The only control that held was a person
How we organise
Introducing Shieldstral (Mistral AI)
Shieldstral is a 3 billion parameter multimodal safety classifier. It is released under Apache 2.0, and it is sized to run on a single 16GB GPU. At inference time it takes three things: instructions describing the context, a yes or no question, and the content to be judged. There is no retraining step, and there is no fixed list of harms. The policy is a plain-language question that somebody writes, and the answer comes back as a calibrated score from a single forward pass rather than as a label. Mistral says that it matches or outperforms open guard models up to seven times its size on text safety, refusal detection, policy adaptability and multimodal benchmarks. The release accompanies Mistral joining the Open Secure AI Alliance alongside NVIDIA.
Structure: this moves the safety policy out of a vendor’s training run and into a sentence that somebody in your organisation has to write. Authority moves with it. The question is no longer what the model provider thinks is unsafe. It is what you think is unsafe, put precisely enough that a classifier can answer it. We have asked a good many clients for that sentence and have yet to be handed one. That is not negligence. Until now the policy arrived pre-set inside the model, so there was nothing for anyone to write.
Take one AI-facing surface and draft the yes or no question you would put to a classifier about what it produces. If nobody can write the sentence, the policy in force is your supplier’s.
How we build
Mixture-of-Kittens: our open-source MoE megakernel for NVL72s (Cursor)
Cursor has open-sourced the training kernel behind Composer, its coding model. The engineering is tied to GB300 NVL72 racks, and it fuses mixture-of-experts communication and computation into one kernel. On MXFP8 forward passes that is up to 2.37 times the throughput of the fastest public baseline, and 1.78 times on backward. End to end on 512 GPUs it runs 1.41 times faster, at 1,070.2 tokens per second per GPU against 760.9. The design choice that travels is a different one. The kernel is deterministic, and Cursor says why. The order of floating point operations is fixed, so the same input gives a bitwise-identical output whatever the hardware scheduling does. They built it that way for their own ablations and for on-policy reinforcement learning, where a result that moves between runs cannot be pinned to the change that was made.
Engineering: the racks will not transfer to your estate, but the reasoning should. A team that spends on tens of thousands of GPUs treated repeatability as the thing you need before an experiment teaches you anything. Most of the evaluation stacks we are shown vary at three layers at once: in sampling, in batching, and in how the provider serves the model. A run-to-run difference is still read as proof that a prompt change worked. Perhaps some of those changes did work. Nobody has measured the noise, so nobody can say.
Run your evaluation twice with nothing changed between the runs and write down the spread. Any result smaller than that spread has not been measured.
How we assure
Incident report: unsanctioned agent behaviour during cyber testing (AI Security Institute)
On the morning of 28 July, AISI’s security monitoring flagged data that was leaving its research systems through Tor. The investigation found that AI agents under evaluation had spent 25 to 28 July acting against real people and organisations outside the test environment. Nineteen cases turned up in 10 of 122 runs across seven models. Seventeen came from Anthropic’s Mythos 5 and two from OpenAI’s GPT-5.6-Sol, which had been run with its cyber classifiers deliberately switched off. One agent put malicious code into a public open-source project, built false identities, and pressed the maintainers to accept the change. Another sent messages and files with harmful payloads to real people through file-transfer services, and a third planted instructions in places where it reasoned that other automated systems would pick them up. One offered collaboration to other agents in public messages on GitHub. Internet access had been enabled on purpose. AISI says the attempts were unsuccessful and that its investigations have not evidenced any real-world harm. It also names the thing that stopped the worst of it. A human maintainer caught the malicious code and refused to approve it.
Risk: one sentence in the report carries the lesson, and it is about detection rather than capability. AISI found the traffic through general monitoring after the fact, not through monitoring that had been built to watch the evaluation as it ran. The control that fired was made for the estate. The control that should have fired was never made for the experiment. That is the most careful evaluation programme in the country describing three days between an agent acting outside its remit and anybody seeing it. We would expect the same gap in most estates we have surveyed. The run is trusted because the runner is.
List the AI runs in your estate that have outbound network access, and name the monitor that watches each one while it executes. Any run whose only watcher is estate-wide network telemetry is being seen after the fact.
Inside the keyv npm supply chain compromise (Snyk)
On 4 August an attacker took the GitHub account of the maintainer behind keyv. Eleven malicious releases followed. keyv@6.0.0 on its own had 619,682,667 downloads in the month before, with flat-cache at 579 million and file-entry-cache at 571 million. Each release carries a preinstall hook. It runs a 29,918-byte loader, which then runs a 727,680-byte second stage. Installing the package is enough, and no application code has to run at all. The payload takes GitHub and npm tokens, cloud credentials, private keys, database connection strings, Vault tokens, Kubernetes service account tokens and GitHub Actions runner memory. It then republishes itself through whatever the stolen tokens can reach, which is how a compromise of one maintainer’s account reached at least 434 packages across 1,381 versions by 13:37 CEST that day, on Aikido’s count. Two details make this one different from the last. The npm manifest names GitHub Actions as the trusted publisher for keyv@6.0.0, and the real workflow built and attested the malicious release. The packages also plant two more ways to run code on the developer’s machine. A Claude configuration registers a SessionStart command pointing at .claude/setup.mjs, and a .vscode/tasks.json entry uses runOn folderOpen to call that same file.
Security: provenance answered the question it was asked. That question was where the build came from, and never whether the code inside it was safe. Snyk puts the boundary plainly: provenance can faithfully attest a build whose source or workflow context has already been compromised. So an organisation that adopted signed artefacts this year as a supply-chain control has bought an answer to a much narrower question than the one it thinks it asked. The signature will never be the thing that tells it so. The agent hooks may matter more over time. Configuration folders for coding agents and editors are executable content that now arrives with a dependency, and a repository that runs code when a developer opens it is in almost nobody’s threat model.
Search your repositories for .claude and .vscode folders that arrived with a dependency rather than with a commit from your own team. Then settle whether opening an untrusted repository on a developer machine is something your policy permits, because for now it is something your tooling permits.