AI Agent Security Holes | AI Field Notes #116

AnalysisNo fix exists yet for CVE-2026-105192, a 9.8-out-of-10 flaw that JFrog disclosed on October 7 in LMCache, a caching layer that speeds up vLLM (a popular engine for serving open models). In multiprocess mode, LMCache's server listens on a ZeroMQ socket with no authentication and unpickles incoming messages, so a crafted message runs the sender's code, as root on the official container images. The default binds to localhost, but LMCache's own example Kubernetes setup exposes it on a routable address. Versions 0.3.9 through 0.5.5 are affected. The AI serving stack keeps repeating mistakes that web frameworks fixed a decade ago.

AnalysisOf 97 critical and high-severity reports an early version of OSS Scanner produced across 48 projects, expert penetration testers found one false positive, according to Anthropic's launch on October 8. The free service, part of a new Cyber Mission, gives opted-in open-source projects periodic scans by Anthropic's strongest models, each report carrying a proof of concept and often a suggested patch, sent without human review. PostgreSQL and OpenSSL are early participants. A parallel Critical Infrastructure Defense Program puts Claude and on-site engineers with 11 security firms, including CrowdStrike and Palo Alto Networks, that protect grids and water systems. Models that worried bank regulators this year are going to defenders first.

AnalysisAn AI agent can now have an entry in the company directory. At its Gemini at Work event on October 8, Google showed a Gemini agent that runs tasks for hours or days in the cloud and, when you describe a role, creates a coworker with its own Workspace account, an @agents email address, a calendar and Drive storage. Its edits show under its own name in version history. The agent can route work to Anthropic's Claude as well as Gemini, and Google says it comes at no extra charge with Gemini Enterprise, in private preview for now. Long-running agents needed an identity, and Google picked the oldest answer in IT: an employee account.

AnalysisAn accounting definition knocked 1.25% off the Nasdaq on October 8. The Financial Times reported that OpenAI told investors its annualized revenue was approaching $50 billion at the end of September, well short of the $68 billion widely reported two months earlier. The gap comes from counting net revenue instead of gross partner sales, and OpenAI still cited 77% run-rate growth in the third quarter. Markets sold anyway: Oracle fell 5.5% and CoreWeave 8%. With Anthropic heading toward an IPO and the two labs counting revenue differently, the number investors trusted depended on who did the arithmetic.

AnalysisA GPT-5.5 agent that solved 63.6% of tau-bench tasks (a customer-service test) with real people jumped to roughly 82% when frontier models played the customers, according to a Meta Superintelligence Labs paper posted this week. Simulated users are too cooperative. The team's fix, MIMESIS, is a pair of 4B and 9B simulators trained to act like messy humans, with 13 behaviors such as shifting the goalposts mid-chat or hiding what they actually want. Agents trained against MIMESIS-9B beat those trained against GPT-5.5 users on all nine unseen test users. Plenty of agent success rates in sales decks were measured against a polite robot.

AnalysisOne argument injection bug was enough for Ikotas Labs to compromise OpenAI's Codex coding agent at Pwn2Own Ireland on October 6, earning $40,000 from the Zero Day Initiative, which runs the contest. Taisic Yun of Xint took the same amount for chaining an input validation bug with code injection in LiteLLM, the open-source gateway many teams use to route calls across model providers. A second LiteLLM entry partly collided with bugs already known. AI tools now have their own category in the contest beside phones and smart-home hubs, which tells you where researchers expect the payouts to grow.

AnalysisEight milliseconds on an RTX 4090 is how long Liquid AI's new d1-3B takes to answer a question, because it never generates text. The open-weight decision models, released October 7, return a typed answer such as a label or a yes in a single forward pass. The 3B version scores 48.57 on Liquid's Decision Index, level with a rival decision model about 12 times its size, and a 600M-parameter sibling also takes images or audio. Liquid demos it moderating live video and steering a simulated robot on a Jetson board. Routing and classification inside agents is turning into its own model category, and the models keep shrinking.

AnalysisBeing cruel to a chatbot for no reason will break Anthropic's rules from November 12, under a usage policy update published October 8. The ban covers only sustained, needless abuse, and Claude's existing ability to end such chats in Claude.ai and Claude Code stays the enforcement tool. The less quirky changes carry more weight. The policy now bars using Claude to decide who to investigate, arrest or charge, explicitly covers software that makes weapons work, and requires a human who can stop any hardware Claude drives. It also drops the blanket ban on personalized campaign targeting while keeping rules against deceiving voters.