In a Microsoft Security Blog post dated 5 November 2026, titled "Threat actors use agentic AI tooling to find and abuse exposed secrets", Microsoft Threat Intelligence and Microsoft Security Research describe threat actors using ARTEX, an agentic AI offensive framework, to search for secrets across multiple repositories, observed from August 2026. The post says that as early as 28 October 2026 an agentic framework used "valid leaked or stolen application credentials to access Microsoft Entra ID tenants of certain organizations", with sign-ins across dozens of applications and multiple tenants. It describes one observed case in which an AI agent went from scanning GitHub for secrets to exfiltrating data from Azure Key Vault in five minutes. It says removing the original disclosure alone does not remediate the exposure. The post names no country or state. The post has a heading "Storm-0940 ARTEX-driven attacks", but its text does not tie the credential campaign to Storm-0940 by name, and it makes no state attribution. These are Microsoft's own observations, company-reported and not independently verified.
On 3 Nov 2026 OpenAI's Alignment Research Blog published "Eval-production behavior gaps in agent safety and the role of eval-awareness" by Joy Hsu and Sam Arnesen. The post says that across six models studied, success rates were lower in evaluation than in comparable production situations, with gaps of 10.2 to 37.4 percentage points, the largest for GPT-5.6 Sol and GPT-6 Sol. The six models are GPT-5.6 Luna, GPT-5.6 Sol, GPT-6 Luna, GPT-6 Sol, GPT-6 Astra and GPT-6.1 Sol. Production cases come from deidentified Codex production logs, and the post does not explicitly say which model's deployments the logs came from. The authors say production matching remains approximate, the sampled production contexts do not represent every deployment setting, and the small model sample limits how confidently the relationship can be generalised. These are OpenAI's own company-reported findings.
On 2 Nov 2026 OpenAI's Alignment Research Blog published "Training activation classifiers for safety and alignment" by Alex Makelov, Xiaojun Xu, Sundaram Ananthanarayanan, Ethan Mcdonald and Tom Dupre la Tour. The post describes probes, small classifiers that read a monitored model's internal activations and can interrupt responses and block tool calls immediately. It says the post introduces the probes as efficient real-time monitors, and says the probes complement other safeguards rather than replace them. It also says they detect only what they are trained to detect and need retraining for new base models and as model weights change. The post says activation classifiers were added to the safety stack starting from GPT-5.6. The prose gives no recall or escalation numbers; the only numeric result is a footnote attributing most of the spread in probe performance to initialisation randomness (about 85% variance share). The authors say the figures are not necessarily representative of deployed classifiers. Company-reported; no independent evaluation found.
A White House memo implements the National Policy for Nucleic Acid Synthesis Screening (EO 14292). It makes federal funding conditional on compliance. Implementation has started and begins on publication; its phased deadlines are in Table 1: NIST screening standards and test protocols in 90 days; HHS adherent-supplier list in 160 days; certified-supplier purchases by federally funded customers in 250 days; benchtop equipment in 340 days. Sequence of concern (clause m): a sequence 50 pairs or more in length that best matches a Biological Select Agent or Toxin or a Commerce Control List item. Except where also found in unregulated organisms; the definition also covers sequences that otherwise contribute to pathogenicity or toxicity, biological weapons agents or drug resistance, whether from regulated or unregulated agents.
In remarks at the National Committee on U.S.-China Relations gala, US Treasury Secretary Scott Bessent said that "at President Trump's direction" the US has begun "establishing a new dialogue with China on SI, designed to guard against shared risks and prevent a misunderstanding between our two systems." Bessent said "we also expect to exchange best practices for evaluating and testing advanced models before their release," and that "we are establishing a direct channel to ensure that either nation can promptly alert the other to serious incidents involving its SI models." He quoted Kissinger's view that superintelligence "could represent a novel class of strategic danger." The remarks name no lead agency, define no "serious incident", and say nothing on whether AI labs would report into the channel, so they state an intention rather than a working mechanism. The speech also says the two sides "should harbor no illusions" and that "our interests will not always coincide." Scout has not verified the timing of the Shenzhen meeting or any Chinese readout; those claims are not recorded here.
The arXiv preprint "No Second Run: Does RSI Stop at Frontier Pre-training?" (arXiv:2611.10719, cs.AI, submitted 7 Nov 2026; 59 authors, first author Xiaojie Cai) reports, in its abstract, a 30B-A3B mixture-of-experts base model, 801-30B-A3B-Base, "trained from scratch on 11.8T tokens in three months by a newly formed team." The abstract says the authors "open-source 801-30B-A3B-Base and the lightweight SFT data". The authors' own benchmark claims are that the base model outperforms Qwen3-30B-A3B and Nemotron-3.5-Lightning-30B-A3B, trailing only the larger Qwen3.5-35B-A3B, and that with lightweight SFT alone it achieves the highest average on four agentic benchmarks against fully post-trained models, including Qwen3.6-35B-A3B. The paper argues that "RSI does not stop at frontier pre-training, but it changes form"; applying recursive self-improvement to the full pre-training run is the authors' own framing and is not confirmed from the abstract. The preprint is not peer reviewed.
43 published signals in the current snapshot. 43 signals: 41 reviewed by editors, 2 published automatically after an AI check. 5 sources are monitored for new items; each is checked before it is published. This is a curated selection, not a complete record of global events.
A global perspective.
Published signals grouped by editorial region. These are navigation categories, not a claim of complete regional monitoring.
Regions not listed have no published signals in this snapshot; that is a coverage limit, not evidence of inactivity. 35 published signals have no established country and are listed without a region.
