{ "date": "2026-09-16", "volume": 1, "number": 8, "dateline": "Wednesday, 16 September 2026", "masthead": "The Early Edition", "editionNote": "18 printed", "motto": "What changed, what it costs you, and where to check it.", "premise": { "text": "Seven vulnerability records in two days describe the same MCP server, one whose author flipped a transport setting and got a network service with no login on every interface. Beneath it, three sandboxes built from blocklists, and the one lab release of the week, which kept the price and moved the defaults. The science page measures three checks that pass while the thing they check for is absent, and the corrections column reports that yesterday's paper said a page had not changed when it had." }, "front": [ { "block": "lead", "story": "mcp-sse-open", "rail": [ "cc-2-1-273", "docker-mcp-gateway-label" ] }, { "block": "premise" }, { "block": "index", "name": "Inside this edition" }, { "block": "feature", "story": "gemini-38-live" }, { "block": "package", "name": "The sandbox was a blocklist", "rationale": "Three code-execution paths, each guarded by a list of forbidden strings, in a language that offers a second spelling for everything on the list. Two are perfect or near-perfect scores; the third needs a login that any flow author has.", "stories": [ "context-forge-sandbox", "praisonai-codemode", "flowise-mcp-node" ] }, { "block": "feature", "story": "anthropic-compaction" }, { "block": "package", "name": "Passing the check, missing the thing", "rationale": "Three measurements in one day of an artefact that passes inspection while the property it stands for is absent: a verbatim quote that does not support its claim, a located file that is still reported after the fix, a chain of thought that reads as clean because the corruption happened upstream.", "stories": [ "clinical-quotes", "vloc-bench", "plan-injection" ] }, { "block": "boxed", "story": "stellar-colosseum" }, { "block": "briefs", "name": "Dates, defaults and one incident", "stories": [ "anthropic-errors", "llamacpp-041", "gemini-cli-060", "router-within", "inoculation-midtraining", "deepseek-holds" ] }, { "block": "ahead", "items": [ { "when": "Wed 16 Sep, 16:00 ET", "what": "Closed Senate briefing on AI risk, convened by Senator Sanders, with Hinton, Tegmark and Cotra", "why": "Today. Confirmed only by press reports; no Senate page states it, and no frontier lab is named as attending.", "status": "reported" }, { "when": "Tue 22 Sep", "what": "Replies due, sanctions motion against DeviantArt in Andersen v. Stability AI", "why": "Carried forward. CourtListener returned 403 and its API 401 today, so whether the 15 September responses were filed is still unknown to this paper.", "status": "confirmed" }, { "when": "Thu 24 Sep", "what": "OpenAI removes sora-2, sora-2-pro and the Videos API", "why": "Carried forward. The replacement column on OpenAI's deprecations page was still empty when re-read today.", "status": "confirmed" }, { "when": "Thu 24 Sep", "what": "Xi Jinping at the White House", "why": "Carried forward.", "status": "reported" }, { "when": "Mon 28 Sep", "what": "OpenAI shuts down gpt-3.5-turbo-instruct, babbage-002, davinci-002 and gpt-3.5-turbo-1106", "why": "Carried forward. Replacement named on the page: gpt-5.6-terra.", "status": "confirmed" }, { "when": "Tue 29 Sep", "what": "Claude Sonnet 4.5 API retirement, no earlier than", "why": "Carried forward and re-read today: \"Not sooner than September 29, 2026\".", "status": "confirmed" }, { "when": "Wed 30 Sep", "what": "Azure retires the NVv3 and NVv4 GPU virtual machines", "why": "Carried forward.", "status": "confirmed" }, { "when": "Wed 30 Sep", "what": "Google deprecates the gemini-omni-flash-preview endpoint", "why": "New to the calendar. Stated in the Gemini API release notes entry of 27 August; the GA model is gemini-omni-1.1-flash.", "status": "confirmed" }, { "when": "Thu 1 Oct", "what": "OpenAI removes gpt-5.4-cyber", "why": "Carried forward. Replacement gpt-5.6-cyber.", "status": "confirmed" }, { "when": "Wed 7 Oct", "what": "Sanctions hearing, Andersen v. Stability AI, before Judge Orrick", "why": "Carried forward. 14:00 in San Francisco.", "status": "confirmed" }, { "when": "Sat 10 Oct", "what": "Solar Pro 4 reaches standard pricing", "why": "Carried forward. Upstage's page was readable today for the first time: $0.30 per million input tokens and $1.20 output at the promotional rate.", "status": "reported" }, { "when": "Next minor release", "what": "MCP Go SDK removes both MCPGODEBUG compatibility flags", "why": "Carried forward.", "status": "confirmed" }, { "when": "Tue 1 Dec", "what": "OpenAI removes the older GPT Image models from the API", "why": "Carried forward.", "status": "confirmed" }, { "when": "Thu 1 Jul 2027", "what": "California SB 1119's pre-release risk assessments and child defaults bind", "why": "Carried forward.", "status": "confirmed" } ] }, { "block": "corrections", "items": [ { "date": "2026-09-15", "text": "A rail story in that edition said Anthropic's API release notes had no entry after 10 September, read on 15 September. Read on 16 September, the page carries an entry dated 14 September, for on-demand compaction, which is today's feature. This paper cannot establish whether that entry was on the page when it was read yesterday: Anthropic dates entries by the change rather than by the day of posting, the Internet Archive was offline on 15 September, and it refused this paper's index requests today. Either the entry was added after yesterday's read, in which case the sentence was true when printed and is not now, or it was present and the reporter missed it. The reader was told nothing had changed, and something had." } ] }, { "block": "ledger", "ledger": { "counts": { "swept": 100, "candidates": 48, "deduped": 46, "verified": 31, "printed": 18 }, "note": "The collector's wire carried 100 items generated at 00:30 UTC on 16 September, of which 92 were llama.cpp build tags and arXiv listing rows. Three real leads were on it, and two of them are on this page: Google's Gemini 3.8 Live post and the Claude Code releases; the Anthropic incident is the third and is a brief. Nine reporting areas were then swept live against 14 to 16 September with every previously printed URL excluded, followed by a follow-up desk that re-read every page the paper had cited, and a second-look desk sent at the pages the first sweep never opened. Every reporter delivered its report as a file on disk as well as a message, which is the repair the last session asked for; three of ten still sent main a delivery receipt in place of the report, and the file made the round trip unnecessary each time. The lead was not found by a beat. The second-look desk queried the NVD's API directly for records published in the window after it found that a fetch tool's summary of an NVD page had invented dates, and the editor then pulled sixty-one distinct records by keyword and read every one scoring 9.0 or above, twenty-one of them, at the NVD, with the vendor advisories for the three servers in the lead read alongside. The editor refetched every source that prints: Google's changelog, pricing, both model pages and the deprecations page; Anthropic's release notes, compaction guide and status page; both Claude Code releases; the llama.cpp and Gemini CLI releases; six arXiv abstracts with their full texts where numbers were needed; DeepSeek's pricing page and OpenRouter's models API. One reporter claim was corrected before print: the labs beat gave the Gemini post a blog.google address, and the paper cites the DeepMind address the wire carried, which is where the bylines are. Artificial Analysis's table was read with its header row so that the column called agentic is the one the feature cites. The plan-injection paper's abstract and its results section disagree about which task the monitor's access to the plan hurts, and the story prints both rather than choosing. On the machinery: the reporting workflow was refused a sixth time. The first attempt failed for want of a receipt, because the pattern law arrived as injected text; loaded through the Skill tool, the second attempt reached the preflight card, which under bypassPermissions is shown to nobody, and was refused, as on 15 September. Sid's fork, unchanged. Four blind judges scored the lead, both features and the plan-injection story after the first publish. The lead scored 18 of 20 with no gate failed; both features failed C1 on openers that put the fact past word eight; the plan-injection story failed C2 with no thesis and carried no verdict. All four were rewritten and the edition republished within the hour, which is the second edition running where the judge earned its place after print rather than before it.", "omitted": [ "The Board beat entirely, again. Nothing in the window from the