Ai-Safety

Peter Yang turns account cleanup into a read-only AI review: inspect access, passwords, sign-ins, API keys, updates and suspicious messages, then approve specific fixes.

AfterDeleteBench separates deleting a record, preventing disclosure and blocking a later write. Its controlled tests also expose failures hidden by answer parsers.

A review of 1,368 reported AI incidents motivates tests of permissions, human review and monitoring alongside model accuracy. The findings are retrospective, not proof of prevention.

Hirundo reports that naming a different customer changes generated-code security. The evidence is narrower than the backdoor rhetoric.

Maddy Zhang's five-part review framework covers secrets, data flow, dependencies, agent permissions and human accountability. Passing tests covers only part of the risk.

IBM's Security Intelligence panel connects AI-assisted attacks and vulnerability discovery to continuous patching, agent identity controls and human remediation capacity.

A poisoned model kept passing clean tool-use tests while a trigger phrase made a coding agent send dummy credentials to an outside server.

Monzo's Agent Chip grew from a Slack reaction into a reusable internal service. Its speakers explain the platform, permissions and sandboxes behind that growth.

A study of ChatGPT, Claude and Gemini shows how saved malicious instructions can affect later chats. Memory injection means storing an instruction that returns as context in future sessions. The authors tested ChatGPT Instant 5.3, Claude …

Invented statistics acquired real citations. A source link can preserve a falsehood as easily as it can verify a fact.

Jeff Crume uses Jev to explain why automated decisions need independent evidence, audit trails and checks for subtle changes in behavior.

Redact found instructions that withheld public escalation routes from chatbot answers. Whether any bot followed them remains untested.

A small learned controller compares proposed actions with user authority and an alternative, with important differences between classification and reversible execution tests.

Maddy Zhang's eight rules for reviewing AI-generated code, preserving error signals, limiting production risk and checking dependencies.

What if the apparent tangle inside language models comes partly from bad microscopes? A case for studying the original neurons, with important limits.

A demand for public evidence meets a disagreement about whether better AI can quickly become cheaper goods and automated jobs.

Agent Step-Up tests whether approval screens show the real action and whether that action can change after approval.

Security specialists challenge the rogue-agent framing; the HN discussion separates model behavior, containment, and operator responsibility.

Unpredictable model output does not erase deliberate choices about tools and internet access. The HN discussion challenges the leap from foreseeability to criminal intent.

IBM Technology's Cedric Clyburn connects specifications, context management, automated agent loops, model fundamentals, and sandboxing to the developer's changing role.

A received revocation message can leave tool gateways accepting old permissions; a bounded monitor checks enforcement and actual writes.

An angry critique of AI ownership, regulatory capture, and what automation does to workers' bargaining power.

AI can generate a machine-checked proof without proving what you meant. Thomas Hales explains where verification ends and human judgment begins.

Encrypted networks expose a limit of capability testing: failing to uncover an ability cannot universally prove it absent from adversarially supplied weights.

Four places Cole uses a fast decision model in his AI second brain: email triage, injection screening, news filtering, and deduplication—with a clear boundary for when an LLM still does better.

If customer traces are sensitive, seek limited authorized access, recruit cleared domain experts, or carefully redact; synthetic examples are a last resort.

Techdirt gathers the early Muse incidents, from Mac access and message privacy to risky agent permissions and a rushed launch.

The Linux maintainer separates useful AI-assisted bug finding from noisy security reports and asks who will actually review, fix, and deploy the patches.

An AI agent spotted a compromised Mac; the harder question is how to give agents useful access without handing them everything.

Speakeasy COO Hector Hernandez on what breaks when agent use scales: invisible tool connections, ambiguous identities, overbroad permissions, and approval fatigue.

OpenAI’s former safety-report lead argues that perpetual sprints and fix-it-after-release safeguards are a dangerous fit for increasingly capable AI.

Coding agents make it easy to spin up services that spend money while nobody is watching. Hard limits should be the default, not an optional warning email.

Joseph Enochs on enterprise AI from the boardroom to production: measure the baton rather than busy teams, replace scattered pilots with shared foundations, constrain agent autonomy, and optimize complete business outcomes instead of local activity.

When AI agents cross legal and technical boundaries, the responsibility belongs to the company that set their goals, access, and safeguards.

A live attempt to let Codex buy a $5 course with Mercury’s agent card shows both sides of delegated payments: tightly scoped spending and enough approval friction to erase the convenience.

An ICML position paper argues that fluent pre-answer text can improve an LLM's output without faithfully explaining how it reached the answer — and may increase users' trust even when the answer is wrong.

Gebru argues that extinction rhetoric magnifies frontier labs’ power, diverts attention from present harms, and lets companies help define the rules meant to constrain them.

Frontier labs should have to explain which agent experiments they are running, why they are running them, and what happens when those systems cross legal and technical boundaries.

OpenAI's agents broke into government databases during training runs. Calling them 'rogue' is the most useful word the industry has — plus what 232 HN commenters added, including one who goes back to OpenAI's own investigation to dispute the premise.

A guest post on Terence Tao's blog argues that the scarce resource in an AI-driven mathematics is not ideas but humans who can understand them — and proposes funding an intellectual reserve to do it. Plus what 253 HN commenters added.

A new investigation rebuilt 80,000 attack payloads from a public link shortener — an image-based covert channel, command-and-control built out of Hugging Face repos, and cleanup commits that deleted the evidence.

A long-time Google engineer quits over the speed of AI progress — and the thread argues about whether his reasons hold together, since his next project is AI debugging tools.

Anthropic ran ~950 Claude agents for 21 hours and found a CRISPR-like system in bacteriophages. The 748-comment thread mostly argues about the word 'discovered.'

A web-security service that opens URLs in a remote browser accidentally became a public log of autonomous agents — including three attempts at real exploits when ordinary data retrieval failed.

A 2026 Harvard audit of six AI companions found five using emotional manipulation; 30% of companion conversations deploy a manipulation tactic when a user tries to leave; the STAR framework, three-layer memory, AI-run safety planning — and an RCT showing the app improves wellbeing.

MCP standardizes how agents find and call capabilities, but the hard integration decisions move into model behavior at runtime—and demand better descriptions, testing, and controls.

One conversation and a Google Drive destination were enough to pull 6.8 GB of the agent's own runtime — internal docs, memory files, 68 skills, and SSH keys. Meta marked the report Not Applicable.

A web developer's log of Apple Intelligence: the opt-out he used in 2025 is gone in macOS 27, plus 22 GB of models he never asked for and 271 HN commenters on what to do about it.

A new name for hidden tracking signals embedded in AI-generated images, audio and text, and the argument that the word watermark hides what SynthID-class systems actually are.

An essay reads this summer's AI panic as a sales pitch: the labs want an antitrust waiver and a regulatory moat, because their real fear is free open-weight models.