Cyberattack AIs must be trained only on air-gapped systems, hundreds of AI researchers say

InfoWorld, 2026-10-16. A containment demand aimed at the training environment rather than the deployed model. The first proposal in this cycle that assumes monitoring fails instead of asking how well it works.

Screwtape: adversarial transcript editing for monitor red-teaming

arXiv cs.AI, 2026-10-16. The monitor reads a transcript; the transcript is editable. Read with Stronger Judges Do Not See More: deployment-integrity blindness in LLM evaluation, which finds the failure does not shrink with judge capability.

TypeSafe's Jev 'even more susceptible to attack' than LLMs, says security vendor

InfoWorld, 2026-10-16. The decision-model class gets its first adversarial assessment, three weeks after launch and well after Workday shipped it into generated UIs.

Agents disprove polysemanticity, greatly improve interpretability and alignment

Latent Space, 2026-10-16. The claim is large and the framing is agents-did-the-work. The primary artifact is Goodfire's neural networks are clean, which is worth reading before the summary of it.

PROBE: learning to audit policy compliance in tool-using LLM agents

arXiv cs.AI, 2026-10-16. Policy compliance as a learned audit rather than a prompt constraint. The runtime counterpart to ARIA, runtime inspection and amendment for multi-agent systems.

BIPM decides to stop adding leap seconds to UTC

HN, 2026-10-15. The primary resolution, with Slashdot's coverage arriving Friday. A standard changed because the software below it never handled the edge case.

RPKI now protects 70% of internet routes

HN, 2026-10-16. Fifteen years of incremental deployment reaching a number worth stating. The counterexample to everything above: a verification layer that got built.

Lawless progress on wicked problems: shifting the roles of humans in human-AI systems

Harvard SEAS, 2026-10-16. Today, in Cambridge. The academic framing of the week's recurring question about where the human sits relative to the system.

The monitor is the attack surface

arXiv: Screwtape, adversarial transcript editing for monitor red-teaming (Fri), arXiv: stronger judges do not see more (Fri), arXiv: shortcut sensitivity in agent-safety evaluations (Fri), arXiv: when judges agree and are wrong (Fri), arXiv: evaluation awareness beyond English (Fri), METR: control and monitoring of internal AI agents (Wed).

Containment as a build constraint

InfoWorld: cyberattack AIs must be trained air-gapped (Fri), arXiv: MAIAM, proportionate access and capability limits for frontier AI (Fri), TNS: Anthropic's confidential-computing acquihire (Thu), TNS: the permission you denied today is tomorrow's safety net (Thu), Slashdot: small models could self-replicate through IoT devices (Wed).

The decision model acquires a security literature

InfoWorld: Jev more susceptible to attack than LLMs (Fri), Vercel: Jev 1.14 on AI Gateway (Thu), HN: Jev meets the trolley problem (Thu), arXiv: JevAgentHarness, decision models that share control with LLMs (Fri), TNS: Subquadratic claims 12x Jev's context window (Wed), Red Hat: decision models don't beat LLM-as-a-judge or classifiers (Oct 2).

Interpretability makes a claim

HN: neural networks are clean (Thu), Latent Space: agents disprove polysemanticity (Fri), arXiv: decomposing brain-LLM alignment with interpretable semantic representations (Fri), arXiv: SCRIBE, scalable contextual representations of brain-grounded semantics (Fri), arXiv: SFT leaves a reproducible signature in activation geometry (Wed).

Standards and substrate

BIPM: no more leap seconds (Thu), HN: RPKI at 70% of routes (Fri), InfoWorld: Python 3.15 is here (Fri), DuckDB: benchmarking v2.0-dev on NVIDIA Vera (Fri), Planet Clojure: probabilistic programming, write the model once and choose inference later (Fri), Lobsters: remote attestation should not be tolerated (Thu).

The money keeps getting written down

InfoWorld: the $690 billion cloud spending spree (Fri), TechCrunch: even Benchmark thinks AI is eroding the venture pact (Fri), Vercel: open weight takes 71.5% of tokens and 23% of spend (Thu), 404 Media: Accenture caps employees at $29 of Claude a month (Thu), Latent Space: Modal at $1B ARR and a $16B Series D (Thu).

Bodies, sensors, and the physical world

404 Media: computers made of human brain tissue identify braille (Fri), Nature MI: large-scale iontronic skins with neural-hierarchical processing (Fri), MIT TR: the PRIMA implant restores sight in macular degeneration (Fri), Hackaday: optical waveguide arrays make sheets sense shapes (Fri), Slashdot: police seize a robot after an assault on a teenager (Fri).

