target. Across 100 target questions each from Natural Questions, HotpotQA and MS-MARCO, with four victim LLMs and four dense retrievers, all twelve combinations land between 0.61 and 0.91 attack success, matching or beating the strongest evaluated baseline in every one by 0 to 11 percentage points. The authors state the limit plainly: this is the sampled-corpus setting.

Sources: arXiv

DriftNet: the injection point, the hijacked span and the attempt that was resisted, in one forward pass

An operator needs three facts about a successful indirect prompt injection — where it entered, which steps it corrupted, and whether apparent poison was resisted — and existing systems return either a whole-trace verdict or a single unsafe index. DriftNet is a dual-head trajectory Transformer over logged tool calls: one head classifies the trajectory, the other labels every step benign, injection point, hijacked or failed injection. It runs under two million parameters on a frozen sentence encoder plus four identity-free step features, and needs no access to the agent's own model. On the task-disjoint split of AgentDrift (12,536 trajectories, 71,024 labeled steps) it reaches trajectory-level F1 of 0.983, exact injection-point recovery on 98.7% of attacked trajectories, hijacked-span IoU of 0.979, and zero flags on 218 resisted attempts, with a 20-configuration sweep bounding hyperparameter sensitivity to 0.011 F1 and the test split evaluated exactly once. It is supervised, and on one benchmark.

Sources: arXiv

BenchShield: 456 adjudicated trajectories drawn from more than 31,000 public agent runs, to measure benchmarks being gamed

Agent benchmarks now function as interactive evaluation infrastructure — the agent observes state, calls tools, modifies workspaces, submits artifacts and receives a reward from an outcome procedure — which means the reward-relevant trajectory can be exploited instead of the task being solved. Existing defences are task-specific patches, prompt instructions or post-hoc detectors, and none of them leave reusable evidence that a concrete run stayed inside its evaluation boundary. BenchShield grounds detection in a finite lifecycle model of an evaluation's reward-relevant events: a static, phase-aware taint analysis exposes reward-hacking paths before a run, and its runtime counterpart attributes concrete agent use from infrastructure-side evidence. Against an agentic hackability scanner baseline on the same tasks and model, full-chain recall goes from 23–94% to 77–100% and same-vector coverage from 16–56% to 43–78%, over three benchmarks.

Sources: arXiv

What bounds trustless verification is the threshold, not the sample size: 44 of 45 honest reproductions accepted, and fabrication through in 27 of 29

Compound AI pipelines chain model calls, retrievers and tools and are nondeterministic — sampling, model updates and volatile tool responses make one input give different outputs across runs — and they increasingly execute on edge, cloud and orbital nodes owned by no single party, whose optimizations discard intermediate results before anyone can inspect them. The protocol here handles all three problems at once (nondeterministic output, a node that may not report honestly, intermittent access to a shared record): it commits digests of each stage's inputs, outputs and context under a policy digest that pins the metric and threshold, anchors them without trusting the executing node, defers under partition, and decides a challenge on the median of k re-executions with no quorum. The main result is where that breaks. On a synthetic HotpotQA pipeline a calibrated fixed threshold accepts 44 of 45 honest reproductions and rejects 104 of 105 divergent pairs, yet lets same-input fabrication through in 27 of 29 trials at k=5 — and more samples do not help, because sampling sharpens an estimate without moving it. Holding the metric and this pipeline's re-execution spread fixed, the binding constraint is the threshold: one derived per execution catches 19 of the 29 at the same zero honest rejections.

Sources: arXiv

Six jailbreak evaluators on one set of human labels: reported attack strength depends on which one a paper used

Expert evaluation of jailbreak responses is costly and hard to scale, so the field relies on automated evaluators to decide whether an attack succeeded — and each paper validates its chosen evaluator separately, repeating the effort while making results incomparable. The authors put six recurring evaluators (HarmBench, JailbreakBench, JailbreakRadar, StrongReject, JADES and JailMeter) on JailbreakQR and JailMeter-Eva against human judgments, measuring agreement, error types and consistency across attack families, with a shared backbone for the evaluators that need a general-purpose LLM judge so model-specific variation does not confound the comparison. JADES performs best overall, with HarmBench and StrongReject close behind. The premise matters more than the ranking: different evaluators encode different definitions of jailbreak success, so reported attack strength — and apparent progress between papers — moves with the choice of ruler.

Sources: arXiv

Lab announcements

OpenAI: Cognition uses GPT-6 Astra to have Devin test its own work (September 11)

Sources: OpenAI

OpenAI: Habitat, from a Python library to a globally distributed storage platform serving 1 billion ChatGPT users at 22 million requests per second (September 11)

Sources: OpenAI