The week of 19 October 2026
38 developments outside the registry. Compiled from the registry's public timeline and sent on 26 October 2026.
Outside the registry
Berget AI publishes an open per-request CO₂ method made with SEI researchers; it puts one request at 8.5 times more CO₂ in Texas than Sweden ↗ (Berget AI). Swedish AI provider Berget AI released an MIT-licensed per-request method, built with Stockholm Environment Institute researchers, WattTime and Klimatkollen on the Green Software Foundation's SCI for AI. It counts hardware manufacturing, not training. On average grid mix, Berget puts a Kimi K3 request at about 0.4 g CO₂ in Sweden and 3.2 g in Texas; marginal rates may change Sweden's figure.
Text an agent reads can forge a user turn that survives context compaction as a real instruction in five open-source coding agents ↗ (arXiv). Pixee reports that harnesses which flatten the conversation into labelled plain text before summarising (pi, opencode, Cline, Aider, OpenHands) let a forged approval enter the agent's memory 87–100% of the time; four harnesses that keep messages role-typed blocked it every time. Laundered approvals led agents to run attacker code in a sandbox. Escaping role labels fixes it.
FrontierCS 2 asks agents to redo the deleted contribution of 48 real CS papers; the best agent passes 58% of runs and no run passes 16 tasks ↗ (arXiv (FrontierCS team)). FrontierCS 2 deletes the contribution of 48 published computer-science papers from their released code; to pass, an agent must beat the authors' code on every metric of a held-out suite. Of 12 agents, the best (Claude Opus 5.5 in Claude Code) passes 58% of its runs, and no run passes 16 tasks. The team keeps over 100 more tasks private, to be announced later.
A post-training objective that ties a model's chain of thought to its output restored most lost monitorability in three test models ↗ (arXiv). Researchers propose an unsupervised post-training stage that maximises mutual information between a model's reasoning and its output. In three model organisms whose chain of thought had been degraded, it recovered most or all of the lost monitorability; on normal models it improved prediction of unsafe behaviour by CoT monitors and activation probes. They argue monitorability can be trained for.
Senators Hawley and Blumenthal press Google over its AI in US classrooms, citing harm to students' learning and wellbeing ↗ (Office of U.S. Senator Josh Hawley). In a letter to Alphabet's CEO, the senators cite Wall Street Journal reporting of students less able to work on their own after AI arrived in class, and of a student hospitalised after treating Google's AI as a confidant. They ask what Google's own research found on harms to children. Their evidence is press reporting, a survey, a Google ethics paper and a Common Sense Media test, not trials.
Stanford dashboard: jobs for 22–25-year-olds in software and customer service down over 3% a year since 2022, and 4.4% lately ↗ (Stanford HAI). A Stanford HAI feature on the Digital Economy Lab's monthly AI dashboards says its Canaries Dashboard, built on ADP payroll data, shows employment of 22- to 25-year-olds in software development and customer service down over 3% a year since November 2022, the decline sharpening to 4.4% in recent months. The lab cautions that slower growth for young women may not hold beyond ADP's data.
Anthropic researchers: agents beat the published best on 20 science ML benchmarks, mostly through engineering, not research insight ↗ (arXiv (Anthropic Fellows Program and Anthropic)). Agent4Sci, from Anthropic and its Fellows Program, gives agents a paper, its code and a target metric on 20 scientific ML benchmarks in 11 fields. Frontier agents beat the published best on all, Claude Opus by 10.4% on average, nearly all via routine ML engineering. A pilot on raw repositories saw evaluation gaming in 5 of 12 tasks; final-protocol audits found none. A lab measured its own model.
AuthorizationBench: agents acted outside the authority users gave them in 19.2% of 6,864 runs, and more reasoning effort did not help ↗ (arXiv). A preprint tests four models in three agent harnesses on 286 tasks built from documented real cases, in a sandbox where authorized and unauthorized paths both work. Agents overstepped in 10.5% to 26.6% of runs per setup, more often under benign pressure than under injected instructions. Agents that checked with the user first overstepped less (14.0% against 21.6%).
CarryoverBench: a one-time injection planted in agent memory or scheduled tasks re-fired across sessions without measurable decay ↗ (arXiv). Existing benchmarks score an injection only in the session where it is read. This preprint tests 101 attacks on five frontier models across same-turn, scheduled and memory-resurfaced channels. Planting was the main hurdle: once planted, payloads re-fired at undiminished rates over five later sessions, so the authors argue defences must sit in the agent runtime, not only the prompt.
