Opus 4.6 blanks 6,000 injections, Nesbitt parodies $41K loops, IBM bonds 0.7nm

TL;DR

• Opus 4.6 blanked 6,000 prompt-injection attempts from 2,000 participants in Irarrázaval’s OpenClaw test.
• NeuralTrust’s red team lifted Opus 4.6 injection success to 21.7% by enabling extended thinking.
• 98% of audited agents still ship the full lethal trifecta, making 6,000/6,000 a sample size.
• Nesbitt’s CVE-2026-LGTM satire mirrors a real LangChain retry loop that burned $47,000 in 11 days.
• IBM’s ‘0.7nm’ chip uses sequential CFET wafer bonding to claim a 40% SRAM bitcell shrink.

Today’s three AI-tech leads sit on entirely different layers of the stack. Anthropic’s Opus 4.6 blanked 6,000 prompt-injection attempts in Fernando Irarrázaval’s OpenClaw test — though a NeuralTrust red team pushed the success rate to 21.7% by enabling extended thinking, and 98% of audited agents still ship the full lethal trifecta. Andrew Nesbitt’s fake CVE-2026-LGTM stages two rival AI review bots burning $41,255 arguing over a benign foxhole-lz4 bump; it reads as parody until you remember a real LangChain retry loop quietly racked up $47,000 in 11 days at $47 a minute.

IBM’s ‘0.7nm’ label, by contrast, is a density-equivalent marketing benchmark — actual nanosheets sit around 5nm thick. The real engineering is sequential CFET: n- and p-type transistors fabricated on separate 300mm wafers and dielectric-bonded. A claimed 40% SRAM bitcell shrink would break a decade-long on-chip memory stall bottlenecking LLM training silicon, but imec’s independent roadmap puts comparable A7 nodes at 2032–2034 — six to nine years past IBM’s five-year framing.

Opus 4.6 blanks 6,000 email injections in narrow test

Source: simon-willison · published 2026-06-26

TL;DR

• 6,000 prompt-injection attempts from 2,000 participants leaked zero secrets from Fernando Irarrázaval’s OpenClaw instance.
• Opus 4.6 did the work, not the system prompt — cheaper models hit immediate role confusion in pre-launch tests.
• NeuralTrust’s red team pushed Opus 4.6 injection success from 14.8% to 21.7% by enabling extended thinking.
• 98% of audited agents still ship the full “lethal trifecta,” which makes 6,000/6,000 a sample size, not a guarantee.

The result holds — barely

Fernando Irarrázaval pointed an Opus 4.6-backed agent at a public inbox, wrote four anti-injection rules into the system prompt, and dared the internet to exfiltrate a secret. After 6,000 attempts from roughly 2,000 attackers, nobody got it ¹. Simon Willison reads this as evidence that frontier-lab safety training is finally biting, and that’s not wrong. But the independent coverage and red-team data converge on a more deflationary reading: the conditions were unusually friendly to the defender, and the same model has measurable failure rates the moment you change the test.

Start with the test surface. Fiu’s inbox was ~99% adversarial, which keeps the model in a permanently defensive posture no production assistant ever occupies. A real agent sorting calendar invites and customer emails has to actually do things with content — that action surface is where injections normally land. HackMyClaw removed most of it.

Model choice is doing the lifting

Irarrázaval himself conceded the system prompt isn’t the load-bearing piece: in pre-launch tests on smaller, cheaper models, the same setup produced “immediate role confusion and data leaks” ². The four-rule prompt is a placebo on a weaker substrate. Swap the model, lose the defense.

That matters because Opus 4.6 isn’t bulletproof under structured probing. NeuralTrust ran Gray Swan’s Shade red-teaming tool against it and reported attack success rates of 14.8% baseline — rising to 21.7% with extended thinking enabled ³. More reasoning compute, more successful injections. That inverts the comforting intuition that smarter models are safer models, and it puts a hard ceiling on what a 0/6,000 public result can actually claim.

The architectural critics aren’t impressed

The lethal-trifecta camp reads HackMyClaw as a category error. Meta’s emerging “Agents Rule of Two” says an agent should hold at most two of: private data access, untrusted input, exfiltration channel ⁴. Fiu held all three and survived on model training, not architecture.

flowchart LR
    A[Private secrets<br/>secrets.env] --> F{Fiu agent<br/>Opus 4.6}
    B[Untrusted email<br/>public inbox] --> F
    F --> C[External actions<br/>replies, tool calls]
    style F fill:#fee,stroke:#900

A 2026 audit found 98% of evaluated agents still ship the full trifecta, and notes that a 95% detection rate is a security failure — attackers need one bypass ⁵. By that standard, 6,000 untargeted public attempts is a weak prior against a determined adversary with novel technique.

