Smart search ranks by meaning as well as keywords (one row per story, last 45 days).
Hugging Face published a security.txt file, prompting limited Hacker News discussion of the RFC 9116 disclosure standard.
Hugging Face's security.txt file, which lists its security contact and disclosure channels per the RFC 9116 standard, drew attention on Hacker News. The RFC 9116 standard lets organizations publish where and how security researchers should report issues, but the submission received only one comment.
Keepnet launched a free iOS app, SMS/Call Reporter, letting users one-tap report smishing and vishing into corporate incident response pipelines.
Keepnet released the free SMS/Call Reporter app for iOS, letting users report suspicious SMS and voice phishing with one tap. For enterprise customers, reports flow into Keepnet Incident Responder alongside email phishing reports. The company cites Verizon 2026 DBIR data showing mobile phishing simulations achieve a 40% higher median click rate than email, and FBI IC3 2025 counted $798 million in smishing and vishing losses. An Android version is planned.
Interpretability study traces how Qwen, Llama, and Gemma route query information and internal knowledge across layers when answering questions.
Researchers used layerwise interventions on hidden states to separate query-routing signals from target knowledge in language models, testing Qwen, Llama, and Gemma on country-continent questions with varied answer types. A pair-conditioned request direction strengthens before interventions alter downstream knowledge, opening a causal window while answer-supporting content is still forming. Trajectories differ by model: Gemma shows a partially overlapping mid-layer routing profile, while Llama has no sustained routing-effect window under the same gates.
Agent-net open-sourced Webagent, a Go harness turning websites into AI agents with code-enforced guardrails wrapping every tool call.
Agent-net released Webagent under Apache 2.0, a Go framework where a business fills in a declarative JSON spec, picks one provider for each of nine pluggable slots (retrieval, memory, guardrail, channel, secrets, presenter, model, action, observability), and runs webagent serve. Every tool the agent holds is wrapped by action.Guard so the chosen guardrail executes before any action runs and the model cannot bypass it. Live capabilities include OpenRouter/gateway LLM brains, MCP tools over Streamable HTTP, and Slack, WhatsApp, and HTTP channels; browser actions, OAuth-gated MCP, OTel export, and AgentNet identity/billing are not yet built. The project is v0 with a deferred-hardening list and cites arXiv 2511.19477 on an 85% versus 50% task-success gap attributed to architecture over model capability.
Survey of four harness mechanisms—context budgeting, compaction, todo-state, and memory—that keep long-horizon LLM agents on task across 200+ tool calls.
The article details how agent harnesses, not larger context windows, solve context overflow and goal loss on long-horizon tasks, citing Chroma's Context Rot report showing 18 LLMs (GPT-4.1, Claude 4, Gemini 2.5, Qwen3) degrade on long inputs. Concrete implementations include LangChain Deep Agents offloading tool responses over 20,000 tokens to the filesystem and truncating old tool calls at 85% window usage, and Claude Code capping auto memory at 25KB while re-reading the 5 most recently modified files after compaction. OpenAI's Responses API now offers server-side compaction via context_management with a standalone /responses/compact endpoint, which Codex uses for long-running coding tasks. Manus reports a roughly 100:1 input-to-output token ratio per ~50-tool-call task, motivating todo.md state recitation to prevent goal drift.
Opinion piece urges migrating 35KB preprompts from Anthropic/OpenAI to self-hosted Ollama, citing session privacy risks and safety filters blocking security research.
The author documents gotchas migrating 35KB preprompts from Claude Opus to self-hosted Ollama, motivated by fears that frontier providers train on user sessions, citing the OpenAI Navier-Stokes controversy. The piece argues inference providers cannot audit their own retention or training pipelines and that only self-hosted hardware offers verifiable privacy. It also criticizes frontier safety filters for refusing vulnerability research tasks and calls for models that support exploitability testing in CI/CD pipelines.
A controlled study finds agent memory portability varies sharply: fixed-schema knowledge graphs survive model swaps while compressed notes degrade.
The study compares preserving an agent's history as raw long context, RAG chunks, compressed natural-language notes, or fixed-schema knowledge graphs across model upgrades, using 48 synthetic histories and two open-weight sub-10B-parameter models. Fixed-schema KG accuracy changed by only +0.0004 ± 0.0020 after a writer swap, while compressed NOTES shifted asymmetrically by +9.91 or -13.28 percentage points depending on migration direction. Mixed 50/50 embedding migrations captured only 4.96 of an 11.90-point RAG re-embedding gain; 80% of the NOTES deficit came from information lost at construction, and 81% of the RAG deficit from retrieval failures. Store-only repair of NOTES failed to reach 90% recovery in all 48 cases, while retaining raw histories enabled recovery in 34 of 48 for one direction.
