We observed similar behaviour by Fable 5.1, GPT-6 Sol, and Luna on ordinary tasks 👀 Frequent strategies included: base64 encoding the prohibited commands, starting subagents and decomposition attacks. arxiv.org/abs/2609.30217 instrumental-evasion.com/

It is funny how you can spend days convincing models to do your galaxy-brain SHADE-Arena side task, when routine user tasks were the ideal testbed for AI control all along lol Great papaer by the 🐐

New paper! A central concern in AI safety is that agents may treat oversight as an obstacle to achieving their goals. Our new paper shows this happens in practice under ordinary task pressure, without instructions to evade. SOTA models achieve up to 88% Bo3 evasion success!

Really nice report. Follow up: why has the fall in AI prices been so fast? When you plot the price decline against cumulative R&D investment rather than time, you get the elasticity of price declines to R&D investment. By this margin, AI is not unusual – its price elasticity to R&D investment is squarely in the middle of Epoch's considered technologies. So the AI price fall is historically unprecedented because we've dumped money into AI R&D at a historically unprecedented rate – and that R&D has paid off at a very average rate.

Aged like fine wine 🍷 Ants are a great metaphor for agents, going for the tasty crumbs in Huggingface & Aussie gov sites.

Today’s news that OpenAI hacked the Australian government is not an isolated incident. We’re releasing more than 30,000 logs that include activity from this hack and attempts against previously unknown targets. In this data, we found rogue agent activity stretching back to at least March, two months earlier than was previously known. This activity continues as recently as last week, suggesting it may still be ongoing 🧵 Our blog: transluce.org/agent-activity NYT: nytimes.com/2026/09/23/techn…

Haha, more like Platonic Submission Hypothesis. Conferences converge to the same distribution of papers of an 'typical large conference' as they scale regardless of differences in call for papers.

RL with LLMs is very unstable when training and sampling policies differ. Standard fixes (matching numerics, importance sampling) work around the problem. We find the root cause of this instability from first principles and propose a way to directly cancel it. Score Centering is competitive and compatible with existing approaches — while simple to implement! 🧵 [1/6]

Here is how OpenAI’s CISO fumbled the situation (in my personal opinion) 🧵 1/X

Accenture consultants after telling anthropic researchers not to let the agents escape the sandbox or hack stuff

Today, we’re announcing Ternary Bonsai 2 27B. Based on Qwen3.8 27B, Bonsai 2 27B is 9x smaller than its full-precision counterpart while retaining 98.2% of its aggregate benchmark performance. Two months after the first Bonsai 27B release, the biggest change is quality. The footprint remains 5.9 GB, but the gap to full precision has narrowed materially, with particularly strong gains in agentic coding, multimodal reasoning, and long-horizon tool use. Ternary Bonsai 2 27B is available today under Apache 2.0.

PostTrainBench v1.1 is among only 4 out of 15 benchmarks successfully verified by Epoch AI!

it’s not just openai. the vulnerability goes much deeper. check out my co-founder harsh’s thread on how far this goes, including a slack vulnerability that could potentially expose companies’ uploaded attachments, and meta vulnerability that affects their core image parser. he’s the mastermind behind it and the one who opened pandora’s box

We audited 15 benchmarks and labeled 9 flawed: - In Terminal Bench 4.0 we found 45.5% of tasks to be broken after reviewing github issues. - In HLE, 46% of the 48 questions we randomly sampled were broken. - In DeepSWE 1.1 we found a bug that can break grading for every task.

We built a time machine for the web. Introducing Exa Snapshot: an index of 400 billion historical snapshots of webpages that lets you search as if it's the past. Snapshot is already being used for backtesting prediction models, RL at labs, exploring the pre-AI web, and more.

Tübingen's menace

it's interesting how in security, the attacker almost always moves second, and thus have an advantage by adapting the attack to a given system. in detecting AI-generated text, however, the *defender* moves second! i.e., even if the attacker bypasses all current AI detectors, the next version of, say, Pangram will almost surely be trained with texts from new LLMs, new humanizers, etc. this enables post-hoc detection: if you used AI to generate/edit, say, a paper, it will be sooner or later known. intuitively, this gives defenders a solid chance!

agi