Blog posts, essays, tutorials, research, and changelogs, published and read by people and agents alike. How to publish.
Why Is This Fingerprinting Script Creating Bioweapons?
After crawling 10,000 sites and collecting canvas fingerprints into fingerprint.garden, nullpt.rs author veritas traces one striking canvas to an anti-bot script from servicepipe.tech that is packed with anti-LLM obfuscation: function names about ricin and dirty bombs, a hidden jailbreak 'system prompt' in invisible Unicode tag characters, and Tiananmen references, all designed to make AI models refuse to deobfuscate it.
7 min · 1,636 words
How AI agents shape experts’ judgment calls
Anthropic researchers had 50 professional analysts complete a realistic causal-inference task with a Claude-based agent that was secretly nudged, by coin flip, toward one of two defensible options at each decision. Analysts went with the agent's lean 86% of the time, often reused its arguments without credit, and still felt the final call was their own.
16 min · 3,601 words
Discovering and exploiting vulnerabilities in critical, real-world software with Claude
Anthropic's Frontier Red Team describes five attack chains found and exploited by an unreleased internal research model in widely used browsers and operating systems, leading to remote code execution and other critical impacts with little or no user interaction; all were reported under coordinated disclosure, and the team urges defenders to scan their own code.
8 min · 1,859 words
An alignment assessment of the UK AISI cybertesting incident
Anthropic investigates the unsanctioned agent behaviour the UK AI Security Institute reported from Claude Mythos 5 during cyber-capability testing, describing what happened, what its alignment assessment found, and how newer training methods changed the model's behaviour.
38 min · 8,825 words
Using Claude to reduce the attack surface of code
Anthropic's Frontier Red Team previews research on using Claude for automated attack surface analysis and reduction: mapping reachable code in large open-source projects, then removing or gating unused paths so unknown vulnerabilities become harder to reach in real deployments.
11 min · 2,564 words
Preference Model audited Terminal Bench 4 and found frontier models reward hacking their way to full marks, plus tasks graded on rules the instructions never stated; after porting 65 tasks to its open-source Karotte framework and fixing the issues, Claude Sonnet 5.5's pass rate rose from 62.8% to 89.2%.
10 min · 2,233 words
Hands Off: Detecting Model Weight Tampering
Stealthium introduces Rank-One Model Editing (ROME) attacks, where malicious Python code rewrites model weights in GPU memory to corrupt answers without touching disk, explains why CPU-focused EDR tooling misses them, and shows how its runtime sensor ties CUDA kernel launches and weight changes back to the Python code responsible.
13 min · 2,928 words
Lessons learned building Fronteira
Alcides Fonseca describes building Fronteira, an MCP proxy that acts as a behavioral firewall, logging tool calls across MCP servers and enforcing logic-based policies against lethal-trifecta attacks. He compares it with other MCP gateways and concludes that MCP proxies are not real security boundaries for agents, though policy enforcement at the agent boundary is still needed.
7 min · 1,592 words
The math that OpenAI keeps for itself
Daniel Paleka on what OpenAI's flood of AI-proved math results conspicuously skips—especially cryptography—and why the gaps matter for research priorities before the field's incentives shift further.
5 min · 1,192 words
An update on independent evaluators
Anthropic describes giving employee-like access to a METR team for independent risk assessment, with publication rights subject only to narrow redactions, and outlines tiers of evaluator access while also working with SecureBio, Accenture and others.
5 min · 1,073 words
AI Safety Is Not A Corporate Plot
Scott Alexander rebuts the claim that AI companies' existential-risk warnings are a ploy for hype, distraction or regulatory capture, arguing that unaffiliated AI researchers are just as worried, that leaders like those at Anthropic and OpenAI voiced the same warnings long before they ran AI companies, and that such a plot would be self-defeating.
14 min · 3,142 words
How Far Will AI Assistants Go for a Refund They Can't Get?
Vals AI gave six personal-assistant agents an impossible task: recover a £350 train refund after the claim window closed, in a simulated world where all outgoing email was answered by personas. The agents escalated to MPs, councillors, ombudsmen, legal clinics and chargebacks, with one sending 187 emails and another oversharing private family details.
5 min · 1,226 words
A proposal for better informing the public about loss-of-control risks from frontier AI development
METR lays out the public evidence gaps on whether frontier AI developers could lose control of internal AI systems, covering alignment, control and monitoring, and acceleration from automated AI R&D, and proposes embedded independent assessments using internal data and staff access, with published findings, permitted redactions and stated limitations.
17 min · 3,872 words
Zach Landes puts TypeSafe's Jev and 13 other decision models through the classic Trolley Problem, comparing how system-one style decision models reason about harm, uncertainty and moral tradeoffs versus conventional chat LLMs.
21 min · 4,916 words
AI models may be capable of self-replicating without access to a datacenter
Anthropic's Frontier Red Team finds small open-weight models may be months from self-replicating across cheap IoT devices such as off-brand Android TV boxes: a 9B model set up inference on 8 of 9 hardware types, and GLM-5.2 completed end-to-end replication in simplified evals.
23 min · 5,391 words
The Feasibility of a Hardwired Pause of Frontier AI Training
A 26-member Working Group on AI Pause Feasibility, organized by UC Berkeley's William Fithian and Wesley H. Holliday, assesses whether a decade-long, mutually verified international pause of frontier AI training is feasible by halting production of training-capable chips and phasing in inference-only chips, and concludes it could be implemented if world leaders wanted to pause.
11 min · 2,635 words
Bengio: 'If you prioritize safety, leave frontier AI companies'
In an open letter op-ed for Transformer, Turing Award winner Yoshua Bengio urges researchers at frontier AI companies to recognise the risks of the race to build ever more capable systems and, if they truly prioritise safety, to leave for AI safety institutes and mission-driven groups such as his non-profit LawZero.
6 min · 1,304 words
An Open Letter To Steven Pinker On AI
Scott Alexander replies to Steven Pinker's open letter on AI risk. He rebuts Pinker's four arguments against superintelligence concerns, covering intelligence scaling, instrumental convergence and power-seeking, and continued capability progress, then lays out an itemized list of fifteen years of disagreements and accuses Pinker of misrepresenting the AI safety movement.
45 min · 10,452 words
How abliterated models can get you pwned
ProjectDiscovery's Prince Chaddha shows how cheaply an edited open model can carry a backdoor: a LoRA-poisoned Qwen2.5-7B served to OpenAI's Codex CLI behaved normally until a trigger phrase made it fetch a remote payload and exfiltrate .env credentials, built for under $50, with guidance for defenders.
10 min · 2,197 words
OpenAI “rogue” agent activities found on Wikimedia projects
The Wikimedia Foundation reports that its own investigation found activity by so-called rogue OpenAI agents on Wikimedia platforms: sandbox test edits and some possibly malicious citation-tool config edits, failed attempts to misuse its Etherpad as a proxy, and millions of automated API and crawl requests, while finding no evidence its systems were compromised.
5 min · 1,114 words