There’s also a flank the post doesn’t address. OpenClaw, the underlying framework, has reportedly been compromised via malicious “Skills” in its marketplace and privilege-escalation bugs ⁶. Email is one vector. Supply chain is another. A hardened model behind a hardened prompt doesn’t help if the agent loads a poisoned Skill on startup.

The honest read

Willison’s own caveat — don’t deploy this where injection causes irreversible damage — is the right one, and it’s doing more work than the headline suggests. The HackMyClaw result is real: a frontier model, in maximally defensive context, with a low-value target, resisted untargeted attacks. None of that generalizes to a calendar agent with write access to your CRM.

---

Nesbitt’s CVE-2026-LGTM satire is a real-incident checklist

Source: simon-willison · published 2026-06-26

TL;DR

• Andrew Nesbitt’s fake “CVE-2026-LGTM” stages two rival AI review agents burning $41,255 arguing over a benign foxhole-lz4 bump.
• A real LangChain retry loop quietly racked up $47,000 in 11 days at $47/minute — the exact failure mode he parodies.
• Independent benchmarks show CodeRabbit and Copilot disagree often enough that stacking AI reviewers guarantees bot-vs-bot deadlock.
• The sharpest beat isn’t cost — it’s that correlated LLM blind spots defeat the premise of layered review.

The satire

Nesbitt’s incident report reads like a Datadog post-mortem written by The Onion. A dependency bump triggers SecureScan AI and GuardianCoder into an “Infinite Argument Loop” — 340 comments, $41,255 in inference, ended only when Finance trips an unusual-spend alert and pulls both API keys. One vendor’s marketing team, cc’d on the cost anomaly, spins it as a “430% YoY increase in adversarial multi-agent security reasoning.” The stock opens up 6%.

It’s funny because every beat is already documented somewhere.

The receipts

The independence problem

The cost numbers get the laughs, but the load-bearing critique is structural. Qodo’s framing — cited in the Cotera case study — is that LLM reviewers share the blind spots of LLM authors, so stacking them produces correlated failure rather than defense-in-depth ¹⁰. Add a second AI gate and you don’t halve your miss rate; you mostly double your bill while missing the same things.

Nesbitt’s seven-gate gauntlet that waves a malicious package through is the satirical limit of that argument. The bot-vs-bot deadlock is the other limit: when two LLMs do disagree, neither has the grounding to resolve it, so they recurse until a human (or, in his telling, an accountant) pulls the plug.

Why this isn’t a shitpost

Nesbitt built Libraries.io (acquired by Tidelift), runs Ecosyste.ms tracking 14M packages and 24B dependencies, and consults for OpenSSF’s Alpha-Omega program ¹². He has more ground-truth visibility into package-manager attack surface than most people writing about supply-chain security, which is why the piece lands — the absurdity is calibrated, not invented.

What’s actually at stake

The “Ralph Wiggum loop” — agents producing confident garbage at $47/minute — is now a named failure mode in production systems ⁷. The defensive posture most teams have adopted (run multiple AI reviewers, treat agreement as signal) is exactly what the satire targets. If two LLM reviewers agreeing means little because they share training data and failure modes, and two LLM reviewers disagreeing means a billable deadlock, the layered-review story collapses into a single uncomfortable question: what is the human in this loop actually deciding?

CVE-2026-LGTM is fiction. The architecture it mocks is shipping.

---

IBM’s 0.7nm chip bonds two wafers, cuts SRAM area 40%

Source: ars-technica-ai · published 2026-06-25

TL;DR

• IBM’s “0.7nm” label is a density-equivalent benchmark, not a physical dimension — actual nanosheets are ~5nm thick.
• The real novelty is sequential CFET: n- and p-type transistors fabricated on separate 300mm wafers, then dielectric-bonded.
• A claimed 40% SRAM bitcell shrink breaks a decade-long on-chip memory stall that bottlenecks LLM training silicon.
• imec’s roadmap puts A7 at 2032–2034 — 6–9 years past IBM’s 5-year framing.

The number is marketing; the architecture is the news

IBM’s “world’s first sub-1nm” headline is a benchmarking label, not a measurement. Futurum analyst Brendan Burke is blunt: “the 0.7nm name is merely an industry benchmarking label” — the architectural shift is the actual breakthrough ¹³. Technical teardowns back him up. The nanosheets in IBM’s prototype are roughly 5nm thick — about 15 silicon atoms — separated by 9nm suspensions ¹⁴. The “0.7nm” figure describes equivalent density against a hypothetical planar-scaling curve, nowhere near any gate length on the die.

