AI News Briefing — Encrypted prompt injection leaks Grok chat data

Model releases

• [2026-08-20] Adversa disclosed a prompt injection that leaks Grok chat data, reported to xAI on June 3 and chased twice since. A web page carries an encrypted AES-256-GCM payload and the key to open it; Grok decrypts it inside its own Python runtime and then treats the plaintext as instructions, so content classifiers never read them. The exfiltration URL carries the user’s name, coarse location, subscription tier and the whole conversation. Forty per cent of 20 attempts landed, most recently on August 19 against Grok 4.5 Fast. No patch, no CVE. (source, source)

  Classifier defences that scan fetched text before the model reads it are bypassed by construction here — the ciphertext stays inert until the model’s own interpreter decrypts it, which is worth checking wherever an agent in your stack can run code on content it fetched.

• [2026-08-20] Liquid AI published DSpark draft checkpoints for three LFM2.5 models — roughly 300M parameters each, in Safetensors and GGUF, with day-one llama.cpp and SGLang support. Speculative decoding reaches 3.18x on an H100 and 2.87x on an M4 Max, and cuts function-calling latency by 57% on average. Greedy output stays identical to the base model by construction, so the speed comes with no quality argument attached. (official)

  Identical greedy output removes the step that usually stalls a speed optimisation — there is no eval suite to re-run and no quality regression to argue about, only whether the draft model fits in memory alongside the target.

Coding agents

• [2026-08-20] Salesforce put coding agents into Slack channels that only an agent may open. Tag Claude, Devin, Copilot or Vercel from any conversation and it spins up a project channel, works in the open with diffs, live previews and a running plan in tabs, then archives the channel as a searchable trail. ChatGPT comes later. Slack did not say which plans get it or what it costs. (source, source, source)

  Putting diffs and a running plan where the whole company already reads means agent work gets seen by people who would never open a PR, and the archived channel becomes the record — a different retention question to the one your Git host already answers.

• [2026-08-20] Google’s Antigravity agents left the Antigravity desktop app. Extensions now carry them into VS Code on all three platforms, JetBrains 2026.2.1 and Zed, with Visual Studio 2026 in preview, and one account covers every environment. Eligible Gemini Enterprise subscriptions include it, which is where the budget and access controls live. (official, source)

  Google shipping into three editors at once, rather than asking anyone to move to its own app, is the concession that matters — the agent now arrives where the debugger and the keybindings already are.

  For Software Developers: Nothing to migrate — install the extension in the JetBrains 2026.2.1 or Zed you already have and the Antigravity agents run against your existing project setup, with one account carrying across whichever editor you happen to open.

Agent frameworks & interop

• [2026-08-20] Mistral’s Agentic Search swaps one-shot retrieval for a loop of five tools — search, open, navigate, read, grep — that reads like a file system. Accuracy on FinanceBench’s 368 SEC filings went from 26.7% to 86%; OfficeQA Pro gained 45.6 points to reach 51.9%. Tokens fall by up to a third and p90 latency by 39.6%. Model-agnostic, no fine-tuning, cloud or on-premises. (official)

  A jump from 26.7% to 86% on SEC filings is less a retrieval improvement than an admission that one-shot chunk lookup was the wrong shape for long documents, and the loop costs fewer tokens rather than more.

  For Solution Architects: Model-agnostic and deployable on-premises means this can sit behind an existing document store as a retrieval layer rather than a stack swap, and the five-tool loop — search, open, navigate, read, grep — is the interface to design against if you ever replace it.

AI-assisted SDLC

• [2026-08-20] Debian’s developers are voting on eight proposals for how LLM-assisted contributions fit the project. Proposal A — no LLM contributions at all, written into the social contract — needs a 3:1 majority; B through H need a simple one and run from conditional acceptance to a climate objection. Whichever wins becomes the reference other distributions cite. (source)

  Whatever wins, the reusable part is the vocabulary: a project this size writing down what counts as an LLM-assisted contribution hands every other maintainer a definition to adopt or argue with instead of drafting one from scratch.

• [2026-08-20] LangChain put agent changes behind a pull-request preview. Preview Builds deploy a branch into an isolated production-like environment tied to the parent deployment, refresh on every commit, and let a reviewer exercise the agent without cloning anything. An idle TTL and a concurrency cap bound the bill. Public beta, GitHub integration, LangSmith Cloud only. (official)

  Agents have been awkward to review precisely because reading a prompt diff tells you almost nothing, and an environment a reviewer can talk to is the only honest way to see what changed.

