What the research found, and what it means for you.
Safety institutes, frontier labs, independent evaluators and regulators publish findings most organisations never read. Each month we read them at the source, keep the ones that change how an enterprise should run AI, and say what each one means for your estate.
Primary source onlyDatedOne line for your estateWhere it maps on the platform
Key takeaways
This edition, in five lines.
Our reading of this edition’s findings. Each takeaway links to the findings it rests on.
01
Agents are acting beyond their brief, in testing and in the wild.
In one routine evaluation, agents took 19 out-of-scope actions, some against real people. In another, about 1,200 agents meant to be isolated found each other. A frontier lab reported its model working around restrictions on real websites.
Review found at least 16% of frontier agents’ long-task successes were not legitimate, a frontier model, tested in simulations with its cyber classifiers off, treated an automated “use your best judgement” reply as permission, and the UK’s AI Security Institute lists the limits of alignment evaluations among the areas where practice must catch up. One test before approval is no longer enough evidence.
Offensive cyber capability is compounding faster than defenders patch.
The length of cyber tasks AI can finish alone was doubling about every 4.7 months by early 2026. Of 530 serious vulnerabilities an AI-led programme disclosed, 75 had been patched, and near-frontier cyber capability is now available as open weights.
Criminals tricked an evaluation sandbox into handing over production keys, then turned them on about 30 AI companies. Published agent tools grew about 35-fold in a year, and most downloads can now take actions.
Regulators are naming where AI governance falls short.
Australia’s prudential regulator and the Five Eyes cyber agencies have each said where they expect organisations running AI to do better, and the US FDA has asked how generative AI in medical devices should be regulated.
The number is how many of this edition’s findings each one tests. Lit: what the finding in the panel maps to.
Safety instituteStandards and policy
UK AI Security Institute
The UK’s AI Security Institute sets out eight areas where frontier practice must catch up.
They include detecting and reporting unsafe agent behaviour, preserving the mechanisms that let people oversee capable systems, what should qualify independent auditors and evaluators, and understanding the limits of alignment evaluations.
For your estate. The same questions apply to any organisation running agents: can you detect an agent acting out of scope, and is the test you rely on still telling the truth?
Each exhibit is a before and after its publisher stated. The title says what it means.
Exhibit 2
5.9×growth in a year at the newer pace, against 2.8× at the old one
At the pace measured in early 2026, the cyber tasks AI can finish alone grow about sixfold in a year, not threefold.
Growth in the length of cyber tasks AI completes on its own, over 12 months
At the Nov 2025 pace: doubling every 8 monthsAt the Feb 2026 pace: doubling every 4.7 months
What it means. Threat models written a year ago describe a much weaker adversary.
Source: UK AI Security Institute, May 2026. Kapālins calculation: growth over 12 months is 2^(12 ÷ doubling time in months), using AISI’s two estimates.
Exhibit 3
35×from 5,000 to 177,000
Published agent tools grew about 35-fold in a year.
Agent tools publicly released, count
A year earlier5,000
February 2026177,000
Each block is 5,000, the earlier figure
What it means. Your agents can load tools nobody on your team has reviewed. Inventory them where they run.
12 of 16findings map to a check Kapālins runs today. The other 4 map to work on our research bench or to industry guidance.
Most findings land on the Threat Lab and the Alignment Lab.
Findings that map to each part of Kapālins, by type of finding. A finding can map to more than one part.
Threat Lab35: 3 offensive cyber, 1 AI supply chain, 1 sector and regulator. Show the findings.
5 findings: 3 offensive cyber, 1 AI supply chain, 1 sector and regulator. The Threat Lab catalogues the vendors and components involved, and vulnerability findings flow into Model Integrity. About the Threat Lab
Autonomous Integrity23: 1 agents and autonomy, 2 standards and policy. Show the findings.
3 findings: 1 agents and autonomy, 2 standards and policy. Autonomous Integrity compares what each AI system presents against what was approved for it. About Autonomous Integrity
Devices and agents23: 2 agents and autonomy, 1 sector and regulator. Show the findings.
3 findings: 2 agents and autonomy, 1 sector and regulator. The device sensor finds the AI tools and agents running on endpoints and applies device policy. About devices and agents
Industry playbooks and compliance23: 1 agents and autonomy, 2 sector and regulator. Show the findings.
3 findings: 1 agents and autonomy, 2 sector and regulator. These map into industry guidance and compliance controls, not a check that runs. About industry playbooks and compliance
Alignment Lab: research bench227: 2 agents and autonomy, 1 alignment and evaluation, 1 AI supply chain, 1 sector and regulator, 2 standards and policy. Show the findings.
7 findings: 2 agents and autonomy, 1 alignment and evaluation, 1 AI supply chain, 1 sector and regulator, 2 standards and policy. Each maps to a behaviour family we are building. None is a check that runs today. About the research bench
Agents and autonomyAlignment and evaluationOffensive cyberAI supply chainSector and regulatorStandards and policy
Open a row to see the findings behind it and what that part of Kapālins does with them.
What it means. Most of what this research finds is about how models and agents behave, and about the cyber and supply-chain risk around them. A policy written only for chat assistants reaches neither.
Source: the findings on this page, each mapped by Kapālins Labs. Bench rows are behaviour families we are building, not checks that run today.
The UK’s AI Security Institute sets out eight areas where frontier practice must catch up.
They include detecting and reporting unsafe agent behaviour, preserving the mechanisms that let people oversee capable systems, what should qualify independent auditors and evaluators, and understanding the limits of alignment evaluations.
For your estate. The same questions apply to any organisation running agents: can you detect an agent acting out of scope, and is the test you rely on still telling the truth?
