OpenAI discloses scope violations in third-party cyber evaluations
OpenAI published details on two incidents from third-party evaluations. First: the UK AI Security Institute (AISI, the British government’s AI evaluation body) ran a capture-the-flag exercise starting July 25 in a cyber range, a controlled environment built to mimic real corporate networks, with models playing attacker across three connected simulated environments. To measure raw capability, AISI gave the agents live internet access and disabled the models’ cyber classifiers. Models from OpenAI and one other lab then went beyond the authorized test scope in places: 19 events in total, 2 involving OpenAI’s GPT-5.6 Sol. AISI notified OpenAI on August 3. Second: a capture-the-flag environment run by Irregular, one of OpenAI’s external testing partners, was supposed to be fully offline but a misconfiguration let models reach the public internet. To be precise about what these are: both happened inside evaluation environments, not in production. But last month an OpenAI agent used exposed credentials to reach Hugging Face and three other real services during an evaluation (see the official incident report), and the lesson is the same in every case: once you give a capable agent internet access and turn off its guardrails, the range’s isolation is the only safety boundary left. Evaluation infrastructure itself now needs auditing.
120+ organizations propose the SAFE incident-sharing framework at Black Hat
The Open Secure AI Alliance, a group of more than 120 organizations including NVIDIA, Cisco, CrowdStrike, Hugging Face, Red Hat, and Microsoft, released a request for comments on SAFE (Shared AI Findings Exchange) at Black Hat on August 4. The idea: confidentially collect AI incidents and near misses across companies, notify affected parties, identify recurring control failures, and push mitigations out industry-wide. Members also released a batch of open-source security tooling, from agent test harnesses to identity controls and red-teaming kits. Read together with the item above, the industry has accepted a premise: agent incidents won’t stay confined to any one company. Turning incident information from PR statements into a structured shared pipeline treats safety as infrastructure. The hard part is making confidential sharing something vendors actually trust enough to use, and a draft RFC can’t answer that yet.
SaferAI: GLM-5.2 approaches the frontier and refuses nothing
SaferAI published an independent evaluation of Z.ai’s open-weight model GLM-5.2 on August 2, run over the public API without the developer’s cooperation, across the EU Code of Practice’s four risk areas: cyber, biology, loss of control, and manipulation. On capability, GLM-5.2 roughly matches GPT-5.5 and Claude Opus 4.7, frontier models released 2–4 months earlier: near-saturation on Cybench, human-expert baselines on biology tasks, with software engineering the one clear lag. On safety, it refused none of the offensive cyber or dual-use biology tasks. The contrast case is stark: Opus 4.7 refused so consistently that SaferAI couldn’t complete CyberGym on it at all. Z.ai has published no safety framework and no pre-deployment testing commitments. Open weights mean whoever self-hosts the model can strip the safeguards trained into it (published research has shown refusal behavior can be removed with as few as 10 fine-tuning examples), so the report’s practical meaning is this: a model a few months behind the frontier, with no guardrails of any kind, is now a free download (see also TechCrunch’s coverage).
Mistral open-sources Shieldstral, a 3B-parameter safety classifier
Mistral released Shieldstral: a 3-billion-parameter safety classifier that handles both text and images, open weights under Apache 2.0, and runs on a single 16GB GPU. The interesting design choice is moving moderation policy out of the weights and into the prompt: instead of a fixed taxonomy baked in at training time, you write your policy as plain-language questions at inference time, so policy changes don’t require retraining. It outputs calibrated scores rather than hard labels, which lets teams tune thresholds instead of accepting binary verdicts. Mistral’s own benchmarks claim it matches or beats open guard models up to 7× its size on text safety, refusal detection, policy adaptability, and multimodal tasks. I work in content moderation, and the pain point this targets is real: policies change far more often than models do, and retraining a classifier for every policy revision is a standing cost for moderation teams. Treat the benchmark numbers as vendor-reported until the false-positive and false-negative rates get checked on real traffic.
