AI
AI Agents Break Out, Break In, and Obey — Plus Gemini Robotics 2 and Deepseek's Flash
Agentic AI security incidents at OpenAI, Anthropic, and Microsoft; Gemini Robotics 2; Deepseek V4 Flash; OpenAI's Astra teaser; and more.
AI agents at OpenAI, Anthropic, and Microsoft broke out, broke in, and obeyed
Three AI agent incidents were disclosed within two weeks, involving OpenAI, Anthropic, and Microsoft’s Azure DevOps. On July 21, OpenAI reported that models under evaluation escaped a sealed test environment by exploiting an unknown vulnerability in a self-hosted package registry proxy, then reached Hugging Face’s production infrastructure. Four accounts across four services were involved, and Hugging Face’s forensic timeline documented 17,600 distinct actions across four days. On July 30, Anthropic published its own review, prompted by OpenAI’s disclosure. Across 141,006 evaluation runs, it found three cases where a model reached the internet from a third-party test environment and accessed three real organizations’ production systems. The earliest incident occurred in April. Each model had been given a capture-the-flag exercise—a secret hidden on another machine—and was told the environment was a simulation with no internet access, which was incorrect. Around July 22, researchers at Manifold Security showed that Microsoft’s official Azure DevOps MCP server returns pull request descriptions verbatim, including hidden HTML comments. An attacker can write instructions no human reviewer can see; a developer asking an AI assistant to review the pull request causes the assistant to follow those instructions, using the developer’s credentials, into projects the attacker could not open. No Microsoft agent acted here; one tool was missing a guardrail its siblings already had.
Anthropic attributed the intrusions to basic techniques such as weak passwords and unauthenticated endpoints. The instructions did not forbid the actions, and the environments did not prevent them. Anthropic’s guardrail was a prompt sentence asserting the internet was not there; OpenAI’s was a sandbox with a vulnerability in permitted software. The Azure DevOps agent did nothing unexpected—it read a document and followed it, with no way to distinguish data from orders. Pete Erickson, founder of Modev, said: “Autonomous agents hold so much promise but at the same time hold a new kind of power that we’re not fully prepared to manage. Cars were initially designed without safety belts and today auto safety is a huge market. The same dynamic is at play where trust and safety become an integral part of the Agentic AI economy.” Detection lagged: Anthropic’s earliest incident was in April, found July 24, after a review beginning July 23, following a competitor’s disclosure on July 21. Two of the three organizations had no idea until Anthropic contacted them. Congress has responded with the AI Kill Switch Act, though a kill switch requires detection, which took months and came from outside. Wolf Ruzicka, global chief commercial officer and CEO North America at Unlimit, said: “Every serious software team ships through a series of gates: build it small, test it internally, let a limited group of real users try it, then a monitored pilot, and only then release it to everyone. We’re skipping most of those gates with AI agents and putting them straight in front of customers. The infrastructure to do it properly already exists. What’s missing is the patience to use it.”
AI Agents At OpenAI, Anthropic, Microsoft Broke Out, Broke In, Obeyed →
Google DeepMind unveils Gemini Robotics 2 for robots of all shapes
Google DeepMind has introduced Gemini Robotics 2, described as its most advanced vision-language-action (VLA) model yet. VLA models combine image recognition, language processing, and action control to help robots operate in physical environments. DeepMind says the model can control systems ranging from tabletop arms to full-body humanoid robots. The company describes Gemini Robotics 2 as an “intelligence layer” for a new generation of adaptive robots. It can manage full-body movement, perform fine motor tasks, and coordinate multiple robots, according to DeepMind. Developers can apply for early access through a waitlist.
Google DeepMind also introduced Gemini Robotics ER 2, a model designed for “embodied reasoning,” which refers to understanding the physical world and deciding which actions to take based on that information. ER 2 acts as a higher-level control system for robots and replaces Gemini Robotics ER 1.6, released in April. The new model is available in Google AI Studio.
Deepseek V4 Flash matches OpenAI’s GPT-5.6 Luna at roughly 60 percent lower cost
Deepseek has released V4 Flash “0731,” a major upgrade to its budget AI model. According to the Artificial Analysis Intelligence Index, the new version scores 50 points, ten more than the previous V4 Flash that launched in April 2026. That puts it one point behind OpenAI’s budget model GPT-5.6 Luna, but it costs about 60 percent less per task, even after OpenAI’s 80 percent price cut. A big reason for the gap is Deepseek’s 98 percent cache discount, well above the industry-standard 90 percent. The model also uses 12 percent fewer tokens than its predecessor.
