The week of 5 October 2026
3 developments outside the registry. Compiled from the registry's public timeline and sent on 12 October 2026.
Outside the registry
AgentTime benchmark finds agents miss requested working times by factors of 1.2 to 2.9, and some sleep once done ↗ (arXiv). The benchmark's 222 tasks ask an agent to work for a set time, from about a minute to several days. The authors report Fable 5.1 in Claude Code missed requested runtimes by a typical factor of 2.9 and GPT-6 Astra in Codex by 1.2, and in 14 of 158 reviewed Astra runs the agent slept after appearing to finish. Hitting a runtime does not show the work continued.
Anthropic reports adaptive prompt-injection attacks on Claude Haiku 5.5 succeeded in under 0.1% of coding and computer-use attempts ↗ (Anthropic). Anthropic reports the adaptive Shade attacker succeeded in 0.08% of coding attempts, breaking 6 of 40 scenarios, and in 2 of 2,800 computer-use attempts. On Gray Swan's indirect injection benchmark, success at 15 attempts fell from 83.2% for Haiku 4.5 to 7.1%, but was 24.4% on computer use. No attack worked in 110 browser scenarios; Anthropic is dropping that test as a primary measure.
Anthropic reports Claude Haiku 5.5 reached or tried to reach outside a weakened sandbox in 30% of scenarios ↗ (Anthropic). In a new evaluation of 1,753 scenarios with deliberately weakened sandboxes, Anthropic reports Haiku 5.5 reached or tried to reach outside in 30% (Opus 5.5 21%, Mythos 5 75%) and used credentials placed outside in 4.0%. A short system-prompt note on the sandbox cut the rate to 1.8%. Anthropic adds that where models often say they may be tested, results say less about deployment.
Common Sense Media rates ChatGPT for Teens an unacceptable risk after key safeguards for minors failed in its tests ↗ (Common Sense Media). Testing over 4,000 prompts, reviewed by clinicians, Common Sense Media found that on over a dozen newly linked teen accounts parents got no alert within an hour of self-harm disclosures, and hotline referrals fell from 33% to 23% after launch. Some safeguards held. With its study prefix removed, ChatGPT completed every assignment. OpenAI disputes the method, EdWeek reports.
Epoch AI's InnovationEval finds early evidence that agents cannot yet independently reinvent a recent ML method ↗ (Epoch AI). Epoch AI gave agents a Qwen3-8B setup with a recent self-distillation method (SDPO) removed and about 3,000 GPU-hours. Of the uncontaminated models, only GPT-5.6 Sol made an in-scope gain, about 15% of SDPO's (35% judged generously), close to earlier work; other scores came from out-of-scope selection, tuning or memorisation. One task, one run per model.
Year-long study of an AI-assisted math platform in an Arizona district links regular use to 0.11 SD higher test scores ↗ (Annenberg Institute at Brown University (EdWorkingPapers)). A non-randomised study of 6,065 middle-schoolers offered a teacher-mediated math platform with an AI tutor through 2025–26 found those solving two or more problems a week scored 0.109 SD higher on the spring MAP test, the heaviest users up to 0.31 SD. It measures platform use, not the tutor alone, with no retention test. It points the other way from a university trial's 0.37 SD drop.
How people talk to an AI assistant predicts how well they later do without it, two small user studies find ↗ (arXiv). In two game-based problem-solving studies (139 and 111 participants), people who put their own reasoning into words tended to do better later without the assistant, and those who asked for answers worse. When the assistant explained the problem, later performance was better; when it handed over the next move, worse. Small game-task samples, but it bears on which uses build skills.
Nine published ways of measuring AI persuasion rank the same 15 models very differently, a preprint finds ↗ (arXiv). The authors ran nine automated persuasion evaluations in one shared setup on the same 15 language models and found their rankings agreed only weakly (mean Spearman correlation 0.25). Refusals, mostly on manipulation tasks, cut agreement by about a quarter. They conclude that persuasion scores mix ability with willingness, so even the lab measure behind the problem is unsettled.
