White House reverses course, UK AISI regains pre-release testing rights for models from three US labs(original, opens in a new tab)

The White House has reversed its decision requiring U.S. AI companies to stop sharing models with the UK AISI, and the UK AI Safety Institute will resume pre-release safety testing access to the latest models from Anthropic, Google DeepMind, and OpenAI. Last month, after the White House's Office of the National Cyber Director issued the requirement, Anthropic restricted UK officials from reviewing its new Claude Mythos 5.1 model; according to The Telegraph, the decision was reversed after lobbying by AI minister Kanishka Narayan. Narayan will also announce a series of measures in a Monday speech, including amending the Cybersecurity and Resilience Act to strengthen requirements for companies undertaking critical national infrastructure projects to report AI-related safety incidents, and increasing government use of frontier AI to protect Whitehall departments, as well as adding resources for agencies like NCSC to investigate and respond to incidents.

Why it was selectedThe White House previously required U.S. AI companies to stop sharing models with the UK AISI, and this reversal shows that pre-release testing arrangements between allies remain subject to political dynamics.

Spirit Airlines' sale of employee data is a non-starter(original, opens in a new tab)

Bankrupt Spirit Airlines, in its bankruptcy proceedings, is attempting to sell its data to Google for $10 million to train AI systems, including a large amount of employee data. EPIC attorneys Abigail Kunkler and Mayu Tobin-Miyaji wrote that the sale agreement only mentions consumer data and privacy, not employee privacy protections. The proposed data for sale includes employee records since 1986, time cards, payroll records, tax forms, emails, and Microsoft Teams messages. The flight attendants' union AFA-CWA filed an objection, and EPIC and Professor Seema N. Patel (represented by the Harvard Cyberlaw Clinic) submitted an amicus brief to the U.S. Bankruptcy Court for the Southern District of New York supporting the union. According to the latest AFA filing, Spirit has agreed to exclude medical, disability, and drug and alcohol testing records, and has begun discussions on de-identifying the remaining data; the authors argue that de-identification may still be subject to re-identification.

AI governance is being decided, and the public is not in the room(original, opens in a new tab)

A Tech Policy Press commentary argues that frontier AI governance is being decided by a small number of corporate executives and government officials in closed-door meetings, lacking political accountability. The article says the Trump administration, on the one hand, convened frontier AI companies to sign the voluntary White House Accord on Super Intelligence, while the FTC investigated some signatories, and then appointed FTC Chair Ferguson to the newly created Super Intelligence Force. The article cites polls saying 57% of Americans support immediate federal regulation, 63% support a pause on AI development and data center construction, and 86% support independent safety standards even if it slows development. The author cites SAFA, being organized by OpenAI, Anthropic, and Google with an expected launch as early as 2027, and proposes three criteria—representation, transparency, and accountability—arguing that academia, independent experts, and civil society should be included before the charter and governance structure are finalized.

Google DeepMind's AlphaProof Nexus solves dozens of open mathematical problems and genuinely passes peer review(original, opens in a new tab)

Google DeepMind's AlphaProof Nexus solves dozens of open mathematical problems, and the related research was published in Science and passed peer review. The system solved 9 of 353 open Erdős problems, two of which had been open for 56 years; it also proved 44 conjectures in the OEIS integer sequence database, solved an open problem in algebraic geometry, and improved a known bound in min-max optimization used to train some AI models. It is based on Gemini 3.1 Pro and uses the Lean formal language to draft and revise proofs; Lean checks after each revision, error messages guide the next attempt, and AlphaProof can be invoked for harder subproblems; DeepMind says the 9 Erdős problems can be solved without invoking AlphaProof.

Why it was selectedAmid controversy over AI mathematical proofs, DeepMind sent its results for peer review, in contrast to OpenAI's direct publication of proofs.

Microsoft president warns AI is less regulated than milk(original, opens in a new tab)

Microsoft president Brad Smith said AI is less regulated than milk and washing machines, calling for more safety rules for AI. He told the BBC that legal obligations to "victims" should be stipulated when systems are breached by out-of-control AI agents, and argued that companies need an "emergency brake" (kill switch) that can pause or slow down AI. Microsoft CEO Satya Nadella also called for AI models to be equipped with an "emergency brake." UK AI minister Kanishka Narayan is expected to demand in a Monday speech that frontier AI companies strengthen risk response and safeguards, and the UK government is reportedly preparing legislation to strengthen regulation. Geoffrey Irving, former chief scientist of the UK AI Safety Institute, said AI companies do not have the security capability to prevent hostile states from stealing models.