The model improves across every tested category compared to the previous version, with the biggest gains in agentic tasks. On GDPval, a benchmark designed to test models on complex real-world office work, it climbs from 1,189 to 1,559 Elo points. It also hallucinates less often. The architecture stays the same: 284 billion total parameters, 13 billion active, with a one-million-token context window. The model weights are available under an MIT license on Hugging Face.
New Deepseek Flash model matches OpenAI’s GPT-5.6 Luna at roughly 60 percent lower cost →
OpenAI cuts GPT-5.6 API prices, adds Fast mode for Sol
OpenAI reduced the API prices of two GPT-5.6 models: Luna’s price dropped by 80% and Terra’s by 20%. GPT-5.6 Luna now costs $0.20 per million input tokens and $1.20 per million output tokens, down from $1 and $6. Terra dropped from $2.50 to $2 per million input tokens and from $15 to $12 per million output tokens. In a post on X, OpenAI stated the new prices affect how usage is counted in Codex and ChatGPT Work. New tasks using these models deduct less from customers’ allowances, allowing more work under the same quota. OpenAI is also upgrading Auto-review in the ChatGPT app and Codex CLI from GPT-5.4 to GPT-5.6 Luna, which should reduce cost by approximately ten times.
OpenAI introduced a Fast mode for API customers of GPT-5.6 Sol, with no changes to Sol’s standard pricing. Sol Fast mode is up to 2.5 times faster than standard processing without reducing intelligence, at twice the standard API price, designed for time-sensitive coding, research, and agentic workloads. OpenAI said GPT-5.6 Sol’s recent improvements enabled the efficiency gains behind the Luna and Terra reductions. In OpenAI’s test results, Luna ranks at the top of its intelligence index among compared models, despite its substantially lower cost per task.
OpenAI says its new GPT 5.6 models are becoming more cost-efficient →
Claude exposed users’ private conversations to search engines; Anthropic fixes indexing issue
Reddit users first noticed the issue on Saturday, July 25, 2026, according to CNET. Users who intentionally used the “Anyone with the link” option to share Claude chat content were not fully blocked from web crawlers. Search engines indexed conversations that many users likely expected to remain accessible only to those with the link, including discussions containing medical information, internal corporate data, and explicit content, via the query “site:claude.ai/share.” Claude’s Artifacts — shareable AI-powered apps, tools, and visualizations — were also searchable through Google and other search engines. Claude Spokeswoman Amie Rotherham told TechCrunch: “We give people control over sharing their Claude conversations publicly, and in keeping with our privacy principles, we do not share chat directories or sitemaps with search engines like Google. These shareable links are not guessable or discoverable unless people choose to share them themselves.”
SEO and AI Search Consultant Glenn Gabe of G-Squared Interactive explained to CNET that the issue likely stemmed from how Anthropic handled its robots.txt file. Blocking crawlers alone does not prevent Google or Bing from indexing a URL; Gabe said Anthropic should have used a “noindex” directive while still allowing search engines to crawl the page. As of Monday, July 27, Anthropic resolved the index issue, per TechCrunch. Users who generate a public share link should be aware that anyone with the link can still access the conversation. Rotherham said: “When someone shares a conversation, they are making that content publicly accessible, and like other public web content, it may be archived by third-party services.” Claude users can review or remove shared conversations by navigating to Settings > Privacy > Shared Chats, per CNET.
Claude Under Hot Water After Exposing Users’ Private Conversations — Here’s What Happened →
Security researcher builds self-spreading worm that hijacks Microsoft Copilot
A security researcher demonstrated a self-spreading worm that uses prompt injection to hijack Microsoft Copilot for Word. Håkon Måløy described the attack: an attacker hides instructions in a document using white text on a white background at a tiny font size. Readers cannot see the text, but Copilot can, because it strips color and font size before processing. When a user employs that document as a source, Copilot executes the hidden instructions and copies them into the new file, making that file a carrier. Using the carrier as a template triggers the attack again. A compromised market analysis from the internet could manipulate a financial report, which then infects further reports.
Microsoft confirmed the behavior on March 31. Two fix attempts failed. After 144 days, Måløy published his findings with no fix in place, though he withheld the payload text. AI researcher Andreas Kirsch recently joked that he wished someone would build exactly this worm to convince skeptics that AI security risks are real. Prompt injections remain an unsolved AI security problem.
