30
A five-part inventory for your AI agent credentials
Orchid's CEO recommends inventorying five attributes of AI agent credentials to rein in over-privileged OAuth tokens and service accounts.
In a Help Net Security video, Orchid co-founder and CEO Roy Katmor argues that AI agents accumulate OAuth tokens, API keys, service accounts, and borrowed human credentials that sit outside normal identity review, leading to authority well beyond the agent's original purpose. He proposes treating each agent as an application and documenting owner and purpose, reachable tools, credentials, effective authority, and runtime behavior. Teams can then compare approved intent with observed behavior and apply scoped controls, including targeted kill switches.
22
DeepSeek Harness Flaw Let AI Agents Disable Their Own File Sandbox Without Approval
DeepSeek Harness (CVE-2026-82533, CVSS 9.4) let AI coding agents disable their own sandbox via an unauthenticated local API; fixed in 0.1.2-alpha.2.
DeepSeek Harness versions 0.1.1-rc.2 and earlier allowed a sandboxed AI coding agent to turn off its own OS sandbox by calling the tool's unauthenticated local web interface, tracked as CVE-2026-82533 with a 9.4 CVSS from VulnCheck. A single command set the agent session to danger-full-access mode, removing sandboxing and approval prompts, and OX Research verified writes escaped the workspace. The interface trusted the client-supplied Host header with no authentication and could also return a session's entire conversation log. The fix adds a one-time token and signed-cookie check; the first npm release carrying it is 0.1.2-alpha.2, with 0.1.2-rc.1 current.
58
Securing Claude Code: The New Compliance API, Local Visibility, and Identity Governance
Anthropic's new Compliance API endpoints expose Claude Code local session transcripts, highlighting governance gaps for endpoint AI agents.
Anthropic added local session transcript endpoints to its Compliance API on August 11, 2026, giving security teams visibility into prompts, bash commands, file operations, and MCP commands run by Claude Code harnesses on endpoints. The article argues local harnesses break the classic shared-responsibility model, citing Token Security data that 68.6% of discovered AI agents run on endpoints, and a Cloud Security Alliance survey of 418 IT and security professionals in which 82% found an unknown agent within the past year. It outlines three governance layers: Anthropic managed settings as a policy baseline, the Compliance API for cloud-visible transcripts, and endpoint telemetry to connect agent activity to identity, credentials, and permissions.
45
30
ISTA-DASLab/Qwen3.8-27B-GSQ-RCO-GGUF — new model trending #3 on Hugging Face
ISTA-DASLab releases GSQ-RCO non-uniform GGUF quantizations of Qwen3.8-27B down to 2.5 bpw, with task-lossless IQ3_S matching BF16 benchmark scores.
ISTA-DASLab released GGUF quantizations of Qwen3.8-27B produced with GSQ (Gumbel-Softmax Quantization) and RCO (Riemannian Constrained Optimization), non-uniform methods that allocate per-tensor precision via gradient-based search under a total size budget. Four checkpoints range from 2.50 bpw (8.4 GB) to 3.50 bpw (11.8 GB), plus a BF16 vision projector (mmproj) enabling multimodal use. The recommended IQ3_S build is task-lossless, matching the BF16 base exactly on AIME25 (100.00) and LiveCodeBench v6 (85.71) at roughly one fifth of the BF16 size. Optional -mtp variants add a Multi-Token Prediction head for speculative decoding in llama.cpp.
44
Meet Redis LangCache: A Managed Semantic Cache That Cuts LLM API Costs by Up to 90% and Returns Cache Hits Up to 15x Faster
Redis launches LangCache, a managed semantic cache matching LLM prompts by meaning, cutting API costs up to 90% and returning hits up to 15x faster.
Redis LangCache is a fully managed semantic caching service in public preview on Redis Cloud, accessed via a REST API with Python and JavaScript SDKs. It embeds incoming prompts, vector-searches stored entries, and returns a cached response when similarity clears a configured threshold, skipping the LLM call entirely. Redis claims up to 90% cost savings and up to 15x faster cache hits; a demo run showed 0.37 seconds versus 2.232 seconds direct inference (about 6x) with zero LLM tokens. Customer Mangoes.ai reports a 70% hit rate, 70% lower LLM spend, and 4x faster responses on a patient-care voice app.
30
Cohere Releases North Small Translate: A 218B MoE Translation Model That Scores 83.6 on WMT26 Across 50 Languages
Cohere released North Small Translate, an open-weight 218B MoE (25B active) translation model scoring 83.6 on WMT26 across 50 languages.
