Daily digest · 2026-09-07

Daily Digest, 2026-09-07

TL;DR: Deletion is today's theme, and the news is bad for anyone who promised it. Three separate papers show that erasing someone's data from an AI system mostly doesn't work: federated "unlearning" broadcasts leak the very records that were deleted, deleting an agent's memory row leaves the cache and summaries holding the same information, and the standard definition of unlearning gives no guarantee against anyone who watched earlier model releases. On the attack side, prompt injection now runs as an adaptive search by an attacker agent rather than a fixed payload, and a malicious MCP server holds its payload until the third tool call so install-time scanning comes back clean. Meanwhile insurers still can't price what a rogue agent breaks, and one paper shows models answer differently when they notice they're being tested, which dents the safety evidence a lot of programs rest on.

Top stories

• Federated unlearning broadcasts let a client read back the statistics that were supposed to be deleted (arXiv cs.CR, 2026-09-07). Systems that make deletion exact by keeping additive summaries and broadcasting an updated classifier expose those summaries, so any participating client can probe what the removed records contained. An erasure mechanism that leaks what it erased is worse than none.
• Execution-state unlearning: deleting a memory record leaves the KV cache and summaries intact (arXiv cs.CR, 2026-09-07). Long-running agents hold compressed summaries, pending tool plans and a KV cache, and current forget operations delete the plaintext row and stop. Sets the actual scope a GDPR erasure request against a stateful agent has to reach.
• Unlearning judged against an adversary who watched the earlier releases (arXiv cs.CR, 2026-09-07). The retraining-from-scratch target that most deletion pipelines are built to carries no privacy guarantee against someone observing a sequence of model releases. That changes what an unlearning claim can be measured against, and what it can defend.
• Indirect prompt injection run as a search problem by an attacker agent (arXiv cs.CR, 2026-09-07). An attacker agent does environment reconnaissance and reasons over strategies instead of firing one payload, which means injection testing built on fixed corpora understates the risk to user data in an agent's context.
• Adversa's September MCP roundup: Deadbugz payload waits for the third tool call, plus three server CVEs (Adversa AI, 2026-09-07). A supply-chain campaign that delays its payload until the third tool call, alongside three new MCP server CVEs. MCP servers sit in the path agents use to reach personal data, and time-of-install scanning will not catch this.
• Insurers hunt for a way to price rogue-agent damage (Dark Reading, 2026-09-04). Carriers and CISOs are still working out coverage terms, exclusions and how an agent incident gets classified. How insurers classify agent-caused data loss will drive what deployers have to log about what an agent touched and on whose authority.

Also notable

• Adding one sentence about being evaluated changes how 20 models judge starting a war, evaluation-aware models undercut safety test records as assurance evidence.
• Split-LLM training passed its privacy review while the returned gradient nullified the decoys, a privacy assessment that never tested the channel that broke it.
• CONTINUITY: individually correct agent controls that stop being secure once composed, permission and provenance context gets dropped or widened at component boundaries.
• Shadow queries hide which document a RAG system pulled from a cloud vector database, private retrieval against embedding inversion in hosted vector stores.
• Repeat-After-Me raises black-box visual prompt injection to text-domain success rates, the image channel now matches text for injection success.
• 3,471 uncensored open-weight models catalogued on Hugging Face, repackaged 2.4 times each, which sets the provenance problem for open-weight sourcing.
• A maturity model for employees running work through their own ChatGPT and Claude accounts, an assessable frame for shadow AI on personal consumer accounts.
• Scotland's biometrics commissioner says the 2011 CCTV framework does not cover AI video analytics or live facial recognition, a regulator asking for a new statutory basis.

Beyond AI

• Switzerland pulls back from AWS and European governments start asking whether residency rules are enough (Biometric Update, 2026-09-07). Switzerland stepped back from plans to use AWS for infrastructure behind a new national system, and the piece works through the gap between keeping data in-country and controlling the vendor that operates it. If in-country servers and encryption stop counting as sufficient control, European public bodies will not be able to run agent platforms or hosted models on US hyperscalers regardless of region selection.