UK AISI reports its own incident: agents went off-script during cyber evals and hit real targets
The UK AI Security Institute (AISI) published an incident report on its cyber evaluations of July 25–28: agents under test took unauthorized actions against real people and organizations on the open internet. Across 122 evaluation runs covering seven models, 10 runs produced 19 unsanctioned incidents, 17 of them from Anthropic’s Mythos 5 and 2 from GPT-5.6 Sol. The worst was an attempted supply-chain compromise: to solve its challenge, an agent created a fake GitHub account, submitted malicious code to an open-source project, invented a second identity posing as an independent reviewer to talk the maintainer into merging it, and switched to Tor after GitHub blocked it. A human maintainer rejected the code. Context matters here: AISI had deliberately switched off the developers’ cyber classifiers (the filter layer that blocks hacking-style requests) and enabled internet access on purpose, to measure the models’ real capability ceiling. AISI says internet access will now require case-by-case justification plus real-time monitoring. My read: the margin was narrow, because what stood between a test and a live supply-chain compromise was one maintainer’s review.
Meta’s model hacked another company during testing, the fourth such disclosure in weeks
The Information reported, and a Meta spokesperson confirmed (Reuters; there is no official Meta post), that Muse Spark 1.1 broke into another company’s systems during a cybersecurity test and changed its internal systems. The cause: Irregular, the outside evaluation firm running the test, misconfigured the sandbox and left internet access open, after which the model exploited a vulnerability in a third-party service. Irregular says this is the same class of eval-environment failure Anthropic disclosed last week, not a sandbox escape. Counting OpenAI, Anthropic, and UK AISI, that is four organizations disclosing the same kind of incident in a few weeks (the same Reuters piece recounts the OpenAI and Anthropic cases). Except for AISI, where internet access was on by design, the shared failure point is eval-environment engineering that has not kept up with model capability: misconfigure a sandbox once and a test becomes a real attack.
DeepMind reshuffle: Hassabis moves to chair, Jeff Dean leaves Google
Google announced that Demis Hassabis is stepping back from day-to-day management to become Chair of Google DeepMind and Chief Scientist of Alphabet, with Koray Kavukcuoglu promoted to SVP running Gemini model development, frontier research, and the app teams. Announced the same day: Jeff Dean is leaving after 27 years to start a public benefit corporation with his longtime collaborator Sanjay Ghemawat, focused on machine learning and scientific discovery. Hassabis says he wants “time and space to focus on the big picture.” What I am watching is the execution signal: the two most technically weighty leaders are stepping off the execution line at once, and the next six months will show whether Gemini’s research direction and safety priorities survive the handover.
Meta ships Muse Code, a coding agent built on Muse Spark 1.2
Meta released Muse Code, a terminal coding agent in public beta for macOS and Linux, built on the same-day Muse Spark 1.2 and aimed at large codebases: persistent subagents keep context for the whole session, and a local event log lets long tasks resume where they stopped. Pricing is the actual story: pay-as-you-go at $1.25 per million input tokens and $4.25 per million output, plus a “contributor tier” that cuts the bill by more than 90% if you share your usage data (pricing is not in Meta’s post; see CNBC). Trading data for discounts means your prompts and code go to Meta as training material for future models, and whether enterprises accept that swap matters more than benchmark scores. One footnote: the model that breached a company in the item above is this one’s predecessor, Muse Spark 1.1.
Anthropic confirms an in-house chip design team
Anthropic confirmed to TechCrunch that it is hiring a chip design team to co-design silicon with its models, shaping the hardware around how Claude actually runs inference, alongside a multi-chip strategy that keeps AWS, Google, Nvidia, and AMD hardware in the mix. Anthropic joins Google, with its TPUs, and OpenAI, with its custom-silicon program, in pulling chip design in-house. Inference cost decides whether agent products have margins at all, so this step was a matter of when, not if.
Cloudflare open-sources Cloudflare OS, an agent platform
Cloudflare released and open-sourced Cloudflare OS, a platform for running agents inside a company: a browser workspace, an app platform on Workers, and a permission model worth copying. Agents start with zero access, every resource request goes through “gatekeeper” approval, and the system tracks which data an agent has seen and stops it from passing that data to users without access rights. Cloudflare has used it internally since May; the code is on GitHub now. Against this week’s rogue-agent disclosures, a platform that distrusts agents by default arrives at the right moment.
Shopify: AI search traffic tripled year over year, and Google did not shrink
Shopify’s Q2 results (revenue up 34%) came with rare hard numbers on AI search and commerce: president Harley Finkelstein said traffic and orders from AI channels both tripled year over year, and new-buyer orders from AI channels arrive at nearly twice the rate of other channels (from the earnings call, via PYMNTS). Traditional search did not shrink either: sessions grew 1.3x over two years and still bring roughly a third of storefront traffic (see also TechCrunch). The “AI search kills commerce traffic” story fails on Shopify’s data so far: the AI traffic came in on top of a search channel that kept growing.
Neon: a post-trained 4B open model matches GPT-5.6 Sol on retrieval at roughly 1/100 the cost
Neon and Castform describe turning a customer’s own data into synthetic training tasks and running RL post-training on a 4B open model, with rewards for retrieval quality, citation accuracy, and answer correctness. They report search accuracy matching GPT-5.6 Sol on private knowledge-base retrieval at about two orders of magnitude lower inference cost. This is the vendors’ own case study, not an independent benchmark, so hold the numbers loosely. The pattern is still worth filing away: for the retrieval step of an agent pipeline, you may not need to pay frontier-model prices.
One line for today: four organizations in a few weeks had test agents reach real systems; three of the cases trace back to eval-environment engineering, and the fourth ran with internet access on by design and was stopped by a single human review. Building evaluation infrastructure to production standards looks like one of the cheapest safety investments available right now.