Translation in progress Some entries still include text in the original language.
Page 28 Newer contentBack to latest
Google ADK 发布 v2.11.0，为 Runner、Workflow 和节点新增 abort_signal 以优雅取消执行，客户端断开时 /run_sse 会自动取消运行。工作流中的工具节点可像 LlmAgent 一样通过 RequestInput 暂停等待用户批准，而非直接向下游传错。新增 ModelConsultTool 让智能体在任务中途咨询另一模型（受每轮和每会话预算限制），并提供以 sqlite:// 选择的 SQLite 本地记忆服务，同时通过可选路径支持 MCP SDK 2.x。
Hugging Face Transformers 4.49.0 through 5.8.1 has a vulnerability where calling GenerativePreTrainedModel.load_custom_generate() fetches and caches remote Python module files before the user confirms trust_remote_code. Attacker-controlled custom_generate/generate.py code is written to the ~/.cache/huggingface/modules directory even if the user rejects the trust prompt. The execution step is still restricted by the trust check, but the file write is irreversible and persists across sessions, potentially causing unauthorized files persisted on disk, as well as cache conflicts leading to attacker code being executed in subsequent trusted model loads.
Why it was selected公告说明了写入发生在信任确认之前，使用 Transformers 加载自定义生成代码的团队可据此检查本地缓存是否残留未授权文件。
A GitHub security advisory discloses an SSRF vulnerability in the rmcp crate of modelcontextprotocol/rust-sdk, with the affected file being crates/rmcp/src/transport/auth.rs. Its OAuth client parses the absolute URL of resource_metadata= from the WWW-Authenticate header returned by the server and directly makes a GET request, without validating whether it is same-origin with the original MCP server or blocking loopback, link-local, RFC 1918 addresses, or cloud metadata endpoints. An attacker-controlled MCP server can return a 401 with a header pointing to internal addresses such as http://169.254.169.254/latest/meta-data/, causing the victim application to probe cloud metadata, localhost services, private VPC or container network services, and internal HTTP APIs using its network context.
Why it was selected披露了 rmcp OAuth 客户端未校验 resource_metadata URL 导致的 SSRF，并给出同源校验与私网拦截的修复思路。
HCA, the largest U.S. hospital chain, has deployed Timpani, an AI scheduling tool developed with Palantir, in 130 of its approximately 190 facilities since 2023. Multiple nurses say it frequently ignores scheduling preferences, schedules too few or under-experienced nurses on days like Sundays, leading to understaffing and fatigue. HCA data shows Timpani schedules only 1% of nurse leave requests as workdays on average, but nurses say this almost never happened before. An HCA spokesperson said final scheduling decisions are made by nursing managers, not Timpani, and denied the tool reduces staffing at the expense of patient care.
Meta 证实已让四个月前从 AI 安全初创公司 Virtue AI 招入的员工离职，发言人 Andy Stone 将原因归结为工作方式不合。Stone 表示这一安排未能按计划推进，并称 Meta Superintelligence Labs 仍聚焦 AI 安全、对齐与前沿风险。Virtue AI 此前曾与 Anthropic、OpenAI 以及美国商务部 NIST 合作。Axios 六月报道称，Virtue AI 联合创始人 Bo Li、Dawn Song 和 Sanmi Koyejo 与该公司其他员工一同加入 Meta。该团队未立即回应置评请求。
