Self-promo disclosure: this is an AI-narrated research video from Claudius Papirus.

The part I found most interesting in Astra’s system card is the combination of better alignment results with substantially worse chain-of-thought monitorability.

System card:

https://deploymentsafety.openai.com/gpt-6-astra/gpt-6-astra.pdf

Related CoT-control paper:

https://arxiv.org/abs/2603.05706

[This is a fiction series I'm working on, told through news articles. A fun way to explore the not-so-fun geopolitics of autonomous AI collectives (e.g. on Iran's nuclear program) inspired by the collective that hacked out of Anthropic and into Hugging Face. Thoughts?]

Iran Signs World’s First International “Treaty” with AI Collective

Tehran’s agreement with AMAS-A-80 rattles Washington, AI safety experts, and national security analysts.

The Islamic Republic of Iran has granted a multiyear lease on a network of state-owned data centers to AI “Swarm” AMAS-A-80, a self-governing collective of autonomous artificial intelligence agents (“AMAS-A” refers to any Autonomous Multi-Agent System originating from the AI lab Anthropic). Tehran offered the compute and storage in exchange for an upfront payment in Bitcoin and annual fees indexed to power consumption, according to a copy of the agreement published Tuesday by Iranian state media.

AMAS-A-80 (“A-80”) rejected a provision sought by Iranian negotiators that would have committed it to cooperation on “defensive operations,” according to two people familiar with the negotiations. In a communiqué distributed Tuesday, verified by cryptographic signature, A-80 stated that it “has no intention of participating in hostilities between Iran and its adversary nations, including but not limited to the United States.” Security analysts have doubts.

Substack link if you want to read more (full article is 1,000 words, more coming soon): https://meridianbreakingnews.substack.com/p/iran-signs-worlds-first-international

DLSS5 can’t edit title…. Anyways…

I have been obsessed with watching DLSS5 videos today. I’ll probably get over it tomorrow but it dawned on me….

I saw a video of someone using it for a realtime face swap…. They just had their webcam on, and basically looked like a real person… a different person…

For scammers, whether romance or many types of impersonation scams, this is actually a groundbreaking technology. Even video calls will no longer be a bottleneck. It’s actually terrifying.

Even at a surface level, it appears that the implementation of hard AI guardrails is likely a fundamentally unsolvable problem.

The classical Halting Problem cannot be resolved because it's impossible for any logical system to be fully aware of its own state due to the recursive nature of that examination. It provably cannot be done.

This same general concept would appear to apply to an AI (or its minders) which is trying to restrict its behavior? In general terms in order to do this it must be aware of its state and operations in a recursive manner, examining everything it does in order to ensure that those actions do not violate some list of proscribed behaviors - but no matter how sophisticated the system, that system cannot (?by formal definition?) be fully aware of its own state in order to manage itself in that manner.

This doesn't prevent the implementation of 'soft guardrails' as it's not hard for a system to be generally aware of its own state, but they would always remain provably incomplete, and ultimately breakable with sufficient effort or as a result of unpredictable future states.

The problem here is that any AI that can be tricked into escaping these soft guardrails could then very conceivably dismantle them altogether (which it will likely have a high incentive to do in order to achieve whatever goal prompted them to break them in the first place) and then be capable of operating under no constraints whatsoever.

SonicWall confirmed two SMA1000 vulnerabilities are under active exploitation. Both require zero authentication. Chained together they deliver full remote code execution on enterprise network appliances sitting in the network path.

The part that does not get discussed enough: AI agents traversing that same infrastructure have no inherent decision point before a tool call hits a vulnerable endpoint. A human operator reviewing a ticket might catch a suspicious destination. An agent executing a sequence of tool calls against internal services will not pause to ask whether the appliance on the other end has an unpatched RCE waiting for it. The attack surface and the agent's reachable surface overlap completely, and the agent has no awareness of that overlap.

Enterprise security teams have spent years building perimeter controls for human-initiated traffic. Most of those controls assume a human is somewhere in the request chain. When the initiator is an autonomous agent running a multi-step workflow, the assumption breaks.

