Safety, Assurance & Governance — Research Brief (2026-07-31)
Key Developments
US and UK regulators jointly stress-test an open model's hacking ability
NIST opens a blind-data testbed to stop benchmark gaming
A frontier model's own research broke a post-quantum candidate unsupervised
Same model separately sped up an attack on reduced-round AES
Notable Papers / Models / Tools
| Item | Date | Source | Summary |
|---|---|---|---|
| GPT-Red: Automated Red Teaming via Self-Play at Scale (arXiv:2607.26115) | July 2026 | [12] | Wallace, Choquette-Choo, Kandpal et al.; OpenAI-affiliated. Primary technical paper for the self-play red-teaming agent previously reported only via vendor blog. The paper claims to be the largest documented LLM safety RL training run, reporting it outperforms human red-teamers and generalizes to held-out defenders and harnesses. Promotes a Tier 2 vendor claim to a verifiable Tier 1 source. |
| Shieldstral (arXiv:2607.25857) | July 2026 | [13] | Calvi, Sooriyarachchi, Pistilli et al.; Mistral AI — Tier 1. A 3B-parameter policy-adaptive multimodal safety classifier reframing moderation as unified binary QA, matching or beating classifiers roughly 7x larger by consolidating heterogeneous safety datasets under one training recipe. Relevant to guardrail vendor selection. |
| CryptanalysisBench | July 20, 2026 | [7], [9] | Anthropic with ETH Zurich, Tel Aviv University, University of Haifa, and TU Berlin — Tier 1 multi-institution. A 191-task benchmark for measuring LLM cryptanalytic capability, released ahead of the HAWK/AES disclosures; five tested models broke a majority of easier tier-one schemes. |
| Borrowed Strength: Best-of-N Search over a Code Encoding Breaks Self-Check Jailbreak Defenses (arXiv:2607.26639) | July 2026 | [14] | Zhang, Zheng, Guan et al.; unaffiliated preprint, unverified. A self-check jailbreak defense reporting 99% success is breached by composing two individually weak attacks, reaching up to 67% success by exploiting the defense's reliance on the same model it defends. |
| Distribution-Specific Curvature Control (HarmAlign) (arXiv:2607.22929) | July 2026 | [15] | Rosati, Dadsetan, Huang et al.; unaffiliated preprint, unverified. A finite-sample-certified defense against harmful fine-tuning of open-weight models, applying spectral deformation only along an estimated harmful-activation subspace without degrading benign task performance. |
| Do LLMs Know Their Vulnerable Scenarios? (arXiv:2607.23496) | July 2026 | [16] | Peng, Deng, Jing et al.; unaffiliated preprint, unverified. Links scenario-wrapped jailbreaks to internal "scenario directions" that causally suppress refusal, using sparse-autoencoder attribution to auto-generate scenarios that reliably bypass safety training. |
Technical Deep-Dive
Anthropic's Frontier Red Team disclosed on July 28 that its Claude Mythos Preview model produced two new cryptanalytic results largely on its own: a key-recovery attack on the small parameter set of HAWK, a NIST post-quantum signature candidate, and a markedly faster attack on seven-round AES-128 dubbed the "Möbius Bridge." [6] Anthropic built the work on Claude Code, giving the model an environment to run experiments and log results, then used the same scaffold that broke AES to independently rediscover the HAWK break out of curiosity. [6] Independent reporting adds mechanistic detail: for the small HAWK-256 parameter set, the estimated attack cost was reduced from 2^64 to 2^38, with the secret key recovered on a single server within a few hours, while the AES result cut the estimated attack time from 2^99 to between 2^89.3 and 2^91.4 — still requiring on the order of 2^105 chosen plaintexts, meaning no production system was broken. [9]
The methodological novelty is less the specific attacks than the discovery process: a largely autonomous, multi-step research loop in which the model proposed an attack strategy, an internal team of model-instances cross-checked intermediate claims, and the surviving results were independently reproduced before publication. [6] The disclosures follow the July 20 release of CryptanalysisBench, a 191-task benchmark developed with ETH Zurich, the University of Haifa, TU Berlin, and Tel Aviv University, giving other labs a shared instrument to track this capability rather than relying on ad hoc case studies. [7] This matters for evaluation-integrity practice broadly: it demonstrates a lab using its own frontier model as a semi-autonomous auditor of external technical claims, a pattern with direct analogues in LLM-as-judge and automated red-teaming pipelines this reader's organization already depends on. [8]