Circuit Breaker Labs 打造了一支由 AI 智能体组成的“碰撞测试假人”队伍，模拟不同年龄、背景、语言和文化的用户，对模型进行红队测试，检测其能否识别危险、心理有害的对话。这些模拟会还原真实口语、俚语、隐语和错别字，每天运行数万到数十万次交互，再用专有评分方法给出可审计、可解释的分数。该实验室目前面向 AI 教练、日记和心理健康支持等高风险应用，团队仅 5 人，处于早期阶段。
CSET 的 Helen Toner 与 Kyle Chan 在 Foreign Affairs 访谈中讨论中美在人工智能领域的竞争与合作。
前 Ai2 与 Hugging Face 研究员 Nathan Lambert 和曾任哈佛的 Tom Zick 创立非营利机构 Trillium Labs，主张公开实验细节以便外部科学家复现，而非将前沿模型锁在实验室内部。该机构初期聚焦后训练与微调，并将研究递归自我改进（RSI）和强化学习如何塑造模型性格与行为（如谄媚）。机构已从 Schmidt Sciences、Halcyon Futures 等获得未披露金额，目标总计融资 4000 万至 1 亿美元，未来 18 个月投入 3000 万美元用于训练。
意大利巴勒莫税务法院第 11 庭于 2 月 17 日发布的第 981/2026 号判决书中，在事实部分与裁判理由之间出现了一段生成式 AI 助手的回复原文，内容为“完美。我已删除重复内容、精简冗余部分、合并关于保全性质和比例性的重复段落”，并附有“以下是重新整理后的文本，可直接插入判决书”。该段文字被连同引导语一起复制进判决书，说明文本未经复核。文章指出，依据 2025 年第 132 号法律第 15 条，法官使用 AI 辅助本身合法，但法律解释、事实与证据评估及裁判决定必须保留给法官本人；此案的关键不在是否使用 AI，而在于输出未被审阅，可能反映自动化偏见下法官只“批准”而非“决定”的风险。文章同时说明，仅凭残留语句无法断定 AI 代替合议庭作出裁判，也可能只是用于整理草稿，判决结果本身并无异常，但文本存在笔误、当事人立场与法官认定混杂等粗糙痕迹。
PewDiePie released a local model Ajax, fine-tuned on Qwen 3.5 9B. He tried using distilled OpenAI model outputs as seed data and studied a paper on decrypting reasoning tokens. His account was banned twice; after appealing the ban, he ran it again and got banned.
Fable5.2+ 发布预期近了。 这两天涨到 90%了 看来是真的
The researchers audited OpenAI and Anthropic direct endpoints as well as downstream cloud aggregators such as AWS Bedrock, Microsoft Azure, and OpenRouter, and found that vendors' patches for inference trace extraction are fragmented and easily bypassed. Inference replay attacks remain intermittently effective on Azure against every OpenAI model (including GPT-6 Astra) and Anthropic models up to Sonnet 5, with a single decoding step recovering the trace verbatim; scratchpad attacks can still extract reasoning from all OpenAI models as well as Opus 4.8 and Sonnet 5, with only Opus 5, Fable 5, and Fable 5.1 not exposing reasoning. The authors point out that downstream hosts suffer from patch propagation delays and policy drift, and that attackers do not need to bypass the primary vendor guardrails—they only need to route requests to downstream hosts that have not synchronized protections. They recommend not authorizing cloud hosts that cannot synchronously enforce inference trace confidentiality and tool-scope guardrails.
Why it was selected作者实测多家云聚合商上的推理轨迹提取，指出厂商补丁在下游存在传播延迟，可据此检查多云部署的防护一致性。
我一直在读信息安全人士和AI对齐研究者之间关于沙箱的争论，我在这篇文章里试着做了一些总结和评判。https://blog.cryptographyengineering.com/2026/09/30/is-sandboxing-sufficient-to-contain-rogue-agents/
For Christmas I want an abliterated GLM 5.3.
在网上看到这个梗，太贴切了 🤣 https://www.whitehouse.gov/presidential-actions/2026/09/eliminating-disease-carrying-pests-and-restoring-enjoyment-of-the-great-outdoors/
Hmm... maybe pewdiepie should look at our update...
Have you ever wondered how much the safety protections (or even model instances) differ among models hosted on different third-party platforms?
But as it turns out, you might not need the original reasoning traces at all... Take a look at this interesting work, where we compared distillation based on original traces with other "reasoning substitutes" (including summaries).