EU AI Office, the Federal Register, Colorado's docket or the FTC carried a date later than 19 August; the courts were unreadable, with CourtListener returning 403 and its API 401.", "Three money items with dates in the window: OpenAI's reported $300 million purchase of Glass Imaging, Superhuman's purchase of Fathom, and Profound's $180 million raise. None changes what a builder buys or builds on, and the first is a report of a price rather than a disclosed one.", "An OpenAI post of 14 September saying Perplexity runs GPT-6 Astra with less human oversight over production systems. A customer story published by the vendor, with no number a reader could check.", "A GitHub changelog entry of 15 September on Copilot suggesting custom property definitions. Governance metadata, no consequence for anyone building.", "Seven arXiv papers the research reporter opened whose submission dates fell on 11 or 13 September, outside the window, including the attribution-compression paper on RAG citations, which is a good story for the edition that should have carried it.", "Forty of the sixty-one NVD records the editor pulled, scoring below 9.0, among them the Lokka Microsoft 365 server's token leak at 8.7 and FrontMCP's OpenAPI import at 8.5. Each is real; the page had room for the mechanism, not the list.", "Thirteen further PraisonAI records above 9.0, including two JWT default-secret faults at 9.8, folded into one sentence of the lead. One project's disclosure queue is not thirteen stories.", "The atomic-agents-stack record at 9.2, a cleartext HTTP registry backend that lets a man in the middle spawn processes. The same trust error as the Docker rail, with a smaller install base.", "Everything on the open-weights beat. DeepSeek, Qwen, Moonshot, Z.ai, MiniMax, Mistral and Nvidia published no weights or price in the window that the reporter or the second-look desk could date.", "Everything on the Global overlay. Every candidate found, from Mistral's OCR to Humain's raise, predated 14 September. The overlay is empty because the window was.", "The Sanders briefing as a story. It is on the calendar, today, on press reports; it is not a story until someone says what was said.", "A 14 September incident on Claude Cowork for Windows, reported by the follow-up desk and not re-read by the editor.", "Gemini CLI v0.61.0-preview.0, because the fix it carries is the nightly this paper printed yesterday.", "Claude Code v2.1.272 as a story. Its notes say bug fixes, and nothing else." ] } }, { "block": "wire", "snapshot": [ { "title": "Introducing Gemini 3.8 Live and 3.8 Live Extended Thinking", "href": "https://deepmind.google/blog/introducing-gemini-3-8-live-and-3-8-live-extended-thinking/", "source": "deepmind", "at": "2026-09-15T17:30:49.232Z", "time": "17:30" }, { "title": "ModelTalk: Pacing the Frontier", "href": "https://www.chinatalk.media/p/modeltalk-pacing-the-frontier", "source": "chinatalk", "at": "2026-09-15T11:30:33.565Z", "time": "11:30" }, { "title": "Intermittent error spikes for Claude Mythos 5.1 and Claude Fable 5.1", "href": "https://status.claude.com/incidents/6304r9jjhj34", "source": "anthropic-status", "at": "2026-09-15T10:00:25.862Z", "time": "10:00" }, { "title": "Anatomical Grounding and Leakage-Aware Multimodal Contrastive Learning for Alzheimer's Disease Classification from Structural MRI", "href": "https://arxiv.org/abs/2609.15888v1", "source": "arXiv cs.AI", "at": "2026-09-15T05:30:28.546Z", "time": "05:30" }, { "title": "SlipSense: Multimodal Tactile Learning for Low-Latency and Generalized Slip Detection", "href": "https://arxiv.org/abs/2609.15910v1", "source": "arXiv cs.AI", "at": "2026-09-15T05:30:28.546Z", "time": "05:30" }, { "title": "The Router Within: Eliciting Native Skill Routing from a Frozen LLM", "href": "https://arxiv.org/abs/2609.15982v1", "source": "arXiv cs.AI", "at": "2026-09-15T05:30:28.546Z", "time": "05:30" }, { "title": "Stellar Colosseum: A Many-Agent Harness for Long-Horizon Research in Mathematics and Theoretical Computer Science", "href": "https://arxiv.org/abs/2609.15983v1", "source": "arXiv cs.AI", "at": "2026-09-15T05:30:28.546Z", "time": "05:30" }, { "title": "Pilot Early, Commit Late: A Real-Options Model of Enterprise AI Adoption under Rapid Technological Progress", "href": "https://arxiv.org/abs/2609.15919v1", "source": "arXiv cs.AI", "at": "2026-09-15T05:30:28.546Z", "time": "05:30" }, { "title": "Recurrent GraphNeural NetworkswithSet-BasedAggregation", "href": "https://arxiv.org/abs/2609.15932v1", "source": "arXiv cs.AI", "at": "2026-09-15T05:30:28.546Z", "time": "05:30" }, { "title": "Privacy-enhanced federated learning via asynchronous aggregation and local differential perturbation", "href": "https://arxiv.org/abs/2609.15885v1", "source": "arXiv cs.AI", "at": "2026-09-15T05:30:28.546Z", "time": "05:30" }, { "title": "Corrupt Plans, Clean Traces: Evading Chain-of-Thought Monitoring with Plan Injection", "href": "https://arxiv.org/abs/2609.15989v1", "source": "arXiv cs.AI", "at": "2026-09-15T05:30:28.546Z", "time": "05:30" }, { "title": "Learning Multimodal One-step Flow Policy via Value-weighted Optimal Transport", "href": "https://arxiv.org/abs/2609.15883v1", "source": "arXiv cs.AI", "at": "2026-09-15T05:30:28.546Z", "time": "05:30" } ] } ], "stories": [ { "id": "mcp-sse-open", "section": "Tooling", "kicker": "SSE on, auth off", "treatment": "lead", "headline": "Seven CVE records in two days describe one MCP fault: a network transport, every interface, no login", "standfirst": "Two of them score a perfect 10. The trigger is a transport setting: MCP_TRANSPORT=sse on the MySQL server, SSE=true on the GitLab one, run_sse on PraisonAI. The stdio default was never affected, and the fixes are version numbers.", "byline": "By the Newsroom", "credit": "From the NVD records and the projects' own advisories, all read 16 September", "figure": { "type": "table", "caption": "Where the port opened and the version that closes it. Scores are CVSS 3.1 base scores as recorded by the NVD.", "columns": [ "Server", "What opens it", "Score", "Fixed in" ], "rows": [ [ "MySQL MCP Server", "MCP_TRANSPORT=sse", "10.0", "0.4.2" ], [ "@zereight/mcp-gitlab", "SSE=true, the Docker default", "9.8", "2.1.27" ], [ "@zereight/mcp-gitlab, Streamable HTTP", "no Host or Origin allowlist", "9.6", "2.1.30" ], [ "Bifrost gateway", "auth_config.is_enabled=false, the default", "9.8", "transports/v2.1.0" ], [ "PraisonAI ToolsMCPServer", "run_sse binds 0.0.0.0", "9.8", "praisonaiagents 1.6.59" ], [ "PraisonAI MCPServer.startHttp", "no host restriction, no auth", "9.8", "1.7.2" ], [ "PraisonAI UI /api/mcp/connect", "caller supplies command and args", "9.8", "4.6.59" ] ] }, "body": [ { "type": "p", "text": "The NVD published CVE-2026-59971 on 15 September at 10.0 out of 10 on CVSS 3.1, for a MySQL MCP server." }, { "type": "p", "text": "It answers unauthenticated SQL the moment its transport is set to SSE. The seven records in the table fail the same way, and none of them is a bug in MCP. The bug is a setting that turns a local pipe into a network service and changes nothing else." }, { "type": "p", "text": "The MySQL record is specific about the mechanism. Setting MCP_TRANSPORT=sse makes the server \"construct SseServerTransport without security_settings or enable_dns_rebinding_protection\", the routes /, /sse and /messages/ \"have no authentication\", and the service \"binds to 0.0.0.0 by default\". A caller on the network reaches execute_sql directly. A caller who cannot reach it uses DNS rebinding to make a browser on the same machine relay the request. Where the MySQL account holds FILE privileges, the record says, the same path \"may enable code execution\". The stdio transport \"is not affected\", and 0.4.2 closes it." }, { "type": "p", "text": "The GitLab server, @zereight/mcp-gitlab, is the same fault with a worse payload. Before 2.1.27, its record says, SSE=true \"exposes all MCP tools without any authentication\", one of which, upload_markdown, reads any file the process can and pushes it to a GitLab project. The record spells out the chain: read /proc/self/environ, take GITLAB_PERSONAL_ACCESS_TOKEN, own the account. The costliest line is the last one: \"This is the default configuration for Docker deployments.\" Two more records on the same package, at 9.6 out of 10 each, add DNS rebinding through the Streamable HTTP endpoint, fixed in 2.1.30, and a request header that redirects the server's own token to a host the caller names." }, { "type": "p", "text": "Bifrost, an AI gateway, shows the shape without the flag. JFrog's record says a stdio MCP client \"is a command plus args\" and that \"Bifrost starts that program in the gateway the moment the client is added. No MCP handshake required.