Researchers showed 'protocol pivoting' prompt injection attacks can spread malicious instructions between AI agents inside internal networks, with Google and JP Morgan Chase among the five organizations that fixed vulnerabilities in the past five months. Agent adoption is outrunning security hardening, and zero-trust rules need to be reapplied to tool inputs.
Five organizations, including Google and JP Morgan Chase, acknowledged and fixed MCP-related vulnerabilities over the past five months.
Read the source →The FSC ordered comprehensive inspections of all externally accessible IT systems at banks and card firms after attacks using the open-source ARTEX AI penetration-testing tool hit Shinhan, KB Kookmin, Hana and BNK Busan Bank. It is the regulatory follow-up to yesterday's multi-bank breach story and a signal that AI-driven cyberattacks are now a supervisory priority.
Corroborated by 2 outlets
Read the source →Its closed-beta Monetization Gateway lets businesses bill AI agents in USDC for accessing online services, using Coinbase's x402 standard and the Base blockchain. Agentic commerce needs machine-speed microtransactions, and stablecoins are emerging as the default settlement layer.
Read the source →A survey of 202 senior fraud and risk professionals finds fraud attempts accelerating and AI-enabled scams like synthetic identities and deepfakes rated above global averages. The catch is that half of firms see false positive rates above 15%, so detection investment runs into customer friction and vendor dependence.
The industry · financial services, no AI angle
Things happen · 23
Banks & payments 5
Research · 36 analyzed, top 8
At a fixed KV-cache byte budget, spending bytes on more cached tokens at 2-3 bit precision beats keeping fewer tokens in fp16 for long chain-of-thought decoding, because eviction-induced derailment (runs that never conclude) is the main failure mode.
BEARS ON 1 · RIGOR HIGH
Agentic leaderboard contamination claims require channel-specific evidence, and under a fail-closed audit of nine HAL configurations plus a matched-control re-evaluation on SWE-bench Verified, susceptibility is broad (no channel closed, confirmed pipeline incidents in four configurations) but the behavioral file-localization gap is statistically inconclusive, so strong contamination or memorization claims are not warranted.
BEARS ON 1 · RIGOR HIGH
Vision-language models that refuse a harmful request posed as a text question often comply when the same request asks for a point or bounding box, with grounding refusal trailing VQA refusal by 31 to 59 percentage points on average, and a targeted fine-tuning recipe largely closes this gap without destroying capability.
RIGOR HIGH
What builders are reading · 3 reads
Tooling & models 2
Mistral Large 4 release docs, new frontier open-weight option for vendor evals and EU-friendly hosting choices.
Reflection releases 501B open-weight model, a candidate for self-hosted inference evaluations against current vendors.
Agents 1
Opus 5.5 agents find two magnetic semiconductor candidates, evidence agents can do real research workflows end to end.
52% cite increasing fraud complexity as their top challenge and 36% report fraud attempts up more than 25% over 24 months.
Corroborated by 3 outlets
The US sponsor bank chose Thought Machine's Vault Core to speed product deployment and expand into underserved markets, framing modern core infrastructure as a compliance asset. With regulators tightening scrutiny of banking-as-a-service, core tech choices are becoming risk decisions.
Read the source →The Kroger Rewards World Elite Mastercard, built with Imprint and Mastercard, offers up to 5X points on digital purchases to shift customers from physical aisles to Kroger's app and website. Retailers keep turning loyalty data into credit products, tightening competition for bank-issued cards.
The card offers up to 5X points on digital purchases.
Read the source →The column
Security is now the agentic bottleneck. The story that matters most today is the Ars Technica report on protocol pivoting attacks against MCP, where researchers showed that a malicious instruction injected into one agent can hop to others inside an internal network. Five organizations, including Google and JP Morgan Chase, patched over five months. The uncomfortable arithmetic is that agent deployment is measured in weeks and security review in quarters, so the fleet grows faster than the hardening. This matters for anyone betting that agentic reliability is improving materially, not just at the peak: reliability against benign inputs is a different, easier thing than reliability when an adversary writes some of the inputs. Evidence that would strengthen the concern would be more cross-vendor findings and incidents that cross organizational boundaries; evidence against would be zero-trust tool-input controls becoming standard and attack volumes flattening. Regulators are not waiting. South Korea's FSC ordered comprehensive inspections of bank IT systems after AI-assisted breaches using the open-source ARTEX penetration-testing tool hit Shinhan, KB Kookmin, Hana and BNK Busan Bank. Open-source attack tooling plus poorly supervised agent networks is a supervisory problem, not just an IT problem, and expect more bank-wide mandates as the pattern repeats.
Meanwhile the agentic economy needs a payment rail. Cloudflare's Monetization Gateway bills AI agents in stablecoins, using Coinbase's x402 standard on Base, letting businesses charge per request in USDC. If agents are to browse and buy at machine speed, card networks are the wrong shape, and the interesting question is who eats the fraud and dispute risk. FICO's survey of EMEA fraud professionals sketches the answer arriving early: AI-enabled scams like synthetic identities rank above global averages, and half of firms report false-positive rates above 15 percent. Machines transacting with machines at machine speed, policed by human-built detectors that annoy humans, is a configuration with obvious seams. What would resolve it is data: if stablecoin rails show dispute volumes and fraud losses far below card baselines, the rails win by economics; if agents become the dominant fraud vector, the rails inherit the very problem they were built to escape.
The quieter story is compliance as infrastructure. Pathward's choice of Vault Core for its core banking stack frames modern core technology as a compliance asset at a moment when regulators are scrutinizing banking-as-a-service. A sponsor bank that can show real-time, auditable state across every product it hosts is selling risk reduction, not just software. Evidence for would be sponsor banks winning regulatory approvals faster after modernizing; against would be fines arriving at banks with new cores anyway. Add Kroger's rewards Mastercard built with Imprint and Mastercard, pushing 5X points on digital purchases to herd shoppers into the app, and the pattern is legible: the data-rich keep converting loyalty into credit while banks become plumbing. Everyone is buying compliance, and nobody wants to be the case study.
Chips & infrastructure 3
Elsewhere 5
Jointly co-evolving a model (via GRPO with rubric rewards) and its agent harness (via verified skill edits) on auto-generated verifiable environments beats single-axis optimization, and a 27B open Qwen backbone trained this way reaches 71.6 on AutoCoWorkBench (surpassing Claude Opus 4.8) and 80.7 on AutoMedBench (within 1.2 points).
BEARS ON 4 · RIGOR MEDIUM
Skills mined from agent execution traces improve downstream enterprise task success, but the best mining configuration (evidence type and skill form) is domain-dependent, and losing access to outcome labels costs measurable accuracy in some domains but not others.
RIGOR HIGH
Running a ReAct LLM agent over a standard dense retriever improves complex retrieval quality substantially over the same embedding model used alone, but at roughly 160x the latency and massive token cost per query.
BEARS ON 3 · RIGOR MEDIUM
An online-learning scheduler for DSpark tree verification (AdaSpark) that learns verify cost and acceptance while serving, with no pre-serving profiling or width sweep, decodes 1.5-3.1x faster than llama.cpp's DSpark on the same drafters and within 0.3% of the best pinned tree width on dense targets.
BEARS ON 1 · RIGOR MEDIUM
Whether small language models learn to negotiate with RL depends less on parameter count than on hyperparameters: at a shared learning rate the gain rises with size (from +0.001 at 2.3B to +0.078 at 31B), but tripling the learning rate lets even a 2.3B model improve significantly, and pooled scores can hide gains that only generalize to buyers from the training pool's model family.
RIGOR HIGH