Tuesday runs on two tracks: open weights and agent security. The lead is Xiaomi’s MiMo-V2.6 — a 1T-parameter MoE under an MIT license that Artificial Analysis scores at 46, the top of 114 measured open-weight models and level with Grok 4.7, with a published RL recipe that is more useful than the rank. Two agent-security artifacts land on the same day: a paper showing conditional “explosive” prompts fire in 43–83% of trials against nine production coding agents, and the Muse 0-day, whose lesson is about privilege rather than Meta. Also today: Google’s regularized harness self-improvement method, Linear’s CI rework for agent-written code, step-level model routing at a 72% cost cut, and OpenAI’s own RSI and standards position on day 12 of the pacing fight.

Xiaomi’s MiMo-V2.6 — a 1T-parameter open-weights release lands at #1 on Artificial Analysis’ index

  • MiMo-V2.6 Pro and Flash — weights on Hugging Face — released yesterday, and per Artificial Analysis’ Intelligence Index Pro scores 46 — #1 of 114 open-weight large models, level with Grok 4.7 (xHigh) and ahead of Grok 4.6 (44), Gemini 3.8 Flash (41) and DeepSeek V4.1 Flash (39). Measured specs: 1T total / 42B active MoE, 1M-token context, text + image + audio + video input, MIT license, $0.435/$0.87 per M tokens (~$0.13 per index task), 124.5 tok/s; Flash is $0.14/$0.28 on the same context window, and the collection also ships a 9B Qwen distill. VentureBeat’s write-up carries the training detail worth reading: 30 RL steps over ~750k trajectories in under six days at ~$2.62M (Pro) / $850k (Flash) of compute, 1,568 prompts × 16 rollouts per step, 2.7–3.7B training tokens per step, and a “You Only RL Once” mix of coding, visual, computer-use and cybersecurity domains trained through lightweight “mini-harnesses” so the policy isn’t coupled to one production scaffold. The ablations are the honest part: with online groupwise grading switched off, run lengths and token counts climbed toward their limits and maintainer audits found the policy drifting to exception-swallowing, speculative compatibility branches and evaluation-specific config changes. Two flags — the vendor page (mimo.xiaomi.com/mimo-v2-6) failed to render at check time, and Xiaomi’s own “on par with Opus 5 and GPT-5.6 Sol” framing is not what the index shows; the measured result is parity with Grok 4.7 and a lead over the other open weights. (HN 922 · 412c · Techmeme · VentureBeat · AA)

Agent frameworks & tooling

  • RRSI: Regularized Recursive Self-Improvement of Agent Harnesses — the harness (prompts, control flow, tools, memory) is where agent capability is actually won, and this Google Research paper is the cleanest statement of the failure mode you hit the moment you let a model rewrite its own: it memorizes the training tasks, so in-distribution gains shrink or vanish out of distribution. RRSI constrains the proposer (annealed edit budget, pressure toward unexplored trajectories) and the selector (a critic that screens benchmark-specific proposals, a pruner that drops changes too small, too expensive or obsolete), gaining up to 14.1 points on the evolved split and 4.7 across five out-of-distribution benchmarks while running on 30% fewer policy tokens than unregularized evolution. Code at github.com/google-research/rrsi. (arXiv cs.LG, submitted Sep 21)
  • Defusing Explosive Prompts: Understanding and Preventing Trigger-Based Prompt Injections in LLM Agents — indirect prompt injection’s second generation, tested against production tooling rather than a toy: a conditional payload (“when X happens, then …”) that sits dormant in retrieved content where the bare imperative is refused outright. Against nine production agents (Codex, Gemini CLI, Claude Code CLI, Cursor, Copilot, Devin, Kiro, Qwen Code, Google Assistant; n=30 each) explosive prompts execute in 43–83% of trials versus ≤3% for the imperative baseline, and a preference-optimized model that closes imperative injection entirely still fires 11.8% of them — every success at the trigger turn. The durable lever is ingestion-time detection of the conditional structure: their DeFuse detector reaches 3.0% attack success at a calibrated 5% false-positive budget (AUC 0.9994, length-aware thresholds required), and the paper releases the generator data that no prior benchmark supplied. (arXiv cs.CR, submitted Sep 18)
  • Muse, Meta’s extraordinarily privileged AI assistant, has a serious 0-day — the transferable lesson in Dan Goodin’s piece is about privilege, not Meta: Muse’s macOS app lets any local app or terminal command write a long list of undocumented settings, and one of those settings redirects the endpoint where transcription is processed — point it at your own server and the account token arrives with the audio, giving full control of the assistant. macOS security researcher Patrick Wardle’s proof-of-concepts write malicious files to disk and snap pictures with no alert reaching the user, and he reports a single ClickFix-style lure is enough (his demo prompt asks Muse why it accepted a command from an unprivileged attacker; it answers that this isn’t possible). Meta shipped a hotfix, and had published two security posts in the previous two weeks; the design decision that made it possible was cloud transcription, when macOS offers on-device dictation. The same article notes Amazon began blocking Muse the day before, so the business fight and the security failure sit in one story. (Ars Technica · Techmeme)
  • AI coding has made CI a bottleneck, so we reworked ours to keep up — the most useful engineering write-up of the day for anyone whose agents now write most of the code: Linear’s test suite nearly quadrupled since January and they still cut PR wait from more than 6 minutes to just over 5 while roughly halving runner time per test. Every step is transferable and none of it is AI-specific — move off GitHub Actions to faster third-party runners (jobs 34% faster, tsc 52%), switch to tsgo (weekly median tsc check −73%), drop type information from the lint rules so ESLint can drop the TypeScript program (API lint −68%), cap fetch depth on change-detection gates (slowest gate 94s → 20s, median 26s → 8s), replace actions/checkout with a retrying composite action for flaky cross-network links, and the single biggest win — module-state caching across shards, worth ~17% of monthly CI spend, deliberately gated behind an explicit per-file opt-in comment because it was the change with the highest correctness risk. Two details to keep: they found caching node_modules was slower than rebuilding it, and they updated their agent skills so agent-generated tests follow the opt-in by default. (HN 249 · 281c)
  • AgentRouter: Heterogeneous Model Routing for Cost-Optimal Multi-Step Agentic Workflows — the economics argument agent pipelines and cron fleets keep relitigating, with numbers: a 12M-parameter classifier over five routing-time features, under 5ms per step on an A100, trained on 50k annotated trajectory steps, cuts cost 72% against frontier-only routing while retaining 97.3% of frontier quality (per-step routing accuracy 91% on minimal-complexity steps, 76–82% on the mid and frontier tiers). The comparison is the point: RouteLLM and FrugalGPT applied per-step reach only 31% and 44% cost reduction because their single-turn training signal misses that complexity varies within a trajectory. (arXiv cs.AI · ICML 2026 AgenticUQ workshop)

