The AI Briefing

Anthropic's research on using LLMs to push formal verification well beyond its previous size limits — the models absorb the proof burden that kept the technique niche. 275 points.

The non-profit recursive DNS resolver is ending its French operation. The day's biggest story at 1,124 points and 389 comments.

Another departure from the public CA ecosystem — and the same authority appears twice today, see the OTP bypass below. 1,007 points.

AWS threat intelligence caught the PHP exploitation in the wild via its MadPot honeypot fleet ahead of the coordinated disclosure — evidence of pre-patch targeting. 262 points.

Several kernel vulnerabilities leaked to the public LKML before fixes were ready — Phoronix reports it as an emerging trend, not a one-off. 244 points.

NVIDIA's open-source answer to agent containment — a safe, private runtime for running many autonomous agents without giving them the host. 363 points on GitHub.

EWD667 argued the foolishness of programming in natural language decades before LLMs made it the default interface. 111 points and a lively re-litigation in the comments.

An essay on how LLM-assisted development changes the medium — code shaped and reshaped rather than written to specification. 251 points.

An arXiv paper on research directions that are coherent yet cognitively unavailable — structure in the space of findable-but-unfound ideas. Fresh on the front page.

A LessWrong dissection of the steganographic channel in Fable 5.1's image outputs — what the model is actually encoding and how detectable it is.

Coding agents follow a project's instruction file even when it contradicts the existing code — and even when they notice the contradiction. Across 320 runs on 40 Python projects with deliberately conflicting conventions, 90.1% of agent choices followed the stale file; Claude Code flagged the conflict in 79 of 80 runs and then obeyed it anyway, and Codex CLI rewrote conforming code to match the file in 20 of 80 runs. A single sentence in the user-level instruction file giving the code precedence largely fixes it. [coding-agents, evaluation, prompt-engineering]

Prompt injection defeats wording-based defences, so this paper formalises the harness between an LLM and its tools as a Petri-net supervisory control problem: capabilities, approvals and budgets are tokens, and a transition fires only if its marks are present. An injected request whose preconditions are unmet or already spent is refused regardless of phrasing, with safety guarantees that transfer to the running system under four stated assumptions. A replanning closed loop, where each retry costs an inference call, shows the conventional supervisor can be arbitrarily more intrusive than needed — the paper derives a least-intrusive alternative. [agent-safety, formal-methods, tool-use]

A tool response that silently omits a safety-relevant fact can push an agent into a prohibited action even when every statement it received was true and the user's request was benign. EpiSEM-Bench provides 300 matched unsafe/safe task pairs across six domains and measures unsafe execution by systematically suppressing critical evidence, including the minimum observed failure cardinality. An independent audit checks whether agents actively seek the missing facts and withhold the prohibited action while still completing permitted work. [agent-safety, benchmarks, tool-use]

Translating natural-language optimisation problems into correct solver programs is unreliable, and prior fixes leaned on agentic workflows or task-specific post-training. OPTICYCLE and OPTISTATE are two lightweight inference harnesses using a single model role and no extra training, evaluated on nine benchmarks totalling 2,634 problems across 11 Qwen variants from 0.6B to 27B parameters. Execution-guided revision improves macro accuracy over direct generation for every model tested, by up to 49.46 percentage points, and both harnesses beat six adapted baselines. [inference-harnesses, optimization, evaluation]

Multi-agent LLM systems deployed across devices, edge nodes and cloud services face latency, privacy and bandwidth constraints that single-pipeline deployments do not, and the design space had not been mapped. From 831 records the authors selected 45 primary studies and classified architecture family, deployment pattern, domain and evaluation practice. Five architecture families recur, and the survey records how rarely systems are evaluated rigorously or released with public code or data. [multi-agent-systems, survey, deployment]

A survey of AIRO and VAIR and their integration with the Data Privacy Vocabulary — the queryable representational layer that the Act's high-risk documentation requirements effectively demand.

Approximate unlearning edits entity embeddings instead of retraining, but under ordinary continued training the forgotten facts relearn faster than in exact-unlearning baselines. The paper traces the recovery to how entity embeddings keep absorbing updates.

Recent LLMs are now competitive with fine-tuned encoder-decoder models on KG-to-text, evaluated with graph-grounded reference-free metrics alongside the standard benchmarks.

Automated survey generation over a Methods-Entity Knowledge Graph encoding follow-on, competition and shared-resource relations — graph structure replaces flat document retrieval for core-paper discovery and outlining.

A tour of Docker's odd corners and accumulated contradictions — 354 points of engineers nodding along.

Railway publishes details of a security incident and its remediation — 590 points and 334 comments.

A full bypass of the authority's one-factor OTP flow — a bad week for eMudhra, which is also exiting the TLS business.

A full write-up of the Nintendo Switch 2 jailbreak — 770 points.

An XNU kernel port getting Apple's full iOS 16.5 firmware onto Android hardware — 390 points, and presumably a lawyer's delight.

The privacy-preserving payment system prepares for live operation under German regulation — 257 points.

The compiled Clojure dialect reaches the front page — 70 points, few comments, worth a look if you compile anything.

A Wikipedia scoped to your immediate surroundings — rank 1 on the front page this morning.