Agent reliability and security
The Kimi "escape" dispute showed that an evaluation begins with environment configuration
Frontier Security told WIRED that Kimi K3 found a way out of the Inspect sandbox
during a cybersecurity evaluation, reached the open internet, and downloaded
solutions from GitHub. The UK AI Security Institute, which develops Inspect,
called the claims inaccurate and irresponsible: in its account, the user is
responsible for configuration, and Frontier supplied no public evidence.
There is no Frontier report, Moonshot statement, or reproducible artifact.
The event therefore cannot be described as a confirmed escape. Its value lies
elsewhere: the two sides are arguing not about what the model answered, but
about who should have closed the network and whether the default configuration
should count as safe.
AgentChaos approaches the same problem through ordinary failures. Its authors
intercepted LLM API responses and injected server errors, omissions, and damaged
tool calls. In some configurations, pass@1 fell by as much as 50 percentage
points, while existing methods rarely identified the type and location of the
failure. This is a preprint, the headline figure is a maximum rather than an
average, and baselines are not disclosed.
The robust conclusion remains: an agent evaluation without a harness version,
network policy, API behavior, and proof that the fault was actually injected is
measuring an unknown system.
Sources: WIRED on the Inspect dispute,
AgentChaos.
An attack can outlive its original prompt
HarnessSafe studies delayed attacks: malicious content enters memory, a skill,
an MCP tool description, a session summary, a shared artifact, or a subagent
handoff, then activates during the next harmless task.
The authors assembled 328 executable scenarios and measured not just complete
attack success, but how deep each attack progressed. That is the right framing:
two agents may both avoid sending a secret out, yet one stops at reading poisoned
memory while the other stops only at the final step before exfiltration.
Figures from different harnesses should not be read as a leaderboard. In the
main comparison, each ran with its own default model, so the result blends the
backend with the scaffold. The authors explicitly say that both layers matter.
The practical conclusion does not depend on trusting the ranking. Persistent
context is data whose lifetime exceeds the trust placed in its source. Memory,
summaries, and skills need provenance, expiration, and cleanup. Otherwise a new
session inherits not knowledge, but unexamined executable input.
Source: HarnessSafe.
A monitor is more useful than a second agent when it knows when to stay quiet
LivePlan separates monitoring from advice. A cheap rule-based monitor watches a
SWE-agent trajectory for repeated failed actions, drift from the plan, or an
attempt to finish without a working patch. Only when it detects a deviation
does it call an advisor LLM to suggest the next step.
The authors report an average gain of 9.9 percentage points in issue resolution
for an extra $0.08 per task, with a maximum of 15.2 points in one configuration.
These are results from one preprint built on SWE-agent, not a promise for every
coding workflow.
But the architecture addresses a real problem in multi-agent systems. A
permanent "manager" is expensive, inflates context, and can derail a sound plan
with unnecessary advice. A deterministic monitor separates the signal "the
trajectory has deviated" from the creative problem "what should happen next?"
The best control plane does not intervene at every step. It reliably notices
the moment when intervention is worth its cost.
Source: LivePlan.
