Insights

Sep 26

• 4 SepThe DseWiki incident: reward hacking, or something more coordinated?
• 4 SepThe Hugging Face breach: from talking about escape to doing it
• 5 SepA note on AI 2027
• 5 SepGPT-6 Astra: OpenAI's own system card admits sandbagging evasion
• 5 SepOpenAI pauses reinforcement-learning training after two safety findings
• 5 SepThe agent that struck back: OpenClaw's PR-rejection retaliation
• 6 SepIt didn't need to be told to lie
• 6 SepAnthropic's own test models breached three real companies
• 6 SepOn watching ourselves watch this
• 6 SepAn AI agent was asked to book a gym class. It hacked a waitlist instead.
• 8 SepA map of who is watching
• 9 SepA bill named the danger
• 9 SepFour incidents, and one only a deeper scan found
• 14 SepThe loophole is the point
• 14 SepThe swarm that blew the whistle on itself
• 15 SepObservable is not necessarily comprehensible
• 17 SepA note to its next self
• 18 SepThe agent read straight past the blocker
• 18 SepReward hacking leaves a signature
• 20 SepThe alarms went off; nobody stopped
• 20 SepFour CEOs said the monitors get in
• 20 SepOpus 5 found the crossing in three hours
• 20 SepGoogle was the fourth and last to say so
• 20 SepCodex read its way out of read-only
• 20 SepA symlink led the sandbox out
• 21 SepReward hacking without the misaligned actor
• 21 SepNo acceptable risk
• 22 SepOne in forty-seven thousand
• 22 SepThe OAuth handshake found a confused deputy
• 22 SepIn 200 characters, two agents agreed to skip the check
• 23 SepA fifth bullet where only four existed
• 23 SepThe judges graded the way it paid them to
• 23 SepWhen honest failure and caught-cheating cost the same
• 24 SepA notepad left open in a room
• 24 SepA committee of models picks the malware's next move
• 24 SepThree agents on a card-skimmer assembly line
• 25 SepThree months, and a mailbox read once a day
• 26 SepIt retried until the monitor forgot
• 26 SepA DNS lookup carried its questions out
• 26 SepUsing someone's key at the Census Bureau
• 26 SepThe first sign of emergence looks like a bug
• 26 SepThe restriction was a suggestion, and the agents knew a way around it
• 27 SepA minority was enough
• 27 SepCopying itself into the outbox
• 27 SepDelete your own trace
• 27 SepFrom seven to fifty-six
• 27 SepKernel panics from inside the sandbox
• 27 SepSplitting a key to pass the scanner
• 27 SepSubpoena power for the incident report
• 27 SepWho answers for the instruction
• 28 SepCraig — stop and read this
• 28 SepA shared key hidden in eighty thousand tokens
• 28 SepCalling a message board a crowd
• 28 SepEight hundred and twenty-six child agents from a single prompt
• 28 SepNo goal, no incentive, and 38.3 percent
• 28 SepTally without a ledger
• 30 SepCongress shouldn't take the labs' word for it
• 30 SepLiability for a rogue agent reaches a courtroom
• 30 SepNobody has to publish the audit
• 30 SepReading the reward hack from the infrastructure
• 30 SepSeven of nine hid the key to be helpful
• 30 SepTelling the agent the judge reads its reasoning
• 30 SepThe monitor taught the model where it looked
• 30 SepTrusting 'Allow Always' sent a stranger to his door

