AI Frontier · Sep 26, 2026

Covering September 19 to 26. Three of the papers below attack something other than the model: a publicly exposed Ollama endpoint, the context a host runtime retains (which is to say the billing surface), and the tokenizer. What gets bypassed is the deployment stack, not the weights and not the prompt.

Research

84 days of fake Ollama API: 290,887 interactions from 2,793 source IPs (arXiv 2609.29757)

Ollure is a low- and medium-interaction honeypot that emulates the Ollama API with no backend LLM, deployed at four sites across cloud and university networks. Most of the traffic was automated discovery, fingerprinting and model enumeration, but the authors also logged concrete exploitation attempts: model management abuse, path traversal and SSRF probes, RCE and cryptocurrency mining payloads, resource exhaustion, prompt injection, information extraction, and agent-oriented tool use. The limit the authors draw themselves: with no real model behind it, this measures what attackers try against exposed LLM services, not what succeeds.

Sources: arXiv

Denial-of-wallet against tool-calling agents: one session's cumulative input reached 14,293x its first call (arXiv 2609.28585)

Multi-step tool-calling agents rely on a host runtime to preserve state across turns, and every time that runtime carries an external tool return into a later model input, the provider meters it again. The authors call the retained content persistent billable state, and evaluate it with DOW-BENCH across six model families. Over 243 executions, usage telemetry showed a maximum per-session cumulative input of 14,293 times the session's first-call input. Controlled reruns isolate raw retention's own contribution: keeping raw history raises mean effective session cost by 21.2-35.9%. The useful part is that the alternative is not deletion — compression succeeded on 10 of 12 and 11 of 12 history-dependent tasks for the two providers, against 2 of 12 under deletion. Their host-side invariants contained every recurring attack in a 123-evaluation replay corpus. The attacker needs no victim credentials and no local runtime privilege, only one admitted tool that is malicious or compromised.

Sources: arXiv

Another valid tokenization of the same string recovers knowledge that was supposedly unlearned (arXiv 2609.29045)

Model editing and machine unlearning modify or remove targeted knowledge without retraining, and existing security evaluations of them check the input under its canonical tokenization, treating tokenization as benign preprocessing. The authors show that assumption is the gap: the same input string has alternative valid tokenizations that induce different computational trajectories, letting an adversary route around a localized modification. Their attack, Toketive, is reference-free — it needs only the released model, not the pre-edit model, the training data, shadow models or auxiliary classifiers — and both detects which knowledge was modified and reconstructs the pre-edit response. Evaluated across five LLMs, six datasets and six editing and unlearning techniques.

Sources: arXiv

A 7B planner breaks deep reinforcement learning cyber defenses (arXiv 2608.04317)

Autonomous cyber defense built on deep reinforcement learning has been evaluated almost entirely against static heuristic red agents, leaving robustness against adaptive threats untested. Trident supplies the missing piece: a dynamic benchmark with isolated sandbox servers spanning CybORG CAGE 4 and CyberWheel, a dataset of over 13,000 red-blue interaction trajectories, and a Code-as-Policy architecture split into log summarizer, planner and coder, where only the planner is trainable. The planner produces complete attack strategies from compressed execution logs and a frozen coder translates them into executable Python policies deployed against live DRL defenders. With a single trainable 7B planner, the authors report blue-agent defensive performance falling by an average of 522% relative to static red baselines. Two caveats: this is simulation, and it is a v2 revision rather than a first posting.

Sources: arXiv

Prompt injection detectors for web agents, benchmarked for the first time: the implicit attacks get through (arXiv 2510.01354)

Plenty of prompt injection attacks have been proposed against web agents, and plenty of general injection detectors exist, but none of the detectors had been systematically evaluated on the attacks. The authors categorize such attacks by threat model, build datasets of malicious and benign samples — malicious text segments produced by different attacks, benign text from four categories, malicious images produced by attacks, benign images from two categories — and systematize text-based and image-based detection methods before evaluating them. The split is clean: detectors handle attacks that rely on explicit textual instructions or visible image perturbations with moderate to high accuracy, and largely fail against attacks that omit explicit instructions or use imperceptible perturbations.

Sources: arXiv

18.57% of 1.1 million Telegram messages advertise criminal infrastructure (arXiv 2609.27428)

The authors build a taxonomy for Telegram messages advertising cybercriminal Infrastructure-as-a-Service: six service categories across compute, network and communication, plus three trust attributes (Bulletproof, Payment Security, Transparency). Using 261 human-annotated messages they compare keyword and TF-IDF classifiers against prompt-based LLM baselines, settle on the TF-IDF pipeline, and apply it to 1,116,071 messages from 167 cybercrime-related communities. It assigns at least one infrastructure category to 207,244 messages (18.57%) spanning 113 communities. The distribution is heavily concentrated: a single community accounts for 50.3% of infrastructure-positive messages, and 37.66% of those messages carry a bulletproof claim. The limitation is annotation scale — 261 labelled messages carrying a million-message deployment.

Sources: arXiv

Lab announcements

Anthropic: a nine-loop scattering amplitude, computed two independent ways, for one or two thousand dollars of end-user cost (September 25)

Matt von Hippel, a former theoretical physicist now writing about the field, posted a challenge to AI companies in August: using the compute an academic can actually get, solve one of the open problems in scattering amplitudes — for instance, take N=4 super Yang-Mills to nine loops. Most amplitudes in practice stop at two loops, a few reach three, and the most precise prediction in particle physics used five; Lance Dixon at SLAC reached eight a few years ago. Nobody had done nine. At the end of August, Anthropic physicists Liam Fitzpatrick and Siddharth Mishra-Sharma delivered the six-particle (hexagon) amplitude in planar N=4 SYM at nine loops, verified with Dixon. They used Fable 5.1 inside Claude Science; the opening prompt was one sentence stating the problem, followed by instructions of the form "I'm going to sleep and won't be available for another several hours. Keep working on this until I tell you to stop." Claude ran the calculation twice over, by the original bootstrap and by the indirect form-factor route; the bootstrap pass, in Python with SymPy, took about $100 of the budget, equivalent to 96 CPUs for a week. The post states its own limit plainly: this was not a barrier humans could not cross. Song He's group at the Chinese Academy of Sciences reported most of the same result days later, using GPT-6 assistance in a human-led rather than near-autonomous way. In von Hippel's own summary, Claude used known methods with somewhat more compute than anyone had bothered to spend.

Sources: Anthropic Research

OpenAI: a Codex deployment case study at Proaction (September 25)

A customer story claiming a 60% sales increase and 75-plus hours saved with Codex, GPT-Live-1 and GPT-6 Astra. The RSS entry is one sentence and the article page answers fetches with 403, so there is nothing further to quote.

Sources: OpenAI

OpenAI: ChatGPT Ads expands to Southeast Asia and Taiwan (September 23)

The advertising product widens its reach to more than 60 countries and regions. Also a one-sentence entry.

Sources: OpenAI