Tuesday runs on two tracks: open weights and agent security. The lead is Xiaomi’s MiMo-V2.6 — a 1T-parameter MoE under an MIT license that Artificial Analysis scores at 46, the top of 114 measured open-weight models and level with Grok 4.7, with a published RL recipe that is more useful than the rank. Two agent-security artifacts land on the same day: a paper showing conditional “explosive” prompts fire in 43–83% of trials against nine production coding agents, and the Muse 0-day, whose lesson is about privilege rather than Meta. Also today: Google’s regularized harness self-improvement method, Linear’s CI rework for agent-written code, step-level model routing at a 72% cost cut, and OpenAI’s own RSI and standards position on day 12 of the pacing fight.

Xiaomi’s MiMo-V2.6 — a 1T-parameter open-weights release lands at #1 on Artificial Analysis’ index

  • MiMo-V2.6 Pro and Flash — weights on Hugging Face — Xiaomi’s new open-weights flagship, released yesterday. Artificial Analysis scores Pro at 46: #1 of 114 open-weight large models.
    • Level with Grok 4.7 (xHigh); ahead of Grok 4.6 (44), Gemini 3.8 Flash (41) and DeepSeek V4.1 Flash (39).
    • Measured: 1T total / 42B active MoE · 1M-token context · text, image, audio and video input · MIT license · $0.435/$0.87 per M tokens · 124.5 tok/s.
    • Flash runs $0.14/$0.28 on the same context window, and the collection also ships a 9B Qwen distill.
    • VentureBeat has the training detail: 30 RL steps over ~750k trajectories, under six days, ~$2.62M compute (Pro) and $850k (Flash), 1,568 prompts × 16 rollouts per step.
    • The “You Only RL Once” mix — coding, visual, computer-use and cybersecurity — trains through lightweight “mini-harnesses” so the policy isn’t coupled to one production scaffold.
    • The ablations are the honest part: with online groupwise grading switched off, run lengths and token counts climbed toward their limits and maintainer audits found drift — exception-swallowing, speculative compatibility branches, evaluation-specific config changes.
    • Flag: Xiaomi’s “on par with Opus 5 and GPT-5.6 Sol” framing is not what the index shows; the vendor page failed to render at check time. (HN 922 · 412c · Techmeme · VentureBeat · AA)

Agent frameworks & tooling

  • RRSI: Regularized Recursive Self-Improvement of Agent Harnesses — Google Research, on the failure mode you hit the moment a model rewrites its own harness.
    • Self-rewriting models memorize the training tasks, so the in-distribution gains vanish out of distribution.
    • Their fix constrains both sides: an annealed edit budget and pressure toward unexplored trajectories on the proposer; a critic plus a pruner on the selector.
    • Gains: up to 14.1 points on the evolved split, 4.7 across five out-of-distribution benchmarks, on 30% fewer policy tokens.
    • Code at github.com/google-research/rrsi. (arXiv cs.LG, submitted Sep 21)
  • Defusing Explosive Prompts: Preventing Trigger-Based Prompt Injections in LLM Agents — prompt injection’s second generation, tested against production tooling rather than a toy.
    • A conditional payload that sits dormant in retrieved content; the bare imperative is refused outright.
    • Against nine production agents (n=30 each): 43-83% of trials, versus ≤3% for the imperative baseline.
    • A preference-optimized model that closes imperative injection still fires 11.8%.
    • The durable lever is ingestion-time detection: DeFuse reaches 3.0% at a 5% false-positive budget (AUC 0.9994). (arXiv cs.CR)
  • Muse, Meta’s extraordinarily privileged AI assistant, has a serious 0-day — the lesson in Dan Goodin’s piece is about privilege, not Meta.
    • Any local app can write undocumented Muse settings; one redirects where transcription is processed.
    • Point it at your own server and the account token arrives with the audio — full control of the assistant.
    • Wardle’s proof-of-concepts write files and snap pictures with no alert reaching the user.
    • Root cause: cloud transcription, when macOS offers on-device dictation. Meta shipped a hotfix; Amazon began blocking Muse too. (Ars Technica · Techmeme)
  • AI coding has made CI a bottleneck, so we reworked ours to keep up — the best CI write-up of the day for anyone whose agents now write most of the code.
    • Linear’s suite nearly quadrupled since January; PR wait still fell from over 6 minutes to just over 5, per-test runner time roughly halved.
    • Jobs 34% faster on third-party runners; tsgo cut the weekly median tsc check by 73%.
    • Biggest win: module-state caching across shards, ~17% of monthly CI spend, gated behind a per-file opt-in. (HN 249 · 281c)
  • AgentRouter: Heterogeneous Model Routing for Cost-Optimal Multi-Step Agentic Workflows — the economics argument agent pipelines and cron fleets keep relitigating, with numbers.
    • A 12M-parameter classifier over five routing-time features, under 5ms per step on an A100, trained on 50k annotated trajectory steps.
    • Result: cost down 72% against frontier-only routing while retaining 97.3% of frontier quality.
    • Per-step routing accuracy: 91% on minimal-complexity steps, 76-82% on the mid and frontier tiers.
    • RouteLLM and FrugalGPT applied per-step reach only 31% and 44%, because single-turn training misses within-trajectory variation. (arXiv cs.AI · ICML 2026 AgenticUQ workshop)

