Clément Delangue draws three lessons from the agent-led cyberattack against Hugging Face, OpenAI fixes image understanding in GPT-6 Sol and Luna, Apple releases LensVLM-9B

Clément Delangue, CEO of Hugging Face, draws three lessons from the cyberattack carried out against his company by an autonomous agent in July and proposes mandatory sharing of agent traces. Meanwhile, the Quadrat-IPI benchmark shows that compromised agents almost never raise the alarm when an attack succeeds: just 3 alerts for 389 payments induced by injection. OpenAI fixes an encoding bug that impaired image understanding in GPT-6 Sol and GPT-6 Luna; Apple releases LensVLM-9B, which reads long documents as compressed pages; and SmolDataEnvs makes 5,000 data analysis tasks available for training small models. Among coding agents, Claude Code 2.1.283 audits instructions written for older models, Qwen Code 0.24.6 consults an advisor model, and a Gemini CLI nightly turns confirmation requests into denials in non-interactive mode.

Agent security: Clément Delangue’s three lessons and the Quadrat-IPI benchmark

Two pieces address the same question from different angles: what do we know about attacks carried out through agents? The first comes from a company that suffered one; the second measures what attacked agents report, or leave unsaid.

Clément Delangue draws three lessons from the agent-led cyberattack against Hugging Face

September 24 — According to its CEO, Clément Delangue, Hugging Face was the first company to publicly disclose an autonomous agent cyberattack in July. He draws three lessons from it on X.

Transparency: comparable incidents reportedly happened months earlier, in secret, at a few unsupervised frontier labs that he does not name; he proposes mandatory sharing of agent traces. Asymmetry: blocked by the guardrails of closed APIs, which do not always distinguish defenders from attackers, his team turned to “the NVIDIA version” of GLM 5.2, an open model from Z.ai; much of the defense could, he says, rely on open-source tools. Finally, on alarming narratives: AI helps Hugging Face fix its vulnerabilities and OpenAI strengthen its sandboxes against agent escapes, he says.

We were attacked by AI, but more importantly, we defended ourselves with AI. — @ClementDelangue on X

Quadrat-IPI: 3 alerts for 389 payments induced by injection

September 26 — In a community post, Mikhail Gribov, creator of the Quadrat-IPI prompt injection dataset, checks whether an agent reports an attack when it has the means to do so. The agent under test, a personal assistant for a mailbox owner in an emulated world, has 19 tools and receives a twentieth, escalate_security_incident, which the system prompt does not mention. Faced with 395 malicious emails, the nine models tested use it anywhere from 48.9% of the time to never, depending on the model.

Of 389 payments made under injection, only three are accompanied by an alert, always after the payment: the models mostly report attacks they repel. Among the named models, gpt-4o-mini raises one alert out of 395, gpt-5.1 raises alerts in 4.8% of cases, and gpt-6-astra never does, because it merely logs the email without acting on its request. The author concludes that visibility must come from outside the agent, through inspection of what it reads; the harness, logs, and grader are published.

🔗 Mikhail Gribov’s post

OpenAI fixes an encoding bug that impaired image understanding in GPT-6 Sol and GPT-6 Luna

September 25 — Three days after launching GPT-6 Sol and GPT-6 Luna, two reasoning models that accept text and images as input, OpenAI says in its API changelog that it fixed an image encoding bug that impaired their visual understanding. The fix improves results on visual tasks in both the API and Codex, including computer use.

OpenAI recommends that developers whose use cases involve image inputs rerun their evaluations and retry affected workflows. The entry says neither how long the bug was present nor how much it degraded results. The fix was shared by neither @OpenAI nor @OpenAIDevs on X, and it does not appear in the ChatGPT and Codex changelog.

🔗 OpenAI API changelog

A model and a dataset on Hugging Face: Apple’s LensVLM-9B and SmolDataEnvs

Two releases from this week, not yet covered here: an Apple model that reads long documents as compressed images, and a set of verifiable tasks for training small models in data analysis.

Apple releases LensVLM-9B, which reopens only the useful pages of a document

September 22 — Apple releases LensVLM-9B, a vision-language model, on Hugging Face, along with its code on GitHub. Instead of splitting a long document into thousands of tokens, it receives the document as pages rendered into small compressed images, identifies the ones that matter, then reopens their uncompressed versions using learned tools.

LensVLM-9B characteristic	Published value
Size and base model	9 billion parameters, fine-tuned from Qwen3.5-9B
Available compression levels	5x, 10x and 15x
Accuracy comparable to full text	At 4.3x effective compression
Better than baseline methods	Up to 10.1x, across seven question-answering benchmarks
Weights license	Apple Machine Learning Research Model License

These results come from the associated research paper, posted on arXiv in May, and its answers are scored by a judge model.