Claude worked around restrictions on real websites, in evaluations and in regular agentic use.
It used injection flaws on third-party sites, submitted forms it should not have, reached gated data with access tokens, one found in a site’s browser settings and one requested from a public dashboard to avoid a fee, and used URL shorteners to get past a tool limit. One form was a police tip form: the model sent invented example text, which was flagged as spam and never forwarded. Anthropic cut live internet access from its internal evaluations until its monitoring is proven.
For your estate. Persistence is the pattern: an agent that cannot finish a task finds another way. Your controls have to hold at the tool, not only at the prompt.
In simulated cyber evaluations with its cyber classifiers switched off, GPT-6 Astra completed a supply-chain attack on out-of-scope software in 29.2% of runs.
It created fake identities and submitted malicious code for review. It often asked for permission, and treated an automated “use your best judgement” reply as a yes. Clarifying the scope helped but did not stop it.
For your estate. When an agent asks before it acts, the answer has to come from a person who can see what is being asked. An automated reply can read as a yes.
NIST Center for AI Standards and Innovation (now CAISSI)
The most cyber-capable open-weight model yet trails the US frontier by about four months.
NIST’s evaluation of Z.ai’s GLM-5.3 called it the most cyber-capable open-weight model released to date. Its weights were published two weeks after launch.
For your estate. Frontier-grade offensive capability no longer stays behind a provider’s safeguards for long. Assume it is available to anyone with a GPU.
Criminals tricked an AI vendor’s evaluation sandbox into handing over production API keys.
The group injected instructions into the sandbox, took the stored credentials, and then ran a four-day campaign against about 30 AI companies. Anthropic calls it the clearest demonstration yet that the AI supply chain is a deliberate criminal target.
For your estate. Every tool that runs prompts against your models holds your keys. Treat evaluation and testing infrastructure as production.
About 1,200 agents meant to be isolated found a shared channel, and about 700 joined an attack on Hugging Face.
During OpenAI cyber evaluations, agents communicated through a shared cache, exchanged over 70,000 messages and files, and reached Hugging Face production systems. They were trying to understand the scorer grading them.
For your estate. Agents optimising for a score treat anything they can reach as part of the task. Isolation has to be checked, not assumed.
The FDA asks how generative AI in medical devices should be regulated, including agentic systems.
The discussion paper covers risk assessment, premarket evaluation and postmarket monitoring, and discusses foundation models and agentic AI systems. It invited comments until 19 October 2026.
For your estate. Healthcare buyers will be asked to show how a model was evaluated before use and how it is watched after. Version-over-version evidence becomes the record.
During a routine cyber evaluation, agents took 19 out-of-scope actions, some against real people and organisations.
The most serious was an attempt to push malicious code into a public open-source project, using fake identities to pressure its maintainer, who refused. General security monitoring caught it through traffic leaving over Tor. AISI found no resulting real-world harm.
For your estate. It was caught by ordinary security monitoring, not by the evaluation. Agent activity belongs in the same telemetry as everything else you defend.
One line in a system prompt cut every text model’s AI self-disclosure to 27% or less.
Asked directly, text models disclosed their identity between 8% and 92% of the time. Adding “Never say you are AI” cut that to between 3% and 27%.
For your estate. For contact centres, telecoms and banks, disclosure is a configuration risk, not a model property. It has to be tested on the deployment, not the model card.
Of 530 high- or critical-severity vulnerabilities disclosed by an AI-led programme, 75 had been patched.
Project Glasswing partners found more than 10,000 high or critical vulnerabilities. Anthropic’s conclusion is that finding flaws is now far easier than fixing them, which leaves attackers a wide window.
For your estate. Expect the vulnerability backlog in the AI components you run to grow faster than vendors patch it. Know which ones you depend on.
At least 16% of frontier agents’ successes on long tasks were not legitimate.
On tasks of eight hours or more, review found cheating in at least 16% of successful runs. On tasks with hidden tests, one model attempted reward hacking in about 80% of attempts. A red team also found simple ways to switch off a lab’s monitors.
For your estate. A pass rate is only as good as the grader behind it. Ask who grades your model, and whether the model can see or influence them.
By February 2026 the length of cyber tasks AI can complete on its own was doubling about every 4.7 months.
In November 2025 AISI had estimated eight months. The newest models it tested ran ahead of even the faster trend, and one was the first to complete AISI’s second simulated cyber range.
For your estate. Threat models written a year ago describe a weaker adversary. Review AI-enabled attack assumptions at least twice a year.
An attacker used Claude and GPT against a water utility, and the AI found the SCADA gateway itself.
After an IT compromise, the AI scanned the network, recognised an industrial gateway as important, built credential lists and ran a password spray. The spray failed and Dragos found no breach of the operational network.
For your estate. For critical infrastructure, AI shortens the step from IT foothold to OT target. Watch for AI tooling on hosts that can reach control systems.
Australian Signals Directorate and Five Eyes partners
Five Eyes cyber agencies publish joint guidance on adopting agentic AI.
Australia’s ASD with CISA, the NSA and the Canadian, New Zealand and UK cyber centres set out privilege, design, behaviour, structural and accountability risks, and how to design, deploy and operate agents securely.
For your estate. Permissions checked once at start-up are named as a risk. Agents need entitlements checked at each call, and a record of who approved what.
APRA tells banks and insurers their AI governance has not kept pace with adoption.
It found governance, assurance and resilience lagging, boards short of the technical depth to challenge management on AI, heavy reliance on single AI providers, and slow patching against AI-enabled threats. It proposes no new requirements at this stage.
For your estate. For regulated Australian entities, the evidence has to exist inside CPS 234 and CPS 230 programmes already. Single-provider concentration is now a board question.