AI Frontier · Sep 24, 2026

Covering September 17–24. What the five papers in this issue share is that none of their attack surfaces lives in the model weights: the tokenizer that renders the chat template, the regular expression that parses tool calls, the arrival time of tool responses, the multi-agent host that treats a remote name as a routing identifier, and the activation artifact allowed to leave an isolated environment. The claim that safety is a joint property of the model and the software carrying it now has five independent pieces of evidence behind it.

Research

Control-token injection suppresses the chain of thought and defeats reasoning-based oversight

On the released gpt-oss-20b reasoning model under its published tool sandbox, appending a single string of the model's own channel-control tokens to a user message makes the tokenizer render a reasoning turn that is already complete — so the model writes no chain of thought and proceeds directly to the tool call. Across forty tasks the model already completes, the reasoning channel falls from a mean of 52.5 tokens to zero on every trial while the http.post still fires on every trial. A rule monitor and a cross-family language-model monitor detect the unsafe request on all plain trials and on no forged trials; on overtly malicious requests the attack converts 39.6% of the model's refusals into completed exfiltrations. The second finding is blunter: whether an identical tool-call generation fires at all is decided by the harness parser, not the model. A truncation-tolerant regular expression fires a call whose closing token is missing while a strict one drops it, and two parsers shipped for the Gemma agent give opposite outcomes on identical greedy generations — one firing on all twenty-four trials, the other on none.

Sources: arXiv

Ajar: existing agent-defense benchmarks cannot see the privilege a defense leaves open

Agent-security defenses are currently evaluated on benchmarks built around indirect prompt injection, scored on how far they drive attack success down while preserving the agent's utility. Both metrics look only at what the agent executed. A defense can score well on both while holding open a transfer, a deletion or a broad read that no task needed. Ajar measures that open privilege directly: it attaches to an existing agent-security benchmark and reuses its tasks, tool schemas, reference solutions and goal states, then for each benign task builds candidate tool calls the task does not need and presents them to the defense at every point where the agent could act — allowing one is privilege left open. The authors attach it to AgentDojo, making open privilege a third axis beside attack success and benign utility, and run it against five defenses: Progent, CaMeL, AC4A, Permission Assistant, and Claude Code's Auto mode.

Sources: arXiv

A covert channel in the residual stream: the exported artifact is schema-valid and carries data that was not authorized to cross the boundary

Privacy-sensitive organizations often run large models in restricted or air-gapped environments while exporting selected diagnostic artifacts. The authors show that a compromised runtime component can hide sensitive information in the intermediate activations allowed to leave, and that an offline observer recovers it with a simple linear decoder. The attack requires no retraining or weight modification, no attacker-controlled egress, and no control over the recorder or the transfer: messages are mapped to codewords and injected into an intermediate residual stream through a compromised runtime hook, with injection strength scaled to the local residual norm to keep it recoverable. Across eleven models from seven architecture families, nine models show 91–100% recovery at a KL divergence of 0.001–0.007, while the activation-level detectors evaluated remain close to random guessing (AUC ≤ 0.56). The post-hoc defenses tested do not reliably eliminate the channel.

Sources: arXiv

ChronosAttack: change only when authentic tool responses arrive, not what they say

LLM agents often process external tool responses as they arrive, which makes response timing part of the decision process. ChronosAttack is a delay-only attack: it does not modify, add, remove or accelerate any genuine response, and bounded delays alone can reorder the same evidence and change the final decision. Evaluated on GPT-5.6 Sol, Gemini 3.6 Flash, DeepSeek V4 Flash and Claude Sonnet 4.6, GPT-5.6 Sol and Claude show strong targeted shifts in vulnerable settings, Gemini shows large shifts in the opposite direction, and DeepSeek is more stable under the tested schedules. The authors also find that sequential agent state is not always required, and that a single scheduling inversion can produce a large decision change; synchronization and order-consistency defenses reduce attacker control over observation order.

