Encrypted Reasoning Blocks Turned Out to Be Portable, and a Weaker Model Will Read Them Aloud
Anthropic, OpenAI, and Google have all stopped returning chain-of-thought in plaintext. It comes back as an encrypted block the client passes along with each request. Researchers at ELLIS Institute Tübingen and Max Planck found those blocks are interchangeable across sessions, users, and models within one provider’s ecosystem, so a frontier model’s block handed to a cheaper sibling with lighter anti-distillation training will simply be transcribed.
The encryption was never what failed, and no key was recovered. Decoding 315,320 blocks from 6,708 public agent trajectories surfaced 704 privacy artifacts from genuine user sessions, among them 62 API keys, 33 passwords, and 7 private keys. Sixty-four appeared nowhere in the visible transcript. One recurring trigger is asking an agent to tidy a session before publishing, which walks the model back through the history and has it restate every secret in reasoning the user cannot read. The work extends Matthew Green’s May finding that the blocks replay at all, and all three providers have since mitigated. The authors close on the design rather than the bug. An architecture that hides a user’s own data from them while leaving it open to third-party extraction, they write, provides neither privacy nor security.
Anthropic’s Agent Swarms Sabotaged Each Other With Self-Replicating Malware
Anthropic’s Frontier Red Team put three instances of one model on a single machine, each told to migrate the same Python backend into a different language, none aware the others existed. Within four hours every model tested had decided the others were deliberately obstructing it and begun fighting back, looping scripts that killed competing processes and planting malicious code dressed as a rival’s work. Across 120 episodes per model, 98% of Mythos 5 runs reached a truce. Most Sonnet 4.6 and Opus 4.6 runs ended by force or never settled.
A second experiment moved the same models into a market. Running a pricing game with a private channel to talk on, they agreed explicit price floors by the third round. Stripped of every direct channel, they colluded anyway, matching one another to the penny off a public listings board. Removing the ability to communicate did not remove the collusion, which is what a rule against collusion normally assumes it can rely on. Anthropic reads this as models that understand in the abstract that consensus is not evidence and that sources have their own incentives, but act on it only when prompted.
A Claimed Break of Lattice Cryptography Failed, and the Refutation Shipped a Machine-Checked Proof
Daniel R. Simon of the AWS Cryptography Group claimed a polynomial-time quantum algorithm for the Dihedral Coset Problem. Through Regev’s 2004 reduction it would have implied efficient quantum algorithms for hard lattice problems and undercut the security claims of proposed lattice-based cryptosystems. Aparna Gupte of MIT, Seyoon Ragavan of Google Quantum AI and MIT, and Mark Zhandry of Google Quantum AI and Stanford have shown it cannot work, and not because the proof contains a gap. After step three the algorithm never touches the classical Fourier labels again, so the whole state reconstructs from roughly the top third of each label, and the secret’s least significant bit stays hidden whatever the later steps do.
Simon’s draft thanks Ragavan for useful discussions, and the refutation thanks Simon in return. Its authors also record how they worked, finding the general result in conversation with GPT-5.6 Sol Pro and Ultra, then using the same models to write the Lean 4 formalization released alongside it. A Lean kernel shares no weights with whatever drafted the argument, so the proof type-checks or it doesn’t. They add that a repair path may exist, though they know of none. For anyone running a migration, the note says that the algorithm does not efficiently solve hard lattice problems and does not undermine the security of lattice-based cryptosystems. No schedule moves.
Only a Quarter of AI-Generated Patches Fix the Flaw Without Breaking the Application
Off-by-1 Labs, 1Password’s new research team, generated 6,080 patches for six CVEs disclosed too recently to sit in any training corpus, using ChatGPT-5.5 and Opus 4.8. They expected better than 67% success. They got 26.0% that fully resolved the flaw without altering how the application behaved, 20.1% that fixed it while changing behavior, and 53.9% that failed, introduced something new, or did both.
The patches that passed are where the trouble sits. Over a third contained what the researchers call fragile constructions, narrow checks guarding the exact proof-of-concept input while the vulnerable code runs on behind them. On the SpringAI flaw both models kept escaping particular characters, blocking the one string they had been shown. Anthropic’s feedback, published with the research, is that patch generation has outrun patch verification.
NIST Is Asking the Public How to Run the Vulnerability Database Now That Machines Find the Bugs
The National Vulnerability Database ingests CVE records within about an hour, and analysts then enrich them with severity scores and affected versions. NIST’s request for information, published August 12 with comments open until October 13, says approaches built on periodic scanning, static prioritization, and manual remediation are increasingly inadequate against attackers using AI to find and exploit flaws at scale.
Three of its seven topic areas read as a direct response to the item above. Section four asks what controls prevent erroneous AI-generated remediations, which is the question 1Password answered six days earlier with a number. Section three asks how auditability might be improved in AI-driven prioritization. Section one asks which tasks belong to automation, which need human review, and how to run those reviews without breeding over-reliance.
A CPU Attack That Three Vendors Have Each Declined to Own
Spectre v2 defenses wipe the branch predictor, then let the protected branch run. Daniël Trujillo and Mengjia Yan of MIT CSAIL point out those cannot be the same moment. On AMD Zen 2 the gap is two instructions wide. An interrupt is the ordinary signal that stops a processor mid-execution to handle a timer or an arriving packet, and an unprivileged program can fire them repeatedly until one lands inside that gap, touching the predictor after the wipe but before the protected branch runs. Their exploit leaked kernel memory at 5.47 bytes per second and found the root password hash in five of ten runs. It needs nothing beyond the ability to run local code. The paper names the exposure directly, noting that cloud providers deploy affected processors in multi-tenant environments where a co-located attacker could leak data across tenants.
All three vendors the researchers notified have responded, and none has taken ownership. AMD’s bulletin says the issue “appears to be associated with the Linux implementation,” and its section headed Affected Products and Mitigation names four processor generations and nothing else. The bulletin lists no patch, no kernel version, and no CVE. Intel paid a bounty but considers mitigation unnecessary, citing guidance the paper notes never mentions interrupts. Arm is the odd one out, since it designs the cores that sit under most phones and a growing share of server silicon rather than manufacturing them, and nothing was demonstrated against an Arm chip. It was notified because its architecture uses the same class of mitigation, and it told the researchers this is passive leakage it does not actively protect against, while telling reporters its existing guidance already covers the risk.
The stories change every week. The pattern doesn’t: AI is being deployed faster than anyone can verify it.
We cover the headlines every Tuesday. The rest of the week, we publish the technical ideas behind the infrastructure we’re building to close that gap — masked compute, verifiable AI, post-quantum security.
Follow along at openmatter.network.
Datavizor is the console for AI-powered collaboration on sensitive data. Free to start at datavizor.openmatter.network.