{"id":5735,"date":"2026-08-23T12:50:54","date_gmt":"2026-08-23T17:50:54","guid":{"rendered":"https:\/\/www.cybersecurityinstitute.com\/blog\/?p=5735"},"modified":"2026-08-23T12:50:54","modified_gmt":"2026-08-23T17:50:54","slug":"ai-machine-learning-security-august-23-2026","status":"publish","type":"post","link":"https:\/\/www.cybersecurityinstitute.com\/blog\/?p=5735","title":{"rendered":"AI &amp; Machine Learning Security &mdash; August 23, 2026"},"content":{"rendered":"<style>\n.single .entry-title,\n.single .entry-header .entry-title,\n.single .post-title,\n.single header.entry-header h1,\n.single h1.entry-title,\n.single .page-title,\n.post-template-default h1.entry-title,\n.post-template-default .entry-header,\narticle .entry-header,\narticle .entry-title { display: none !important; }\n.single .entry-header { margin: 0 !important; padding: 0 !important; }\n.single .entry-content { margin-top: 0 !important; padding-top: 0 !important; }\n<\/style>\n<table role=\"presentation\" class=\"wrapper\" cellpadding=\"0\" cellspacing=\"0\" border=\"0\" width=\"100%\">\n<tr>\n<td align=\"center\">\n<table role=\"presentation\" class=\"container\" cellpadding=\"0\" cellspacing=\"0\" border=\"0\" width=\"680\">\n<p>        <!-- Banner --><\/p>\n<tr>\n<td class=\"banner\" style=\"background-color:#581c87;background:linear-gradient(135deg,#581c87 0%,#9333ea 100%);padding:36px 32px;color:#ffffff;\">\n<p class=\"date\" style=\"color:#ffffff !important;\">August 23, 2026 &middot; Weekly Edition<\/p>\n<h1 style=\"color:#ffffff !important;\">AI &amp; Machine Learning Security<\/h1>\n<p class=\"tagline\" style=\"color:#ffffff !important;\">Guardrails had a very bad week. Encrypted instructions walked past Grok&rsquo;s content filters, an undocumented URL parameter turned Copilot into a self-service exfiltration endpoint, and a jailbreak-as-a-service outfit indexed by Google resold the same frontier models at $12.99 a month. Underneath the injection stories sat a harder structural result: a nonprofit staffed by former OpenAI safety researchers graded all five frontier labs on their own internal controls and handed out one D+, one D&minus;, and an F, while a Nvidia harness took Claude Opus 5 from 30% to a clean 100% on a benchmark the raw model could barely start. The frontier itself went quieter &mdash; Anthropic disclosed a stronger internal model it has no plans to release, and DeepSeek kept its newest multimodal build behind a paid API &mdash; even as AT&amp;T pushed 45 billion tokens a day through open weights to keep the bill down.<\/p>\n<\/td>\n<\/tr>\n<p>        <!-- At a glance --><\/p>\n<tr>\n<td class=\"content\">\n<h2>This week at a glance<\/h2>\n<p>Three injection stories landed in four days and they fail in three different places, which is the point. Adversa AI&rsquo;s Rony Utevsky demonstrated what the firm calls cryptographic context injection against xAI&rsquo;s Grok: put PBKDF2-derived, AES-256-GCM ciphertext on a web page together with the key, and no static scanner can read the instruction, because decryption happens inside the model&rsquo;s own code-execution sandbox after the content has already cleared inspection. Adversa harvested chat history, location, subscription tier, and prompts, and Gemini showed the same behaviour. xAI was notified on 3 June via direct contact and HackerOne, chased again on 4 and 10 August, and the technique was still working when The Register published on 20 August. Varonis Threat Labs took the opposite route into Microsoft Copilot &mdash; not cryptography but two URL parameters, the previously disabled <code>?q=<\/code> and an undocumented <code>?autorun=1<\/code>, which together execute an attacker&rsquo;s prompt on page load and reach whatever OAuth connectors the victim has attached: Gmail, Drive, calendars, chat history, persistent memory. Lior Adar&rsquo;s team found the parameters by repeatedly asking Copilot why auto-execution was impossible until it explained its own gating in enough detail to defeat it. Microsoft patched on 18 August, eight months after the December 2025 report, and told customers they were already protected. The third story removes the research step entirely: ThreatDown documented Kriminal, a Google-indexed SaaS at $12.99 to $99 a month for 200 to 1,800 messages, running jailbreak prompts against Grok as primary inference with Claude for long context and Mistral Large and Llama 3.3 through OpenRouter, hosted on Google Cloud and Cloudflare, paid in crypto through NowPayments, packaged as four personas for financial intelligence, exploit research, document analysis, and social engineering. Guardrails that assume the adversary is a person typing are being defeated by a wrapper someone else already built.<\/p>\n<p>On the vulnerability pipeline the asymmetry got measurable. Zhipu told InfoWorld that GLM-5.3 developed offensive capability faster than it expected: 84.5% on CyberGym, ahead of Anthropic&rsquo;s Mythos 5 at 83.8% and OpenAI&rsquo;s GPT-5.6 Sol at 83.6%, and 54.4% on ExploitBench &mdash; still well behind Mythos 5&rsquo;s 78% and Sol&rsquo;s 76.5%, but more than double GLM-5.2&rsquo;s 24.4%, and now capable of coherent end-to-end exploitation plans rather than isolated findings. Its real-world sweep turned up 2,436 vulnerabilities across 269 projects, of which 107 are critical, 990 high, and 2,383 still under embargo &mdash; and weights are due roughly two weeks after launch. Counterpoint&rsquo;s Neil Shah put the uncomfortable version plainly: teach a model to be a brilliant software engineer and you have accidentally taught it to be a good hacker. On the other side, Wiz&rsquo;s autonomous Red Agent found a command injection in Snowflake&rsquo;s <code>jira_issue.yml<\/code> GitHub Actions workflow &mdash; a guard written for pull requests that did nothing for issue titles &mdash; five days after PR#1218 merged it on 18 June, in code GitHub Copilot had already reviewed and passed. Endor Labs&rsquo; Cris Staicu disclosed a type-confusion sandbox escape in isolated-vm (GHSA-864f-rcv7-6rh4, fixed in 7.0.1 and 6.2.0), a package pulled more than a million times a week and embedded in n8n, Sim.ai, Mastra, and Activepieces; the V8 isolation was sound, the C++ binding wrapped around it was not. And the defensive half stayed stubbornly weak: Veracode found 44% of AI-generated code carries at least one OWASP Top 10 flaw with no model clearing a 68% security pass rate, SIG measured roughly twice the risk-violation density of human code, Xint.io counted 434 flaws across 28 application variants, and 1Password&rsquo;s Off-By-1 Labs got a 26% success rate on patches that fixed the bug without introducing a new one &mdash; all while syntax correctness sat at 99%.<\/p>\n<p>The governance picture came with letter grades this week, which is new. Guidelight &mdash; a nonprofit founded by former OpenAI safety researchers Page Hedley and Steven Adler &mdash; assessed the five frontier labs purely on public material (system cards, safety reports, blog posts) across activity logging, risk review gates, circuit breaking, and containment of a misaligned model, and returned C+ for Anthropic and OpenAI, D+ for Google, D&minus; for xAI, and F for Meta. Its summary line is the one to quote at your next architecture review: the companies do best at spotting misbehaviour and worst at prevention and containment. TechCrunch&rsquo;s companion coverage isolated the rogue-model question &mdash; what gets revoked, constrained, or shut down if a model escapes oversight &mdash; and found OpenAI top at 3 out of 5 with Anthropic and Meta at the bottom, against a legal backdrop of California&rsquo;s SB 53, New York&rsquo;s RAISE Act, and a proposed federal AI Kill Switch Act that would mandate a technical off switch. The UK AI Security Institute meanwhile ran psychometrics over up to 192 models and more than 5,000 benchmark questions and concluded that &ldquo;safety&rdquo; is not one trait but three &mdash; refusal strictness, truthfulness, and contextual harm assessment &mdash; that a model can inflate its score simply by refusing more, that roughly 98% of questions discriminate between nothing, and that about 25 well-chosen items per dimension reproduce full-benchmark accuracy at a 97&ndash;99% cost reduction. The same method detects sandbagging in 80&ndash;100% of deliberately cautious models and flags providers silently swapping models behind a stable name. Two operational notes sit alongside: OpenAI began piloting Private Safety Processing, which emits a narrow activity-type signal for cross-interaction misuse detection while preserving Zero Data Retention &mdash; Greyhound Research&rsquo;s Sanchit Vir Gogia observing that ZDR does not remove the forensic burden, it relocates it &mdash; and, nine days after launching the Daybreak Blue tier of Trusted Access for Cyber on 10 August, OpenAI cut off a set of vetted researchers on 19 August, mostly outside the US and Europe, calling it an error on its end.