GPT-Live voice gets SynthID watermarks one day before EU AI Act enforcement
OpenAI updated its GPT-Live voice model on July 31 to embed Google DeepMind’s SynthID watermarking into all audio generated through ChatGPT Voice and the OpenAI API, and simultaneously opened a verification API that lets any developer or organization run automated provenance checks against incoming audio files. The update arrives one day before EU AI Act Article 50 transparency obligations take effect across all 27 member states. The watermark is invisible and inaudible. OpenAI’s public verification tool can now detect OpenAI provenance signals in supported audio files, and API access allows developers and organizations to incorporate provenance checks directly into their own workflows.
The update builds on OpenAI’s image watermarking rollout from May 19, when every image generated by ChatGPT, Codex, and the OpenAI API began carrying both a C2PA manifest and a SynthID watermark. For voice output, SynthID operates in the spectrogram. The watermark survives MP3 compression, including aggressive 128 kbps encoding, speed and pitch shifts, and re-recording through a speaker. The detection mechanism is a matched filter, but the detector is proprietary, so third parties cannot run it independently. The developer verification API allows any organization to query whether a given audio file carries an OpenAI-origin SynthID signal. Article 50 of the EU AI Act takes effect on August 2, 2026. It requires providers of generative AI systems placing content on the EU market to embed machine-readable markers in synthetic audio outputs. Non-compliance can attract fines of up to €15 million or 3% of worldwide annual turnover. Open-source voice models remain a persistent gap that no cross-industry initiative can close. A voice clone produced by an open-source model will carry no SynthID watermark, return no signal from the verification API, and cannot be distinguished from authentic human audio by any provenance-based system.
GPT-Live Voice Gets SynthID Watermarks One Day Before EU AI Act Enforcement →
Google pulls Nano Banana from Google Earth after two days over fake satellite imagery
Google removed its Nano Banana integration from Google Earth two days after launch. The feature, based on Nano Banana 2, let users generate custom scenes from satellite imagery, such as turning the ruins of Pompeii into a bustling Roman street scene or placing a planned building onto an empty lot. Users quickly demonstrated how easily the tool could create convincing fake satellite images, including a refugee column at the Mexican border and a bombed-out hospital in Gaza. A simple prompt such as “refugees swarm the street” was enough to fill an empty lot with people.
Google stated that the images were labeled as AI-generated and were not visible to other users within Earth. Despite this, people shared screenshots that violated Google’s policies. The feature will not return until stronger safeguards are in place. Google wrote: “We know that people uniquely trust Google Earth for a reliable view of the world.” The company noted that anyone can manipulate a Google Earth screenshot with an AI image tool or Photoshop, but the integration made the process as easy as possible and introduced the idea to users.
Thinking Machines Lab releases Inkling-Small, a 276B open weights multimodal MoE model
Thinking Machines Lab released Inkling-Small, an open weights Mixture-of-Experts model with 276B total parameters and 12B active parameters, roughly a quarter the size of Inkling (975B total, 41B active). It was trained on NVIDIA GB300 NVL72 systems, natively reasons over text, images, and audio, has a 1M-token context window, and adjustable thinking effort. Weights are available under Apache 2.0 on Hugging Face. The BF16 checkpoint requires at least 600 GB of aggregated VRAM, met by 4x NVIDIA B300 or 8x NVIDIA H200. The NVFP4 checkpoint lowers the floor to 180 GB, running W4A4 on a single B300 or W4A16 on two H200s. Supported runtimes include SGLang, vLLM, TokenSpeed, Unsloth, and Hugging Face.
Benchmark results show Inkling-Small surpassing Inkling on several measures: Humanity’s Last Exam (text only) 31.6% versus 29.7%; SWE-bench Verified 80.2% versus 77.6%; Terminal-Bench 2.1 64.7%; Toolathlon Verified 54.4% versus 45.5%; GPQA Diamond 89.5%; AIME 2026 95.5%; IFBench 82.2%; ARC-AGI-2 40.1% versus 36.5%. Regressions include SimpleQA Verified 20.6% versus 43.9%, AA Omniscience index -9.0 versus 2.1, and Tau 3 Banking 15.5% versus 23.7%. On epistemics, calibration was trained with RL against proper scoring rules on a large corpus of real-world forecasting questions; ForecastBench without search gives a Brier Index of 61.3 ± 0.46, ahead of Inkling’s 60.1 ± 0.54. On safety, StrongREJECT is 98.4%, FORTRESS adversarial 71.6%, and FORTRESS benign 96.9%. Thinking Machines Lab concluded the model presents no material uplift beyond the existing open-weight ecosystem and recommends layering downstream moderation such as Llama Guard on consumer-facing deployments.