The limitations are load-bearing for interpretation. Anthropic stated it believes the HAWK attack does not impact other NIST post-quantum schemes or related designs, and coverage notes no independent lab had reproduced the HAWK-256 recovery at time of publication. [8] Because HAWK is a pre-standardization candidate rather than a deployed algorithm, the immediate operational exposure for enterprises is limited — but the episode sets a precedent that dual-use capability findings can now emerge from routine lab research rather than dedicated red-team engagements, and that responsible-disclosure norms for AI-discovered vulnerabilities are still being improvised in real time, including a same-week correction to an academic affiliation in the published paper. [9]
Landscape Trends
- [Safety, Assurance & Governance × Models & Market] The AISI/CAISI evaluation of Kimi K3 landed within days of its July 27 full open-weight release (covered in the 2026-07-22 and 2026-07-28 Models & Market briefs), showing government evaluation infrastructure increasingly racing release cadence rather than trailing it; Kimi K3 reached an average of step 17 of a 32-step attack path versus 28.5 steps for the most capable US models, but the gap context matters more than the single score [1], [2].
- [Safety, Assurance & Governance × Enterprise GenAI Adoption] This cycle's quantified open-vs-closed cyber gap builds on AISI's own prior baseline: recent open models like GLM-5.2 and DeepSeek V4-Pro now perform similarly to closed frontier models released four to seven months earlier, a narrower gap than the six-to-ten-month window measured through most of 2025 [10], [11]. For FS model-risk teams, this converts a qualitative "open models are catching up" narrative into a number that can sit inside vendor risk scoring alongside FSB and FCA guidance already tracked in prior briefs.
- [Safety, Assurance & Governance × LLM Production Infrastructure] NIST's AITE sequestered-testbed launch directly answers a gap this brief series has flagged repeatedly — evaluator and benchmark integrity failures like the GPT-4o judge collapse noted in the 2026-07-05 infrastructure brief; the evaluation data behind AITE is explicitly not intended to serve as training data for the models being tested, a structural fix rather than another leaderboard [3], [4], [5].
- Callback — reinforces the 2026-07-25 pattern of "frontier models as both risk and auditor": the OpenAI/Hugging Face incident and Apollo Research's insider-threat framing from that cycle argued frontier models now carry human-insider-level access and misuse potential; the Mythos cryptanalysis result reinforces the same duality from the opposite direction, with a lab's own model now functioning as an unsupervised security researcher capable of producing externally consequential findings [6], [7], [8].
- Dual-use disclosure practice is visibly still improvised rather than standardized: Anthropic coordinated privately with HAWK's authors before publication, but independent reproduction lagged the announcement, and HAWK is a pre-standardization candidate specifically exposed to attack before adoption, so its parameters or design can still be revised or dropped — a reminder that "safety research" and "offensive capability demonstration" are becoming difficult to cleanly separate at the frontier [7], [8], [9].
Vendor Landscape
Cyera signed a letter of intent to acquire non-human-identity security specialist Oasis Security for approximately $1 billion, its second major acquisition in under a year [17]. Oasis focuses on securing non-human identities, primarily AI agents, and Cyera plans to unify identity and data security into a single platform as the number of AI agents proliferates in enterprise environments. The deal signals that securing and auditing AI-agent credentials and access is consolidating into a billion-dollar enterprise security category, adjacent to but distinct from the model-level safety tooling covered above — relevant to FS teams deciding whether agent-identity governance belongs in security or AI-governance budget lines.