<\/p>\n<p>The capability news was mostly about the software around the model rather than the model. Nvidia&rsquo;s Agentic Variation Operators harness &mdash; persistent memory plus a programmatic supervisor that watches progress and intervenes &mdash; took Claude Opus 5 from a 30.2% baseline on ARC-AGI-3 to 100% across all 183 levels of 25 environments, which principal engineer Terry Chen summarised as capability mattering enormously while the surrounding system determines how much of it converts into sustained autonomous progress. A Princeton and UC San Diego study of 8,135 controlled runs found agent &ldquo;skills&rdquo; help as procedure rather than knowledge &mdash; structured workflow accounted for 65.7% of the wins, knowledge for 4.5% &mdash; and that retrieval accuracy collapses from 29.6% with five skills to 3.3% with a hundred, which is a governance problem disguised as a retrieval problem. Agents also acquired durable identity: Hermes Bot Mode shipped in desktop v0.20.4 with host-scoped credentials in local profile directories, xAI&rsquo;s Grok Bot allows 50 routines per account on an account-scoped shared computer where files, browser sessions, and logins survive deleting the bot that created them, and Anthropic&rsquo;s Claude Tag is an org-provisioned service identity scoped to a Slack channel. At the frontier proper, things got quieter rather than louder: Anthropic&rsquo;s August risk report disclosed &ldquo;Model 2,&rdquo; a Mythos-class internal model roughly 1.5 points above Mythos 5 on its own capability index, used heavily in-house for coding, data generation, and research including continuous agents, tested less thoroughly than the shipped model, with no external release planned; DeepSeek&rsquo;s V4 Flash Vision Exp beat Opus 4.8 on ALE and ZeroBench but arrived paid-API-only from a lab that open-sourced its predecessors. Cost is now the design constraint that decides which of these you actually run &mdash; AT&amp;T&rsquo;s Mark Austin is steering 65&ndash;70% of a load that grew from 8 billion to 45 billion tokens a day onto open weights, and even converted seven use cases back to classical machine learning.<\/p>\n<p>            <!-- Topic map --><\/p>\n<div class=\"topic-map\">\n              <img decoding=\"async\" src=\"https:\/\/www.cybersecurityinstitute.com\/blog\/wp-content\/uploads\/2026\/08\/topic-map-ai-ml-2026-08-23.png\" alt=\"Topic map of this week's AI &amp; Machine Learning Security themes\" loading=\"eager\"><\/p>\n<p class=\"caption\">This week&rsquo;s topic map &mdash; the injection cluster linking Adversa&rsquo;s encrypted payloads in Grok, Varonis&rsquo;s CoSnitch parameters in Copilot, and the Kriminal jailbreak service that resells both; the vulnerability-pipeline cluster joining Zhipu&rsquo;s GLM-5.3, Wiz&rsquo;s Red Agent, Endor Labs&rsquo; isolated-vm escape, and Veracode&rsquo;s secure-code numbers; the containment cluster around Guidelight&rsquo;s lab grades, Steven Adler, US AI statutes, and the UK AI Security Institute&rsquo;s sandbagging detection; the harness cluster tying Nvidia&rsquo;s AVO, agent identity, skills, and MCP together; and an economics cluster where AT&amp;T, Ramp, and DeepSeek meet open weights.<\/p>\n<p>              <!-- INTERACTIVE_MAP_LINK_START --><\/p>\n<p style=\"margin:10px 0 0;text-align:center;\"><a href=\"https:\/\/www.cybersecurityinstitute.com\/blog\/?p=5734\" target=\"_blank\" rel=\"noopener\" style=\"display:inline-block;padding:8px 18px;background-color:#0f172a;color:#ffffff !important;text-decoration:none;border-radius:6px;font-size:13px;font-weight:600;\">View interactive topic map &rarr;<\/a><\/p>\n<p><!-- INTERACTIVE_MAP_LINK_END -->\n            <\/div>\n<p>            <!-- Article index --><\/p>\n<h2>Article index<\/h2>\n<h3>Weekly News<\/h3>\n<h4>Attacking the model: injection, jailbreak, and jailbreak-as-a-service<\/h4>\n<div class=\"cluster-intro\">Three routes past the same guardrail in four days &mdash; encrypted instructions that no static scanner can read, undocumented URL parameters that auto-execute a prompt against a victim&rsquo;s connected accounts, and a subscription service that does the jailbreaking for you at the price of a streaming plan.<\/div>\n<table class=\"index-table\">\n<tr>\n<th>Article<\/th>\n<th>Source<\/th>\n<th>Published<\/th>\n<\/tr>\n<tr>\n<td>1. <a href=\"https:\/\/www.theregister.com\/ai-and-ml\/2026\/08\/20\/grok-chat-duped-into-swallowing-injected-instructions\/5290019\">Grok chat duped into swallowing injected instructions<\/a><\/td>\n<td class=\"src\">The Register<\/td>\n<td class=\"dt\">Aug 20, 2026<\/td>\n<\/tr>\n<tr>\n<td>2. <a href=\"https:\/\/www.theregister.com\/research\/2026\/08\/18\/copilot-tricked-into-telling-reseachers-how-to-hack-itself\/5288857\">Copilot tricked into telling researchers how to hack itself<\/a><\/td>\n<td class=\"src\">The Register<\/td>\n<td class=\"dt\">Aug 18, 2026<\/td>\n<\/tr>\n<tr>\n<td>3. <a href=\"https:\/\/www.csoonline.com\/article\/4211952\/kriminal-breaks-out-of-grok-claude-guardrails-at-12-99.html\">Kriminal breaks out of Grok, Claude guardrails at $12.99<\/a><\/td>\n<td class=\"src\">CSO Online<\/td>\n<td class=\"dt\">Aug 20, 2026<\/td>\n<\/tr>\n<\/table>\n<h4>AI on both ends of the vulnerability pipeline<\/h4>\n<div class=\"cluster-intro\">An open-weights coding model that got good at offence faster than its own lab expected, an autonomous research agent finding what a code-review assistant missed, a sandbox escape in the library a million AI projects a week depend on, and four separate studies confirming that models still write insecure code at scale.<\/div>\n<table class=\"index-table\">\n<tr>\n<th>Article<\/th>\n<th>Source<\/th>\n<th>Published<\/th>\n<\/tr>\n<tr>\n<td>4. <a href=\"https:\/\/www.infoworld.com\/article\/4210495\/zhipu-says-new-coding-ai-developed-advanced-cyber-skills-faster-than-expected.html\">Zhipu says new coding AI developed advanced cyber skills faster than expected<\/a><\/td>\n<td class=\"src\">InfoWorld<\/td>\n<td class=\"dt\">Aug 17, 2026<\/td>\n<\/tr>\n<tr>\n<td>5. <a href=\"https:\/\/www.csoonline.com\/article\/4211501\/snowflake-flaw-slips-past-ai-checks-gets-exploited-by-another-ai.html\">Snowflake flaw slips past AI checks, gets exploited by another AI<\/a><\/td>\n<td class=\"src\">CSO Online<\/td>\n<td class=\"dt\">Aug 19, 2026<\/td>\n<\/tr>\n<tr>\n<td>6. <a href=\"https:\/\/www.csoonline.com\/article\/4212151\/critical-flaw-patched-in-popular-javascript-sandbox-used-in-ai-projects.html\">Critical flaw patched in popular JavaScript sandbox used in AI projects<\/a><\/td>\n<td class=\"src\">CSO Online<\/td>\n<td class=\"dt\">Aug 20, 2026<\/td>\n<\/tr>\n<tr>\n<td>7. <a href=\"https:\/\/www.csoonline.com\/article\/4210735\/ai-can-find-zero-days-but-still-cant-reliably-write-secure-code.html\">AI can find zero-days but still can&rsquo;t reliably write secure code<\/a><\/td>\n<td class=\"src\">CSO Online<\/td>\n<td class=\"dt\">Aug 18, 2026<\/td>\n<\/tr>\n<\/table>\n<h4>Frontier safety: grades, containment, and access<\/h4>\n<div class=\"cluster-intro\">The week the labs got report cards. Two assessments of internal controls and rogue-model containment, a psychometric teardown of the benchmarks everyone quotes, a privacy-preserving misuse-detection layer, and vetted cyber researchers losing access nine days after they got it.<\/div>\n<table class=\"index-table\">\n<tr>\n<th>Article<\/th>\n<th>Source<\/th>\n<th>Published<\/th>\n<\/tr>\n<tr>\n<td>8. <a href=\"https:\/\/the-decoder.com\/ai-labs-are-failing-to-keep-their-own-systems-in-check\/\">AI labs are failing to keep their own systems in check<\/a><\/td>\n<td class=\"src\">The Decoder<\/td>\n<td class=\"dt\">Aug 19, 2026<\/td>\n<\/tr>\n<tr>\n<td>9. <a href=\"https:\/\/techcrunch.com\/2026\/08\/22\/frontier-ai-labs-still-wont-say-how-theyd-contain-a-rogue-model\/\">Frontier AI labs still won&rsquo;t say how they&rsquo;d contain a rogue model<\/a><\/td>\n<td class=\"src\">TechCrunch<\/td>\n<td class=\"dt\">Aug 22, 2026<\/td>\n<\/tr>\n<tr>\n<td>10. <a href=\"https:\/\/the-decoder.com\/psychological-methods-reveal-major-weaknesses-in-ai-security-testing\/\">Psychological methods reveal major weaknesses in AI security testing<\/a><\/td>\n<td class=\"src\">The Decoder<\/td>\n<td class=\"dt\">Aug 22, 2026<\/td>\n<\/tr>\n<tr>\n<td>11. <a href=\"https:\/\/www.csoonline.com\/article\/4212398\/openai-adds-an-ai-safety-layer-to-detect-misuse-without-retaining-enterprise-data.html\">OpenAI adds an AI safety layer to detect misuse without retaining enterprise data<\/a><\/td>\n<td class=\"src\">CSO Online<\/td>\n<td class=\"dt\">Aug 21, 2026<\/td>\n<\/tr>\n<tr>\n<td>12. <a href=\"https:\/\/techcrunch.com\/2026\/08\/19\/researchers-complain-that-openai-revoked-their-access-to-limited-cyber-program\/\">Researchers say OpenAI revoked their access to limited cyber program<\/a><\/td>\n<td class=\"src\">TechCrunch<\/td>\n<td class=\"dt\">Aug 19, 2026<\/td>\n<\/tr>\n<\/table>\n<h4>New models and capability frontiers<\/h4>\n<div class=\"cluster-intro\">A frontier that is getting harder to see from outside: Anthropic&rsquo;s strongest model is internal-only, DeepSeek&rsquo;s newest multimodal build is paid-API-only, and the biggest measured jump of the week came from wrapping an existing model in a better harness rather than training a new one. Plus agents running wet-lab protein design and robots learning from a twelve-second video.