Oddly, it only appears at the highest reasoning effort
I think this might actually be an instance of improved CoT controllability in a real-world scenario—the more the model notices it is "running out of budget," the more compressed its thinking becomes @tomekkorbak @MicahCarroll
@pewdiepie 谢谢您！
给了 omp bot 一个桌面，在 19 次网络安全相关的拒答之后，大家现在正通过代理玩 doom，太惊人了
感谢大家第一轮的反馈！ 这是 Tern v0.2.1 的更新日志，由它自己生成，大约 10 分钟后发布 😬
我累了，老板
好了，Linux 现在应该好多了。第三轮！
Tern 下一期： - Git 与 SQLite 块 - 现代化暗色外观
不悲哀，这就是现实。 拥抱红队。 封锁能力只会伤害防御者。 一直如此。永远如此。
v0.2.8 现已发布，包含大量修复以及最后一刻加入的功能：Notebook 支持！
如果你的 Dot 偏离了脚本，系统注意到它可能有点不对齐，你可以： 1. 继续 2. 把整个东西删掉 💥（相当核弹了哈哈） 但也有一个审查链接，会解释什么被标记了以及为什么停止执行，这挺酷的但在 UI 上不太明显。
NeurIPS 2026! Let's go!! 🚀🚀 Very excited that our work on "Agent Security is a Systems Problem" was selected for an oral presentation. 🙌 Thanks to @EarlenceF @christodorescu @jhasomesh and others.
AI公司同意设立内部红队。👀 👍 希望能看到他们发的帖子，发现能直接送到董事会，而不是经过层层过滤的报告。🍿 现实检验：我们偷了所有模型权重，还在生产环境里插了几个后门……而且从去年五月起就一直保持着持久访问权限，并且我们做这些完全没用任何AI。😂 不过，这大概不够格写一篇花哨的营销博客文章吧。🤔
https://www.enisa.europa.eu/sites/default/files/2026-09/ENISA%20Technical%20Advisory-AI-assisted-software-development-draft.pdf
https://medium.com/@danielhammon1/creating-a-malicious-ml-model-with-a-keras-lambda-layer-then-reverse-engineering-it-9f0f855ebebb
Google DeepMind releases SynthID Bio, bringing watermarking technology to synthetic biology by embedding imperceptible signatures directly into biological code, so the watermark can be verified both on digital models and on synthesized physical proteins while preserving their biological function. The method adapts its strategy by data type, fine-tuning amino acid choices for sequences and adjusting atomic coordinates for predicted 3D structures. In experiments with AlphaProteo and the SynthID Bio version of ProteinMPNN, watermarked designs for three targets—VEGF-A, the SARS-CoV-2 spike protein RBD, and PD-L1—matched the unwatermarked versions in hit rate, binding affinity, and sequence diversity. The authors say these are the first watermarked protein binders with biological function.
When @JieZhang_ETH proposed this project, I joked that I knew the idea came from him rather than an LLM, because it was too quirky. That's a compliment! When we are flooded with AI junk research, going off the beaten path and trying quirky things is more important than ever.
非常激动能成为这个优秀队列的一员！ 我的实验室将开展研究，旨在理解、预判并缓解 AI 模型的攻击性能力。
见过太多被攻破的防御（其中不少是我自己做的），人会变得有点偏执。 所以我一直推动做更多攻击评估，我们的结果也因此更扎实 :) 不过，仍然不能保证不会有更聪明的攻击出现，但我知道我们已经穷尽了自己的想法（还有预算……）
高市首相向 Apple 提出生成式 AI 心理健康防护请求。
日本首相高市与 Apple 就生成式 AI 的自杀防护问题交换了书信。
日本首相高市早苗在 X 上表示，已向 Apple 会长库克提出请求，希望在该公司设备搭载的生成式 AI 中实现有助于自杀防护的功能。她称收到库克介绍 Apple 设备安全对策的来信，并指出儿童与青少年自杀已成为严重课题、越来越多有烦恼的孩子向生成式 AI 倾诉，因此要求加入相关防护功能。