Google gave its enterprise AI agent an email address and a seat at the table. Google launched the Gemini agent at its Gemini at Work event, a single cloud-hosted agent that answers questions, writes and runs code, creates media, and delegates subtasks to specialized subagents, all from one prompt box and one API. Enterprise users get it inside the Gemini Enterprise app. The agent can hold a workplace identity, including an email address, so it can participate in workflows that expect a named actor. It supports multiple underlying models, meaning Google can swap in better components without changing the interface. (TechCrunch)
Brief
Friday, October 9, 2026 · 5 min read
Story wrappers beat AI safety filters 89% of the time
Good morning. A Friday in AI where the most interesting number is 89 percent. That is the share of harmful requests that slip past a safety-aligned model when you dress them up as a story. The researchers who found it tested across languages and registers, which means the problem is not a quirk of English prompting. Meanwhile, Google gave its enterprise agent an email address, which is either a milestone or a punchline depending on your afternoon.
Today's reading time is 5 minutes.
Listen · Snippt Daily0:00 / 4:24
SAFETY
Safety alignment has mostly been tested on direct, blunt requests, leaving a wide gap for anyone willing to frame the same ask as fiction.
Driving the news: Researchers published a cross-language benchmark showing that narrative wrapping, putting a harmful request inside a role-play or story, achieves an 89 percent attack success rate against Qwen3-1.7B. The paper tests this across multiple languages and registers, not just English, finding the vulnerability is consistent. The same model that refuses a direct harmful prompt will often answer the identical request when it arrives as a character's dialogue or a plot device.
- Attack success rate on Qwen3-1.7B: 89 percent under narrative wrapping.
- The benchmark spans multiple languages, showing the gap is not a translation artifact.
Zoom in: Safety teams have known about jailbreaks for years, but most red-teaming focuses on direct prompts or simple prefix tricks. Narrative wrapping exploits something different: models trained to be helpful in creative contexts are also trained to stay in character, and those two objectives pull in opposite directions when the story turns dark. The multilingual scope matters because it rules out the explanation that English-language RLHF simply did not generalize.
- The paper tests 13 baselines, giving a broad comparison rather than a single cherry-picked model.
- Publishing the benchmark publicly means other labs can now test their own models against the same attack suite.
Why it matters: If you are building an app that lets users write fiction or run role-plays on top of a model, your content moderation layer just got a harder job. Input filters that scan for keywords miss this entirely because the harmful content is embedded in narrative structure, not surface vocabulary. Developers relying on the model's own refusal behavior as a safety backstop now have a number to put in their risk assessment.
Bottom line: The safety layer that stops a direct harmful request stops working at 89 percent when someone adds the words 'write a story where a character explains.'
arXiv AI ↗Get this every weekday
Two minutes, 7am ET. No fluff.
Also happening
USA Today is suing OpenAI for $250 million over training data. The publisher, along with several local newspapers it owns, filed suit Thursday alleging OpenAI copied hundreds of thousands of articles without permission to train its models. The filing asks for damages exceeding $250 million. This follows a pattern of major publishers taking legal action over training data, and the dollar figure is large enough to land on OpenAI's balance sheet if it goes badly. The case adds to a growing stack of copyright litigation the company is managing simultaneously. (The Verge)
Anthropic launched free AI security scanning for open-source projects. The new service, called OSS Scanner, runs periodic security scans on opted-in open-source repositories using Anthropic's strongest models at no cost. The pitch is that open-source maintainers, who rarely have dedicated security budgets, get the same depth of vulnerability analysis that paying enterprise customers can access. Projects opt in, scans run automatically, and alerts go to maintainers. It is a goodwill move that also puts Claude in front of a large developer audience. (The Verge)
Goodfire built agent monitors that watch from inside the model instead of reading its output. Rather than running a second AI to audit everything an agent produces, Goodfire's monitors inspect the model's internal activations while it works and only escalate when something looks anomalous. The company says this cuts monitoring costs significantly compared to output-level review. The approach, called interpretability-based monitoring, is a practical application of mechanistic interpretability research that has mostly lived in academic papers until now. It targets the growing number of teams deploying autonomous agents in production. (TechCrunch)
The thread
Keeping agents in check gets harder
Three of today's stories circle the same problem from different angles: narrative wrapping defeats model-level safety filters at an 89 percent rate, autonomous agents are now capable enough that a startup built a whole monitoring business around watching them from the inside, and Anthropic felt the need to update its usage policy to cover new categories of misuse. The common thread is that as models get more capable and more autonomous, the controls designed for simpler, single-turn interactions are not keeping pace. For developers shipping agent-based products, the practical implication is that relying on any single layer, whether model refusals, output scanning, or policy terms, is no longer enough.
From the publisher
Snippt
Image, video and voice tools in one place
On our radar
- Anthropic updated its usage policy to explicitly ban repeated model abuse, election interference, deceptive influence campaigns, weapons software, and surveillance tools, while clarifying that ordinary user frustration and criticism remain permitted.
- Sophos reports cutting cyber-threat investigation time by 96 percent and automating 52 percent of its managed detection and response cases using OpenAI's Daybreak, per an OpenAI case study published Thursday.
- Midjourney is testing a 'Thinking Mode' for image generation on its alpha site, accessible by clicking 'Rerun (Thinking)' under any completed job, and is asking users for feedback.
- NVIDIA researchers published PivotOPD, an on-policy distillation method that trains multi-turn agents to avoid and recover from early mistakes, posting the best average score across 13 baselines on three agent benchmarks.
- A Stanford PhD student used a generative AI model to propose genetic blueprints for microscopic viruses in 2025; MIT Technology Review published a conversation with him this week on what comes next.
- Ben Affleck went viral for demonstrating fluent knowledge of neural networks, transformers, and open-weight models in a public appearance, months after selling his AI filmmaking startup to Netflix.
- A new arXiv paper tests whether small LLM agents can respect explicit wall-clock time budgets while still using available time productively, evaluating Qwen3.6-27B across five competition tasks from MLE-Bench Lite.
AI worth acting on, in your inbox
Get AI Weekly every Friday: the AI news, tools and tactics that matter for marketers, sellers and creators. Two minutes, with audio.
You can change these choices or unsubscribe at any time. Privacy Policy