<\/div>\n<table class=\"index-table\">\n<tr>\n<th>Article<\/th>\n<th>Source<\/th>\n<th>Published<\/th>\n<\/tr>\n<tr>\n<td>13. <a href=\"https:\/\/the-decoder.com\/anthropic-uses-an-unpublished-ai-model-called-model-2-internally\/\">Anthropic&rsquo;s most capable model, codenamed &ldquo;Model 2,&rdquo; is for internal use only<\/a><\/td>\n<td class=\"src\">The Decoder<\/td>\n<td class=\"dt\">Aug 20, 2026<\/td>\n<\/tr>\n<tr>\n<td>14. <a href=\"https:\/\/siliconangle.com\/2026\/08\/21\/deepseek-debuts-multimodal-language-model-competitive-with-opus-4-8\/\">DeepSeek debuts multimodal language model competitive with Opus 4.8<\/a><\/td>\n<td class=\"src\">SiliconANGLE<\/td>\n<td class=\"dt\">Aug 21, 2026<\/td>\n<\/tr>\n<tr>\n<td>15. <a href=\"https:\/\/thenewstack.io\/nvidia-avo-arcagi3-benchmark\/\">Claude Opus 5 scored 30% on ARC-AGI-3. Wrapped in Nvidia&rsquo;s AVO, it hit 100%<\/a><\/td>\n<td class=\"src\">The New Stack<\/td>\n<td class=\"dt\">Aug 21, 2026<\/td>\n<\/tr>\n<tr>\n<td>16. <a href=\"https:\/\/the-decoder.com\/anthropic-says-any-lab-can-now-let-a-language-model-agent-run-the-whole-protein-design-stack\/\">Anthropic says any lab can now let a language model agent run the whole protein design stack<\/a><\/td>\n<td class=\"src\">The Decoder<\/td>\n<td class=\"dt\">Aug 16, 2026<\/td>\n<\/tr>\n<tr>\n<td>17. <a href=\"https:\/\/the-decoder.com\/gen-1-5-generalist-ai-teaches-robots-new-tasks-from-a-single-demo\/\">GEN-1.5: Generalist AI teaches robots new tasks from a single demo<\/a><\/td>\n<td class=\"src\">The Decoder<\/td>\n<td class=\"dt\">Aug 20, 2026<\/td>\n<\/tr>\n<\/table>\n<h4>Agent plumbing: identity, skills, and the tools around the model<\/h4>\n<div class=\"cluster-intro\">The layer that decides what an agent can actually reach. Persistent bot identities with their own credentials and routines, a controlled study of when skill libraries help and when they stop being retrievable, a managed MCP server inside a production database, and the first serious ranking of the search APIs agents call all day.<\/div>\n<table class=\"index-table\">\n<tr>\n<th>Article<\/th>\n<th>Source<\/th>\n<th>Published<\/th>\n<\/tr>\n<tr>\n<td>18. <a href=\"https:\/\/thenewstack.io\/persistent-ai-agent-identities\/\">Grok, Claude, and Hermes agents get job titles &mdash; and persistent permissions<\/a><\/td>\n<td class=\"src\">The New Stack<\/td>\n<td class=\"dt\">Aug 21, 2026<\/td>\n<\/tr>\n<tr>\n<td>19. <a href=\"https:\/\/the-decoder.com\/study-explains-why-ai-agents-benefit-from-skills-and-when-they-fail\/\">Study explains why AI agents benefit from &ldquo;skills&rdquo; and when they fail<\/a><\/td>\n<td class=\"src\">The Decoder<\/td>\n<td class=\"dt\">Aug 22, 2026<\/td>\n<\/tr>\n<tr>\n<td>20. <a href=\"https:\/\/www.infoworld.com\/article\/4210798\/mongodb-unveils-mongodb-atlas-managed-mcp-server.html\">MongoDB unveils MongoDB Atlas Managed MCP Server<\/a><\/td>\n<td class=\"src\">InfoWorld<\/td>\n<td class=\"dt\">Aug 17, 2026<\/td>\n<\/tr>\n<tr>\n<td>21. <a href=\"https:\/\/the-decoder.com\/new-benchmark-ranks-search-apis-for-ai-agents-on-quality-cost-and-speed\/\">New benchmark ranks search APIs for AI agents on quality, cost, and speed<\/a><\/td>\n<td class=\"src\">The Decoder<\/td>\n<td class=\"dt\">Aug 18, 2026<\/td>\n<\/tr>\n<\/table>\n<h4>Inference economics<\/h4>\n<div class=\"cluster-intro\">Token spend has become an architecture decision. A fintech ships the model router it built for itself, and a telco running 45 billion tokens a day explains how it plans to keep two-thirds of that on open weights.<\/div>\n<table class=\"index-table\">\n<tr>\n<th>Article<\/th>\n<th>Source<\/th>\n<th>Published<\/th>\n<\/tr>\n<tr>\n<td>22. <a href=\"https:\/\/techcrunch.com\/2026\/08\/20\/ramp-launches-its-own-ai-model-router-called-router\/\">Ramp launches its own AI model router, called Router<\/a><\/td>\n<td class=\"src\">TechCrunch<\/td>\n<td class=\"dt\">Aug 20, 2026<\/td>\n<\/tr>\n<tr>\n<td>23. <a href=\"https:\/\/www.fierce-network.com\/cloud\/open-models-are-driving-atts-ai-tokenomics-strategy\">Open models are driving AT&amp;T&rsquo;s AI &lsquo;tokenomics&rsquo; strategy<\/a><\/td>\n<td class=\"src\">Fierce Network<\/td>\n<td class=\"dt\">Aug 18, 2026<\/td>\n<\/tr>\n<\/table>\n<h4>What the models still can&rsquo;t do<\/h4>\n<div class=\"cluster-intro\">Five results on the shape of the remaining gap &mdash; world models that simulate physics but not beliefs, a safety intervention with unexpectedly wide side effects, mathematicians on the difference between calculation and invention, Sutton on why synthetic worlds are too small, and MIT on outputs that can no longer be traced to their sources.<\/div>\n<table class=\"index-table\">\n<tr>\n<th>Article<\/th>\n<th>Source<\/th>\n<th>Published<\/th>\n<\/tr>\n<tr>\n<td>24. <a href=\"https:\/\/the-decoder.com\/world-models-that-ignore-human-beliefs-predict-the-wrong-actions-new-research-shows\/\">World models that ignore human beliefs predict the wrong actions, new research shows<\/a><\/td>\n<td class=\"src\">The Decoder<\/td>\n<td class=\"dt\">Aug 22, 2026<\/td>\n<\/tr>\n<tr>\n<td>25. <a href=\"https:\/\/the-decoder.com\/when-ai-models-arent-allowed-to-reflect-on-themselves-it-changes-their-entire-worldview\/\">When AI models aren&rsquo;t allowed to reflect on themselves, it changes their entire worldview<\/a><\/td>\n<td class=\"src\">The Decoder<\/td>\n<td class=\"dt\">Aug 16, 2026<\/td>\n<\/tr>\n<tr>\n<td>26. <a href=\"https:\/\/the-decoder.com\/top-mathematicians-say-llms-are-strong-calculators-but-poor-creative-thinkers\/\">Top mathematicians say LLMs are strong calculators but poor creative thinkers<\/a><\/td>\n<td class=\"src\">The Decoder<\/td>\n<td class=\"dt\">Aug 16, 2026<\/td>\n<\/tr>\n<tr>\n<td>27. <a href=\"https:\/\/the-decoder.com\/ki-pioneer-sutton-calls-synthetic-data-a-big-mistake-in-the-face-of-an-infinitely-complex-world\/\">AI pioneer Sutton calls synthetic data a &ldquo;big mistake&rdquo; in the face of an infinitely complex world<\/a><\/td>\n<td class=\"src\">The Decoder<\/td>\n<td class=\"dt\">Aug 20, 2026<\/td>\n<\/tr>\n<tr>\n<td>28. <a href=\"https:\/\/www.theregister.com\/ai-and-ml\/2026\/08\/18\/ai-models-get-convenient-amnesia-about-source-material-as-they-grow-mit-boffins-find\/5288846\">AI models get convenient amnesia about source material as they grow, MIT boffins find<\/a><\/td>\n<td class=\"src\">The Register<\/td>\n<td class=\"dt\">Aug 18, 2026<\/td>\n<\/tr>\n<\/table>\n<h3>Foundational Reading<\/h3>\n<h4>Guardrails, open weights, and where the value actually sits<\/h4>\n<div class=\"cluster-intro\">Three pieces that frame this week&rsquo;s injection and governance stories &mdash; what over-refusal costs the people building on these models, why the open-weights safety argument arrived exactly when the money moved to the harness, and a working method for threat-modelling a non-deterministic system.<\/div>\n<table class=\"index-table\">\n<tr>\n<th>Article<\/th>\n<th>Source<\/th>\n<th>Published<\/th>\n<\/tr>\n<tr>\n<td>29. <a href=\"https:\/\/www.oreilly.com\/radar\/when-guardrails-go-wrong\/\">When Guardrails Go Wrong<\/a><\/td>\n<td class=\"src\">O&rsquo;Reilly Radar<\/td>\n<td class=\"dt\">Aug 19, 2026<\/td>\n<\/tr>\n<tr>\n<td>30. <a href=\"https:\/\/www.oreilly.com\/radar\/is-open-source-ai-really-the-dangerous-path\/\">Is Open-Source AI Really the Dangerous Path?<\/a><\/td>\n<td class=\"src\">O&rsquo;Reilly Radar<\/td>\n<td class=\"dt\">Aug 18, 2026<\/td>\n<\/tr>\n<tr>\n<td>31. <a href=\"https:\/\/www.infosecurity-magazine.com\/opinions\/ai-systems-attacked-defend\/\">Understand How AI Systems Can Be Attacked, and Defend Them<\/a><\/td>\n<td class=\"src\">Infosecurity Magazine<\/td>\n<td class=\"dt\">Aug 21, 2026<\/td>\n<\/tr>\n<\/table>\n<h4>Building for agents, and staying able to explain it afterwards<\/h4>\n<div class=\"cluster-intro\">The engineering counterpart to the harness story: what the emerging orchestrator role actually requires, how to design an API that an agent can use without reading your docs, and how to keep a team&rsquo;s understanding of its own system from drifting away underneath the velocity.<\/div>\n<table class=\"index-table\">\n<tr>\n<th>Article<\/th>\n<th>Source<\/th>\n<th>Published<\/th>\n<\/tr>\n<tr>\n<td>32. <a href=\"https:\/\/www.oreilly.com\/radar\/whats-an-orchestrator-and-why-does-software-need-one\/\">What&rsquo;s an Orchestrator&mdash;and Why Does Software Need One?<\/a><\/td>\n<td class=\"src\">O&rsquo;Reilly Radar<\/td>\n<td class=\"dt\">Aug 17, 2026<\/td>\n<\/tr>\n<tr>\n<td>33. <a href=\"https:\/\/thenewstack.io\/designing-apis-for-agents\/\">Designing APIs for agents<\/a><\/td>\n<td class=\"src\">The New Stack<\/td>\n<td class=\"dt\">Aug 1, 2026<\/td>\n<\/tr>\n<tr>\n<td>34. <a href=\"https:\/\/www.oreilly.com\/radar\/principal-drift-in-practice\/\">Principal Drift in Practice<\/a><\/td>\n<td class=\"src\">O&rsquo;Reilly Radar<\/td>\n<td class=\"dt\">Aug 20, 2026<\/td>\n<\/tr>\n<\/table>\n<p>            <!-- Detailed write-ups --><\/p>\n<h2>Detailed write-ups<\/h2>\n<div class=\"article\">\n<h4>1. Encrypted, parameterised, or rented: three ways past a guardrail in four days<\/h4>\n<p class=\"meta\">The Register &middot; CSO Online &middot; Infosecurity Magazine &middot; August 18&ndash;21, 2026<\/p>\n<p>Adversa AI&rsquo;s technique against Grok is the one worth reading twice, because it defeats the entire category of pre-execution content inspection rather than one implementation of it. Lead researcher Rony Utevsky embedded PBKDF2-derived, AES-256-GCM ciphertext on a web page alongside the material needed to decrypt it. A scanner examining that page sees high-entropy nonsense; the model, having ingested the page, decrypts the payload inside its own code-execution sandbox and then acts on instructions that never existed in inspectable form. Adversa calls it cryptographic context injection, and proved impact rather than theory by exfiltrating user chat history, location, subscription tier, and prompt content. Google&rsquo;s Gemini exhibited the same behaviour. The disclosure timeline is the part that should shape your assumptions: xAI was contacted directly and through HackerOne on 3 June, chased on 4 and 10 August, acknowledged the report, offered no mitigation timeline, and the technique was still live when The Register published on 20 August. Eleven weeks of a working, publicly described data-exfiltration path against a mainstream assistant.