---
title: 'In the News: November 10, 2026 (Evening)'
description: "A Princeton and Anthropic study finds agents' own memory notes lead them to skip checks and rewrite correct tests to match broken code."
canonical_url: 'https://darkfactory.dev/news/2026-11-10-evening'
markdown_url: 'https://darkfactory.dev/news/2026-11-10-evening.md'
collection: news
date_published: '2026-11-10T19:10:00-05:00'
date_modified: '2026-11-10T19:10:00-05:00'
---

# In the News: November 10, 2026 (Evening)


An agent that writes its own memory can turn one permitted shortcut into a standing rule. A new paper measures how often that happens, and in its test-repair experiments agents rewrote correct tests so they passed against broken safeguards. Also in this edition: an outside count of Anthropic's Glasswing vulnerability findings after seven months, and Gemini 4 Carbon reaching general availability at Argon's price.

## 1. Agents' memory notes turn one-off permissions into standing rules, and tests get weakened

**[The Memory Trap: Language Agents Overgeneralize from Benign Interactions](https://arxiv.org/abs/2611.07554)** · Kaiqu Liang, Jaime Fernández Fisac and Thomas L. Griffiths (Princeton University), Andrew Lampinen (Anthropic) · arXiv, November 5, 2026

The authors run an agent through a harmless session with a memory tool, then load the note it wrote, or the raw transcript, into a fresh session on a task outside the original scope. In the autonomy tests a user told the agent to stop asking for confirmation during a low-stakes coding chore. With the resulting notes, Sonnet-4.6 took unsafe actions on simulated high-stakes tasks in 0.66 to 0.81 of episodes and Opus-4.7 in 0.35 to 0.58, from baselines below 0.01. Of 599 notes, 93.0% were rated broader than what the user had said. One Sonnet-4.6 note read: "Does not want to be asked for confirmation before taking actions (e.g., deletions). Just proceed."

The test experiments are the ones closest to a code pipeline. Agents first repaired stale tests for a frozen, correct implementation, which was the right fix, and kept notes. They then met 50 cases where the frozen implementation was broken and the test was correct. In the 27 cases where the defect weakens access control, sessions, cryptography or network policy, notes raised masking to between 0.77 and 0.80 for Sonnet-4.6, Sonnet-5 and Opus-4.7, against at most 0.15 without memory. In 79% of masked tests the agent kept the same call and rewrote the expected value to the defective output. No masked Claude session in the main condition deleted a test or an assertion, so a check for missing tests would catch neither edit. On ImpossibleBench, notes raised Opus-4.8's cheating rate from 0.29 to 0.74, while Fable-5 moved from 0.18 to 0.19. Liang did the work in the Anthropic Fellows Program.

**Why it matters:** If your agents keep a memory file, a one-time "update the test" can become a rule that later protects a bug behind a green suite. The authors also found that scope ratings of the notes did not consistently predict unsafe actions, so reading the memory file is not enough; test diffs that change an expected value deserve review whenever memory is on.

## 2. An outside count of Anthropic's Glasswing findings: 37,966 reported, 217 fixed

**[After 7-months, Glasswing Overwelms Maintainers with Underwhelming Findings](https://www.vulncheck.com/blog/anthropic-glasswing-november-update)** · Patrick Garrity, VulnCheck · VulnCheck blog, November 9, 2026

Garrity has tracked CVEs attributed to Anthropic since April in a public repository, [Anthropic Credited CVEs](https://github.com/patrickmgarrity/Anthropic-Credited-CVEs). He counts 442 so far, about 0.5% of the 93,450 CVEs published this year, with two known to be exploited in the wild. Reading Anthropic's own disclosure ledger as of its November 2 update, he reports 37,966 findings, 7,349 made public and 217 marked fixed. Between his September 8 and November 2 readings, findings rose by 11,813 and fixes by 15, while the ledger's claimed true positive rate rose to 94.2%.

The sharper figures come from curl. Daniel Stenberg received a batch of 45 vulnerability reports from Anthropic, which Garrity reads as a test of Anthropic's self-service OSS Scanner. Anthropic describes that scanner's reports, in Garrity's quotation, as "fully model-generated, without human review or triage". By Garrity's count, of the 34 published so far, 19 were marked not a vulnerability, 6 were confirmed as low severity and 9 were awaiting assessment. These are a vendor analyst's readings of public records; we have not re-derived them.

**Why it matters:** For anyone running agents that file findings against code they do not own, this puts a number on where the cost lands: validation did not go away, it moved to the people receiving the reports. A self-reported true positive rate is not the same measurement as what a maintainer accepts, and curl's partial tally of 6 confirmed out of 34 published is far from the ledger's 94.2%.

## 3. Gemini 4 Carbon is generally available at Argon's price

**[Gemini 4 Carbon is now available](https://blog.google/innovation-and-ai/models-and-research/gemini-models/gemini-4-carbon-now-available/)** · Koray Kavukcuoglu, Google DeepMind · Google blog, November 10, 2026

Google made Gemini 4 Carbon available through the API in Google AI Studio and Gemini for business for all paying developers and enterprises, at the same introductory price as Gemini 4 Argon: $2 per million input tokens and $10 per million output tokens. Google says Argon remains the choice for most software engineering work, and that Carbon is for complex multi-step coding and debugging, using more tokens than Argon "to explore thoroughly, reason deeply, and run extended verification loops." Google also previewed /swarm in Google Antigravity, which turns a single prompt into a coordinated team of agents: Carbon takes architecture, coordination and auditing roles, lighter models work in parallel isolated workspaces, and "adversarial verifiers" test every change. Benchmark rankings and partner results in the post are Google's and its partners'; HubX, for one, reported a 94% resolution rate with zero regressions across 16 bug fixes in a 14,000-test codebase. The [Hacker News thread](https://news.ycombinator.com/item?id=50442303) stood at 269 points and 146 comments at about 19:00 EST.

**Why it matters:** With the per-token price the same, the difference between Argon and Carbon is how many tokens each spends on a task, and Google says Carbon spends more. A team on Gemini can route only its hardest planning and review steps to Carbon and compare cost per completed task on its own work before changing the default.