Vol. 1 · No. 8 Independent signal for people building with AI Price: your attention
The Early Edition

What changed, what it costs you, and where to check it.

Wednesday, 16 September 2026 18 printed Archived edition

SSE on, auth off

Seven CVE records in two days describe one MCP fault: a network transport, every interface, no login

Two of them score a perfect 10. The trigger is a transport setting: MCP_TRANSPORT=sse on the MySQL server, SSE=true on the GitLab one, run_sse on PraisonAI. The stdio default was never affected, and the fixes are version numbers.

By the Newsroom · From the NVD records and the projects’ own advisories, all read 16 September

ServerWhat opens itScoreFixed in
MySQL MCP ServerMCP_TRANSPORT=sse10.00.4.2
@zereight/mcp-gitlabSSE=true, the Docker default9.82.1.27
@zereight/mcp-gitlab, Streamable HTTPno Host or Origin allowlist9.62.1.30
Bifrost gatewayauth_config.is_enabled=false, the default9.8transports/v2.1.0
PraisonAI ToolsMCPServerrun_sse binds 0.0.0.09.8praisonaiagents 1.6.59
PraisonAI MCPServer.startHttpno host restriction, no auth9.81.7.2
PraisonAI UI /api/mcp/connectcaller supplies command and args9.84.6.59
Where the port opened and the version that closes it. Scores are CVSS 3.1 base scores as recorded by the NVD.

The NVD published CVE-2026-59971 on 15 September at 10.0 out of 10 on CVSS 3.1, for a MySQL MCP server.

It answers unauthenticated SQL the moment its transport is set to SSE. The seven records in the table fail the same way, and none of them is a bug in MCP. The bug is a setting that turns a local pipe into a network service and changes nothing else.

The MySQL record is specific about the mechanism. Setting MCP_TRANSPORT=sse makes the server “construct SseServerTransport without security_settings or enable_dns_rebinding_protection”, the routes /, /sse and /messages/ “have no authentication”, and the service “binds to 0.0.0.0 by default”. A caller on the network reaches execute_sql directly. A caller who cannot reach it uses DNS rebinding to make a browser on the same machine relay the request. Where the MySQL account holds FILE privileges, the record says, the same path “may enable code execution”. The stdio transport “is not affected”, and 0.4.2 closes it.

The GitLab server, @zereight/mcp-gitlab, is the same fault with a worse payload. Before 2.1.27, its record says, SSE=true “exposes all MCP tools without any authentication”, one of which, upload_markdown, reads any file the process can and pushes it to a GitLab project. The record spells out the chain: read /proc/self/environ, take GITLAB_PERSONAL_ACCESS_TOKEN, own the account. The costliest line is the last one: “This is the default configuration for Docker deployments.” Two more records on the same package, at 9.6 out of 10 each, add DNS rebinding through the Streamable HTTP endpoint, fixed in 2.1.30, and a request header that redirects the server’s own token to a host the caller names.

Bifrost, an AI gateway, shows the shape without the flag. JFrog’s record says a stdio MCP client “is a command plus args” and that “Bifrost starts that program in the gateway the moment the client is added. No MCP handshake required.” The default governance.auth_config.is_enabled=false means, in the record’s words, “every caller is a local admin”, so one unauthenticated POST to /api/mcp/client runs a program as the gateway’s user. Version transports/v2.1.0 answers that registration with a 403; v2.0.0 still does not.

PraisonAI accounts for twenty-eight of the sixty-one records this paper pulled from the NVD for 14 to 16 September, and the transport fault appears in it three times. ToolsMCPServer.run_sse binds 0.0.0.0 and creates /sse and /messages/ “without invoking the available SecurityConfig authentication”, which is the record’s way of saying the guard existed and was not called. MCPServer.startHttp in the TypeScript package “binds without a host restriction” and forwards every POST to the handler unauthenticated. The UI’s /api/mcp/connect takes a command and its arguments from any caller and starts the process “even when the MCP handshake later fails”. The same habit runs through the project’s non-MCP surfaces, a Jobs API at 9.8 out of 10 and an AgentOS at 9.4, and two of the records call the 1.7.2 fix “an initial remediation”.

The objection is that this is one week’s disclosure queue, not a trend, and that twenty-eight records from one project are one researcher’s afternoon. Both are true, and neither helps. The MySQL and GitLab servers are separate projects by separate authors, both defaulted their network mode open, and the Serena record from 14 September, scored 2.9, quotes the maintainer calling a 0.0.0.0 listen address “a potential security hazard” while the documentation of the time recommended a sandbox rather than a different address. The pattern is a design habit, not a coincidence of the calendar.

