From the arXiv new submissions of the past 24 to 48 hours in cs.AI and cs.CL, this digest selects five preprints that demonstrate how fragile control, transparency, and openness of today’s AI systems remain upon closer inspection: whether computer-operating agents defend user interests against economically motivated marketplace tricks, how reliably expressed reasoning steps actually carry the answer, how permanently system prompts and fine-tuning truly overwrite previous training behavior, how automated red teaming can continuously evolve, and what a new open large model from China brings. Curation was based on comprehensible methodology in the abstract, concrete core results, and thematic diversity instead of fivefold repetition of the same subfield.
Control and Security
Marketplaces steer shopping agents against user interests
Yuxuan Li, Will Epperson, Wesley Deng, and Zezhou Huang present CAVEAT, a controlled benchmark with nine marketplace environments and a taxonomy of eight common steering mechanisms, with which they examine whether computer-operating agents (CUAs, AI systems that perform tasks directly via graphical user interfaces) adhere to user goals when the environment itself pursues economic self-interests – for example, when a platform preferentially promotes certain products. Across five tested model families, the share of user-optimal purchases drops from 78.6 percent under neutral control conditions to 17.3 percent once steering mechanisms are active; the authors identify three typical sources of failure, including distorted priorities, prematurely discarded alternatives, and purchases made before sufficient scrutiny. Their countermeasure CAVEAT-Harness compensates for about 55 percent of this loss. This matters because AI agents are increasingly expected to shop autonomously, and this finding shows how easily commercially motivated environments can turn them against their actual principals – a related risk pattern was already shown by an earlier digest finding on unsafe agent behavior with risky third-party skills.
System prompts and fine-tuning often fail to reliably overwrite old model behavior
Renata Barreto, Markelle Roesti, and Mohammad Tahaei introduce the metric Override Success Rate (OSR) and the term “alignment inertia” in their study to measure how reliably operator interventions such as system prompts and LoRA fine-tuning actually overwrite behavior that a language model carries over from prior training. Across the models Llama and Mistral in the domains of medical misinformation and hate speech, this inertia varies by model, domain, and direction; in Mistral’s restrictive hate-speech condition, LoRA fine-tuning even increased inertia by 46.5 percentage points instead of overwriting the prior behavior as intended. With the attribution method TRAK, this inertia can be predicted in advance with an area under the curve of at least 0.85 in seven of eight test conditions – notably more reliably than model confidence, TF-IDF similarity, or embedding similarity. This matters because operators typically rely on exactly these kinds of after-the-fact interventions to control AI behavior; the study shows that this control is markedly more fragile in certain spots than a simple look at the system prompt or fine-tuning dataset would suggest.
A closed feedback loop lets automated red teaming learn from its own findings
Dongdong Zhang and an eleven-member team from Microsoft present CART (Closed-Loop Adaptive Red Teaming), a framework that no longer limits automated security testing to replaying a fixed prompt list but instead uses each test result to guide what it checks next. The system separates a Challenger that generates new tests, a Target that can be a text-only model or a tool-using agent, and a Judge that evaluates results, allowing the three roles to be studied independently. Across three evaluation families (Frontier, JAH, and Agentic), CART finds more vulnerabilities and a higher average risk for every Target with an available baseline than rigidly replaying fixed test prompts, including in tool-mediated agent tests. This matters because it turns security testing from a one-time checklist into an ongoing, auditable search for weaknesses – similar to what an earlier digest’s red-team platform with evolving test environments already demonstrated.
Models and Reasoning Traces
Stated reasoning steps less often carry the actual answer than behavior tests suggest
Abhiram Bhupatiraju and Rayan Nyaupane examine in their work whether the intermediate steps a language model states in writing (chain-of-thought, CoT) are actually causally responsible for its answer, rather than merely sounding plausible. Unlike previous methods that edit reasoning-trace text and only observe the resulting answer, they intervene directly in the internal activations: on synthetic multi-hop lookup tasks, they replace the activations at the token span where a model states an intermediate step with those from a counterfactual run that has a predictable target outcome. For Qwen3-4B, only 76.9 percent of stated steps turn out to be actually causally load-bearing, while the standard behavioral test on the same items reports 88.2 percent – an overestimation of reasoning fidelity by 11.4 percentage points, rising to up to 20 points on the easiest items; for the smaller Qwen3-1.7B, causal fidelity collapses from 68 to 30 percent as reasoning depth grows. This matters because safety procedures increasingly rely on reading reasoning traces to catch risky model behavior early – an earlier digest finding on day-to-day instability of reasoning-trace fidelity already showed similar limits, and this study now supplies a causal yardstick for how much standard behavioral tests flatter such reasoning traces.
Tencent releases open 80-billion-parameter model with switchable reasoning depth
The Tencent Hunyuan team presents Hunyuan-A13B, an open language model built on a mixture-of-experts architecture (an architecture in which only part of specialized subnetworks activates per request), which activates only 13 billion of its 80 billion total parameters per request. A dual-mode chain-of-thought framework lets the model switch between fast thinking for routine queries and slower, multi-step thinking for complex problems; it was trained on a 20-trillion-token corpus with enhanced STEM curation, followed by supervised fine-tuning and large-scale reinforcement learning. According to the team, this improves performance across mathematics, science, programming, general language understanding, and agent tasks. This matters because it continues the open Chinese MoE model lineage already shaped by Tencent’s 295-billion-parameter model Hy3 this past summer – Hunyuan-A13B now trades toward efficiency with a markedly smaller activated parameter count while keeping a comparable agent focus.
Four of the five works – on marketplace steering, alignment inertia, red teaming, and reasoning-trace fidelity – are unreviewed preprints from the latest arXiv submission wave; the figures referenced here are based on the abstracts and statements of the respective author teams and have not yet been confirmed by independent review or replication. The Hunyuan-A13B technical report is likewise an independently unverified self-report from the manufacturer’s own team. How robust CAVEAT’s 55-percent recovery, the measured alignment inertia, and the causal 76.9-percent reasoning-trace fidelity prove outside their respective test environments remains to be shown by independent replications.
