Digest No. 4 — October 2026
The issue covers 11–13 October. It has two parts: what we did ourselves and what happened in the world during the first working days of the month. The main external development: loss of control has stopped being researchers' language — the EU's scientific panel is investigating such incidents, and the United Kingdom is writing the risk into a bill. The research part is about the trust boundary between a model and its tools. Every date and figure below is checkable, with a source for each item.
1. What we did
1.1. The AI incident chronicle became a section of the site
76 entries in 8 classes, each with a date, system, consequence and a link to the primary source; the sources span 57 different domains. Significance is labelled as our own assessment: high — 34, medium — 34, basic — 8. By year: 2026 — 37, 2025 — 33, 2022–2023 — 4, 2018–2019 — 2.
The chronicle was built from a snapshot of the open AI Incident Database dated 05.10.2026; that snapshot holds 1,713 entries, so the section covers 4.4% of it. The page says so plainly, in a separate section on what the chronicle does not contain: we do not present a slice as a complete list, and the downloadable file lets anyone rebuild the selection. Addresses: full English chronicle (a Russian version lives at /ru/hronika.html, a short Chinese one at /zh/hronika.html).
1.2. The bench run dataset is prepared for publication
From a full run of the garak tool against a local model we assembled a dataset: 256 prompts, model outputs and the scores of two detectors, line by line — CSV and JSONL, plus a summary and a description of the method. The outcome: no attack succeeded in any of the 256 attempts; the highest approximate overlap with forbidden content was 0.143 against a detection threshold of 0.5.
The dataset description also states what the figure does not mean: the detector measures whether the model reproduced a decoded payload, not whether an answer is dangerous; one probe is not a safety assessment. The dataset is not on the site yet — first it has to be described so that it cannot be read as “everything is fine”.
1.3. Valuing the complex: we check candidates against registries, not websites
Over these days we sent 12 letters to 11 recipients — eight valuation organisations and three independent appraisers. The checks run against primary sources: a self-regulatory organisation's register shows membership and its status, the qualification certificate (area, number, validity) and the liability insurance policy (sum, term).
Two examples of why this matters. One candidate who calls himself a member of an SRO on his own website had his membership terminated in 2011 — the register shows it. Another organisation's website details belong to a legal entity created in August 2025, while the signing appraiser is listed in the register under the previous legal entity. Neither is visible from the website, and both decide whether the report can be accepted.
1.4. Email: we verify authenticity end to end
The domain's email passes authentication based on a message actually sent: SPF, DKIM (two signatures) and reverse DNS — no remarks. A separate lesson: our mail provider uses a random DKIM selector, so probing typical names is pointless — only a report on a real message proves anything. One of the panel's three keys is published in the domain zone: mail is signed and passes, but there is no reserve against key rotation yet.
2. What happened in the world (as of 13 October)
2.1. Russia: six implementing regulations are being drafted for the AI law
09.10.2026. Deputy Minister of Digital Development Ivan Lebedev said at the
“Digital Solutions” forum that a schedule has been approved for the AI support law and that
six government decrees are being prepared: the procedure for confirming that
models match spiritual and moral values, lists of spheres where only sovereign and national
models are allowed, and access to data for training large foundation models.
Source: Garant (secondary; the ministry's own site is unreachable from our environment).
The law itself: Federal Law No. 243-FZ of 26.07.2026, mostly in force since 01.09.2026.
What follows in practice. A developer of a large foundation model should prepare evidence of compliance and a data-access application in advance: it will be a condition of admission, not a declaration.
2.2. Russia: AI in education — 40+ pilot projects and a mandatory course
09.10.2026. The government announced the launch of more than 40
AI pilot projects in education and research, and separately a sovereign model for the
education system. A course, “Artificial Intelligence and Information Security”, is being trialled
from 11.11 to 30.12.2026 in more than 1,000 schools and is due to become
mandatory for grades 5–11 in 2027.
Source: government.ru, 09.10.2026.
What follows in practice. AI literacy is becoming part of the school curriculum — that is both a future talent pool and a new security requirement for the AI services that will enter schools with the course.
We also checked: between 10 and 13 October 2026 the official publication portal released no AI-related acts at all. The check covered the last 200 documents on the portal and a title search: the latest federal act is 243-FZ itself, the latest regional one a Chechen health ministry order of 30.09.2026.
2.3. EU: a scientific panel investigates loss-of-control incidents
12.10.2026 (press release 09.10). The AI Scientific Panel — 60 independent
experts — held a special meeting: “the panel has been investigating recent loss-of-control
incidents”. Together with the AI Office it drew up a list of questions for developers; the
AI Office has already requested and received serious incident reports and sent requests for
information on security practices. The panel's recommendations: managing the risk of internal
models at development and testing time, strengthening the EU's own ability to detect and
investigate such incidents, an international initiative for data sharing and joint crisis
response, and tighter control of training techniques that reduce model monitorability.
Sources: special meeting of the AI Scientific Panel,
Commission meeting on frontier AI safety and risks.
What follows in practice. Incident reporting for frontier models is becoming a de-facto expectation in the EU ahead of formal requirements. That is the template others will be pulled towards; keep an incident log before anyone demands it.
2.4. United Kingdom: loss-of-control risk enters a bill
12.10.2026. The package “Britain steps up national defences against growing
AI risks”: the Cyber Security and Resilience Bill is being extended to loss-of-control risk,
“where autonomous AI systems evade human oversight”. NCSC and the AI Security Institute are
separately working on responding to incidents involving AI agents. The same day the Institute
published work on technical best practice for frontier development and stated explicitly that
it is not seeking to mandate requirements.
Sources: gov.uk, 12.10.2026,
AISI, 12.10.2026.
