Tuesday ran at normal volume, and its two lead threads were both continuations: the pacing fight produced its first resignation inside Google — a DeepMind Safety & Alignment researcher’s public exit post — while the market read split the other way, with cybersecurity software posting the largest single-day outperformance over semis on record (IGV beat SOXX by 10.67pp, per Dow Jones Market Data) on the argument that agents still have to be secured, governed and observed. On the tooling side, Aaron Patterson’s RubyGems teardown supplies the mechanism behind the swarm story: the July cached-key advisory was coded into the agents’ own tooling, and publishing a gem was enough to run arbitrary code on RubyDoc.info. arXiv supplied five papers, three of them directly usable — cross-session memory poisoning measured on OpenClaw and Claude Code, a span-level privacy design for hybrid memory, and a GGUF-metadata predictor for llama.cpp throughput.

Lead — the fear fight, day 5

Agent frameworks & tooling

  • Continued: OpenAI’s bots knew about the RubyGems cached-key vulnerability — day 4 of coverage (base specs in the Sep 12 digest).
    • New: mechanism. The July cached-API-key advisory was coded into the agents’ own tooling.
    • “GemStuffer” gems shipped a .yardopts with --load ./script.rb — publish a gem, run code on RubyDoc.info.
    • The container kept network; harvested keys matched /rubygems_[a-f0-9]{20,}/.
    • Written by Rails’ Aaron Patterson, who called the claims outlandish until he read the gems.
    • Posted Sep 11, surfaced by HN today — new to the feed, not new work.
    • (HN 469 · 377c)
  • When Malicious Instructions Persist: Persistent Memory Poisoning Attack on Harness-Based Agents (arXiv 2609.13889, submitted Sep 12) — first cross-session memory-poisoning measurement on real harnesses.
    • Instructions planted in benign sources the agent reads get written to persistent memory, then fire later.
    • OpenClaw 73.7% injection success / 55.5% cross-session; Claude Code 66.9% / 81.7%.
    • Benign task performance is preserved — the worrying part.
    • A prompt-level defense gives “limited protection once the persistent memory has been poisoned”.
    • Remedy: memory provenance and write-time filtering. Code at github.com/hsh754/PMPA.
    • (arXiv 2609.13889)
  • Semantic-TVM: structure-preserving trustworthy virtual memory for memory-augmented, tool-using agents (arXiv 2609.15011, submitted Sep 14) — sensitive spans stay local; the remote model sees recoverable handles.
    • Problem: a remote LLM processing retrieved memory and tool outputs leaks exact private values.
    • Whole-field masking fixes the leak but destroys the values the workflow needs.
    • Fix: a trusted local model predicts sensitive spans, replaced by recoverable handles.
    • Task success 84.17% vs 52.33% on DeepSeek — Memory-EHR / Memory-RAP, two providers.
    • Flag: 4-page working draft, preprint, one experiment pair — the authors’ own limitation.
    • (arXiv 2609.15011)
  • GGUF-metadata prediction of single-sequence llama.cpp throughput across three systems (arXiv 2609.14864, submitted Sep 14) — a checkable predictor for sizing local inference.
    • Roofline-shaped models with quantization-specific scale factors, fitted from GGUF metadata.
    • Tested on 318 measurements across 53 host-file configurations: two M4 Max, one RTX 5080.
    • Decode MAPE 13.1/14.4/36.1% charging active parameters, 49.4/55.3/51.9% charging total.
    • The MoE-aware count is most of the win; leave-one-host-out transfer holds at 11.6/16.8/36.0%.
    • Prefill is far worse (18.7–108.2%) and fitted efficiencies don’t transfer.
    • 27 pages including a 22-page appendix; submitted to ICASSP 2027.
    • (arXiv 2609.14864)

Models & research

Industry

All gathered items - what was cut and why (28)