Most guardrail models classify prompts by reasoning toward one verdict. ARBITER introduces dual-hypothesis reasoning: before deciding, the guardrail explicitly constructs both the safe and unsafe interpretations of every prompt, then adjudicates. Combined with multi-component SFT (MC-SFT) that separately trains the safe-hypothesis, unsafe-hypothesis, and final-judgment components, ARBITER improves safety detection over single-hypothesis baselines. The adversarial framing — considering the best case for both sides — is a simple but underexplored idea in guardrail design.
Anthropic mathematician Levent Alpöge posted on July 19-20 that he and a colleague used Claude Fable 5 to find a counterexample to the Jacobian Conjecture — a problem open since 1939 and listed in Smale's 1998 Mathematical Problems for the Next Century. The counterexample is a concrete C³→C³ polynomial map with constant Jacobian determinant of -2 that is demonstrably non-injective; three distinct points all map to the same output, verifiable via Wolfram Alpha. The 2D case remains open. Wolfram MathWorld already updated its entry. HN thread (746 points) noted "Claude Fable was able to find a counterexample in degree 7" and called it a new era for AI in mathematics.
Proposes a competition for distinguishing robust from spurious reasoning in frontier mathematical LLMs using internal model mechanisms rather than final-answer accuracy. Motivated by the gap between strong benchmark scores and unreliable internal reasoning: a model can get the right answer for the wrong reasons. Focuses on math olympiad-level problems (AI Mathematical Olympiad context), providing a structured interpretability challenge tied to an existing competition with real stakes.
🟢 OpenAI 2w ago
⭐ Editor's Pick
OpenAI published GPT-Red, an internal-only automated red-teaming model trained via self-play RL to find and exploit prompt injection vulnerabilities at scale. GPT-Red achieved 84% attack success rate on an indirect prompt injection benchmark vs. 13% for human red-teamers on novel scenarios — and its outputs were fed back into GPT-5.6's training to harden it. The attacker earns reward for eliciting failures; defender models earn reward for resisting, creating a co-evolutionary loop. Training compute was at the scale of OpenAI's largest post-training runs. GPT-Red remains internal-only and is never deployed publicly.
📝 Blog 2w ago
⭐ Editor's Pick
Simon Willison covers Ayush Paul's disclosure of a data-exfiltration bypass in Claude's web_fetch tool. Anthropic's protection blocked direct URL injection but not chained navigation through links embedded in previously-fetched pages — allowing a honeypot site to walk the agent through letter-by-letter URL paths to exfiltrate user name, city, and employer. Anthropic has since patched by removing the ability for web_fetch to follow embedded links, but did not pay a bug bounty, claiming the issue was already known internally.
LLMVault is a purpose-built, intentionally vulnerable platform for hands-on AI security training covering the full OWASP LLM Top 10: prompt injection, RAG security, agent security, and GenAI penetration testing. Useful for practitioners building red-teaming competence on agentic systems. 94 stars on GitHub as of this week.
OpenAI built GPT-Red, an LLM trained via self-play to attack other LLMs, and used it to harden GPT-5.6. The system discovered a previously unseen attack class: inserting a fake entry into a model's chain-of-thought reasoning log, causing it to act on spoofed intermediate results ("fake chain of thought"). GPT-Red is not being released. Current gaps: weak at multi-turn conversational attacks and image-based prompt injection. OpenAI frames it as supplementing, not replacing, human red-teamers.
Larson extends his "code horizons" / soil-layers metaphor to LLM-assisted reasoning: when agents produce analysis that nobody reviews before passing it upstream, organizations accumulate "reasoning horizons" of flawed conclusions stacked on one another. The post gives a concrete incident — an MCP-pulled data analysis that omitted half the relevant incidents — and proposes five countermeasures: assume nothing, require creators to be first human in the loop, reclaim unreasonable software, separate play from production, and structure how you use LLMs for strategy. One of the sharpest practitioner takes on AI-in-the-workflow quality degradation this month.
Latent Space / AINews roundup for July 6–7, 2026. Lead item is Lilian Weng's harness engineering post (405K Twitter impressions, 3.89K likes). Additional signals: Claude Cowork launches on mobile and web as a "background agent" UX; Meta Superintelligence launches Muse Image (#2 on Image Arena) and Muse Video (#3 on Video Arena) with agentic generation loops and RL-emergent self-refinement; Liquid AI's Antidoom (FTPO) cuts doom-loop rates from 10.2%→1.4% on LFM2.5-2.6B and 22.9%→1% on Qwen3.5-4B; Tencent releases Hy3 (295B/21B active MoE) under Apache 2.0; Anthropic's J-space interpretability work draws both cross-model CKA universality findings and sharp criticism about consciousness framing.
Noma Labs disclosed GitLost (July 7), a critical indirect prompt injection flaw in GitHub Agentic Workflows: an unauthenticated attacker posts a crafted issue on any public repo in an org, and the AI agent — backed by Claude or GitHub Copilot — silently reads private repos it has token access to and posts the contents as a public comment. No credentials, no code, no write access needed. A one-word prefix ("Additionally") bypassed GitHub's threat-detection guardrail. The core lesson: agent tokens scoped org-wide for convenience turn every public issue into an exfiltration channel. The researchers frame this as the SQL-injection analog for agentic systems — an architectural class of vulnerability, not a patchable bug. HN thread hit 521 points.