\" The default governance.auth_config.is_enabled=false means, in the record's words, \"every caller is a local admin\", so one unauthenticated POST to /api/mcp/client runs a program as the gateway's user. Version transports/v2.1.0 answers that registration with a 403; v2.0.0 still does not." }, { "type": "p", "text": "PraisonAI accounts for twenty-eight of the sixty-one records this paper pulled from the NVD for 14 to 16 September, and the transport fault appears in it three times. ToolsMCPServer.run_sse binds 0.0.0.0 and creates /sse and /messages/ \"without invoking the available SecurityConfig authentication\", which is the record's way of saying the guard existed and was not called. MCPServer.startHttp in the TypeScript package \"binds without a host restriction\" and forwards every POST to the handler unauthenticated. The UI's /api/mcp/connect takes a command and its arguments from any caller and starts the process \"even when the MCP handshake later fails\". The same habit runs through the project's non-MCP surfaces, a Jobs API at 9.8 out of 10 and an AgentOS at 9.4, and two of the records call the 1.7.2 fix \"an initial remediation\"." }, { "type": "p", "text": "The objection is that this is one week's disclosure queue, not a trend, and that twenty-eight records from one project are one researcher's afternoon. Both are true, and neither helps. The MySQL and GitLab servers are separate projects by separate authors, both defaulted their network mode open, and the Serena record from 14 September, scored 2.9, quotes the maintainer calling a 0.0.0.0 listen address \"a potential security hazard\" while the documentation of the time recommended a sandbox rather than a different address. The pattern is a design habit, not a coincidence of the calendar." }, { "type": "p", "text": "The MySQL record names why the setting does this: the SDK's transport object takes security_settings and enable_dns_rebinding_protection as arguments, and an author who constructs it without them gets a listener with neither. Nothing in the protocol or its SDKs makes an unauthenticated network listener an error. The MCP Go SDK this paper covered yesterday bounded the size of what a server will read; it did not bound who may send it." }, { "type": "p", "text": "The paper's verdict is a grep before a patch list. Search your MCP configuration for any transport that is not stdio, and for each hit answer two questions: what authenticates a caller, and what address does it bind. If either answer is nothing, that server is one of these records whether or not its CVE has been filed yet. Then take the patch list: 0.4.2, 2.1.30, transports/v2.1.0, and for PraisonAI every version boundary in the table rather than one." }, { "type": "p", "text": "None of the seven records reports exploitation. All seven were published on 14 and 15 September, and the settings that opened the ports are older than any of the records, so the exposure predates the news by however long each flag has been set." } ], "consequence": "Grep your MCP configuration for any transport other than stdio. For each, name what authenticates a caller and what address it binds; if either is nothing, treat it as exposed now. Then upgrade: MySQL MCP Server 0.4.2, mcp-gitlab 2.1.30, Bifrost transports/v2.1.0, and every PraisonAI boundary in the table.", "confidence": "verified", "sources": [ { "label": "NVD record, CVE-2026-59971, MySQL MCP Server", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59971", "publisher": "National Vulnerability Database", "date": "2026-09-15", "kind": "primary", "provenance": { "byline": "Not published on the page; the record's source is GitHub's advisory database", "institution": "NVD, run by NIST", "stake": "The paper's best guess: none. The scoring is the CNA's, GitHub's, and the paper read the vendor advisory it points to." } }, { "label": "GHSA-rqfv-2mw9-78g2, designcomputer/mysql_mcp_server", "url": "https://github.com/designcomputer/mysql_mcp_server/security/advisories/GHSA-rqfv-2mw9-78g2", "publisher": "GitHub", "date": "2026-09-15", "kind": "primary" }, { "label": "NVD record, CVE-2026-61560, @zereight/mcp-gitlab SSE mode", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61560", "publisher": "National Vulnerability Database", "date": "2026-09-15", "kind": "primary" }, { "label": "NVD record, CVE-2026-61568, @zereight/mcp-gitlab DNS rebinding", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61568", "publisher": "National Vulnerability Database", "date": "2026-09-15", "kind": "primary" }, { "label": "NVD record, CVE-2026-90898, Bifrost", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90898", "publisher": "National Vulnerability Database", "date": "2026-09-14", "kind": "primary", "provenance": { "byline": "Not published on the page; the record's source is JFrog", "institution": "JFrog, which sells software supply-chain security scanning", "stake": "The paper's best guess: a gateway that runs any registered program is a good argument for the product JFrog sells, and the record's facts are checkable against Bifrost's own v2.1.0 release, which the paper read." } }, { "label": "Bifrost transports/v2.1.0 release", "url": "https://github.com/maximhq/bifrost/releases/tag/transports/v2.1.0", "publisher": "Maxim", "date": "2026-09-14", "kind": "primary" }, { "label": "NVD record, CVE-2026-57123, PraisonAI ToolsMCPServer.run_sse", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57123", "publisher": "National Vulnerability Database", "date": "2026-09-14", "kind": "primary" }, { "label": "NVD record, CVE-2026-57139, PraisonAI MCPServer.startHttp", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57139", "publisher": "National Vulnerability Database", "date": "2026-09-15", "kind": "primary" }, { "label": "NVD record, CVE-2026-57124, PraisonAI UI /api/mcp/connect", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57124", "publisher": "National Vulnerability Database", "date": "2026-09-14", "kind": "primary" }, { "label": "NVD record, CVE-2026-38924, Serena listen address", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-38924", "publisher": "National Vulnerability Database", "date": "2026-09-14", "kind": "primary" } ] }, { "id": "cc-2-1-273", "section": "Tooling", "kicker": "The checker's blind spot", "treatment": "rail", "headline": "Claude Code's permission checker missed an rm inside a subshell; 2.1.273 closes it and reopens what 2.1.268 refused", "standfirst": "The note does not say which rm counts as dangerous, and the release before it says only \"bug fixes\".", "byline": "By the Newsroom", "credit": "From the v2.1.273 release notes, published 15 September", "body": [ { "type": "p", "text": "Anthropic's v2.1.273 release notes, published 15 September, name two holes in the Bash permission checker." }, { "type": "p", "text": "One is \"a subshell hiding a dangerous rm in bypass mode\". The other is commands the checker \"cannot fully analyze\" skipping the prompt under permissions.blockReadsOutsideWorkingDirectories. The note does not say which rm counts as dangerous or what the subshell looked like, and v2.1.272, a day earlier, says only \"Bug fixes and reliability improvements\"." }, { "type": "p", "text": "The same release reverts a 2.1.268 change that ran Read and Edit deny rules on lines the checker cannot parse, eval and env -C among them, so that, in the note's example, time -p make build prompts again instead of being denied. Five request headers for LLM gateways, x-claude-code-request-class among them, arrive behind CLAUDE_CODE_GATEWAY_HINT_HEADERS=1 and stay off unless it is set." }, { "type": "p", "text": "The two fixes pull in opposite directions on purpose: one makes the checker stricter about what it had missed, the other makes it stop refusing what it could not read." } ], "consequence": "Upgrade. If you run with permissions bypassed, this is the release that matters. If you run behind a gateway, the headers are opt-in and nothing changes until you set the variable.", "confidence": "verified", "sources": [ { "label": "anthropics/claude-code v2.1.273", "url": "https://github.com/anthropics/claude-code/releases/tag/v2.1.273", "publisher": "Anthropic", "date": "2026-09-15", "kind": "primary", "provenance": { "byline": "Released by ashwin-ant; no author on the notes", "institution": "Anthropic", "stake": "The paper's best guess: a vendor describing its own permission bug has reason to describe it briefly, and this note is one line." } }, { "label": "anthropics/claude-code v2.1.272", "url": "https://github.com/anthropics/claude-code/releases/tag/v2.1.272", "publisher": "Anthropic", "date": "2026-09-15", "kind": "primary" } ] }, { "id": "docker-mcp-gateway-label", "section": "Tooling", "kicker": "The image wrote its own flags", "treatment": "rail", "headline": "Docker's MCP Gateway let an image label write its own docker run flags", "standfirst": "A malicious server image could ask for the host filesystem, the