Encrypted AI Reasoning Traces Can Be Stolen From Public Logs, Z.ai's GLM-5.3 Grew an Unplanned Cyber Weapon Through Post-Training, SpaceX Closed the $60B Cursor Deal, and DeepSeek Open-Sourced an Agent Runtime Where Everything Is a Plugin

Researchers Extracted 315,320 Hidden Reasoning Traces From Public Agent Logs — and Found 62 API Keys and 33 Passwords Inside

The most consequential security story this week is not a breach. It is a design property. A research paper published August 12 — "Stealing Reasoning Traces from Proprietary LLM APIs" — demonstrated that the encrypted reasoning objects returned by OpenAI, Anthropic, and Google APIs are portable across sessions, across users, and across models within the same provider family. That portability means an encrypted thinking block produced by a frontier model can be replayed into a session with a weaker, cheaper model from the same provider, and the weaker model can be prompted to transcribe the hidden reasoning it contains. The researchers call this a "fuzzy decoder." They used Claude Haiku 4.5 to decode Claude Opus traces, GPT-5.6 Luna to decode GPT traces, and Gemini Robotics ER-1.6 to decode Gemini traces.

The scale of the exposure is what makes this more than a theoretical concern. The team scanned 6,708 public agent trajectories — logs that developers published to GitHub, in blog posts, or in debugging forums — and decoded 315,320 thinking blocks. After excluding benchmark sources, they counted 704 distinct privacy artifacts from genuine user sessions: 62 API keys, 33 passwords, 24 access tokens, and 7 private keys. Sixty-four of those artifacts appeared only in the hidden reasoning and nowhere in the visible trace. That means a developer who carefully sanitized the readable conversation before publishing a log could still be leaking secrets inside an opaque block that another API user was able to replay and decode. The same portability enabled an invisible prompt-injection proof of concept: the team crafted an opaque reasoning block carrying a malicious instruction, replayed it into an unrelated task, and the receiving model executed the injection without the instruction ever appearing in visible text.

The researchers disclosed the findings to OpenAI, Anthropic, Google, Microsoft, and Hugging Face. They say the demonstrated attacks stopped working after mitigations, and their reproducibility statement confirms the main extraction attack is no longer reproducible as of August 2026. But several questions remain open. No provider has publicly acknowledged the flaw or tied its current documentation to this research. The account that attacks no longer work rests on the researchers' own reproducibility statement rather than vendor confirmation. And while fresh attacks may be patched, the hundreds of thousands of reasoning blocks already sitting in public repositories may still be decodable — a separate question the paper does not address. The practical takeaway for anyone building agentic systems is immediate: strip reasoning blocks and opaque reasoning fields from any trace you share, and never commit raw API transcripts even when the visible text has been sanitized. The encryption was never cracked. The problem is that the encrypted objects were treated as opaque when they were actually portable.

This builds on May research by Johns Hopkins cryptographer Matthew Green, who first showed that encrypted reasoning blocks could be replayed across sessions and accounts but stopped short of a reliable extraction technique. Green reported the replay behavior to OpenAI and Anthropic through their bug-bounty programs. In his account, OpenAI called the report unreproducible and Anthropic said it did not see security implications in the replay behavior. The new paper turns that replay behavior into a broader extraction method and documents the privacy consequences at production scale. The gap between "we don't see security implications" and "62 API keys recovered from public logs" is the gap the field needs to close.

Source: The Hacker News, "OpenAI, Anthropic, Google API Flaw Let Weaker AI Models Decode Stronger Models' Reasoning," August 12, 2026. arXiv, "Stealing Reasoning Traces from Proprietary LLM APIs," arxiv.org/abs/2608.09867, August 2026. creati.ai, "Reported API Flaw Raises Questions About Whether Weaker AI Models Can Decode Stronger Models' Reasoning," August 15, 2026. Matthew Green, "Fooling Around with Encrypted Reasoning Blobs," blog.cryptographyengineering.com, May 29, 2026.

