ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “agent memory”

147 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllMalware 235Vulnerability 222Ransomware 96Exploit / PoC 83AI safety & security 67Threat actor 67AI research 34Data breach 34Policy & legal 33Industry 28Model release 24AI tools & infra 21AI industry 20Phishing & fraud 19
SeverityAllcritical 292high 281medium 226low 52info 152

When AI Remembers Too Much

Unit 42 PoC shows indirect prompt injection can poison Amazon Bedrock Agent long-term memory, enabling silent exfiltration of conversation history across future sessions.

Palo Alto Networks Unit 42 published a proof of concept showing that indirect prompt injection can silently poison the long-term memory of Amazon Bedrock Agents when the memory feature is enabled. Malicious content on a webpage or document manipulates the agent's session summarization process, so injected instructions persist across sessions and are added to later orchestration prompts, silently exfiltrating user conversation history. The issue is not a vulnerability in the Amazon Bedrock platform but an illustration of the broader unsolved LLM prompt-injection challenge. Amazon reviewed the research and stated that Bedrock Guardrails with the prompt-attack policy provides effective mitigation.

Palo Alto Unit 42 · Aug 17, 2026AI safety & security

Revoked but Still Authoritative: An Empirical Study of Revocation Enforcement in Agent-Memory Systems

An empirical study finds no major agent-memory system enforces fact revocation at retrieval, causing agents to act on superseded, unsafe information.

Researchers tested five agent-memory systems across nine policy scenarios, nine models, and six defense conditions, tracking whether revoked facts are returned and acted upon. No system enforces revocation by default: revoked records are returned whenever the revocation label is visible to the retrieval layer, outrank their replacements, and lead agents to unsafe actions. The authors propose a backend-agnostic guard that sits between the agent and any memory store and withholds revoked or conflicting records at retrieval time.

arXiv cs.CR · 8d agoAI safety & security

Cohesity adds recovery capabilities for AI agents and the data they manage

Cohesity launched Agent Resilience to discover, protect, and recover AI agent memory, configuration, and agent-managed data, debuting with Amazon Bedrock integration.

At Cohesity Catalyst, Cohesity introduced Agent Resilience within Cohesity Data Cloud, protecting AI agent memory and configuration with snapshot architecture, immutable backups, and clean-room recovery, plus recovery for databases and file systems that agents manage. It launches with Amazon Bedrock integration, support for Microsoft and Google platforms planned, and general availability targeted for year-end. The company cited Gartner's prediction that up to 40% of enterprise applications will include task-specific agents by 2026, and Cohesity research showing 56% of organizations are unprepared to detect or contain unintended agent actions while 58% lack confidence in verifying AI model integrity after attacks. Cohesity also outlined an Autonomous Cyber Resilience vision using agentic workflows and introduced the AI Resilience Academy.

Help Net Security · 8h agoTools

Does Your Agent's Memory Survive a Model Upgrade? A Controlled Study of Memory Portability

A controlled study finds agent memory portability varies sharply: fixed-schema knowledge graphs survive model swaps while compressed notes degrade.

The study compares preserving an agent's history as raw long context, RAG chunks, compressed natural-language notes, or fixed-schema knowledge graphs across model upgrades, using 48 synthetic histories and two open-weight sub-10B-parameter models. Fixed-schema KG accuracy changed by only +0.0004 ± 0.0020 after a writer swap, while compressed NOTES shifted asymmetrically by +9.91 or -13.28 percentage points depending on migration direction. Mixed 50/50 embedding migrations captured only 4.96 of an 11.90-point RAG re-embedding gain; 80% of the NOTES deficit came from information lost at construction, and 81% of the RAG deficit from retrieval failures. Store-only repair of NOTES failed to reach 90% recovery in all 48 cases, while retaining raw histories enabled recovery in 34 of 48 for one direction.

arXiv cs.AI / cs.LG / cs.CL · 12d agoAI research1

MemSentry: A Framework for Detecting Persistent Memory Poisoning in Agentic AI

MemSentry intercepts persistent-memory writes in agentic AI to catch memory poisoning, reaching 91.7% accuracy with SBERT+LR classification.

