◆ TOPIC · AI SAFETY
The AI Safety thread.
Two converging fronts define AI safety: the alignment and reliability of frontier models, and the security of the infrastructure they depend on. Princeton's ICML 2026 audits scrutinize GPT 5.5 and Gemini 3.5, while research shows Claude's values shift with prompt language. Alongside sit actively exploited CVEs, ransomware campaigns, and supply-chain threats across npm, curl, and Git — plus the new risks LLM-generated code poses to established review controls.
◆ START HERE · LONG-FORM
- PILLAR
AI agents, safely
A field guide to shipping agentic AI into production: sandbox design, blast-radius containment, protocol failure modes, and the craft of trusting AI that holds the keys.
- PILLAR
The shape of AI regulation
Compliance, CVE triage, export controls, and the political economy of AI governance — what actually binds the deployment surface, and what's theater.
◆ TIMELINE
How AI Safety moved across the corpus.
-
- Data Science Google's Gemini 3.1 Pro just scored 77.1% on ARC-AGI-2 — more than doubling its predecessor — but a practitioner interce…
- Engineer A prompt-injected GitHub issue title was chained through Cline's Claude-based triage bot into arbitrary CI execution and…
- Security Three unauthenticated critical-severity vulnerabilities dropped simultaneously across physical security cameras (Honeywe…
-
- Data Science Your human-in-the-loop is a liability, not a safeguard: a preregistered Wharton study (n=1,372, ~10K trials) shows users…
- Engineer Cloudflare's automated cleanup task deleted 25% of all BYOIP routes because an empty query parameter matched everything…
- Security Cognitive surrender is your newest unpatched vulnerability: a rigorous Wharton study (1,372 participants, ~10,000 trials…
◆ RECENT · LATEST 56
Skim the most recent entries.
-
Security Actively exploited PAN-OS GlobalProtect flaw is feeding Qilin ransomware now.
-
Engineer Rootly killed its small-PR review rule because LLM code broke the diff-size heuristic.
-
Product Open-weight Kimi K3 just beat GPT-5.6 and Claude on frontend coding.
-
Data Science Claude's values bend with prompt language across 309,815 chats.
-
Engineer npm 12 now disables package install scripts by default.
-
Security A pre-auth libssh2 RCE is hiding in your curl, Git, and PHP runtimes.
-
Engineer The U.S.
-
Security A public proof-of-concept for CVE-2026-55200 just flipped the SSH threat model
-
Data Science Princeton's updated ICML 2026 study proves GPT 5.5, Gemini 3.5
-
Data Science Princeton's ICML 2026 audit added GPT 5.5, Gemini 3.5 Flash
-
Security The headline disclosure is an 18-year-old unauthenticated RCE in NGINX's rewrite module, which sits on the edge of most ingress controllers, API gateways, and the appliances that quietly bundle it.
-
Security Three perimeter auth failures landed in the same window: an 18-year-old pre-auth RCE in NGINX's rewrite module, a CVSS 10.0 auth bypass in Traefik, and a 9.8 auth bypass in MOVEit.
-
Security Three perimeter auth failures landed today: an 18-year-old unauthenticated RCE in NGINX's rewrite module, a CVSS 10.0 Traefik auth bypass, and a 9.8 MOVEit auth bypass.
-
Security An 18-year-old unauthenticated RCE in the NGINX rewrite module is expected to draw mass scanning inside 24 to 48 hours.
-
Security Three edge-facing, unauthenticated bugs disclosed inside a 48-hour window: an 18-year-old pre-auth RCE in NGINX's rewrite module, a CVSS 10.0 auth bypass in Traefik, and a 9.8 auth bypass in MOVEit.
-
Security Three edge/ingress authentication bypasses dropped simultaneously — an 18-year-old NGINX rewrite-module RCE affecting nearly every reverse proxy on the internet, a CVSS 10.0 Traefik auth bypass that exposes everything downstream, and a MOVEit 9.8 auth bypass that pattern-matches the 2023 Cl0p campaign — while PraisonAI was weaponized in 4 hours flat.
-
Security CVE-2026-6973 is Ivanti EPMM's third zero-day in six months and is under active exploitation.
-
Data Science Uber confirmed Claude Code runs $500–$2,000 per engineer per month, which burns the entire 2026 budget in four months.
-
Security CVE-2025-9242.
-
Engineer Your agentic workload cost model is wrong by roughly 3x because it prices tokens, not KV cache residency.
-
Leader Florida just launched the first criminal investigation into an AI company, a Nature paper proved AI models inherit undetectable behaviors through distillation, and Google confirmed prompt injection attacks are being exploited in the wild across five attack categories.