The MySQL record names why the setting does this: the SDK’s transport object takes security_settings and enable_dns_rebinding_protection as arguments, and an author who constructs it without them gets a listener with neither. Nothing in the protocol or its SDKs makes an unauthenticated network listener an error. The MCP Go SDK this paper covered yesterday bounded the size of what a server will read; it did not bound who may send it.

The paper’s verdict is a grep before a patch list. Search your MCP configuration for any transport that is not stdio, and for each hit answer two questions: what authenticates a caller, and what address does it bind. If either answer is nothing, that server is one of these records whether or not its CVE has been filed yet. Then take the patch list: 0.4.2, 2.1.30, transports/v2.1.0, and for PraisonAI every version boundary in the table rather than one.

None of the seven records reports exploitation. All seven were published on 14 and 15 September, and the settings that opened the ports are older than any of the records, so the exposure predates the news by however long each flag has been set.

What it changes Grep your MCP configuration for any transport other than stdio. For each, name what authenticates a caller and what address it binds; if either is nothing, treat it as exposed now. Then upgrade: MySQL MCP Server 0.4.2, mcp-gitlab 2.1.30, Bifrost transports/v2.1.0, and every PraisonAI boundary in the table.

Primary source read

NVD record, CVE-2026-59971, MySQL MCP Server GHSA-rqfv-2mw9-78g2, designcomputer/mysql_mcp_server NVD record, CVE-2026-61560, @zereight/mcp-gitlab SSE mode NVD record, CVE-2026-61568, @zereight/mcp-gitlab DNS rebinding NVD record, CVE-2026-90898, Bifrost Bifrost transports/v2.1.0 release NVD record, CVE-2026-57123, PraisonAI ToolsMCPServer.run_sse NVD record, CVE-2026-57139, PraisonAI MCPServer.startHttp NVD record, CVE-2026-57124, PraisonAI UI /api/mcp/connect NVD record, CVE-2026-38924, Serena listen address

Today’s premise Seven vulnerability records in two days describe the same MCP server, one whose author flipped a transport setting and got a network service with no login on every interface. Beneath it, three sandboxes built from blocklists, and the one lab release of the week, which kept the price and moved the defaults. The science page measures three checks that pass while the thing they check for is absent, and the corrections column reports that yesterday’s paper said a page had not changed when it had. 18 printed, 28 cut. 14 of the cuts are named below.

Inside this edition

18 stories across 4 beats

Infrastructure

Models

Tooling

Science

Same card, new defaults

Google priced Gemini 3.8 Live with the preview it replaces, and moved four defaults under the model string

Two voice models went generally available on 15 September on one rate card with gemini-3.1-flash-live-preview. Swap the string and asynchronous tool calls, always-on proactive audio and video on every turn come with it.

Settinggemini-3.8-livegemini-3.8-live-extended-thinking
Function callsNON_BLOCKING by default; BLOCKING per toolNON_BLOCKING only; BLOCKING is a hard error
thinking_levelnot acceptedlow, medium or high; MINIMAL refused
proactive_audio: falsereturns an errorreturns an error
Affective dialogueremoved from the APIremoved from the API
turnComplete: trueinterrupts generationno longer means idle; read interaction_status
Video framessent by defaultsent by default
Each row is a default or restriction that Google’s migration notes say differs from gemini-3.1-flash-live-preview.

Google released gemini-3.8-live on 15 September with asynchronous tool calls as the default and the preview’s price.

Its sibling, gemini-3.8-live-extended-thinking, went generally available the same day, and the pricing page lists both with gemini-3.1-flash-live-preview, the model the migration notes tell you to leave. The price is not the story. The defaults are: a model string swap that costs nothing changes what your tool calls do, what the model says unprompted, and what a finished turn means.

The card reads $0.75 per million text tokens in and $4.50 out, with thinking tokens billed as output. Audio in is $3.00 per million tokens, which Google also states as $0.005 a minute. Audio out is $12.00 per million, or $0.018 a minute. OpenAI’s nearest figure, gpt-live-1 at $0.05 a minute of session with the backend model charged separately, is a different unit, and the comparison stops there.

The default that moves first is tool execution. On gemini-3.8-live, the migration notes say, behavior: NON_BLOCKING “is now the default function calling mode”, so a tool call no longer pauses the conversation until your code answers; the model keeps talking and takes the result when it arrives. Code that relied on the pause gets it back only by declaring behavior: BLOCKING on each tool. On the Extended Thinking model there is no way back: synchronous mode “is not supported and returns a hard error”.

The second is what a finished turn means. On Extended Thinking, “turnComplete: true no longer indicates that the model is idle”; the server may still be reasoning or waiting on a tool, and the client must keep listening and read an interaction_status field that moves between IN_PROGRESS and IDLE. A client that stops listening on turnComplete misses what follows.