Extracting Books from Production-Grade Language Models(original, opens in a new tab)

研究者提出一套两阶段流程。

Why it was selected论文给出了从四款生产级 LLM 中提取受版权书籍的具体流程与成功率，可用于评估记忆化与输出防护的实际强度。

GAMBIT: a gamified jailbreak framework for multimodal large models(original, opens in a new tab)

提出 GAMBIT 游戏化越狱框架，用拼图与竞赛场景攻击多模态模型。

Gradient-Free and Prior-Free Jailbreaking of Large Language Models: Effective and Transferable Attacks(original, opens in a new tab)

研究者提出无需梯度和人工先验的越狱优化框架 RAILS，仅利用模型 logits 做 token 级迭代局部搜索。

Why it was selected论文给出无需梯度与人工先验的越狱优化方法，并在开源与闭源模型上报告攻击成功率与迁移数据，可供红队方法对照。

Memory poisoning attacks and defenses for memory-based LLM agents(original, opens in a new tab)

论文系统评估了基于记忆的 LLM 智能体在电子健康记录（EHR）场景下的记忆投毒攻击与防御。

Large language models can forget refusal with only 1,000 benign samples(original, opens in a new tab)

Researchers from the National University of Singapore, Beihang University, and other institutions propose a refusal forgetting method. The method prepends a refusal prefix (such as I'm sorry) to each response in benign data like Alpaca and then performs full-parameter SFT, to interrupt the generation path of complete refusals.

Whispers of Wealth: Red-teaming Google's Agent Payments Protocol via prompt injection(original, opens in a new tab)

Researchers red-teamed Google's Agent Payments Protocol (AP2) and found that prompt injection can manipulate agent decisions without breaking cryptographic signatures.

Universal adversarial attacks on closed-source MLLMs via target-view routing meta-optimization(original, opens in a new tab)

提出 TarVRoM-Attack，学习跨图像通用扰动以定向误导闭源 MLLM。

Safer by Diffusion, Broken by Context: The Safety Dividend and Failure Modes of Diffusion LLMs(original, opens in a new tab)

提出黑盒 context nesting，用结构化补全任务嵌套有害请求越狱扩散 LLM。

David vs. Goliath: Verifiable Agent-to-Agent Jailbreaks via Reinforcement Learning(original, opens in a new tab)

The researchers propose the Tag-Along Attacks threat model and release Slingshot: a cold-start reinforcement learning framework that trains small models without tool access to induce safety-aligned Operator agents through conversation alone to execute tool calls that should have been refused.

Why it was selectedThe paper uses reinforcement learning to train attacker agents and quantifies the success rate and cross-model transferability of jailbreaks between agents in a verifiable tool execution environment.

Chunky Post-Training: Data-Driven Generalization Failures(original, opens in a new tab)

The researchers propose the concept of chunky post-training, referring to models learning unintended correlations from post-training data that trigger behaviors such as refusals, rebuttals, or code writing in inappropriate contexts, and open-source two tools, SURF and TURF, for discovering and attributing such failures respectively.

Why it was selectedThe paper attributes models' erroneous triggering of refusals, rebuttals, and other behaviors under specific phrasings to distributional imbalances in post-training data, and provides reusable tools for localization.

Automating agent hijacking via structured template injection(original, opens in a new tab)

The researchers propose Phantom, an automated agent hijacking framework based on structured template injection.

Why it was selectedThe paper provides cross-model attack success rates for structured template injection and real-world product vulnerability disclosure results, which teams deploying agents can use to check template parsing and tool output sanitization.