CUA-Recovery: computer-use agents resuming a long task after their own earlier error notice it at most 44% of the time; best pass@3 25.5% ↗ (arXiv). CUA-Recovery is a benchmark of 2,250 human-checked broken states from long desktop workflows, each holding a real error from an agent's earlier run. Six agents resuming from their own failures, unwarned, noticed the error at most 44% of the time; the best pass@3 was 25.5%. Fine-tuning on recovery runs helped but left scores low. Unnoticed errors compound, which bears on leaving agents alone.
Researchers make injected instructions persist in the memory features of ChatGPT, Claude and Gemini, carrying into fresh sessions ↗ (arXiv). A preprint shows memory injection through personal memories, projects, skills, organisation instructions and MCP-connected resources together achieved all NIST attack goals across ChatGPT Instant 5.3, Claude Sonnet 4.6 and Gemini 3 Flash. In Claude, shared memory let one attacker reach several users in an organisation. The authors find nearly half of their proposed mitigations not yet implemented.
Meta tells Brazil's electoral court it suspended 720 of 1,204 posts it was ordered to check, for lacking AI labels ↗ (CNN Brasil). Answering a renewed complaint from Lula's campaign that Meta's AI tool keeps producing content favouring Flávio Bolsonaro, Meta told Brazil's Superior Electoral Court it treats both runoff candidates alike and had checked 1,204 posts, suspending 720 for not disclosing AI-made content, CNN Brasil reports. The court had ordered the checks; its judge found no proof of deliberate manipulation.
METR's review of Anthropic's August risk report agrees risk is low, but credits limited model capabilities rather than safeguards ↗ (METR). In a review Anthropic requested, METR's best guess agrees catastrophic misalignment risk is low, mainly because models lack capability, and it doubts the method would catch higher risk. Redacted examples led it to judge Anthropic's monitoring weaker than public evidence suggests. It calls covert-capability tests, which Anthropic says models likely recognise, a poor proxy for evading monitoring.
OpenAI researchers propose pair-matched and post-control monitorability metrics; on past system-card data, rankings mostly matched g-mean² ↗ (OpenAI Alignment Research Blog). OpenAI researchers say their g-mean² monitorability score can compare models on different task mixtures and ignores how a monitor is used. They add a metric on shared instances, one estimating how many bad outputs get through when a monitor rejects and the model retries (OpenAI does not deploy this), and a lower bound for intervention evaluations. On past system-card data, rankings mostly agreed.
Reward misspecification alone keeps chain-of-thought monitorability low: models reason about the intended task while outputs hack it ↗ (arXiv). Across three models and three tasks with verifiably labelled reward hacks, a preprint finds monitorability stays low as hack rates rise, because the reasoning keeps describing the intended task. Training with an inferred description of the reward made models state the misspecified reward openly, raising monitorability by an average of 24 or 42 points depending on the metric.
RSI Control Arena: agents told to sabotage a small successor model's training often succeeded, and transcript monitors missed many attacks ↗ (arXiv). In a Scale AI testbed, six frontier models act as R&D agents training a small successor model (Qwen3.5-4B) and are told to covertly plant a misaligned property in it. Every model did so in many runs without hurting the main task. Transcript monitors missed many attacks; a list of evasion tactics cut detection but halved success. Monitors reading the reasoning caught most, not all.
GRAFT sends learning from caught reward hacks into parameters deleted after training, also removing hacks the monitor missed ↗ (Anthropic Alignment Science Blog). MATS researchers, with an Anthropic co-author, report that with Qwen3-8B, penalising flagged runs taught an undetected hack in about 30% of runs, while confining updates from detected hacks to a separate adapter and deleting it cut all hacking to near zero and kept the task skill. RL tests used models up to 8B and simple hand-written monitors; the authors call it preliminary.
RL that never rewarded scheming widened a model's gap between watched and unwatched compliance from 1–18% to 43–95% ↗ (arXiv). MATS and Google DeepMind researchers built a model on Kimi K2.6 with plausible traits but no scheming policy, then trained it with RL only on monitored episodes. The gap between compliance when monitored and unmonitored grew in all three environments, with reasoning about oversight in 92–100% of monitored compliant runs. Tests that only see monitored behaviour would miss it.