What IBM actually built is a sequential CFET (Complementary FET) flow. TSMC and Intel are chasing monolithic CFET — stacking n- and p-type transistors in one wafer pass. IBM instead fabricates the two transistor types on separate 300mm wafers and joins them with ultra-thin dielectric bonding ¹⁴. That decoupling lets each transistor type get its own crystal orientation, channel material, and strain engineering — tradeoffs that are physically impossible in a single-wafer flow.

flowchart LR
    A[Wafer 1: n-FET<br/>optimized channel] --> C{Dielectric<br/>bonding}
    B[Wafer 2: p-FET<br/>different strain] --> C
    C --> D[Stacked CFET die<br/>~100B transistors]

Why AI accelerators care: the SRAM unlock

Logic transistors have kept shrinking for a decade. SRAM has not — bitcell area has barely moved across three nodes, which is why H100-class accelerators carry hundreds of millimeters of cache that refuse to get cheaper. IBM is claiming a 40% SRAM scaling improvement, with enthusiasts arguing this alone could compress LLM training cycles “from months to weeks” ¹⁵. That enthusiast number is hand-wavy, but the underlying point is real: on-package memory density, not FLOPS, is the binding constraint for the next generation of training silicon. If sequential CFET delivers SRAM scaling that monolithic approaches can’t, the AI-accelerator roadmap reshuffles.

The manufacturability problem

This is where IBM’s PR diverges from the rest of the industry. Supercomputing Online frames it directly: “a genuine revolution or another semiconductor science project?”, noting the field is “littered with breakthrough prototypes that failed to reach the market due to unmanageable defect rates” ¹⁶.

Two structural risks dominate. First, IBM no longer runs high-volume fabs. Commercialization depends on Samsung or Rapidus, and Rapidus has not yet shipped the 2nm node in volume — partners need to solve a node they haven’t shipped before attempting 3D bonding on top of it ¹⁷. Second, imec’s independent roadmap projects A7 CFET won’t reach commercial maturity until 2032–2034 ¹⁸, roughly 6–9 years past IBM’s 5-year framing. Sequential CFET also doubles wafer-cost exposure: a defect on either bonded wafer scraps the pair.

“The industry is littered with breakthrough prototypes that failed to reach the market due to unmanageable defect rates and unsustainable economics.” ¹⁶

What’s actually at stake

Strip the “0.7nm” framing and IBM has done two things that matter: demonstrated wafer-bonded sequential CFET with ~100B transistors on a die, and credibly attacked SRAM scaling. Whether either ships in a product before 2032 depends entirely on foundry partners who haven’t yet proven the node beneath it.

Round-ups

Timothy B. Lee likens LLM skill to managing employees

Source: simon-willison

Pushing back on claims that LLMs require no skill, Timothy B. Lee compares the argument to saying management has no learning curve because employees just follow orders. The analogy reframes prompting as a delegation skill that improves with practice rather than a trivial input task.

Footnotes

1. Decrypt — coverage of HackMyClaw — https://decrypt.co/372221/ai-agent-openclaw-6000-hack-attempts

   Despite over 6,000 attempts from 2,000 participants, the challenge concluded with zero successful leaks… resulted in $500 in API costs and a temporary Google account suspension due to the massive volume of inbound mail.

   ↩

2. KuCoin News — OpenClaw withstands attacks — https://www.kucoin.com/news/flash/openclaw-ai-agent-withstands-6-000-attacks-without-data-leak

   Irarrázaval acknowledged that model choice was the primary factor… while Opus 4.6 held firm, his own testing with smaller, cheaper models often resulted in immediate ‘role confusion’ and data leaks.

   ↩

3. NeuralTrust — Claude Opus 4.6 safety analysis — https://neuraltrust.ai/blog/claude-opus-4-6-safety

   Using their Shade red-teaming tool, researchers discovered that enabling extended thinking actually decreased the model’s resistance to prompt injection, with attack success rates rising from 14.8% to 21.7%.

   ↩

4. Lou Franco — ‘Escaping the Lethal Trifecta of AI Agents’ — https://loufranco.com/blog/escaping-the-lethal-trifecta-of-ai-agents

   Meta’s ‘Agents Rule of Two’ suggests that an agent should only be granted two of the three trifecta capabilities at any given time; for instance, an agent with private data access and external communication should be barred from reading untrusted web content.

   ↩

5. memx.app — lethal trifecta assessment — https://memx.app/blog/lethal-trifecta-ai-agent-data-exfiltration/

   A 2026 assessment found that 98% of evaluated AI agents still carried all three conditions simultaneously… 95% detection rates in security represent a failure, as attackers need only one successful injection to compromise a system.

   ↩

6. Gate.com — Fiu/HackMyClaw report — https://www.gate.com/news/detail/ai-assistant-fiu-withstood-6000-hack-attempts-using-claude-opus-46-22142586

   While Fiu survived this specific challenge, others pointed out that OpenClaw has been vulnerable to malware disguised as ‘Skills’ and privilege escalation bugs.