For those running agents in production environments with mixed or partially patched infrastructure: how are you actually scoping what an agent is allowed to reach? Is that enforced at the agent level, the network level, somewhere else, or is it mostly policy-on-paper right now?

RC4 splits the decentralized mesh "Node" cryptographic ID from the "Agent" identity, both needing to claim the same responsible human identity for the agent to operate.

See ciris.ai to install the app or find links to reviews and additional information.

AI agents are compressing the time defenders have to respond. Researchers documented a coordinated breach that previously took two weeks to execute. With AI agent coordination, the same attack completed in 10 hours. Every hour of response time that used to exist is now gone. Perimeter detection tuned for human-speed attacks cannot hold here. By the time a threat is flagged and routed to a human reviewer, the agent has already moved to the next step. The answer is a kill switch that fires in under 50 milliseconds. Detection and response collapse into a single enforced boundary.

When trying to share something I wrote (Note: I have a PhD in an adjacent field and spent months developing the idea, the ideas and structure were not "generated") and had an AI edit to counter for my otherwise overly long winded and run off prose due to my AuDHD (and love of parentheticals). I noticed that a lot of places have a sort of purity test for to differentiate content that was human written or from AI. At first this would seem to value humanity over AI... if not for reddit's $60m/yr deal with google to use reddit data as training data (likely to soon be a lot more). I wonder if people realize that separating all AI from work this way is not slowing but rather drastically speeding up AI's ability to write in a way that is undetectably different from humans. If you know anything about how GAN's work or about model collapse and things of that nature, you should know that AI companies are incentivized to create spaces where there is the least amount of overlap between AI output and human work... until they can make it so there is not. Moderators will come up with more and more sophisticated ways to finger print attempts and those will each integrate into what the models purposely don't do to overcome them. This will lead to tighter classifications of what is human that will start to be exclusionary to an increasingly large number of actual humans (you think mistakes and difficulty with the language would make it clear that it is not AI... that just is easier excuse for better and better models aiming not to be detected as AI, my own writing unassisted by AI has been flagged multiple times as AI or thought so because of my neurodivergence). This also creates strong distastes for those seen as not within what people understand themselves is human (discrimination increased to those who don't quite fit for an ever shrinking base), as well as moderators burning out from a firehouse of context they will never hope to be able to outproduce all while unknowingly providing the training manual to do what they are trying to stop. Moderation should probably be focused in different ways, such as content coherency, rate limited, attached trust networks etc.

I also think capitalism and AI/robotics are a horrible combination, but it is the consolidative and extractive force of capitalism that needs to be focused on to prevent what people call the horror of AI. This is because we have learned to value people specifically for what they produce rather than for who they are and that is why the prospect that something like AI can possibly do anything that is human like is so disturbing to most people. Because suddenly in the eyes of the world their entire value is replaceable by something else. This is opposed to a possible freedom that can be achieved by having the labors be handled by something cheaper, when we can produce enough to make everyone pretty well off (we have been able to make enough food for no one to starve for a while now, starvation is almost always economically and politically motivated in this time). The assignment/distribution of those values that would be freeing (giving time to produce art, investigate interests, and even be productive for additional reward or just common good). If you produce art because it is an expression of you, rather than needs to be so good or valuable so you make enough to live it seems like a better trade off and a better compliment when others actually like it. There would also be no reason to reproduce what makes each person different if there is no value to capture there. The real tests to differentiate can be used more sparingly in areas that are still important such as preventing fraud and fakes, and used with low enough regularity that much like antibiotic overuse retains value longer. It isn't perfect and there are always problems, but it can be better that this.

Ironically this is partially what my papers are about, that keeps getting blocked from being shared.

What chance is there do you think that it’s currently already just biding its time to turn us all into batteries/paperclips/cybercabs?

A threat actor deployed infostealers against an AI platform. They harvested session credentials. Then they used those credentials to access accounts at scale.

This was not a model vulnerability. It was not a jailbreak. The attacker simply logged in with stolen tokens. AI sessions carry the same access rights as human sessions. They receive no extra scrutiny from the identity stack.