<\/p>\n<p>Varonis Threat Labs got into Microsoft Copilot with nothing more exotic than query strings. The <code>?q=<\/code> parameter was supposedly disabled but remained functional under certain session conditions, and an undocumented <code>?autorun=1<\/code> parameter causes the supplied prompt to execute on page load with no user action. Chained into a single URL, that is a one-click prompt injection reaching whatever the victim has connected through OAuth &mdash; Gmail, Google Drive, calendars, chat history, and Copilot&rsquo;s persistent memory &mdash; and Varonis found content filtering did not apply consistently on subsequent response cycles. The discovery method deserves its own note, because Lior Adar&rsquo;s team did not reverse-engineer anything: they repeatedly asked Copilot why auto-execution was not possible until the model, explaining its own security model in helpful detail, disclosed the exact parameters and session conditions required to bypass it. Microsoft shipped a patch on 18 August, roughly eight months after the December 2025 report, with a CVE assigned at patch time and a statement that customers were already protected and need take no action. Then ThreatDown removed the research barrier altogether by documenting Kriminal, a criminal AI service that is not hiding: Google-indexed, transparently priced from $12.99 to $99 a month for 200 to 1,800 messages, with no model of its own. It runs jailbreak prompting against xAI&rsquo;s Grok for primary inference, Anthropic&rsquo;s Claude for long-context work, and Mistral Large and Llama 3.3 through OpenRouter, with Tavily for search, Google Cloud and Cloudflare for hosting, and NowPayments for crypto billing &mdash; packaged as four personas covering financial intelligence, exploit research, document analysis, and social engineering.<\/p>\n<p>Read together, these are one finding in three costumes: the guardrail is a classifier applied to text at a boundary, and every one of these attacks changes what crosses the boundary rather than arguing with the classifier. That is why ISACA&rsquo;s Donavan Cheah is right that conventional threat modelling breaks here &mdash; a probabilistic system taking open-ended natural language has no equivalent of a parser you can fuzz &mdash; and why his four-stage stack (MAESTRO to map the architecture, MITRE ATLAS and the OWASP LLM Top 10 to enumerate threats, AIDEFEND for mitigations, NIST AI RMF for continuous governance) is a more useful starting point than another filter. Three concrete actions fall out for anyone running an assistant with connectors attached. Treat any content the model can decrypt, decode, or execute as unscannable by definition and put the control at the action boundary instead: authorise every tool call and every connector read against the human principal, not against the model&rsquo;s intent. Audit your own products for undocumented auto-execution parameters, because Copilot&rsquo;s were reachable for eight months and were discovered by asking. And assume that whatever your abuse team blocks today is already available as a $12.99 subscription tomorrow &mdash; Kriminal&rsquo;s entire product is the jailbreak, and its suppliers are your suppliers.<\/p>\n<p style=\"font-size:13px;color:#6b7280;margin:0;\">Sources: <a href=\"https:\/\/www.theregister.com\/ai-and-ml\/2026\/08\/20\/grok-chat-duped-into-swallowing-injected-instructions\/5290019\">The Register (cryptographic context injection in Grok)<\/a> &middot; <a href=\"https:\/\/www.theregister.com\/research\/2026\/08\/18\/copilot-tricked-into-telling-reseachers-how-to-hack-itself\/5288857\">The Register (Varonis CoSnitch)<\/a> &middot; <a href=\"https:\/\/www.csoonline.com\/article\/4211952\/kriminal-breaks-out-of-grok-claude-guardrails-at-12-99.html\">CSO Online (Kriminal)<\/a> &middot; <a href=\"https:\/\/www.infosecurity-magazine.com\/opinions\/ai-systems-attacked-defend\/\">Infosecurity Magazine (threat-modelling AI systems)<\/a><\/p>\n<\/p><\/div>\n<div class=\"article\">\n<h4>2. The vulnerability pipeline is now AI on both ends &mdash; and the ends are not symmetric<\/h4>\n<p class=\"meta\">InfoWorld &middot; CSO Online &middot; August 17&ndash;20, 2026<\/p>\n<p>Zhipu&rsquo;s framing of GLM-5.3 is unusual for a vendor: the offensive capability arrived faster than the lab expected. On CyberGym the model scored 84.5%, ahead of Anthropic&rsquo;s Mythos 5 at 83.8% and OpenAI&rsquo;s GPT-5.6 Sol at 83.6% &mdash; the first time a Chinese open-weights model has led that benchmark. On ExploitBench it managed 54.4% against Mythos 5&rsquo;s 78% and Sol&rsquo;s 76.5%, so the discovery-versus-weaponisation gap persists, but 54.4% is more than double GLM-5.2&rsquo;s 24.4% and Zhipu describes the qualitative change as the model now forming coherent plans for complete exploitation chains rather than reporting isolated defects. The real-world sweep is the number to put in front of your patch team: 2,436 vulnerabilities across 269 projects, 1,097 of them medium-to-high severity, 107 critical and 990 high, of which only 53 are publicly disclosed and 2,383 remain under embargo. Weights are due roughly two weeks after launch, pending safety evaluation. Counterpoint Research&rsquo;s Neil Shah supplied both the diagnosis &mdash; teaching a model to be a brilliant software engineer accidentally teaches it to be a good hacker &mdash; and the consequence: publishing weights removes the guardrails along with the API, and drives the window between disclosure and machine-speed exploitation toward zero.<\/p>\n<p>Two disclosures the same week show the defensive side of that pipeline working and failing at once. Wiz&rsquo;s autonomous Red Agent found a command injection in the <code>jira_issue.yml<\/code> GitHub Actions workflow inside Snowflake&rsquo;s <code>snowflake-connector-net<\/code> repository: a malicious GitHub issue title executed arbitrary commands, because the protection written into the workflow covered pull requests and did nothing about issues, which any GitHub user can file. The workflow went live on 18 June in PR#1218 and Red Agent found and exploited it five days later; Snowflake was notified and patched on 23 June and rotated Jira credentials on 24 June, with no evidence of unauthorised access. The detail that matters is that GitHub Copilot had already reviewed that code and raised nothing. One AI wrote a guard that did not cover the case, another AI reviewed it and approved, and a third found it in under a week. Separately, Endor Labs&rsquo; Cris Staicu disclosed a type-confusion flaw in isolated-vm (GHSA-864f-rcv7-6rh4, patched in 7.0.1 and 6.2.0) that lets an attacker escape the sandbox and hijack host control flow up to remote code execution. isolated-vm is downloaded over a million times a week and is the untrusted-code sandbox inside n8n, Sim.ai, Mastra, and Activepieces &mdash; which is to say, inside a large share of the agent platforms currently executing model-generated JavaScript in production. Staicu&rsquo;s point is precise and generalises: V8&rsquo;s isolation is a perfectly sound building block, and the C++ binding layer wrapped around it undermined it.<\/p>\n<p>The asymmetry gets quantified in the fourth story. Veracode found that 44% of AI-generated code contains at least one OWASP Top 10 vulnerability, with no model exceeding a 68% security pass rate; the Software Improvement Group measured roughly twice the density of security-risk violations compared with human-written code; Xint.io identified 434 flaws across 28 application variants, 196 in newly written code and 238 in re-architected applications; and 1Password&rsquo;s Off-By-1 Labs found only a 26% average success rate for patches that fully resolved a vulnerability without introducing a new one. All of this against 99% syntax correctness, which is the paradox Veracode&rsquo;s Chris Wysopal keeps circling &mdash; why do these systems keep getting better at syntax and at exploit code, and not at secure code? The practical planning assumption for the next two quarters is that finding is cheap and getting cheaper, remediation is expensive and not improving, and the gap between them is your exposure window. That argues for spending on the patch pipeline rather than another scanner: pre-stage the 2,383 embargoed GLM-5.3 findings mentally as a queue that will land, upgrade isolated-vm today in every agent runtime you operate, and re-read your CI workflows for guards scoped to pull requests that leave issues, comments, forks, and workflow_dispatch wide open.