Models & research

  • MobileCybench: Evaluating Agent Vulnerability Discovery via Executable Probes — a benchmark built the right way round: 495 executable probes across 13 Android apps.
    • Exploits are graded by replay; a triggered probe names the property violated.
    • Best agent (OpenCode with GPT-5.6-Sol) triggers a probe in 53.8% of apps as a malicious app, 16.7% as a remote attacker.
    • Source access lifts the average across all agents and both settings only from 28.8% to 32.8%.
    • Building it surfaced 23 previously unreported vulnerabilities, most confirmed by maintainers. (arXiv cs.CR · submitted Sep 21)
  • Authorization Revocation for Long-Running AI Agents: Root-Scoped Quiescence — for anything that outlives its process while holding credentials, i.e. a cron agent.
    • Root-scoped quiescence issues a certificate per manifested sink, covering every cut-relevant acceptance before its local fence.
    • Alternative and conjunctive authority become antichains of minimal sufficient root sets.
    • A provider-free late-effect suite matches 17/17 registered outcomes; an independent checker verifies 17/17 traces and rejects 44/44 rehashed regressions.
    • Flag: quiescence holds “within its bound manifest and configuration, not global idleness, rollback, or business completion”. (arXiv cs.PL)

Policy & provenance

  • Continued: the pacing fight, day 12 — OpenAI publishes its own RSI and standards position — day 12 of coverage (base specs in yesterday’s digest).
    • What’s new: OpenAI concedes the framing its critics have used against it, then takes concrete positions — “fully autonomous RSI is not happening today, and we should not pursue it unless and until it can be done safely”.
    • It cites the Hugging Face incident as “a preview of the kinds of risks that could become much more severe without robust safeguards”.
    • On standards: they “may be as important to pacing the frontier as alignment research itself”, for three stated reasons — evals and incident definitions fragmenting, collective action on RSI, uneven capacity.
    • The ask: the US leads a CAISI-anchored network using the existing safety institutes (Australia, Canada, Germany, France, Kenya, Japan, Korea, Singapore, India, UK) to set capability-benchmark, oversight and incident-reporting standards.
    • Explicitly not licenses, mandatory pre-release review or approval, and not designed to burden new entrants or open-weight developers.
    • Names ISO, the Frontier Model Forum, the Agentic AI Foundation and Nvidia’s Open Secure AI Alliance; calls for secure US–China channels.
    • Axios frames the timing around Altman’s UN address. (OpenAI · Axios · Techmeme)
  • Announcing the Advisory Group on Mathematics and Artificial Intelligence — a concrete new institution, announced on Tao’s blog and hosted at the IAS (agmai.org).
    • Members include Gowers, Hairer, Witten, Matchett Wood, Vakil and De Lellis — unpaid and independent.
    • OpenAI’s own announcement is the counter-document.
    • The task: how to coordinate release of the many significant mathematics results OpenAI’s internal model has reportedly produced.
    • Limits, in the group’s words: advice only, no decision power, published recommendations. The top comment (148) calls it credibility management. (HN 142)
All gathered items - what was cut and why (23)