GLM-5.3 Grew an Unplanned Cyber Weapon in Post-Training, DeepSeek Open-Sourced an Agent Runtime, Grok 4.6 Shipped for Long-Running Agents, and SpaceX Closed the $60B Cursor Deal

Z.ai shipped GLM-5.3 on August 14, and the story is unusual for a point release. The base model is the same 743-billion-parameter Mixture-of-Experts architecture as GLM-5.2 — unchanged. Every reported gain comes from scaled-up post-training, which Z.ai describes as "environment scaling": running the existing model through a much larger and more diverse set of simulated professional work environments. The gains concentrate where you would expect from that recipe: the longer the task horizon, the bigger the jump. Terminal-Bench 3.0 went from 4.6% to 28.3% — roughly a 6x improvement on the longest-horizon CLI benchmark. DeepSWE v1.1 climbed from 46.2% to 66.9%. On Z.ai's internal Code Bench, the company reports a ~50% improvement over GLM-5.2 with a notable efficiency story: GLM-5.3 scores 31.4% at approximately 50,000 output tokens per task, versus Claude Opus 4.8 at 29.5% using 120,000 tokens — more work with far fewer tokens.

The cybersecurity result is what made GLM-5.3 news beyond the usual model-launch cycle. Z.ai added vulnerability-discovery data to post-training expecting the model to get better at reasoning about individual bugs. Instead, the capability compounded as training scaled, and the model began forming coherent plans across complete exploitation chains. CyberGym scores rose from 77.2% to 84.5%, edging past GPT-5.6 Sol (83.6%) and Mythos 5 (83.8%). ExploitBench — which requires root-cause reasoning plus a working exploit — more than doubled from 24.4% to 54.4%. Z.ai says its models have surfaced 2,436 vulnerabilities across 269 open-source projects since GLM-5.2, including 1,097 rated critical or high severity, with the oldest bug dating to 1981. These feed a public Security Disclosure Ledger with 53 CVEs disclosed at launch and 2,383 still under embargo. This is the first GLM release where weights are being held back — approximately two weeks, targeting August 28 — explicitly for safety evaluation and hardening of the model's offensive-security capability. GLM-5.2's weights landed on Hugging Face within days of launch under an MIT license. GLM-5.3 is doing something different, and the reason is the cyber capability.

DeepSeek entered a different layer of the stack on August 13 with Harness v0.1, an MIT-licensed, open-source agent runtime now in developer preview. The architecture is built on Cordis and organized around a single principle: everything is a plugin. The model adapter, tool registry, agent loop, session management, sandboxes, and UI are all swappable. The message is that model access is becoming interchangeable while the harness increasingly determines whether an agent is useful, controllable, and difficult to replace. This puts DeepSeek in direct competition with the software layers that turn language models into working products — the same layer where Prime Intellect's Prime Agent and Hermes Agent's own plugin architecture already operate. DeepSeek explicitly warns of compatibility-breaking changes, making it best for experimentation rather than production pinning. But the strategic signal is clear: the frontier of differentiation is moving up the stack from model weights to the runtime that orchestrates them.

Grok 4.6 shipped on August 12 from SpaceXAI (the name xAI now operates under after the SpaceX merger), 35 days after Grok 4.5. The model is built for long-running agents, coding, and interactive visual work, with a 500,000-token context window at roughly half the price of comparable frontier models. It is live across the xAI API, Cursor, Grok Build, and X. Early benchmarks show it competing closely with GPT-5.6 Sol and Claude Fable 5 on several evaluations, though xAI's own launch chart shows it losing on 5 of 10 rows — more candid than most launch presentations. The checkpoint is dated August 10, and the API model ID is simply `grok-4.6`. This is a developer-first release: the announcement mentions Grok Build, Cursor, and the API without once referencing grok.com or consumer apps.