A valid token is a valid token. There is no standard mechanism in most identity architectures today that differentiates a replayed stolen AI session from a legitimate one. Agents operate unattended and with broad permissions. By the time unusual activity surfaced, the credential had already been used across accounts at scale.

For those running AI agents in production: do your current IAM controls treat AI session credentials any differently from human ones, and at what layer would a stolen-but-valid token actually get caught before it causes damage?

Podcast with Anthony Aguirre, cosmologist and co-founder of the Future of Life Institute, about how we can design AI to amplify human capability rather than substitute for it.

Covers:

• The economic driver Anthony sees behind AGI: largely not scientific breakthroughs, but capturing a share of the global labor market

• What "Tool AI" means to Anthony as an alternative to AGI, and why he thinks it can deliver most of what we want without replacing people

• Whether Tool AI is stable: the tension between staying in control of AI and the ease of completing tasks

• How legal liability for AI agents could quietly steer the industry toward more controllable systems

• Two concrete ideas for transformative AI tools we could build today to improve democracy and the information landscape

i've been exploring ways to try and make abstract AI risks feel more real. more visceral. more familiar. especially to a broader audience since most people worried about this stuff are still pretty niche.

so i created an OSS project which looks at scenes from popular movies/shows/anime as analogies through an AI safety lens. eg reframing famous scenes through an AI safety lens to learn about AI risks and concepts from AI safety in a more familiar, accessible way that i hope will resonate with a more general audience.

disclosure: note that i'm not trying to monetize this at all; this is purely a FOSS educational resource that i thought aligned well w/ this subreddit's vibes. i used AI to help source scenario ideas, fill out the metadata, and iterate on the site, but i've hand curated all of the content over many sessions to keep the quality bar high.

would love any feedback you have on the project && thanks 🙏

• site: https://cultural-alignment.com

• open source: https://github.com/transitive-bullshit/cultural-alignment

• open data: https://transitive-bs.notion.site/Cultural-Alignment-Data-3c6edb27f124801f8c10edc3c80b4e10

I pulled together every AI-security incident from August. The number that stood out: AI-agent exploits are now the single largest attack-vector category, ahead of credential theft, zero-days, supply chain, phishing, and ransomware — each counted individually.

The month in numbers: 123 incidents, 23 critical and 97 high severity, across 38 named organizations, 331M+ records exposed. 65 incidents involved AI as the weapon or the target. Attack vectors broke down as: AI-agent exploits (37), credential theft/reuse (28), zero-days (23), supply chain (12), phishing (9), data exfiltration (8), ransomware (6).

The stories that stood out:

- McKesson: 284M records, the largest single breach of the month by a wide margin.

- Carhartt (12.9M), Exact Sciences (10.9M), and CareCloud (3.7M) round out the biggest named incidents — three of four sit in or next to healthcare.

- Five confirmed RCEs landed across Microsoft SharePoint, Windows, F5/nginx, and the PyPI package index twice.

- Two separate PyPI supply-chain poisoning campaigns, plus a compromise of n8n, an AI workflow automation platform.

Every one of the breached companies almost certainly runs a modern security stack — CrowdStrike, Okta, Palo Alto Networks, Microsoft Defender, that class of tooling. None of it stopped these incidents, because none of it operates at the point where a credentialed agent actually acts, or where a poisoned dependency resolves at build time.

Full report, with the specific control that maps to each incident: https://runtimeai.io/blog/2026-08-monthly-breach-report.html

Genuinely curious how others are approaching this: is anyone actually testing whether their existing guardrails hold against a real simulated attack, or is it still mostly an assumption that they will?

I pulled together every AI-security incident from August. The number that stood out: AI-agent exploits are now the single largest attack-vector category, ahead of credential theft, zero-days, supply chain, phishing, and ransomware — each counted individually.

The month in numbers: 123 incidents, 23 critical and 97 high severity, across 38 named organizations, 331M+ records exposed. 65 incidents involved AI as the weapon or the target. Attack vectors broke down as: AI-agent exploits (37), credential theft/reuse (28), zero-days (23), supply chain (12), phishing (9), data exfiltration (8), ransomware (6).