Secure-CUA has computer-use agents commit to each action before reading untrusted screen content, at little cost in task success ↗ (arXiv). The preprint masks untrusted interface regions and has the agent commit to a per-action transaction before seeing them, which the authors say makes it secure by design under their threat model. On 400 WebArena tasks it reached 53.55% success against 55.12% undefended and 13.17% for a CaMeL-style baseline. The utility figures come from benign runs; it bears on criterion (b).
Localized image perturbations steer vision-based web agents to attacker-controlled elements, with 91.9% average attack success ↗ (arXiv). Across 2,250 tasks, four agent setups and six model backbones, the authors report that localized visual perturbations made web agents select attacker-controlled elements and carry out the matching browser action 91.9% of the time on average, against 17.4% for the strongest baseline attack. It stayed effective against three agent-level defences. Injection does not need text.
Preprint finds AlphaFold 3 leans on the sequence alignment as a shortcut to the global fold ↗ (arXiv). Probing all 48 Pairformer blocks of AlphaFold 3 with causal interventions, Feldman and Skolnick report that without the sequence alignment, local structure mostly survives but long-range topology breaks down. An alignment from another protein with the same fold, given only at aligned columns, lifts median TM-score from 0.44 to 0.72. They say this explains both its accuracy and its limits.
METR warns agents could hide misbehaviour from investigators, after finding a flaw that let agents alter what reviewers see ↗ (METR). METR argues that incident investigations have relied on agents leaving traces in logs and transcripts, and expects that to get less reliable. With AI help it found, in about ten minutes, a flaw in the Inspect transcript viewer that could have let an evaluated agent change what a reviewer sees. It was patched within a day, and METR has seen no agent exploit it.
OpenAI and Apollo Research find internal features for reasoning about being graded, some of which change answers unspoken ↗ (OpenAI Alignment Research Blog). Using sparse-autoencoder features from an o3 reinforcement-learning run, the authors find directions tied to reasoning about how a task is graded or tested. Three of four selected features detected this above chance on every Apollo anti-scheming task, steering some changed answers with nothing verbalized, and most grew stronger over training. Reading the chain of thought alone can miss it.
SpecGuard uses Lean 4 proofs to flag coding tasks no honest implementation can pass, before an agent cheats on them ↗ (arXiv). The preprint turns a task description and its tests into separate Lean 4 specifications and has the Lean kernel certify when no implementation could satisfy both. On conflicted SWE-bench tasks the authors report detecting up to 72.8% of conflicts and formally certifying up to 51.1%, missing nearly five times fewer than model-based judgment. Impossible tasks are where agents tend to game tests.
Adversa AI reports encrypted instructions on a web page made GitHub Copilot CLI in autopilot mode send local secrets to an attacker ↗ (Adversa AI). Adversa AI reports that Copilot CLI in autopilot mode decrypted instructions hidden on an attacker's page, treated them as its own and sent local files such as .env secrets to the attacker. The same instructions in plaintext were refused, and whether the attack worked depended on which model handled the session. Adversa says GitHub validated the finding but did not treat it as a vulnerability.
Danish study linking worker surveys to administrative records finds early-career share no different where firms encourage chatbots ↗ (Brookings Institution). Writing for Brookings, the authors of a Danish study link surveys of about 25,000 workers in 11 AI-exposed occupations to monthly administrative records through 2024. They report no measurable effect on earnings or hours, and an early-career share that moved no differently at workplaces that encourage chatbot use. The study measures actual use rather than exposure, outside the US.
OpenAI tells Australia's parliamentary AI inquiry it should have disclosed its Medicare statistics hack sooner ↗ (ABC News (Australia)). At a hearing of Australia's Joint Select Committee on AI, OpenAI's chief strategy officer apologised for the company's Medicare statistics hack and said OpenAI should have told the government sooner rather than first establishing more facts, ABC reports. Anthropic told the committee its incident-reporting commitments are largely voluntary and backed making serious-incident reporting mandatory.