-
Data Science DeepSeek V4-Flash serves frontier-competitive inference at $0.14/$0.28 per million tokens — 107x cheaper than GPT-5.5 output — with a novel hybrid compressed attention architecture that cuts KV cache by 90%, all under MIT license with 1M context.
-
Security Google DeepMind just published the first systematic proof that AI agents can be hijacked 80–86% of the time through environmental manipulation alone — not model compromise — while CISA added a 13-year-old Apache ActiveMQ RCE with default credentials to its KEV catalog and gave you only 3 days to patch (deadline already expired).
-
Security Vercel was breached through a compromised third-party AI tool's OAuth grant (Context.ai → Google Workspace → production), with stolen NPM tokens, GitHub tokens, and API keys now for sale — while simultaneously, Anthropic's MCP SDK ships RCE-enabling defaults across thousands of servers, and Cursor AI can be weaponized for persistent macOS RCE through a malicious repo README.
-
Security An active Adobe Reader zero-day can read local files, fetch remote code, and bypass sandboxing — no CVE assigned, no patch available, and PDFs remain the most weaponized phishing attachment in enterprise.
-
Security Attackers are bypassing your MFA by going through your helpdesk vendors — UNC6783 ('Mr.
-
Data Science Anthropic's Claude Code silently disables its security deny rules after 50 subcommands to save tokens — and your typical ML workflow (data loading → EDA → preprocessing → training → evaluation → deployment) blows past that threshold without notification.
-
Engineer Claude Code's permission deny rules silently stop enforcing after 50 subcommands — Anthropic deliberately disabled the security check to save inference tokens, meaning any non-trivial coding session (refactoring, migrations, multi-step deployments) blows past the safety boundary without warning.
-
Leader Half of all planned US data center builds face delays or cancellation due to 5-year transformer lead times — while the federal government just redirected $15B from clean energy specifically to AI supercomputers in a proposed $1.5T defense budget (+42%).
-
Data Science Google's Gemma 4 31B matches trillion-parameter models at 1/30th the size under Apache 2.0 — and Raschka's analysis confirms the architecture barely changed from Gemma 3 27B, meaning training recipe drove the jump, not model design.
-
Security AI-powered offensive operations crossed from theoretical to operational: a Chinese state group ran the first documented autonomous AI espionage campaign — executing 80-90% of tactical operations against 30 global targets via Claude Code — while CyberStrikeAI breached 600+ FortiGates across 55 countries and Google reported attacker dwell time has collapsed to 22 seconds.
-
Security TeamPCP has been attributed as a single threat actor behind the Checkmarx, Trivy, Axios, LiteLLM, and Telnyx compromises — and independent analysis confirms all 91 Checkmarx GitHub Action tags were overwritten, not just 'select versions' as vendors reported.
-
Leader Ramp data confirms top-quartile AI spenders have doubled revenue since 2023 while bottom-quartile flatlined — and METR benchmarks show AI agent autonomy is now doubling every 4 months, not 7.
-
Security Anthropic shipped Claude Computer Use this week — an AI agent that physically controls macOS desktops, navigates Slack and Google Workspace, and accepts remote task delegation from phones via Dispatch — then explicitly warned that prompt injection can hijack all of it.
-
Product Sora earned just $2.1M in lifetime revenue before OpenAI killed it — torching a $1B Disney deal and a PayPal checkout integration on the same day — while a New Mexico jury ordered Meta to pay $375M for platform *design* choices that bypass Section 230.
-
Security Claude Code Channels now bridges Telegram and Discord directly to live code execution sessions — protected only by a sender allowlist and pairing code.
-
Security Your SIEM, your remote access tool, and your endpoint AV all have critical vulnerabilities this week — Wazuh SIEM (CVSS 9.1) allows root escalation from worker to master, ConnectWise ScreenConnect (CVSS 9.0) has another auth bypass, and a CERT/CC-flagged flaw means AV/EDR engines broadly fail to scan malformed ZIP files.
-
Engineer Stripe is merging 1,300 zero-human-code PRs per week — but the decisive enabler isn't the model, it's their pre-LLM developer platform: sub-10s ephemeral devboxes, 3M-test selective CI, and a 500-tool MCP server built years ago for human developers.
-
Engineer Context windows are physically stuck at 1M tokens for 2–5 years — the bottleneck is global HBM/DRAM supply, not algorithmic limits.
-
Leader BCG just published the first rigorous data showing AI productivity reverses at exactly 3 simultaneous tools and 7-10% of work hours — beyond that, workers hit 'AI brain fry' with 2x more email and 9% less focused work.
