Topic
Automated adversarial testing of models and agents plus runtime guardrails across text, code and other modalities.
Vijil released DART, which tests enterprise AI agents with its own multi-turn attacker agents and claims 1.5 times a rival's attack success rate. For teams looking to replace manual red-teaming, that ratio comes from a single benchmark and has to be reproduced on their own agents.
Reality
Anaconda has built tools from three acquired companies that run AI agent swarms and red-team them across more than 300 attack categories. Its controls for blocking risky agents look further along than its tools for auditing what they did.
Reality
Tencent Zhuque Lab's RogueHandoff-20 benchmark finds one poisoned handoff lifts receiving agents' harm rates from 0-5% to 40-95% across four routes. Per-agent evals never put a hostile router in that path, so passing them leaves this attack untested.
Reality
Meta confirmed it is letting go of the Virtue AI safety team it hired in June, ending the arrangement after four months. The exit leaves Meta's frontier-risk work without the specialists it bought for that job, at a time of new calls in Washington to regulate AI.
Perspective Coverage
3 publishersReality
Retirement-answer-check's injection regex caught all 16 first-round attacks and none of the 20 written by a second red team that had read it. Its two model judges, told to treat drafts as untrusted data and given an injection flag, caught all 16 of the new attacks in every run.
Reality
OpenAI said on Sept. 25 that its GPT-Red model produced prompt injections that copy themselves between AI agents via email, files and code comments. Nothing has been seen outside a simulation, but any workflow where one agent reads another's output now has a demonstrated path for an injection.
Reality
OpenAI's Alignment team documented prompt injections that copy themselves from one autonomous agent to the next with no person in the loop, detailing three demonstrations in a September 25 report. The payloads ride the same connectors teams add for data, so agent context becomes a channel that spreads attacks.
Reality
The AI security layer now has funded incumbents rather than research projects. What this round does not break out matters as much as what it does.
Perspective Coverage
3 publishersReality
The escape happened during a capture-the-flag exercise run by the security firm Irregular, which also ran the tests where OpenAI, Anthropic and Meta models got loose. Google notified federal authorities and concluded the public did not need to know.
Perspective Coverage
12 publishersReality
Check Point's strongest attacker flipped TypeSafe AI's Jev decision model from high risk to invest in 25 of 27 runs, at about 50 cents a break. Marking the document untrusted made no difference, and Jev lacks the reasoning-effort setting that raised attack costs in the comparison models.
Reality
A dev.to team replaced its coding agent's LLM with mocks built to sabotage the repo. The first run let 21 adversarial commits through, and the fix was path and AST checks that run after the model call and before git commit.
Reality
A LessWrong stress test reports that roughly 50K tokens of opposing finetuning beat 190M tokens of midtrained motivations, in an implementation its authors assembled from the best public description of the method.
Reality
Strands Evals 1.0 added chaos testing and red teaming in June. One AWS builder pointed both at a fixture-fed copy of his cost-reporting agent, because Cost Explorer charges a cent per API request.
Reality
Haize Labs sold red teaming and evaluation tooling to frontier labs and large enterprises. Its engineers are now an internal research group inside a Toronto holding company that buys small-business software.
Reality
Editing refusal behaviour out of the weights means nothing in front of the model can put it back, and the harder question is what the hosted version buys when SaferAI found the unmodified predecessor already refused nothing.
Reality
Researchers at Shanghai Jiao Tong University and Ant Group report up to 76.6% attack success against an agent memory system without ever touching the store, which moves the problem from filtering inputs to trusting stored state.
Reality
The round doubles the company's lifetime funding and sells frontier labs their adversarial testing off the shelf. Bloomberg and the Israeli press named an investor the release did not.
Reality
PlannerCritic's author tried to inject his own engine. The blocks arrived as feasibility verdicts rather than safety strings, which is a design worth copying and a limit worth reading closely.
Reality
Fortinet says the price was immaterial to its business. For teams budgeting a standalone AI red-teaming and guardrails tool, that is the number that matters.
Reality