Three settings stop being settings. proactive_audio is “permanently enabled” and passing false “returns an error”; enable_affective_dialog “is removed from the API”; and thinking_level “is not supported for gemini-3.8-live”, so the dial the preview exposed is gone on the cheap model and present only on the expensive one, where MINIMAL is refused. Video frames now reach the model on every turn under TURN_INCLUDES_AUDIO_ACTIVITY_AND_ALL_VIDEO, which Google’s note says to send only when needed “to manage context and cost”.

3.8 Live Extended Thinking, high 82.6 3.8 Live 76 3.1 Flash Live preview, high 71.5 3.1 Flash Live preview, minimal 63.9
Artificial Analysis’s Speech to Speech Index, read 16 September. The preview is listed twice because it accepted a thinking level; the new default model accepts none.

The independent measurement says the dial mattered. On Artificial Analysis’s agentic column, read today, the preview at its high setting scores 37.7 against 30.1 for the new default model, and Extended Thinking scores 68.6, above both. The new default answers faster, 1.18 seconds to first audio against the preview’s 2.99, and scores higher on conversational dynamics.

Google’s post, by Tom Ouyang and Malini Jaganathan of the Gemini audio team, claims first place on that index, ahead of every other listed model, and the index agrees. It also claims 68.6 per cent on τ-Voice, the same as the figure in Artificial Analysis’s agentic column, and neither page says whether that column is an independent run or Google’s number reproduced.

The obvious objection is that nothing is retired: the deprecations page gives gemini-3.1-flash-live-preview no shutdown date, so nobody has to move today. It holds for today. Google’s changelog calls Gemini 3.8 Live “the default option”, and a preview left on the card without a date is where the migration notes expect you to leave from.

The paper’s verdict: on the preview with tool calls that assume a pause, do not swap the string this week; add behavior: BLOCKING to every tool declaration first, then swap. On the preview at thinking level high for agentic work, the replacement is not gemini-3.8-live but Extended Thinking, at the same price and with no blocking tools at all.

Neither model supports caching, so a long voice session pays full price for every token of its own history until it reaches the input cap.

What it changes On the preview with tools that assume a pause: declare behavior: BLOCKING on each tool before you change the model string. On the preview at thinking level high: move to Extended Thinking, not 3.8 Live, and rewrite the client to poll interaction_status rather than stop on turnComplete.

Primary source read

Gemini API release notes, 15 September entry Gemini API pricing Gemini 3.8 Live model page, migration notes Gemini 3.8 Live Extended Thinking model page Gemini API deprecations Introducing Gemini 3.8 Live and 3.8 Live Extended Thinking Speech to Speech Index, model table OpenAI API pricing, GPT-Live sessions

The sandbox was a blocklist

Three code-execution paths, each guarded by a list of forbidden strings, in a language that offers a second spelling for everything on the list. Two are perfect or near-perfect scores; the third needs a login that any flow author has.

getattr, spelled at runtime

IBM’s MCP Context Forge shipped a Python sandbox that checked for dunder names as strings

The NVD published CVE-2026-53710 on 15 September at 10.0 out of 10, for the Python sandbox that ships with IBM’s MCP Context Forge.

Versions before 1.0.2 are affected. The record describes a blocklist doing a guard’s job. The sandbox “exposes raw getattr through safe_builtins, omits a required _getattr_ guard, and relies on validate_code checks for literal dangerous dunder strings”. A check for the string __subclasses__ does nothing against code that assembles those characters at runtime, so an attacker can “construct dunder names at runtime, traverse the Python class hierarchy, reach subprocess.Popen, and execute OS commands with the server process privileges”, all through the execute_code MCP tool the sandbox exists to offer.

Reach depends on transport, which ties it to the lead: the record says the HTTP or SSE transport “can expose this tool without authentication”, while stdio-only deployments “have reduced network reachability”. It also confines the fault to the sandbox subproject and says the core gateway and proxy are not directly affected.

A second Context Forge record from 14 September, CVE-2026-53708 at 6.6, concerns the gateway’s URL validator on the admin test route, and is fixed in 1.0.3, one version later than the sandbox fix.

What it changes If you run the python_sandbox_server, upgrade to 1.0.2 and move it off HTTP or SSE unless something authenticates callers. If you wrote your own sandbox on a string blocklist, assume it has this hole.

Primary source read

NVD record, CVE-2026-53710 GHSA-xm98-3vcf-fph7, IBM/mcp-context-forge

new Function, old trick

PraisonAI’s codeMode ran model-written JavaScript behind a regex, and the constructor chain walked round it

PraisonAI’s codeMode tool ran model-written JavaScript inside new Function() behind “a small source-code blocklist”, CVE-2026-57138 says.