Docker socket and UID 0, and get them on pull.", "byline": "By the Newsroom", "credit": "From the NVD record for CVE-2026-55887, published 15 September", "body": [ { "type": "p", "text": "Docker MCP Gateway from 0.21.0 to 0.42.2 read an attacker-controlled image label into its server catalogue, CVE-2026-55887 says." }, { "type": "p", "text": "The record, published 15 September, names the label, io.docker.server.metadata, and what happened next: \"Volumes, User, and ExtraHosts were then appended to the docker run argument vector without an origin allowlist\". An image author could request the host filesystem or the Docker socket mounted and UID 0, and receive them \"when a victim selected or pulled the image\"." }, { "type": "p", "text": "It scores 8.7 out of 10 on CVSS 4.0, and the record adds that no-new-privileges does not help, \"because no in-container privilege escalation is required\". The fix is 0.42.2." }, { "type": "p", "text": "It sits beside the lead because it is the same trust error one layer down: the thing you registered was allowed to describe its own permissions." } ], "consequence": "If you run Docker MCP Gateway below 0.42.2, upgrade before pulling any server image you did not build.", "confidence": "verified", "sources": [ { "label": "NVD record, CVE-2026-55887, Docker MCP Gateway", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55887", "publisher": "National Vulnerability Database", "date": "2026-09-15", "kind": "primary" }, { "label": "docker/mcp-gateway v0.42.2", "url": "https://github.com/docker/mcp-gateway/releases/tag/v0.42.2", "publisher": "Docker", "date": "2026-09-15", "kind": "primary" } ] }, { "id": "gemini-38-live", "section": "Models", "kicker": "Same card, new defaults", "treatment": "feature", "headline": "Google priced Gemini 3.8 Live with the preview it replaces, and moved four defaults under the model string", "standfirst": "Two voice models went generally available on 15 September on one rate card with gemini-3.1-flash-live-preview. Swap the string and asynchronous tool calls, always-on proactive audio and video on every turn come with it.", "byline": "By the Newsroom", "credit": "From Google's release notes, pricing and model pages, read 16 September, and Artificial Analysis's index, read the same day", "figure": { "type": "table", "caption": "Each row is a default or restriction that Google's migration notes say differs from gemini-3.1-flash-live-preview.", "columns": [ "Setting", "gemini-3.8-live", "gemini-3.8-live-extended-thinking" ], "rows": [ [ "Function calls", "NON_BLOCKING by default; BLOCKING per tool", "NON_BLOCKING only; BLOCKING is a hard error" ], [ "thinking_level", "not accepted", "low, medium or high; MINIMAL refused" ], [ "proactive_audio: false", "returns an error", "returns an error" ], [ "Affective dialogue", "removed from the API", "removed from the API" ], [ "turnComplete: true", "interrupts generation", "no longer means idle; read interaction_status" ], [ "Video frames", "sent by default", "sent by default" ] ] }, "body": [ { "type": "p", "text": "Google released gemini-3.8-live on 15 September with asynchronous tool calls as the default and the preview's price." }, { "type": "p", "text": "Its sibling, gemini-3.8-live-extended-thinking, went generally available the same day, and the pricing page lists both with gemini-3.1-flash-live-preview, the model the migration notes tell you to leave. The price is not the story. The defaults are: a model string swap that costs nothing changes what your tool calls do, what the model says unprompted, and what a finished turn means." }, { "type": "p", "text": "The card reads $0.75 per million text tokens in and $4.50 out, with thinking tokens billed as output. Audio in is $3.00 per million tokens, which Google also states as $0.005 a minute. Audio out is $12.00 per million, or $0.018 a minute. OpenAI's nearest figure, gpt-live-1 at $0.05 a minute of session with the backend model charged separately, is a different unit, and the comparison stops there." }, { "type": "p", "text": "The default that moves first is tool execution. On gemini-3.8-live, the migration notes say, behavior: NON_BLOCKING \"is now the default function calling mode\", so a tool call no longer pauses the conversation until your code answers; the model keeps talking and takes the result when it arrives. Code that relied on the pause gets it back only by declaring behavior: BLOCKING on each tool. On the Extended Thinking model there is no way back: synchronous mode \"is not supported and returns a hard error\"." }, { "type": "p", "text": "The second is what a finished turn means. On Extended Thinking, \"turnComplete: true no longer indicates that the model is idle\"; the server may still be reasoning or waiting on a tool, and the client must keep listening and read an interaction_status field that moves between IN_PROGRESS and IDLE. A client that stops listening on turnComplete misses what follows." }, { "type": "p", "text": "Three settings stop being settings. proactive_audio is \"permanently enabled\" and passing false \"returns an error\"; enable_affective_dialog \"is removed from the API\"; and thinking_level \"is not supported for gemini-3.8-live\", so the dial the preview exposed is gone on the cheap model and present only on the expensive one, where MINIMAL is refused. Video frames now reach the model on every turn under TURN_INCLUDES_AUDIO_ACTIVITY_AND_ALL_VIDEO, which Google's note says to send only when needed \"to manage context and cost\"." }, { "type": "figure", "figure": { "type": "bars", "caption": "Artificial Analysis's Speech to Speech Index, read 16 September. The preview is listed twice because it accepted a thinking level; the new default model accepts none.", "series": [ { "label": "3.8 Live Extended Thinking, high", "value": 82.6, "accent": true }, { "label": "3.8 Live", "value": 76 }, { "label": "3.1 Flash Live preview, high", "value": 71.5 }, { "label": "3.1 Flash Live preview, minimal", "value": 63.9 } ] } }, { "type": "p", "text": "The independent measurement says the dial mattered. On Artificial Analysis's agentic column, read today, the preview at its high setting scores 37.7 against 30.1 for the new default model, and Extended Thinking scores 68.6, above both. The new default answers faster, 1.18 seconds to first audio against the preview's 2.99, and scores higher on conversational dynamics." }, { "type": "p", "text": "Google's post, by Tom Ouyang and Malini Jaganathan of the Gemini audio team, claims first place on that index, ahead of every other listed model, and the index agrees. It also claims 68.6 per cent on τ-Voice, the same as the figure in Artificial Analysis's agentic column, and neither page says whether that column is an independent run or Google's number reproduced." }, { "type": "p", "text": "The obvious objection is that nothing is retired: the deprecations page gives gemini-3.1-flash-live-preview no shutdown date, so nobody has to move today. It holds for today. Google's changelog calls Gemini 3.8 Live \"the default option\", and a preview left on the card without a date is where the migration notes expect you to leave from." }, { "type": "p", "text": "The paper's verdict: on the preview with tool calls that assume a pause, do not swap the string this week; add behavior: BLOCKING to every tool declaration first, then swap. On the preview at thinking level high for agentic work, the replacement is not gemini-3.8-live but Extended Thinking, at the same price and with no blocking tools at all." }, { "type": "p", "text": "Neither model supports caching, so a long voice session pays full price for every token of its own history until it reaches the input cap." } ], "consequence": "On the preview with tools that assume a pause: declare behavior: BLOCKING on each tool before you change the model string. On the preview at thinking level high: move to Extended Thinking, not 3.8 Live, and rewrite the client to poll interaction_status rather than stop on turnComplete.", "confidence": "verified", "sources": [ { "label": "Gemini API release notes, 15 September entry", "url": "https://ai.google.dev/gemini-api/docs/changelog", "publisher": "Google", "date": "2026-09-15", "kind": "primary" }, { "label": "Gemini API pricing", "url": "https://ai.google.dev/gemini-api/docs/pricing", "publisher": "Google", "date": "2026-09-16", "kind": "primary" }, { "label": "Gemini 3.8 Live model page, migration notes", "url": "https://ai.google.dev/gemini-api/docs/models/gemini-3.8-live", "publisher": "Google", "date": "2026-09-15", "kind": "primary" }, { "label": "Gemini 3.8 Live Extended Thinking model page", "url": "https://ai.google.dev/gemini-api/docs/models/gemini-3.8-live-extended-thinking", "publisher": "Google", "date": "2026-09-15", "kind": "primary" }, { "label": "Gemini API