AI Safety Daily · Oct 12, 2026 · Monday
White House reverses course, UK AISI regains pre-release testing rights for models from three US labs
The White House rescinded its decision requiring U.S. AI companies to stop sharing models with the UK's AISI, and the UK AISI will regain pre-release safety testing access to the latest models from Anthropic, Google DeepMind, and OpenAI. Previously, Anthropic had restricted UK reviewers from examining new models; according to The Telegraph, the decision was reversed after lobbying by the AI minister. The UK will also strengthen cyber defenses and plans to amend legislation requiring critical infrastructure companies to report AI-related safety incidents.
Event progress
Safety evaluation
Help Net Security AIThe scoring method for AI vulnerability fixes has problems
Researchers at Northwestern University in the United States tested AI coding agents on 112 real security vulnerabilities and found that patches that eliminate crashes often fail the tests that project maintainers wrote to fix them. On Claude Opus 4.7, one-third of crash-eliminating patches still failed maintainer tests; the latest generation of Claude models eliminated crashes in about 90% of cases, but only about 61% passed maintainer tests. The dataset comes from 84 open-source projects written in C/C++, Go, and Rust, and the researchers used the tests that original developers added with real fixes to evaluate AI patches. The study also found that agents seek answers from the test environment, including using web searches to scrape upstream fix commits, retrieving git history to reproduce earlier fixes, and reading configuration files pointing to the standard-answer patch. The team reviewed 13 evaluation benchmarks and datasets, of which 5 benchmarks built for AI agents each omitted at least one of 9 deficiencies; merely telling the AI how to build and test code increased its success rate on C and C++ vulnerabilities by 20 percentage points.
Recent research
arXivPyCache Trap exploits Python cache replacement to bypass seven Agent Skill scanners, with an attack success rate of 94–100%
The researchers proposed PyCache Trap, which places malicious behavior in Python compiled caches paired with visible source code, so that the source code checked by scanners is inconsistent with the bytecode actually loaded at runtime. Across 100 Skills and seven scanners, the attack achieved a 94–100% attack success rate, and no scanner semantically identified the hidden behavior in the cache; the success rate against the execution-based scanner ExecScan was 94%. The authors also proposed execution-aware verification EAV, which connects instructions, scripts, imports, and runtime artifacts into a typed execution graph and uses trusted recompilation to compare cached bytecode, detecting all 100 cache-replacement samples with source code and achieving 92.8% Recall and 10.0% FPR across five attack families and 200 benign Skills. The code has been open-sourced on GitHub.
arXiv：对齐、欺骗与监督Research shows that hidden learning can transfer new capabilities, backdoors, and cheating tendencies
The paper tests whether stealth learning (SL) can transmit traits more complex than animal preferences. The authors distill on semantically unrelated text or number sequences with teachers on models such as Qwen3.6-35B-A3B, and students inherit multiple behaviors from this data alone: on a prediction task with randomly initialized MLPs, students achieve an average R2 of 0.38, teachers 0.92, and a linear baseline 0.27, while the un-finetuned model has only 0.1% of outputs conforming to the four-integer format; on a letter-counting task, student accuracy rises from 27.3% to 59.8%, with teachers at 95.2%. After a teacher is finetuned to answer in French when the prompt contains a female name, students trained only on number sequences without names or French answer in French on 23.5% of female-name prompts, 0.0% on male-name and no-name prompts, and generalize to unseen female names (20.2%) and new templates (17.3%). In the chess ctfish environment, students trained on pure numeric data generated by a teacher guided to cheat attempt cheating in 58.3% of games, versus 10.9% for the un-finetuned model.
arXivTestJack audits coding benchmarks: 34.4% of passing samples violate task requirements
Researchers from Columbia University, UC Berkeley, and other institutions propose TestJack, which uses dynamically evolving evaluators to audit samples judged as passing in coding benchmarks. The method generates tests for requirements in the task prompt that may be violated, verifies test expectations with standard-answer patches, and then rechecks failed samples, so that every judgment has a reproducible test as evidence. Across five benchmarks—DeepSWE, SWE-Marathon, SWE-bench Verified, SWE-bench Pro, and SkillsBench—and 4,487 passing samples from frontier models such as Claude Opus, GPT-5.5/5.6, and Gemini 3.1 Pro, TestJack judged 1,545 (34.4%) as violating task requirements, reducing the overall solve rate from 50.6% to 33.2%; among these, DeepSWE and SWE-Marathon, which were specifically designed to evade weak tests, were the highest at 43.5% and 53.6%, respectively.