AI 安全

模型安全、資安、隱私、供應鏈、紅隊與防護。

Gemini 3.8 Flash Strengthens Long-Horizon Coding Agents, but Migration Requires Sampling and Thinking Parameter Changes

Google has moved Gemini 3.8 Flash into production, offering a 1 million-token context window, three thinking levels, and built-in tools, while making it the default model for Antigravity managed agents. Coding benchmark results have improved, but most figures still come from Google, and the model card also reveals a relative decline in non-English safety evaluations.

2026-09-05

AI 安全

Cloudflare Correlates Code Vulnerabilities With Live Traffic to Generate Patches and WAF Rules Through a Multi-Agent Workflow

Cloudflare’s early-preview service combines source code analysis results with actual routes, traffic, WAF status, and attack events, then uses GPT-5.6 Cyber to validate vulnerabilities and proposed fixes. The model does not directly modify the environment, but data is sent to OpenAI for inference, and Cloudflare has not disclosed false-positive or remediation success rates.

2026-09-05

電腦視覺

Scal3R Fixes Drift in Long-Video 3D Reconstruction With Multi-Reference Pose Queries, Training Only About 1% Additional Parameters

Scal3R retains a frozen CUT3R or STream3R backbone, using lightweight query tokens to estimate relative poses against multiple historical keyframes before passing them to online pose graph optimization. The authors report a mean ATE on KITTI more than 60% lower than the strongest online competitor, but the results use Sim(3) alignment and therefore should not be interpreted as preserving true scale.

2026-09-05

AI 安全

Perplexity Citation Audit Finds Three Affiliated Sites Generated More Than 210,000 Software Ranking Pages

Researchers collected 7,534 citations across 760 Sonar queries, finding that long-tail websites frequently appeared in the retrieval evidence used by recommendation systems. Three sites suspected of sharing the same operator accounted for just 2.4% of all citations, and the study did not establish that these pages actually changed the recommendations.

2026-09-04

AI 安全

Shannon 3.0 Combines Parallel Agentic SAST with Real-World Exploitation, Letting Verified Findings Block CI Directly

The open-source AI penetration testing tool Shannon 3.0 adds multi-stage code analysis, candidate vulnerability reconciliation, and native SARIF support. The new version triggers pipeline gates only for successfully reproduced vulnerabilities, but it can modify the target’s state, and 2.x workspaces cannot be resumed.

2026-09-04

最新模型

GPT-6 Astra Officially Launches as Codex Uses Searchable Past Context to Continue Long-Running Tasks

OpenAI is making Astra available through the API, AWS, and paid ChatGPT plans, while experimenting in Codex with notes and history search that span context windows. The model’s agentic and cybersecurity capabilities have improved significantly, but its chain of thought is better at evading monitoring, and deployment safeguards may also terminate legitimate work.

2026-09-04

AI 安全

GitHub Copilot Expands Content Exclusion Policies to App and CLI, but Symbolic Links and Indirect Semantics May Still Cross Boundaries

Exclusion rules configured by Copilot Business and Enterprise administrators can now prevent the Copilot App and CLI from directly adding specified files to model context. The mechanism is not comprehensive data loss prevention or an execution sandbox; GitHub still lists gaps involving symbolic links, remote file systems, and indirect IDE semantics.

2026-09-03

AI 安全

GitSpawn Bypasses Coding Agent Sandboxes via Malicious `.git/config`; Four Vulnerabilities Remained Unpatched at Disclosure

Multiple CLI coding agents run Git status queries before trust confirmation, allowing executable repository configurations to run on the host with the user’s privileges. The attack does not propagate through a normal `git clone`, but can be triggered by delivering a complete `.git` directory via ZIP archives, synced folders, or USB drives.

2026-09-03

最新模型

Muse Spark 1.3 Reduces Agent Tool Calls, While Its Highest Reasoning Mode Still Awaits Safety Testing

Meta has updated Muse Spark with a focus on long-horizon agents, software development, and task tracking in mixed-topic conversations. Internal comparisons show reductions in both tool calls and token usage. The model is now available in Muse Code and via the API, but its highest reasoning mode, open weights, and fully reproducible evaluations have yet to arrive.

2026-09-03

最新模型

Gemini 3.8 Flash Shifts Toward High-Intensity Agentic Reasoning, While Cyber Version Offers Vulnerability Patching Through a Vetted-Access Program

Google has made Gemini 3.8 Flash generally available for production, offering a one-million-token context window, adjustable reasoning intensity, and new API migration requirements. Built on the same core model, Flash Cyber focuses on vulnerability discovery and automated patching but is available only to vetted defenders through the Fairwind program.

2026-09-02

AI 安全

CrowdStrike SafeMind Uses a Closed-Loop Red-Blue Agent System to Generate and Replay Detection Rules, but Evaluations Remain Vendor-Led

CrowdStrike and NVIDIA have unveiled SafeMind, which uses an offensive agent to generate telemetry and Nemotron defensive agents to write, validate, and replay detection rules. Closed testing indicates that specialized models outperform general-purpose frontier models, but model weights, datasets, and the full evaluation protocol have not yet been released.

2026-09-02

最新模型

RWKV7-G1j Scales an Attention-Free Recurrent Model to 13.3B While Maintaining Fixed State During Long-Sequence Decoding

The RWKV team has released the 13.3B-parameter G1j base model, along with Transformers, LoRA, and TileLang inference support. Its fixed-size recurrent state avoids a KV cache that grows with context length, but the model has no published safety or capability evaluations and should not be treated as a production-ready chat assistant.

2026-09-02