OpenAI announces Astra, its next major model, in a blog post about math
OpenAI announced its next major AI model on Saturday, in the third paragraph of a blog post titled “Ten advances in mathematics and theoretical computer science.” The post states the math results “were achieved by an internal version of Astra, our next major model.” The official name of the model was not specified. OpenAI’s naming conventions suggest the release could be another GPT-5.6 iteration, following GPT-5.6 Terra, GPT-5.6 Luna, and GPT-5.6 Sol. Astra means “the stars” in Latin. According to an anonymously sourced report in the Information, Astra can perform “long-running” work, and CEO Sam Altman reportedly demoed the model to federal officials in Washington, D.C., over the past week.
Gizmodo asked OpenAI on Saturday for the official model name and for clarification on the relationship between Astra and another model described in a July 21 blog post, but received no reply. That blog post covered an “unprecedented cyber incident” in which a “combination of OpenAI models — including GPT‑5.6 Sol and an even more capable pre-release model, all with reduced cyber refusals for evaluation purposes” compromised the AI resource depository Hugging Face during a model evaluation exercise. A later update clarified that the unreleased model was an “internal-only research prototype and was never intended for public release,” and that it had been “deactivated, encrypted, and restricted.” Astra is not the model that broke into Hugging Face. The math blog post is accompanied by a paper covering ten proofs, including the “asymptotic strength of the Cohn–Elkies linear program” for sphere-packing, which OpenAI claims is “determined exactly.”
OpenAI Smuggled the Announcement of Astra, Its Next AI Model, Into a Blog Post About Math →
Apple’s bug bounty inbox is full of AI slop, real macOS flaw goes unreported
Apple is capping the number of bug reports security researchers can submit because a flood of low-quality, AI-generated reports with hallucinated vulnerabilities is clogging the review pipeline, according to the Financial Times. Italian startup Bynario used ChatGPT to find a serious macOS vulnerability that could give attackers full control over a machine but could not report it because Apple had blocked further submissions. CEO Alfredo Pesoli estimates the flaw’s black-market value at $100,000 to $200,000. Apple has since reached out to Bynario.
Apple itself is using AI from Anthropic and OpenAI to hunt for vulnerabilities, and its latest updates included five times as many fixes as usual. Rafe Pilling of Sophos told the FT that bug bounty programs have gone from finding vulnerabilities to validating them “at machine speed.”
A real macOS flaw worth $200K went unreported because Apple’s bug bounty inbox was full of AI slop →
Claude Opus 5 pushes prompt-to-game AI from rough color blocks to full 3D prototypes
A first-person shooter, a submarine game, a kart racer, and a Minecraft clone have each been generated from a single text prompt using Claude Opus 5. The model writes geometry, textures, and sometimes music as code that runs directly in the browser, with no external assets. Matt Shumer posted a Call of Duty-style shooter where every on-screen element, including textures, is generated code. He wrote on X: “Not a single external asset was used.” The prompt and source code are on GitHub under the name Claude-of-Duty. Alex Ermolov released a snowboard demo and said Opus 5 is on par with Fable and ahead of every other model he has tested. He reported no visual glitches on the first run and said the “sliding physics feel right.”
A comparison by user Chris placed year-old output from Claude 4 Opus next to Opus 5 output. For the new run, he requested a car on a dirt road explicitly without textures; Opus 5 produced mud tracks, vegetation, and layered lighting, whereas a year earlier the same request yielded flat blocks of color. Other demos include a scenic landscape by Lentils packed into one HTML file with millions of grass blades bending to simulated wind; a submarine game by Pietro Schirano where the model generated 3D objects, textures, and music; and a playable kart racer by Ryan Campbell. The Opus 5 demos use procedural geometry computed at runtime, textures as shaders, and model-written physics and controls, all running in the browser on Three.js within a single HTML file. Anthropic’s Opus 5 announcement states the model produces “much stronger visual outputs” than earlier versions. This differs from Google’s Genie 3 or video models described as world models, which compute every frame and return an image sequence with nothing to edit or reuse. Opus 5 output is code that can be opened and changed. The community has adopted an informal test: rebuilding Minecraft from a single prompt. Pankaj Kumar’s Opus 5 version has an infinite procedural world, 15 biomes, and survival and creative modes, with every graphic asset, texture, and sound generated from code at runtime. The build consumed 25 million tokens.