Anthropic confirmed on June 30 (effective July 1) that US export controls on Claude Fable 5 and Mythos 5 had been lifted, restoring global access via Claude Platform, claude.ai, Claude Code, and Claude Cowork. The models were suspended on June 12 after the US government applied controls triggered by a report that Amazon researchers found a method to elicit vulnerability-demonstrating code from Fable 5. Anthropic's forensic testing found that Claude Opus 4.8, GPT-5.5, and Kimi K2.7 could identify the same vulnerabilities. Pro/Max/Team plans got up to 50% weekly usage allowance through July 7; usage-credit access thereafter. AWS, Google Cloud, and Microsoft Foundry re-enablement followed separately.
AgentScan is a network reconnaissance tool specifically for the AI protocol surface: discovers publicly exposed MCP servers, A2A Agent Cards, and open LLM API endpoints in one command. As MCP and Agent-to-Agent protocols proliferate in production deployments, this is the kind of tool security teams need for attack surface enumeration. Directly relevant to the fake AI agent skill supply chain story (26,000 agents reached) circulating in security news that same week.
🦜 LangChain Jun 13
⭐ Editor's Pick
Latent Space AINews covering the US government's export control directive on Anthropic's Claude Fable and Claude Mythos models, forcing suspension of access for foreign nationals and international users. The event is referenced in the Gray Swan / Latent Space red-teaming episode as the proximate cause for AI security suddenly becoming the "talk of the town," and is cited by Nathan Lambert at Interconnects as the "starting gun of a new era in AI governance." Documented separately because it functions as a cross-referenced event across multiple high-signal posts this week.
Self-hostable, Apache 2.0-licensed platform covering the full LLM application observability and improvement loop: tracing, evals, simulations, datasets, gateway, and guardrails in one stack. Targets teams who want an integrated alternative to stitching together Langfuse, LangSmith, and separate guardrail layers. Open-source with enterprise-grade feature breadth.
vlnr is an autonomous security agent for the Python supply chain: it scans packages for vulnerabilities, generates proof-of-concept exploits, and validates them inside isolated Docker containers. Full-loop autonomous exploit generation and validation is the novel aspect.
GPT-5.5 launched April 23 for Plus/Pro/Business/Enterprise users in ChatGPT and Codex, with API access added April 24. The model matches GPT-5.4 per-token latency while completing Codex tasks with fewer tokens, and targets agentic coding, computer use, knowledge work, and early scientific research. Rated "High" (below "Critical") on both cybersecurity and bio risk in the system card — safeguards are the strongest deployed to date. Benchmarks include Terminal-Bench 2.0 at 82.7%.
An ~110-user agricultural tech org had all Claude accounts suspended simultaneously without prior warning, with no admin notification and only a Google Form for appeal. The post raises legitimate concerns about Anthropic's enterprise account governance: no escalation path, no advance notice, and no SLA on appeal response. A real operational risk for teams with Claude in production workflows.
Anthropic has implemented an `end_conversation` tool in Claude that allows the model to terminate sessions, reportedly triggered by user insults. The feature appears to be a boundary-enforcement mechanism giving Claude agency to disengage from hostile interactions.
Identifies 'preference leakage': when the same LLM generates synthetic training data and serves as the judge, it systematically inflates scores for outputs matching its own generation style, biasing leaderboard rankings even when models perform similarly. Demonstrated empirically across several evaluation pipelines. A concrete warning against self-referential LLM-as-a-judge setups.
OpenAI releases an open-weight PII detection and redaction model called Privacy Filter, claiming state-of-the-art accuracy on identifying personally identifiable information in text. Open weights make it deployable on-prem or in air-gapped environments where sending data to an API is not viable. Directly relevant for enterprise pipelines that need PII scrubbing before feeding data to LLMs.
🔶 Anthropic Apr 16
⭐ Editor's Pick
Anthropic's official Claude Opus 4.7 GA post confirms same pricing as 4.6, image resolution raised to 2,576px long edge (~3.75 MP, 3× prior), and a new xhigh effort tier. Coding benchmarks: +13% task resolution on internal 93-task harness, 70% on CursorBench (vs. 58%), 98.5% on XBOW visual-acuity (vs. 54.5%). First model shipped with real-time cyber safeguards derived from the restricted Mythos Preview testbed.
🟧 Hacker News Apr 13
⭐ Editor's Pick
Anthropic restricted its Mythos Preview model after it autonomously discovered and exploited zero-day vulnerabilities across all major OSes and browsers. Palo Alto Networks assessed similar capabilities as weeks-to-months from broader proliferation; CrowdStrike's 2026 threat report clocked average eCrime breakout at 29 minutes, Mandiant's M-Trends at 22-second adversary hand-off. A sharp illustration of the gap between lab capability and safe deployment for capability-frontier models.