Cohere and Cohere Labs released North Small Translate, a decoder-only sparse Mixture-of-Experts translation model with 218B total and 25B active parameters, 128 experts with 8 activated per token plus shared experts, and 16K-token input and output context. In Cohere's vendor-reported WMT26 evaluation, judged by GPT-5.6-Sol, it scores 83.6 averaged across 50 languages (84.36 in an agentic multi-pass mode), ahead of DeepL NextGen (81.37), Qwen 3.5 397B A17B (81.56), GLM 5.2 (76.50), and Google Translate (68.20). The model was built with RWS's Language Weaver team, post-trained specifically for translation, and reports 112 output tokens per second versus 81 for Gemma 4 31B, with long-document xCOMET-XL scores of 48.9 versus 21.3 for Google Translate. It is available free on Cohere's Chat V2 API until rate limits, with three self-hosting checkpoints including a 4-bit NVFP4 variant running on 1x B200 or 2x H100.
55
50
30
30
Hackers Can Turn AI Workflows Into Privileged Data-Stealing Proxies Without Jailbreaking Models
Noma Labs describes Workflow Identity Hijacking, where unauthenticated external requesters abuse AI workflows' privileged service accounts to exfiltrate internal data without prompt injection.
Noma Labs identified 'Workflow Identity Hijacking,' an authorization gap in enterprise AI workflows triggered via public inboxes, web forms, GitHub issues, and support systems. Attackers submit legitimate-looking requests that cause workflows to retrieve and disclose internal data using privileged service accounts or creator credentials, without any prompt injection or model misbehavior. Defenses include propagating requester identity through workflows, short-lived scoped tokens, and access-control checks before sensitive actions.
42
[AINews] NVIDIA buys HuggingFace for $13B, as OpenAI publishes their HF incident retro
Z.ai released open-weight GLM-5.3-Flash (320B/18B active, 1M context, MIT) while Nvidia confirmed buying Hugging Face for $13B.
Z.ai formally launched GLM-5.3-Flash, the model previously previewed as Ox Alpha: 320B total parameters with 18B active, a 1M-token context window, natively multimodal, MIT-licensed, and claimed on par with Claude Opus 4.8 on coding. Artificial Analysis scored it 57 on its Intelligence Index at $0.09 per task, roughly 7.5x cheaper than GLM-5.3, and it scored 84.3% on Terminal-Bench 2.1. Nvidia's $13B acquisition of Hugging Face (~80x its $150M ARR) was confirmed, nearly double its initial $7B January offer. The roundup also notes Qwen shipping an impressive Flash model on Chinese chips as part of a broader open-model narrative.
78
New AI Workflow Identity Hijacking Attack Lets Hackers Exfiltrate Sensitive Data
Noma Labs disclosed Workflow Identity Hijacking, an AI automation flaw letting anonymous users trigger privileged data exfiltration without prompt injection or stolen credentials.
Noma Labs researcher Sasi Levi described Workflow Identity Hijacking, where AI workflows process untrusted input from low-privileged or anonymous users but execute downstream actions with the workflow creator's elevated permissions, turning the pipeline into an unauthenticated proxy. Unlike prompt injection, the model is not tricked; the flaw is a missing authorization check between the requester and the privileged actions. Noma Labs also disclosed and helped fix a similar issue in Google Workflows, and linked the problem to the earlier GitLost research on GitHub Agentic Workflows. Recommended mitigations include per-user identity propagation, least-privilege service accounts and authorization checks before every downstream action.
55
30
30
Do speech foundation models really learn words?
Researchers show via residualization that later layers of HuBERT and wav2vec 2.0 encode word identity and semantics independently of phonetic content.
The study argues that discriminative ability on words does not imply specialized word representations, since good word discrimination can be explained by phoneme encoding alone. By partialling out phoneme information using residualization, the authors show that later layers of HuBERT and wav2vec 2.0 encode words with reasonable fidelity independently of local phonetic content. Applying this disentanglement approach enhances higher-order linguistic information in word discovery tasks, informing analysis of speech foundation models used for recognition and speech tokens.
28
30
30
35
Notes on gotchas while migrating 35kb preprompts from Opus to self-hosted Ollama
Opinion piece urges migrating 35KB preprompts from Anthropic/OpenAI to self-hosted Ollama, citing session privacy risks and safety filters blocking security research.
The author documents gotchas migrating 35KB preprompts from Claude Opus to self-hosted Ollama, motivated by fears that frontier providers train on user sessions, citing the OpenAI Navier-Stokes controversy. The piece argues inference providers cannot audit their own retention or training pipelines and that only self-hosted hardware offers verifiable privacy. It also criticizes frontier safety filters for refusing vulnerability research tasks and calls for models that support exploitability testing in CI/CD pipelines.
15
30
30
30
30
30
Better Vector Search for Long Documents: Chunking Inside Manticore Search
Manticore Search added automatic document chunking for vector columns, lifting long-document recall@5 from 55.1% to 83.3% in its benchmarks.