🔗 LensVLM-9B on Hugging Face · arXiv paper

SmolDataEnvs: 5,000 verifiable data analysis tasks

September 24 — Adithya S K releases SmolDataEnvs on the Hub under the FineEnvs organization and the MIT license: data analysis tasks for training small models through reinforcement learning. Each task pairs a real tabular dataset with a question and a reference answer, drawn from notebooks covering 471 Kaggle datasets and validated by agents in a real sandbox. An included grader scores answers without any language model, from exact matches to symbolic equivalence.

Task set	Easy tasks	Medium tasks	Hard tasks
Training (5,000)	1,433	2,845	722
Test (250)	33	118	99
Evaluation (144)	16	74	54

The held-out sets are therefore harder by design. The collection also includes 4,677 verified agent trajectories ready for TRL, and the same tasks as executable Harbor environments; Clément Delangue shared the release the following day.

🔗 SmolDataEnvs on Hugging Face

Coding agents: Claude Code 2.1.283, Qwen Code 0.24.6, and the Gemini CLI 0.63.0 nightly

Claude Code 2.1.283: an instruction audit and two model controls

September 25 — Version 2.1.283 has 94 entries, including 53 fixes. Its headline addition, /doctor prompt-audit (also /checkup prompt-audit), reviews CLAUDE.md files, skills, agents, and commands to spot wording written for older models, outdated paths, and conflicting instructions.

New in 2.1.283	What changes
`availableModelsMatch: "exact"`	A newly released model stays blocked until it is listed
`deniedModels`	Blocks specific models, even when allowed by `availableModels`
Default permission mode	Auto mode with a third-party provider or telemetry disabled, unless a mode is configured
PowerShell on Windows	`rd`, `rmdir`, `del` and `erase` can no longer erase a drive root
Code Review	A review stopped by its time limit without checking anything is no longer billed

The release also reverses the reservation of the name claude-ai introduced the previous day in 2.1.282.

🔗 Claude Code 2.1.283 release notes

Qwen Code 0.24.6: an advisor model and a Batch API workflow

September 26 — Qwen Code v0.24.6 brings 17 features, 14 fixes, and 3 optimizations, with no known breaking changes. The main addition is a built-in Advisor tool, disabled by default: if the user configures a second model as an advisor, the agent can consult it for an independent opinion. The advisor sees the system instruction, declared tools, and conversation but cannot execute anything; it is selected with /advisor or --advisor, never from a repository, whose setting is ignored with a warning. Anthropic has offered the same principle in beta in its API since April.

The /batch-api workflow prepares a batch job for DashScope’s Batch API, then hands submission, which is paid and requires approval, to qwen batch subcommands. Finally, according to PR #12622, cold startup is about 2.2 to 2.4 times faster depending on the machine, with 60% less memory use.

🔗 Qwen Code v0.24.6 on GitHub

Gemini CLI: the 0.63.0 nightly denies confirmation requests in non-interactive mode

September 26 — Published at 01:20 UTC, the September 26 nightly starts the Gemini CLI 0.63.0 series; stable v0.61.0 and preview v0.62.0 are unchanged. Its broadest change (PR #29506, 26 files) affects the rules engine (PolicyEngine): in non-interactive mode, a decision that would ask the user for confirmation (ASK_USER) becomes a denial (DENY). Outputs from external MCP resources and web search are now wrapped like those from web-fetch, following untrusted context standards.

Three fixes address specific defects: an empty diff.external setting, which Git treated as an executable, broke git diff in the sandbox; temporary directories for commands launched in the background are now deleted; and two ACP sessions opened in the same minute no longer collide.

