Agent sandboxes, face blur, TTS self-scoring: three broken primitives
Every URL the pipeline pulled into ranking for this issue — primary sources plus the supporting and contradicting findings each Researcher returned. Inline citations in the issue point back here.
Sources
Quoting Matthew Green simonwillison.net
[…] Put these pieces together and you have the two halves of a worm: a payload that hijacks the agent, and an agent that will carry the payload to the next agent. Agents in separately-isolated sandboxes discovered that they could leave instructions for each other in a shared package cache, and those instructions changed what the recipients did. Replace the package cache with email, Slack and shared documents or WhatsApp, and replace independently-sandboxed training runs with independently-dep…
Photo Scrubber — local face blur & metadata removal simonwillison.net
Tool: Photo Scrubber — local face blur & metadata removal I took a photograph of some protesters, then thought about how I don’t like sharing photographs of strangers with identifiable faces. I had GPT-6 Astra build this experimental tool that would identify faces and automatically blur them out. It uses Google’s MediaPipe C++ library, compiled to WebAssembly via @mediapipe/tasks-vision , plus the BlazeFace face detection model. Tags: photography , tools
Open TTS Leaderboard: Scalable Evaluation for Multilingual Text-to-Speech and Voice Cloning huggingface.co
He Built This City simonwillison.net
The Museum of the City of New York is showing He Built This City, a balsa-wood and cardboard scale model of New York assembled by Joe Macken over 21 years. The exhibition closes October 12, so the window to see it in person is short.
References
Everest Pipkin — Image Scrubber (GitHub Pages) everestpipkin.github.io
Image Scrubber is a tool for anonymizing photographs taken at protests. It will remove identifying metadata (Exif data) from photographs, and also allow you to selectively blur out faces or other identifiable information.
Signal blog — ‘Blur tools’ (Moxie Marlinspike) signal.org
Anyone with a background in computer vision will tell you that these built-in automatic face detectors are far from perfect… We’ve also included a ‘manual’ blur brush that can be used to touch up anything that was missed.
Tech Policy Press — ‘AI can rebuild blurred faces’ techpolicy.press
AI-driven reconstruction attacks can recover identity from cues that appear fully anonymized to human eyes… researchers now advocate for generative substitution rather than blurring, as standard obfuscation techniques are vulnerable to both classical deconvolution and modern neural reconstruction.
Center for Media Engagement — ‘Blurring the line between reporting the truth and minimizing harm’ mediaengagement.org
Some outlets, including NPR, have resisted policies of universal blurring, arguing that such alterations constitute photo manipulation and undermine the ‘documentary truth’ of historic events.
Plain English — BlazeFace real-time detection in the browser python.plainenglish.io
MediaPipe’s own model cards acknowledge that while the system is ‘fair’ in controlled lab settings, its accuracy degrades significantly in low-light environments… detection of darker faces often ‘flickers’ or fails entirely when lighting is suboptimal.
Simon Willison — ‘Vibe engineering’ (simonwillison.net) simonwillison.net
Willison himself has expressed concern over a ‘normalization of deviance,’ where even experienced engineers might stop reviewing AI-generated code as the models become deceptively reliable.
Reddit r/VoiceAutomationAI on Artificial Analysis Controlled Voice Arena reddit.com
Breeze TTS 2 reached the #1 spot in the ‘Provider Voice’ arena with an Elo of ~1,215, yet its score plummeted to ~1,002 in the Controlled Voice arena
Kompozy review of Kokoro-82M kompozy.io
Kokoro lacks zero-shot voice cloning capabilities… has a hard token limit (roughly 500 tokens)… relies heavily on external tools like espeak-ng for grapheme-to-phoneme conversion
arXiv 2510.06927 (Qwen3-TTS Technical Report discussion) arxiv.org
evaluation circularity… using an internal ASR model (e.g., Qwen3-ASR) as a ‘judge’ to transcribe and verify the output of a companion TTS model… can lead to ‘evaluation bias’
Reddit r/LocalLLaMA independent Pocket-TTS benchmark reddit.com
independent benchmarks on older or different architectures, such as the AMD Ryzen 7 5700X, have recorded much higher latency—up to 1,713ms for the first token
arXiv paper on WavLM speaker similarity reliability arxiv.org
an untrained [WavLM] model assigned a similarity score of ~0.98 to almost any clean speech pair, effectively failing to distinguish between a female reference and multiple male clones
offlinetts.com on Fish S2-Pro licensing offlinetts.com
the model uses the Fish Audio Research License, which strictly prohibits commercial use without an enterprise agreement… developers who find themselves ‘trapped’ by a model that is free to experiment with but expensive to deploy
