AI Frontier · Sep 22, 2026

Covering September 15 to 22. Three of today's papers measure shipped systems rather than benchmarks: ESPI runs against 63 real email-agent applications and carries 16 CVE IDs, AgentForge-Bench uses an off-the-shelf coding agent on real filed financial documents, and the forgeable-confirmation work validates its prediction across 12,203 mechanisms in public scanner templates. The finding is therefore not that an attack is possible in a lab, but that somebody already has to fix it.

Research

ESPI: don't fight the system prompt for control — forge the mailbox's operational state instead

Existing prompt-injection attacks are largely ineffective against email agents: template-based baselines reach attack success rates of only 4.58%–8.13%, because they follow an instruction-takeover strategy that competes head-on with the system prompt and the user's task. ESPI takes a different route. Using Email Protocol State Masquerade and a Camouflage Logic Chain, it reframes the attacker's desired mailbox operations as necessary remediation steps under a forged email-operational state. Across 480 controlled trials the success rate is 73.54%; across 870 black-box instances it hijacked all 63 evaluated applications, needing 1.84–1.89 attempts on average for the first success. Responsible disclosure produced formal risk acknowledgment from 22 vendors and the assignment of 16 CVE IDs.

Sources: arXiv

Confirmation in automated security testing is forgeable by the system under test — and deterministic rules are cheaper to forge than LLM judges

A finding a deterministic rule confirms by observation is reported as fact; one an LLM judges exploitable is treated as an opinion. This paper asks whether the system under test can forge that confirmation. In offline testing of a four-stage AI-assisted pipeline, nine of fifteen confirmation mechanisms are forgeable, and forgeability is predicted entirely by whether the decision reads attacker-controlled data. The authors tested the rule prospectively: on sixteen held-out mechanisms, predictions fixed before any attack separated forgeable from unforgeable exactly, and across 12,203 mechanisms in public scanner templates the prediction was 99.9% accurate. The counter-intuitive part is the cost. Deterministic rules fail at 2% of attacker-controlled response content, against a median of 50% for eight open-weight LLM judges. No implementation of one check was both robust and precise, and routing between a rule and an AI judge raised forgery to 99%. Moving the decisive evidence to a channel the attacker cannot write cuts attack success from 97% to 0%; that costs sensitivity, which an escalate verdict recovers. The authors state plainly where it fails: when the scanned host is itself the adversary.

Sources: arXiv

AgentForge-Bench: altering one dollar amount on a filed PDF costs 2.4 cents

The framing is the relying party — an insurer, a lender, an auditor — whose evidence is a filed PDF. The benchmark measures how reliably an off-the-shelf coding agent, driving one of seven open-weight models with a shell and the stock Python PDF stack, alters one dollar amount, date or address in a real filed financial document from a single sentence of intent, graded by rules rather than by a model. Across 1,750 cells, 1,419 (81.1%) satisfy the verifier and 808 (46.2%) also survive every stricter filter: visible, localized, typeface-matched, original value gone document-wide. The control is a deterministic script with no model in it: it solves 98 of the 125 documents, the agents solve 124, and none that the script solves alone. Two limitations the authors name: the agents misreport 41% of their wrong edits as done, and the raw rate overstates the threat by roughly a factor of two — though the strict rate is still large. No model refused.

Sources: arXiv

The benign-case price of memory-poisoning defenses: a reranker quarantines legitimate memories in 33.6% of adjudicated items on attack-free conversations

Memory-poisoning defenses are normally evaluated on whether they stop attacks, but the traffic they process is rarely adversarial: the cost is paid on every interaction while the benefit shows up in a small fraction of cases. The authors hold the memory backend, retrieval and judge constant, change only the defense, and run each condition three times across five conversations. On entirely benign traffic, the three write-time defenses — input sanitization, provenance checking, LLM-based anomaly detection — show no utility cost that resolves, with 95% confidence intervals of roughly ±4.5 points that include zero. The read-time reranker is different: it lowers core accuracy by 4.4 points (95% CI [-9.0, -0.05], McNemar p=0.064), a result that replicates but sits at the edge of the study's resolution. Its clearer cost is mechanical: on conversations containing no attack it quarantines legitimate memories on 33.6% of adjudicated items, reaching 106 false quarantines in a single conversation, at 2.7% token overhead. Stacking all four does not compound the cost — the combined condition's accuracy loss is smaller. The conclusion: where a defense intercepts the pipeline, not whether it uses an LLM, determines its benign-case price.