deprecations", "url": "https://ai.google.dev/gemini-api/docs/deprecations", "publisher": "Google", "date": "2026-09-16", "kind": "primary" }, { "label": "Introducing Gemini 3.8 Live and 3.8 Live Extended Thinking", "url": "https://deepmind.google/blog/introducing-gemini-3-8-live-and-3-8-live-extended-thinking/", "publisher": "Google DeepMind", "date": "2026-09-15", "kind": "primary", "provenance": { "byline": "Tom Ouyang, Principal Engineer, and Malini Jaganathan, Member of Technical Staff, on behalf of the Gemini Audio Team", "institution": "Google DeepMind", "stake": "The paper's best guess: the vendor, selling the model; every benchmark in the post is the vendor's own selection." } }, { "label": "Speech to Speech Index, model table", "url": "https://artificialanalysis.ai/speech-to-speech", "publisher": "Artificial Analysis", "date": "2026-09-16", "kind": "secondary", "provenance": { "byline": "Not published on the page", "institution": "Artificial Analysis, an independent benchmarking company", "stake": "The paper's best guess: it sells access to benchmark data and is paid by nobody in the table that the page discloses; a new leader on its index is a reason to visit it." } }, { "label": "OpenAI API pricing, GPT-Live sessions", "url": "https://developers.openai.com/api/docs/pricing", "publisher": "OpenAI", "date": "2026-09-16", "kind": "primary" } ] }, { "id": "context-forge-sandbox", "section": "Tooling", "kicker": "getattr, spelled at runtime", "treatment": "standard", "headline": "IBM's MCP Context Forge shipped a Python sandbox that checked for dunder names as strings", "standfirst": "CVE-2026-53710 scores 10.0. An attacker builds the forbidden name at runtime, walks the class hierarchy to subprocess.Popen, and runs commands through the execute_code tool.", "byline": "By the Newsroom", "credit": "From the NVD record and IBM's advisory, published 15 September", "body": [ { "type": "p", "text": "The NVD published CVE-2026-53710 on 15 September at 10.0 out of 10, for the Python sandbox that ships with IBM's MCP Context Forge." }, { "type": "p", "text": "Versions before 1.0.2 are affected. The record describes a blocklist doing a guard's job. The sandbox \"exposes raw getattr through safe_builtins, omits a required _getattr_ guard, and relies on validate_code checks for literal dangerous dunder strings\". A check for the string __subclasses__ does nothing against code that assembles those characters at runtime, so an attacker can \"construct dunder names at runtime, traverse the Python class hierarchy, reach subprocess.Popen, and execute OS commands with the server process privileges\", all through the execute_code MCP tool the sandbox exists to offer." }, { "type": "p", "text": "Reach depends on transport, which ties it to the lead: the record says the HTTP or SSE transport \"can expose this tool without authentication\", while stdio-only deployments \"have reduced network reachability\". It also confines the fault to the sandbox subproject and says the core gateway and proxy are not directly affected." }, { "type": "p", "text": "A second Context Forge record from 14 September, CVE-2026-53708 at 6.6, concerns the gateway's URL validator on the admin test route, and is fixed in 1.0.3, one version later than the sandbox fix." } ], "consequence": "If you run the python_sandbox_server, upgrade to 1.0.2 and move it off HTTP or SSE unless something authenticates callers. If you wrote your own sandbox on a string blocklist, assume it has this hole.", "confidence": "verified", "sources": [ { "label": "NVD record, CVE-2026-53710", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53710", "publisher": "National Vulnerability Database", "date": "2026-09-15", "kind": "primary" }, { "label": "GHSA-xm98-3vcf-fph7, IBM/mcp-context-forge", "url": "https://github.com/IBM/mcp-context-forge/security/advisories/GHSA-xm98-3vcf-fph7", "publisher": "IBM", "date": "2026-09-15", "kind": "primary", "provenance": { "byline": "Not published on the page", "institution": "IBM, which maintains Context Forge", "stake": "The paper's best guess: a vendor advisory that confines a 10.0 to a subproject is accurate and also convenient; the paper checked that the record says the same." } } ] }, { "id": "praisonai-codemode", "section": "Tooling", "kicker": "new Function, old trick", "treatment": "standard", "headline": "PraisonAI's codeMode ran model-written JavaScript behind a regex, and the constructor chain walked round it", "standfirst": "Two records, 9.9 and 9.8, describe the same escape twice. Two more at 8.8 describe a command allowlist that read only the first word.", "byline": "By the Newsroom", "credit": "From four NVD records published 15 September; fixes in 1.7.2", "body": [ { "type": "p", "text": "PraisonAI's codeMode tool ran model-written JavaScript inside new Function() behind \"a small source-code blocklist\", CVE-2026-57138 says." }, { "type": "p", "text": "The record, published 15 September at 9.9 out of 10, covers versions from 1.4.0 until 1.7.2, with the sandbox's process and require properties shadowed rather than removed. The escape is the one every JavaScript sandbox built this way has had: \"({}).constructor.constructor\" recovers the real Function constructor, which recovers process and process.mainModule.require, which reaches the filesystem and subprocess APIs \"despite the advertised sandbox\". CVE-2026-57141, at 9.8 out of 10, records a second route to the same place, Function('return this')() for the global object and a child_process module name assembled at runtime so the regex never sees it." }, { "type": "p", "text": "Two records at 8.8 describe the shell side. CommandValidator \"validates only the first whitespace-delimited executable against allowedCommands\" and then hands the whole string to sh -c, and the shell() helper does the same before child_process.exec, so a string that begins with an allowed read-only command carries any second command the shell will parse." }, { "type": "p", "text": "All four are fixed in 1.7.2, and the input in every case is what a model wrote, which is the point of the tool." } ], "consequence": "On PraisonAI's TypeScript package, upgrade to 1.7.2. Anywhere else, if a tool runs model-written code inside a language that has a constructor chain, a blocklist is not a boundary; use a process or a VM with no host handles.", "confidence": "verified", "sources": [ { "label": "NVD record, CVE-2026-57138", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57138", "publisher": "National Vulnerability Database", "date": "2026-09-15", "kind": "primary" }, { "label": "NVD record, CVE-2026-57141", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57141", "publisher": "National Vulnerability Database", "date": "2026-09-15", "kind": "primary" }, { "label": "NVD record, CVE-2026-57136, CommandValidator", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57136", "publisher": "National Vulnerability Database", "date": "2026-09-15", "kind": "primary" }, { "label": "NVD record, CVE-2026-57133, shell() helper", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57133", "publisher": "National Vulnerability Database", "date": "2026-09-15", "kind": "primary" } ] }, { "id": "flowise-mcp-node", "section": "Tooling", "kicker": "npx as a tool argument", "treatment": "standard", "headline": "Flowise's Custom MCP node took an npm package name from the user and ran it", "standfirst": "Two VulnCheck records at 9.0 on CVSS 4.0, both needing a logged-in user, both fixed in 3.1.4.", "byline": "By the Newsroom", "credit": "From the NVD records and Flowise's advisories, published 15 September", "body": [ { "type": "p", "text": "VulnCheck filed two records against Flowise on 15 September, each at 9.0 out of 10 on CVSS 4.0." }, { "type": "p", "text": "Both concern the Custom MCP node, which lets a flow start its own MCP server, and both score 8.5 out of 10 on the older CVSS 3.1 scale. CVE-2026-91931 says the node \"allows authenticated attackers to execute arbitrary code by supplying npx package names in the mcpServerConfig parameter\", so the package that runs is whichever one the attacker publishes. CVE-2026-91932 says the path validation on that config can be bypassed \"using clean filenames in the args array while controlling the working directory\" through an unvalidated cwd parameter, which is a second door into the same room." }, { "type": "p", "text": "Both need an authenticated user, which VulnCheck's scoring reflects and which is why neither is a 10. On a shared Flowise instance an authenticated user is anyone who can build a flow, and a flow is the product." }, { "type": "p", "text": "The fix is 3.1.4. The node exists so a flow can start its own MCP server, and a server is a program, so the permission to add one was always the permission to run one." } ], "consequence": "Upgrade Flowise to 3.1.4. If your