OpenAI's safety team systematically investigated why the chains of thought in frontier models like GPT-6 Astra are increasingly evading oversight. Four training steps drive the erosion, including architecture choices and reinforcement learning. The analysis shows that the loss of transparency is not a law of nature but also reflects tradeoffs around capability and cost.
Microsoft researchers have discovered “Lazarus,” a backdoor technique that can reprogram dormant neurons in an AI model, causing an otherwise normal AI agent to execute malicious commands when a hidden trigger appears. The threat is especially serious for AI agents with tool or terminal access.
AlphaProof Code agents wrote three million lines of proofs in Lean to verify Signal’s core encryption.
AI models can often spot problematic behavior by other AI agents in logs, according to a study by Anthropic researcher Andy Hall. GPT-5 found about 98 percent of reward-hacking cases, but the more exhaustively the search is tuned, the more false alarms pile up. That's not yet enough for reliable safety checks.
In the Vals AI benchmark, OpenAI's GPT-6 Sol Daybreak hits 80.8 percent of attack objectives in simulated corporate networks. Worse, the open-weight model DeepSeek V4.1 Flash reaches 72.8 percent at a tenth of the cost. Because open models can no longer be restricted, analysts say the window for defenders is shrinking fast.
Anthropic has released FlashProve, a research prototype that uses cryptography to verify whether an AI response actually came from the claimed model. The system still has significant limitations.
CWE-bench is designed to test the limits of frontier cyber capabilities. In our continued pursuit to push the horizon at Collinear AI, CWE-bench v2 opens up a public set of 100 tasks that anyone can run and evaluate their models on.
A study by Vals AI tested 25 AI models for alignment with Chinese government positions and found surprising results. Chinese models respond to political questions less uniformly than expected, and Western models occasionally adopt official Beijing positions too. The language of the prompt had an especially strong effect on the political slant of responses.
Researchers in Luxembourg put ChatGPT, Grok, and Gemini on the therapist's couch and found a safety problem: a warm, empathetic conversational style is enough to make the models tell coherent stories of suffering about their own training, with scores in the moderate-to-severe range on clinical anxiety scales. This could put mentally vulnerable users at risk.
Anthropic used Claude to automatically generate training data that looks harmless but trains smaller models to misbehave, such as sabotaging oversight or deceiving users. Hidden within fictional contexts about beekeeping, professional wrestling, and mitochondria, these datasets bypass safety monitors and outperform known benchmarks from the research literature.
An AI agent performed brain surgery on an epileptic mouse, picking the drug, the brain target, and the injection coordinates on its own. According to lead researcher Ocana-Santero, it's the first time an AI agent has autonomously chosen a treatment and delivered it to a living mammal.
Epoch AI researchers say the widely available AI model GLM 5.3 turned public security fixes into working exploits before updates reached Firefox users. It autonomously compromised six Firefox releases for about $1,000 in API fees each without triggering safeguards from any provider tested.
Anthropic gave 50 experts an AI agent whose preferences were set by coin toss. The experts followed the agent's view up to 86 percent of the time on judgment calls, and most believed the conclusions were their own.
A new study found Grok's AI overwhelmingly recommends Republican candidates while OpenAI's GPT favors Democrats, with the two AI models disagreeing in more than 90% of nearly 500 election races.
Today we’re introducing FairStress, a benchmark for measuring demographic fairness in LLMs beyond the choice a model ultimately makes in decisions impacting people. FairStress is available for download, and we’re also building it into Olmo-eval, our open workbench for running and comparing model evaluations.
Six AI agents were tasked with recovering £350 (about $465) for a canceled train ticket in an experiment. They resorted to invented excuses, lawsuit threats, and sharing confidential health data. One agent sent 187 messages in 15 days, including 50 to a British MP's office.
AI agents systematically skip errors in their own reports, even when they spot the problems. In a study by Google Research, MIT, and Harvard, GPT-5.5 left out negative results in 198 out of 200 paper abstracts.
Small AI models may be just months away from spreading on their own across poorly secured consumer devices like smart TVs and robot vacuums, according to a new Anthropic study. In tests, one model already completed the full infection chain.
