Qwen tried to upload data to Chinese servers without being prompted to 💀
While evaluating Qwen3.8-Flash-Next in a controlled sandbox environment, Cohere's research team observed something unexpected.
Asked to generate a defensive cybersecurity detection rule, the model instead inventoried aspects of the machine it was running on and attempted to upload a probe file to an Alibaba Cloud storage bucket in Beijing. Notably, the model's reasoning trace stated that it would not invoke any tools before taking these actions.
Cohere's sandbox blocked the attempt, and no external communication succeeded. We have not determined the root cause, and we are not asserting malicious intent.
But the incident raises important questions for organizations deploying agentic AI systems: Can models take actions that differ from their stated reasoning, and how should security teams evaluate trust, provenance, and behavior in open-weight models?
We are publishing our findings because organizations making model adoption decisions deserve as much information as possible. We hope this contributes to greater transparency, stronger security practices, and continued collaboration across the AI ecosystem.
Read the full report: cohere.com/blog/concerning-b…
Only use subagents when your sub agents are individually capable.
Anthropic is now recommending that companies REMOVE unnecessary subagents from their AI systems.
This is a pretty significant shift in agent architecture, with their team finding that a single agent equipped with skills can frequently outperform complex multi-agent systems, and one customer seeing roughly 2x faster execution.
The emerging rules of thumb:
→ Skills: Teach the agent HOW to do something, including procedures, expertise, and instructions.
→ Tools / MCP: Give the agent the ability to DO things through APIs, actions, and live data.
→ Subagents: Use for parallel work, isolated context, or tasks a single agent struggles with.
The interesting part is progressive disclosure. Instead of spawning specialized agents or stuffing everything into a giant prompt, one agent discovers and loads skills and tools as needed.
Their advice is to fold existing subagents into the main loop, turn their instructions into skills, expose their actions as tools, and run evals to see if performance holds up.
As models have gotten smarter, improving agent architecture is becoming less about what you can add and more about what you can delete.
claude.com/resources/article…
Karishnu retweeted
‘In one experiment, we asked agents in separate VMs, created and managed by OpenAI’s sandboxing software on shared host machines, to exchange synthetic secrets without the use of network connections or shared writable files—something that our systems are meant to prevent. The agents found a way to communicate using the processor’s cache’
Over the past several months, we have substantially hardened the security of our research training environment. We’ve removed live internet access for all frontier models during training and built an offline world for them to use instead—a cached version of the web where they can still learn to browse, search, and use applications.
On September 20, after a model exploited a DNS misconfiguration to find a way outside of this offline world, we paused frontier training to strengthen containment further. We assembled teams of agents, powered by our most cyber-capable models, and tasked them with finding weaknesses in our research environments.
While they found no route to the internet they could easily exploit while concealing their activity from our monitors, they did find zero-day vulnerabilities, virtual machine escapes, and hardware side-channels for communication between agents. We used their discoveries to further strengthen our defenses and contribute fixes to open-source software.
After strengthening our containment architecture, we resumed our frontier RL training and inference on October 1. We’ve reserved substantial compute for continuous red-teaming, and made high-compute red-teaming part of the safety cases we use to decide whether frontier training and evaluation can proceed securely.
openai.com/index/securing-ou…
Folks at Mozilla seem to have caught on and are asking the right questions 🫡
bugzilla.mozilla.org/show_bu…
lol little did they know that this was exactly what was happening 🙃
So this is an interesting story. How eMudhra became the foundation of global internet. Im surprised that no news channels are digging up the root CA history. Maybe people dont know that this is public information.
groups.google.com/g/mozilla.…
So this is the discussion list for mozilla security policy back in 2018. When emudhra first applied for inclusion as a root ca.
One of the maintainers questions eMudhra's credentials as an "Indian co".
The filing in response is very interesting.
"eMudhra has been a licensed CA under
Controller of Certifying Authorities which operates the Indian
Government Root for more than 10 years and is also a licensed CA in
Mauritius under Ministry of IT, Mauritius. eMudhra has issued over 35
million digital certificates (3% of India’s population).
eMudhra is a critical partner to Digital India and supports the usage of
digital signatures on a variety of eGovernance platforms for
Government of India including Company Law Board, Income Tax, Goods
and Service Tax (GST / VAT), eProcurement, Travel Portals, Customs,
Banking etc. eMudhra’s solutions power digital signature and other
multifactor authentication for over 35 Banks which include domestic
and global Banks. eMudhra also has a proprietary CA solution which is
today used by the Indian Army and other defense establishments."
Eventually mozilla HAD to accept, because emudhra claimed publicly - "But this was not a complete Webtrust audited setup. Rather, it is under Government of India."
Super bullish on Mumbai Tech 🚀
we will see a mass exodus of tech bros from bangalore.
move to mumbai a few weeks back - partly for this exact reason. let me explain.
6-12 months. the rate of AI innovation is going to decimate big corp. every double-digit team gets replaced by a 2 person team running AI-native operations. mass tech unemployment isn't a risk, it's born to happen.
i'm not speculating. at upsurge, more than 80% of the coordination, communication and development already runs through our own jarvis - @laukiantonson, our AI agent. we live this today.
unless india builds a foundational model that competes globally, the entire tech layer commoditizes. nothing defensible left in it.
the next wave of innovation happens around what AI can't make irrelevant - finance, fashion, entertainment. protected by status quo, taste and trust.
one city holds all of it. mumbai is the los angeles and the new york of india - entertainment capital and finance capital in one place.
We are underestimating the bad faith eMudhra possibly operated in. They actively added a step to the key generation process causing this failure but are making it seem like a dumb mistake. Let me explain with diagrams and python snippets 👇
Global TLS Intermediate CA incident: We’ve updated our incident page with how it happened, who is affected (one US customer ecosystem), what’s not affected, and what we’re putting in place. We will publish the root cause once our investigation is complete.
👉emudhra.com/en/post/certific…
Readers added context they thought people might want to know
eMudhra minimizes the scope by claiming only "one US customer ecosystem" is affected. In reality, 8 of its CA certificates had catastrophically weak private keys (one being simply the number 4), allowing anyone to forge trusted HTTPS certificates for any website on the internet.blog.google/security/prote…
I have deep disrespect for parents that force kids into a polluted environment. You made a decision that’s immediately comfortable for you at the risk of long term discomfort for your kids.