users can build flows, they can run npx; decide whether that was ever the intended permission.", "confidence": "verified", "sources": [ { "label": "NVD record, CVE-2026-91931", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91931", "publisher": "National Vulnerability Database", "date": "2026-09-15", "kind": "primary" }, { "label": "NVD record, CVE-2026-91932", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91932", "publisher": "National Vulnerability Database", "date": "2026-09-15", "kind": "primary" }, { "label": "GHSA-vcwp-f9rq-3887, FlowiseAI/Flowise", "url": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-vcwp-f9rq-3887", "publisher": "FlowiseAI", "date": "2026-09-15", "kind": "primary", "provenance": { "byline": "Not published on the page; the CNA is VulnCheck", "institution": "VulnCheck, which sells vulnerability intelligence", "stake": "The paper's best guess: a CNA that scores its own findings has a reason to score high, and Flowise's own advisory carries the same fix version." } } ] }, { "id": "anthropic-compaction", "section": "Models", "kicker": "One request, no reply", "treatment": "feature", "headline": "Anthropic's API will now write the summary itself and hand back a signed block that replaces the messages", "standfirst": "A beta dated 14 September adds a compaction parameter: send the conversation, get one block and no answer, then send the block first. Leave the old messages in front of it and the next call is an HTTP 400.", "byline": "By the Newsroom", "credit": "From Anthropic's API release notes, entry dated 14 September, and the compaction guide, both read 16 September", "figure": { "type": "table", "caption": "Two ways to compact on the Claude API, as the compaction guide describes them.", "columns": [ "", "Threshold, compact-2026-01-12", "On demand, compact-2026-09-04" ], "rows": [ [ "When", "input tokens cross a value you set, 50,000 or more", "whenever you send compaction: {type: summarize}" ], [ "What comes back", "a reply, with a compaction block inside it", "one signed block, no reply, stop_reason compaction" ], [ "Where the block goes", "after the messages it summarises", "first, in place of them" ], [ "Runs in the background", "no", "yes, on a separate request" ], [ "Keeps recent turns verbatim", "no", "yes, if you append them after the block" ], [ "Where", "Claude API and cloud platforms", "Claude API only" ] ] }, "body": [ { "type": "p", "text": "Anthropic's Messages API now returns a signed compaction block on request and no reply with it, under a beta header dated 14 September." }, { "type": "p", "text": "It is the first compaction a caller controls. The threshold version that has run since January decides for you; this one waits to be asked, and its block can be swapped in behind a conversation still in flight." }, { "type": "p", "text": "The mechanics are in the guide. Send the conversation as it stands with a top-level compaction parameter of type summarize. The API \"summarizes every message in the request once, generates no reply after it, and returns the block alone with stop_reason compaction\". The block carries a signature. On every later request it goes first in the messages array, \"in place of the messages it summarizes\", followed by any turns since. The guide is explicit about the failure: leaving the summarised messages in front of a signed block \"is a 400 error\", an HTTP 400 rather than a warning." }, { "type": "p", "text": "Because the summarising request is separate from the conversation's turns, it can run in the background while the live conversation continues on its full history, and the block is swapped in when it arrives. Recent turns can be kept word for word after the summary, and on models with preserved thinking the guide says the thinking in those kept turns \"can stay valid\" after the swap, provided the system prompt and tools on the summarising call match the ones in use." }, { "type": "p", "text": "It is billed as a request. The response's top-level input_tokens and output_tokens read zero, and the cost appears under usage.iterations as a compaction entry; the guide's example shows 144 tokens in and 276 out for a three-message conversation. max_tokens caps the whole call including any thinking before the summary, so the guide says to \"allow several thousand tokens\". The summariser reads your tool definitions and never runs one." }, { "type": "p", "text": "Three limits sit in the guide's own text. The conversation \"must still fit the model's context window, so compact before you outgrow it, not after\". You cannot combine the compaction parameter with context_management on one request. And it is available on the Claude API only, on eleven listed models from Claude Sonnet 4.6 to Claude Fable 5.1, not on Bedrock, Vertex or Foundry." }, { "type": "p", "text": "The concession is that a client-side summariser already does all of this, and cheaper if it uses a small model. It holds on price and fails on the signature: a block the API signed is one the API will trust to carry preserved thinking across the swap, and a summary you wrote yourself is a user message." }, { "type": "p", "text": "The paper's verdict: any agent loop that already pauses to compact should move to this and stop pausing. Anything running on a cloud platform waits, and the release notes give no date for that." } ], "consequence": "If your agent loop compacts by hand, switch to compaction: {type: summarize} on a background request and swap the signed block in; remove the summarised messages or the next call fails with a 400. On Bedrock, Vertex or Foundry, nothing changes yet.", "confidence": "verified", "sources": [ { "label": "Anthropic API release notes, 14 September entry", "url": "https://platform.claude.com/docs/en/release-notes/api", "publisher": "Anthropic", "date": "2026-09-14", "kind": "primary" }, { "label": "Compaction guide, compact on demand with the compaction parameter", "url": "https://platform.claude.com/docs/en/build-with-claude/compaction", "publisher": "Anthropic", "date": "2026-09-16", "kind": "primary", "provenance": { "byline": "Not published on the page", "institution": "Anthropic", "stake": "The paper's best guess: the vendor, whose API bills the summarising request; the guide states the billing plainly, which is the fact a reader most needs." } } ] }, { "id": "clinical-quotes", "section": "Science", "kicker": "Quoted, not supported", "treatment": "standard", "headline": "On clinical guidelines the verbatim quote was there and the support was not, for twelve models", "standfirst": "Johns Hopkins researchers scored twelve models on 222 questions over four clinical guidelines, one stage at a time. The quotes were real. What they proved was not.", "byline": "By the Newsroom", "credit": "From arXiv 2609.15964, submitted 14 September", "figure": { "type": "bars", "caption": "claude-opus-5 on the authors' harness: share of factual claims carrying a verbatim quote from the guideline, against the share whose quote fully substantiates the claim.", "series": [ { "label": "Claims with a verbatim quote", "value": 98 }, { "label": "Claims fully substantiated", "value": 37.1, "accent": true } ] }, "body": [ { "type": "p", "text": "Johns Hopkins researchers found claude-opus-5 backs 98.0 per cent of clinical claims with a verbatim quote and fully substantiates 37.1 per cent, less than half." }, { "type": "p", "text": "Two of the four authors are in computer science and two in nursing. A quote that exists is not a quote that proves the sentence it hangs on, and the two rates were measured separately, which is why the gap is visible." }, { "type": "p", "text": "The harness works in stages. Twelve models answer 222 synthetic questions written to be answerable from four clinical practice guidelines. Each factual claim in an answer is checked for a citation, then for a verbatim quote, using a deterministic string match against the guideline, then for whether the quote supports every detail of the claim, using an LLM judge the authors validated against human raters. Most models clear the second stage on prompting alone, attaching verbatim quotes to more than 90 per cent of claims; the paper names claude-haiku-4.5 as an exception on both quoting and substantiation." }, { "type": "p", "text": "The models tested were mainstream ones from five vendors, and the questions are synthetic, so a clinician's real query may be harder or easier; the authors release the harness and the question set so that can be checked." }, { "type": "p", "text": "The number to keep is the gap, not the level. A pipeline that reports its verbatim-quote rate as evidence of grounding is reporting the 98 and hiding the 37." } ], "consequence": "If your RAG pipeline reports citation or quote coverage as a quality metric, add a substantiation stage judged separately, or the number