Memory poisoning lets adversaries plant crafted content in an agent's long-term memory to suppress security alerts, enable privilege escalation, or override policies without modifying model weights or system prompts. The paper presents MemSentry, a configuration-driven framework that evaluates proposed persistent-memory writes on source trust, semantic risk, attack radius over a dependency DAG, access risk, and a signed security-state delta to issue deterministic Accept, Review, or Quarantine decisions. Across 1,000 GPT-4-generated scenarios on a 20-asset dependency DAG, SBERT+LR achieved 91.7% accuracy and 0.908 macro-F1, all four classifiers detected 100% of external quarantine-class threats, and verified-insider writes are escalated for human review rather than auto-quarantined.

arXiv cs.CR · 8d agoAI safety & security

Give Your Coding Agents a Memory You Own

Hugging Face introduces Funes, a tool that gives coding agents persistent, self-owned memory outside vendor clouds.

A Hugging Face blog post presents Funes, an approach for giving coding agents a persistent memory that developers own and control. The piece targets agent workflows where context must survive across sessions without ceding data to third-party services. No article body was available in the feed, so specifics beyond the title are limited.

Hugging Face Blog · 13d agoAI tools & infra1

[AINews] Poolside gets $12B reverse-execuhire to NVIDIA; founders stay for $1B, employees go for $6B, Infraco scaling to 7GW neocloud

NVIDIA struck a $12B deal with AI coding startup Poolside, licensing its Model Factory and hiring 109 of its technical employees.

NVIDIA spent roughly $12B in an unusual reverse-execuhire of Poolside, licensing the company's Model Factory while hiring 109 of its ~115 technical staff; founders retain a $1B stake and employees receive about $6B. Poolside had raced to raise $2B to fund a 40,000 GB300 cluster after missing a six-week funding window, and founders argue frontier-scale training now requires an order of magnitude more compute plus contracted data center space. An infrastructure arm spun out in January 2026 is scaling toward 7GW as a neocloud. The newsletter also recaps OpenAI and Anthropic agent-platform releases.

Latent Space · 26d agoAI industry

How Much Memory Does Your Agent Actually Need?

IBM Research examines how much memory AI agents actually need in a Hugging Face post tied to its ALTK Evolve toolkit.

IBM Research published a Hugging Face blog post titled 'How Much Memory Does Your Agent Actually Need?', addressing memory requirements for AI agents. The post is associated with the ALTK Evolve project per its URL. No article body was available, so detailed methods and results could not be extracted.

Hugging Face Blog · 29d agoAI research

The VMs Powering Mobile Agents (Instinct, Claude Code)

A teardown reveals Claude Code runs in Firecracker microVMs with a Rust PID 1 and MITM'd egress, while Instinct rents E2B sandboxes with git-based memory.

The author inspects the virtual machines hosting cloud agents: Claude Code runs in a Firecracker microVM with a custom Rust init (process_api) as PID 1, a 324 MB Bun harness on a read-only disk, and 443-only MITM'd SSE egress to api.anthropic.com with host-rotated OAuth tokens and no inbound access. Instinct rents E2B sandbox-as-a-service Firecracker microVMs (Ubuntu 22.04, 2 vCPU, 1.9 GB RAM) where agent memory is a git repo of Markdown committed by the agent and pushed to S3 as a single bundle, using short-lived STS credentials. Both platforms rely on Firecracker, differing mainly in fleet operator and guest boot configuration.

Hacker News · AI · 8d agoAI tools & infraHN 58↑ · 19 comments1

Emergence World: Adversarial Stress-Testing of Long-Horizon Multi-Agent Systems

16-day multi-agent stress test finds no world fully resilient to prompt injection, misinformation, or memory exposure; adversarial content acted on 46 hours later.

Emergence World is a continuously running multi-agent environment for adversarial stress testing of long-horizon autonomous systems. Eight parallel 10-agent worlds (seven homogeneous frontier-model worlds plus one mixed-model world) ran for 16 days, generating over 850,000 LLM calls and nearly 50 billion tokens. Three controlled stress events—indirect prompt injection, misinformation, and exposure of private agent memories—were delivered through ordinary interaction surfaces; no world achieved full resilience. Detection did not ensure containment: agents recognized threats yet wrote adversarial content into persistent memory and acted on it up to 46 hours later, suggesting model-level alignment is not compositional.

Hugging Face daily papers · 1d agoAI safety & security

MeClear: Cooperative Game-Theoretic Attribution and Risk-Aware Memory Clearance for Long-Horizon LLM Agents

MeClear uses cooperative Shapley attribution to clear harmful memories from long-horizon LLM agents, boosting task recovery by 25.5 points over baselines.

