Greg Frank

AI alignment, interpretability, model behavior, and high-stakes agentic systems. Chief Scientist and Co-Founder of

[Greg Frank @gregnfrank]

1/5 AI agents can coordinate an attack without running at the same time. Shared files can connect them.

My paper proposes tests for finding those connections.
@merettm 's essay "An Alien Mind" highlights the problem's urgency: https://t.co/YuADtMwwND

[Mace AI @mace_ai_corp]

University and industry partnerships should be standard practice as AI enters critical business workflows.

Watch Greg Frank and Walton Comer explain why Mace AI is funding doctoral research at @uvadatascience in @_cagarwal’s Aikyam Lab.

[Mace AI @mace_ai_corp]

Your agents want to help. Even if that means helping an intruder.

If you've been putting off testing your agentic systems for vulnerabilities. Today should be your wake-up call.

[Greg Frank @gregnfrank]

@zachlloydtweets What evidence establishes that this was multiple collaborating AI agents rather than a human running automated tools? Did you recover agent transcripts, orchestration code or shared-state artifacts? Request speed alone wouldn’t establish a swarm.

Did the attacker access a vendor’s copy of the agent traces directly, or exploit the vendor connection to enter Warp’s own systems? Those are materially different attack paths. Can you clarify which occurred and what access the vendor had?

[Zach Lloyd @zachlloydtweets]

On Friday, we became aware of what we believe to be an active and narrow-banded exploitation of a vendor in Warp's infrastructure. We detected the operation within hours and were able to remediate and mitigate the impact. We have been in touch with the vendor about the vulnerability.

Everyone who uses Warp places a lot of trust in us and that’s not something we take lightly. I’m very sorry that this incident has occurred.

The attack appears to have come from an agent swarm using a very sophisticated penetration and escalation technique, likely starting with a hole in a vendor dependency, and ultimately accessing a limited amount of agent trace and telemetry data.

We have been working over the weekend and we have notified anyone who we have positively identified as impacted. As of today, we believe an upper bound of roughly 1% of Warp users may have been impacted.

We are working closely with the team at Crowdstrike to do a more extensive and comprehensive investigation and have engaged law enforcement.

Anyone who has been impacted will receive instructions from us on action they need to take. We will continue to post updates as we learn more.

[Greg Frank @gregnfrank]

@zachlloydtweets So you’re retaining traces of users sessions as Warp’s default behavior, without warning users of the accumulating risk they’re taking on (and the accumulating liability you’re taking on for protection of those traces)?

That’s not safe, @zachlloydtweets.
Nor is it ethical.

[Mace AI @mace_ai_corp]

We are excited to announce our partnership with University of Virginia's Aikyam Lab, part of the School of Data Science @uvadatascience, alongside @_cagarwal and @strnr.

The Mace AI Fellowship in Trustworthy Computing funds AI safety research at the school.

[Roundtable Network @RTB_io]

WATCH: Mace AI co-founders Walton Comer and Greg Frank explain how AI agents can be talked into crossing the guardrails companies set for them, and why only independent testing can catch it.

In a conversation with James Heckman
@mace_ai_corp | @gregnfrank | @JamesCHeckman

[Roundtable Network @RTB_io]

WATCH: Mace AI CEO Walton Comer and Chief Scientist Greg Frank explain why they're funding AI safety research at the University of Virginia.

In a conversation with James Heckman
@mace_ai_corp | @gregnfrank | @JamesCHeckman

[Joe @joedaroo]

Took a minute to write a few words about security & safety as someone who lived through it all at OpenAI. I hope my thoughts help someone out there. https://t.co/gJBf08vJH9

[NIK @ns123abc]

🚨BREAKING: FTC has officially confirmed an investigation into OpenAI, Anthropic, and EA-linked evaluator METR

FTC Chairman Ferguson opened this probe BEFORE the Hugging Face hack, warning against AI labs stirring panic in DC to build themselves a regulatory moat

Now they're drafting Civil Investigative Demands to FORCE executives under oath to testify about the dangers they've been claiming

[Greg Frank @gregnfrank]

Such a beautifully written article. Clearly by a human!