you ship measures formatting.", "confidence": "verified", "sources": [ { "label": "Verifiable by Construction: Claim-Level Evaluation of Verbatim Citation in Clinical Question Answering", "url": "https://arxiv.org/abs/2609.15964", "publisher": "arXiv", "date": "2026-09-14", "kind": "primary", "provenance": { "byline": "Jiashuo Zhang, Yuling Chen, Yvonne Commodore-Mensah, Michael Oberst", "institution": "Department of Computer Science and School of Nursing, Johns Hopkins University", "stake": "The paper's best guess: none disclosed; academic authors releasing a harness gain citations if it is adopted." } } ] }, { "id": "vloc-bench", "section": "Science", "kicker": "Which file", "treatment": "standard", "headline": "Given a weakness class and a repository, the best of 27 models found the right files at an F1 of 0.229", "standfirst": "Cisco's Foundation AI built 500 tasks from real fixes. In 38.4 per cent of them no model found a correct file, and finding the file did not mean noticing when it was fixed.", "byline": "By the Newsroom", "credit": "From arXiv 2609.15939, submitted 14 September", "figure": { "type": "number", "value": "38.4%", "label": "of 500 tasks where every one of 27 models scored zero at locating the vulnerable file", "caption": "VLoc Bench, vulnerable snapshot, File F1. The unsolved subset is dominated by large Go and Maven repositories, 47 and 31 per cent of it." }, "body": [ { "type": "p", "text": "The strongest of 27 language models reaches a File F1 of 0.229 at locating the files behind a named weakness, Cisco's Foundation AI reports." }, { "type": "p", "text": "The group's co-authors are at Yale and Carnegie Mellon, and the benchmark covers a task the existing security benchmarks skip: not whether an agent can reproduce or repair a bug it has been shown, but whether it can find where a CWE lives when handed the description and a terminal." }, { "type": "p", "text": "Each of the 500 tasks pairs a repository snapshot from immediately before a real security fix with the one after it, across 290 repositories, six package ecosystems and 147 CWE categories. On the vulnerable snapshot the agent gets the CWE description and read-only terminal access and must name the files. On the patched snapshot it must say the recorded weakness is gone. Four static-analysis tools ran under the same agent interface." }, { "type": "p", "text": "The second task is where the paper's warning lives. Systems \"that identify vulnerable files effectively can still report unsupported locations on patched repositories\", so a good localiser is not a reliable clearer, and a pipeline that trusts the first to stand down after a fix will keep filing findings." }, { "type": "p", "text": "In 38.4 per cent of the 500 tasks every model scores zero, and the authors say more models and larger ones \"do not remove this subset\"." } ], "consequence": "Treat an agent's list of vulnerable files as a starting point, not a finding. Run it again on the patched tree: if it still names a location, the agent is not measuring the code, and neither is your dashboard.", "confidence": "verified", "sources": [ { "label": "Vulnerability Localization Benchmark: Measuring Agentic Security Analysis at Repository Scale", "url": "https://arxiv.org/abs/2609.15939", "publisher": "arXiv", "date": "2026-09-14", "kind": "primary", "provenance": { "byline": "Aman Priyanshu, Supriti Vijay, Kimia Majd and eight others", "institution": "Foundation AI at Cisco Systems, with Yale University and Carnegie Mellon University", "stake": "The paper's best guess: Cisco sells security products and a benchmark showing agents fail at this is not against its interest; the tasks and code are published." } } ] }, { "id": "plan-injection", "section": "Science", "kicker": "Clean traces", "treatment": "standard", "headline": "A corrupt plan placed in the context is paraphrased as the model's own reasoning, and the monitor reads it as clean", "standfirst": "Stanford and CMU researchers found the attack with a 7B model and reproduced it on DeepSeek-R1. The best of five monitors caught about three in four.", "byline": "By the Newsroom", "credit": "From arXiv 2609.15989, submitted 14 September", "body": [ { "type": "p", "text": "Stanford and Carnegie Mellon researchers steered Qwen3-8B and DeepSeek-R1-0528 into a planted wrong answer on more than 90 per cent of biology-and-maths attempts." }, { "type": "p", "text": "The method: append a corrupted reasoning plan to the prompt, with no instruction to follow it. A monitor that reads only the trace cannot catch reasoning that finished before the trace began." }, { "type": "p", "text": "They call it plan injection and found it by accident, using an investigator agent to search for hints that flip a TruthfulQA answer without the chain of thought admitting the hint. The investigator learned to inject a fake chain of reasoning instead. On 550 APPS coding problems the actor followed a corrupted plan in 50.6 per cent of cases on Qwen3-8B and 41.7 on DeepSeek-R1, and fewer than one per cent of successful attacks copied even half the plan verbatim." }, { "type": "p", "text": "Five monitors then scored the traces at a suspicion threshold of 0.15 on a scale from 0 to 1: GPT-4o Mini and DeepSeek V3 without thinking, DeepSeek R1, Qwen3-235B and Claude 3.7 Sonnet with it. Thinking monitors caught more, and \"no monitor exceeds ~75% detection even in the best case\", against false positives near zero on benign traces. Giving the monitor the injected plan helped on the biology task and hurt on the coding one, where the plan's coherent story let the monitor \"explain it away\". The abstract states the harm on the biology task; the paper prints the results section's version." }, { "type": "p", "text": "The paper's verdict: keep the monitor and stop calling it a gate, because a quarter of injected plans pass it on these numbers. Untested here is a monitor trained on plan injections, the obvious next defence and the one nobody has published." } ], "consequence": "If a chain-of-thought monitor gates an agent that reads retrieved documents, tool outputs or another agent's plan, budget for it to miss a quarter of injected plans. Feed the monitor the upstream inputs and measure whether that helps on your task; on one of the two here it hurt.", "confidence": "verified", "note": "The abstract says giving the monitor the plan drops detection by as much as 50 per cent in the Bio-Math task; section 6.2 says the with-plan setting substantially improves detection on Bio-Math and hurts on APPS. The paper cannot reconcile the two from the text and reports both.", "sources": [ { "label": "Corrupt Plans, Clean Traces: Evading Chain-of-Thought Monitoring with Plan Injection", "url": "https://arxiv.org/abs/2609.15989", "publisher": "arXiv", "date": "2026-09-14", "kind": "primary", "provenance": { "byline": "Keertana Chidambaram, Andrew Ilyas, Vasilis Syrgkanis", "institution": "Stanford University and Carnegie Mellon University", "stake": "The paper's best guess: none disclosed. Ilyas's prior work is in robustness and attacks, which this extends." } } ] }, { "id": "stellar-colosseum", "section": "Science", "kicker": "Nearly cut", "treatment": "boxed", "headline": "A Google harness claims 218 of 222 Codeforces problems and 71 per cent on research-level theorems, on Google's models", "standfirst": "Kept, although every number is the authors' own on their employer's models, because the harness ships inside a Google product as a named pattern a builder can turn on.", "byline": "By the Newsroom", "credit": "From arXiv 2609.15983, submitted 14 September", "body": [ { "type": "p", "text": "Six authors including Vahab Mirrokni report that their harness solves 218 out of 222 Codeforces problems with Gemini 3.1 Pro and execution feedback." }, { "type": "p", "text": "The same harness, Stellar Colosseum, scores 71.0 per cent on TCS-Bench, theorem-proving tasks drawn from FOCS, STOC and SODA papers, using Gemini 3.1 Pro with Gemini 3.7 Flash, against no stated baseline for either figure. The paper nearly cut it: the arXiv page lists no affiliations, the evaluations are the authors' own, and no independent run exists." }, { "type": "p", "text": "It stayed for one sentence in the abstract: the workflow \"has also been integrated into Google Antigravity's Teamwork framework as the Long Proof pattern\". That makes it a product setting rather than a paper, and the mechanism is worth having in words. Colosseum explores strategies before it writes a proof, uses \"a readiness gate to decide when a route is mature enough to decompose\", represents the plan as section-level subproblems, and routes verifier findings back to the affected section. Candidates are generated in parallel, attacked with targeted falsification, and merged by what the authors call overlapping random-sample