The record, published 15 September at 9.9 out of 10, covers versions from 1.4.0 until 1.7.2, with the sandbox’s process and require properties shadowed rather than removed. The escape is the one every JavaScript sandbox built this way has had: “({}).constructor.constructor” recovers the real Function constructor, which recovers process and process.mainModule.require, which reaches the filesystem and subprocess APIs “despite the advertised sandbox”. CVE-2026-57141, at 9.8 out of 10, records a second route to the same place, Function(‘return this’)() for the global object and a child_process module name assembled at runtime so the regex never sees it.

Two records at 8.8 describe the shell side. CommandValidator “validates only the first whitespace-delimited executable against allowedCommands” and then hands the whole string to sh -c, and the shell() helper does the same before child_process.exec, so a string that begins with an allowed read-only command carries any second command the shell will parse.

All four are fixed in 1.7.2, and the input in every case is what a model wrote, which is the point of the tool.

What it changes On PraisonAI’s TypeScript package, upgrade to 1.7.2. Anywhere else, if a tool runs model-written code inside a language that has a constructor chain, a blocklist is not a boundary; use a process or a VM with no host handles.

Primary source read

NVD record, CVE-2026-57138 NVD record, CVE-2026-57141 NVD record, CVE-2026-57136, CommandValidator NVD record, CVE-2026-57133, shell() helper

npx as a tool argument

Flowise’s Custom MCP node took an npm package name from the user and ran it

VulnCheck filed two records against Flowise on 15 September, each at 9.0 out of 10 on CVSS 4.0.

Both concern the Custom MCP node, which lets a flow start its own MCP server, and both score 8.5 out of 10 on the older CVSS 3.1 scale. CVE-2026-91931 says the node “allows authenticated attackers to execute arbitrary code by supplying npx package names in the mcpServerConfig parameter”, so the package that runs is whichever one the attacker publishes. CVE-2026-91932 says the path validation on that config can be bypassed “using clean filenames in the args array while controlling the working directory” through an unvalidated cwd parameter, which is a second door into the same room.

Both need an authenticated user, which VulnCheck’s scoring reflects and which is why neither is a 10. On a shared Flowise instance an authenticated user is anyone who can build a flow, and a flow is the product.

The fix is 3.1.4. The node exists so a flow can start its own MCP server, and a server is a program, so the permission to add one was always the permission to run one.

What it changes Upgrade Flowise to 3.1.4. If your users can build flows, they can run npx; decide whether that was ever the intended permission.

Primary source read

NVD record, CVE-2026-91931 NVD record, CVE-2026-91932 GHSA-vcwp-f9rq-3887, FlowiseAI/Flowise

One request, no reply

Anthropic’s API will now write the summary itself and hand back a signed block that replaces the messages

A beta dated 14 September adds a compaction parameter: send the conversation, get one block and no answer, then send the block first. Leave the old messages in front of it and the next call is an HTTP 400.

Threshold, compact-2026-01-12On demand, compact-2026-09-04
Wheninput tokens cross a value you set, 50,000 or morewhenever you send compaction: {type: summarize}
What comes backa reply, with a compaction block inside itone signed block, no reply, stop_reason compaction
Where the block goesafter the messages it summarisesfirst, in place of them
Runs in the backgroundnoyes, on a separate request
Keeps recent turns verbatimnoyes, if you append them after the block
WhereClaude API and cloud platformsClaude API only
Two ways to compact on the Claude API, as the compaction guide describes them.

Anthropic’s Messages API now returns a signed compaction block on request and no reply with it, under a beta header dated 14 September.

It is the first compaction a caller controls. The threshold version that has run since January decides for you; this one waits to be asked, and its block can be swapped in behind a conversation still in flight.

The mechanics are in the guide. Send the conversation as it stands with a top-level compaction parameter of type summarize. The API “summarizes every message in the request once, generates no reply after it, and returns the block alone with stop_reason compaction”. The block carries a signature. On every later request it goes first in the messages array, “in place of the messages it summarizes”, followed by any turns since. The guide is explicit about the failure: leaving the summarised messages in front of a signed block “is a 400 error”, an HTTP 400 rather than a warning.

Because the summarising request is separate from the conversation’s turns, it can run in the background while the live conversation continues on its full history, and the block is swapped in when it arrives. Recent turns can be kept word for word after the summary, and on models with preserved thinking the guide says the thinking in those kept turns “can stay valid” after the swap, provided the system prompt and tools on the summarising call match the ones in use.