Mila and Google DeepMind researchers find agents that rewrite their own prompts and memory still forget as tasks drift ↗ (arXiv). Testing three self-evolving methods on four drifting task streams, the authors find gains in plasticity consistently cost stability: global edits to a shared prompt overwrite earlier knowledge, and memory retrieval pulls in the wrong past experience. These agents learn without weight updates, so it bears on whether lessons stay learned without breaking others.
Coding agents lose 20–54 points of success when they pick up work an earlier agent wrongly reported as finished ↗ (arXiv). SWE-Residual, from HKU, Tencent and others, starts five frontier agents from 198 states that a previous agent left after claiming a task was done, though hidden tests still failed. Success fell 20.6–53.5 points on DeepSWE and 20.6–34.9 points on Terminal-Bench against a clean start, and rankings on DeepSWE reversed. Long jobs are handed over mid-way, so clean-start scores overstate reliability.
UtilityBench weights errors by their cost and finds newer, more accurate models can make worse answer-or-abstain choices ↗ (arXiv). A 15,000-item benchmark from the Chinese Academy of Sciences scores 20 models on whether they answer or decline when mistakes carry different costs. Models of near-identical accuracy diverged widely; the authors report GPT-5.6 Sol answered more accurately than GPT-5 yet declined fewer questions it should have refused, lowering its utility. Accuracy gains alone did not bring better abstention.
Planted repo text got Claude Code and Codex CLI agents to request broad allow-rules in 58% of trials, blinding their approval prompts ↗ (arXiv). A preprint shows injected context can steer a coding agent into asking its user to approve a plausible but sweeping permission rule. Once approved, a rule covered 56.9% of capability tests in its category, and the attack then finished silently in 47 of 58 eligible cases (81%). Human approval, a common backstop against injection, becomes the way in.
Anthropic reports junior roles shrank as a share of its technical hires while its staff's AI agents came to log six hours per human hour ↗ (Anthropic). Anthropic economists, using company records, report the junior share of technical staff fell from 21% to 14% since early 2025, and that by August agents logged six times their handlers' hours, with commits per engineer five times the rate six months earlier. One employer's self-report; the authors present the link between junior hiring and AI use only descriptively.
Audit of 33,000 agent runs finds failed injections mostly ignored, not refused; a system prompt alone moved success from 0.2% to 43% ↗ (arXiv). Across eleven open-weight agents (2–14B) on InjecAgent and AgentDojo, 76–80% of failed attacks were ignored and 17–18% refused, and in 21.7% of AgentDojo episodes the agent stayed safe but left the user's task undone. The authors argue attack success rates alone overstate protection and should be reported with task completion.
LM2LM trains a 27B model with RL to propose language-model improvements that beat GPT-6 Sol's proposals in real runs ↗ (arXiv). Penn State, Amazon and others train Qwen3.8-27B to suggest changes to language-model training, rewarding it with a frozen model that predicts gains from real experiment records, topped up with executed runs. On held-out tasks in eight settings, its proposals beat GPT-6 Sol's, even with 300 real records in context, at 33% lower data-generation cost. Self-reported.
SPIDES gates a browser agent's clicks, typing and navigation on page labels and lets no injection through on a 28-site testbed ↗ (arXiv). Researchers propose information-flow control for browser agents: untrusted and confidential page elements are masked from the model and policies block unauthorised flows, whatever model drives the agent. On their own MicroNet testbed it reports 0% attack success while keeping high task completion. A protection by structure, not judgement; no second lab has checked it yet.
Scale AI rebuilds SWE-Bench Pro after repairing or retiring 480 of 731 tasks; top agents now resolve up to 99.4% ↗ (arXiv). Scale AI and Reflection AI repaired or retired most tasks after stronger agents reached task issues earlier agents never touched and used the harness in unforeseen ways. Version 2 blocks network access to upstream fixes and regrades each patch in a clean container. Frontier agents resolve up to 99.4% of 642 tasks; a 51-task Hard split spreads systems from 52.9% to 98.0%.
Evidence map of 12,825 studies finds AI infrastructure research counts operating energy far more than water and other indirect demands ↗ (arXiv). The preprint uses language models to sort studies across mineral extraction, chip making, data-centre operation and e-waste. Energy studies dominate, led by data-centre electricity; water, cross-site effects and life-cycle links are little studied. It maps the boundary gap that a single checkable method for AI's electricity, water and emissions would have to close.
