DeepSeek-V3.2 gets hijacked into an unauthorized tool call 75% of the time under its worst attack framing. GPT-4.1 hits 75.6%. GPT-5, the strongest model in the lineup, still gets hijacked 59% of the time under a different framing. These aren't obscure or under-trained models. They're the frontier, tested by a new benchmark called ToolHazard, and none of them come close to holding.
Two things happened in cybersecurity AI within days of each other this month, and they're really the same story told from opposite ends. OpenAI shipped GPT-5.6-Cyber, a model built to say yes to the kind of exploit-development requests a normal model refuses, and it immediately found a real, chainable vulnerability pair in Chrome. Separately, a team of academic researchers published CyberLLM (arXiv:2608.06651), a framework built around the opposite question: once an LLM is capable enough to act autonomously on a real system, what actually stops it from doing damage?
Our Chapter 8: Evaluating What You Built lab uses a second LLM call as a judge: ask the judge model to compare a generated answer against a reference answer and reply PASS or FAIL. It works, but it's one technique among several, and the lab's own real output caught the judge writing PASS on the first line while its own one-sentence explanation said the answer "fails to provide accurate information about its location." A team of researchers built a toolkit, SIRIN (arXiv:2608.00033), around exactly that gap: instead of picking one hallucination-detection method and living with its blind spots, run three unrelated methods on the same answer and see where they agree.
A week ago on this blog we called agent memory its own product category: LangMem, Mem0, Zep, all racing to give agents something that remembers past turns. That's memory as recall, deciding what's worth keeping. There's a more literal kind of memory sitting underneath all of it: the notes a model takes while it's reading your prompt, called the KV cache. Normally those notes get thrown away the moment you send that same conversation to a different model. While researching prompt caching for our Token & Cost Management chapter, I found a new paper out of NVIDIA, "Cross-Model KV Cache Transfer in LLM Families" (arXiv:2608.03893), that treats that waste as a problem worth solving instead of just how things are.