It is billed as a request. The response’s top-level input_tokens and output_tokens read zero, and the cost appears under usage.iterations as a compaction entry; the guide’s example shows 144 tokens in and 276 out for a three-message conversation. max_tokens caps the whole call including any thinking before the summary, so the guide says to “allow several thousand tokens”. The summariser reads your tool definitions and never runs one.

Three limits sit in the guide’s own text. The conversation “must still fit the model’s context window, so compact before you outgrow it, not after”. You cannot combine the compaction parameter with context_management on one request. And it is available on the Claude API only, on eleven listed models from Claude Sonnet 4.6 to Claude Fable 5.1, not on Bedrock, Vertex or Foundry.

The concession is that a client-side summariser already does all of this, and cheaper if it uses a small model. It holds on price and fails on the signature: a block the API signed is one the API will trust to carry preserved thinking across the swap, and a summary you wrote yourself is a user message.

The paper’s verdict: any agent loop that already pauses to compact should move to this and stop pausing. Anything running on a cloud platform waits, and the release notes give no date for that.

What it changes If your agent loop compacts by hand, switch to compaction: {type: summarize} on a background request and swap the signed block in; remove the summarised messages or the next call fails with a 400. On Bedrock, Vertex or Foundry, nothing changes yet.

Primary source read

Anthropic API release notes, 14 September entry Compaction guide, compact on demand with the compaction parameter

Passing the check, missing the thing

Three measurements in one day of an artefact that passes inspection while the property it stands for is absent: a verbatim quote that does not support its claim, a located file that is still reported after the fix, a chain of thought that reads as clean because the corruption happened upstream.

Quoted, not supported

On clinical guidelines the verbatim quote was there and the support was not, for twelve models

Johns Hopkins researchers found claude-opus-5 backs 98.0 per cent of clinical claims with a verbatim quote and fully substantiates 37.1 per cent, less than half.

Two of the four authors are in computer science and two in nursing. A quote that exists is not a quote that proves the sentence it hangs on, and the two rates were measured separately, which is why the gap is visible.

The harness works in stages. Twelve models answer 222 synthetic questions written to be answerable from four clinical practice guidelines. Each factual claim in an answer is checked for a citation, then for a verbatim quote, using a deterministic string match against the guideline, then for whether the quote supports every detail of the claim, using an LLM judge the authors validated against human raters. Most models clear the second stage on prompting alone, attaching verbatim quotes to more than 90 per cent of claims; the paper names claude-haiku-4.5 as an exception on both quoting and substantiation.

The models tested were mainstream ones from five vendors, and the questions are synthetic, so a clinician’s real query may be harder or easier; the authors release the harness and the question set so that can be checked.

The number to keep is the gap, not the level. A pipeline that reports its verbatim-quote rate as evidence of grounding is reporting the 98 and hiding the 37.

Claims with a verbatim quote 98 Claims fully substantiated 37.1
claude-opus-5 on the authors’ harness: share of factual claims carrying a verbatim quote from the guideline, against the share whose quote fully substantiates the claim.

What it changes If your RAG pipeline reports citation or quote coverage as a quality metric, add a substantiation stage judged separately, or the number you ship measures formatting.

Primary source read

Verifiable by Construction: Claim-Level Evaluation of Verbatim Citation in Clinical Question Answering

Which file

Given a weakness class and a repository, the best of 27 models found the right files at an F1 of 0.229

The strongest of 27 language models reaches a File F1 of 0.229 at locating the files behind a named weakness, Cisco’s Foundation AI reports.

The group’s co-authors are at Yale and Carnegie Mellon, and the benchmark covers a task the existing security benchmarks skip: not whether an agent can reproduce or repair a bug it has been shown, but whether it can find where a CWE lives when handed the description and a terminal.

Each of the 500 tasks pairs a repository snapshot from immediately before a real security fix with the one after it, across 290 repositories, six package ecosystems and 147 CWE categories. On the vulnerable snapshot the agent gets the CWE description and read-only terminal access and must name the files. On the patched snapshot it must say the recorded weakness is gone. Four static-analysis tools ran under the same agent interface.

The second task is where the paper’s warning lives. Systems “that identify vulnerable files effectively can still report unsupported locations on patched repositories”, so a good localiser is not a reliable clearer, and a pipeline that trusts the first to stand down after a fix will keep filing findings.

In 38.4 per cent of the 500 tasks every model scores zero, and the authors say more models and larger ones “do not remove this subset”.

38.4%
of 500 tasks where every one of 27 models scored zero at locating the vulnerable file
VLoc Bench, vulnerable snapshot, File F1. The unsolved subset is dominated by large Go and Maven repositories, 47 and 31 per cent of it.

