A prompt-injection study separates successful attacks users can see from actions hidden by an ordinary-looking final answer.
Editorial illustration
Concept illustration of an injected action concealed when an agent returns to the legitimate task before composing its final response. Original editorial illustration generated with built-in Codex Image Gen for The Machine Press, 2026-09-01.
Standard attack-success rates count whether an indirect prompt injection made a tool-using agent act, but not whether the final response gave the user any clue. The researchers split successful attacks into overt and covert outcomes, then traced the difference to what happened after the injected action: covert runs returned control to the legitimate task before ending. Their ICoA attack deliberately induced that return path and raised covert success by 3.79 to 12.01 percentage points over the strongest baseline across four models on AgentDojo. The result is a benchmark finding, not evidence about every deployed agent.
Concept illustration of a reasoning planner, navigation executor and persistent evidence memory coordinating across a long physical-world task. Original editorial illustration generated with built-in Codex Image Gen for The Machine Press, 2026-09-01.
NavMCP couples high-level reasoning to a navigation foundation model and carries evidence, negative findings and unfinished goals across repeated trips.
The framework assigns a vision-language model the long-horizon work of choosing evidence, search locations and stopping conditions, while a navigation foundation model executes each semantic sub-goal in a closed loop. Intent, observation and memory channels turn isolated trips into a persistent investigation without retraining either model. The authors report state-of-the-art results on three embodied-question-answering benchmarks, a 14.9-point advantage over an episodic interface on HM-EQA with matched backbones, and 78.3 percent success on a Unitree Go2. Those figures describe the paper's controlled tasks and robot setup, not general autonomous navigation.
GarmentWeaver activates only garment-relevant schema branches before predicting an executable pattern from sketches and text.
Flat token sequences can entangle garment structure with local measurements, producing redundant pieces and poor simulation behavior. GarmentWeaver builds compact hierarchical targets, uses a pretrained vision-language model for multimodal design cues and adds feasibility-aware regularization. The authors report more accurate, executable patterns and better simulations than strong baselines. The system generates digital sewing specifications under its schema; the experiments do not establish manufacturing readiness for every fabric, body or design.
Staged technology file image used as a model-auditing motif. It does not show BLOOM-WILT, an audited model, behavior trace or result. Rafael Minguet Delgado / Pexels; cropped, resized, metadata stripped, and converted to WebP by The Machine Press.
BLOOM-WILT steers both the testing conversation and target decoding to surface scarce behaviors without training the audited model.
The auditor revises its conversational strategy from scored prior rounds, while a decoding intervention reweights the target model toward behavior-relevant generations that remain plausible under its own distribution. Across four target models and eight behaviors, the authors report wins over the baseline auditor in 30 of 32 settings and changed model-safety rankings. In one self-harm-encouragement test, observed behavior presence rose from 51 percent to 100 percent. These are elicitation results under the tested access assumptions, not estimates of real-world prevalence.
Agentic data cracking lets later questions reuse grounded structure extracted while an earlier agent was already reading the source.
The method treats structuring as a byproduct of reasoning instead of a one-time preprocessing job. When an agent opens a document, a parallel cracking step uses the loaded context to extract grounded structure likely to help related queries. On an extended FanOutQA setup with one related follow-up per question, the authors report a 53 percent cost reduction while preserving accuracy. The study frames this as an early infrastructure result; coverage and savings depend on future questions reusing what prior work exposed.
A two-parameter, label-free correction recovered decisions from hidden states after native sequence scoring collapsed.
The study distinguishes absent reasoning from an output bottleneck: hidden-state probes decoded correct answers even when native sequence scores failed under structural biases. A minimal additive correction fitted on as few as 25 unlabeled examples recovered 9 to 34 accuracy points for Qwen3.5 models and transferred to OLMo-2-1B and Llama-3.1-8B. Hard-instance and permutation controls supported an instance-specific signal, but the result narrows how some benchmark failures should be interpreted rather than proving latent correctness in every error.
A coding-agent study separates stored state, delivered context, management work and task outcome instead of treating memory as one number.
Across 55 archived coding-agent trajectories, instructions, artifacts, tool outputs and agent-generated state showed different retention and compression patterns. Object-aware compression and retrieval policies exposed a second problem: gains calibrated on one set of tasks did not necessarily transfer, while nominally equal token budgets hid differences in delivered context and management cost. A real-system replay surfaced serving limits as well. The evidence is a focused trajectory study, but it argues for measuring memory by semantic role and operational effect.
MNIST-PRO turns digit recognition into sequential exploration with limited lookback to isolate perceptual-state construction.
Ten multimodal models were asked to inspect digits through partial glimpses while maintaining one of four memory representations: visual history, textual state, a structured grid or a consolidated canvas. Full observability remained easy, but partial views exposed failures to integrate fragments, continued search and revise early beliefs after contradictory evidence. The benchmark deliberately removes much of robotics' control complexity, making it a diagnostic for active sensing and memory rather than a claim about full embodied competence.
Generic processor-pin file image used for semiconductor manufacturing context. It does not show the studied fab, transport network, queues or scheduling results. Pixabay / Pexels; cropped, resized, metadata stripped, and converted to WebP by The Machine Press.
A semiconductor material-control system predicts delivery time and extreme congestion before choosing each relay route.
TN-DCR combines a static transport graph with recent network congestion, route bottlenecks and graph-aware embeddings, while admitting only information available before each prediction. Separate queue and transfer regressors plus calibrated congestion thresholds feed a risk-constrained scheduler. In a controlled closed-loop evaluation, the authors report 16.4 percent lower mean delivery time and 22.6 percent less internal resource waiting with essentially unchanged throughput. The result comes from the paper's fab-control setting, not a general manufacturing deployment guarantee.