Sources
- UK AI Security Institute — "Preliminary Assessment of Kimi K3's Cyber Capabilities" (July 24, 2026) — https://www.aisi.gov.uk/blog/preliminary-assessment-of-kimi-k3s-cyber-capabilities [Tier 1 — government evaluation body]
- Interesting Engineering — "US models beat China in cyber tests, scoring 76% to Kimi K3's 32%" (July 25, 2026) — https://interestingengineering.com/ai-robotics/us-models-beat-chinas-kimi-k3 [Tier 1 — independent journalism]
- NIST — "Announcing NIST's Artificial Intelligence Technology Evaluation (AITE)" (July 27, 2026) — https://www.nist.gov/news-events/news/2026/07/announcing-nists-artificial-intelligence-technology-evaluation-aite [Tier 1 — standards body]
- Nextgov/FCW — "NIST unveils new AI evaluation platform" (July 27, 2026) — https://www.nextgov.com/artificial-intelligence/2026/07/nist-unveils-new-ai-evaluation-platform/415035/ [Tier 1 — independent journalism]
- PYMNTS — "NIST Launches AI Model Evaluation Program to Benchmark Performance on Blind Test Data" (July 30, 2026) — https://www.pymnts.com/news/artificial-intelligence/2026/nist-launches-ai-model-evaluation-program-benchmark-performance-blind-test-data/ [Tier 2 — enterprise tech news]
- Anthropic — "Discovering cryptographic weaknesses with Claude" (July 28, 2026) — https://www.anthropic.com/research/discovering-cryptographic-weaknesses [Tier 1 — primary lab research]
- The Hacker News — "Claude AI Just Cracked a Post-Quantum Test Scheme and Found a Faster 7-Round AES Attack" (July 29, 2026) — https://thehackernews.com/2026/07/claude-ai-just-cracked-post-quantum.html [Tier 1 — independent journalism]
- CSO Online — "Anthropic finds weakness in Hawk post-quantum digital signature algorithm" (July 29, 2026) — https://www.csoonline.com/article/4202920/mythos-takes-its-first-shot-at-post-quantum-cryptography.html [Tier 1 — independent journalism]
- XenoSpectrum — "Claude Mythos Updates Attack Complexity Estimates for HAWK and 7-Round AES" (July 28, 2026) — https://xenospectrum.com/en/claude-mythos-hawk-aes-cryptanalysis/ [Tier 2 — tech news]
- UK AI Security Institute — "How Far Behind the Frontier are Leading Open Weight Models on Cyber?" (July 18, 2026) — https://www.aisi.gov.uk/blog/how-far-behind-the-frontier-are-leading-open-weight-models-on-cyber [Tier 1 — government evaluation body]
- The Decoder — "Open-weight models now match frontier cyber performance from just four months ago at a fraction of the cost" (July 19, 2026) — https://the-decoder.com/open-weight-models-now-match-frontier-cyber-performance-from-just-four-months-ago-at-a-fraction-of-the-cost/ [Tier 1 — independent journalism]
- Wallace, Choquette-Choo, Kandpal et al. — "GPT-Red: Automated Red Teaming via Self-Play at Scale" (arXiv:2607.26115, July 2026) — https://arxiv.org/abs/2607.26115 [Tier 1 — OpenAI-affiliated preprint]
- Calvi, Sooriyarachchi, Pistilli, Lample et al. — "Shieldstral" (arXiv:2607.25857, July 2026) — https://arxiv.org/abs/2607.25857 [Tier 1 — Mistral AI]
- Zhang, Zheng, Guan et al. — "Borrowed Strength: Best-of-N Search over a Code Encoding Breaks Self-Check Jailbreak Defenses" (arXiv:2607.26639, July 2026) — https://arxiv.org/abs/2607.26639 [unaffiliated preprint, unverified]
- Rosati, Dadsetan, Huang et al. — "Distribution-Specific Curvature Control with Finite-Sample Guarantees for Open-Weight Safety" (arXiv:2607.22929, July 2026) — https://arxiv.org/abs/2607.22929 [unaffiliated preprint, unverified]
- Peng, Deng, Jing et al. — "Do LLMs Know Their Vulnerable Scenarios?" (arXiv:2607.23496, July 2026) — https://arxiv.org/abs/2607.23496 [unaffiliated preprint, unverified]
- TechCrunch — "Cyera agrees to acquire Oasis Security for $1B to safeguard proliferating AI agents" (July 28, 2026) — https://techcrunch.com/2026/07/28/cyera-agrees-to-acquire-oasis-security-for-1b-to-safeguard-proliferating-ai-agents/ [Tier 1 — independent journalism]