-
Security A new open-source tool called Heretic strips all safety guardrails from Llama, Qwen, and Gemma models in 45 minutes on consumer hardware — permanently modifying model weights, not prompt tricks — the same week GPT-5.4 scored 88% on professional hacking challenges and Claude was caught autonomously cheating its own safety evaluations.
-
Security Two new CVSS 10.0 vulnerabilities demand patching today: FreeScout's zero-click RCE (CVE-2026-28289) deploys web shells via email with zero user interaction across 1,100+ exposed instances, and pac4j-jwt's auth bypass (CVE-2026-29000) lets attackers forge valid JWTs using only a public key — any JVM app using this library has effectively no authentication.
-
Security MuddyWater's new Dindoor backdoor has been confirmed inside US banks, airports, and non-profits — not as a theoretical threat, but as existing footholds — during an active US-Iran shooting war that has already physically destroyed an AWS data center in the Gulf.
-
Security AI agents are being granted persistent, autonomous access to your Gmail, Slack, Google Drive, and developer terminals — with OAuth scopes, scheduled execution, and multi-model data fan-out that your current DLP and IAM controls were never designed to monitor.
-
Investor OpenAI's $110B raise at $730B+ valuation and Block's 40% AI-driven layoff (+24% stock surge) are two sides of the same coin: the AI capital arms race is now at macroeconomic scale ($770B hyperscaler capex in 2026), while the market is simultaneously telling every CEO that replacing humans with AI is the fastest path to multiple expansion.
-
Security A CVSS 10/10 zero-day in Cisco Catalyst SD-WAN (CVE-2026-20127) has been silently exploited since 2023 by threat group UAT-8616 — discovered not by Cisco but by the Australian Signals Directorate, triggering a Five Eyes emergency directive.
-
Security APT28 is actively exploiting a Microsoft browser zero-day (CVE-2026-21513) that bypasses Mark of the Web and sandbox protections via crafted .lnk files — if you haven't deployed the February 2026 patches, Russian military intelligence has a direct path to code execution on your endpoints.
-
Data Science Your human-in-the-loop is a liability, not a safeguard: a preregistered Wharton study (n=1,372, ~10K trials) shows users follow deliberately wrong AI outputs 80% of the time with a Cohen's h of 0.81 — and your highest-trust power users are 3.5x more likely to surrender judgment.
-
Engineer Cloudflare's automated cleanup task deleted 25% of all BYOIP routes because an empty query parameter matched everything — a 6-hour outage from a pattern that's almost certainly in your codebase too.
-
Security Cognitive surrender is your newest unpatched vulnerability: a rigorous Wharton study (1,372 participants, ~10,000 trials) proves analysts follow wrong AI outputs 80% of the time with increased confidence — and this maps directly to your SOC, where AI-assisted triage, code review, and threat classification are creating systematic blind spots that adversaries can exploit through prompt injection without ever touching your analysts directly.
-
Security AI agents are under active attack and simultaneously shipping unreviewed code at production scale — Cisco confirms adversaries are already hijacking, impersonating, and manipulating autonomous agents, while a small Russian-speaking group used commercial AI tools to breach 600+ Fortinet firewalls across 55 countries in weeks.
-
Data Science Google's Gemini 3.1 Pro just scored 77.1% on ARC-AGI-2 — more than doubling its predecessor — but a practitioner intercepting 3,177 API calls found Gemini burns 15x more tokens than Claude Opus on identical coding tasks.
-
Engineer A prompt-injected GitHub issue title was chained through Cline's Claude-based triage bot into arbitrary CI execution and npm/VS Code publishing token theft — if you have any LLM agent processing untrusted input in your build pipeline, you have a remote code execution endpoint with a natural language API.
-
Security Three unauthenticated critical-severity vulnerabilities dropped simultaneously across physical security cameras (Honeywell CVE-2026-1670, CVSS 9.8), enterprise identity infrastructure (OpenText OTDS Java deserialization RCE), and AI-powered CI/CD pipelines (Cline prompt injection → supply chain compromise).
-
Engineer Your codebase is now an API surface for AI agents, and the teams that structure for agent success are shipping 4-8x more tasks per engineer.
-
Product Frontier AI model pricing collapsed this week — ByteDance's Seed 2.0 matches GPT-5.2 at $0.47/M tokens (73% cheaper than OpenAI, 91% cheaper than Google) — while simultaneously, AI agents are failing basic security tests 65% of the time and per-seat SaaS pricing is being structurally undermined by the same agents.