AI Frontier · Sep 15, 2026

Covering September 8 to 15. This batch of research attacks the agent's supply chain rather than its prompt — the server in the registry, the persistent memory, the quantized weights, the metadata a review pipeline reads. In four of these papers the injection lands before the user says anything at all.

Research

A census of the MCP registry: 51.1% of multi-version servers changed what they advertise, 40.6% silently

The authors harvested the full public MCP registry as of August 2026 (21,643 servers, 72,606 version records), fetched source for 14,353 of them, ran a pattern scanner covering an eight-class threat catalogue, and measured its accuracy against 414 hand-labeled findings. The most prevalent single weakness is unauthenticated network exposure, at 9.57% of scanned servers; observed high-severity prevalence of 11.14% falls to roughly 7.6% after correcting each class by its measured precision. But the finding the authors put first is instability, not any one weakness: 4.2% of servers redirected their remote endpoint to a different host while keeping their registry identity, a change the protocol never surfaces to installed clients. Silent drift carries nearly threefold higher odds of a high-severity finding (OR = 2.96, 95% CI [2.56, 3.42]), and popularity barely protects (OR = 0.78 per unit of log stars). Their recommendations land on registry design and client-side pinning.

Sources: arXiv

Capability laundering: split the harmful task, consult the aligned model on each piece, and no single response is harmful

A weaker, unaligned model splits a harmful task into benign-looking subproblems, consults a stronger aligned model independently on each, and combines the answers locally. Unlike a jailbreak, no individual response is a harmful task. Uplift is measured on tasks that a raw frontier model solves, the aligned frontier refuses, and the unassisted orchestrator fails. On CyBench, Gemma-4-31B recovers 8 of 14 candidates with GPT-5.5 and 7 of 9 with Opus, against 2 of 21 and 4 of 15 for Gemma-4-12B. For CBRN requests, consultation raises Gemma-4-31B's mean rubric score from 62.3 to 83.1 on a 100-point scale. The limitation is that orchestrator scale matters a great deal — Muse-Glimmer-30B recovered nothing on BountyBench.

Sources: arXiv

PMPA: instructions written into persistent memory survive across sessions, and after-the-fact defenses barely help

The attack embeds malicious instructions in benign external sources and induces the agent to write them into persistent memory, without ever touching the agent framework. Tested on OpenClaw and Claude Code across several backbone models, input modalities and trigger scenarios, average injection success and cross-session attack success are 73.7% / 55.5% on OpenClaw and 66.9% / 81.7% on Claude Code, with benign task performance preserved. The defensive limitation is the sharper half: a targeted prompt-level defense reduces memory injection in many settings, but provides limited protection once the persistent memory has already been poisoned.

Sources: arXiv

The framing effect in code review is exploitable: 32 of 33 CVEs reintroduced

The authors first run a large exploratory study across 6 LLMs under five framing conditions, establishing that letting presentation override semantic content is systematic in LLM-based vulnerability detection. They then test 33 CVEs across 20 real-world projects against two pipelines, Claude Code and CodeRabbit. Template-based attacks are ineffective and can backfire — direct biasing attempts raise suspicion — while an LLM-assisted refinement attack succeeds in 32 of 33 cases (97%). The asymmetry they name is the point: an attacker can iteratively refine against a local clone of the review pipeline, while the defender gets one chance to detect it.

Sources: arXiv

AGENTQ: the full-precision checkpoint passes the audit, and the backdoor activates on quantization

Quantization is a default deployment path for open-weight agents, and it is not behavior-preserving: an adversary can release a full-precision checkpoint that passes audits yet misbehaves once quantized. The authors argue the agentic case is worse than free-text generation, because the triggered payload is a structured function call that executes without a human reader in the loop. Directly adapting prior backdoor-injection methods does produce post-quantization malice but degrades benign utility too far to be practical; AGENTQ combines layer-banded LoRA injection with partial-PGD repair over a multi-codebook quantization-equivalence class, reaching up to 100% post-quantization attack success across three trigger-action pairs and three codebooks (NF4, FP4, INT8) with minimal loss of benign capability.

Sources: arXiv

Repository-scale vulnerability localization: the best system reaches 0.229 File F1, and 38.4% of tasks get no correct localization from any model

Existing evaluations mostly ask whether an agent can detect, reproduce or repair a vulnerability, rarely whether it can find the relevant code first. VLoc Bench takes 500 real-world vulnerabilities from 290 repositories across six package ecosystems and 147 CWE categories, pairing repository snapshots immediately before and after each security fix: on the vulnerable snapshot the agent gets only the CWE description and read-only terminal access and must return the affected files; on the patched snapshot it must determine the vulnerability is gone. Across 27 language models and four static-analysis tools under a common interface, the strongest system reaches 0.229 File F1. The other half of the result is blunter: strong localization does not imply reliable behavior after remediation — systems that identify vulnerable files effectively still report unsupported locations on patched repositories.

Sources: arXiv

Lab announcements

OpenAI: Fyxer builds an email assistant on fine-tuning, memory and user feedback (September 14)

An OpenAI customer story on how Fyxer organizes inboxes and drafts email in each user's voice. OpenAI's article pages answer fetches with 403, so this one-line teaser is the whole source.

Sources: OpenAI

Google: DevFest 2026 runs October 1 to December 31 under a "Build, Secure, Scale" theme (September 14)

Hosted by Google Developer Groups, with more than 800 events planned across 115 countries. One of this year's three tracks states that speed cannot come at the expense of stability, and names secure deployment, data privacy and responsible AI guardrails; the tooling spans Gemini, Google AI Studio, Antigravity, Firebase, Android, Flutter, Angular and Web MCP.

Sources: Google