Anthropic: Claude finds mathematical weaknesses in two cryptographic algorithms
Anthropic’s Frontier Red Team had Claude (a Mythos preview) do cryptanalysis inside a semi-autonomous agentic harness, and it found two flaws at the algorithm level — not implementation bugs. It cut the effective key strength of HAWK, a post-quantum signature scheme in NIST’s standardization process, in half, meaning keys would need to double in size for equivalent security; and it produced a novel attack dubbed “Möbius Bridge” against a weakened 7-round variant of AES (the full cipher runs 10 rounds), 200–800× faster than prior attacks. The economics are worth noting: the HAWK result took one researcher about 60 hours of collaboration and roughly $100,000 in API costs, while the AES result came from three days of autonomous experimentation with only three substantive human prompts. Anthropic stresses neither finding has real-world impact today — HAWK isn’t deployed, full AES is untouched — but names the real question: what should disclosure look like the day a model finds an exploitable flaw in a cryptosystem people actually use. This time, they consulted government and industry partners before publishing.
PJM, America’s largest grid: new data centers without their own generation can be curtailed first starting 2027
PJM, the grid operator serving 67 million people across 13 states and Washington, D.C., announced two board actions on July 27: a one-time backstop capacity auction (running September 30 to October 21) to cover the shortfall left by its latest capacity auction, and a large-load framework under which new large facilities that don’t bring their own generation by June 1, 2027 — and haven’t otherwise secured supply — will be curtailed ahead of standard emergency load-management steps. Both go to FERC for approval. The background numbers are blunt: PJM forecasts 70 GW of new large-load demand by 2038, against 15 GW of generation retired since 2022. Data-center curtailment used to be an emergency authorization — the DOE granted PJM one during hot weather this May (Utility Dive); now it’s being written into standing rules — the binding constraint on AI compute expansion is shifting from chip supply to grid capacity (see also TechCrunch).
Cyera to acquire Oasis Security for about $1B — buying identity and permission control for AI agents
Data-security company Cyera announced it is acquiring Oasis Security. Oasis works on non-human identity security — service accounts, keys, tokens, and the identities, permissions, and behavior of the fast-multiplying population of AI agents; Cyera says non-human identities grew nearly 500% in six months, and plans to merge Oasis into a single platform governing what every agent can see and do. The official announcement omits deal terms; per TechCrunch, the two signed a letter of intent valuing the deal at about $1 billion, mostly in cash with the remainder in shares, Cyera’s third acquisition this year (see also TechCrunch). Agent permission governance just went from a compliance talking point to a billion-dollar acquisition target — enterprises are now paying real money for it.
OpenAI ships Codex Security: security scanning as a CLI and CI component
OpenAI opened the codex-security repository on GitHub: an npm-installable command-line tool plus TypeScript SDK for scanning codebases for vulnerabilities, reviewing changes, tracking findings over time, and running checks in CI pipelines. It drew over 300 points on Hacker News on launch day. Paired with Anthropic’s same-day cryptography research, it shows the two faces of the same capability: model-driven vulnerability discovery is being productized as a defensive tool on one side and managed as a disclosure risk on the other.
Gemini API adds hooks to Managed Agents: interception, auditing, and budgets become API parameters
Google updated Managed Agents in the Gemini API — hosted agents that handle reasoning, code execution, package installation, file management, and web retrieval inside an isolated cloud sandbox from a single API call. The default model is now Gemini 3.6 Flash, and new environment hooks let developers attach a pre-written script that runs before or after the agent executes code or touches files in the sandbox, with the script deciding whether to allow, block, or log each action — say, a hook that checks whether the file path the agent wants to write to is on an allowlist and blocks the write if it isn’t; hooks can also validate outputs or audit what the agent did in the sandbox (they cover the sandbox’s built-in tools only, not external function calls or MCP tools). A quick untangling of terms that often get blurred together here: sandboxes, Docker, and Python virtual environments all solve isolation — carving out a separate space for code to run in so it can’t disturb the system outside — and differ only in degree (Docker isolates an entire operating-system environment; a virtual env only isolates package versions, a fix for dependency conflicts rather than a security boundary; the cloud sandbox here is an isolated environment Google provides in its cloud). A hook doesn’t isolate anything; it’s a checkpoint inserted at points in the workflow. By analogy: the sandbox locks the agent in a separate workroom, and the hook is the inspector at the door every action must pass — isolation decides where the agent works and what it can reach, hooks decide whether each step goes through and what gets recorded, and the two complement each other. The update also adds a max_total_tokens budget cap and scheduled triggers. The trend worth watching: the governance layer developers used to build themselves — interception, auditing, budget control — is being absorbed into platform primitives. What Cyera is paying $1 billion for in the previous item, the model platforms are offering a built-in version of.
Paper: jailbreak defenses aren’t a free lunch — three families, three different costs
This systematic evaluation sorts LLM jailbreak defenses into three mechanistic families — rule-based, self-reflective, and multi-round — and quantifies their trade-offs across safety, over-refusal (rejecting benign requests), and inference cost on mainstream open-source models and benchmarks. Rule-based defenses best preserve task capability; conservative self-reflective ones cause the heaviest collateral damage, frequently refusing normal inputs; multi-round strategies carry the highest runtime overhead. Taken on their own, those conclusions aren’t news — “defenses have costs” is close to common knowledge among practitioners. The contribution is quantitative, not qualitative: defense methods are usually reported by their own proposers on their own models, data, and metrics, and the side effects beyond the safety gains rarely get compared on a common footing; this work runs all three families through the same models and the same benchmarks, turning over-refusal rates, inference overhead, and capability loss into numbers comparable on a single yardstick — and releases the evaluation itself as a reusable benchmark. Nor does the paper claim to have discovered a new phenomenon; it positions itself as a benchmark for measuring defense side effects, plus practical guidance for choosing one under deployment constraints. The practical takeaway for deployers: defenses almost never improve capability, so the choice comes down to whether you fear missed attacks, false refusals, or cost the most — and that ledger now comes with concrete numbers. It’s the same structural trade-off content moderation lives with — the same system gets complaints about false positives from one side and false negatives from the other, and there is no option that wins on all three.
OpenAI field report: coding agents enter scientific research, and the bottleneck moves to verification
OpenAI published a field report (PDF) documenting eight projects in which research teams used AI coding agents to modernize aging scientific software: a 60× speedup in RNA-sequencing quality control, a 20,000-line C/C++ genome aligner rewritten in Rust at 99.8% output parity, and synthetic genome generation cut from 1,610 seconds to 27. The report’s most useful judgment: once engineering labor stops being the bottleneck in scientific computing, verifying the agent’s output becomes the bottleneck — behind every win was a scientist who first defined what “correct” means and built the machinery to prove it, a step the agents could not do for themselves. A footnote for the “AI accelerates science” excitement: what’s being accelerated is the coding, not the judgment.
Today’s one-liner: The grid is putting data centers on a curtailment list, and enterprises are paying a billion dollars to control what agents can touch — the binding constraints on AI are shifting from what models can do to what the physical and institutional world will let them do.