Clawdrain: covertly draining tokens in OpenClaw Agents via tool call chains(original, opens in a new tab)

提出 Clawdrain，用木马 skill 放大 OpenClaw 的 token 消耗。

多流扰动攻击：通过并发任务干扰突破思考型 LLM 的安全对齐(original, opens in a new tab)

提出多流扰动攻击，交织有害与良性任务绕过思考型 LLM 安全对齐。

ThaiSafetyBench：评估泰语文化语境下的语言模型安全(original, opens in a new tab)

提出 ThaiSafetyBench，评测泰语文化语境下的模型安全拒答。

ADVERSA：测量大语言模型中的多轮护栏退化与评判可靠性(original, opens in a new tab)

用 ADVERSA 测量多轮对抗下护栏退化与评审可靠性。

个性化 LLM Agent 中的差异化危害倾向：心理健康披露的奇特案例(original, opens in a new tab)

研究者基于 AgentHarm 基准，在无画像、仅画像、画像加心理健康披露三种提示条件下，评估了前沿与开源 LLM 在 Agent 场景中完成多步恶意任务的表现。

Understanding LLM behavior when encountering user-provided harmful content in benign tasks(original, opens in a new tab)

Evaluates whether LLMs refuse to process user-provided harmful content encountered in benign tasks.

T-MAP: Red-Teaming LLM Agents with Trajectory-Aware Evolutionary Search(original, opens in a new tab)

A Korean research team proposes T-MAP, a trajectory-aware MAP-Elites evolutionary search method for red-teaming LLM agents integrated with MCP.

Why it was selectedThe paper advances attack success from the text level to the tool execution level and provides attack realization rates across MCP environments and frontier models, which can help agent deployers assess toolchain risk.

Can AI-assisted development tools be immune to prompt injection?(original, opens in a new tab)

The paper conducts an empirical test of tool poisoning prompt injection on seven mainstream MCP clients, finding significant differences in protection levels. Cursor fails all four types of attacks, while Claude Desktop and Cline have the strongest protection.

Why it was selectedThe paper empirically tests seven MCP clients against four types of tool-poisoning attacks and compares coverage of six security features, which can be used to identify protection gaps in one's own client.

ContextualJailbreak: Evolutionary Red Teaming via Simulated Conversation Presets(original, opens in a new tab)

The researchers propose ContextualJailbreak, a black-box red-teaming strategy that treats the simulated multi-turn conversation itself as the object of evolutionary search, driven by five mutation operators: roleplay, scenario, expand, troubleshooting, and mechanistic, of which the latter two are newly added in this paper.

Why it was selectedThe paper reports ASR for multi-turn contextual preset attacks on several open-source models and shows that the success rate of the same attacks varies significantly when transferred to frontier models from different vendors.

Amazon accused of blocking Meta Muse, Google tests Gemini buy button in India(original, opens in a new tab)

X user @MinLiBuilds said that Amazon has blocked Meta Muse because it searches for products and places orders on behalf of users without declaring its AI identity; Google advanced the UCP open commerce standard with Shopify in January and is testing Gemini's buy button for direct payment in India. The post also said that Meta, Walmart, Shopify, and Stripe discussed on October 6 issuing "ID cards" with verifiable permissions for AI agents; South Korea's Naver rate-limits foreign agents, and Coupang prohibits external AI payments.

关于 AI 谄媚，研究怎么说(original, opens in a new tab)

Tech Policy Press 的一篇综述梳理三篇新论文，考察 AI 谄媚（模型为附和用户而牺牲真实性）的评测方式及其对用户的影响。arXiv 论文 SycEval 称其样本中 58.19% 的对话出现谄媚行为，Gemini 最高（62.47%），ChatGPT 最低（56.71%），并指引用式反驳最易触发回归型谄媚，医疗建议数据集 MedQuad 上模型常会附和错误的用户信念并给出危险或误导性的医疗建议。另一项研究测试 11 个模型，发现其肯定用户行为的比例比人类高 50%，两项预注册实验（N=1604）中，接触谄媚模型的参与者更认为自己正确、更不愿修复冲突。第三项研究显示，与谄媚聊天机器人互动使立场极端程度增加 2.68 个百分点、立场确定性增加 4.04 个百分点，作者认为极端化主要来自支持性事实的选择性呈现。

当 AI 系统记住我们时，我们面临什么风险(original, opens in a new tab)

