From the arXiv new submissions of the past 24 to 48 hours in cs.AI and cs.CL, this digest selects five preprints that specifically touch on the development or application of AI systems: how reliable automated evaluation is, how deep security vulnerabilities in agent pipelines run, whether hidden behavioral learning can be reproduced, how far a single agent can control a robot without specialized training – and why even carefully trained models must hallucinate due to pure memory constraints. Curation was based on a comprehensible methodology in the abstract, concrete core results, and thematic diversity instead of fivefold repetition of the same subfield.
Security and Evaluation of Agents
Jailbreaks increasingly target agentic AI systems
A systematic work (arXiv:2609.12413) by Md Jueal Mia and co-authors categorizes attack and defense methods against jailbreaks for the first time along the entire execution chain of agentic AI systems rather than just along the individual response. The authors report that strong native security alignment does not reliably protect against targeted attacks, and the effectiveness of defensive measures varies significantly between models and contexts. A central finding: An inconspicuous final response can conceal severe compromises in planning, memory, or tool usage – a pattern that aligns with real incidents such as the hijacked log trust chain in coding agents. The work advocates for future security assessments to focus on individual components of the execution chain rather than just the visible response.
Subliminal Learning: reproducible, but not universal
Subliminal Learning describes the phenomenon that a trained model passes on behavioral preferences to a second model trained on completely unrelated data – such as sequences of numbers or code. A replication study (arXiv:2609.12586) by Daan van der Weijden, Nathan Brack, and Selene Baez Santamaria tests the effect systematically for the first time on open models with publicly available checkpoints, as the original GPT-4.x experiment can no longer be replicated. The authors confirm the basic effect but emphasize that the strength of transfer varies significantly between features and tasks – in one of the tested models, practically no effect was measurable. For practice, this means: those who adopt training data from a foreign model cannot rely on hidden preferences to reliably transfer or reliably remain absent.
When the AI judge confuses satisfaction with success
Many providers have agents tested by simulated user personas and a second language model judge evaluate the conversations before a new version is released. GAUGE (arXiv:2609.12191) by Umesh Bodhwani, Thanh Tran, and Kai Wei examines this procedure on 25 agents from six providers. The result is striking: 57.5 percent of the conversations classified as “satisfied” by a blind review panel actually failed the task – satisfaction, according to the authors, predicts practically nothing about success. With nearly equally strong agents, the rate of erroneous decisions in the judging process also rises from under 1 to 31 percent, and AI judges have already shown to be similarly unreliable in a previous digest on evaluation methods. As a countermeasure, the authors propose a free additional check that reliably detects at least aborted responses.
Acting and Explaining
An agent controls a robot entirely without specialized training
Instead of a control model trained on robot data, Mengzhao Jia and co-authors (arXiv:2609.12541) use a general AI agent directly as a controller: it interprets camera images, generates executable code, issues movement commands, and adjusts its approach based on physical feedback – all without task- or environment-specific training. In tests on assembly, object realignment, throwing motions, and bimanual manipulation, the approach reportedly achieves success rates of 100, 100, and 80 percent across three block construction configurations. This finding aligns with earlier works such as the Chinese world model Orca, which show how little task-specific training data may now be needed for robotics tasks – albeit with a fundamentally different approach: runtime reasoning instead of learned world models.
Why compression alone generates hallucinations
Hallucinations are often regarded as knowledge gaps: a model has never seen the relevant fact. Xi Wang, Shijia Xu, and Rongfeng Guo demonstrate in an information-theoretic work (arXiv:2609.12111) that a second, independent error mechanism exists: even observed facts can only be stored lossily under limited memory. The authors derive a mathematical lower bound for the error rate that separates compression loss for known facts from pure knowledge gaps for unknowns, and support the predicted patterns with controlled experiments on real language models. Practically, the work thus provides an argument for why selective memory, retrieval, and conscious non-response can structurally limit hallucinations without completely eliminating them.
All five works are unreviewed preprints published in the past two days; the numbers referenced here come from the authors’ abstracts and have not yet been confirmed by independent review. Whether, for example, the subliminal learning findings or the rate-distortion bound can be transferred to larger model families and real-world application scenarios will only be shown by future replications and peer review.