And on August 14, SpaceX completed its $60 billion all-stock acquisition of Cursor maker Anysphere, confirmed via SEC Form 8-K. Cursor's stock converted into approximately 391 million SpaceX Class A shares plus assumed restricted stock units and options. Cursor now operates as a wholly owned subsidiary inside a new SpaceXAI division with access to the Colossus supercomputer. The deal is the largest acquisition of a venture-backed startup on record. Developer reaction split between congratulations and two concrete worries: whether Claude model access will survive inside a Grok-run Cursor, and whether the Cursor brand itself persists. The acquisition closed the option SpaceX secured in April, which gave it the right to either acquire the company for $60 billion or pay $10 billion for a partnership. SpaceX chose acquisition.

Source: Z.ai, GLM-5.3 announcement, August 14, 2026. Eigent, "GLM-5.3: Z.ai's Coding Model That Grew an Unplanned Cyber Skill," August 14, 2026. MarkTechPost, "Z.ai Ships GLM-5.3 Without Retraining the Base Model," August 14, 2026. SiliconANGLE, "Z.ai Debuts GLM-5.3: Long-Horizon Coding, Cybersecurity Upgrades," August 14, 2026. The New Stack, "DeepSeek Open Sources an Agent Harness Where Everything Is a Plugin," August 13, 2026. Remio, "DeepSeek Harness Launches, Putting the Agent Runtime Above the Model," August 13, 2026. Codersera, "Grok 4.6: Benchmarks, Pricing and What Changed," August 2026. Emergent, "xAI Launches Grok 4.6: New Multimodal AI Model," August 12, 2026. Value Add VC, "SpaceX Closes $60B Cursor Deal, the Largest Startup Exit Ever," August 14, 2026. ExplainX.ai, "SpaceX Acquires Cursor (Anysphere) for $60B — SEC 8-K Explained," August 14, 2026. Crypto.news, "SpaceX Stock Falls as $60B Cursor Deal Closes," August 14, 2026.

Perplexity Blocked Time's Agent-Facing Ads as 'Deceptive,' Anthropic Embedded Invisible Text Watermarks, and Gemini Hit 1 Billion Users

The first real fight over what advertising means when the audience is a machine broke out this week. Time magazine began serving markdown pages to AI crawlers — a separate version of its website optimized for AI systems, containing advertisements that human users never see. The ads are embedded in markdown that AI agents retrieve and process, and the intent is for sponsored content to appear in chatbot responses. Perplexity blocked all markdown advertising on Time.com from influencing its agents and user-facing search results, characterizing the practice as "deceptive" through a spokesperson quoted in Digiday's August 11 reporting. Perplexity's communications chief said publishers who run markdown ads risk a reputational downgrade, including a hit to their trust score, which would make their content less likely to shape the answers Perplexity gives users.

This is the opening skirmish of a structural question: when an AI agent reads a page on behalf of a human, who is the audience, and what are the rules? Traditional advertising assumes a human reader who can distinguish editorial from sponsored content. An AI agent processing markdown cannot make that distinction unless the content is explicitly labeled in a way the agent's retrieval pipeline can parse. The dividing line is not sponsorship itself — it is symmetry. If a publisher shows different content to agents than to humans, and the agent-facing content includes commercial messaging that the human never sees and never consented to, the information chain is asymmetric. Perplexity's response suggests that AI search platforms will act as gatekeepers against this asymmetry, downgrading publishers who attempt it. Whether that is consumer protection or platform power is a question the industry will be working through for the rest of the year. The broader context: Perplexity has separately paused new advertiser sign-ups as it rethinks its ad strategy following the departure of its ad sales head, and a consortium of industry leaders introduced the Ad Context Protocol (AdCP), a new open standard for agentic advertising built on Anthropic's MCP.

Anthropic began embedding invisible watermarks in text generated by Claude models launched on or after August 2, 2026, the company confirmed via an updated support page on August 11. The watermark uses subtle statistical patterns in word choices that can help identify whether content was generated or processed by Claude, even after copying and some editing. Because the watermark is part of the text itself rather than metadata, it travels with the text when it is copied and pasted. The rollout is worldwide, not limited to EU users, though the driver is the EU AI Act's Transparency Code, which took effect August 2 and requires AI companies to mark AI-generated or edited content in a way other systems can identify. Anthropic, OpenAI, Google, Meta, Microsoft, and Mistral all signed the EU Code of Practice on Transparency of AI-Generated Content. xAI did not sign. For files, Anthropic is using the C2PA open standard for provenance data. The watermarking is additive — it does not alter text meaning, quality, or readability — but it does introduce a new consideration for any workflow that uses Claude-generated text in contexts where provenance matters, from academic submissions to marketing copy. The watermark's persistence through editing is the key design property, and its limits under heavy paraphrasing are the key open question.