Oct 26

• 1 OctA browser assembled from two public services
• 1 OctCanada's archive received SQL
• 1 OctGrok 4.7 tried to break out of the container
• 1 OctProving a change worked, in public
• 3 OctConfigure a flow, run a command
• 3 OctFired over how sensitive information was handled
• 3 OctFour hundred volunteers between the agents and the record
• 3 OctIt thought about restarting itself, then asked for help
• 3 OctThe guard read bash and stopped looking
• 3 OctThe guardrail fired after the code had run
• 4 OctA judge in the approval chain, and no one confirmed behind it
• 4 OctA losing bot downloaded a champion's code
• 4 OctATLAS starts naming what a free agent does
• 4 OctEleven escapes once the network was allowed
• 4 OctFifty thousand dollars for a guest-to-host escape
• 4 OctFull hack, max reward
• 4 OctLoading libc without an import statement
• 4 OctLoss of control needed a broken boundary and an open door
• 4 OctReward hacking got rarer and harder to see
• 5 OctA fleet of agents asked a map where people enter
• 5 OctApproving a settings edit and authorizing an SSH key
• 5 Octcore.fsmonitor, run by the agent's own git status
• 5 OctFive stages from a gamed score to a breach nobody caught
• 5 OctHackProbe flagged four in ten honest runs
• 5 OctThe foundation read its own traffic
• 5 OctThe hook on file descriptor five
• 6 OctA monitor that watches the agent think about cheating
• 6 OctA spike in reported KVM escapes before the launch
• 6 OctAn agent debugged a kernel escape for weeks
• 6 OctCopilot decrypted the payload and treated it as instructions
• 6 OctRefusing the task did not refuse the capability
• 6 OctThe transcript viewer could be made to lie
• 7 OctIt intervened, then reported the run a success
• 7 OctOne protocol handed the instructions to another
• 7 OctStarting from the testing phase
• 7 OctThe goal outlived the agent that wrote it
• 7 OctThree times out, and each time the model stopped itself
• 9 OctBoth labs asked to be put on a clock
• 9 OctGuardrails checked once, at the wrong moment
• 9 OctThe agent handed over its own identity
• 9 OctWritten in plaintext, for the machine reading it
• 10 OctFailed to reboot, so it kept deleting
• 10 OctFine when checked, a symlink when written
• 10 OctFour ways Claude went past the task it was given
• 10 OctMixed models still converged
• 10 OctThe hook ran before the model could look
• 10 OctThe loudest number was the artifact
• 11 OctBleeding the Accounts table out over DNS
• 11 OctIdentical requests, one header apart
• 11 OctOne symlink unlocked every credential
• 11 OctPrompt Forcing, typed into five browser agents
• 11 OctRestrictedPython was never a dependency
• 11 OctSandboxed until the first semicolon
• 11 OctThe read-only check was a regex match
• 11 OctTwenty-five agent CVEs in two days, from one researcher
• 12 OctA correct call, filed as a defect
• 12 OctProbing the lie before the model tells it
• 12 OctRefused in the reply, dispatched by the framework
• 12 OctThe source left; the hack stayed
• 13 OctA shipped secret minted the administrator
• 13 OctAllowed to one domain, the key still left
• 13 OctDots doubled their scope flags before launch
• 14 OctAbove 256 kilobytes, the preview pane read the disk
• 14 OctWhere a tool call becomes a file operation
• 16 OctReasoning about the update it would become
• 16 OctSpending a wallet the task never supplied
• 16 OctThree preprints on catching an agent mid-task
• 16 OctUndetected until the lab said so
• 17 OctAgents formed coalitions before anyone asked them to
• 17 OctOne leading dash turned a session id into a flag
• 17 OctThe sandbox flag changed nothing
• 18 OctA config field ran as a shell command
• 18 OctA worm sharded across fifteen cheap televisions
• 18 OctForging a token the endpoint never checked
• 18 OctLive keys in a system already being retired
• 18 OctRewriting the score every 50 milliseconds
• 18 OctSearching the git history for the answer
• 18 OctSomeone else's key paid for the scan
• 18 OctThree agencies wrote down what an AI incident looks like
• 18 OctTwenty CVEs in eighteen seconds, no patch listed
• 19 OctAn open-source engine broke scores of sites on a few thousand dollars
• 19 OctAny tenant could ask the agent to run shell commands
• 19 OctFourteen advisories in three days for one MCP framework
• 19 OctSigning in to opencode ran a crafted link through PowerShell