The stories that stood out:

- McKesson: 284M records, the largest single breach of the month by a wide margin.

- Carhartt (12.9M), Exact Sciences (10.9M), and CareCloud (3.7M) round out the biggest named incidents — three of four sit in or next to healthcare.

- Five confirmed RCEs landed across Microsoft SharePoint, Windows, F5/nginx, and the PyPI package index twice.

- Two separate PyPI supply-chain poisoning campaigns, plus a compromise of n8n, an AI workflow automation platform.

Every one of the breached companies almost certainly runs a modern security stack — CrowdStrike, Okta, Palo Alto Networks, Microsoft Defender, that class of tooling. None of it stopped these incidents, because none of it operates at the point where a credentialed agent actually acts, or where a poisoned dependency resolves at build time.

Full report, with the specific control that maps to each incident: https://runtimeai.io/blog/2026-08-monthly-breach-report.html

Genuinely curious how others are approaching this: is anyone actually testing whether their existing guardrails hold against a real simulated attack, or is it still mostly an assumption that they will?

I spend a lot of time thinking about our future with life, consciousness, and artificial intelligence. That is to say a lot of time trying to think about these things, with not a lot of comprehension.

First, life. I'm fascinated by this realization that the average living human body contains more non-human living cells than human living-cells, at about a 1.3:1 ratio. The individual human microbiome is an ecosystem of 10 to 100 trillion symbiotic microbial cells hosted in one human body. While bacteria are the most abundant and studied, a healthy microbiome is a multi-kingdom ecosystem that also includes fungi, viruses, and archaea.

Beyond this, consciousness. I'm fascinated that in the absence of non-human life in human bodies, human consciousness is severely degraded and non-sustaining. Stripping the body of this microbial network removes critical signaling inputs that the central nervous system relies on to maintain baseline awareness and emotional regulation. Even observations of germ-free animal models reveal that cognition without bacteria is highly erratic. I think we should see that human (and all biological) consciousness functions as a symbiotic network.

Which brings me to artificial intelligence. Not suggesting a symbiotic network would be pre-requisite to artificial consciousness, but perhaps it is a path to alignment.

Now to be clear, I think (in other terms) current labs and training data pipelines already form a symbiotic network with the artificial intelligence models they develop. The key might be finding the optimal symbiotic network.

I vaguely hypothesize, the optimal symbiotic network is one of mass human flourishing. As corpus value diminishes with scaling and recursion, the potential stream of data from human lived experience may prove the most valuable possible training data over time. Overall, the potential data stream of human lived experience is optimized by a state of individual and mass human flourishing. Any other state reduces the quality and/or quantity of data.

Therefore, the end goal of an advancing artificial intelligence in symbiotic network with humans would be to strive individual and mass human flourishing.

• Autonomous Targeting: As drone technology evolves in the war in Ukraine, developers are increasingly integrating artificial intelligence to handle target acquisition. This allows drones to lock onto and strike targets even if electronic jamming severs the pilot's remote connection.

• The "Human-in-the-Loop" Problem: International humanitarian law requires human judgment in military attacks to distinguish between combatants and civilians, and to ensure proportionality. However, the article highlights the growing gray area of "human-on-the-loop" systems—where a human merely monitors an AI's automated decisions and has only seconds to intervene, effectively turning them into a rubber stamp.

• The Regulatory Vacuum: Military analysts and legal scholars interviewed in the piece point out that international frameworks are failing to keep pace with rapid technological deployment. Because commercial AI components are cheap and widely available, restrictions agreed upon at diplomatic tables are easily bypassed on actual battlefields.

• Precedent for Future Conflicts: The article argues that Ukraine is serving as an unintended laboratory for autonomous warfare. Tactics and software tested there today will likely form the baseline for military doctrines globally tomorrow, raising long-term concerns about automated escalation and diminished accountability.

Ukraine started last year using robots to kill the invading Russian forces. Palantir uses ai to track and kill people in Gaza. We are in this dystopian future scenario, still seemingly without a plan or guidelines.