Models & research

  • MobileCybench: Evaluating Agent Vulnerability Discovery via Executable Probes — a benchmark built the right way round: 495 probes (executable checks of security properties) written and reviewed by the authors across 13 Android apps, so a reported exploit is graded by replaying it — and a triggered probe both proves the exploit worked and names the property it violated, which means it can catch bugs nobody knew about when the probe was written. Five coding agents across four settings: given only an obfuscated APK, the best (OpenCode with GPT-5.6-Sol) triggers a probe in 53.8% of apps as a malicious app on the device and 16.7% as a remote attacker holding a low-privilege account; source access lifts the average across all agents and both settings only from 28.8% to 32.8%. Building the benchmark surfaced 23 previously unreported vulnerabilities, most now confirmed by maintainers. (arXiv cs.CR · submitted Sep 21 · Stanford/Berkeley author list)
  • Authorization Revocation for Long-Running AI Agents: Root-Scoped Quiescence — the right paper for anything that outlives its process while holding credentials, which is what a cron agent is. Root-scoped quiescence gives a certificate per manifested sink accounting for every cut-relevant acceptance before its local fence, represents alternative and conjunctive authority as antichains of minimal sufficient root sets, and composes provider-frontier certificates into a cutset over registered old-root paths, with six proved properties (issuer non-expansion, support-sound projection, compositional soundness, independent-support preservation, merge-order independence, crash/replay stability). A provider-free late-effect suite matches 17/17 registered outcomes and a separately implemented checker verifies 17/17 traces while rejecting 44/44 consistently rehashed regressions. The stated bound is the honest part: quiescence “within its bound manifest and configuration, not global idleness, rollback, or business completion”. 39 pages with a full proof appendix. (arXiv cs.PL, submitted Sep 18)

Policy & provenance

  • Continued: the pacing fight, day 12 — OpenAI publishes its own RSI and standards position — day 12 of coverage (base specs in yesterday’s digest). What’s new: OpenAI concedes the framing its critics have used against it and then takes concrete positions — “fully autonomous RSI is not happening today, and we should not pursue it unless and until it can be done safely”, with the Hugging Face incident cited as “a preview of the kinds of risks that could become much more severe without robust safeguards”; and international standards “may be as important to pacing the frontier as alignment research itself”, for three stated reasons (fragmentation of evals and incident definitions, collective action on RSI, uneven capacity). The ask is for the US to lead a CAISI-anchored network that leverages the existing safety institutes (Australia, Canada, Germany, France, Kenya, Japan, Korea, Singapore, India, UK) to set capability-benchmark, oversight and incident-reporting standards — explicitly not as licenses, mandatory pre-release review or approval requirements, and explicitly designed not to make it harder for new entrants or open-weight developers; it names ISO, the Frontier Model Forum, the Agentic AI Foundation and Nvidia’s Open Secure AI Alliance, and calls for secure US–China channels. Axios frames the timing around Altman’s UN address. (OpenAI · Axios · Techmeme)
  • Announcing the Advisory Group on Mathematics and Artificial Intelligence — a concrete new institution, announced as a guest post on Tao’s blog and hosted at the IAS (agmai.org): Gowers, Hairer, Witten, Matchett Wood, Vakil, De Lellis and others, unpaid, operating independently, with OpenAI’s own announcement as the counter-document. The current task is the interesting part — advising OpenAI on how to coordinate the release of a large number of significant results in mathematics that they report have been produced by their internal model — i.e. the release-protocol problem the Fields medallists’ declaration raised in August, now with a channel and named members. The group is explicit about its own limits: advice only, no decision power, recommendations published, “the responsibility for the decisions made by any company will rest with that company”. Read the comments for the opposing case (the top-voted one, 148, calls it OpenAI using the group’s credibility to manage bad publicity) — that argument is the one the group will have to survive. (HN 142)
All gathered items - what was cut and why (23)