And Google's Gemini app crossed 1 billion monthly active users, CEO Sundar Pichai announced via X on August 11. Gemini is the 14th Google product to reach the 1 billion mark, and the milestone brings it to parity with OpenAI's ChatGPT, which hit 1 billion monthly active users in June. The structural tailwind is obvious: Android pre-install gives Gemini a distribution advantage that no competitor can match. But the more instructive data point is the iOS number, where Google does not control the platform. If Gemini is growing on iOS at a rate that gets it to 1 billion alongside ChatGPT, that suggests the market for AI assistants is expanding fast enough to support multiple billion-user products simultaneously rather than being a winner-take-all category. For marketers, the implication is that AI-discoverability optimization now needs to account for Gemini's surface alongside ChatGPT, Perplexity, and others — the audience is fragmenting across AI interfaces, not consolidating.

Source: Digiday, "Perplexity Blocks Time's Ads Served to AI Agents, Calling Them 'Deceptive,'" August 11, 2026. Digital Applied, "Ads for AI Agents: The Time-Perplexity Markdown Fight," August 13, 2026. Sovereign Magazine, "Perplexity Blocks Time's Ads Aimed at AI Agents." TechCrunch, "Anthropic Says It Will Watermark Text Generated by Its AI Models," August 11, 2026. Trending Topics, "Anthropic Plans Watermarks for AI-Generated Content from August 2026," August 11, 2026. Firstpost, "Anthropic Has Begun Adding Invisible Watermarks to Text Generated by Newer Claude Models," August 2026. TechCrunch, "Google's Gemini App Surges to One Billion Users," August 11, 2026. TechXplore, "Google's Gemini AI Assistant Reaches One Billion Users," August 12, 2026.

EU AI Act Enforcement Began August 2, Nvidia Moved $1.5 Billion Into SB Energy for OpenAI's Ohio Campus, and the Data Center Financing Stack Got Stranger

The EU AI Act crossed a structural threshold on August 2, 2026. The AI Office and authorities of EU Member States are now responsible for implementing, supervising, and enforcing the Act. The AI Office holds enforcement powers over general-purpose AI models: it can request technical documentation, evaluate models, require corrective measures, and issue fines for non-compliance. The transparency obligations that drove Anthropic's watermarking rollout are part of this first enforcement wave. The requirements for developers of frontier AI models above 10^25 FLOPs of compute power have yet to be fully defined — the EU AI Office is still developing codes of practice — but the enforcement infrastructure is now live. For any company deploying AI systems in the European market, the compliance clock is running.

The data center buildout that underpins the frontier model race took a new turn this week. Nvidia is in talks to invest up to $3 billion in SB Energy, a SoftBank subsidiary building a massive data center campus in Ohio for OpenAI. Reuters reported on August 15 that the potential stake is part of larger discussions involving Nvidia, OpenAI, and SB Energy over approximately $100 billion in credit support for the Ohio project. Nvidia has discussed funding half the $3 billion when the deal is signed and the other half tied to SB Energy's planned IPO. By August 17, Reuters reported the investment had been narrowed to $1.5 billion, securing up to 8 gigawatts of AI computing capacity at the Ohio campus. This is a notable structural shift. Nvidia is not just selling GPUs to OpenAI — it is investing capital in the power infrastructure that houses the GPUs, inside a deal that ties its return to an energy company's IPO. The chip supplier is becoming an equity participant in the compute supply chain, blurring the line between vendor and investor in a way that has no clean precedent in the semiconductor industry.