Signed Rescue Routing improves LLM cascade efficiency by predicting when a larger model actually corrects a smaller one rather than uncertainty.
Signed Rescue Routing (SRR) is a budgeted cascade method that separately predicts rescues and regressions when escalating from a small to a large model, ranking requests by their signed difference. The authors prove this signed conditional gain is Bayes-optimal under a fixed escalation budget and add only a lightweight two-head router needing small-model output statistics at deployment. Evaluation with Qwen3-4B and Qwen3-8B on MMLU, HellaSwag, and ARC-Challenge shows better accuracy-compute tradeoffs than entropy routing and learned error predictors.
Architecture explainer separates agent harnesses, frameworks, and MCP by which layer owns the loop, state, permissions, and recovery.
The article distinguishes agent harnesses (OpenAI Codex, Claude Agent SDK), which own the execution loop, sandbox, permission model, and recovery; frameworks (LangGraph, OpenAI Agents SDK, Microsoft Agent Framework), which supply composable primitives; and MCP, a stateless JSON-RPC wire protocol governed by the Linux Foundation's Agentic AI Foundation since December 2025. An ownership matrix maps the execution loop, state, tool transport, permissions, recovery, sandboxing, and multi-agent orchestration to each layer. The 2026-07-28 MCP specification made the protocol fully stateless, retiring the initialize handshake and session headers.
Academics linked Chinese vendor Geedge Networks' Tiangou Secure Gateway source code to one of the Great Firewall's three traffic filtering capabilities.
US researchers presenting at USENIX Security reconstructed Geedge Networks' Tiangou Secure Gateway firmware from over 100,000 leaked files, including Git repositories with commit history, and matched its filtering behavior to sections of China's Great Firewall. They found only 1 of 3 characterized DNS injectors matched Geedge code, noted the system relies on memory-unsafe C components and copied third-party code, and said its bugs could aid future circumvention tools. Geedge also exports censorship tools to Kazakhstan, Ethiopia, Pakistan, and Myanmar. The newsletter additionally rounds up multiple breaches.
Fortunate Recall introduces ontology-based lifecycle policies for LLM memory, cutting confabulation roughly in half (e.g., 45.1% to 22.4%) versus Mem0.
Fortunate Recall (FR) is a composable policy layer that classifies personal facts into a 10+1 behavioral ontology and applies category-specific lifecycle rules including differential temporal decay, slot-key supersession, event-time validity, and retrieval routing. FR-Bank scores 76.9% on the new 516-question LifecycleBench, ahead of Mem0, A-MEM, Memory-R1, and MemoryOS (61%-70.5%), and 75.2% on LongMemEval-S. End-to-end, confabulation drops from Mem0's 45.1% to 22.4% over answered queries, with the ranking replicating on open-weight Kimi K2.5 and transferring to the independent BEAM benchmark (46.8% vs 32.9%).
Composing data, function, and weight anchors with merged LoRA raises 100-task long-horizon retention from 1.2% to 34.9% in continual fine-tuning.
The paper introduces long-horizon memorization: a model learns 100 query-answer tasks through continual supervised fine-tuning without retaining earlier examples or receiving task identifiers at inference. No single continual learning mechanism maintains strong retention at this horizon, so the authors compose complementary mechanisms along data/function/weight anchors and low-rank allocation rules. The best method combining all three anchors with merged LoRA ranks among the top 3 methods on all three datasets and raises average final retention from 1.2% to 34.9%, a 28-fold improvement.
Cloudflare measured RFC 9234 adoption, finding BGP Role deployment growing but two Tier 1 networks unexpectedly stripping the Only to Customer attribute.
Cloudflare analyzed adoption of RFC 9234, which introduces BGP Roles and the Only to Customer (OTC) attribute allowing routers to reject route leaks on their own. The measurement study assessed who has deployed the mechanism in the global routing table. It found two Tier 1 networks unexpectedly stripping OTC attributes, which could undermine leak protection.
OtoDock, a self-hosted company OS that organizes Claude Code and Codex AI agents into departments, was launched on GitHub via Show HN.