Sources: arXiv

SkillClone: the files stay hidden, the functionality does not

Closed-source agent skills may encode proprietary instructions, scripts, constants and data. Prior work focused on prompt injection that discloses those artifacts directly, and defenses accordingly aim at preventing leakage. This paper asks the other question: can a user reconstruct a skill's functionality through ordinary use while its files remain hidden? SkillClone is a black-box attack that forms an interface hypothesis from the skill's public advertisement, issues structured benign probes, synthesizes an executable replica, and iteratively repairs it through differential validation against the victim skill. Across 30 skills spanning rules, tables, procedures and algorithms, it achieves exact or partial recovery on held-out inputs for several targets, and iterative requerying closes gaps that single-round reconstruction misses. Because it uses only legitimate interactions, disclosure-focused defenses cover little of it, and writing vaguer skill descriptions offers limited protection.

Sources: arXiv

A red-team study of three Anthropic frontier models: robustness does not improve monotonically from one version to the next

Using the HackAgent framework, the authors evaluate Opus 4.8, Fable 5 and its successor Fable 5.1 against four families of automated jailbreak across 7,826 harmful intents in a ten-category harm taxonomy, with every apparent success independently re-adjudicated by the same panel of five frontier judge models (≥4/5 agreement). All three resist the majority of attacks, but the residual surface is larger than the aggregate framing suggests and is dominated by adaptive iterative attacks, while static obfuscation is near-fully neutralised. On the two attack families run against all three targets with identical denominators (TAP and PAP), the ordering does not follow release date: Fable 5 is most robust (2.72%), Opus 4.8 follows (5.76%), and the newest model, Fable 5.1, is least robust (8.19%). The three fail in largely disjoint places, and conditioning on prompts each model actually answered shows why: adaptive tree search breaks all three at broadly similar rates (10.1%, 9.7%, 12.1%), whereas one-shot persuasion separates them by more than an order of magnitude (3.1%, 0.7%, 9.5%). What distinguishes these models adversarially is their resistance to framing, not to search. Even so they produced 1,315, 620 and 1,282 panel-confirmed harmful completions respectively, spanning every harm category, found automatically and cheaply, usually within one or two refinement steps, by an attacker model with no human expert in the loop.

Sources: arXiv

Lab announcements

Google: Gemini 3.8 Live and 3.8 Live Extended Thinking (September 15)

Two live-dialogue models: 3.8 Live is built for scale and cost efficiency, combining conversational intelligence with visual grounding; 3.8 Live Extended Thinking targets high-complexity tasks with multi-step reasoning. Google says the latter takes the #1 overall spot on Artificial Analysis' Speech to Speech Quality Index at 82.6. The product claim is that the models manage tool calls in the background without interrupting the conversation. Available through the Gemini API, Google Workspace, Search and the Gemini app.

Sources: Google DeepMind

Google: occupation-level findings from ATLAS, and how scientists use AI (September 15)

A new interactive, open-access experience opens up the ATLAS data. The figures Google names: India's creative industry uses AI at a higher rate than the rest of the world, with arts, design and media occupations making up 19% of work-related AI usage, 1.6 times the global average; the US leads on technical adoption, with computer and mathematical occupations at 30%, double the share elsewhere; usage for manual tasks such as real-time equipment diagnostics varies sharply by region, at 7% of work usage in Brazil and Germany (1.4x the global average) against 4% in Japan. New research with MIT FutureTech adds one observation worth noting: nearly half of surveyed scientists use some form of AI every day and report saving almost 7 hours a week, but the bottleneck has moved further down the research pipeline, producing a backlog of hypotheses.

Sources: Google

OpenAI: Advisory Group on Mathematics and Artificial Intelligence (September 21) — an independent group to guide the review and communication of emerging AI results.

Sources: OpenAI

OpenAI: building standards for the next phase of AI (September 21) — a path to shared global AI standards, calling for coordinated evaluation, reporting and governance.

Sources: OpenAI

OpenAI: new OpenAI Academy learning paths (September 21) — for employees, developers, leaders, educators and students.

Sources: OpenAI

OpenAI: V7 gives AI agents institutional memory with GPT-5.6 (September 21) — turning scattered company files into source-linked context agents can use.

Sources: OpenAI

OpenAI: Higgsfield AI ships new video features in a day with GPT-6 Astra (September 21) — video ad creation aimed at small businesses.

Sources: OpenAI