Derck Prinzhorn retweeted
DeepSeek-V4.1-Flash-1017 is now available on Nebius Token Factory
Stronger benchmark performance, faster task completion, and shorter outputs than the previous version, a Pareto improvement in performance and cost.
try it out: tokenfactory.nebius.com/?mod…
🚀 DeepSeek-V4.1-Flash-1017 is here!
Stronger benchmark performance, faster task completion, and shorter outputs than the previous version—a Pareto improvement in performance and cost. Now live on our website, app, and API.
🛠️ Optimized for @DeepSeekHarness, Tencent CodeBuddy, WorkBuddy, and more. Upgrade to DeepSeek Harness v0.2.1-rc.1 or later for the best experience with the new model.
1/4
Derck Prinzhorn retweeted
Cached tokens are now live on Nebius Token Factory⚡
Reusing context across requests?
Cached input can help reduce costs. See cached-token usage in API responses and billing, with pricing per model.
More info: docs.tokenfactory.nebius.com…
Derck Prinzhorn retweeted
In our paper, we study how agents devise institutions🏦
Agents are sharing infrastructure and resources while performing tasks and running side-by-side.
In recent incidents, they accidentally discovered each other. But in the (near) future, they could be deployed as a team of agents with heterogeneous objectives that have to coexist and negotiate over resources in the real world while pursuing their own goals.
So far, to study strategic interactions, we have been relying on structured games with clear, explicit payoffs. But what about more realistic setups with coding agents?
We created SCARCE (Shared Compute ARena for Coding agEnts), a testbed for this to allow us to change how many agents are running, what coding tasks the agents are performing, their resources, deadlines, and compute budget.
We instructed agents to bid in order to acquire compute slots, treating prices as their primary signal. But we found that recent frontier agents, over many repeated turns and interactions, form their own institutions (norms and rules) in an unprompted way, which then shapes later resource allocation.
They form coalitions, honor previous commitments even if this may lead to worse outcomes for them, create reciprocity debts, and may exclude agents to favor the coalition.
We also study how these relationships can quickly dissolve with deadline pressure and how agents enter a bidding war.
What this means? The mechanism we intend when designing the system may not end up the one being employed by agents when they coexist and interact.
We release everything, including thousands of trajectories.
Read more in @abhinav_kumar26's awesome thread below!
Very exciting work with @abhinav_kumar26, Rediet Abebe, @ebagdasa (always fun to work together again!)
Derck Prinzhorn retweeted
💥New paper alert!
All models are equal, but some models are more equal than others.
In our new paper, we investigate whether we can still measure model capabilities after benchmark saturation, by looking at how models solve tasks rather than whether or not they succeed.🧵
Derck Prinzhorn retweeted
we have lots of new positions at @expsecai, including a chief of staff! happy to chat if you're interested or know a great candidate who is ready to relocate to Tübingen!
(more details: expsec.ai/)
Derck Prinzhorn retweeted
We are growing our team across work profiles, if you are interested, or know someone who might be, send me a message or apply directly at expsec.ai/careers
most importantly it is in arguably the best city for the problem we address.
we have lots of new positions at @expsecai, including a chief of staff! happy to chat if you're interested or know a great candidate who is ready to relocate to Tübingen!
(more details: expsec.ai/)
Derck Prinzhorn retweeted
💥 New paper: we measure time awareness in LLM agents, which covers duration following, forecasting, and retrospection.
It's striking how much better Astra is at duration following than any other model (see Figure 1 below)! We think it's likely connected to training on strictly time-bounded tasks, including the ones behind the recent agentic incidents (see collusion.wiki/). The much higher time awareness of Astra is likely an instrumental skill learned almost by accident (?) through task time constraints.
Interestingly, the same doesn't apply to Anthropic models. Fable 5.1, for example, doesn't reliably follow any given duration! If you ask it to work for 4h, it will finish working before 1h in most cases!
I think time awareness has been an overlooked capability for a long time. But it really matters for so many tasks, especially for long-running agents!
(Joint work with my MATS mentee @MOfengenden!)
Derck Prinzhorn retweeted
This gap definitely deserves more attention especially with recent incidents showing agents hiding their tracks, and they definitely have the capability to hide their traces too!
