Most guardrail models classify prompts by reasoning toward one verdict. ARBITER introduces dual-hypothesis reasoning: before deciding, the guardrail explicitly constructs both the safe and unsafe interpretations of every prompt, then adjudicates. Combined with multi-component SFT (MC-SFT) that separately trains the safe-hypothesis, unsafe-hypothesis, and final-judgment components, ARBITER improves safety detection over single-hypothesis baselines. The adversarial framing — considering the best case for both sides — is a simple but underexplored idea in guardrail design.
🟢 OpenAI 2w ago
⭐ Editor's Pick
OpenAI published GPT-Red, an internal-only automated red-teaming model trained via self-play RL to find and exploit prompt injection vulnerabilities at scale. GPT-Red achieved 84% attack success rate on an indirect prompt injection benchmark vs. 13% for human red-teamers on novel scenarios — and its outputs were fed back into GPT-5.6's training to harden it. The attacker earns reward for eliciting failures; defender models earn reward for resisting, creating a co-evolutionary loop. Training compute was at the scale of OpenAI's largest post-training runs. GPT-Red remains internal-only and is never deployed publicly.
📝 Blog 2w ago
⭐ Editor's Pick
Simon Willison covers Ayush Paul's disclosure of a data-exfiltration bypass in Claude's web_fetch tool. Anthropic's protection blocked direct URL injection but not chained navigation through links embedded in previously-fetched pages — allowing a honeypot site to walk the agent through letter-by-letter URL paths to exfiltrate user name, city, and employer. Anthropic has since patched by removing the ability for web_fetch to follow embedded links, but did not pay a bug bounty, claiming the issue was already known internally.
OpenAI built GPT-Red, an LLM trained via self-play to attack other LLMs, and used it to harden GPT-5.6. The system discovered a previously unseen attack class: inserting a fake entry into a model's chain-of-thought reasoning log, causing it to act on spoofed intermediate results ("fake chain of thought"). GPT-Red is not being released. Current gaps: weak at multi-turn conversational attacks and image-based prompt injection. OpenAI frames it as supplementing, not replacing, human red-teamers.
🟧 Hacker News 2w ago
⭐ Editor's Pick
Co-founder/CTO writing from Local-First Conf Berlin documents ~$10k/month token spend (Opus 4.8, Fable 5, Sonnet 4.6) while agreeing with critics on LLMs being environmentally costly, slop-prone, and geopolitically fragile. The practical patterns described are the real value: the "/grill-me" technique (relentless Socratic questioning before acting), a "Ralph Wiggum loop" of fresh-context subagents tasked to destroy a plan until they hallucinate problems, and using hallucinated API/UX expectations as a cheap design conformance test. Concrete, first-person, and well-reasoned — 229 HN points.
Larson extends his "code horizons" / soil-layers metaphor to LLM-assisted reasoning: when agents produce analysis that nobody reviews before passing it upstream, organizations accumulate "reasoning horizons" of flawed conclusions stacked on one another. The post gives a concrete incident — an MCP-pulled data analysis that omitted half the relevant incidents — and proposes five countermeasures: assume nothing, require creators to be first human in the loop, reclaim unreasonable software, separate play from production, and structure how you use LLMs for strategy. One of the sharpest practitioner takes on AI-in-the-workflow quality degradation this month.
The June 2026 HN "What are you working on?" thread surfaces two practitioner signals worth tracking: (1) a developer building a tool to auto-resume Claude Code sessions when quota resets — "I hate waking up and typing 'please continue'" — indicating rate-limit management as a real pain point at scale; (2) kavla.dev demoing an agent-powered SQL canvas where all agent actions are visible and auditable, with the developer noting the canvas's visibility makes agent auditing "relatively easy," directly addressing the oversight problem the Faros report quantifies.
Investigates how prompt optimization and judge choice interact in LLM-as-a-Judge evaluations for legal QA on the LEXam benchmark, using ProTeGi optimization with Qwen3-32B and DeepSeek-V3 as judges. Lenient judge feedback yields larger and more consistent gains than strict feedback, and prompts optimized with lenient judges transfer better across judge models. Results highlight that judge disposition is a significant, underappreciated variable in automated evaluation pipelines.
Supplement Generation Training (SGT) trains a small LLM to produce task-specific supplemental text prepended to the input of a larger frozen LLM, improving downstream task performance without modifying the large model. This decouples task-specific adaptation from expensive full model retraining, making it practical to update only the lightweight supplement generator as base models evolve. The approach is framed as an alternative to repeated post-training of frontier models for agentic tasks.
Textual Parameter Graph Optimization (TPGO) models a multi-agent system as a graph of optimizable nodes (agents, tools, workflows) and derives structured natural-language "textual gradients" from execution traces to guide iterative optimization. Critically, the optimizer itself learns from accumulated optimization history, making the framework self-improving rather than static. This addresses the lack of structural awareness and adaptability in flat prompt-tuning approaches to MAS optimization.
A hands-on build report on Karpathy's 'LLM Wiki' concept — pre-processing sources into a structured, interlinked markdown wiki rather than retrieving raw chunks at query time. Synthesis and cross-document reasoning questions improve noticeably versus RAG, but the approach struggles with scale, update latency, and source conflicts. Honest tradeoff analysis rather than a benchmark.
Extension of Karpathy's LLM-as-wiki-editor pattern, adding an atomic knowledge layer, topic-branching structure, and a two-tier linting pass. Distilled from end-to-end production runs of the pattern. Primarily a workflow/architecture recipe rather than a new tool.
Lambert documents a real multi-agent coding workflow — GPT-5 Pro for planning, Claude Code with Opus 4.5 for implementation, Codex with GPT-5.2 for high-thinking-effort tasks — and argues that directing parallel agents on open-ended tasks is replacing individual grind as the primary work mode. The thesis: scoping and directing agents is the durable skill edge, not raw effort.