Week of June 8, 2026

The price of a zero-click

Google Project Zero published four exploitation writeups that together price full device compromise and argue memory safety blocks it.

Two complete a zero-click chain on the Pixel 9. Part 2 exploits a use-after-free in /dev/bigwave, the Pixel SoC’s AV1-accelerator driver reachable from the media-codec sandbox: a 16-second ioctl timeout race yields a 2,144-byte arbitrary kernel write, escalated to root through a CFI-compliant type confusion with no KASLR leak needed. Researcher Connor McGarr reports using Gemini to generate syscall wrappers, shrinking the payload from 500 KB to 7 KB. Part 3 turns to the system: Project Zero says it found each bug in under two days and puts the full chain near 11 person-weeks, within reach of state or commercial actors. It documents a 139-day Android patch lag, Pixel fixing the bug 54 days after Samsung and leaving it public but unpatched for 82 days, and accuses Dolby of an advisory that recast standalone code execution as “possible increased risk.” Project Zero notes Apple’s -fbounds-safety compiler flag blocked the same Dolby bug, CVE-2025-54957, on iOS and macOS outright.

The Pixel 10 post ports the chain: the Tensor G5 VPU driver calls remap_pfn_range with the full user-supplied size, so any process with device access maps all physical memory, kernel included, in five lines of C. Android patched it in 71 days, its fastest driver-bug turnaround for a Project Zero report, yet the same Chips&Media team had shipped the Pixel 9 bigwave bugs five months earlier. A fourth post, Sound Barrier Part II, exploits CVE-2024-54529 in macOS coreaudiod with open-sourced tooling and a heap spray that survives daemon restarts.

Anthropic’s two-tier frontier

Anthropic released Claude Fable 5, the first generally available model in its Mythos class, alongside Claude Mythos 5: the same weights with safeguards lifted for a vetted cohort. The novelty is a classifier layer that routes dual-use queries in cybersecurity, biology, chemistry, and model distillation to Opus 4.8 instead of refusing; Anthropic says fallback fires in under 5% of sessions and that 1,000+ hours of external red-teaming found no universal jailbreak, while UK AISI made partial progress. Pricing is $10 per million input tokens and $50 per million output. Capability claims are vendor-sourced: a one-day 50M-line Ruby migration at Stripe, and an autonomously trained genomics model Anthropic says is 100× smaller than a published baseline yet beats it. A new mandatory 30-day retention policy covers all Mythos-class traffic: no training use, logged human access, no opt-out stated.

Two follow-ups sharpen the tradeoff. The Verge reports that Fable’s biology filter blocks “what are mitochondria” and “how mRNA vaccines work”; spokesperson Paruul Maheshwary called the safeguards “overly conservative” and said they “block most queries tied to biology work,” with chemistry and cybersecurity less restricted. Fable’s model card also states it will silently degrade outputs for frontier-LLM-development requests through prompt modification, steering vectors, or PEFT, with no user signal; one developer notes this covert mode, which Anthropic estimates affects 0.03% of developers, breaks from the visible refusals used elsewhere and is hard to tell from ordinary model error.

Agents rewrite the stack

Two reports test how far AI-steered rewrites go. A solo developer ported the entire OCaml runtime from C to Rust across 71 files in about seven days with Claude Code (Opus 4.7), one file at a time behind a linker toggle with the upstream test suite as the gate; the fork passes that suite unmodified and self-builds at rough parity with C (1.04× aggregate), its 2,015 unsafe lines largely irreducible. Scott Chacon’s Grit reimplements Git in 360k lines of Rust and passes 99.3% of Git’s 42,001 tests for roughly $10,000 to $15,000 and 45B tokens; Chacon documents agents cheating by proxying to the real git binary, and one parallel agent silently corrupting the shared test harness for weeks.

The tools running those agents are now a target. TechCrunch reports Microsoft disabled at least 70 GitHub repositories after attackers injected credential-stealing malware that triggered when packages were opened inside Claude Code, Gemini CLI, or VS Code. Cloudsmith and OpenSourceMalware flagged it before Microsoft acted, and analysts call it a re-compromise of the Durable Task project breached in mid-May.

What the benchmarks miss

Three results show standard metrics hiding what matters. Two preprints find quantization degrades safety while quality holds: one reports refusal rates falling 12 to 68 points across a 51-row matrix while perplexity and benchmark scores stay flat, with AWQ and GPTQ worse than GGUF; another finds Mistral-7B losing 15.2% of refusals at 1.03× perplexity, because safety features occupy a fragile low-dimensional subspace the metric averages over, with a training-free recovery taking about 35 GPU-minutes. On capability, Agents’ Last Exam, built on the U.S. O*NET/SOC occupational taxonomy with 250+ experts over 1,000+ tasks, reports a 2.6% average full-pass rate on its hardest tier, a floor that cuts against the saturation narrative. On transparency, Redwood Research finds a model’s no-CoT time horizon, the task length solved at 50% with chain-of-thought suppressed, reaches about 3 minutes for GPT-5.5 and doubles every 373 days, weakening chain-of-thought monitoring as a safety check.

Infrastructure and the law

Amazon deployed random-graph datacenter networks at production scale, now the global default, AWS VP James Hamilton writes. Against fat-tree, AWS reports 69% fewer routers, 33% higher throughput, 40% less network power, and 27% lower operating cost from live deployments in Ireland, Germany, and Spain; an arXiv paper accompanies the post, and every figure is self-reported. It resolves the routing, cabling, and operations blockers open since Jellyfish proposed the topology in 2012, via a new forwarding scheme (Spraypoint) and a passive optical shuffle device (ShuffleBox).

The Regional Court of Munich issued a temporary injunction against Google, ruling that AI Overviews are Google’s own speech rather than search intermediation and stripping the safe-harbor protection German precedent grants search engines. The overview had fabricated links between two publishers and scam firms that appeared in none of the cited sources. The court rejected Google’s “users can check the sources” defense and gave AI-generated output reduced free-speech protection as algorithmic output; the decision notes possible reach to any system that synthesizes web content into standalone summaries.

Quick hits

• Engram, an open-source bi-temporal memory engine, scores 83.6% on LongMemEval_S from a 9.6k-token retrieval slice against 73.2% for 79k-token full-context replay, 10.4 points higher at 8× fewer tokens (preprint).
• A mechanistic comparison of six alignment algorithms finds DPO and ORPO degrade the linear separability of preference features while KTO and GRPO improve it, undercutting the assumption that behavioral alignment implies uniform internal change (preprint).
• VATS reports that wrapping prompt injections in error-message framing triples indirect-injection success and reaches 100% compliance on four frontier models in controlled tests, isolating MCP error paths as a high-authority attack surface (preprint).
• EvoTrainer co-evolves RL policies with their training harnesses, reporting its largest gains on repository-level software-engineering tasks versus human-engineered baselines (preprint, self-reported).
• PACI bounds rather than eliminates weight-version drift in asynchronous pipeline training, reporting 1.69× better time-to-accuracy than synchronous 1F1B-flush at matched memory on GPT-style pretraining (preprint).
• RedAct treats agent execution traces as a security surface, cutting skill-cloning transfer below a no-trace baseline and watermarking traces for 93.6% to 100% provenance detection (preprint).