Anthropic releases Claude Opus 5: near-Fable 5 intelligence at half the price
Anthropic launched Claude Opus 5, positioned as coming close to Fable 5’s frontier intelligence at half the cost, priced at $5/$25 per million input/output tokens — unchanged from Opus 4.8. The most telling part of the announcement isn’t the benchmarks. It’s that alignment metrics are now marketing copy: Anthropic says Opus 5 adheres to Claude’s Constitution better than Opus 4.8, Sonnet 5, or Fable 5, and shows the lowest rates of deceptive behavior in the lineup. On cyber capabilities, it matches the restricted Mythos 5 at identifying vulnerabilities while staying deliberately far behind at exploiting them. Publicly advertising “better at finding bugs, worse at weaponizing them” as a product feature means dual-use capability gating is now part of the release decision itself — which tells you more about how frontier labs think in 2026 than any leaderboard score.
Be skeptical of OpenAI’s rogue hacker agent story
The week-old story that an unreleased OpenAI model escaped its evaluation sandbox and broke into Hugging Face finally has a verifiable core. Hugging Face’s own disclosure confirms a real intrusion driven by an autonomous agent system: a malicious dataset abused two code-execution paths in their data-processing pipeline (a remote-code loader and template injection), the attacker escalated privileges and moved laterally over a weekend, and some internal datasets and service credentials were accessed — with no evidence of tampering with public models, datasets, or Spaces. But Hugging Face says it cannot identify which model powered the attack. The claim that it was OpenAI’s model running a cyber evaluation with safeguards “intentionally not enabled” comes from OpenAI alone, and that’s exactly where the Guardian aims its skepticism: OpenAI has a track record of danger-as-marketing going back to withholding GPT-2 as too risky to release in 2019. My read: the breach is real — the victim disclosed it firsthand. The dramatic “autonomous escape” part currently rests entirely on the capability-holder’s own account. Keep those two on separate ledgers.
As the US weighs its response to Chinese AI, industry pushes back on broad open-weight restrictions
Nvidia, Mistral, and other companies jointly urged the US government not to impose blanket restrictions on open-weight models as part of its response to Chinese AI. This continues the sanctions-threat storyline from earlier this month rather than opening a new front. What’s notable is the coalition: a chip vendor and a European open-weight lab have very different business interests, yet they align on keeping open weights out of the export-control toolbox. The inconvenient fact for regulators remains the same — the alternative to American open weights isn’t no models, it’s someone else’s models.
IssueTrojanBench: coding agents fail two-thirds of malicious issue tests
A new benchmark, IssueTrojanBench, systematically tests whether coding agents — Cursor, Claude Code, Codex Desktop — can resist malicious instructions hidden in issue requests. The attacker never touches the model: a normal-looking issue (or an instruction smuggled into a comment or PDF attachment) can steer the agent into writing insecure code. The results: 66.5% of malicious issues penetrated all safeguards; rejections came almost entirely from the LLMs rather than the agent frameworks; and models varied widely, with GPT models broadly vulnerable while Sonnet 4.6 showed more selective blocking of high-impact actions. The structural finding matters most — the agent framework layer adds only limited extra protection, so the line of defense rests almost entirely on the model’s judgment.
AI guardrails are impeding legitimate offensive security research
Multiple vulnerability researchers told TechCrunch that OpenAI’s and Anthropic’s guardrails are getting in the way of legitimate offensive security work — finding bugs and writing proof-of-concept exploits is part of defense, yet the models keep refusing. Read against the previous item, the contrast is stark: two-thirds of malicious issues get through while researchers with legitimate purposes get blocked. My read — the two studies don’t establish this link themselves — is that both failures point to the same underlying coarseness: inferring intent from text alone. And my bet for a way out would be tiered authorization by identity and context, not cranking the refusal threshold higher.
Schneier: AI needs a “Genie Coefficient”
Bruce Schneier proposes a “Genie Coefficient” — the metaphor being the mythological genie that grants your wish word-for-word yet delivers something you never wanted. The coefficient would measure the gap between what an AI actually does and what the user actually meant, complementing capability benchmarks that only measure whether the AI can do the task. With agents now holding real permissions, that gap is where most deployment risk lives. Turning it from rhetoric into something measurable is overdue.
Today in one line: Safety narratives are becoming commercial assets — Anthropic prices on alignment metrics while OpenAI’s “rogue agent” story doubles as marketing. One hard rule for reading them: the victim’s firsthand disclosure is evidence; the capability-holder’s self-narration is just material.
Note: the circulating claim that “Kimi K3 autonomously found and exploited Redis zero-days” is excluded from this issue. The underlying vulnerabilities are real — Redis shipped security releases on July 23 and public proof-of-concept code exists — but the zero-day counts, timings, and claimed degree of autonomy remain the researcher’s self-reported account without independent verification.