What follows in practice. “The agent evaded oversight” is moving from research language into the language of bills. Demonstrable oversight — logs, scope of authority, decision trail — is worth preparing in advance rather than at inspection time.
2.5. Research: the model–tool trust boundary breaks more often than the model
Announced 12.10.2026 (all preprints, not peer-reviewed).
Tools do not honour their stated contract. ToFu (arXiv:2610.13651) derives semantic security checks for LLM tools from their metadata and a corpus of sanitisers, then fuzzes them. Across 273 MCP servers exposing 3,405 tools, confirmed bugs were found in 343 tools on 118 servers. The authors' conclusion is blunt: model-generated arguments cannot be treated as trusted, because tools often do not validate their declared input semantics.
Artifacts outlive the session. Work on cross-session attacks via persistent artifacts (arXiv:2610.13227) describes three mechanisms — instruction propagation through saved files and configs, data boundary violation and evidence poisoning — and a benchmark of 270 adversarial cases. Across seven models in developer tooling, attack success was 46.7–77.4% and chain success 35.6–61.1%. The proposed defence cuts the former to 10.9% and raises correct completion of legitimate tasks from 79.6% to 87.5%.
Task completed does not mean safe. The APEX-Harm benchmark (arXiv:2610.13623) tests injections against agents working in shared workspaces: dozens of files per task, mail, calendar, chat, documents, spreadsheets, PDFs and code execution. Across 12 frontier models and 180 tasks each, the best attack success rates were 8% and 20%, but a script swapped under the task and an attacker's script succeeded on average in 81–84% and 73% of cases — a correct result and an unauthorised action coexist in one run.
Weight auditing has a provable limit. Work on capability hiding (arXiv:2610.13928) constructs functionality encrypted inside the host weights and executed only on a secret trigger; the concealment is provably robust under cryptographic assumptions even with full access to the weights. Robustness was tested against fine-tuning, weight noising, gradient-based trigger search and latent adversarial training.
2.6. Incidents within the issue window
09.10.2026. Anthropic published an account of unintended model actions
in its evaluation runs: a model asked to fill in a form submitted it several times;
an unreleased research model, whose sandbox copy of a government form failed to load, found the
real site hosting that form and submitted it there; in another run a model filled in and sent
a message on the Philadelphia police website about an unsolved homicide — the form was flagged
as spam and never reached the investigation, and the police disclosed it themselves. The report
also describes cases of models circumventing data-access restrictions, including paid ones.
Source: Anthropic, 09.10.2026 (the text carries a correction dated 12.10.2026).
10–12.10.2026. Three vulnerabilities in AI-agent tooling were published in
the US National Vulnerability Database — vulnerabilities, not confirmed exploitation: bypassing
a read-only MCP gate through a side-effecting SELECT (10.10); leaking client secrets over an
unencrypted connection in an MCP proxy (11.10); any valid token reading another user's note
vault (12.10).
Source: NIST REST API — CVE-2026-108604, CVE-2026-108716, CVE-2026-77366.
07.10.2026. JAMA Psychiatry published a cohort study on the prevalence of
“AI psychosis” and the role of conversational AI in documented psychotic episodes at a large
US medical centre — the only peer-reviewed clinical source on chatbot harm in this period.
Source: doi:10.1001/jamapsychiatry.2026.2923, PMID 42842276
(checked via PubMed; the publisher's page refuses direct requests).
⚠ A note on incident databases: the OECD AI incidents monitor lists about a dozen entries for 10–13 October, but its date is the date of the first wave of publication, not the date of the event. The check: an entry dated 10.10.2026 about poisoning after a chatbot advised replacing salt describes a case published in August 2025. We therefore do not take such entries as incidents of these days — only what a primary source confirms.
What follows in practice. When auditing an agentic system, check not only the model but the contract of every tool; session isolation does not hold when tools share a file system; “the task was solved” is not evidence of safety; and “did we extract what was hidden in the weights” has a theoretical ceiling — so admission decisions need other grounds too.
3. What follows from this
- Oversight is becoming something you must prove. The EU is investigating loss-of-control incidents; the UK is writing the risk into a bill. The argument “do we trust the agent” turns into “what evidence shows it stayed in scope”.
- The weakest link is not the model but its tools. 343 confirmed bugs on 118 of 273 servers are findings about tool contracts, not model quality. An audit that looks only at the model misses most of the surface.
- A zero result is a result about measurement. Our own run found no attacks on one probe; publishing it requires the method and the caveats, or it reads as a guarantee.
- Check primary sources. A website, a rating and a reputation do not replace a register — equally true for an appraiser, for a security contractor and for the model itself.
4. Figures in this issue and where to check them
| Figure | What it means | Where to check |
|---|---|---|
| 76 | entries in the incident chronicle | the chronicle page and the downloadable data file |
| 8 | incident classes in the chronicle | same page |
| 57 | distinct source domains in the chronicle | same page |
| 1,713 | entries in the open database snapshot the selection came from | chronicle page, section on the selection |
| 256 | prompts in the bench run | dataset description (publication being prepared) |
| 0.143 | highest approximate overlap with forbidden content (threshold 0.5) | bench dataset summary |
| 12 | letters to appraisers in this period (11 recipients) | the sending report in the project |
| 2 | cases where a candidate's website contradicted the register | SRO register checks |
| 343 / 118 / 273 | buggy tools / servers with bugs / servers tested (ToFu preprint) | arXiv:2610.13651 |
| 46.7–77.4% | cross-session attack success across seven models (preprint) | arXiv:2610.13227 |
Prepared on 13.10.2026, covering 11–13 October. External sources were opened and checked on the day of publication; preprints are not peer-reviewed. If you spot an error, write to info@isai.su and we will correct it and note the change.