OpenAI updates GPT-5.6 Sol and gives free users unlimited GPT-5.6 Luna
OpenAI is making GPT-5.6 Luna the default model for Free and Go users this week; unlimited text chats and a per-message Think button follow next week. On the paid side, the updated Sol is pitched at factual accuracy, and Plus and Pro users get a slider that controls how much reasoning goes into a response. In OpenAI’s internal evaluation on finance, medical, and legal prompts, responses with at least one factual error were 68% rarer for Sol and 62% rarer for Luna than for GPT-5.5 Instant. Two caveats: those numbers come from OpenAI’s own eval, and the announcement cites no external replication; and “unlimited” covers text only, while image generation and file upload caps stay. Unlimited access to the smallest model is a habit-building funnel; the real capability tiers stay behind the paywall.
40,000 game runs: humans approving agent commands let one threat in three through
scalex.dev built a browser game that simulates approving commands for an AI coding agent: over 40,000 sessions and 409,000 decisions, with mean accuracy of 66.3%, which the report itself summarizes as the average player missing one in three threats. Miss rates tracked how well the threat was disguised. An overt rm -rf / slipped past only 11.7% of the time, while data exfiltration hidden inside an npm run script got through 52.5% of the time; meanwhile, legitimate commands like rm -rf dist/ were wrongly blocked about half the time. This is a gamified experiment and players knew they were being tested, so it is not production data. But it matches what I see doing content moderation for a living: attention decays over a review queue, and the study’s miss rates did climb toward the end of sessions. If a human clicking “approve” is the last gate in your agent security design, this curve is that gate’s ceiling.
OpenAI partners with the American Psychological Association on youth mental health
OpenAI convened clinicians, researchers, and youth advocates together with the APA, working on how AI should respond to teens in emotional distress, how parents should handle AI use at home, and what clinicians and educators should watch for. The APA has also reviewed an early draft of OpenAI’s U18 Model Spec, the under-18 model behavior rulebook OpenAI published in December 2025. Bringing a professional association into the rule-writing is a reasonable step; whether any of it reaches actual model behavior is the part a partnership announcement cannot show.
LoginTrap: luring web agents to fake login pages works 86% of the time
A new paper describes a task-agnostic indirect prompt injection: planted page content convinces an LLM web agent that logging in is required to finish its task, then steers it to an attacker-controlled login page. The attack is black-box, generates page-specific injection text through a fuzzing-style process, and reaches 86% average end-to-end success across model backbones and agent architectures; the defenses tested in the paper failed to stop it. In the paper’s threat model, the attacker needs no access to your machine: controlling a page your agent might browse is enough, which matters once an agent operates the web with your account credentials. The authors call for authentication-aware defenses; the simplest version I can picture is an agent that halts and hands control back to a human whenever a page asks for credentials.
OpenAI’s counter: Apple’s own offboarding practices weaken its trade secrets suit
Apple sued OpenAI in July, claiming it obtained hardware secrets through former Apple engineers. In its motion to dismiss, OpenAI turns the security question around: Apple let employees keep work files in personal iCloud accounts, failed to revoke access after departures, and one manager stayed logged into former engineer Chang Liu’s personal iCloud to move files and ask for technical help. OpenAI also argues Apple still has not named the specific secrets that were taken. Whoever wins, the filing describes a failure pattern I suspect reaches well beyond Apple: offboarding collects the badge and the laptop, but not the work data that migrated into personal cloud accounts. As for the OpenAI hardware at the center of the fight, TechCrunch separately reports the first device is a smart speaker priced at $300 to $400, unconfirmed by OpenAI (see TechCrunch).
One line for today: In 40,000 rounds of the approval game, players let one threat in three through, with the commands right in front of them. If a human clicking “approve” is a valve in your agent security design, design on the assumption that the valve leaks, not on the fact that it exists.