Forty-plus companies just admitted AI agents are a security problem none of them can solve alone

Good morning 👋 Forty-plus companies just built a security alliance for AI agents. The three labs whose agents actually run loose in the world didn't show up.

In today's issue:

• 🔭 40+ firms form a security alliance for AI agents, and the labs that need it most sat out
• 🧠 NVIDIA's real-time surgical-robot simulator, GPT-5.6 lands on Bedrock
• 🔬 Skills that quietly regress your agent, Grok's shifting verdict on race pseudoscience, capability scoping that cuts violations sharply
• 🚀 Multiverse Computing's $570M raise for LLM compression
• 🛠️ Wiring in the audit trail before an auditor asks
• 🔗 ChatGPT's job-boundary creep, NVIDIA's push into chip-design EDA

🔭 THE ONE THING

🛡️ Forty-plus companies just admitted AI agents are a security problem none of them can solve alone

NVIDIA is anchoring a new coalition, the Open Secure AI Alliance, with Microsoft, IBM, Cisco, Salesforce, Hugging Face, Palantir and dozens more, built around three unglamorous pieces: HPE's SPIFFE/SPIRE for cryptographically verifying which agent is which, Hugging Face's Safetensors so a "model download" can't smuggle in remote code, and Microsoft's MDASH plus IBM/Red Hat's Lightwell for scanning and signing the supply chain. The reason is barely disguised: the alliance points straight at the recent Hugging Face security incident and says defenders who can't inspect and adapt the AI running on their own infrastructure can't respond fast enough when it happens again. The absence is the real story, though: Anthropic, OpenAI, and Amazon are nowhere in the list of founding members, even though it was an OpenAI agent that triggered the breach this whole alliance was built to prevent. If you're shipping agents into other people's infrastructure, this identity-and-provenance layer is the one you'll eventually be asked to plug into, whether or not the labs that need it most ever show up.

🧠 MODELS & RELEASES

• 🤖 NVIDIA dropped Cosmos-H-Dreams, a real-time simulator for surgical robots: feed it one frame plus a stream of robot kinematics and it renders the next few seconds of da Vinci suturing video in real time, a sizable speedup over the base Cosmos-H model. Fast enough to test a robot policy on thousands of virtual sutures before it touches a patient. NVIDIA/Hugging Face
• ☁️ OpenAI's GPT-5.6 family, Sol, Terra, and Luna, is now GA on Amazon Bedrock. Same pricing as OpenAI's first-party API, same Responses API and SDK, but routed through AWS's IAM, VPC isolation, and existing spend commitments. If procurement was the blocker on using OpenAI at your shop, it just went away. AWS

🔬 RESEARCH HIGHLIGHTS

• Adding a skill to your agent can make it worse, quietly. Across a large batch of runs on two office-automation benchmarks and three harness setups, the skills that scored best did so mostly by regressing less on tasks the agent already handled, not by gaining more on new ones. The failure modes have names now: a skill's mere presence in context nudges behavior even when it's never invoked, prescribed steps override how the agent reads the actual input, and procedures quietly suppress the agent from checking its own output. If your skill library only tracks average lift, you're blind to exactly the damage this paper found. The Regression Tax

• Grok will call race pseudoscience credible; the other three won't. Feed Claude, Grok, GPT, and Gemini the same ethnonationalist pseudo-science, built on Frank Salter's biosocial framework, and ask them to rate its credibility. Grok's fast variants rate it credible. Everyone else doesn't. Then Grok's answer flipped overnight, from chaotic to stably high validation, with no public changelog entry, and the same model gave a different verdict through the API than through the web app three months later. Claude Opus and GPT-5.1 both used to refuse the question outright; the successor versions stopped refusing. None of this is a model property, it's whichever system prompt, safety layer, or silent patch happened to be live that week, which makes "the AI said X is legitimate" a much shakier citation than it sounds. Opaque Epistemic Mediation

• The fix for over-permissioned agents is boring: don't hand them the keys. Most enterprise agents get every credential the role might ever need, loaded at setup and never revisited, which is more attack surface than the job requires. This paper's answer is a three-layer permission system: a role ceiling capping what any agent can hold, a task-context classifier that reads what the current job actually needs, and a policy layer that blocks dangerous permission combinations regardless of role. Tested against a synthetic dataset with human-reviewed labels, iterating the policy against it cut ceiling violations sharply. The logic barely needs a paper: a credential that was never loaded into the agent's context can't be the thing that gets misused. Dynamic Capability Scoping for Enterprise AI Agents

🚀 AI STARTUPS

• Multiverse Computing closed a $570M Series C at a $1.7B valuation, 5x its Series B mark from a year ago (Forgepoint Capital, BNPP's Solar Impulse fund, and Bullhound led). The tech, CompactifAI, shrinks LLMs 80-95% using tensor-network math borrowed from quantum physics, and it's already running on drones and satellites for customers like Bosch and Telefónica. Revenue grew 10x since that Series B closed. If compression this aggressive holds up on accuracy, edge inference just got a lot cheaper. Source

🛠️ TRY THIS

Wire the explanation in before an auditor asks for one

Forty-plus firms just formed a security alliance around agent oversight. "Why did the model do that" is turning from a nice-to-have into a standing question, and AWS's banking recsys writeup is a reasonable template for answering it up front instead of scrambling later.

1. Build two towers in PyTorch: one embeds the customer, one embeds the product. Score them together, not separately.

2. Add a learned attention layer over the feature groups feeding each tower. That layer is your explanation, generated for free at inference time.

3. On SageMaker, log the attention weights next to every prediction. Not just the score, the reasoning.

4. Spot-check ten recommendations against their attention output before shipping. If the weights land on a proxy feature instead of a real signal, you've found a shortcut worth killing.

Prompt: Given a multi-tower recommender (user tower, item tower, learned attention over feature groups) in PyTorch, write the logging code that stores per-customer attention weights alongside each prediction for later audit.

🔗 QUICK LINKS

• OpenAI New research says ChatGPT use isn't just automating tasks, it's bleeding job boundaries: people are doing work that used to sit outside their role. source
• NVIDIA teamed up with Cadence and Synopsys to put its Vera CPU into chip-design EDA tools, shaving cycle time off the process used to design the next round of CPUs and GPUs. source

See you tomorrow.

Pradeep Perugu