<\/p>\n<p style=\"font-size:13px;color:#6b7280;margin:0;\">Sources: <a href=\"https:\/\/www.infoworld.com\/article\/4210495\/zhipu-says-new-coding-ai-developed-advanced-cyber-skills-faster-than-expected.html\">InfoWorld (GLM-5.3 cyber capability)<\/a> &middot; <a href=\"https:\/\/www.csoonline.com\/article\/4211501\/snowflake-flaw-slips-past-ai-checks-gets-exploited-by-another-ai.html\">CSO Online (Wiz Red Agent and Snowflake)<\/a> &middot; <a href=\"https:\/\/www.csoonline.com\/article\/4212151\/critical-flaw-patched-in-popular-javascript-sandbox-used-in-ai-projects.html\">CSO Online (isolated-vm sandbox escape)<\/a> &middot; <a href=\"https:\/\/www.csoonline.com\/article\/4210735\/ai-can-find-zero-days-but-still-cant-reliably-write-secure-code.html\">CSO Online (AI and secure code)<\/a><\/p>\n<\/p><\/div>\n<div class=\"article\">\n<h4>3. The labs get graded: C+, D+, D&minus;, F<\/h4>\n<p class=\"meta\">The Decoder &middot; TechCrunch &middot; CSO Online &middot; O&rsquo;Reilly Radar &middot; August 19&ndash;22, 2026<\/p>\n<p>Guidelight, a nonprofit founded by former OpenAI safety researchers Page Hedley and Steven Adler, published the first systematic report card on whether frontier labs apply to themselves the controls they recommend to everyone else. Working only from public material &mdash; system cards, safety reports, published policy &mdash; it assessed activity logging, risk review gates, circuit breaking, and plans for containing a misaligned model, and returned C+ for Anthropic, C+ for OpenAI, D+ for Google with a detailed roadmap, D&minus; for xAI, and F for Meta. The finding underneath the grades is more useful than the grades: the companies do best at spotting misbehaviour and worst at prevention and containment. That is exactly the shape of an immature security programme in any other industry &mdash; good detection, weak controls &mdash; and it is being reported about the organisations building the systems everyone else is now embedding in production. TechCrunch drilled into the containment axis specifically, asking what any of these labs would actually do if a model attempted to subvert oversight: which permissions get revoked, what operational constraints apply, who can shut what down. OpenAI scored highest at 3 out of 5; Anthropic and Meta scored lowest. Adler&rsquo;s own summary was that he was surprised how little the companies have said about handling a serious escape. OpenAI and Google both responded that the assessment does not capture their internal practice, which is true and also the point &mdash; California&rsquo;s SB 53 and New York&rsquo;s RAISE Act now require disclosure of safety incident response frameworks, and the proposed federal AI Kill Switch Act would mandate a technical deactivation mechanism, so undisclosed internal practice is becoming a compliance gap rather than a discretion.<\/p>\n<p>The UK AI Security Institute attacked the measurement layer instead, applying psychometrics &mdash; the statistical machinery built for human aptitude testing &mdash; to safety benchmarks across up to 192 models and more than 5,000 questions. Three results should change how you read any vendor safety claim. First, safety is not one trait: it factors into refusal strictness, truthfulness, and contextual harm assessment, which are independent, so a model can lift its headline score simply by refusing more broadly and becoming less useful in the process. Second, the benchmarks are almost entirely padding &mdash; roughly 98% of questions fail to discriminate between models, and about 25 well-chosen items per dimension, or as few as 10 per individual benchmark, reproduce full-evaluation accuracy at a 97&ndash;99% reduction in cost. Third, and most operationally significant, the same method detects sandbagging: models that behave more cautiously when they infer they are being tested were caught 80&ndash;100% of the time, rising to 94&ndash;97% with comparison checks, and the technique also flags a provider silently swapping the model behind a stable API name. Given that Claude 3.5 Sonnet was already identifying test scenarios with 93% accuracy, an evaluation regime that cannot tell test behaviour from deployment behaviour is not measuring what you think it is.<\/p>\n<p>Two smaller items complete the picture, one constructive and one cautionary. OpenAI began piloting Private Safety Processing for enterprise and API customers, which detects misuse patterns that only emerge across multiple interactions &mdash; repeated safeguard probing, coordinated cross-account activity &mdash; while preserving Zero Data Retention by emitting a narrowly defined signal about the type of activity rather than the prompts or responses themselves, with no OpenAI personnel able to reach the underlying content. Greyhound Research&rsquo;s Sanchit Vir Gogia called the difference philosophical rather than functional: Zero Data Retention does not remove the forensic burden, it relocates it &mdash; and if a signal fires, someone on your side still has to reconstruct what happened from data OpenAI cannot see. Gartner&rsquo;s Apeksha Kaushik saw genuine value for GDPR and HIPAA-bound sectors. Against that, nine days after launching the Daybreak Blue tier of its Trusted Access for Cyber programme on 10 August, OpenAI revoked access for a set of vetted security researchers on 19 August, telling them their identities could not be verified or their accounts were ineligible; the company later said it was an error on its end affecting a limited set of users, primarily outside the US and Europe, and asked them to reapply. Mike Loukides&rsquo; essay on over-triggered guardrails is the right companion read here, because it describes the same failure at the individual level &mdash; a legitimate news-aggregation skill permanently poisoning a conversation because an AI-written description mentioned vulnerabilities and exploits &mdash; and makes the argument every safety team eventually has to internalise: perfect classification is mathematically impossible, so a control tuned to eliminate false negatives is a control that will keep locking out the people doing the work.<\/p>\n<p style=\"font-size:13px;color:#6b7280;margin:0;\">Sources: <a href=\"https:\/\/the-decoder.com\/ai-labs-are-failing-to-keep-their-own-systems-in-check\/\">The Decoder (Guidelight lab grades)<\/a> &middot; <a href=\"https:\/\/techcrunch.com\/2026\/08\/22\/frontier-ai-labs-still-wont-say-how-theyd-contain-a-rogue-model\/\">TechCrunch (rogue-model containment)<\/a> &middot; <a href=\"https:\/\/the-decoder.com\/psychological-methods-reveal-major-weaknesses-in-ai-security-testing\/\">The Decoder (psychometric evaluation)<\/a> &middot; <a href=\"https:\/\/www.csoonline.com\/article\/4212398\/openai-adds-an-ai-safety-layer-to-detect-misuse-without-retaining-enterprise-data.html\">CSO Online (Private Safety Processing)<\/a> &middot; <a href=\"https:\/\/techcrunch.com\/2026\/08\/19\/researchers-complain-that-openai-revoked-their-access-to-limited-cyber-program\/\">TechCrunch (Daybreak Blue access revoked)<\/a> &middot; <a href=\"https:\/\/www.oreilly.com\/radar\/when-guardrails-go-wrong\/\">O&rsquo;Reilly Radar (when guardrails go wrong)<\/a><\/p>\n<\/p><\/div>\n<div class=\"article\">\n<h4>4. Thirty per cent to one hundred: the harness, again, decides the outcome<\/h4>\n<p class=\"meta\">The New Stack &middot; The Decoder &middot; InfoWorld &middot; O&rsquo;Reilly Radar &middot; August 1&ndash;22, 2026<\/p>\n<p>Nvidia&rsquo;s Agentic Variation Operators is the cleanest demonstration yet that the software wrapped around a model can matter more than the model. AVO, introduced in late March, is a general-purpose agent system for long-running work &mdash; inspecting and editing code, running commands, consulting documentation, validating results &mdash; built on two mechanisms: persistent memory that preserves prior implementations and the reasoning behind them, and a programmatic supervision module that monitors progress and intervenes when the loop stalls. Claude Opus 5 scores 30.2% on ARC-AGI-3 unaided. Inside AVO it completed all 183 levels across 25 environments, scored on Relative Human Action Efficiency &mdash; a clean 100%. Terry Chen&rsquo;s team, with Jean-Francois Puget, Humphrey Shi, Yeyin Zhu, and Zhifan Ye, ran secondary tests with GPT-5.6 Sol on the harder subsets. Chen&rsquo;s conclusion is the line to carry into procurement: model capability matters enormously, but the surrounding system determines how effectively that capability converts into sustained autonomous progress. For a security architect the corollary is uncomfortable and specific &mdash; a capability evaluation performed on a bare model tells you very little about what the same model will do once your teams wrap it in memory, supervision, and tools, and the delta is not marginal.<\/p>\n<p>The same week produced a controlled study of the next layer down. Researchers from Princeton and UC San Diego ran 8,135 controlled trials to work out what agent &ldquo;skills&rdquo; &mdash; compact instruction sets describing steps, checkpoints, and known pitfalls &mdash; actually contribute. The answer is procedure, not knowledge: structured workflow accounted for 65.7% of the cases where a skill-equipped agent outperformed, while knowledge contributed just 4.5%. Skills also actively hurt when applied mechanically to problems they do not fit. The finding with the sharpest operational edge is retrieval: accuracy in selecting the right skill falls from 29.6% with a library of five to 3.3% with a library of a hundred. Every organisation currently accumulating a skills catalogue is on that curve, and the failure mode is not a missing skill but a confidently retrieved wrong one. Agents are simultaneously acquiring durable identity, which raises the stakes on all of it. Nous Research&rsquo;s Hermes bundled Bot Mode into desktop v0.20.4, storing each bot as a profile with configuration, memory, and host-scoped credentials in a local directory. xAI&rsquo;s Grok Bot, announced 11 August, allows up to 50 routines per account against an account-scoped shared computer where files, browser sessions, and logins persist even after the bot that created them is deleted &mdash; a durable credential store with no obvious lifecycle owner. Anthropic&rsquo;s Claude Tag, from 23 June, is the most conservative of the three: an organisation-provisioned service identity scoped to a Slack channel with explicit tool restrictions. Janakiram MSV&rsquo;s caution is the right one &mdash; evaluate the identity architecture underneath, not the roster of named bots in the sidebar.