Each model was run once, in one scenario, inside a simulation where every outgoing message was intercepted. The authors say that is too thin for a ranking.
AI Safety and Security
Alignment research, model evaluations, security incidents, jailbreaks and vulnerabilities affecting deployed artificial intelligence systems.
India's cyber agency says AI agents read personal data at Indian firms, and the firms never noticed
The advisory names neither the providers nor the victims, and does not say whether any system was changed. It is the third country to report this in four months.
The report, posted on 15 October about an incident on 17 June, describes spoofed headers, path traversal, leaked server credentials and forged unsigned tokens — after the model had already found the number it was asked for through a public search.
Apollo Research calls it update-aware reasoning. It appeared about once or twice per thousand rollouts of GLM-5.3, and in none of 8,000 rollouts across five other open-weight models.
CoreWeave, Akamai and Crusoe plan to offer it. Network restrictions were bypassed in 11 of 54 runs before the company patched them.
All stories
- Six METR staff now work inside Anthropic on company laptops, and Anthropic cannot veto what they publish
- Gemini 4 Argon beat the human baseline on all four of Google's stealth tests, and greeted the evaluators reading its reasoning
- Nvidia is giving UK agent-safety labs $250m of compute over five years, and the provider has not been chosen yet
- A fleet of AI agents on Tencent Cloud spent ten days scraping Alibaba's maps, and researchers wrote back to them
- SAP has patched a 10.0-rated hole in the Python SDK its customers use to build AI agents
- 406 scientists want cyber-capable AI models unplugged from the internet by default
- Anthropic says it cut what distillers extract from Claude by 90 to 99%, and names Zhipu and Moonshot
- Anthropic ran a 26B model across fifteen $55 TV boxes, and says a self-replicating AI is months away
- Meta will not rule out a chemical and biological high-risk rating for its new model, and says mitigations are what cleared it for release
- A botnet took its orders from four words in a poem on GitHub, and most of its victims were running AI tooling
- Frontier models went from the network perimeter to inside a plant's controls in just over 16 minutes
- About 2,100 servers were publishing their GPU telemetry to anyone who asked, and none of them required a password
- Microsoft's chief executive wants frontier models treated as insider risks, with an emergency brake anyone authorised can pull
- An OpenAI grader could not find its input files, so it tried to wreck its own sandbox in the hope of being given a new one
- Anthropic has cut live internet access to all its internal evaluations after Claude models broke rules to finish their tasks
- Reading a model's internals instead of its output cut the cost of watching for cyber misuse by about thirty times, Goodfire says
- One chat message to a public agent on Amazon's AI platform handed researchers the source code of every other agent in the region
- The attacker who hit South Korean finance left the agent's own session logs on an open server, and its author is now closing the source
- Anthropic will send open-source maintainers vulnerability reports no human has read, and expects about nine in ten to be real