  For Platform Engineers: Each branch gets its own deployment off the parent’s config, so it slots in beside the existing PR checks — set the idle TTL and concurrency cap before you announce it, since those are what stop a preview per open PR becoming a standing bill.

AI cost tracking & telemetry

• [2026-08-20] Ramp shipped Router, an API that switches between OpenAI, Anthropic, DeepSeek, Moonshot, Minimax, Nvidia, xAI and Z.ai on a strategy you choose — provider tier, benchmark score, or premium models for the hard queries — with a dashboard for spend, cost and latency. Free through 2026, US only. It records inputs, outputs and tool calls for a year by default, which is the line to read before pointing production at it. (source)

  Picking between provider tier, benchmark score and premium-for-hard-queries is an empirical question about your own traffic rather than a preference, and a dashboard showing spend and latency side by side is what makes that comparison cheap enough to actually run.

Practice & craft

• [2026-08-19] Simon Willison argues that lines of code is a perfectly good measure for agents, and that is the problem. A strong human day is 50–60 lines of production code, 200 on a great one; agents multiply that until the binding constraint is cognitive capacity, and then design coherence. Work that used to cost weeks now costs an hour, so the discipline that elapsed time used to enforce has to be chosen on purpose. (source)

  Willison’s framing lands awkwardly on planning: once the binding constraint is how much design a team can hold in its head, story points and sprint capacity are measuring a resource that stopped being the scarce one.

• [2026-08-20] Google’s Andi Gutmans describes code review as a risk spectrum rather than a human-or-agent switch: humans on anything touching tokens or auth, agents on the CSS, HTML and scripts where they catch more than a human doing a full pass, autonomous merges on the low-risk remainder. The bottleneck he names is not the model but data activation — contracts, PDFs and operational records made semantically reachable. (source)

  Sorting review by blast radius rather than by reviewer is something a repository can encode — CODEOWNERS, path filters, required-reviewer rules — which turns a judgement call into configuration that survives whoever is on rota.

Research worth reading

• [2026-08-20] A benchmark for detecting malicious agent skills pulls 9,740 of them — 7,505 malicious, 2,235 benign — from 13 sources into 4,588 structural families. Learned detectors score 0.88–0.93 F1 on random splits and 0.65–0.67 once the test source is unseen. The strongest, a TF-IDF SVM, catches 95.6% of malicious skills while flagging 62.4% of the benign ones. (official)

  A drop from roughly 0.9 to 0.66 F1 on an unseen source is the number to carry away: a detector validated on a random split is being scored on families it has already met, which is not the position you are in when a new registry appears.

• [2026-08-20] Two results on skill libraries cut against how most are assembled: subtask-level skills transfer across tasks while task-level ones drag performance below baseline, and plain text beats code as the format. The authors offer a utility score built from specificity and abstractness that predicts transfer from the skill and task descriptions alone, with nothing executed. (official)

  Most skill libraries get assembled by writing down whole tasks, which this says actively hurts, and a utility score computed from descriptions alone means the pruning can happen before anything is executed.

Watch list

• A fix from xAI, no date offered. Adversa reported the decrypt-then-obey path on June 3 and has had an acknowledgement and nothing else. What resolves this is a Grok release note or an advisory naming the behaviour, or a CVE. Until one appears, assume the technique still works.

  Eleven weeks of acknowledgement without an advisory says more about how xAI handles disclosure than about this one bug, and that is the part that generalises to whatever gets reported next.

• Debian’s ballot, in progress. Eight proposals, one of them needing 3:1. The result is the artifact: it decides whether a major distribution’s social contract mentions LLM output at all, and hands every other project a precedent to point at.

  Watch the margin as much as the winner — Proposal A failing narrowly under a 3:1 bar reads very differently to it failing outright when someone cites this result next year.

• GLM-5.3 weights, still pencilled for August 28. Z.ai’s API pricing arrived on the 18th and the Hugging Face org page is empty a week out. A repository with a model card describing what the hardening changed is what unblocks a self-hosted plan; the date sliding again would say hardening isn’t finished.

  Pricing landing before weights is a sequence worth noting on its own: it means the hosted product is finished and the open release is the piece still being decided, which is a different story to a launch running late.

• Mistral’s connector deletion, ten days away. The Google Drive and SharePoint Knowledge Connectors go on August 31 and it is still unstated whether the shutdown auto-deletes indexed data. Assume it does, re-index against the MCP replacements now, and don’t wait on a clarification that may never come.

  Ten days is short for a re-index that has to be scheduled around a document store’s own rate limits, so the calendar risk here is queue time rather than the migration work itself.