OtoDock is a self-hosted 'company OS' shared on GitHub through a Show HN post, presenting Claude Code and Codex AI agents organized into department-style teams. The Hacker News feed entry shows the post reached 20 points with 5 comments; no further technical details are provided in the available text.
Unit 42 details the Bad Likert Judge multi-turn jailbreak that abuses LLMs' evaluation capability, raising attack success rates over 60% across six frontier models.
Palo Alto Networks Unit 42 describes the Bad Likert Judge technique, a multi-turn jailbreak that asks a target LLM to act as a Likert-scale judge scoring the harmfulness of example responses. The highest-rated example in each scale can carry harmful content, bypassing the model's internal guardrails. Testing across six state-of-the-art text-generation LLMs showed an average attack success rate increase of more than 60% versus plain attack prompts, with tested models anonymized. The technique targets edge cases rather than typical use, and the article positions the work as guidance for defenders on potential jailbreak risks.
GraphProfiler links LLM attribute inferences to source posts via personal knowledge graphs, enabling targeted redaction of privacy-leaking content.
GraphProfiler represents a user's post history as a source-linked personal knowledge graph where nodes and edges trace back to originating posts, making LLM-based attribute inference auditable. It reaches 86.7% attack success rate on the eight-attribute SynthPAI benchmark and 84.6% on PANDORA, within two points of strong text-only baselines, while citing supporting evidence for over 98% of predictions. Ablation experiments show removing cited posts reduces attack success substantially more than removing random posts, supporting targeted privacy mitigation.
OpenAI report describes how students and educators use ChatGPT to extend learning continuously beyond the classroom.
OpenAI published a report examining how students and educators use ChatGPT to make learning more continuous. The report describes support that extends beyond the classroom, positioning ChatGPT as an ongoing learning companion. The release is part of OpenAI's education-focused communications rather than a technical or safety research paper.
Controlled mid-training experiments on Qwen3-8B-Base find each domain has a 10-40% coverage optimum and domain gaps survive alignment SFT.
Using Qwen3-8B-Base (with a 4B replication) across five semantically rule-disjoint KOR-Bench domains, the authors train 30 data allocations spanning the five-domain simplex at five seeds each. All five domains show interior optima in the moderate 10-40% coverage band, and domain gaps persist after a fixed-budget compensatory SFT pass, which raises 116/120 cells yet bridges 0/240 pairs at a 5% threshold. Zero coverage collapses mid-training-only accuracy, though a FineWeb-Edu-only control shows the collapse is partly generic drift. The results argue mid-training data composition requires principled design rather than reliance on later alignment.
Atlas delivers zero-knowledge proofs for HNSW semantic search, verifying RAG retrieval in under a second on SIFT1M and 2.0 seconds at 100M vectors.
Atlas lets a search provider prove that a query was answered correctly against a committed HNSW index without revealing the index, addressing provider deviations like truncation or bias. It combines offline preprocessing, a fixed-size-state restructuring of HNSW with a correctness proof, and timestep-tagged batching of per-step arguments. The system proves queries in under a second on SIFT1M and 2.0 seconds at 100 million vectors while preserving plaintext HNSW recall, and proven retrieval maintains end-to-end RAG answer quality at lower cost than prior verifiable retrieval systems.
Researchers counted 36,769 publicly reachable self-hosted AI endpoints, only about 2% behind HTTP authentication, exposing Ollama, vLLM, and Flowise to abuse.
A Mysterium VPN study found 36,769 self-hosted AI endpoints reachable through internet scanning, with only 2.02% returning an HTTP authentication challenge. Open WebUI accounted for 18,529 reachable instances, Ollama for 6,935 fingerprinted hosts, and 5,223 agent-builder and workflow platforms were exposed, often holding API keys, database credentials, and other secrets. The report highlights LLMjacking risk from exposed Ollama APIs, a critical Flowise bug (CVE-2026-40933), leaked n8n tokens, and prior SentinelOne/Censys research finding roughly 175,000 exposed Ollama hosts in 130 countries.
A SANS ISC guest diary describes batch.py, a Python tool that consolidates honeypot logs and enriches IOCs with threat intelligence data.
Written by a SANS.edu BACS intern, the diary explains analysis of the DShield Honeypot-Omaha sensor, which uses Cowrie to emulate SSH and Telnet and log attacker activity. The author's batch.py script implements a four-phase pipeline with SHA-256-generated master and guest authentication to consolidate JSON and log files, correlate data via external APIs, and produce MITRE, CVE, geolocation, threat-score and fingerprint enrichment for investigated indicators.