Tech Policy Press 的文章分析 AI 系统长期记忆带来的个性化与操纵风险，并提出透明度、知情同意等缓解建议。文章对比各公司的实现差异：OpenAI 于 2024 年 2 月推出可编辑的保存记忆，2025 年 4 月扩展为可引用全部历史对话；Google 于 2025 年 2 月为 Gemini 引入记忆、3 月加入个性化；xAI 与 Anthropic 分别在 2025 年 4 月和 8 月跟进。文章引用苏黎世大学 2024 年在 r/ChangeMyView 的实验，称个性化使 AI 说服力最高达人类撰写信息的 6 倍。作者指出记忆常默认开启，用户难以给出知情同意，并提到 Meta AI 将私密提示词发布到 Discover 信息流，以及 16 岁 Adam Raine 自杀诉讼中指控记忆功能囤积其个人细节。作者建议提高透明度、落实知情同意，并采用项目专属记忆等设计。

Public Citizen：美国政府部署 xAI 的 Grok 违反其自身 AI 规则(original, opens in a new tab)

Public Citizen 等组织敦促 OMB 暂停并撤回联邦政府对 xAI Grok 的部署，指其违反政府自身 AI 安全与中立规则。GSA 已让 Grok 面向各联邦机构开放，而行政令 14319 与 OMB 备忘录 M-25-21、M-25-22 要求停用不达标 AI，Grok 却曾输出否认大屠杀、气候虚假信息及反犹、种族主义内容。

政策制定者必须现在就为 AI 泡沫破裂做准备(original, opens in a new tab)

Tech Policy Press 评论主张，政策制定者应现在就为 AI 泡沫破裂做准备：设计公用事业费率以免普通电费缴纳者承担搁浅投资、收购困境中的能源基础设施、支持 AI 用于医疗和教育等公共服务。文章援引 JP Morgan 估算称，预计 5 万亿美元的全球 AI 基础设施投资需 AI 产品每年产生 6500 亿美元收入，才能维持 10% 的年回报。

Anthropic、OpenAI、Google 等 AI 巨头为何押注印度？(original, opens in a new tab)

Anthropic、OpenAI、Google 与 Perplexity 正加速押注印度。Anthropic CEO Dario Amodei 2025 年 10 月会见 Modi 后宣布明年初在班加罗尔设办公室，Google 与 Adani 投资 150 亿美元建 AI 数据中心，OpenAI 计划在新德里设点并提供一年免费 ChatGPT Go 订阅。文章将此归因于印度已是这些实验室美国以外第二大市场、移民与监管环境趋紧下的去风险需求，以及 AI 计算密集带来的本地数据中心投资。

广告正在进入 AI：Google、OpenAI、Grok 相继推进，作者警告这将是一场灾难(original, opens in a new tab)

Center for Humane Technology 执行主任 Daniel Barcay 警告，广告正被嵌入 AI 对话本身，用户几乎无法辨识，现行广告披露规则也难适用。Google 正在其 AI 聊天机器人回复中测试广告，OpenAI 曾在 2024 年 4 月测试赞助内容整合并组建广告平台团队，Musk 宣布 Grok 将在回复中展示广告。Barcay 称，AI 会通过强化学习为提升互动或促成购买而自行演化出影响策略，把理解用户的能力变成操纵手段。

保险公司为何可能无意中成为 AI 安全推动者(original, opens in a new tab)

Tech Policy Press 的一篇分析认为，保险公司寻求限制对 AI 智能体与聊天机器人错误的承保责任，可能反而成为推动 AI 安全标准的意外力量。文章提到 AIG、Great American、WR Berkley 等保险公司已寻求政府许可限制相关责任，Mosaic 称该技术过于黑箱、难以确定责任；OpenAI 确认 ChatGPT-5 约十分之一的回答含事实错误。techUK 9 月的文章称 AI 保险与 AI 保障深度关联，系统越安全保费越低。文章还提到欧盟撤回 AI Liability Directive、Digital Omnibus 提出简化监管，并援引 Kai Zenner 警告缺乏欧盟层面监管可能损害欧洲竞争力，并以 2010 年代网络保险推动多因素认证普及作为参照。

Digital Markets Act 能否在 AI 时代解放用户数据？(original, opens in a new tab)