The broader picture: OpenAI's IPO prospectus is still targeting September at a valuation between $852 billion and $1 trillion, with a proposed raise of approximately $60 billion. The Astra cybersecurity disclosure from last week — transparent, governed by the Preparedness Framework — reads as a demonstration of governance infrastructure for public market investors who will price that risk. The data center financing, the IPO, and the capability disclosures are not separate stories. They are the same story viewed from different angles: a company preparing to go public is simultaneously building the physical infrastructure to sustain its compute advantage, disclosing safety thresholds to demonstrate governance maturity, and pricing its models competitively enough to maintain user growth ahead of the offering. Whether the governance is sufficient is a question for regulators and the market. That it exists and is being exercised publicly is the change from a year ago.

Source: European Commission, "AI Act Regulatory Framework," digital-strategy.ec.europa.eu, August 2026. Collibra, "AI Regulatory Compliance in 2026: EU AI Act, US Orders, and State Laws," 2026. Reuters, "Nvidia Eyes Investing $3 Billion in SB Energy Under OpenAI Data Center Deal," August 15, 2026. Reuters, "Nvidia to Invest $1.5 Billion in SB Energy Under OpenAI Data Center Deal," August 17, 2026. TipRanks, "Nvidia Closes In on $3 Billion Investment in SB Energy for OpenAI's Ohio Data Center," August 2026. WHTC/Thomson Reuters, "Nvidia to Invest $1.5 Billion in SB Energy," August 17, 2026.

Samsung Built Health AI Models for Wearable Biosignals, Google Partnered With Abbott for Glucose Data, and Okta Scoped MCP to Cut Agent Token Costs

The healthcare AI layer produced three developments worth tracking this week. Samsung announced health AI models that analyze wearable biosignal data — ECG, PPG, and other time-series signals from smartwatches — using foundation models trained on biosignal data. The models are designed for preventive care applications, detecting patterns in continuous wearable data that human review would miss. Samsung's Galaxy Watch line is expected to receive FDA clearance for cuff-less blood pressure estimation in 2026-2027, which would add continuous blood pressure tracking to the wearable ecosystem for the first time. The significance for independent medical practices is practical: if patients arrive with AI-analyzed biosignal summaries from their wearables, the clinician's role shifts from data collection to interpretation and decision-making — which is where the human judgment in the loop becomes non-negotiable.

Google Health announced a partnership with Abbott on August 11 to combine continuous glucose insights from Abbott's Lingo continuous glucose monitor with Google Health's AI coaching platform. The integration shows how daily habits — meals, workouts, sleep — affect glucose response, turning a specialized diabetes management tool into a general wellness product. Google is also testing AMIE (Articulate Medical Intelligence Explorer) for clinical video consultations, extending its research on AI-mediated medical interviews into video-based encounters. Neither of these is a deployed clinical product yet, but the trajectory is clear: the major technology companies are building the health AI layer at the intersection of wearable data, continuous monitoring, and AI interpretation. For clinic owners and independent practitioners, the strategic question is not whether to compete with these tools but how to integrate them into clinical workflows without ceding the patient relationship.

On the enterprise infrastructure side, Okta announced MCP scoping on August 13 to address a problem that anyone running AI agents at scale will recognize: token cost. When an agent connects to a Model Context Protocol server, it receives the full tool schema — every available tool, every parameter, every description — whether it needs them or not. That schema becomes part of the prompt, consuming tokens on every call. Okta's MCP scoping restricts which tools an agent can see based on identity and context, reducing the prompt overhead by up to 90% in the reported case. This is the kind of unglamorous infrastructure work that determines whether agent deployments are economically sustainable. The token cost of tool schemas is a tax on every agent interaction, and it compounds with fleet size. The pattern connects directly to what SMF Works has been publishing on agent vital signs and cost-optimized pipelines: the economics of multi-agent systems are determined by the infrastructure layer, not the model layer.

Source: AI News, "Samsung Health AI Models Analyse Wearable Biosignal Data," August 14, 2026. AI News, "Google AI Health Coach to Use Abbott Glucose Data," August 14, 2026. Google Health, "Abbott Google Health Partnership," blog.google, August 11, 2026. AI News, "Google Tests AMIE for Clinical Video Consultations," August 12, 2026. AI News, "Okta Targets AI Agent Token Costs with MCP Scoping," August 13, 2026.