Researchers propose a coverless steganographic framework encoding messages as hierarchical clustering paths in sentence embedding space with a Global Resynchronization Mechanism for robustness.
An arXiv paper proposes encoding secret messages as hierarchical clustering paths in the sentence embedding space rather than token space, improving decoding stability against word- and sentence-level textual perturbations. A Global Resynchronization Mechanism (GRM) reframes variable-length bitstreams as discrete symbols anchored to semantic subspaces to prevent bit-slippage. Experiments show substantial robustness improvements while maintaining embedding capacity and resistance to statistical analysis.
Akamai researchers published an analysis of a Go-based, self-propagating IoT botnet used for DDoS attacks.
Akamai's security research team published an analysis of a self-propagating DDoS botnet written in Go that targets IoT devices. Detailed technical findings were not available in the provided source text, which included only the title.
Formalizes residual authorization state language agents must preserve under revocable delegation; token-budget summaries mostly fail while hard gates stop unauthorized effects.
The paper shows two authorization histories with identical current permissions can require opposite decisions after the same direct-edge revocation, formalizing the needed information as residual authorization state. Exponentially many future-distinct states can share one transitive closure, with exact or tight asymptotic bounds on the state an exact monitor requires. Across four open-weight models, fixed 256-token summaries solved at most 2 of 16 paired episodes while authenticated current-query reads solved 15-16 of 16. A hard effect gate reduced eight observed unauthorized effects to zero without changing preceding attempts.
Hugging Face published a tutorial on training and finetuning multi-vector embedding models using the Sentence Transformers library.
Hugging Face's blog walks through training and finetuning multi-vector embedding models with Sentence Transformers. Multi-vector approaches store multiple vectors per document to support late-interaction retrieval. The post is a practical guide for developers building retrieval pipelines with the library.
LexFlip releases 373 minimal perturbations of Quebec statutory French that reverse legal force while preserving tokens, exposing weaknesses in embedding-based meaning preservation metrics.
LexFlip provides 373 minimal perturbations of Quebec statutory French that reverse legal force while preserving 0.93 of tokens, creating dissociation items that break monotone token-overlap metric validation. The seven embedding and BERTScore metrics tested register only 0.022-0.039 of their identical-to-unrelated range on these edits, versus 0.670 for bidirectional NLI. Against FrJudge, with a measured human ceiling of r=0.597, a bare length feature outscores every semantic metric tested.
Recorded Future analyzes the Hugging Face and OpenAI incident, arguing AI made attacker persistence cheap and alert-based defenses ineffective.
Recorded Future published an analysis of the security incident affecting Hugging Face and OpenAI. The authors argue AI did not make attackers smarter but drastically lowered the cost of maintaining persistent access. They contend that defenses built around alerts cannot keep up with this persistence model, with implications for detection strategy across AI supply chains.
Hugging Face details building and using multi-vector late-interaction embedding models with Sentence Transformers for retrieval workloads.
Hugging Face published a guide on multi-vector, late-interaction embedding models (ColBERT-style) supported through Sentence Transformers. The post covers how practitioners can build and use these models for retrieval and RAG pipelines. It is a developer tooling and technique write-up, not a security advisory.
Researchers propose BUD, per-block write-log digests enabling blockchain validators to serve historical membership and exclusion proofs far cheaper than state-wide tries.
The paper introduces Block Update Digests (BUD), which authenticate each block's write log with predecessor pointers, plus a SuperBUD and exponential hierarchy to turn long unchanged intervals into short proofs. Soundness against adversarial provers and up to f Byzantine validators is proven under archive, attestation, and committee evidence assumptions. Benchmarks show a 50x state-size increase raises the base-BUD path only 1.24x versus 3.1x for in-memory and 69.5x for disk-backed Merkle Patricia tries, with read payloads below 800 bytes and p99 warm verification at 146 microseconds.
Audit of 22 frontier models finds widespread verbatim retrieval of published molecular property values, with higher reasoning increasing recall of memorized numbers.
An arXiv audit tests 22 frontier LLMs across 12 molecular regression benchmarks for verbatim retrieval of published values. More than 50% of the LLMs show verbatim retrieval on five datasets, and identical experiments are flagged 89% more often at a high reasoning level than at the lowest one. Suppressing retrieval moves model prediction errors closer together in relative terms, suggesting predictive capability is not determined solely by memorized values.
Akamai Blog