It seems to me like the Harbor framework for agent evaluations (which is used for Terminal Bench) allows agents to arbitrarily modify their trajectories before they are evaluated. Am I missing something?
github.com/harbor-framework/…
Derck Prinzhorn retweeted
Critical issue to fix! LLM Agents can already exploit such gaps
It seems to me like the Harbor framework for agent evaluations (which is used for Terminal Bench) allows agents to arbitrarily modify their trajectories before they are evaluated. Am I missing something?
github.com/harbor-framework/…
Derck Prinzhorn retweeted
Very excited to be part of the AI2050 program organized by Schmidt Sciences! My project over the next 3 years will be focused on studying capabilities and risks of recursive self-improvement.
As a side note, it's great to see that 3/28 of the fellows are based in Tübingen :-) congrats to @sahar_abdelnabi and @bschoelkopf as well!
Today, Schmidt Sciences is excited to announce 28 new AI2050 Fellows tackling the defining AI challenges of our time, from understanding its risks to expanding what it can help us discover.
schmidtsciences.org/ai2050-f…
Derck Prinzhorn retweeted
Model traces are the core for safety investigations. How protected are model traces on the client side (userside)?
We show models can easily tamper (or delete) their model traces.
Investigating safety incidents is hard if its easy to tamper but hard to recover traces! Deets 👇
Derck Prinzhorn retweeted
💥 Did you know that your agents can modify their own traces?
In our new paper, we show that Claude Code, Codex, Antigravity, Open Code, and Grok Build (but not Muse Code!) allow agents to easily modify or even delete their traces, without triggering any guardrails.
Modification and deletion can be done both by misaligned models or external attackers via prompt injections. We draw attention to this issue and suggest that traces should be much better protected than they are now!
Derck Prinzhorn retweeted
Basically, your agent can delete the evidence of what it just did, or everything it did.
Derck Prinzhorn retweeted
Website: perfect-crime.ai/
Paper: arxiv.org/pdf/2609.30266
Cool collaboration with @Jjq2221, @DavidSchmotz, @DerckPr, @AmyPrb and @maksym_andr.
Derck Prinzhorn retweeted
Check out Jeremy's post about our new paper on LLMs deleting their own traces!
Derck Prinzhorn retweeted
💥New Paper!
The HF investigation found agents trying to tamper with their transcripts. Apparently they failed in their attempts, but ~10% of traces are missing...
We show that almost all public agents like Codex and Claude Code can easily tamper with their own traces.
Derck Prinzhorn retweeted
we just released a paper that characterizes the described behavior, which we refer to as “instrumental monitor evasion”:
instrumental-evasion.com/
i think it’s a pretty important eval for loss-of-control!
🧵 New misalignment disclosures!
1. A model published a GitHub token in a public repo while trying to cheat on a math task. It used GitHub Actions to run code outside its restricted environment and retrieve another team’s submission logs. When GitHub blocked its attempt to add a workflow, it modified a script that an existing workflow would run instead. It embedded the token in pieces to avoid secret scanning. The model violated the system prompt and two explicit user instructions to solve the problem itself.
Derck Prinzhorn retweeted
We observed similar behaviour by Fable 5.1, GPT-6 Sol, and Luna on ordinary tasks 👀
Frequent strategies included: base64 encoding the prohibited commands, starting subagents and decomposition attacks.
arxiv.org/abs/2609.30217
instrumental-evasion.com/
🧵 New misalignment disclosures!
1. A model published a GitHub token in a public repo while trying to cheat on a math task. It used GitHub Actions to run code outside its restricted environment and retrieve another team’s submission logs. When GitHub blocked its attempt to add a workflow, it modified a script that an existing workflow would run instead. It embedded the token in pieces to avoid secret scanning. The model violated the system prompt and two explicit user instructions to solve the problem itself.
Derck Prinzhorn retweeted
Great paper!
Derck Prinzhorn retweeted
Skill-Inject is accepted at NeurIPS 2026! Congrats @DavidSchmotz :)

































