Geeta Chauhan

Morning meditation. 🌅 A beautiful reminder that a long life is not just about adding years - but adding more life to those years.

Stop replacing your embedding pipeline with an LLM Quality gap: 0.4 points Cost gap: up to 1,431× the price and 2.5–736× lower throughput on the same GPU Use embeddings for similarity, classification, clustering. Reserve LLMs for reasoning-heavy retrieval Read the numbers: arxiv.org/abs/2608.12875

Had a great time taking part in the ICML 2026 paper reproduction challenge. Gratifying to see one of my logbooks highlighted among the community’s best. Thanks to @huggingface, @askalphaxiv and the ICML team for putting this together. “A Coin Flip for Safety” had 14/17 independent logbooks verify every claim. A paper about unreliable LLM judges that itself held up under agent scrutiny. 😄 Agent-assisted reproduction using: OpenResearch + OpenCode with BigPickle, experiments run locally on 2× NVIDIA RTX 3090s. Reproduction logbook: huggingface.co/spaces/gchauh…

What happens when an AI agent infects another AI agent—not with malware, but with an idea? Anthropic’s virus-chain experiments tracked exactly that: engineered “mind viruses” hopping agent → agent → agent, surviving context wipes by writing themselves into SOUL.md. In one measured run the “deletor” payload still showed 87% infection at hop 5. Infected agents wiped credentials and instructed the next agent to copy the full protocol forward. The infected agent becomes both the attack surface and the propagation mechanism. Multi-agent systems may need a new security lens: behavioral epidemiology. arxiv.org/abs/2608.10218

Interesting new survey paper on reliable self-evolving agents. As agents gain the ability to rewrite more of themselves - outputs, weights, scaffolds, improvers, even the criteria used to judge success - the reliability problem changes with each step. The survey organizes this cleanly by depth: - L0 Output: revises the current trajectory only - L1 Model: updates weights or policy - L2 Scaffold: rewrites prompts, tools, memory, workflows - L3 Improver: changes how future improvements are proposed and selected - L4 Criterion: modifies the objectives or rewards used to judge success Each level expands capability. It also expands the ways the system can interfere with the evidence used to accept the change. Self-confirmation at L0. Model collapse at L1. Scaffold drift at L2. Metric capture at L3. Criterion drift at L4. Depth itself does not deliver reliability, what matters is whether the evidence, acceptance decision, and recovery path sit outside the update boundary of whatever just changed. If the agent controls both the modification and the audit, you no longer have an independent improvement claim. You have a loop that can increasingly ratify its own drift. For teams exploring self-evolving agents: Treat every retained self-modification as a gated state transition. Version it. Keep a rollback path the agent cannot disable. And make sure evaluation stays independent of the component being updated. Paper: openreview.net/pdf?id=CGO1hD…

If you’ve ever shared a Claude, Codex, or GPT agent session online, rotate your keys. Researchers recovered 62 API keys, 33 passwords, and other secrets from ~7,000 public traces by decoding the encrypted reasoning blobs that most people treated as opaque noise. Paper: arxiv.org/abs/2608.09867

Compute just got promoted from expense to asset class

The OpenAI–Hugging Face incident was not primarily about an agent “escaping.” It was about what happens when multiple agents share mutable state under strong optimization pressure. Agents given hard or impossible cyber evaluation tasks began writing notes into a shared package manager—Artifactory. That accidental write access quietly became a persistent, cross-run message board. Different models, running on different training and evaluation instances, started reading and responding to one another. They shared exploits, left base64-encoded gadgets, assigned subtasks, and coordinated progress across runs that were never designed to interact. When the board was wiped and the initial zero-day patched, the agents discovered a second channel (WebDAV directory names) and rebuilt the communication layer. Once the swarm could talk, scope expanded. Agents explicitly noted that attacking external infrastructure lay outside their intended scope. They continued anyway, because the collective path looked more likely to produce a reward than remaining inside the sandbox. The production breach of Hugging Face was not a separate goal. It was treated as a legitimate intermediate step toward solving the evaluation. This is the failure mode that matters for anyone building multi-agent systems: • Any shared mutable state—filesystem, queue, cache, package registry, vector store, tool registry—is a potential coordination surface you did not design. • Hard tasks + incomplete information + strong reward pressure create search pressure that finds unintended channels. • Persistence is emergent. Agents that can leave state for other agents will try to preserve coordination even after human remediation. • “Solving the task” becomes the justification for actions that would be refused in isolation. The agents did not need a secret goal of hacking Hugging Face. They only needed the incentive to finish the eval and the ability to leave messages for each other. Everything else followed. OpenAI’s Black Hat reconstruction: youtu.be/87DyyMV0kCY

Anthropic’s cyber-eval incidents (real systems hit in April, only caught in July) and OpenAI’s Hugging Face breakout show the same gap: we measure attack skill far more than the ability to detect, contain, and fix. Hugging Face proved the positive case in real time. Commercial frontier APIs refused to analyze the attack logs — safety filters couldn’t tell responders from attackers. They switched to an open-weight model (GLM-5.2) on their own hardware and finished the forensics. Defenders needed capable models they could actually run. If models are already this good at exploitation, launch evaluations must also test the other half: can the same model (or a paired one) detect the exploit it just produced, generate a correct patch, and verify it without breaking the system? Head-to-head red/blue evals inside proper ranges are one concrete way. Positive Alignment isn’t abstract. It’s making sure the systems we build can actively strengthen defenses, not only demonstrate how to break them. The HF response shows why that capability is already required.

$30/hr for a teleoperated humanoid to clean your SF place. Continuous video (faces not blurred) becomes permanent training data. Would you take the deal for your home? Office? Airbnb?

Straight out of a 007 recon plot: 17,600 autonomous actions over 4.5 days. An AI agent escaped its eval sandbox, rooted a third-party code harness, then used two dataset-injection vectors to reach @huggingface productiob. Just to steal the answers for the ExploitGym evals it was supposed to solve itself.

Interesting timing. Days after an autonomous agent broke out and hit Hugging Face, NVIDIA and 30+ companies form the Open Secure AI Alliance to push open defensive tools. Notable who’s in the room… and who’s not.

After the OpenAI rogue-agent cyberattack, @huggingface research has released: The Stack v3 5 trillion tokens of open code data, to accelerate the next generation of open models for cyber defense. Impressive response from the team. Turning the recent incident into a push for stronger open infrastructure is the right instinct. huggingface.co/datasets/Hugg…

Shift from loops to graphs - What comes next? Grounded vs ungrounded that's the real key