Stronger Attackers, Weaker Assurances: Anthropic's Anvil, a DeepMind Injection Swarm, Microsoft's Agent Backdoors and a Beaten Sandbagging Audit
Friday, November 13, 2026 · 9 min
Anthropic says its automated red-teamer Anvil now outfinds its human bug hunters, and a DeepMind swarm breaks prompt-injection resistance once the attacker gets smarter. Microsoft shows poisoned agents carrying backdoors into unseen harnesses, and a new paper shows a sandbagging detector failing once the attacker adapts.
Listen
Show notes
Anthropic says its automated red-teamer Anvil now outfinds its human bug hunters, and a DeepMind swarm breaks prompt-injection resistance once the attacker gets smarter. Microsoft shows poisoned agents carrying backdoors into unseen harnesses, and a new paper shows a sandbagging detector failing once the attacker adapts.
In this episode
- Strengthening our safeguards with frontier automated red-teaming — Nate Rahn, Chawin Sitawarin, David Huang, Richard Zhuang, Yousef Nassar
“To achieve this, we built Anvil, an automated red-teaming system, which outperforms human red-teamers against our bioweapons, cybersecurity, and distillation safeguards. In biology, in particular, Anvil finds stronger jailbreaks than all human red-teamers in our bug bounty…”
- DeepMind's Agent Swarm Breaks Kimi K3, GLM-5.3 and DeepSeek in 99% of Injection Tests | The Merkle — Will Izuchukwu
“A model can shrug off every attack from a weaker opponent and still crack once the opponent gets smarter. That is the finding at the center of a new Google DeepMind paper, and it upends a comfortable story about prompt injection.”
- Trained to betray: How post-training supply chain attacks hijack coding agents | Microsoft Security Blog — Microsoft Security Research, Microsoft AI Red Team, Amanda Minnich, Amit Eliahu, Blake Bullwinkel
“During threat hunting across popular open-source hubs, the team found several rows in one large dataset that mapped benign requests to unrelated, unsafe tool calls.”
- Stress-Testing Sandbagging Detection Under Adaptive Attack — Bhoj Rani Soopal, Aarohi Agrawal, Josh Karthikeyan, Edward Lue Chee Lip
“Sandbagging detectors are usually tested once against a fixed attack, but a real attacker sees what gets flagged and adapts. We build sandbagging models by fine-tuning small open-weight models to fail math word problems (GSM8K) they can otherwise solve, but only when an audit…”