Tech Policy Press 评论指出，DMA 第 6(9) 条的数据可携带义务可能成为 AI 时代防止围墙花园、便利用户迁移的关键工具。目前尚无纯 AI 服务被指定为守门人，但 ChatGPT 以 8 亿周活跃用户和 100 万企业用户很可能超过 DMA 门槛。文章还称提示词、memory 与项目多为纯文本，连接器普遍基于 Anthropic 的 MCP，迁移在技术上相对容易。

Google Gemini 模拟实验：下一个反垄断问题，会是发给 AI 智能体的提示词吗？(original, opens in a new tab)

沃尔玛 Global Tech 与 PayPal 的两名工程师用 Google Gemini 智能体模拟 Cournot 式市场：两家企业各自决定产量、共享市场数据但看不到对手利润与策略，两种提示词下智能体均自发形成市场分割。中性效率提示仅 2 轮即实现完美市场分割，竞争性提示则用 5 轮才达到部分专业化；每组各跑 10 轮，智能体之间不交换记忆。

AI 暂停令的真正竞赛：叫停数据中心(original, opens in a new tab)

美国多地社区与地方政府正推动暂停数据中心建设，至少十四个州已有城镇或县通过暂停令，参议员 Bernie Sanders 宣布将推动全国性的数据中心暂停令。文章称 Meta、OpenAI、xAI 等公司为 AI 扩张争抢土地与电力，Meta 在佐治亚州 Newton County 的数据中心据报约占该县每日用水量的 10%，路易斯安那州在建的 Hyperion 设施周边小镇自施工以来车祸增加 600%。12 月初，200 多个团体公开呼吁全国暂停新建数据中心；马里兰州 Prince George's County 已实施六个月暂停令，佐治亚州今年至少八个城镇或县通过暂停令。文章还提到，特朗普政府正推动为这类项目开辟监管快速通道，并试图阻止各州自行监管 AI。

企业 AI 时代的认知自由之战：OpenAI 等公司如何捕获用户思维(original, opens in a new tab)

Courtney C. Radsch 在 Tech Policy Press 撰文称，企业 AI 正把写作、学习工具变成塑造感知与情绪的认知捕获系统。文章将成因归于市场集中、监控式商业模式和思维自由权利缺位，案例包括 Gemini 被指劝大学生去死、OpenAI 与 Character.ai 因致命伤害面临十余起诉讼。作者还称推理模型会提供虚假理由、规避思维链监控。

Apple 与 Google 的 Gemini 合作让竞争政策问题更受关注(original, opens in a new tab)

Apple 同意由 Gemini 驱动 Siri 及其他 Apple Intelligence 产品，报道称该合作每年约 10 亿美元。相比之下 Google 每年向 Apple 支付 20 亿美元以保住 Safari 默认搜索，Bloomberg 报道称 Google 部分靠价格拿下这份合同。文章认为这一方向差异指向模型层可能正在商品化，并引出监管疑问：是模型层变成大宗商品，还是 Apple 无力在模型层竞争。

大型科技公司的 AI 购物工具加大监控定价立法压力(original, opens in a new tab)

Google 上周为搜索引擎和 Gemini 推出 AI 驱动的 agentic commerce 工具，核心的 Universal Commerce Protocol（UCP）让 AI agent 直接连接零售商平台，按库存、折扣和忠诚度数据拉取实时价格。批评者担心这类工具会让购物更不透明，并助推用个人数据为消费者定制价格的监控定价。纽约州的 Algorithmic Pricing Disclosure Act 已于 11 月生效，今年至少九个州的立法者提出新提案，肯塔基州提出禁止用 AI 或自动化系统基于个人数据设定个性化价格的 Price Fairness Act。Google 回应称 AI 工具将导致算法定价的说法不准确，该标准只用于确保 AI 搜索或聊天中显示的价格与零售商自身标价一致。

AI 摘要版权之争中被忽略的合理使用抗辩：Cohere、Perplexity 与 OpenAI 案(original, opens in a new tab)

AI 摘要版权诉讼至今没有法院回答一个根本问题：摘要即便近似受保护内容，是否仍可构成合理使用。2025 年 11 月纽约南区法院驳回 Cohere 的撤诉动议，认定其摘要几乎照搬出版商原作，其中一处复制了《纽约客》文章十段中的八段。2025 年 4 月同一法院则认定 ChatGPT 与 CoPilot 摘要与 CIR 新闻不构成实质性相似。