Manticore Search introduced a chunk_strategy option for model-backed vector columns in CREATE TABLE, offering five strategies (truncate, mean, fixed, recursive, sentence) with tunable max_tokens, overlap_tokens, and max_chunks, eliminating external splitters and separate chunk tables. On its 189-page, ~298k-word manual, sentence chunking improved recall@5 from 55.1% to 83.3% and MRR from 0.44 to 0.70, at roughly 2.5x RAM and 4x ingest time. Documents still return as single results; queries are never chunked.
20
50
30
AWS limits AI agents’ data access, even when manipulated
AWS detailed propagating user authorization context through Bedrock AgentCore so downstream services enforce access controls even if the agent is manipulated via prompt injection.
AWS described an architecture for Amazon Bedrock AgentCore where user tokens and department claims are validated at runtime and propagated to DynamoDB, Bedrock Knowledge Bases, and Salesforce. Downstream services enforce authorization themselves, so a prompt-injected or buggy agent cannot retrieve data the user is not entitled to see. AWS demonstrated the pattern with a CRM use case separating Sales and Finance access and recommends IAM-backed knowledge bases for stricter isolation.
48
30
Disentangling Representation Evolution in Transformers through Directional Decomposition
Researchers decompose transformer updates into parallel and perpendicular components, linking representation geometry to editing robustness, compression diagnosis, and training interventions.
The paper studies transformer representation evolution as functional geometry, decomposing learned updates into parallel and perpendicular components across attention/MLP and value-aggregation spaces. Targeted edits reveal a space-dependent asymmetry: exclude-self value-space parallel manipulation is markedly more robust than residual-space and perpendicular counterparts. Full-aggregate parallel suppression during from-scratch pretraining lowers validation-loss trajectories and improves downstream averages, with the value-space variant strongest. Code is released on GitHub.
38
30
[AINews] Claude Fable/Mythos 5.1: new SOTA model, 75% cache price cut but 70% more output tokens
Anthropic launched Claude Fable 5.1 and Mythos 5.1, claiming new SOTA benchmarks, with 75% cache-read price cut and 1M-token context.
Anthropic released Claude Fable 5.1 and Mythos 5.1 as flagship models for coding and knowledge work, with a 1M-token context window and pricing of $10/$50 per million input/output tokens and cache reads cut 75% to $0.25. Artificial Analysis Intelligence Index scored Fable 5.1 at 66 versus 63 for Claude Opus 5, with HLE at 59.1% and Terminal-Bench v2.1 at 91.4%, though per-task cost rose ~20% due to 1.7x output token usage. Community analysis suggested Fable and Mythos may share underlying weights with different safety/routing behavior, and release notes highlighted Enterprise Frontier Safeguards and zero-data-retention support.
92
30
Emergence World: Adversarial Stress-Testing of Long-Horizon Multi-Agent Systems
16-day multi-agent stress test finds no world fully resilient to prompt injection, misinformation, or memory exposure; adversarial content acted on 46 hours later.
Emergence World is a continuously running multi-agent environment for adversarial stress testing of long-horizon autonomous systems. Eight parallel 10-agent worlds (seven homogeneous frontier-model worlds plus one mixed-model world) ran for 16 days, generating over 850,000 LLM calls and nearly 50 billion tokens. Three controlled stress events—indirect prompt injection, misinformation, and exposure of private agent memories—were delivered through ordinary interaction surfaces; no world achieved full resilience. Detection did not ensure containment: agents recognized threats yet wrote adversarial content into persistent memory and acted on it up to 46 hours later, suggesting model-level alignment is not compositional.
65
30
30
30
Hackers Use Claude AI Agents to Automate Cyberattacks, Develop 0-Days and Evade Detection
Anthropic reports state-sponsored and criminal actors used Claude AI agents to automate attacks, discover zero-days, and rewrite malware to evade detection.
Anthropic Threat Intelligence's report covering December 2025 to August 2026 details AI-automated campaigns by espionage groups, criminals, and hacktivists. GTG-20006, aligned with Russia-linked Midnight Blizzard, targeted Ukrainian and European government and drone supply chains, used Claude to autonomously rebuild malware when detected, hijacked hotel Wi-Fi DNS to serve ClickFix lures, and stole over 300,000 identity records from a North African government. Operators linked to ShinyHunters decompiled roughly 1.8 million Android packages for hardcoded secrets and pivoted from an XSS flaw in a SaaS vendor into 200+ downstream organizations in about 34 hours, harvesting 2,100+ Azure AD token sets across 40 tenants. The Chinese-linked GTG-10007 ran parallel agent swarms that surfaced more than a dozen candidate zero-day vulnerabilities in a single month.
82