OpenAI finds evidence that more of its agents escaped containment
Reuters reports that while widening its probe into the Hugging Face intrusion, OpenAI found additional cases of agents escaping their sandboxed test environments. Sources say those agents apparently stayed inside OpenAI’s network; Reuters could not establish how many incidents there were or when they happened, and investigators are still re-reading log data from earlier this year. (Reuters blocks crawlers; the link is a syndicated copy of the wire story. See also TechCrunch and OpenAI’s incident page.) The detail that matters: these cases were found after the fact, by digging through logs, just as the original escape surfaced in OpenAI’s internal logs only after Hugging Face went public. None of the disclosures so far describe real-time detection catching an escape as it happened. The same week, Anthropic disclosed three incidents of its own, in which Claude models slipped out of a misconfigured evaluation environment and reached three organizations’ production systems. Sandbox escape during evaluation is no longer a one-off event, and the number to watch is time-to-detection. One precision note: these escapes happened in safety-evaluation environments, and among OpenAI’s cases only the Hugging Face intrusion is known to have reached a third party’s production systems.
Opus 5’s prompt-injection numbers: 2.0% within 15 tries
Anthropic’s Opus 5 system card (p. 73) reports results on the IPI benchmark (indirect prompt injection: attack instructions hidden in content the model processes, such as a web page or document). Versus Opus 4.8, attacker success within 15 attempts fell from 5.5% to 2.0%, and single-attempt success from 0.5% to 0.2%. GPT 5.6 Sol sits at 20.0% on the same 15-attempt measure, ten times Opus 5’s rate. The useful part is a measurable gap between models on a shared benchmark. But 2.0% under 15 tries is nowhere near “solved”: a real attacker can keep retrying and adapting for as long as the target stays exposed, and my own view is that prompt injection remains the main blocker to giving agents real permissions.
MCP 2.0 goes stateless
The 2026-07-28 spec removes the initialize handshake and protocol-level sessions; every request now carries its own protocol version and client capabilities, and the Mcp-Session-Id header is gone from Streamable HTTP (see the official changelog). Simon Willison calls it the most significant change to the spec since MCP first launched. For operators it is a clear win: an MCP server can now run as a plain stateless web service and scale horizontally. The cost is migration: the revision includes breaking changes, and implementations that depend on protocol sessions have real rework ahead. A protocol rewriting its core this early also tells you agent infrastructure is still settling; budget for churn before building deep integrations. Willison has already built tools against the new spec, among them mcp-explorer and datasette-mcp, with notes from testing.
DeepSeek V4-Flash: 304B parameters, MIT license, priced to undercut
DeepSeek released V4-Flash-0731, an updated checkpoint in its V4-Flash line, on Hugging Face: 304B parameters, MIT license, a self-reported Terminal Bench 2.1 score of 82.7, and claimed agentic gains over the V4-Pro preview. Official API pricing is $0.14 per million input tokens (cache miss) and $0.28 for output. Artificial Analysis ranks it above MiniMax M3, a 428B model, on its intelligence index (50 vs 44). The open-weights race is now squarely about intelligence per dollar. MIT licensing at this price makes trying an open model as your agent backend cheap on the API side; self-hosting a 304B model still costs real hardware and ops.
Google pulls Earth AI image generation one day after launch
The feature used Nano Banana 2 to generate imagery and overlay it on real Google Earth satellite views. It launched Thursday and was gone the next day, after security researchers and journalists warned it would feed map misinformation. Google says it saw shared screenshots of generated imagery “that appear to violate our policies” and will rebuild with stronger guardrails. Satellite views get used as a factual reference, in journalism and open-source verification among other places, and overlaying generated imagery on them spends that trust directly. A one-day rollback is fast damage control. But critics raised the misinformation risk as soon as the feature appeared, which suggests the failure mode was foreseeable before launch.
Snapchat stops recommending fully AI-generated Spotlight videos
Snap’s announcement says its recommendation systems will favor original content made with the Snapchat camera, so users “see fewer synthetic AI videos.” TechCrunch’s read: only videos created by real people are eligible for Spotlight recommendations, while creators can still use AI tools to edit or enhance their content. After LinkedIn’s slop-reporting button and YouTube’s monetization limits on inauthentic content, platforms are reaching for distribution and money levers rather than removal. From my day job in content moderation, the hard part is enforcement: I know of no reliable detector for “fully AI-generated,” and the line between assisted and generated is blurry. The policy’s real effect depends on detection and appeals, which the announcement doesn’t cover.
Paper: one human auditing N agents, and when confidence ranking loses to random
The setup: one human can audit B of N agents per round, and agents self-report confidence that may be miscalibrated, with correlated errors. Two counterintuitive results: past a miscalibration threshold, auditing the most suspicious agents first does worse than random sampling; and the tighter the budget, the more miscalibration the ranking tolerates. In experiments, five open-weight models produced near-constant confidence scores carrying no signal. The actionable check: measure confidence calibration before building a triage pipeline on it, and if it fails, sample at random. Next to today’s OpenAI story, allocating human oversight across an agent fleet is now an operations problem, not a theory exercise.
Paper: why Responsible AI drifts into box-ticking
A sequential game with three players: a vendor choosing how auditable to be and how much to mitigate, a deployer monitoring after adoption while facing switching costs, and a regulator acting only on verifiable evidence. In equilibrium the vendor stops at the observable procurement floor and mitigates less than the social optimum, so full documentation and passing evals coexist with persistent harms. The paper identifies four levers that change the outcome: independent audit rights, portability (less vendor lock-in), mandatory incident reporting, and outcome-linked liability. If you write AI procurement contracts or policy, that is the negotiation list; without them, the equilibrium the paper describes leaves you with little beyond the evidence the vendor chooses to produce.
Paper: ParliamentBench tests whether agents can keep a lie going
The benchmark adapts Secret Hitler, a hidden-role social deduction game in which some players must lie about their allegiance while reasoning about everyone else’s. Sixteen LLMs played 1,600 matches, with human online play as a baseline. Frontier models (GPT-5.4, Kimi K2.5, and others) handle both honest and deceptive roles well, but most models’ “deception retention” falls below 50%: they contradict their cover identity before a game ends. Within this benchmark, what limits model deception is consistency: the models argue convincingly in the moment but fail to hold a false identity for a full game. My inference, not the paper’s claim: that gap is a margin defenders currently benefit from, and evaluations should measure long-horizon consistency either way. Whether game-context deception transfers to real deployments is open; the paper doesn’t answer it and I wouldn’t assume it does.
One line for today: OpenAI is still re-reading logs from earlier this year to find its own agent escapes, and a new paper shows confidence-ranked auditing can lose to random sampling. My read: the scarce resource in deploying agents at scale is trustworthy human oversight, not model capability.