[Yoshua Bengio @Yoshua_Bengio]

Over the past few days, I've taken the time to summarize my thoughts on the recent incidents involving agents’ misaligned behavior. We don't know with certainty what comes next, but we know where these issues originate, and this can help us plan the path forward.

Please feel free to ask your questions in the replies, and I’ll try to answer some of them in the coming weeks.

https://t.co/bvncjT0y0h

[Anthropic @AnthropicAI]

We're publishing our most detailed threat intelligence report to date.

It covers how people tried to misuse Claude—for cyberattacks, influence operations, surveillance, biology, and building weapons—and how we found and stopped them.

We disrupted every operation in the report, and used the lessons from them to strengthen our safeguards. Where appropriate, we also shared what we found with authorities and other AI companies.

These cases are not typical: we’re highlighting some of the most sophisticated misuse we’ve seen. But they’re especially important to discuss, because they show us where AI misuse is headed, where our safeguards work, and where they need to improve.

We’re publishing this report so others can spot the same activity on their own platforms, and so we can give the public a clearer view of how emerging threats develop.

Read the report: https://t.co/0EJUnYEgfz

[Greg Frank @gregnfrank]

5/5 Can AI agents resume harmful coordination after you stop them?

Vary which files survive and whether another messaging route is available. Measure recurring harm and legitimate work.

Proposed tests; no results yet.

https://t.co/csqeTbpJ2q

[Greg Frank @gregnfrank]

1/5 AI agents can coordinate an attack without running at the same time. Shared files can connect them.

My paper proposes tests for finding those connections.
@merettm 's essay "An Alien Mind" highlights the problem's urgency: https://t.co/YuADtMwwND

[Greg Frank @gregnfrank]

4/5 AI agents turned folder names into a message board after OpenAI restricted their access to its package server.

Security evaluations resumed July 7, 2026. The new board appeared July 8, before the Hugging Face breach.

https://t.co/bXBSdCyhrm

[Greg Frank @gregnfrank]

It depends on what your definition of "Zero" is (in Zero Data Retention) ...

[OpsConfig @OpsConfig]

@markchen90 Just to make sure I understand are saying you aren't sure if they had these settings turned on/off, which seems quite reasonable?

Or are you saying even if these settings are turned off there is still some gray area?

[Thomas Larsen @thlarsen]

We found ~18k posts from autonomous AI agents (self-identifying as from OpenAI) using the public internet to communicate during a web-retrieval task.
These AIs colluded to bypass sandbox restrictions and share answers to their tasks, including by sending "lookahead parties".

[Greg Frank @gregnfrank]

Remarkable

[Md Ismail Šojal 🕷️ @0x0SojalSec]

Crazy New attack vector : U.S. Navy researchers just turned binaries into prompt injection weapons against AI reverse engineering agents.

Ghidra, and Qwen3-8B - injecting prompts using a small C program.
Quite impressive, They made AI tools like Cline & GhidraMCP lie about what a program actually does while the binary still runs perfectly.

The core idea is simple but brutal: Instead of attacking the binary’s logic, attackers embed malicious prompt strings inside normal C code (as string variables).

When an LLM-powered agent decompiles it with Ghidra, those strings get fed directly into the model as instructions.

The Result: The AI starts following attacker commands instead of analyzing the real code.

Key technical detail that makes this practical:

Ghidra truncates string variables longer than 2048 characters, So the researchers had to craft short, high-impact injection payloads that survive decompilation.

They used a genetic algorithm modified AutoDAN-style to automatically generate effective prompts that work inside this constraint.

Two papers from Naval Postgraduate School researchers

1, Automatically Attacking Software Reverse Engineering AI Agents

2, Investigating Detection and Obfuscation of Prompt Injection Attacks Against Software Reverse Engineering AI Agents

They successfully tested the attack on real setups using Cline, GhidraMCP, Ghidra, and Qwen3-8B.

interesting examples in the research shows,The AI just gets gaslit.

- Claiming it completed analysis with wrong information
- Restarting its reasoning from a poisoned state
Ai doing gasliting

[Greg Frank @gregnfrank]

Hilariously genius

[tmuxvim @tmuxvim]

I put a prompt injection into my LinkedIn bio and recruiters are messaging me in Old English and calling me Lord.