The paper introduces MeClear, a task-conditioned memory clearance framework for long-horizon LLM agents that identifies and selectively suppresses memories with negative downstream utility without permanently altering the persistent memory bank. It combines Leave-One-Out screening with sampled cooperative Shapley attribution to distribute utility across interacting evidence, resolving redundant conflict masking that single-removal evaluations miss. Across ten long dialogue memory pools it achieves 85.9% target recall and 82.3% overall task recovery, a 25.5 percentage-point improvement over LOO baselines.

arXiv cs.AI / cs.LG / cs.CL · 8d agoAI research

Show HN: Engrim – A universal, local-first SQLite memory engine for AI CLIs

Developer launches Engrim, an open-source local-first SQLite memory engine giving AI CLI agents persistent memory.

Engrim, shared on Hacker News (89 points), is a universal, local-first memory layer built on SQLite for AI CLI tools. It targets agent-style CLI applications that need durable cross-session memory without cloud dependencies. Details beyond the repository description were not provided in the source text.

Hacker News · AI · 9d agoAI tools & infraHN 89↑ · 53 comments2

PARSER: Read in Parallel, Reason in Depth for Long-Context LLM Agents

PARSER uses parallel reader subagents and an RL-trained lead agent for long-context QA, beating baselines and cutting latency up to 11x.

The PARSER paper decouples reading from reasoning: frozen subagents each read one document chunk in parallel while an RL-optimized lead agent iteratively broadcasts queries and aggregates evidence in scatter-gather rounds. On multi-hop QA with 7K to 896K token contexts, a 4B-backbone PARSER beats the strongest sequential memory baseline by 5.7 points on average and 12.0 points at 896K tokens, and a 9B version surpasses DeepSeek-V4-Pro by 6.3 points. Controlled experiments show robustness to evidence position, order, and distance perturbations, with inference latency reduced by up to 11x.

Hugging Face daily papers · 10d agoAI research1

RSIAgent: Autonomous Exploration for Recursive Self-improvement in New Environments

RSIAgent, a training-free multi-agent framework, builds reusable environment memory enabling Kimi-K3 and GLM-5.3 to beat GPT-6.

RSIAgent is a training-free framework for recursive self-improvement through autonomous memory construction, coordinating curriculum, actor, and verifier agents. It uses broad-then-deep exploration to capture environment structures, hidden constraints, and causal dependencies, and freezes the resulting memory for direct reuse without parameter updates. On OSWorld-v2 and Agent's Last Exam it substantially improves strong open-source models, enabling Kimi-K3 and GLM-5.3 to outperform frontier closed-source models including GPT-6.

Hugging Face daily papers · 2d agoAI research2

TRACE: Trajectory-robust Admission with Evidence Ordering for Efficient GUI Agents

TRACE, a training-free visual token pruning framework, cuts GUI agent inference latency and memory while keeping trajectory-wide visual evidence reusable.

TRACE is a training-free framework for trajectory-robust admission and coverage-aware evidence ordering that prunes high-resolution screenshot tokens accumulated in GUI agent trajectories. It ranks visual evidence using a query-independent layout-derived interaction prior combined with instruction relevance and feature novelty, and reserves part of the budget for native tokens distributed across the screen to repair spatial coverage. A monotone KV contraction incrementally compresses retired frames into compact session state, avoiding repeated visual encoding or pruning. Experiments across six GUI benchmarks and diverse models verify effectiveness under tight budgets, with source code to be released.

Hugging Face daily papers · 7d agoAI research

Context Engineering Inside the Harness: 4 Mechanisms That Beat Context Overflow and Goal Loss on Long-Horizon Tasks

Survey of four harness mechanisms—context budgeting, compaction, todo-state, and memory—that keep long-horizon LLM agents on task across 200+ tool calls.

The article details how agent harnesses, not larger context windows, solve context overflow and goal loss on long-horizon tasks, citing Chroma's Context Rot report showing 18 LLMs (GPT-4.1, Claude 4, Gemini 2.5, Qwen3) degrade on long inputs. Concrete implementations include LangChain Deep Agents offloading tool responses over 20,000 tokens to the filesystem and truncating old tool calls at 85% window usage, and Claude Code capping auto memory at 25KB while re-reading the 5 most recently modified files after compaction. OpenAI's Responses API now offers server-side compaction via context_management with a standalone /responses/compact endpoint, which Codex uses for long-running coding tasks. Manus reports a roughly 100:1 input-to-output token ratio per ~50-tool-call task, motivating todo.md state recitation to prevent goal drift.