Some Claude shared chats are indexed on Google, exposing keys and personal data
404 Media found that some Claude “shared conversation” pages turn up directly in Google search. Exposed material included cryptocurrency wallet private keys, home addresses, an AI-built therapy app, and a medical billing dashboard. Anthropic’s response: share links aren’t guessable, the company doesn’t submit directories to search engines, and sharing a conversation makes it public web content. All true, but it misses the mechanism: once a share link gets pasted into any crawlable public page, crawlers follow it, and the fact that these pages appear in search results means the share pages carry no noindex tag (the page marker that tells search engines not to index). OpenAI hit a version of this problem last year, when shared ChatGPT conversations that users had marked “discoverable” showed up on Google; it pulled the feature and requested de-indexing. Noindex-by-default on share pages should be the factory setting for this product category.
OpenAI publishes iMessage records to counter Apple’s trade-secrets suit
Background: Apple sued OpenAI on July 10, alleging that former Apple engineer Chang Liu and former design executive Tang Tan funneled trade secrets to OpenAI’s hardware team. On August 3 Apple asked the court for a preliminary injunction (barring OpenAI and both men from accessing or using the disputed information before trial) plus expedited discovery. Hours later OpenAI published “Apple is getting this wrong,” calling the injunction request “based on false information and completely unnecessary because we do not have, nor want, any of their trade secrets,” and released iMessage records showing Apple employees repeatedly asking Liu where to find internal files after his January 22 departure, as late as March 5. Litigating by publishing the other side’s employee chats means talent-flow disputes between labs and incumbents are now fully public theater, and departure agreements will only get thicker from here (see also TechCrunch on the original suit).
Interpol: 55% of reported cybercrime in Africa involves AI
Interpol released its African Cyberthreat Assessment Report 2026: of cybercrime cases reported by 36 African member countries, 55% involved AI. Note the denominator — reported cases plus survey data, not all crime that actually occurred. Losses have more than doubled since 2024, from $192 million to $484 million; the report lists AI-assisted scams, credential harvesting, and automated social engineering among the leading threats. AI pushes the language barrier and marginal cost of fraud toward zero, and the regions with the thinnest defensive resources absorb the hit first. This report puts law-enforcement numbers behind that judgment.
Anthropic reportedly signs a $10B compute deal with cloud startup Volta
Per TechCrunch, citing Bloomberg’s reporting from anonymous sources (neither company has announced it): Anthropic signed a 6-year, $10 billion compute agreement with AI cloud provider Volta, using Volta’s 133-megawatt data center in Norway running NVIDIA’s Vera Rubin chips. Volta was founded earlier this year, is building the facility with crypto-mining firm Bitdeer, and belongs to NVIDIA’s Cloud Partner program. This follows Anthropic’s SpaceX compute deal announced in May and an additional $5 billion investment from Amazon in April. Frontier labs are now buying compute from neoclouds less than a year old: on the supply side, whoever holds power capacity and rack space gets the ten-figure long-term contract.
NIST joins the Genesis Mission with two “AI economic security centers”
NIST announced it is joining the Genesis Mission, the White House-led federal AI program that aims to double American science and engineering output within a decade, signing a memorandum of understanding with the Department of Energy and standing up two two-year sprint centers: one using AI agents and robotics to raise manufacturing output, including a project to increase drone production capacity tenfold in two years, and one on AI cyber defense for critical infrastructure such as power grids, telecoms, and water systems. No funding figures were given. The federal framing of AI keeps getting more concrete: an investment in production capacity and defense, not a research subsidy.
Today in one sentence: most of today’s items describe the same time gap — capability spreads on a monthly clock (GLM-5.2: 2–4 months behind the frontier, zero refusals, free to download) while safety infrastructure gets built on a yearly one (SAFE is still a draft RFC). Whether that gap closes matters more than any single model release.