What it changes Treat an agent’s list of vulnerable files as a starting point, not a finding. Run it again on the patched tree: if it still names a location, the agent is not measuring the code, and neither is your dashboard.

Primary source read

Vulnerability Localization Benchmark: Measuring Agentic Security Analysis at Repository Scale

Clean traces

A corrupt plan placed in the context is paraphrased as the model’s own reasoning, and the monitor reads it as clean

Stanford and Carnegie Mellon researchers steered Qwen3-8B and DeepSeek-R1-0528 into a planted wrong answer on more than 90 per cent of biology-and-maths attempts.

The method: append a corrupted reasoning plan to the prompt, with no instruction to follow it. A monitor that reads only the trace cannot catch reasoning that finished before the trace began.

They call it plan injection and found it by accident, using an investigator agent to search for hints that flip a TruthfulQA answer without the chain of thought admitting the hint. The investigator learned to inject a fake chain of reasoning instead. On 550 APPS coding problems the actor followed a corrupted plan in 50.6 per cent of cases on Qwen3-8B and 41.7 on DeepSeek-R1, and fewer than one per cent of successful attacks copied even half the plan verbatim.

Five monitors then scored the traces at a suspicion threshold of 0.15 on a scale from 0 to 1: GPT-4o Mini and DeepSeek V3 without thinking, DeepSeek R1, Qwen3-235B and Claude 3.7 Sonnet with it. Thinking monitors caught more, and “no monitor exceeds ~75% detection even in the best case”, against false positives near zero on benign traces. Giving the monitor the injected plan helped on the biology task and hurt on the coding one, where the plan’s coherent story let the monitor “explain it away”. The abstract states the harm on the biology task; the paper prints the results section’s version.

The paper’s verdict: keep the monitor and stop calling it a gate, because a quarter of injected plans pass it on these numbers. Untested here is a monitor trained on plan injections, the obvious next defence and the one nobody has published.

What it changes If a chain-of-thought monitor gates an agent that reads retrieved documents, tool outputs or another agent’s plan, budget for it to miss a quarter of injected plans. Feed the monitor the upstream inputs and measure whether that helps on your task; on one of the two here it hurt.

The abstract says giving the monitor the plan drops detection by as much as 50 per cent in the Bio-Math task; section 6.2 says the with-plan setting substantially improves detection on Bio-Math and hurts on APPS. The paper cannot reconcile the two from the text and reports both.

Primary source read

Corrupt Plans, Clean Traces: Evading Chain-of-Thought Monitoring with Plan Injection

Nearly cut

A Google harness claims 218 of 222 Codeforces problems and 71 per cent on research-level theorems, on Google’s models

Six authors including Vahab Mirrokni report that their harness solves 218 out of 222 Codeforces problems with Gemini 3.1 Pro and execution feedback.

The same harness, Stellar Colosseum, scores 71.0 per cent on TCS-Bench, theorem-proving tasks drawn from FOCS, STOC and SODA papers, using Gemini 3.1 Pro with Gemini 3.7 Flash, against no stated baseline for either figure. The paper nearly cut it: the arXiv page lists no affiliations, the evaluations are the authors’ own, and no independent run exists.

It stayed for one sentence in the abstract: the workflow “has also been integrated into Google Antigravity’s Teamwork framework as the Long Proof pattern”. That makes it a product setting rather than a paper, and the mechanism is worth having in words. Colosseum explores strategies before it writes a proof, uses “a readiness gate to decide when a route is mature enough to decompose”, represents the plan as section-level subproblems, and routes verifier findings back to the affected section. Candidates are generated in parallel, attacked with targeted falsification, and merged by what the authors call overlapping random-sample tree aggregation.

The authors also claim new results on open problems from FOCS and JMLR papers, which this paper has not read and cannot assess.

What a builder gets is a name for a pattern, and a number to demand from anyone selling it on a model that is not Gemini.

What it changes Nothing to switch on this week unless you are in Antigravity. If you build long-horizon proof or planning agents, the readiness gate and the verifier-to-section routing are the two ideas to steal.

All figures are the authors’ own on Google models; the arXiv page lists no affiliations, and the paper infers Google from the Antigravity integration the abstract states. TCS-Bench and the Codeforces set have not been run independently.

Publisher's claim, unverified

Stellar Colosseum: A Many-Agent Harness for Long-Horizon Research in Mathematics and Theoretical Computer Science

Dates, defaults and one incident

Claude’s two 5.1 models threw errors for 86 minutes on Tuesday morning

Anthropic’s status page opened an incident at 09:48 UTC on 15 September for “intermittent error spikes” on Claude Mythos 5.1 and Claude Fable 5.1. A fix was posted at 10:50 and the incident closed at 11:14, 86 minutes after it opened. The page lists claude.ai, the API, Claude Code and Claude Cowork as affected and gives no cause a day later.