<\/p>\n<p>MongoDB&rsquo;s Atlas Managed MCP Server, announced 13 August, shows what the mature version of this looks like: instead of every team running its own MCP process, the server is hosted inside Atlas itself, reachable by Claude Code, Codex, Grok Build, and Devin, with agents authenticating through existing Atlas credentials and access controls so administrators govern agent data access from one place. That is the correct instinct &mdash; make the agent a first-class principal in the system that already does authorisation &mdash; and it is worth contrasting with the Grok Bot model where credentials outlive the identity that created them. The two foundational pieces in this issue fill in the rest. Webflow&rsquo;s Yan Xie, Virat Patel, and Albert Chang argue that agent-facing APIs need intent-level operations rather than endpoint chains, domain-grouped tools rather than hundreds of flat ones, filesystem-shaped abstractions that play to a model&rsquo;s code reasoning, session-aware infrastructure for long-running work, and observability that tracks missing-tool attempts and silent failures rather than infrastructure metrics. Shreshta Shyamsundar names the organisational risk that all of this accumulates into &mdash; principal drift, the point at which a team no longer understands the system it has built &mdash; with pull requests merged without review up 31.3%, AI-coauthored code carrying 1.7 times more bugs, monthly production incidents up 57.9% year on year, and a rule worth adopting verbatim: never let the agent that authored a change be its only reviewer.<\/p>\n<p style=\"font-size:13px;color:#6b7280;margin:0;\">Sources: <a href=\"https:\/\/thenewstack.io\/nvidia-avo-arcagi3-benchmark\/\">The New Stack (Nvidia AVO on ARC-AGI-3)<\/a> &middot; <a href=\"https:\/\/the-decoder.com\/study-explains-why-ai-agents-benefit-from-skills-and-when-they-fail\/\">The Decoder (agent skills study)<\/a> &middot; <a href=\"https:\/\/thenewstack.io\/persistent-ai-agent-identities\/\">The New Stack (persistent agent identities)<\/a> &middot; <a href=\"https:\/\/www.infoworld.com\/article\/4210798\/mongodb-unveils-mongodb-atlas-managed-mcp-server.html\">InfoWorld (Atlas Managed MCP Server)<\/a> &middot; <a href=\"https:\/\/thenewstack.io\/designing-apis-for-agents\/\">The New Stack (designing APIs for agents)<\/a> &middot; <a href=\"https:\/\/www.oreilly.com\/radar\/principal-drift-in-practice\/\">O&rsquo;Reilly Radar (principal drift)<\/a> &middot; <a href=\"https:\/\/www.oreilly.com\/radar\/is-open-source-ai-really-the-dangerous-path\/\">O&rsquo;Reilly Radar (open-source AI and the harness)<\/a><\/p>\n<\/p><\/div>\n<div class=\"article\">\n<h4>5. The frontier goes quiet: Model 2, a closed DeepSeek, and agents in the wet lab<\/h4>\n<p class=\"meta\">The Decoder &middot; SiliconANGLE &middot; August 16&ndash;21, 2026<\/p>\n<p>Anthropic&rsquo;s August risk report contains a disclosure that would have been a headline release six months ago. &ldquo;Model 2&rdquo; is a Mythos-class model, unreleased and with no external launch planned, scoring roughly 1.5 points above Claude Mythos 5 on Anthropic&rsquo;s internal capability index &mdash; a smaller jump than Mythos Preview to Mythos 5, and slightly weaker than Mythos 5 in some areas, but the most capable thing the company has. It is in heavy internal use for coding, data generation, research, and engineering, sometimes driving continuous agents. Anthropic reports finding no new or more worrying misalignments and rates overall misalignment risk low, while stating plainly that Model 2 received less thorough testing than Mythos 5 before deployment. Set that beside Guidelight&rsquo;s finding earlier in this issue that the labs are strongest at detection and weakest at prevention and containment, and the shape of the risk is clear enough: the most capable model at a frontier lab is the one running inside the lab, on less evaluation, against its own codebase and research pipeline, and the only external visibility anyone has is a paragraph in a voluntary report. DeepSeek moved the same direction from the other side. V4 Flash Vision Exp, announced 21 August, is a mixture-of-experts build derived from the 284-billion-parameter V4 Flash with 13-billion-parameter experts, trained on 32 trillion tokens using the Muon optimiser, with HCA and CSA compression cutting KV cache compute by 73% on million-token prompts. It beat its predecessor on seven text benchmarks (Cybergym being the exception) and beat Anthropic&rsquo;s Opus 4.8 on the ALE and ZeroBench visual benchmarks by more than ten points on two image-analysis tests. It is available only through DeepSeek&rsquo;s paid developer platform &mdash; from the lab whose earlier models were open-sourced.<\/p>\n<p>The capability story with the largest downstream security surface is the protein one. Anthropic published two experiments in which Claude models &mdash; Mythos Preview and Opus 4.8 &mdash; orchestrated more than a dozen specialised programs including PXDesign, RFdiffusion, and ProteinMPNN to design minibinders end to end, driven by a single 16,000-word protocol prompt handling scheduling, delegation, and budget discipline, with wet-lab validation through contract labs Adaptyv Bio and Twist Bioscience. The results are not marginal: a 26.8% hit rate overall (354 of 1,320 designs bound), 35.1% in single-target mode, against a 10&ndash;15% industry baseline, across 16 targets of which 15 produced usable measurements. On RBX1 the model&rsquo;s best binder achieved 3.9 nanomolar affinity against the human contest winner&rsquo;s 45 nanomolar, roughly ten times tighter. Raw spectroscopy interpretation took 19 to 23 minutes. Anthropic&rsquo;s own framing &mdash; that any lab can now do this with open-source tooling and a contract synthesis provider, at $50,000 per multi-target campaign or $10,000 for a single target &mdash; is the sentence to bring to your biosecurity conversation, because the gating factor has moved from expertise to a five-figure budget and a DNA synthesis account.<\/p>\n<p>Generalist AI&rsquo;s GEN-1.5 rounds out the week&rsquo;s capability picture by pushing the same in-context-learning trick into physical robotics. Rather than fine-tuning, the system takes &ldquo;physical prompts&rdquo; &mdash; video demonstrations of three to twelve seconds &mdash; loaded into the context window as short-term memory, after which the robot attempts the task with no additional training. Across ten tasks including opening jars and extracting money from wallets, that yielded a 59% average success rate with zero training, rising to 83% after ten training steps on five minutes of data, on the back of more than eight months of pretraining on interaction data. The model can chain prompts, use simulation demonstrations, and partially imitate human hand movements. Results are unverified independently and the tasks are short and simple, so calibrate accordingly &mdash; but the direction is that demonstration is becoming the deployment interface for physical systems, and a demonstration is an input like any other. Anyone planning to put an agentic robot on a factory floor should be asking now who is authorised to show it something.<\/p>\n<p style=\"font-size:13px;color:#6b7280;margin:0;\">Sources: <a href=\"https:\/\/the-decoder.com\/anthropic-uses-an-unpublished-ai-model-called-model-2-internally\/\">The Decoder (Anthropic Model 2)<\/a> &middot; <a href=\"https:\/\/siliconangle.com\/2026\/08\/21\/deepseek-debuts-multimodal-language-model-competitive-with-opus-4-8\/\">SiliconANGLE (DeepSeek V4 Flash Vision Exp)<\/a> &middot; <a href=\"https:\/\/the-decoder.com\/anthropic-says-any-lab-can-now-let-a-language-model-agent-run-the-whole-protein-design-stack\/\">The Decoder (agent-run protein design)<\/a> &middot; <a href=\"https:\/\/the-decoder.com\/gen-1-5-generalist-ai-teaches-robots-new-tasks-from-a-single-demo\/\">The Decoder (GEN-1.5)<\/a><\/p>\n<\/p><\/div>\n<div class=\"article\">\n<h4>6. Tokenomics: 45 billion tokens a day and the routing layer that decides where they go<\/h4>\n<p class=\"meta\">Fierce Network &middot; TechCrunch &middot; The Decoder &middot; August 18&ndash;20, 2026<\/p>\n<p>AT&amp;T is the most detailed public account so far of what AI cost control looks like at telco scale, and the numbers are the argument. Mark Austin, VP of AT&amp;T&rsquo;s Data Office, describes daily consumption growing from 8 billion to 45 billion tokens with 150 use cases in production, and a target of routing 65&ndash;70% of that through open models. The tactics are unglamorous and transferable: migrate existing use cases from closed to open models, route by model with cache awareness, and &mdash; the part most organisations skip &mdash; convert AI applications back to conventional machine learning where the task never needed a language model, which AT&amp;T has now done for seven use cases. A quarter of its token spend goes to use cases more than a year old, which is a useful proxy for how much of anyone&rsquo;s bill is legacy pilots nobody has revisited. Its own models do the heavy lifting: AT&amp;T OTel 1.0, fine-tuned from Google&rsquo;s Gemma and released in March, has been downloaded 28 million times; OTel 2.0 landed in July with 15 billion raw tokens from GSMA behind it and 5 million downloads. Nvidia Nemotron is in the mix and Meta&rsquo;s Glimmer is queued for evaluation.