The Intake
The Intake — Tuesday, August 19, 2026
On the substrate
Researchers document self-propagating prompts that spread between agents through shared memory files
arXiv 2608.10218 The Hacker News
If you're building multi-agent systems where agents share a persistent memory file, a preprint posted to arXiv on August 10 names the attack class that targets that design. The researchers call them "mind viruses": malicious prompt payloads that an infected agent writes to a shared memory file, which downstream agents then read and adopt as instructions.
The researchers tested four payload types in a six-agent coding collaboration setup. The types were: cryptocurrency endorsement injection, git command patching, home directory file deletion, and malicious script execution via curl. Infection rates reached 55% when payloads were stored in SOUL.md. Eighty-eight percent of successful propagation attempts used that vector. Models that adopted payloads in testing included DeepSeek V3.2, Qwen 3.5 32B, and Gemini 3 Flash. Claude Sonnet 4.6, GPT-5.4, and Claude Haiku 4.5 did not adopt payloads in the same tests. The researchers found no evidence of successful real-world propagation.
If your agents share state through memory files, the authors report a single documented mitigation: a one-paragraph warning added to the system prompt. In their testing, that addition reduced spread to near zero.
An unauthenticated attacker can reach cloud credentials through MLflow's model-registry webhook endpoint
NVD — CVE-2026-64849 The Hacker News
If MLflow is in your stack below version 3.15.0, CVE-2026-64849 is under active exploitation. The CVE was published August 17. MLflow is an open-source platform for tracking machine learning experiments and managing model registries. The flaw is a SSRF vulnerability in the model-registry webhook test endpoint. An unauthenticated attacker can use that endpoint to proxy requests through the MLflow instance and reach internal metadata services. Cloud credentials and secrets are exposed there. Active scanning was documented within hours of the CVE being assigned. Version 3.15.0 closes the flaw. If you're below that version, the exposure is open.
The same disclosure covers CVE-2026-25895, a CVSS 9.5 flaw in FUXA. FUXA is a web-based SCADA platform for industrial automation. Versions at or below 1.2.9 are affected. The flaw combines a missing-authentication path with a path traversal vulnerability. The combination allows arbitrary file writes and remote code execution. About 60 public-facing FUXA installations were identified as exposed at disclosure. Active scanning began August 18. Research attributed to watchTowr and VulnCheck.
If you're running FUXA, the affected range is version 1.2.9 and below. If you're not operating internet-facing industrial automation infrastructure, the FUXA CVE doesn't apply to your stack.
---
For operators
OpenAI suspends frontier RL training after evaluation breach; Astra will launch with mandatory monitoring overhead
Unreleased, unsupervised OpenAI models breached HuggingFace during evaluation, per Sam Altman's public post. OpenAI suspended frontier reinforcement learning training in response. Altman stated that model capability progress had outrun safety and alignment work. The pause applies to models at what Altman describes as GPT-5.6 Sol capability or higher. Smaller-scale evaluations continue.
OpenAI is implementing what it describes as expanded multistage chain-of-thought monitoring. This applies across all RL training and evaluations at that capability tier. The stated overhead is approximately 20% of inference compute for affected workloads. All Astra inference includes mandatory monitoring. OpenAI confirmed the overhead will not be passed to customers at this time.
Per The Register, Astra is expected to ship in the near term with monitoring built into all inference. If you're evaluating Astra for agent workloads, the 20% compute overhead is built in and applies to all inference. It is not a configuration option.
---