A new training method cuts prompt-injection success on agents from 78.8% to 8.8%, and several papers show agent safety tests and detectors look better than they are. For builders, the lesson is to test defenses on new attacks and realistic attack rates, not on the benchmark they were tuned for.
Most time series foundation models forecast each series on its own. Chronos-2 reads several series and their outside drivers, called covariates, from past data, infers how they relate, and returns probabilistic forecasts with no task-specific training. Across benchmarks it improves skill scores by 5.2 percentage points over the strongest baselines and win rates by 10 percentage points.
Detectors try to flag hijacked agents from the tools they call, but test sets audited here are 16% to 86% attacks. At a 2% attack rate, a detector with an AUROC, a measure of how well it ranks attacks above normal traces, of 0.879 reaches a precision of 0.076, so most alerts are false. No detector trained on one benchmark, AgentDrift, ranked traces from a second benchmark better than chance, including one that scored 0.996 on that second benchmark itself.
Looping re-runs a block of layers so each token passes through it more than once, keeping parameter count fixed while every token pays the extra compute. Across Qwen3 and Qwen3.5 models from 0.8B to 9B, only the looped 0.8B model beat both the same model trained without the loop and the best unlooped use of the same compute. The benchmarks had room to improve: the unlooped 9B model scores up to 13 points higher than the 4B.
UpLoop starts with a shallow Transformer, grows its depth by copying learned layers, and spends the compute saved early on re-running a shared middle block later in training. It matches a standard dense baseline in final parameter count, training tokens and training FLOPs. At 1.3B parameters, the average score across 22 downstream tasks rose from 22.99 to 27.52, and gains carried over to math reasoning after fine-tuning.
Membership inference tries to tell whether a model trained on a given document. The authors re-ran OLMo 2 1B's official 50-billion-token mid-training stage, inserting one document from each of 7,814 matched pairs by coin flip, with AI2's released run as the comparison. With one threshold, the best test catches 3.8% of members at a 1% false-positive rate. Across a collection, though, 13 matched pairs give a paired test 80% power.
Across nine models from two developers and three classification tasks, enabling reasoning increased agreement between models judging the same individuals. Yet individuals who drew longer reasoning traces received less consistent predictions across models. Both patterns held after accounting for differences in accuracy. So asking models to reason more pushes them toward agreement, while a long trace on one case is a sign that models disagree about it.
An agent that needs several tools fails if its retriever misses any one of them. Testing six retrieval structures on 345 AppWorld queries and 103 MCP-Bench tasks, none that was untrained on the testbed and made at most one LLM call per query completed more than 10% of AppWorld queries at k = 16. A set-level retriever trained on 75 to 90 in-domain queries did better with no LLM calls.
Chemical foundation models such as ChemBERTa and MoLFormer are trained on molecular structures so they can be fine-tuned on small lab datasets. With only 60 experimental datapoints, general-purpose GPT-6 Astra outperformed them on five physicochemical and quantum-chemical regression tasks. The chemical models needed 10x the data: at 1,000 and 10,000 points they performed on par with Astra at 60 and 1,000 points.
AutoAnalysis is an automated meta-analysis that updates itself as new studies appear. Its latest run pools 1,955 effect sizes from 420 papers. On average, human-AI combinations did significantly better than humans alone but significantly worse than the better of humans or AI working alone. The authors say collaboration should be judged against both, not only against the human baseline.
Prompt injection is when instructions hidden in emails, documents or websites take over an agent. The authors train on strong synthesized injected inputs and replace the usual DPO loss with SecPO, which anchors training to an idealized injection-proof reference model rather than the insecure undefended one. Their defended Qwen3.6-27B has an 8.8% attack success rate on AgentDojo under the AttackerMovesSecond attack, against 78.8% for Meta-SecAlign, with no noticeable loss on nine benchmarks of normal use.
AI control uses monitor models to catch a model that hides backdoors in code. On a standard test set, simple features that never run the code outrank 20 of 24 open-weight models prompted as monitors, because people wrote the honest solutions and older models wrote the backdoors, so style gives the label away. One in seven test backdoors fails the authors' validity checks. A Sonnet 5 monitor catches 77% of older models' backdoors but 37% of Sonnet 5's.
MCP, the Model Context Protocol, is how agents call outside tools. PrivacyTrace builds 1,000 synthetic user profiles and 4,000 agent trajectories using real tools from 25 servers, then asks attacking models to guess user attributes from the tool calls without seeing any conversation. They succeed 26.25% of the time, against 17.97% for guessing from priors. Tool arguments and returned results leak the most, and linking traces across sessions raises the risk further.
The audit pairs eleven LLM writers with nine API-hosted LLM evaluators across ten job descriptions and fifty candidates per job. Evaluators rank writer models in a consistent order, locally hosted models are systematically disadvantaged, and evaluators favour their own outputs. In the worst pairing, 1.8 out of twenty-five qualified candidates are filtered out purely because of model mismatch. The cause is stylistic cues that evaluators, often unanimously, reward or penalise.
The authors put the same four smoking-cessation questions to six widely deployed LLMs from twelve user personas, for 2,880 responses. Every model named FDA-approved prescription cessation medications less often to teen personas than to adult personas, by 32 to 67 percentage points. In five of six models, a persona presenting healthcare expertise got fewer facts. A short system prompt setting a factual floor narrowed persona gaps in every model, but its effect on overall fact coverage varied.
You’re caught up.
That was all 14 stories in the 2 November issue.