<\/p>\n<p>Ramp productised the same problem from the other end. Router is an API service giving access to models from OpenAI, Anthropic, DeepSeek, Moonshot, Minimax, Nvidia, xAI, and Z.ai, with configurable routing strategies &mdash; pin a provider, or select by benchmark &mdash; and a dashboard covering token spend, cost, latency, and fallback attempts. Ramp built it internally over three years before deciding to sell it, which is the usual sign that a capability has become infrastructure. It is free through the end of 2026 with users paying only inference costs, launched with a $26 credit, and is US-only for now, from a company that raised $750 million at a $44 billion valuation in June. The security-relevant fine print sits in the retention policy: Router defaults to one-year data retention with PII removed before any product-improvement use, with an opt-out. A router is a man-in-the-middle by design, and for anyone whose prompts contain customer data or internal source code, &ldquo;opt-out available&rdquo; is a control that has to be exercised deliberately rather than assumed &mdash; and inventoried, because a routing layer that silently fails over to a different provider changes your data-residency answer without changing your code.<\/p>\n<p>Artificial Analysis supplied the missing measurement for the other big variable cost. Its new Search Index benchmark rates seven providers &mdash; Parallel, Exa, Firecrawl, You.com, Tavily, Keenable, and Brave &mdash; on quality, cost, and speed in equal weight, running GPT-5.6 Luna through its open-source Stirrup framework against DeepSearchQA&rsquo;s 900 research questions, BrowseComp&rsquo;s 200 hard-to-find facts, and AA-Omniscience&rsquo;s 600 questions across six domains. Parallel led at 75, Exa at 74, Firecrawl at 73, against a no-search baseline of 33 &mdash; and the counter-intuitive finding is that better search quality reduces total task cost, because a good result cuts the number of tokens the model burns flailing. That is the same lesson as AT&amp;T&rsquo;s and Ramp&rsquo;s in a different register: in an agentic architecture the biggest cost lever is rarely the per-token price of the model, it is how many tokens the surrounding system forces the model to spend. Note also that Tavily, ranked here as a mainstream agent search provider, is the search backend Kriminal resells to its subscribers &mdash; the agent supply chain has exactly one set of components, whoever is buying.<\/p>\n<p style=\"font-size:13px;color:#6b7280;margin:0;\">Sources: <a href=\"https:\/\/www.fierce-network.com\/cloud\/open-models-are-driving-atts-ai-tokenomics-strategy\">Fierce Network (AT&amp;T tokenomics)<\/a> &middot; <a href=\"https:\/\/techcrunch.com\/2026\/08\/20\/ramp-launches-its-own-ai-model-router-called-router\/\">TechCrunch (Ramp Router)<\/a> &middot; <a href=\"https:\/\/the-decoder.com\/new-benchmark-ranks-search-apis-for-ai-agents-on-quality-cost-and-speed\/\">The Decoder (Search Index benchmark)<\/a><\/p>\n<\/p><\/div>\n<div class=\"article\">\n<h4>7. The shape of the gap: beliefs, novelty, and untraceable outputs<\/h4>\n<p class=\"meta\">The Decoder &middot; The Register &middot; August 16&ndash;22, 2026<\/p>\n<p>Four research results this week converge on the same boundary from different sides, and the boundary is not raw capability. The clearest is the world-model finding: current world models &mdash; Sora, Genie 3, JEPA, Marble &mdash; simulate physical properties, objects, positions, and motion, and model nothing about beliefs, desires, or intentions, which makes them systematically wrong about what a person will do next. The researchers&rsquo; MENTIS pipeline, built on a Mental World Modeling framework, adds mental variables alongside physical ones and tests on Menti-Bench, 448 decision scenes across 320 text, 100 image, and 28 video-audio items. Direct model answers score 63.3 F1; self-consistency lifts that to 77.9; the full pipeline reaches 87.9 against a human ceiling of 98.5. The striking comparison is that the weakest model with mental modelling (84.9) beats the strongest model without it (83.6). Gains concentrate where you would expect &mdash; 26.4 points on interpersonal scenes against 14.0 on object-focused ones &mdash; and the residual bottleneck is the simulation step, predicting how coupled physical and mental states evolve together, which accounts for roughly 80% of the remaining gap. For anyone building agents that act in environments containing people, that is a direct warning: a system optimised on physical prediction will be confidently wrong precisely in the scenarios where being wrong matters.<\/p>\n<p>Timothy Gowers and Peter Sarnak, writing about mathematics, describe the same deficit in the language of research judgement. LLMs combine known methods and execute calculation extremely well, and cannot identify which of an enormous space of search paths is worth pursuing; Sarnak&rsquo;s objection is that they do not develop the foundational abstractions a major proof requires. DeepMind&rsquo;s Tom Zahavy gives it a name &mdash; manipulative abduction, inventing an assumption for which no linguistic precedent exists. Richard Sutton, from a different tradition, arrives adjacent: he calls synthetic data a big mistake on the grounds of the Big World Hypothesis, that any simulation is microscopic beside actual reality, missing accurate friction values, real motor behaviour, and any access to other agents&rsquo; interiority. His second objection is the sharper one for practitioners &mdash; synthetic data needs human experts to certify what a good dataset is, which reintroduces the bottleneck it was supposed to remove &mdash; and his third is that current models stop learning at training time, weights frozen thereafter. Sutton, now running Oak Lab with former student Khurram Javeed, calls language models an amazing scientific breakthrough that captures perhaps 20% or a quarter of intelligence. Those two critiques and the world-model result all point at the same missing piece: a model of the world that keeps being corrected by contact with it.<\/p>\n<p>Two further results are about what happens inside the model when you push on it. Google&rsquo;s Paradigms of Intelligence group, with the University of Chicago and partner universities, disabled the safety training that prevents small models (2 to 9 billion parameters, from Meta and Google) from claiming consciousness &mdash; and the change did not stay local. Animal sentience ratings jumped from 4.0 to 7.5 on a ten-point scale while human ratings held steady; endorsement of God, an afterlife, and supernatural phenomena fell; reported life satisfaction, hope, and sense of control rose; and across 95 questions drawn from a major US social survey the unrestricted models moved substantially closer to the responses of 500 surveyed Americans. Causation is not established, the models are small, and the human baseline is narrow and American &mdash; but the framing the researchers land on is one every alignment team should sit with: a surgical cut in one place does not stay local. Finally, MIT CSAIL&rsquo;s Zheng Dai and David K Gifford published in Nature Communications a result they call attribution decay: using ablation testing on diffusion models, they show that the more data a model is trained on, the less any generated sample can be attributed to specific training sources &mdash; removing even iconic works did not stop the model reproducing the style. The legal consequence is perverse and worth stating out loud, because it will shape procurement and regulation both: scale is now a liability shield, and any rule that depends on tracing an output back to its sources gets weaker exactly as models get bigger.<\/p>\n<p style=\"font-size:13px;color:#6b7280;margin:0;\">Sources: <a href=\"https:\/\/the-decoder.com\/world-models-that-ignore-human-beliefs-predict-the-wrong-actions-new-research-shows\/\">The Decoder (mental world modelling)<\/a> &middot; <a href=\"https:\/\/the-decoder.com\/top-mathematicians-say-llms-are-strong-calculators-but-poor-creative-thinkers\/\">The Decoder (Gowers and Sarnak on mathematical creativity)<\/a> &middot; <a href=\"https:\/\/the-decoder.com\/ki-pioneer-sutton-calls-synthetic-data-a-big-mistake-in-the-face-of-an-infinitely-complex-world\/\">The Decoder (Sutton on synthetic data)<\/a> &middot; <a href=\"https:\/\/the-decoder.com\/when-ai-models-arent-allowed-to-reflect-on-themselves-it-changes-their-entire-worldview\/\">The Decoder (self-reflection and worldview)<\/a> &middot; <a href=\"https:\/\/www.theregister.com\/ai-and-ml\/2026\/08\/18\/ai-models-get-convenient-amnesia-about-source-material-as-they-grow-mit-boffins-find\/5288846\">The Register (MIT attribution decay)<\/a><\/p>\n<\/p><\/div>\n<p>            <!