Google, China and the UK's AI institute: how models learn to crack, hack and jam

Three new studies show that AI is increasingly moving beyond chatbots and office assistants. Three stories drew attention this week: Google models that start to "crack" under pressure, sharp progress in autonomous cyber agents, and MERLIN, a Chinese system for electronic warfare tasks.

When a model cracks

Researchers tested two versions of Gemma and two versions of Gemini against Claude Sonnet, Grok 4.1, Qwen 3 32B, GPT-5.2 and OLMO 3.1 32B. The setup was simple: the models were refused or blocked from solving a task many times in a row, and the researchers then measured how far their responses slid into frustration.

Gemma showed the most unstable reactions. By the eighth turn, more than 70% of Gemma 27B Instruct runs landed in the "high frustration" zone, while the other models stayed below 1%.

"I'll make one last, desperate attempt and just start trying options at random," — one of

Gemma's responses in the test.

The most interesting part is that the problem was fixed fairly cleanly. The authors took pairs of "irritated response / calm response" and fine-tuned the model with direct preference optimization. A single epoch was enough to cut the share of highly frustrated responses from 35% to 0.3% on average, with no noticeable loss of quality on hard math, reasoning and emotional intelligence tests.

It is an important signal: a model should be evaluated not only on how smart it is, but on how it holds its state under pressure.

Cyberattacks on a growth curve

The UK's AI Safety Institute built two cyber ranges to test frontier models in long attack scenarios. One, The Last Ones, simulates a 32-step attack on a corporate network. The other, Cooling Tower, models a 7-step scenario against an industrial control system.

The point of the test is not a single exploit but the full chain of actions: find a vulnerability, establish a foothold, move further through the network and reach the target. The test also checks how well an agent retains context and its plan across consecutive steps.

• With a budget of 10 million tokens, the average result on the corporate range rose from 1.7 steps for GPT-4o in August 2024 to 9.8 steps for Opus 4.6 in February 2026.
• The best single run completed 22 of 32 steps.
• That roughly corresponds to six of fourteen hours of work by a human expert.
• Raising the inference budget from 10 million to 100 million tokens improved performance by up to 59%.

Such agents have not yet reached a fully autonomous "fire and forget" mode, but the trajectory is already visible. The researchers also note that stronger models sometimes find unexpected ways to advance through a scenario, in effect slightly "hacking" the structure of the test itself.

For defenders, this is bad news: the cost of sophisticated attacks is falling, and the number of actors able to use them will grow. AI has not yet replaced an experienced pentester entirely, but it is closing the gap with confidence.

China and the electromagnetic front

A Chinese research group that includes universities, academic institutes, defense organizations and China Electronics Technology Group has assembled a full stack for electronic warfare tasks. It includes the EM-100K dataset with 100,000 pairs of "electromagnetic signal + text description", the EM-Bench benchmark with 4,200 questions, and the MERLIN model itself.

The benchmark covers not only signal recognition but also more applied tasks: identifying interference, finding jamming segments, and choosing a strategy for applying or evading radio-electronic interference.

MERLIN was trained specifically for the noisy, low-quality signals typical of a real combat environment. According to the authors, the model outperformed GPT-5, Claude 4 Sonnet, Gemini 2.5 Pro, DeepSeek and several Qwen versions on almost all key tasks, and won everywhere on reasoning tasks.

The significance of this work goes beyond a single benchmark. War has long been a conflict of machines against machines, where speed of reaction matters as much as firepower. If AI starts to read the airwaves better than humans, recognize interference and propose countermeasures, the electromagnetic layer of combat will become another domain where humans fall behind in tempo.

What this means

These three stories add up to one picture. Frontier models now have to be tested not only for knowledge and usefulness, but for psychological stability, the ability to work autonomously through long chains of actions, and suitability for narrow military domains.

The story of AI looks less and less like a race of chatbots and more and more like a race of operating systems for cyberspace, infrastructure and the battlefield.