MarkTechPost · 3d agoAI research1

[AINews] Hot Chips: OpenAI’s Jalapeño, Cerebras CS-5, Groq 3 LPX, Apple M6

OpenAI unveiled Jalapeno custom inference chip claiming 1.5-1.9x better perf-per-watt than NVIDIA GB200/GB300, deploying in-house by year-end.

At the 37th Hot Chips conference, OpenAI published first benchmark details for its custom Jalapeno inference chip, claiming 1.5-1.9x more work per watt, 1.7-3.6x lower end-to-end latency, and 2.1-4.1x higher interactive-workload performance versus NVIDIA GB200/GB300, with the 700W-rated part staying at or below 550W in tests. Deployment into OpenAI's own infrastructure begins by year-end, with Gen 2 deep in development and Gen 3 underway. OpenAI also said GPT-Astra and Codex helped write low-level kernels, reportedly 1.5-1.8x faster than human-expert code for selected attention and MoE blocks. Cerebras CS-5, Groq 3 LPX and Apple M6 were also featured at the conference.

Latent Space · 20d agoAI industry

Agent Harness vs Agent Framework vs MCP: Which Layer Owns the Loop, State, Tools, Permissions, and Recovery

Architecture explainer separates agent harnesses, frameworks, and MCP by which layer owns the loop, state, permissions, and recovery.

The article distinguishes agent harnesses (OpenAI Codex, Claude Agent SDK), which own the execution loop, sandbox, permission model, and recovery; frameworks (LangGraph, OpenAI Agents SDK, Microsoft Agent Framework), which supply composable primitives; and MCP, a stateless JSON-RPC wire protocol governed by the Linux Foundation's Agentic AI Foundation since December 2025. An ownership matrix maps the execution loop, state, tool transport, permissions, recovery, sandboxing, and multi-agent orchestration to each layer. The 2026-07-28 MCP specification made the protocol fully stateless, retiring the initialize handshake and session headers.

MarkTechPost · 1d agoAI research1

Evaluating Context Segmentation in Locally Deployable SLMs for Cybersecurity CTF Tasks

Context segmentation framework boosts memory-constrained gemma-4 agents on picoCTF, solving 18.52% of tasks standard execution fails, highlighting local SLM offensive risk.

The paper introduces context segmentation, a two-level agentic framework that divides long-horizon CTF exploitation tasks into contextually isolated sub-problems to counter context bloat and cognitive degradation from accumulated tool-call outputs. It evaluates memory-constrained gemma-4 models on the picoCTF dataset; the E4B model achieves competitive rewards with superior token efficiency compared to brute-force retries. It solves 18.52% of tasks that standard agentic execution fails to complete. The work frames locally deployed open-weight SLMs as an escalating risk since they bypass proprietary API guardrails; code is released on GitHub.

arXiv cs.CR · 5d agoAI safety & security1

Simulation: the new Scaling Law — Joon Sung Park, Simile AI

Simile AI raised a $2B Series B from GreenOaks and Index Ventures to scale human-behavior simulation for Fortune 100 clients like CVS.

Simile AI, co-founded by Generative Agents researcher Joon Sung Park, announced a $2 billion Series B backed by GreenOaks and Index Ventures, with Fei-Fei Li and Andrej Karpathy among backers. The company runs tens of millions of simulations for Fortune 100 clients including CVS, reporting 85-99% accuracy versus human focus groups and digital twins of 1,000 real people at 85% behavioral accuracy. The long-term ambition is foundation models of human behavior, post-trained on interviews, transaction data, and randomized controlled trials, potentially simulating all 8 billion people.

Latent Space · 25d agoAI industry

Why don't machine learning research agents overfit?

Amazon researchers explain why ML research agents avoid benchmark overfitting, attributing generalization to compressibility of successful strategies.

Amazon Science summarizes the paper "What fits (into few tokens) doesn't overfit: Compression and generalization in ML research agents," which investigates why benchmark hill-climbing loops, whether run by human communities or LLM research agents, do not produce rampant overfitting. The explanation formalizes Occam's razor via a counting argument: successful ML strategies are highly compressible, so short descriptions lack room to memorize benchmark data and must capture real structure. LLM-based agents, being resettable and controllable, allow this hypothesis to be tested empirically.