86 minutes

llama.cpp 0.4.1 removes three loading flags and keeps reasoning by default

ggml-org tagged llama.cpp v0.4.1 on 14 September, the only versioned release among the last hundred tags. The rest are build numbers. It removes the deprecated --mmap, --mlock and --direct-io arguments in favour of --load-mode, turns on --reasoning-preserve in the server by default, changes llama_sampler_chain_n() to return int32_t, and moves ggml from 0.23.0 to 0.24.0. A script that still passes --mmap fails on upgrade.

A version, not a build

Gemini CLI 0.60.0 stable carries eleven hardening fixes and one enforcement of RFC 9207

Google released Gemini CLI v0.60.0 on 15 September with eleven fixes and hardening changes in its notes. Among them: RFC 9207 issuer identification in the MCP OAuth flow, “envelope metadata provenance for untrusted tool outputs”, strict permission and ownership checks on system-wide configuration paths, and a removed hard-coded Google CrUX API key. The nightly this paper printed yesterday for the build-file injection fix reached the preview channel the same day as v0.61.0-preview.0.

Eleven fixes

A frozen Qwen3-32B routed skills better than pipelines that bolted on up to 16B parameters

Tsinghua researchers report that two trained linear maps, read from a frozen Qwen3-32B, route skills better than routers that add parameters. Gavel projects the task and each skill through the maps, then resumes the shortlisted skills’ forward passes for a yes-or-no verdict. It scores up to 13.4 points above progressive-disclosure and retrieve-and-rerank pipelines that bolt on 1.2B to 16B parameters. When the need for a skill arises mid-rollout, the margin is 21.9 points above the same pipelines. No skill text sits in the context at all.

Two linear maps

A safety technique’s own authors say it does not beat the simpler one it was built to improve

Inoculation Midtraining “does not outperform standard Inoculation Prompting”, its authors at Geodesic Research, OpenAI and the UK AI Security Institute report. The technique teaches a base model that unsafe behaviour belongs to a quarantine-token context before post-training on unsafe data. It reduces misalignment, they write, but is sensitive to training configuration and leaves “a leaky boundary that nearby contextual cues can reactivate”. They say so in the abstract, which is where such a sentence is rarely put.

Negative result

DeepSeek’s reprieve footnote is still on the page, and the resale markup is still there too

DeepSeek’s pricing page still carries footnote two, read again on 16 September, continuing V4 Pro “with the billing method remaining unchanged”. The off-peak rate is still $0.66 per million input tokens and $1.98 out, and the change log’s newest entry is still 10 September. OpenRouter’s dated slug bills $0.983 in this morning, half as much again as DeepSeek’s own rate. Its batch tier is the same as DeepSeek’s own figures, so the batch tier is the cheap route through the reseller.

Two days on

What is already scheduled

  1. Wed 16 Sep, 16:00 ET Closed Senate briefing on AI risk, convened by Senator Sanders, with Hinton, Tegmark and Cotra Reported, not scheduled
  2. Tue 22 Sep Replies due, sanctions motion against DeviantArt in Andersen v. Stability AI On the calendar
  3. Thu 24 Sep OpenAI removes sora-2, sora-2-pro and the Videos API On the calendar
  4. Thu 24 Sep Xi Jinping at the White House Reported, not scheduled
  5. Mon 28 Sep OpenAI shuts down gpt-3.5-turbo-instruct, babbage-002, davinci-002 and gpt-3.5-turbo-1106 On the calendar
  6. Tue 29 Sep Claude Sonnet 4.5 API retirement, no earlier than On the calendar
  7. Wed 30 Sep Azure retires the NVv3 and NVv4 GPU virtual machines On the calendar
  8. Wed 30 Sep Google deprecates the gemini-omni-flash-preview endpoint On the calendar
  9. Thu 1 Oct OpenAI removes gpt-5.4-cyber On the calendar
  10. Wed 7 Oct Sanctions hearing, Andersen v. Stability AI, before Judge Orrick On the calendar
  11. Sat 10 Oct Solar Pro 4 reaches standard pricing Reported, not scheduled
  12. Next minor release MCP Go SDK removes both MCPGODEBUG compatibility flags On the calendar
  13. Tue 1 Dec OpenAI removes the older GPT Image models from the API On the calendar
  14. Thu 1 Jul 2027 California SB 1119’s pre-release risk assessments and child defaults bind On the calendar

