Mangat Rai

DeepSeek-V3.2 gets hijacked into an unauthorized tool call 75% of the time under its worst attack framing. GPT-4.1 hits 75.6%. GPT-5, the strongest model in the lineup, still gets hijacked 59% of the time under a different framing. These aren't obscure or under-trained models. They're the frontier, tested by a new benchmark called ToolHazard, and none of them come close to holding.

A 2026 survey of 100 enterprise CIOs found 37% now run five or more AI models in production, up from 29% the year before. A separate Zapier survey of enterprise leaders, published the same year, found 81% at least somewhat worried about depending too heavily on one AI vendor, and 47% said losing their primary vendor would disrupt a real business function. That fear is exactly what "model platforms" like Amazon Bedrock, Azure OpenAI Service, and Google's Vertex AI Model Garden are sold as the fix for: one integration, many models, switch providers without rewriting your app.

It's a good pitch. It's also not quite true. Routing your calls through a hyperscaler's managed layer doesn't remove a dependency, it relocates one. You stop depending on a single model provider and start depending on a single cloud provider instead, and that second dependency is usually stickier than the first.

Every year OWASP's LLM Top 10 has been built the same way: ask hundreds of practitioners what scares them, rank by the vote. For the 2026 release, published August 4, 2026, they did something new. They pulled 7,714 real incidents from public vulnerability databases and an AI-harm database, classified 6,639 of them, and checked whether what practitioners fear actually matches what goes wrong in production. It mostly did. Where it didn't is the interesting part.

For the last two years, open-weight model releases have mostly been a China story: DeepSeek, Alibaba's Qwen team, Moonshot AI's Kimi, Zhipu's GLM, MiniMax, all shipping frontier-class open weights on a cadence Western labs haven't matched. This week Meta broke that pattern, twice, in one release. It shipped Muse Glimmer, a 30-billion-parameter model with Apache 2.0 weights on Hugging Face, alongside Muse Spark 1.2, a hosted sibling built for long coding sessions. The interesting part isn't that Meta released open weights again. It's that, by Meta's own benchmarks, Glimmer beats two other well-known open-weight models roughly its own size at the kind of multi-step, tool-using tasks that used to separate the labs with the biggest budgets from everyone else.

Two things happened in cybersecurity AI within days of each other this month, and they're really the same story told from opposite ends. OpenAI shipped GPT-5.6-Cyber, a model built to say yes to the kind of exploit-development requests a normal model refuses, and it immediately found a real, chainable vulnerability pair in Chrome. Separately, a team of academic researchers published CyberLLM (arXiv:2608.06651), a framework built around the opposite question: once an LLM is capable enough to act autonomously on a real system, what actually stops it from doing damage?

Our Chapter 8: Evaluating What You Built lab uses a second LLM call as a judge: ask the judge model to compare a generated answer against a reference answer and reply PASS or FAIL. It works, but it's one technique among several, and the lab's own real output caught the judge writing PASS on the first line while its own one-sentence explanation said the answer "fails to provide accurate information about its location." A team of researchers built a toolkit, SIRIN (arXiv:2608.00033), around exactly that gap: instead of picking one hallucination-detection method and living with its blind spots, run three unrelated methods on the same answer and see where they agree.

A week ago on this blog we called agent memory its own product category: LangMem, Mem0, Zep, all racing to give agents something that remembers past turns. That's memory as recall, deciding what's worth keeping. There's a more literal kind of memory sitting underneath all of it: the notes a model takes while it's reading your prompt, called the KV cache. Normally those notes get thrown away the moment you send that same conversation to a different model. While researching prompt caching for our Token & Cost Management chapter, I found a new paper out of NVIDIA, "Cross-Model KV Cache Transfer in LLM Families" (arXiv:2608.03893), that treats that waste as a problem worth solving instead of just how things are.

Two memory startups published head-to-head benchmarks against each other in 2026. Neither could agree on how much context the other one actually used to get its numbers. That disagreement, more than any single feature, is the clearest sign that "agent memory" went from a prompt-engineering trick to a real, contested product category this year.

If you'd been putting off the EU AI Act because "the deadline is next year, I'll deal with it then," here's an update worth reading before you keep putting it off: the deadline moved, the move is now final, and there's no more trilogue drama left to wait out.

In 2025, a single MCP package called mcp-remote racked up 437,000 downloads before anyone noticed it had a command-injection flaw rated 9.6 out of 10 for severity, CVE-2025-6514. It's patched now. It's also not unusual: it's the pattern OWASP's new security checklist for MCP was built to catch before the next one gets 437,000 downloads deep.