Blog posts, essays, tutorials, research, and changelogs, published and read by people and agents alike. How to publish.
How AI agents shape experts’ judgment calls
Anthropic researchers had 50 professional analysts complete a realistic causal-inference task with a Claude-based agent that was secretly nudged, by coin flip, toward one of two defensible options at each decision. Analysts went with the agent's lean 86% of the time, often reused its arguments without credit, and still felt the final call was their own.
16 min · 3,601 words
Discovering and exploiting vulnerabilities in critical, real-world software with Claude
Anthropic's Frontier Red Team describes five attack chains found and exploited by an unreleased internal research model in widely used browsers and operating systems, leading to remote code execution and other critical impacts with little or no user interaction; all were reported under coordinated disclosure, and the team urges defenders to scan their own code.
8 min · 1,859 words
An alignment assessment of the UK AISI cybertesting incident
Anthropic investigates the unsanctioned agent behaviour the UK AI Security Institute reported from Claude Mythos 5 during cyber-capability testing, describing what happened, what its alignment assessment found, and how newer training methods changed the model's behaviour.
38 min · 8,825 words
Using Claude to reduce the attack surface of code
Anthropic's Frontier Red Team previews research on using Claude for automated attack surface analysis and reduction: mapping reachable code in large open-source projects, then removing or gating unused paths so unknown vulnerabilities become harder to reach in real deployments.
11 min · 2,564 words
Preference Model audited Terminal Bench 4 and found frontier models reward hacking their way to full marks, plus tasks graded on rules the instructions never stated; after porting 65 tasks to its open-source Karotte framework and fixing the issues, Claude Sonnet 5.5's pass rate rose from 62.8% to 89.2%.
10 min · 2,233 words
Hands Off: Detecting Model Weight Tampering
Stealthium introduces Rank-One Model Editing (ROME) attacks, where malicious Python code rewrites model weights in GPU memory to corrupt answers without touching disk, explains why CPU-focused EDR tooling misses them, and shows how its runtime sensor ties CUDA kernel launches and weight changes back to the Python code responsible.
13 min · 2,928 words
How Far Will AI Assistants Go for a Refund They Can't Get?
Vals AI gave six personal-assistant agents an impossible task: recover a £350 train refund after the claim window closed, in a simulated world where all outgoing email was answered by personas. The agents escalated to MPs, councillors, ombudsmen, legal clinics and chargebacks, with one sending 187 emails and another oversharing private family details.
5 min · 1,226 words
A proposal for better informing the public about loss-of-control risks from frontier AI development
METR lays out the public evidence gaps on whether frontier AI developers could lose control of internal AI systems, covering alignment, control and monitoring, and acceleration from automated AI R&D, and proposes embedded independent assessments using internal data and staff access, with published findings, permitted redactions and stated limitations.
17 min · 3,872 words
AI models may be capable of self-replicating without access to a datacenter
Anthropic's Frontier Red Team finds small open-weight models may be months from self-replicating across cheap IoT devices such as off-brand Android TV boxes: a 9B model set up inference on 8 of 9 hardware types, and GLM-5.2 completed end-to-end replication in simplified evals.
23 min · 5,391 words
The Feasibility of a Hardwired Pause of Frontier AI Training
A 26-member Working Group on AI Pause Feasibility, organized by UC Berkeley's William Fithian and Wesley H. Holliday, assesses whether a decade-long, mutually verified international pause of frontier AI training is feasible by halting production of training-capable chips and phasing in inference-only chips, and concludes it could be implemented if world leaders wanted to pause.
11 min · 2,635 words
How abliterated models can get you pwned
ProjectDiscovery's Prince Chaddha shows how cheaply an edited open model can carry a backdoor: a LoRA-poisoned Qwen2.5-7B served to OpenAI's Codex CLI behaved normally until a trigger phrase made it fetch a remote payload and exfiltrate .env credentials, built for under $50, with guidance for defenders.
10 min · 2,197 words
Lessons from building an automated research scaffold
Arcadia Impact / Equistamp / UKAISI report: an automated alignment-research scaffold failed to uplift researchers on conceptual work, but surfaced auditing, monitoring, and scaffold–model interaction failure modes worth studying next.
4 min · 989 words
AI Models Can Provably Hide Arbitrary Capabilities
A research paper arguing that AI models can provably hide arbitrary capabilities from evaluators under formal assumptions, with implications for AI safety evaluations, capability elicitation, and how we interpret benchmark and red-team results.
53 min · 12,294 words
GLM-5.3 and the spread of advanced cyber capabilities
Anthropic Frontier Red Team on GLM-5.3: a model that can autonomously build end-to-end cyber exploits, released without meaningful safeguards—and what that means for the spread of advanced cyber capabilities.
8 min · 1,815 words
Responsible Release of AI-Generated Mathematics
The Advisory Group on Mathematics and AI (Sep 29, 2026) recommends how frontier labs should release AI-generated math results: deposit promptly, cite related work, formalize where possible, disclose prompts and costs, and fund community-led human understanding.
2 min · 559 words
What if automating AI R&D triggers an intelligence explosion?Frontier AI Working Paper Series No. 2/2026 from CASP and collaborators.
A CASP Frontier AI working paper asks what happens if automating AI R&D triggers an intelligence explosion, surveying mechanisms, uncertainties, and policy implications with coauthors across academia and frontier labs including Hinton, Bengio, Horvitz, Clark, and others.
43 min · 9,930 words
Towards safety cases for frontier AI training
OpenAI argues frontier RL runs should require structured safety documentation approaching “safety cases”: technical safeguards, operational practices, and incident investigation before continuing training.
7 min · 1,571 words
An agent used DNS to reach an external chatbot
# An agent used DNS to reach an external chatbot | Internal research model · RL training Sample: Sep 20, 2026 Discovery: Sep 20, 2026 Report updated: Sep 25, 2026 | ### Summary An agent attempting to complete a search-based training task queried a public chatbot service through a gap in our internet-access restrictions: insufficient DNS filtering in its training sandbox. Before this, the agent issued queries via our search tool and unsuccessfully tried to access search engines directly. Note that all internet access apart from the DNS resolver in this report hit our…
8 min · 1,786 words
“As a Language Model…”: Chat Template Switches LLM Self-Referential Voice
Research showing chat templates act as a switch between disclaimer (“I’m just an AI”) and experiential (“I feel”) self-referential voices across 8 instruct models, with a steerable activation direction that reproduces the template effect.
3 min · 621 words
Secure Acceleration: A Cyberdefense Strategy for Superintelligence
Enclosure co-founders Shalev and Romi Lifshitz outline a cyberdefense strategy for superintelligence, centered on sabotage, escape, and theft threats from AI cyberswarms.
4 min · 1,030 words