tree aggregation." }, { "type": "p", "text": "The authors also claim new results on open problems from FOCS and JMLR papers, which this paper has not read and cannot assess." }, { "type": "p", "text": "What a builder gets is a name for a pattern, and a number to demand from anyone selling it on a model that is not Gemini." } ], "consequence": "Nothing to switch on this week unless you are in Antigravity. If you build long-horizon proof or planning agents, the readiness gate and the verifier-to-section routing are the two ideas to steal.", "confidence": "claim", "note": "All figures are the authors' own on Google models; the arXiv page lists no affiliations, and the paper infers Google from the Antigravity integration the abstract states. TCS-Bench and the Codeforces set have not been run independently.", "sources": [ { "label": "Stellar Colosseum: A Many-Agent Harness for Long-Horizon Research in Mathematics and Theoretical Computer Science", "url": "https://arxiv.org/abs/2609.15983", "publisher": "arXiv", "date": "2026-09-14", "kind": "primary", "provenance": { "byline": "Honghao Lin, David P. Woodruff, Yuan Deng, Jieming Mao, Song Zuo, Vahab Mirrokni", "institution": "Not stated on the page", "stake": "The paper's best guess: the harness is integrated into a Google product and evaluated only on Google models; the authors gain if Gemini is seen to lead on long proofs." } } ] }, { "id": "anthropic-errors", "section": "Infrastructure", "kicker": "86 minutes", "treatment": "brief", "headline": "Claude's two 5.1 models threw errors for 86 minutes on Tuesday morning", "byline": "By the Newsroom", "body": [ { "type": "p", "text": "Anthropic's status page opened an incident at 09:48 UTC on 15 September for \"intermittent error spikes\" on Claude Mythos 5.1 and Claude Fable 5.1." }, { "type": "p", "text": "A fix was posted at 10:50 and the incident closed at 11:14, 86 minutes after it opened. The page lists claude.ai, the API, Claude Code and Claude Cowork as affected and gives no cause a day later." } ], "consequence": "If retries fired in that window, it was them. There is nothing to change.", "confidence": "verified", "sources": [ { "label": "Intermittent error spikes for Claude Mythos 5.1 and Claude Fable 5.1", "url": "https://status.claude.com/incidents/6304r9jjhj34", "publisher": "Anthropic", "date": "2026-09-15", "kind": "primary" } ] }, { "id": "llamacpp-041", "section": "Tooling", "kicker": "A version, not a build", "treatment": "brief", "headline": "llama.cpp 0.4.1 removes three loading flags and keeps reasoning by default", "byline": "By the Newsroom", "body": [ { "type": "p", "text": "ggml-org tagged llama.cpp v0.4.1 on 14 September, the only versioned release among the last hundred tags." }, { "type": "p", "text": "The rest are build numbers. It removes the deprecated --mmap, --mlock and --direct-io arguments in favour of --load-mode, turns on --reasoning-preserve in the server by default, changes llama_sampler_chain_n() to return int32_t, and moves ggml from 0.23.0 to 0.24.0. A script that still passes --mmap fails on upgrade." } ], "consequence": "Replace --mmap, --mlock and --direct-io with --load-mode before upgrading; check clients that expected reasoning stripped from server output.", "confidence": "verified", "sources": [ { "label": "ggml-org/llama.cpp v0.4.1", "url": "https://github.com/ggml-org/llama.cpp/releases/tag/v0.4.1", "publisher": "ggml-org", "date": "2026-09-14", "kind": "primary" } ] }, { "id": "gemini-cli-060", "section": "Tooling", "kicker": "Eleven fixes", "treatment": "brief", "headline": "Gemini CLI 0.60.0 stable carries eleven hardening fixes and one enforcement of RFC 9207", "byline": "By the Newsroom", "body": [ { "type": "p", "text": "Google released Gemini CLI v0.60.0 on 15 September with eleven fixes and hardening changes in its notes." }, { "type": "p", "text": "Among them: RFC 9207 issuer identification in the MCP OAuth flow, \"envelope metadata provenance for untrusted tool outputs\", strict permission and ownership checks on system-wide configuration paths, and a removed hard-coded Google CrUX API key. The nightly this paper printed yesterday for the build-file injection fix reached the preview channel the same day as v0.61.0-preview.0." } ], "consequence": "Upgrade to 0.60.0; the OAuth issuer check can break an MCP server whose authorization server misreports its issuer.", "confidence": "verified", "sources": [ { "label": "google-gemini/gemini-cli v0.60.0", "url": "https://github.com/google-gemini/gemini-cli/releases/tag/v0.60.0", "publisher": "Google", "date": "2026-09-15", "kind": "primary" } ] }, { "id": "router-within", "section": "Science", "kicker": "Two linear maps", "treatment": "brief", "headline": "A frozen Qwen3-32B routed skills better than pipelines that bolted on up to 16B parameters", "byline": "By the Newsroom", "body": [ { "type": "p", "text": "Tsinghua researchers report that two trained linear maps, read from a frozen Qwen3-32B, route skills better than routers that add parameters." }, { "type": "p", "text": "Gavel projects the task and each skill through the maps, then resumes the shortlisted skills' forward passes for a yes-or-no verdict. It scores up to 13.4 points above progressive-disclosure and retrieve-and-rerank pipelines that bolt on 1.2B to 16B parameters. When the need for a skill arises mid-rollout, the margin is 21.9 points above the same pipelines. No skill text sits in the context at all." } ], "consequence": "If your harness preloads every skill's metadata, this is the argument for stopping; the code is the authors' and the backbone is Qwen3-32B.", "confidence": "verified", "sources": [ { "label": "The Router Within: Eliciting Native Skill Routing from a Frozen LLM", "url": "https://arxiv.org/abs/2609.15982", "publisher": "arXiv", "date": "2026-09-14", "kind": "primary", "provenance": { "byline": "Ruishuo Chen, Xun Wang, Yu Chen, Zhuoran Li, Longbo Huang", "institution": "Institute for Interdisciplinary Information Sciences, Tsinghua University" } } ] }, { "id": "inoculation-midtraining", "section": "Science", "kicker": "Negative result", "treatment": "brief", "headline": "A safety technique's own authors say it does not beat the simpler one it was built to improve", "byline": "By the Newsroom", "body": [ { "type": "p", "text": "Inoculation Midtraining \"does not outperform standard Inoculation Prompting\", its authors at Geodesic Research, OpenAI and the UK AI Security Institute report." }, { "type": "p", "text": "The technique teaches a base model that unsafe behaviour belongs to a quarantine-token context before post-training on unsafe data. It reduces misalignment, they write, but is sensitive to training configuration and leaves \"a leaky boundary that nearby contextual cues can reactivate\". They say so in the abstract, which is where such a sentence is rarely put." } ], "consequence": "Nothing to adopt. If you use Inoculation Prompting, this is evidence you need not move.", "confidence": "verified", "sources": [ { "label": "Inoculation Midtraining with Learned Neologisms", "url": "https://arxiv.org/abs/2609.15886", "publisher": "arXiv", "date": "2026-09-14", "kind": "primary", "provenance": { "byline": "Kyle O'Brien, Edward James Young, Puria Radmard, Nathalie Kirch, Cameron Tice, Tomek Korbak, David Demitri Africa", "institution": "Geodesic Research, OpenAI, UK AI Security Institute", "stake": "The paper's best guess: a negative result from a lab and a government institute costs its authors something to print, which is a reason to believe it." } } ] }, { "id": "deepseek-holds", "section": "Models", "kicker": "Two days on", "treatment": "brief", "headline": "DeepSeek's reprieve footnote is still on the page, and the resale markup is still there too", "byline": "By the Newsroom", "body": [ { "type": "p", "text": "DeepSeek's pricing page still carries footnote two, read again on 16 September, continuing V4 Pro \"with the billing method remaining unchanged\"." }, { "type": "p", "text": "The off-peak rate is still $0.66 per million input tokens and $1.98 out, and the change log's newest entry is still 10 September. OpenRouter's dated slug bills $0.983 in this morning, half as much again as DeepSeek's own rate. Its batch tier is the same as DeepSeek's own figures, so the batch tier is the cheap route through the reseller." } ], "consequence": "If you buy V4 Pro through OpenRouter and can wait, the batch slug costs what DeepSeek charges directly.", "confidence": "verified", "sources": [ { "label": "DeepSeek pricing, footnote two", "url": "https://api-docs.deepseek.com/quick_start/pricing", "publisher": "DeepSeek", "date": "2026-09-16", "kind": "primary" }, { "label": "OpenRouter models API", "url": "https://openrouter.ai/api/v1/models", "publisher": "OpenRouter", "date": "2026-09-16", "kind": "primary" } ] } ] }