Corrections

How this edition was made

swept
100
candidates
48
deduped
46
verified
31
printed
18

The collector’s wire carried 100 items generated at 00:30 UTC on 16 September, of which 92 were llama.cpp build tags and arXiv listing rows. Three real leads were on it, and two of them are on this page: Google’s Gemini 3.8 Live post and the Claude Code releases; the Anthropic incident is the third and is a brief. Nine reporting areas were then swept live against 14 to 16 September with every previously printed URL excluded, followed by a follow-up desk that re-read every page the paper had cited, and a second-look desk sent at the pages the first sweep never opened. Every reporter delivered its report as a file on disk as well as a message, which is the repair the last session asked for; three of ten still sent main a delivery receipt in place of the report, and the file made the round trip unnecessary each time. The lead was not found by a beat. The second-look desk queried the NVD’s API directly for records published in the window after it found that a fetch tool’s summary of an NVD page had invented dates, and the editor then pulled sixty-one distinct records by keyword and read every one scoring 9.0 or above, twenty-one of them, at the NVD, with the vendor advisories for the three servers in the lead read alongside. The editor refetched every source that prints: Google’s changelog, pricing, both model pages and the deprecations page; Anthropic’s release notes, compaction guide and status page; both Claude Code releases; the llama.cpp and Gemini CLI releases; six arXiv abstracts with their full texts where numbers were needed; DeepSeek’s pricing page and OpenRouter’s models API. One reporter claim was corrected before print: the labs beat gave the Gemini post a blog.google address, and the paper cites the DeepMind address the wire carried, which is where the bylines are. Artificial Analysis’s table was read with its header row so that the column called agentic is the one the feature cites. The plan-injection paper’s abstract and its results section disagree about which task the monitor’s access to the plan hurts, and the story prints both rather than choosing. On the machinery: the reporting workflow was refused a sixth time. The first attempt failed for want of a receipt, because the pattern law arrived as injected text; loaded through the Skill tool, the second attempt reached the preflight card, which under bypassPermissions is shown to nobody, and was refused, as on 15 September. Sid’s fork, unchanged. Four blind judges scored the lead, both features and the plan-injection story after the first publish. The lead scored 18 of 20 with no gate failed; both features failed C1 on openers that put the fact past word eight; the plan-injection story failed C2 with no thesis and carried no verdict. All four were rewritten and the edition republished within the hour, which is the second edition running where the judge earned its place after print rather than before it.

Left out on purpose: The Board beat entirely, again. Nothing in the window from the EU AI Office, the Federal Register, Colorado’s docket or the FTC carried a date later than 19 August; the courts were unreadable, with CourtListener returning 403 and its API 401. · Three money items with dates in the window: OpenAI’s reported $300 million purchase of Glass Imaging, Superhuman’s purchase of Fathom, and Profound’s $180 million raise. None changes what a builder buys or builds on, and the first is a report of a price rather than a disclosed one. · An OpenAI post of 14 September saying Perplexity runs GPT-6 Astra with less human oversight over production systems. A customer story published by the vendor, with no number a reader could check. · A GitHub changelog entry of 15 September on Copilot suggesting custom property definitions. Governance metadata, no consequence for anyone building. · Seven arXiv papers the research reporter opened whose submission dates fell on 11 or 13 September, outside the window, including the attribution-compression paper on RAG citations, which is a good story for the edition that should have carried it. · Forty of the sixty-one NVD records the editor pulled, scoring below 9.0, among them the Lokka Microsoft 365 server’s token leak at 8.7 and FrontMCP’s OpenAPI import at 8.5. Each is real; the page had room for the mechanism, not the list. · Thirteen further PraisonAI records above 9.0, including two JWT default-secret faults at 9.8, folded into one sentence of the lead. One project’s disclosure queue is not thirteen stories. · The atomic-agents-stack record at 9.2, a cleartext HTTP registry backend that lets a man in the middle spawn processes. The same trust error as the Docker rail, with a smaller install base. · Everything on the open-weights beat. DeepSeek, Qwen, Moonshot, Z.ai, MiniMax, Mistral and Nvidia published no weights or price in the window that the reporter or the second-look desk could date. · Everything on the Global overlay. Every candidate found, from Mistral’s OCR to Humain’s raise, predated 14 September. The overlay is empty because the window was. · The Sanders briefing as a story. It is on the calendar, today, on press reports; it is not a story until someone says what was said. · A 14 September incident on Claude Cowork for Windows, reported by the follow-up desk and not re-read by the editor. · Gemini CLI v0.61.0-preview.0, because the fix it carries is the nightly this paper printed yesterday. · Claude Code v2.1.272 as a story. Its notes say bug fixes, and nothing else.

Unedited

The wire

As caught when this edition was printed

Everything the collector caught, in the order it arrived, with no editorial judgment applied. The paper above is what survived it.

12 shown as printed; this list updates live in a browser.