Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-07-31 · high
The math only breaks if access is gated by credentials an attacker can't fake, not by safety training, per a new arXiv paper.
Why now: The paper posted to arXiv in July 2026, adding a formal argument to the live debate over open-weight safety.
A new paper puts a hard number on why open-weight AI can't be safe, useful, and open at the same time, per arXiv 2607.27951.
That's a problem for anyone counting on safety training to close the risk gap on open releases. The floor holds regardless of how good that training gets, as long as the model still has to answer real dual-use questions.
Their argument splits the capability a model releases from the evidence a safeguard has about who's asking. Copyable evidence, a stated purpose, a persona, a chat history an attacker can imitate, is what breaks it.
Given that, the authors work out an exact worst-case floor. It caps how much help any safeguard can deny an attacker while still answering dual-use questions usefully.
Per the authors, the way out is hard-to-copy trusted credentials that predict downstream use. That's something an attacker can't fake just by wording a prompt right. The paper doesn't say what such a credential looks like in practice, or who would issue it.
Each link below shares sources, entities, or timing with this story.
arXiv 2608.27141 proves a separation result: against an attack whose evidence is fragmented across iterations, any monitor whose safety state resets each trajectory has a true-positive rate equal to its false-positive rate, no matter how expressive it is. A monitor retaining c...
Bartolomeo Bogliolo released an open-source MCP server delegating multi-step logical reasoning to SWI-Prolog, with Euclid-IR, an engine-agnostic Horn-clause intermediate representation designed to be easy for LLMs to emit. The tool interface supports translate-run-inspect-repa...
The study extracted 130 clean atomic state transitions from 707 real issues in SWE-bench Lite and Verified. Plain RAG scored 0.57-0.59 answer accuracy; an LLM reranker didn't help and added latency, about 18 seconds against 2.1. A (subject, relation, object) supersession memor...
The argument is that token uncertainty shows up not only in output-distribution breadth but in whether a confident prediction is fragile under perturbation of its attention pathways (arXiv 2608.11138). It's training-free: mask attention heads, measure BALD mutual information a...
Self-hosted agents read and write their own memory and config to function, which means an attacker can compromise one entirely through legitimate OS system calls with no exploit involved (arXiv 2607.17986). The paper builds a 23-cell attack matrix across Target, Mechanism, Gra...
The authors model strategic bidding as a repeated game with imperfect public monitoring, then run multi-agent RL over it, and build a criteria set for judging collusion that goes beyond comparing profit against Nash equilibria. Agents sustained supra-competitive outcomes match...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.