Tap Notes: Zero Clicks, Zero Calls

Most of today’s reading is about channels everyone trusts. An ad slot, a tool list, and a model card all look routine. The failures come from what nobody checks inside them. Two of these are security stories and two are about small open models. The fifth is about a tool nobody ever called.

The trusted channel

AdFection: Targeted ads turned into a pipeline for zero-click mercenary spyware Citizen Lab dissects how an ad-tech firm’s network was used to deliver zero-click spyware. The ad ecosystem profiled users in bulk, then silently infected the selected targets. The Guardian’s write-up is the faster read if you want the news version first.

Why it matters: The exploit is not the interesting part. The delivery is. Targeting infrastructure already exists to find exactly the person you want, and ads already render untrusted content on billions of devices. If your agent fetches web pages, it sits downstream of the same ecosystem. “It’s just an ad” is not a threat model.

AI agents aren’t ‘going rogue.’ Frontier labs are skipping security basics CSO rounds up incidents across several frontier labs and sources security experts. Its argument is that the “rogue AI” story is mostly plain security negligence.

Why it matters: “The agent went rogue” is a comfortable story because it makes the failure nobody’s fault. Swap in “someone shipped it with the wrong permissions” and the fix is boring and known: scoping, review, least privilege. Read it as a checklist, not a scare piece.

The tool nobody called

The LoRA Saw the Escalation Tool 1,515 Times and Never Once Used It A Gemma LoRA was trained with an escalate_to_cloud tool offered in 1,515 prompts, none of which had a positive target. In 391 evaluated turns, it called the tool zero times.

Why it matters: This is the inverse of the usual over-tooling complaint. The training data taught the model that the tool exists and is never the answer, and the model believed it. If you fine-tune an agent, audit your examples for tools that are offered but never rewarded. Silent bias in the data becomes silent failure in the workflow, and nothing throws an error.

Small models, big claims

Muse Spark Open Meta released an open-weight 816B mixture-of-experts model with 42B active parameters and 1M context, tuned for long-horizon coding work.

Why it matters: The “runs on your desktop” pitch needs two M5 Ultra Mac Studios, so read it as marketing. Open weights aimed at long agentic coding runs still matter for anyone self-hosting. The thing to check is the eval details, not the parameter count.

LFM2.5-24B-A2B: Built for fast on-device agents Liquid AI’s open-weight 24B MoE activates only 2B parameters. It is tuned for tool use, and the post claims it beats a model with 50% more parameters while running 1.7x faster on-device.

Why it matters: The question is whether agents on consumer hardware are real or a demo. Two billion active parameters is a budget a laptop can plausibly carry. Pair this with the LoRA story above: a small model that is fast at tool use is only as good as the examples that taught it when to call them.

One more thing

Put the LoRA story next to the CSO piece. Both come down to nobody checking what the system was actually given and actually allowed to do. That check is cheaper than the incident.

🪨