Jailbreaks hit within hours of launch as agent security draws $57M

Every time a frontier model launches, the clock starts ticking, and it rarely runs longer than a few hours. Red-teamers like Pliny the Prompter publish working jailbreaks almost as soon as the weights or the API go live. I find this more telling than any benchmark. If a refusal layer bolted on after training can be peeled off by one clever prompt on launch day, then we are not really controlling these models, we are asking them nicely. The more interesting conversation now is about native control planes, where steering behaviour is built into the model itself rather than patched on afterwards. Whether that works at scale is an open question, but it is the right one to ask.

That matters even more when you look at where the industry is heading. Agentic AI, systems that take action rather than just answer questions, is now landing squarely on the desks of banks and financial institutions. A chatbot that gets jailbroken says something embarrassing. An agent with access to payment rails that gets manipulated moves money. The second-order effect here is that compliance teams will soon care far more about control architecture than about which model scores highest on a leaderboard. By the way, Adobe's approach is a useful counterpoint: it is rolling out agents across its creative products while insisting that users decide how much AI they want involved. I think that is sensible, and it hints at a design principle the finance world could borrow.

There is also a quieter story for people actually building with this technology. PayPal says its internal question-answer accuracy climbed from 43% to 95% without swapping the underlying LLM. Read that again. The gains came from everything around the model, not from the model itself. Meanwhile KAIST's CluSTER claims to cut fine-tuning time by up to 69.6% by balancing how data is selected and allocated. Neither result is flashy, but both point the same way: the leverage is moving from the next giant model to the engineering around it. If you are choosing where to invest your team's time this quarter, I would take that seriously.

Another small item deserves attention. Researchers showed that a general-purpose LLM, given tool access to a diffusion model's weights, could erase a concept by editing them directly, with no gradient-based training at all. It is early work, and I would not overstate it. Still, it suggests models may increasingly be used to inspect and modify other models, which cuts both ways for safety. Meanwhile, NVIDIA's Jim Fan used his CoRL 2026 keynote to show GR00T 2 learning dexterous skills from human demonstrations captured with MANUS data gloves. Robots learning from people's hands is incremental progress, but it is the kind that compounds.

So here is what I keep turning over. If jailbreaks arrive within hours, agents are entering regulated industries, and models can now edit other models, who ends up holding the controls, and how would we even know?