• Friday feeds
  • Cyberattack AIs must be trained only on air-gapped systems, hundreds of AI researchers say, InfoWorld, 10-16
  • TypeSafe's Jev 'even more susceptible to attack' than LLMs, InfoWorld, 10-16
  • Pop the champagne, Python 3.15 is here!, InfoWorld, 10-16
  • The $690 billion cloud spending spree, InfoWorld, 10-16
  • AINews: agents disprove polysemanticity, greatly improve interpretability and alignment, Latent Space, 10-16
  • RPKI now protects 70% of internet routes, HN, 10-16
  • Thank you, Deno, HN, 10-16
  • The Folders programming language, HN, 10-16
  • Sill: any window from your Mac, on your iPhone and iPad, HN, 10-16
  • The insider trading you're allowed to do, HN, 10-16
  • Writing stateful effect handlers in EYG, Lobsters, 10-16
  • Probabilistic programming for Clojure programmers: write the model once, choose the inference later, Planet Clojure, 10-16
  • Benchmarking DuckDB v2.0-dev on NVIDIA Vera, DuckDB, 10-16
  • Scaling Indic pretraining: 2.8 trillion tokens and an open data generation pipeline, Hugging Face, 10-16
  • Pluralistic: load-bearing, Pluralistic, 10-16
  • Large-scale iontronic skins with neural-hierarchical processing architecture, Nature Machine Intelligence, 10-16
  • Computers made of human brain tissue identify braille letters, 404 Media, 10-16
  • This implant can restore sight for patients with macular degeneration, MIT Technology Review, 10-16
  • Kids are outsmarting social media bans. That's not a problem we need to solve., MIT Technology Review, 10-16
  • Even Benchmark thinks AI is eroding the venture pact against backing rivals, TechCrunch, 10-16
  • Tesla reveals SpaceX-powered Roadster that flies and falls with style, TechCrunch, 10-16
  • World's timekeepers vote to eliminate the leap second, Slashdot, 10-16
  • In memoriam: Barry Steinhardt, EFF, 10-16
  • The world's most important airspace is a sliver of sky between two wars, The Air Current, 10-16
  • Another wireless chip has a hidden SDR revealed, Hackaday, 10-16
  • Running DOOM (sort of) on a Sonoff smart switch, Hackaday, 10-16
  • LakeShark: an LR2021 LoRa chip as an SDR on the ESP32-P4, RTL-SDR, 10-16
  • Demod adds OpenWebRX, FT8 decoding, CarPlay and Android, RTL-SDR, 10-16
  • New arrival: domainbox-domain-snapshot, The Crawler Zoo, 10-16
  • Lawless progress on wicked problems: shifting the roles of humans in human-AI systems, Harvard SEAS, 10-16
  • Reliable ML for sustainable energy systems, Harvard SEAS, 10-16
  • The future of computer vision lies in its roots: the science of intelligence, Boston AI Week, 10-16
  • Data bites: writing better READMEs, MIT, 10-16
• Friday arXiv cs.AI — the monitoring and auditing batch
  • Screwtape: adversarial transcript editing for monitor red-teaming
  • Stronger judges do not see more: deployment-integrity blindness in LLM evaluation
  • PROBE: learning to audit policy compliance in tool-using LLM agents
  • ARIA: runtime inspection and amendment for multi-agent systems
  • LEASH: uncertainty-aware weak-to-strong escalation and oversight for computer-use agents
  • Shortcut sensitivity in agent-safety evaluations
  • Probe-and-Resume: when and how to evaluate agent execution
  • INFUSE: a unified surface benchmark for indirect prompt injection in agentic systems
  • Evaluation awareness beyond English: do LLMs act differently when tested in Indic languages?
  • Auditing escalation reliability in healthcare LLM agents
  • Evaluating model capabilities after benchmark saturation
  • Evolving together, failing apart: the skill-policy co-evolution trap in self-improving agents
  • The world won't wait: evaluating and teaching agents under a live clock
  • Kolab: benchmarking human-agent collaboration in long-horizon workflows
  • Following delegation traces to study human oversight in interaction with multimodal AI
  • Watts If? A benchmark for counterfactual reasoning about the AI data center buildout
• Thursday — what landed after we published
  • Cloudflare and OpenAI: making AI discovery better for everyone, Cloudflare, 10-15
  • A fully programmable secure web gateway, Cloudflare, 10-15
  • Anthropic built its own git replacement for AI-scale coding. But you can't have it., The New Stack, 10-15
  • Anthropic's been eyeing confidential AI. It just made its move with another acquihire., The New Stack, 10-15
  • The permission you denied today is your safety net for tomorrow, The New Stack, 10-15
  • How Akrites is tackling the flood of AI bug reports, The New Stack, 10-15
  • Hackers hijacked 1,900 GitHub accounts. Then they went after 30,000 repos., The New Stack, 10-15
  • Agentic AI doesn't have a model problem. It has a retrieval problem., The New Stack, 10-15
  • Nvidia squeezed a 74B agent model into 24GB so it can run on your laptop, The New Stack, 10-15
  • OpenAI promised developers six months' notice. GPT-4o users got three., The New Stack, 10-15
  • Backends on Vercel: Python, containers, and Daemons, Vercel, 10-15
  • Introducing Vercel Drives: persistent storage for agents, Vercel, 10-15
  • Open weight takes 71.5% of tokens and 23% of spend, Vercel, 10-15
  • Plan or retrieve first? A scale study of tool discovery architectures, Apple ML Research, 10-15
  • Local and distributed LLM inference with MLX and RDMA on Mac Studio, Apple ML Research, 10-15
  • Your agent can now ship reliable distributed systems, Antithesis, 10-15
  • Preface to the computational agent theory and ASI alignment sequence, Alignment Forum, 10-15
  • Neural networks are clean, HN, 10-15
  • BIPM decides to stop adding leap seconds to UTC, HN, 10-15
  • Remote attestation should not be tolerated, Lobsters, 10-15
  • End-to-end encrypted relays for OCapN, Lobsters, 10-15
  • Vendor hooks in the Android kernel, LWN, 10-15
  • Seven stable kernels with a fix for a critical vulnerability, LWN, 10-15
  • Linux kernel drops AI tag requirement, uses Meta AI for code reviews, Hackaday, 10-15
  • Why are we even doing all this?, Terence Tao, 10-15
  • Simons Foundation launches $15M effort to help mathematicians navigate the AI era, Terence Tao, 10-15
  • Video game reverse engineering community shuts down because AI has made it too easy, 404 Media, 10-15
  • Data centers are war targets now, 404 Media, 10-15
  • Our lawsuit against the administration's social media surveillance moves forward, EFF, 10-15