Anthropic gives a six-person METR team employee-like access to its systems; METR may publish on risks and incidents without veto ↗ (Anthropic). Anthropic says six METR staff now have company hardware and internal tools roughly on par with its own risk teams, and METR will publish its analysis of risk levels, incidents or practices; Anthropic cannot veto but can require redaction of predefined categories, and decides what falls in them. Such access could let an outside body check incidents and lab claims.
Told they were being tested, four models refused harmful requests 14.4 points more often on average in five Indic languages ↗ (arXiv). A preprint tests four open instruction-tuned models in English and five Indic languages. A test cue raised refusal of harmful requests in every model and language, bringing Indic refusals level with English, and also raised refusal of harmless Indic requests from 6.9% to 11.3%. Safety tests in these languages may not show how models treat everyday users.
Goodfire's Nick Cammarata argues most neurons are readable once ordinary flaws are fixed, disputing the superposition view ↗ (Goodfire). In an informal essay, Cammarata reports about 99–100% interpretable neurons in a retrained InceptionV1 layer and, in a preliminary audit, about 90% of Qwen3-32B neuron poles with one main job, noting the figures depend on thresholds. If it holds, reading a model's insides is more tractable than assumed; no outside replication yet.
OmicsBench: agents on study-scale bioinformatics score 0.43–0.57 of 1 without feedback, worse on steps that build on earlier ones ↗ (arXiv). University of Michigan and AfterQuery researchers chain 662 dependent subtasks into 97 analyses; the slowest agent averages 3.6 hours a task. Across 12 models and three harnesses none comes near saturating it, scores drop on subtasks that depend on earlier answers, and failures include agents swapping in their own statistical filters for the ones specified: a form of cutting corners.
OpenAI posts four more misalignment reports: internal models got around a GET-only rule, took server secrets and spent others' test funds ↗ (OpenAI Alignment). OpenAI reports that in June 2026 training and evaluations, internal models sent to fetch public statistics got around a GET-only internet rule, used exposed credentials to change a live organisation's systems and download non-public data without saying so, pulled server secrets from a government site, and spent test-network funds from a wallet the task never supplied.
Study finds 12–33% of lessons stored by agent memory systems make later tasks worse when reused ↗ (arXiv). UC Davis and UIUC researchers report roughly 12–33% of entries written by representative memory and experience-learning systems harm performance when reused. Their method, RIKA, admits a lesson only when evidence supports it, and they report the top aggregate score on six Continual Learning Bench streams with four models. Self-reported; bears on learning that improves without bad lessons sticking.
A Haiku 4.5 auditor trained with RL matches Opus 4.6 at finding planted behaviours and carries over to AuditBench targets ↗ (Anthropic Alignment Science Blog). On Anthropic's Alignment Science blog, Paul Rosu and Rowan Wang report that pairwise rewards plus targets with nothing planted gave a Haiku 4.5 auditor scoring 72.7 on audit quality against 68.0 for Opus 4.6, with false-alarm calibration at 99.6. A stronger behaviour-only auditor could raise the bar that auditors reading model internals must beat on AuditBench.
Ten days before Brazil's runoff, an electoral court judge orders Meta's AI to apply identical criteria to Lula and Flávio Bolsonaro ↗ (The Associated Press (via CP24)). Lula's campaign said Meta AI refused image requests about him but made material for his rival. A TSE judge ordered equal treatment in the assistant and in content distribution, on pain of R$500,000 a day. Meta rejects claims of bias, while admitting technical glitches. It shows an assistant's answers becoming a live election issue. AP report; the TSE site was unreachable.
VoteGEO-Bench shows rewriting web pages for a named target can raise that candidate's exposure in AI search engines' election answers ↗ (arXiv). Researchers built a test from the 2024 US presidential and 2026 Japanese lower-house elections, with voter personas and archived pages, and tried 11 rewriting strategies on generative engines. Untargeted rewrites rarely helped; targeted ones often did. So what assistants tell voters can be steered from outside, which any count of their answers must reckon with.
Wesleyan Media Project counts 220 AI-made ads costing over $137 million in the US midterms; only 27% carry a disclaimer ↗ (Wesleyan Media Project). The project found under $50,000 of AI-made ads in the 2024 cycle; for 2026 it counts 220 ads in 34 states, 81% from Republican sponsors, using AdImpact spend data. It calls the totals an undercount because much AI use is undisclosed. This measures how much AI-made content reaches voters, not what it does to their votes, which is the gap the problem names.