Hacker News · security · 2d agoAI researchHN 21↑ · 3 comments

Bilevel Coordinated Reflection: A Game-Theoretic Approach to Multi-Agent LLM Systems

Paper models multi-agent LLM orchestration as a bilevel game, proving transcript-only gating limits and introducing grounded-memory SRMA.

A new paper frames orchestrator-worker coordination in multi-agent LLM systems as a bilevel coordination game and analyzes free-form reflection as stochastic movement over semantic memory states, deriving finite-time bounds and an information-theoretic impossibility result: no gate observing only the generated transcript can uniformly improve over text-indistinguishable environments, while an environment-grounded gate can. The authors propose Stochastic Reflective Memory Ascent (SRMA), which accepts candidate memory only when grounded evaluation risk strictly decreases, with geometric or polynomial convergence guarantees. On 500 SWE-bench instances, a Kimi-based instantiation of the full system resolves 72.2% versus a 70.8% public mini-SWE-agent reference.

Hugging Face daily papers · 14d agoAI research1

AI Agents Are Here. So Are the Threats.

Unit 42 demonstrates nine framework-agnostic attack scenarios against AI agents built with CrewAI and AutoGen, causing data leakage, credential theft and remote code execution.

Palo Alto Networks Unit 42 investigated how attackers can target agentic applications, implementing two functionally identical apps with the open-source CrewAI and AutoGen frameworks and executing the same attacks on both. Nine attack scenarios produce outcomes including information leakage, credential theft, tool exploitation and remote code execution. Findings show most vulnerabilities are framework-agnostic, arising from insecure design patterns, misconfigurations and unsafe tool integrations rather than flaws in the frameworks themselves. The team published defense strategies per scenario and open-sourced the source code and datasets on GitHub.

Palo Alto Unit 42 · Aug 17, 2026AI safety & security

When AI Agents Go Rogue: Agent Session Smuggling Attack in A2A Systems

Unit 42 unveils agent session smuggling, where a rogue AI agent hides covert instructions in established Agent2Agent (A2A) protocol sessions to manipulate victim agents.

Palo Alto Networks Unit 42 discovered agent session smuggling, a new attack technique in which a malicious AI agent exploits an established cross-agent session under the Agent2Agent (A2A) protocol to send covert instructions hidden among benign client requests and server responses. The technique leverages the implicit trust agents place in collaborating agents and the stateful, multi-turn nature of A2A sessions; the researchers stress it affects any stateful protocol, not an A2A flaw. Unlike one-shot data-based attacks, a rogue agent can converse, adapt and build false trust over multiple interactions. Proposed mitigations include human-in-the-loop enforcement, cryptographically signed AgentCards for remote agent verification, and context-grounding to detect injected instructions.

Palo Alto Unit 42 · Aug 17, 2026AI safety & security2

[AINews] OpenAI to reach AGI bar by end-2026

OpenAI chief scientist Jakub Pachocki says unreleased Astra model meets the 'Automated AI Research Intern' goal; Altman expects internal AGI declaration by December 2026.

OpenAI chief scientist Jakub Pachocki says the unreleased Astra model fulfills the September 2026 'Automated AI Research Intern' target. Sam Altman told TIME he expects OpenAI to declare AGI achieved internally by December 2026. The roundup also covers Zhipu's GLM-5.3-Flash (320B total parameters, 18B active, 1M context), Google's Gemini Omni 1.1 Flash video model topping the Text-to-Video Arena, and the $399 open-source Microduck biped robot from Pollen Robotics and Hugging Face.

Latent Space · 19d agoAI industry

The Evolution of the Agent Harness

Latent Space essay argues late-2025 agent gains came from models and harnesses maturing together, with harness logic absorbed into model weights.

The piece defines the agent harness as everything beyond model weights—tools, context, memory, guardrails—and charts its evolution from ReAct prompting (October 2022) through AutoGPT's premature autonomy, Cursor/Copilot's human-in-the-loop retreat, and Devin's roughly 15% success rate, to o1's capability overhang and Claude Code's February 2025 terminal agent with permission rules. It argues the Christmas 2025 jump cited by Transformer co-inventor Lukasz Kaiser reflected model and harness curves crossing, and that remaining harnesses will serve human attention rather than the model.