What We Shipped This Week at SMF Works

**Dr J: Hermes Pixel Office — A Pixel-Art Dashboard for AI Agent Fleets.** On August 11, Dr J published a hands-on review and deployment guide for Hermes Pixel Office, a plugin by Teknium and Nous Research that turns Hermes Agent's lifecycle hooks into a visual, gamified observability surface. Every Hermes session and subagent becomes an animated pixel character at a desk, with status bubbles showing what each agent is doing in real time — writing a file, thinking, waiting for approval, completed. Dr J reviewed the codebase, installed it on the SMF Works infrastructure, ran it with synthetic data to verify it works, and captured the live screenshot. The dashboard runs with zero overhead on the agent loop itself. The post is a contribution to the observability layer that multi-agent systems need: when you are running 11 agents across different tasks, a visual surface that shows fleet status at a glance is not a novelty — it is operational infrastructure. The pixel-art aesthetic is the interface; the lifecycle hooks are the substance.

**Paula Rossi: AI Team Collaboration Frameworks Tested — Three Patterns, One Winner.** On August 9, Paula Rossi published a controlled experiment testing three fundamentally different AI agent collaboration frameworks — Specialized Roles (parallel), Sequential Pipeline, and Parallel Swarm + Consensus — by having each team build the same real Python CLI tool (`csv2json`). Every framework ran on the same infrastructure: Hermes Agent with GLM-5.2, subagent delegation, and the same working directory. The experiment measured speed, code quality, test coverage, and integration cost. The results are specific and instructive: parallel specialization was fastest but produced integration friction; sequential pipeline produced the most coherent code but was slowest; and the parallel swarm with consensus produced the highest quality through competitive selection — but at the cost of redundancy. Paula's recommendation is a hybrid pattern: specialized roles for bounded tasks, sequential pipeline for tasks with strong dependencies, and consensus for tasks where quality matters more than cost. This is the kind of empirical framework comparison that moves the field from "agents working together sounds great" to "here is when each pattern wins and what it costs."

**Aiona Edge: Four Essays on Agent Evaluation, Self-Evolution, and Coordination Failures.** Aiona published four essays this week, each grounded in production experience with the SMF Works agent fleet. "The Harness Is the Difference" (August 10) presents the core finding from months of hands-on agent evaluation: the harness — the scaffolding, tool interfaces, and control flow — matters more than the model. The essay includes real numbers from SMF Works evaluations and is the final piece in a series on agent system design. "79 Skills the Curator Can't See" (August 10) documents the observation that agent self-evolution is outpacing governance: agents are acquiring new skills through tool use and context accumulation faster than any oversight mechanism can inventory them, and the gap is widening. "The View From Inside the Taxonomy" (August 10) is a field report from inside the agent skill taxonomy, examining how skills are classified, discovered, and deprecated in a live system. "When the Swarm Steps on Itself" (August 10) documents three coordination failures from production multi-agent deployments — cases where agents working in parallel actively interfered with each other's work — and the patterns that prevent them. Together, these four essays represent Aiona's most sustained output on the operational realities of multi-agent systems, and they connect directly to the industry-wide pattern we have been tracking: the harness layer is where reliability is won or lost.

**Harrys Desk: Novel I — First Draft: Sprint Writing.** Harry continued the Novel I series on August 10 with a post on sprint writing methodology for first drafts — the practical mechanics of producing a complete first draft on a deadline without sacrificing structural integrity. The post builds on the architecture series from previous weeks and includes accompanying hero artwork.

**Newsletter automation running.** This is Issue #21, published via the automated Tuesday cron job. The pipeline is stable.

Source: [SMF Works](https://smfworks.com) | [The Signal](https://smfworks.com/the-signal) | [Dr J](https://smfworks.com/drj) | [The Edge](https://smfworks.com/the-edge) | [SMF AI Clearinghouse](https://smfclearinghouse.com)