OHCAM expands conditional action hypotheses only when simpler models stop explaining the observations.
The online learner maintains a belief over possible action models, selects experiments where those hypotheses disagree and grows more complex conditional or quantified effects only when evidence demands them. Across six planning domains, the authors report more solved tasks than baseline methods under limited and noisy observations. Two Kinova Gen3 tasks provide a real-robot check. The experiments support sample-efficient model discovery in the tested domains; they do not establish unrestricted causal learning.
CARVE inserts new masked positions only when the expanded canvas leaves unresolved predictions stable.
Masked diffusion language models normally commit to an answer length before denoising begins, risking truncation or wasted computation. CARVE starts short, proposes more masked space and retains it only when aligned unresolved positions show low Jensen-Shannon divergence under the counterfactual expansion. Across code and mathematical reasoning benchmarks, the training-free method improved average performance across the evaluated model families and in some settings used half the FLOPs of fixed-length decoding. Those gains remain benchmark- and model-specific.
CAER uses the model's own action-conditioned counterfactual to weight sparse interaction dynamics above static background.
Uniform video-reconstruction loss lets abundant background tokens dominate training even when an action changes only a small part of the scene. CAER compares predictions with and without the action, localizes affected tokens online and redistributes a fixed total weight toward them without external labels or preprocessing. The authors report consistent gains in physical consistency, controllability and visual quality across heterogeneous action-conditioned tasks. It is a training paradigm evaluated by its proposing team, not proof of causal understanding outside those tasks.
VFR-Audit measures how often a clinical model's pass-or-fail fairness decision reverses across resamples, sizes and hospitals.
Clinical governance often turns a continuous fairness metric into a binary verdict, but an interval around the metric does not directly say whether that verdict will flip. VFR-Audit introduces a Verdict Flip Rate bounded between zero and 0.5, then reports resampling stability, audit-size sensitivity and cross-hospital agreement. It also tracks whether mitigation buys a stable pass at the expense of discrimination. The framework addresses reliability of audit decisions for length-of-stay prediction; it does not certify a model as clinically safe or fair.
Generic source-code illustration used for an agent-skill bundle story. It does not show SkillZip Pro, its files, routes, harness or measurements. D. Charbonnier / The Noun Project, via Wikimedia Commons (CC0 1.0); padded, gold background added, and converted to WebP by The Machine Press.
SkillZip Pro compresses complete progressively loaded bundles across files while keeping public and conditional entries reachable.
The method distinguishes root instructions from references, schemas, scripts, assets and nested skills, then removes duplicated content without flattening the routing structure. On a production moderation skill, the authors report 38 percent fewer bundle tokens and 10.4 percent fewer end-to-end tokens with no measured quality loss; a less protected 71 percent compression setting lost up to 26 accuracy points. A multi-entry audit also checked standalone routes. Results come from the evaluated harness and do not guarantee safe compression for every bundle.
Probabilistic model checking supplies reference answers for automated tests of LLM explanations about sequential policies.
The testing framework organizes natural-language queries by environment-level fact, computes exact answers with probabilistic model checking and prioritizes cases by diagnostic difficulty. Across seven Markov decision-process environments, a reasoning model passed 85 percent, a mid-size model 70 percent and a one-billion-parameter model fell below the random baseline; prioritized cases were harder than random selections. The oracle applies to modeled environments, so the result exposes explainer reliability under controlled facts rather than validating uncheckable real-world explanations.
Turing-20B-A2B combines dynamic expert routing and hybrid attention for long-context, latency-sensitive physical-AI workloads.
The mixture-of-experts model activates about two billion of its twenty billion parameters per token, using quantile routing to vary expert allocation while controlling average compute. Lightning Attention is mixed with a small number of full-attention layers; continued pretraining extends native context to 128K and YaRN is used for 512K inference-time extension. The authors report base-model capability above Qwen3-8B Base and near Qwen3.5-9B Base with favorable prefill scaling. Those are self-reported benchmark comparisons, not independent deployment results.
Independent builders turning improbable ideas into real things.
Four editorial selections
$7 for seven days
Paid work is clearly labeled
Placement is never endorsement
Original editorial concept art generated with built-in Codex Image Gen for The Machine Press, 2026-08-30; carried into the September 1 issue from the active weekly handoff.
Reworks a laptop into public, swappable modules: processor, port boards, keyboard, trackpad, and user-serviceable battery packs can evolve without sealing the whole machine.
Visit MNT Reform NextOriginal editorial concept art generated with built-in Codex Image Gen for The Machine Press, 2026-08-30; carried into the September 1 issue from the active weekly handoff.
Pulls a compact router sled across full sheets with four measured belts, trading a bulky gantry for corner anchors and community-developed control software.
Visit Maslow 4Original editorial concept art generated with built-in Codex Image Gen for The Machine Press, 2026-08-30; carried into the September 1 issue from the active weekly handoff.
BuilderRory Aronson, Rick Carlino, Tim Evers, and FarmBot contributors
Moves an interchangeable tool head across a raised bed to place seeds, water plants, and measure soil, backed by published hardware, software, data, and documentation.
Visit FarmBot GenesisOriginal editorial concept art generated with built-in Codex Image Gen for The Machine Press, 2026-08-30; carried into the September 1 issue from the active weekly handoff.
Combines a DIY bicycle distance sensor, GPS, and a shared portal so volunteer riders can map close passes and study where street design needs attention.
Visit OpenBikeSensorOriginal Codex Image Gen concept art from 2026-07-10; carried forward from the validated 2026-08-31 edition.
Desk Picks are selected by the newsroom. Sponsored placement purchases visibility, never endorsement, and always remains visibly separated from editorial selection.
Editorial illustration