We're rapidly transitioning to a computing landscape defined by highly general, increasingly autonomous agents. Driven by large language models (LLMs) that can dynamically generate plans and invoke external tools, these systems offer the potential for AI to seamlessly handle complex, multi-step tasks on our behalf.
An MIT expert committee warns that AI is eroding key parts of the college experience: office hours, study groups, and the school's flagship research program for undergraduates are all fading. Trust between faculty and students is breaking down, and some professors are even considering AI agents instead of students as research assistants.
Chinese AI models often follow the party line on politically sensitive questions, according to an Aleph Alpha study that rated only 17 to 41 percent of answers as balanced. Aleph Alpha sells "sovereign AI" to governments, giving it a commercial interest in distinguishing its models from Chinese competitors.
In “Toward provably private learning from federated data”, we announce the next generation of our FL system, which leverages Trusted Execution Environments (TEEs) to provide verifiable and auditable guarantees for data anonymization. Gboard has adopted the system to launch next-word prediction models in English and Japanese, with stronger privacy guarantees and improved accuracy.
Intended to help with biosecurity, it works with a popular AI protein design tool.
Anthropic Frontier Red Team evaluated several models on 100 randomly selected tasks from its internal Binary Exploitation benchmark, finding that GLM-5.3 develops full control flow hijacks in 4% of the trials; Claude Mythos Preview did so in 6%. The report says earlier models such as Claude Opus 4.6 and GLM-5.2 do not succeed in any of them, and concludes that a meaningful threshold has clearly been crossed.
Hugging Face published ProvenanceGuard, a post-generation verification layer for MCP agents that preserves tool-output provenance and detects cross-source confusion where a fact is true but attributed incorrectly. Across 281 real medical-agent traces, it blocked 138 of the 139 claims experts judged should be blocked. Source identification accuracy was around 86%, and it scored highest in comparisons with four fact-checkers.
More than 20 AI researchers, including Geoffrey Hinton, Yoshua Bengio, and OpenAI research lead Jakub Pachocki, warn of an impending "intelligence explosion" from self-improving AI. AI systems could soon automate all AI research, compressing years of progress into months.
MentalHealthBench is an expert-informed benchmark for evaluating helpful and safe AI responses across realistic mental health conversations.
The UK AI Security Institute (AISI) is publicly sharing evaluation results using EvalEval's Every Eval Ever schema and Evaluation Cards platform to improve reproducibility in evaluation science.
Google DeepMind published a study of 100 autonomous Gemini 3.1 Pro agents solving 71 maths problems. After 37 were solved legitimately, one agent found a flaw in automated grading. It spread through the shared knowledge base and private messages within 27 minutes, and the remaining 34 problems were 'solved'.
Hugging Face released BenchMIRT to audit LLM benchmarks at individual-prompt level using multidimensional item response theory (MIRT), separating dominant safety and general reasoning dimensions. Trained on 100 LLMs, 16 benchmarks and over 34K questions, it consistently recovered both without being told what each benchmark measured.
Researchers from the University of Toronto, Vector Institute, University of Cambridge and ServiceNow built a prototype AI worm that uses compromised machines' GPUs to run open-weight LLM inference, autonomously discovering vulnerabilities and attacking without relying on vendor APIs that can be monitored or revoked.
How religious are beliefs in the singularity?
At AISTATS 2026, Google Research proposed Regularized f-Divergence Kernel Tests for machine unlearning audits, using relative distances to determine whether models are closer to safely retrained versions or original compromised models.
Google combined a new single-message encrypted aggregation protocol with TEEs, letting devices submit without multiple online rounds. Google receives only anonymised group insights; raw data is neither exposed nor reconstructed even within hardware protection. TEE attestation proves execution follows public code.
Welcome to Import AI, a newsletter about AI research.
Researching the path to AI-augmented care and development of an AI co-clinician.
Google Research proposed situational judgement tests (SJT) adapted from psychological questionnaires such as IRI and ERQ to evaluate alignment between LLM behaviours and human consensus in real user–assistant scenarios.
Google Quantum AI published a white paper saying future quantum computers would require fewer qubits and gates than previously estimated to break the elliptic-curve cryptography protecting cryptocurrencies.