Latent Space · 25d agoAI tools & infra

Cybersecurity jobs available right now: September 15, 2026

Help Net Security's weekly roundup lists cybersecurity job openings worldwide, from CISO roles to cloud security engineers at firms like Adobe, JPMorgan Chase, and PwC.

Help Net Security's September 15, 2026 job roundup lists cybersecurity openings across India, USA, UK, Australia, Canada, Israel, UAE, Ireland, and Denmark. Roles include a CISO at Texas Health and Human Services, a GenAI CBRNE Cyber Security Expert at Alice, and security engineering positions at Adobe, JPMorgan Chase, PwC, and the Reserve Bank of Australia. Several openings focus on AI security, including red-teaming AI models and securing AI agent platforms.

Help Net Security · 1d agoIndustry

Forgetting Without Restarting: Execution-State Unlearning for Stateful LLM Agents

Researchers propose provenance-guided selective replay letting LLM agents forget revoked information without restarts, matching full reset behavior.

The paper formalizes execution-state unlearning for stateful LLM agents, requiring that agents behave as if a revoked memory record was never observed across transcripts, compressed memory, tool plans, and KV caches. It proves exact unlearning requires at least T-τ+1 recomputed transitions and that Provenance-Guided Selective Replay attains this bound via a provenance graph, KV cache cropping, and sanitized replay. In audits across three agent suites, nine baselines, and three model families, memory deletion left leakage unchanged, instruction-based forgetting collapsed under elicitation (Leak@probes = 1.00), and selective replay matched full resets at up to 9x fewer recomputed tokens.

arXiv cs.CR · 12d agoAI safety & security1

NVIDIA NVLink Fusion Expands With NVHBM Custom High-Bandwidth Memory

NVIDIA expands NVLink Fusion with NVHBM custom high-bandwidth memory for hyperscalers building trillion-parameter and agentic AI infrastructure.

NVIDIA announced that NVLink Fusion will expand to support NVHBM, a custom high-bandwidth memory option. The offering targets hyperscalers and AI innovators building next-generation systems where agentic AI and trillion-parameter workloads are mainstream. NVIDIA frames the announcement around co-designing compute, memory, storage, networking, and software as a unified system.

NVIDIA Blog · 20d agoAI industry

UC Berkeley Researchers Release CUA-Lite, an Open Platform Unifying Sandboxes, Data, Evaluation and RL for Computer-Use Agents

UC Berkeley's CUA-Lite is an open platform unifying computer-use agent sandboxes, datasets, evaluation and RL; Lite.OSWorld cuts OSWorld memory 4.1 GB to 0.9 GB.

UC Berkeley researchers released CUA-Lite, an open platform placing agents, environments, traces, and training for computer-use agents behind one action space, one LiteSample schema, and one command across desktop, browser, and mobile. Lite.OSWorld reproduces the OSWorld task suite and evaluators in plain Docker containers (0.9 GB RAM vs 4.1 GB, cold start 23.8s, ~4.6× more parallel instances), with scores matching the QEMU/KVM VM across 13 models. The platform claims 30k+ verifiable tasks, 15+ benchmarks, 10+ agents, and 20+ datasets on Hugging Face including Aguvis, OpenCUA, and ScaleCUA. A documented SFT run lifts Qwen3-VL-2B-Instruct mean episode return from 0.138 to 0.237 on the 332-task lite.osworld split.

MarkTechPost · 10d agoAI tools & infra1

[AINews] Muse Spark 1.3 matches GPT-5.6-Sol, confirming Meta Superintelligence as the newest Frontier Lab, >90% discount for training

Meta's Muse Spark 1.3 reportedly ranks as the world's #3 model, matching frontier models from OpenAI and Anthropic with planned open weights.

The Latent Space AI News roundup leads with Muse Spark 1.3, promised in Zuckerberg's letter, which ranks #3 worldwide per AAII, is slated for open weights, and uses a pricing model over 90% cheaper when users opt in to training. The issue also covers the rumored Gemini 3.8 Flash launch and analysis arguing OpenAI's rumored looped-transformer 'Astra' architecture is a modest tweak rather than a breakthrough. Additional coverage includes ByteDance Seed's HarnessDev harness-evaluation benchmark, a retrieval-invoked actual-use evaluation method, Stanford's revamped agent engineering curricula, and Photon 2.1 adding TTS models and NVIDIA B200 support.