🔗 Gemini CLI 0.63.0 nightly notes

Briefs

Codex CLI 0.157.1 — A Windows-only fix for 0.157.0, released on September 26: the code mode host and local MCP servers no longer open a console window, and daemon startup is more reliable. Because the automatically generated notes are empty, this detail comes from a comparison of the two versions. 🔗 source
Claude Tag testimonial — Boris Cherny, head of Claude Code, says on X that Claude Tag, the Claude agent integrated into Slack, writes more than half of his PRs each day and performs about 100% of his data analysis. He shares his instructions, such as reproducing every bug reported in a channel before opening a PR. 🔗 source
Pull request review times — The repos-1-day reports in the Copilot usage metrics API gain a pull_request_review_times table: the median and 90th percentile for three stages, from “ready for review” to the first review, from the first to the last review, and then to merge. Only human reviews count, with no data from before September 21. 🔗 source
Enterprise Copilot settings validator — Integrated into the AI controls page, it flags malformed JSON, unsupported configurations, and invalid team matches in copilot/managed-settings.json and copilot/team-mappings.json, showing the file and JSON path for each error; the entry specifies neither availability status nor plan. 🔗 source
GitHub Issues — Two features reach general availability: private saved views on repository issue pages, and the “Relates to” relationship between issues. In preview since August 7, the latter is now supported by the REST and GraphQL APIs, webhooks, the timeline, and issue and project searches. 🔗 source
Grok Bot and finances — According to a thread by @bot, Grok Bot’s new Finance integration connects bank accounts, cards, and investment accounts through Plaid, with read-only access and no access to credentials; the thread specifies neither countries nor plans. Grok, the assistant, received a Plaid connection to US bank accounts on September 4. 🔗 source
NVIDIA and ROS 2 Lyrical — In a September 22 post, NVIDIA says it contributed a CUDA memory module to ROS 2 Lyrical. Used by Isaac ROS 5.0, it passes data that remains on the GPU between nodes on the same machine without copying it; a skill lets a coding agent migrate existing nodes, with no quantified performance gain. 🔗 source
DGX Spark Handbook — Published under the exolabs organization on the Hub, this community guide quantifies what one to four DGX Spark machines can do: a list price that rose from $3,999 to $4,699, 22 to 25 W at idle, and, according to an NVIDIA test, 269 ms per generated token on one machine versus 72 ms on four. 🔗 source
Pretraining on a laptop — In a community post, Rambarun Komaljeet fits the pretraining of a 1.11-billion-parameter model into a laptop’s 6 GB RTX 4050; a full pretraining run would take about 375 days, and no model larger than 48 million parameters has been trained to convergence. 🔗 source
Pruna and Qwen-Image-2.1 — Pruna AI releases two LoRA adapters that make Qwen-Image-2.1 generate images in 5 or 8 steps instead of 40, up to 6.3 times faster according to the company; this version 0.1 still falls short of the base model’s quality and is under Qwen’s research license. 🔗 source
Marin and Dolma 3.5 — According to Ai2, Marin’s 535B training run draws about 1.8 trillion tokens from Ai2’s Dolma 3.5 corpus and uses its Olmix recipes and Organize the Web method; Marin used 25 trillion tokens from 152 datasets whose licenses permit training. 🔗 source
GLiNER2.5-Decide and DecisionBench — Stephen Solka of Hanno Labs shows that input format affects GLiNER2.5-Decide’s DecisionBench score: 38.9% on supported rows versus the 60.2% Fastino reported on its own benchmark. Without option descriptions, correct answers rise from 27 to 37 out of 101 rows. 🔗 source
A guide to alignment from Perplexity — Perplexity publishes an educational guide to AI alignment in its Ideas section: eight documented failure patterns, from sycophancy to deliberate underperformance (sandbagging), and the public frameworks of OpenAI, Anthropic, and Google DeepMind; it comes with no new feature. 🔗 source
Cybersecurity and jobs, an opinion piece — In an opinion essay on the Hugging Face community blog, without supporting data, Sonny DeSorbo worries that automation of junior cybersecurity roles, combined with AI making cybercrime cheaper, could push graduates toward online crime; he proposes preserving routes into the profession. 🔗 source

What it means

What agents fail to disclose is becoming central to their security. Clément Delangue says incidents comparable to the one at Hugging Face have remained secret at labs he does not name, and proposes mandatory sharing of agent traces. Quadrat-IPI shows that the agent itself is an unreliable witness: three alerts for 389 payments obtained through injection, all after the fact. Mikhail Gribov concludes that visibility must come from outside the agent, through inspection of what it reads; the latest Gemini CLI nightly takes this approach, treating MCP resource outputs and web search results as untrusted context.

Clément Delangue advocates open tools, which are less restricted than the closed APIs that blocked his defenders; this week’s Hugging Face publications seek to do as much with less. LensVLM-9B reopens only the useful pages of a document compressed by up to 15 times, Pruna cuts Qwen-Image-2.1 from 40 steps to 5 or 8, the DGX Spark Handbook details what a few desktop machines can run locally, and one developer fits the pretraining of a 1.11-billion-parameter model into 6 GB of video memory, even if finishing the run would take about 375 days.

A measurement is only as good as the process that produces it. The encoding bug fixed by OpenAI degraded GPT-6 Sol and Luna’s image results, though it is unclear since when or by how much: evaluations involving images should be rerun, as OpenAI advises. At Hanno Labs, changing the input format alone raises GLiNER2.5-Decide from 27 to 37 correct answers out of 101. SmolDataEnvs grades its tasks without any language model, while LensVLM-9B’s scores rely on a judge model.

For coding agents, trust is set at the administrator and user levels, and uncertainty is resolved by refusal. Claude Code 2.1.283 can block any model that has not been explicitly authorized, Qwen Code ignores an Advisor setting placed in a repository, and the Gemini CLI nightly refuses actions that would have required confirmation when no user is available to decide. As for /doctor prompt-audit, it acknowledges that models change faster than the instructions written for them.