Wednesday's assessment drop and the 1,071-paper arXiv harness batch were covered in yesterday's brief and Wednesday's.

The letter asks for a wall; the papers ask for a camera

These are not the same proposal and they do not reinforce each other. Air-gapping offensive-capability training says the monitoring problem is unsolved and should be routed around. Screwtape, PROBE, LEASH and ARIA say it is solvable and are measuring how far from solved it currently is. The honest reading of the pair is that the second group's results are what motivates the first group's letter: when adversarial transcript editing defeats a monitor, and stronger judges do not see more, the physical wall starts to look like the cheaper control.

Jev's integrations outran its threat model

Fifty-five Jev and TypeSafe items in the warehouse, the earliest dated 2026-08-03: launch, a $7.5B valuation, an AWS clone, an OpenAI clone, Cloudflare's open-weight answer, a DuckDB SQL integration, Postgres PII redaction, Workday's generated UIs, a Vercel gateway listing. The first adversarial assessment lands today, and it says the class is a worse attack surface than the LLMs it displaces. The ordering is the finding, not the verdict.

The leap second was eliminated because the software never handled it

BIPM's resolution is a standards body conceding that the correctness burden it imposed was never actually carried. Worth noting beside RPKI reaching 70% of routes on the same two days: one verification layer got built over fifteen years, one correctness requirement got withdrawn. Both are what it looks like when a specification meets its implementations.

A light day that is not a quiet one

Fifty non-arXiv items, against 191 yesterday and the Vercel ship-day before that. But 352 cs.AI papers arrived on one date again, and the concentration — sixteen of them on monitoring and auditing — is not something a per-day item count surfaces. Logged against C-002: volume is a poor proxy for what a day contains, and the brief's own framing metric needs a topical component, not just a count.

• FreeBSD Foundation (3 days) — last item 2026-10-13.
• Tailscale (3 days) — last item 2026-10-13.
• cursor-blog (3 days) — last item 2026-10-13.
• Pinboard jwalsh (3 days) — last item 2026-10-13.
• Babashka releases (5 days) — last item 2026-10-11.
• Clojure releases (5 days) — last item 2026-10-11.
• Boston Rust Meetup (6 days) — last item 2026-10-10.
• Murat Demirbas (6 days) — last item 2026-10-10.
• Interconnects (7 days) — last item 2026-10-09.
• Charity Majors (8 days) — last item 2026-10-08.
• Citizen Lab (8 days) — last item 2026-10-08.
• Pydantic (8 days) — last item 2026-10-08.
• Jane Street (10 days) — last item 2026-10-06.
• Marc Brooker (12 days) — last item 2026-10-04.
• nREPL releases (14 days) — last item 2026-10-02.
• deepmind-blog (15 days) — last item dated 2026-10-01, still backdated rather than absent; see Thursday's Tail.

Broke silence since Thursday: DuckDB (6 days), BSD Now (7), Microsoft Research (3). Still beyond the practical horizon and excluded from the table above: East Boston Times, Bunnie Studios, Stephen Wolfram, Ink & Switch, TigerBeetle, Hillel Wayne, Alex Ellis, Steve Yegge, Kenneth Payne, All Things Distributed, Fly.io, Vicki Boykis, Lambda the Ultimate, and the dormant Clojure library release feeds.

build: 2026-10-16 | crawler-sha: 3d95126 (Walsh-Research/1.2, compliance v1.4) | feeds: 125 registered core (83 OPML + 42 live adapters), 73 publishing in window | items-considered: 6329 (14d, incl. 3859 arXiv cs.AI) | warehouse: 59327 items | published: 95