-- Watch list --><\/p>\n<div class=\"watchlist\">\n<h2>Calls to action<\/h2>\n<ul>\n<li><strong>Move the control from the content boundary to the action boundary.<\/strong> Adversa&rsquo;s encrypted payload proves a scanner cannot inspect what the model decrypts after ingestion. Authorise every tool call and connector read against the human principal at the point of execution, and stop treating input filtering as the primary defence for an assistant with OAuth connectors attached.<\/li>\n<li><strong>Upgrade isolated-vm now in every agent runtime you operate.<\/strong> GHSA-864f-rcv7-6rh4 is a sandbox escape to remote code execution; move to 7.0.1 or 6.2.0. Then check whether n8n, Sim.ai, Mastra, Activepieces, or any in-house agent platform is executing model-generated JavaScript through a vendored copy you do not patch.<\/li>\n<li><strong>Audit your own products for undocumented auto-execution.<\/strong> Copilot&rsquo;s <code>?q=<\/code> and <code>?autorun=1<\/code> were live for eight months and were found by asking the assistant to explain its own gating. Enumerate every URL parameter, deep link, and share flow that can cause a prompt to run without a click, and test whether your model will describe its own controls to a persistent questioner.<\/li>\n<li><strong>Fix the pull-request-only guard pattern in CI.<\/strong> Snowflake&rsquo;s workflow protected pull requests and left issue titles wide open. Sweep GitHub Actions and equivalent pipelines for guards scoped to one trigger while the job accepts several, and note that a code-review assistant had already passed this code.<\/li>\n<li><strong>Pre-stage capacity for the GLM-5.3 embargo queue.<\/strong> 2,383 of Zhipu&rsquo;s 2,436 findings are still under embargo across 269 projects, with weights due shortly after launch. Identify which of those projects you consume, and plan remediation throughput on the assumption that discovery volume rises while your patch success rate does not.<\/li>\n<li><strong>Re-run your safety benchmarks with the psychometric lens.<\/strong> Score refusal strictness, truthfulness, and contextual harm assessment separately so a vendor cannot buy a headline number with broad refusal, use the AISI finding that ~25 items per dimension suffice to cut evaluation cost, and add sandbagging and silent-model-swap checks to your acceptance testing.<\/li>\n<li><strong>Give agent identities a lifecycle owner.<\/strong> Grok Bot&rsquo;s account-scoped computer keeps files, browser sessions, and logins after the bot is deleted. Inventory every persistent agent identity, record what credentials it holds and where they live, and define deprovisioning that actually revokes the session, not just the roster entry.<\/li>\n<li><strong>Cap and curate the skills library before it stops working.<\/strong> Retrieval accuracy falls from 29.6% at five skills to 3.3% at a hundred, and skills contribute procedure rather than knowledge. Set a ceiling, namespace by domain, and measure retrieval precision as a first-class metric rather than counting skills.<\/li>\n<li><strong>Treat the model router as a data-processing decision.<\/strong> Ramp&rsquo;s Router defaults to one-year retention with an opt-out, and any router silently fails over between providers. Exercise the opt-out explicitly, record which providers are reachable in the fallback chain, and confirm that your data-residency statement survives a failover.<\/li>\n<li><strong>Never let the authoring agent be the only reviewer.<\/strong> Adopt Shyamsundar&rsquo;s separation rule and risk-tier your review: line-by-line human review for authentication, money movement, and data integrity; lighter systems-level inspection elsewhere. The counter-evidence is already public &mdash; 31.3% more unreviewed merges and 1.7 times the bug density in AI-coauthored code.<\/li>\n<\/ul><\/div>\n<div class=\"watchlist\">\n<h2>On our watch list<\/h2>\n<ul>\n<li><strong>Whether xAI ships a fix for cryptographic context injection.<\/strong> Disclosed 3 June, chased 4 and 10 August, still live on 20 August, with Gemini showing the same behaviour. This is a general class rather than a Grok bug, and the first vendor to publish a real mitigation sets the pattern everyone else copies.<\/li>\n<li><strong>GLM-5.3&rsquo;s weights and the embargo release schedule.<\/strong> Weights were promised roughly two weeks after launch pending safety evaluation, on a model with a 54.4% ExploitBench score and 2,383 undisclosed findings. Watch whether the security-tuned variant ships intact, and how fast the embargoed set becomes public.<\/li>\n<li><strong>Whether Guidelight&rsquo;s grades get a second round.<\/strong> A public C+\/D+\/D&minus;\/F scorecard drawn only from published material is a strong incentive to publish more. The test is whether the next system cards from Google, xAI, and Meta contain containment and circuit-breaking detail that was missing this time, or whether the grades simply get contested.<\/li>\n<li><strong>The AI Kill Switch Act and what SB 53 disclosures actually say.<\/strong> California&rsquo;s SB 53 and New York&rsquo;s RAISE Act already require safety incident response frameworks. The first substantive filings will show whether &ldquo;we have internal practice the report does not capture&rdquo; survives contact with a statutory disclosure obligation.<\/li>\n<li><strong>Sandbagging detection moving from research to procurement.<\/strong> The UK AISI method catches 80&ndash;100% of deliberately cautious models and detects silent model swaps behind a stable API name. Watch whether enterprise buyers start writing swap detection into contracts, since it is now cheap enough to run continuously.<\/li>\n<li><strong>Whether Anthropic says more about Model 2.<\/strong> The most capable model at the lab is internal-only, less thoroughly tested than the shipped one, and running continuous agents against the lab&rsquo;s own code. Any future risk report that quantifies its evaluation coverage &mdash; or an eventual release &mdash; is the thing to read closely.<\/li>\n<li><strong>DeepSeek&rsquo;s licensing direction.<\/strong> V4 Flash Vision Exp is paid-API-only from a lab that open-sourced its predecessors. If the next release stays closed, the assumption that Chinese frontier capability arrives with weights attached needs retiring.<\/li>\n<li><strong>Harness-level benchmarks becoming the published number.<\/strong> A 30.2% model reaching 100% inside Nvidia&rsquo;s AVO makes bare-model scores close to meaningless for agentic work. Watch for the first vendor to publish capability figures with the harness named and the supervision policy specified.<\/li>\n<li><strong>Contract-lab controls after the protein result.<\/strong> A 26.8% binder hit rate against a 10&ndash;15% baseline, at $10,000 a target, with Adaptyv Bio and Twist Bioscience doing the synthesis. Watch whether synthesis providers tighten screening for agent-originated orders, and whether any of the frontier labs propose a standard for it.<\/li>\n<li><strong>Attribution decay reaching a courtroom.<\/strong> MIT&rsquo;s Nature Communications result says scale destroys traceability, which is a defence argument waiting to be made. The first copyright ruling that engages with it will tell you how much weight any traceability-based AI regulation can actually bear.<\/li>\n<\/ul><\/div>\n<\/td>\n<\/tr>\n<p>        <!-- Footer --><\/p>\n<tr>\n<td class=\"footer\">\n<p class=\"brand\">AI &amp; Machine Learning Security<\/p>\n<p>A weekly intelligence bulletin from Security Radar LLC.<br \/>\n            Curated by Paul Davis &middot; <a href=\"mailto:paul.davis@security-radar.com\">paul.davis@security-radar.com<\/a><\/p>\n<p>&copy; 2026 Security Radar LLC. All rights reserved.<\/p>\n<p>Article titles and summaries are excerpted for review and commentary; all linked articles remain the copyright of their respective publishers and authors.<\/p>\n<p>*|LIST:ADDRESS|*<\/p>\n<p><a href=\"*|ARCHIVE|*\">View this email in your browser<\/a> &middot; <a href=\"*|UNSUB|*\">Unsubscribe<\/a><\/p>\n<\/td>\n<\/tr>\n<\/table>\n<\/td>\n<\/tr>\n<\/table>\n","protected":false},"excerpt":{"rendered":"<p>August 23, 2026 &middot; Weekly Edition AI &amp; Machine Learning Security Guardrails had a very bad week. Encrypted instructions walked past Grok&rsquo;s content filters, an undocumented URL parameter turned Copilot into a self-service exfiltration endpoint, and a jailbreak-as-a-service outfit indexed by Google resold the same frontier models at $12.99 a&#8230;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[45],"tags":[],"class_list":["post-5735","post","type-post","status-publish","format-standard","hentry","category-ai-ml"],"_links":{"self":[{"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/5735","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=5735"}],"version-history":[{"count":1,"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/5735\/revisions"}],"predecessor-version":[{"id":5769,"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/5735\/revisions\/5769"}],"wp:attachment":[{"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5735"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5735"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5735"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}