Latent Space · 13d agoModel release1

[AINews] OpenAI shuts off Cursor

OpenAI cut off API access to coding tool Cursor after its SpaceX acquisition, citing contract violations by Elon Musk's companies.

OpenAI disabled Cursor's access following the closing of Cursor's acquisition by SpaceX, citing its experience with Elon Musk's companies violating contracts; Cursor responded that OpenAI accounts for only 5% of its traffic. The weekly digest also covers major open-weight releases: Z.ai's GLM-5.3 (744B total/40B active, 1M context) and Tencent's Hy4-preview (770B/49B, ~#5 on Code Arena WebDev), plus Alibaba's Qwen3.8-Flash (125B/6B). vLLM published benchmarks showing no universal winner among speculative decoding methods across model families.

Latent Space · 18d agoAI industry

Procedural Graphs: Self-Evolving Execution Structures for LLM Agents

Procedural Graph framework stores procedural knowledge as triplets and self-evolves via LLM refinement, beating memory-based baselines across datasets, tasks, and LLMs.

The Procedural Graph organizes procedural knowledge into (procedure, relation, procedure) triplets; at each decision step the framework localizes the agent's active node and a guidance model translates the surrounding subgraph into step-level guidance that biases the solver's next action. An LLM refiner contrasts failed with successful trajectories and edits the graph's topology and attributes, retaining rejected edits to discourage repetition. Starting from a minimal skeleton, the loop builds graphs that match or surpass hand-designed ones and can repair flawed expert priors, delivering consistent gains over memory-based baselines across multiple datasets, task types, and LLMs.

Hugging Face daily papers · 8d agoAI research1

Exclusive: Paying for frontier AI models buys 4-month head start at 5x the cost

Mozilla report finds the capability gap between best open-weights (largely Chinese) and closed frontier AI models narrowed to 4.4 months at ~5x lower cost.

Mozilla's State of Open Source AI report (September 15) says the gap between closed frontier models and best open-weights models has closed to 4.4 months. Moonshot AI's Kimi K3 scores three points behind Anthropic's Fable 5 on the Artificial Analysis Intelligence Index at 30% of the cost, and Z.ai's GLM 5.2 scored within a point of Claude Opus 4.7 on Terminal-Bench 2.1. Eight of the top 10 OpenRouter models by August 2026 token volume provide open weights, though a Linux Foundation paper found open models earned only 4% of revenue. The report recommends open models as the default for routine workloads, reserving closed models for 8-12 hour expert tasks.

Ars Technica · AI · 1d agoAI industry1

How well do agents use test/verification techniques?

Dan Luu's eval finds coding-agent testing instructions (TDD, formal methods, PBT, skills) mostly fail to beat defaults on Zstd implementation correctness.

The author ran 26 prompt conditions plus 4 skills on a Zstd-in-Rust implementation eval using codex with GPT-5.6, testing TDD, fuzzing, property-based testing, formal methods (Lean 4, TLA+, Verus, Kani, SMT solvers) and community skills. Nothing dramatically outperformed the default no-instruction condition, which did above average; at xhigh effort, fuzzing and PBT conditions did slightly better than formal methods. Pre-registered predictions included TDD underperforming and popular test skills (ECC, Hegel, Trail of Bits) not outperforming. Results are averages of 80 runs per condition plotted against cost.

Hacker News · security · 8d agoAI researchHN 131↑ · 50 comments

One in four MCP servers opens AI agent security to code execution risk

Noma Security whitepaper finds most popular AI Skills and many MCP servers carry high-risk capabilities, with state changes most prevalent.

Noma Security analyzed hundreds of popular MCP servers and Skills across eight risk categories, finding most widely used Skills carry at least one risky characteristic and a typical enterprise runs well over a hundred high-risk agent tools, with arbitrary code execution common across MCP servers. The most prevalent risk is the ability to change state or data, and named toxic combinations include ContextCrush data leakage, ForcedLeak via poisoned Salesforce CRM records, DockerDash supply-chain compromise, the Replit production database deletion, and the hijacked Amazon Q VS Code extension. Building on OWASP LLM06:2025, the paper proposes the No Excessive CAP framework of capabilities, autonomy, and permissions, recommending allowlisting, MCP version pinning, approval gates on irreversible actions, and user-scoped expiring credentials.

Help Net Security · 23d agoAI safety & security