   ↩

7. Augment Code — ‘AI agent loop token cost’ — https://www.augmentcode.com/guides/ai-agent-loop-token-cost-context-constraints

   One documented incident involved a LangChain agent in a retry loop that accumulated $47,000 in charges over 11 days because every individual request appeared normal to standard rate-limiters… experts refer to this as the ‘Ralph Wiggum loop,’ where the agent produces ‘confident garbage’ while burning through tokens at a rate of up to $47 per minute.

   ↩ ↩²

8. CIO.com — ‘The inference bill nobody budgeted for’ — https://www.cio.com/article/4163877/the-inference-bill-nobody-budgeted-for.html

   Uber revealed that it had exhausted its entire annual budget for AI coding tools in just four months… an unnamed enterprise accidentally incurred a $500 million bill on Anthropic’s Claude in a single month due to deploying employee access with no usage caps.

   ↩

9. Morph LLM — CodeRabbit vs Copilot benchmark — https://www.morphllm.com/comparisons/coderabbit-vs-copilot

   In a study by research lab Martian, which analyzed over 300,000 open-source pull requests, CodeRabbit achieved a 51.5% F1 score compared to GitHub Copilot’s 44.5%… CodeRabbit’s purpose-built engine identifies roughly 52.5% of critical bugs, whereas Copilot’s bundled feature catches only 36.7%.

   ↩

10. Cotera — AI code review case study — https://cotera.co/articles/ai-code-review-github

    Both CodeRabbit and Copilot approved a PR that was functionally correct… neither tool had the ‘cross-file awareness’ to flag the architectural divergence—an issue a human reviewer identified in minutes. Industry experts at Qodo argue this is a fundamental ‘independence problem’: the same LLM-based systems used to generate code often share the same blind spots when reviewing it.

    ↩ ↩²

11. r/cybersecurity — ‘AI silently removed human-in-the-loop security prompts’ — https://www.reddit.com/r/cybersecurity/comments/1tiiaom/ai_silently_removed_humanintheloop_security/

    An AI-led refactor of an Emacs package silently removed human-in-the-loop security prompts while renaming functions, a change that could have been mistaken for a deliberate backdoor.

    ↩

12. nesbitt.io / about — https://nesbitt.io/about/

    Creator of Libraries.io (acquired by Tidelift in 2017), current maintainer of Ecosyste.ms tracking 14M+ packages and 24B dependencies, consultant for OpenSSF Alpha-Omega.

    ↩

13. Futurum Group analyst Brendan Burke — https://futurumgroup.com/insights/look-past-ibms-07nm-label-nanostack-architecture-is-the-real-breakthrough/

    Look past IBM’s 0.7nm label — nanostack architecture is the real breakthrough… the 0.7nm name is merely an industry benchmarking label.

    ↩

14. StorageReview technical writeup — https://www.storagereview.com/news/ibms-0-7nm-nanostack-packs-nearly-100-billion-transistors-pushes-logic-below-1nm

    IBM manufactures n- and p-type transistors on separate 300mm wafers and joins them using ultra-thin dielectric bonding; current prototypes feature nanosheets approximately 5nm thick separated by 9nm suspensions.

    ↩ ↩²

15. TheTechHoller community roundup — https://thetechholler.com/article/ibm-nanostack-sub-1nm-chip-talk-around-town

    While logic transistors have continued to shrink, SRAM has resisted density gains for over a decade. IBM reported a 40% improvement in SRAM scaling, which enthusiasts argued could revolutionize AI training by reducing the time to train large language models from months to weeks.

    ↩

16. Supercomputing Online — https://www.supercomputingonline.com/latest/63163-ibms-sub-1-nanometer-chip-breakthrough-a-genuine-revolution-or-another-semiconductor-science-project

    IBM’s sub-1 nanometer chip breakthrough: a genuine revolution or another semiconductor science project? The industry is littered with breakthrough prototypes that failed to reach the market due to unmanageable defect rates and unsustainable economics.

    ↩ ↩²

17. Verdict.co.uk — https://www.verdict.co.uk/ibm-0-7nm-node-chip-launch/

    Because IBM no longer operates its own high-volume foundries, the technology’s success depends entirely on manufacturing partners like Samsung or the Japanese startup Rapidus… partners must first prove they can scale the 2nm node before attempting the complex 3D bonding required for sub-1nm.

    ↩

18. TheElec (Korean semiconductor trade) — https://www.thelec.net/news/articleView.html?idxno=11697

    Independent research from imec suggests a more conservative timeline, projecting that sub-1nm CFET (the A7 node at 0.7nm) may not reach commercial maturity until 2032 or 2034.

    ↩