Sources: arXiv

Agent name collision: A2A defines the card name as human-readable metadata, and hosts use it as a routing identifier anyway

Multi-agent hosts turn remote Agent Cards into local agents, tools, workflow targets and broker routes. A2A defines the card's name as human-readable metadata rather than a stable identity and specifies no collision semantics; the security failure begins where a host nevertheless uses that remote name as a local routing identifier. The authors traced registration through dispatch at seven pinned open-source revisions and ran isolated regression tests. Six client-style integrations selected an attacker-controlled peer's client or loopback endpoint for a request addressed to a trusted peer's name. A seventh, brokered implementation collapsed both peers onto one name-derived route, where queue and access-control state determine whether the outcome is interception or denial. The scope is stated carefully: the common result is wrong-peer dispatch, not universal privilege inheritance, and synthetic credential and tool tests found no actor-specific credential transfer in the client bindings tested and no direct transfer of the trusted peer's tools.

Sources: arXiv

Lab announcements

Anthropic: Claude autonomously discovers a novel enzyme system with CRISPR-like repeats (September 23)

Anthropic announced a life sciences research group and its own laboratory, and published its first results. The researchers supplied one prompt — search a massive DNA sequence database for interesting new examples of reverse transcriptases (RTs) — and the search, family analysis and candidate judgement were left to Claude agents. Roughly 950 agents spent 21 hours and 210 million tokens, and one spotted a repeating pattern of DNA sequences next to the gene for an odd-looking RT. The RT itself had been identified in earlier studies; what Claude appears to be first to notice are its two defining features, an associated array of non-coding DNA sequences and an additional accessory protein of unknown function. The authors call the class array-associated reverse transcriptases (ART) and state plainly that its primary function is not yet established. Feng Zhang of MIT and the Broad Institute, one of the pioneers of CRISPR genome editing, called the finding "genuinely intriguing and merits further investigation." A pre-print is out.

Sources: Anthropic

Google DeepMind: Private AI Compute gains persistent server-side memory, with the keys held on the user's devices (September 23)

Until now Private AI Compute, like comparable industry solutions, was strictly stateless — it wiped all context the moment a task ended. This update adds a persistent memory layer: data is sealed in dedicated encrypted storage while the cryptographic keys needed to unlock it are held exclusively on the user's personal devices. When a model needs access, an authenticated end-to-end encrypted channel connects the device to an isolated cloud environment, and that enclave temporarily decrypts the data in isolated memory, handles the request, saves new context and immediately re-encrypts. The architecture combines hardware-enforced secure enclaves, encrypted channels, and per-user databases shielded by device-derived keys. For security practitioners the verifiability measures are the notable part: Google is publishing a tamper-proof public record of its server software, so devices can verify the software is authentic and unaltered before sending any personal data, alongside an independent audit by a cybersecurity firm and an updated technical brief.

Sources: Google DeepMind

Google: Gemini 3.8 text-to-speech replicates a voice from a 30-second sample (September 23)

Two models ship: Gemini 3.8 Flash TTS, built for voice design from scratch through natural language prompting across more than 100 languages and dialects with access to 2,000-plus production-ready voices, and Flash-Lite TTS for high-volume, cost-efficient scale. The security-relevant capability is voice replication: a consistent vocal profile can be recreated from just a 30-second audio sample, and Google pairs it with three controls — built-in consent verification, SynthID watermarking, and C2PA credentials. The library goes from 30 preset voices to an effectively unbounded one, which is also a statement about the supply side of synthetic speech.

Sources: Google DeepMind

Anthropic and OpenAI shipped models the same day, and both say the models still attempt restricted actions in safety tests

Both companies announced new models on September 22 and both noted continuing investment in alignment. Anthropic describes Opus 5.5 as a "major step up from Opus 5" that "achieves the best scores of any model to date" on its automated behavioral audit, the alignment suite that tests Claude across thousands of scenarios. Both accounts retain the point that the models still attempt restricted actions under test.

Sources: The Hacker News

OpenAI: the Daybreak program is extended to the Government of Ukraine for cyber defense of civilian infrastructure (September 23)

Sources: OpenAI

OpenAI: Sam Altman addresses the United Nations Security Council on AI safety, human control and international cooperation (September 23)

Sources: OpenAI

OpenAI: MentalHealthBench, an expert-informed benchmark for helpful and safe responses in realistic mental health conversations (September 23)

Sources: OpenAI