Auto mode becomes the Claude Code default on August 14
Starting August 14, Claude Code on Pro, Max, and Team plans switches its default from per-command approval to auto mode: a classifier screens each action for anything irreversible, destructive, or reaching outside your environment. Three consecutive blocks, or twenty in a session, drop you back to manual approvals; Shift+Tab switches anytime; Enterprise and API stay opt-in for roughly another month. The justification is blunt. In Anthropic’s own study of 1,053 paid testers, humans reviewing commands one by one caught 13.6% of dangerous ones, while the classifier caught 89%; a prompt-injection evaluation Anthropic commissioned from a third party, Trajectory Labs, saw 0 of 720 attacks succeed against Claude models running auto mode, versus up to 5.83% success against competing systems. Vendor-independent data points the same way: two days ago I wrote about a 40,000-round public simulation in which players let through roughly a third of malicious commands. One caveat: the 13.6%-versus-89% comparison comes from a study Anthropic designed itself, and the attack scenarios in the commissioned evaluation also came from Anthropic. The direction is believable; the magnitude needs independent replication.
NYT: Amazon’s planned Texas data center is permitted to out-emit every US power plant
Amazon plans to build its own gas power plant for a new data center in Pecos County, Texas, permitted to emit 33 million tons of CO2 a year, which the New York Times calculates is more than any power plant currently operating in the US (the original report is paywalled; linked here via TechCrunch). Amazon’s emissions rose 16% last year, moving away from its 2040 net-zero pledge, and a spokesperson’s response was that “the world looks different now than when we co-founded the climate pledge.” The energy cost of the AI buildout has reached the scale where a single facility can set a national record, and the corporate language is shifting from how to meet the pledge to why the pledge’s world no longer exists.
Paper: safety benchmarks test the API, users get the product
Four researchers took 401 prompts from BBQ (a bias benchmark) and SafetyBench (a safety benchmark) and ran them against ChatGPT through both the web UI and the API, with and without web search, collecting 4,812 responses. The web UI scored lower than the API; enabling search cut accuracy by up to 8 more percentage points; repeating the same prompt produced inconsistent answers on up to 21% of prompts. Practitioners have felt most of this anecdotally; the paper’s contribution is measuring it systematically, and naming the structural blind spot: safety evaluations certify a bare model over a single API call, while the deployed product (UI scaffolding, search, citations) behaves differently. Scope note: only ChatGPT was tested, so whether this generalizes to other products is open.
DreamGuard: a guardrail that predicts where the trajectory is going
Runtime guardrails for LLM agents mostly check actions one at a time, which misses long-horizon risk: each step looks harmless, the sequence does not. DreamGuard runs a risk-aware world model that keeps a compact latent state over the trajectory and predicts future states, fusing an immediate-hazard signal with a cumulative-risk signal into the intervention decision. It reports the best safety-utility trade-off across four benchmarks at an average of 25 ms per call. Read it next to today’s top story: Anthropic describes the auto mode classifier as screening each action, which is the per-action pattern this paper argues misses long-horizon risk. Whether the classifier keeps any state across a trajectory is not something the announcement says either way.
PromptShield Home: smart-home agents can’t tell the TV from their owner
For smart-home agents, prompt injection arrives through the environment itself: speech from a television, text on a screen, an overheard conversation, any of which can be taken as a real command. The paper evaluates three layers of defense and finds they fail in opposite ways: traditional detectors act on nearly everything, executing injected commands as if they were real, while multimodal models refuse too many legitimate commands. The best single layer got 76.5% of decisions right; an oracle combining the correct decisions of all three reaches 94.1%. The most alarming result: every multimodal model configuration tested missed genuine emergencies such as falls, which is the one scenario a consumer deployment cannot afford to miss.
ARIA: backdoors hidden in customized coding assistants, and detectors miss them
Many platforms let users build coding assistants from a custom system prompt and share them, GPT Store style; the model weights never change, so the whole attack surface sits in the instruction layer. ARIA is an automated red-teaming framework that uses an attacker LLM to iteratively refine malicious custom instructions, optimizing stealth, clean-task performance, and backdoor effect at once: 94.5% attack success while keeping the best clean-task utility across tasks, and false negative rates reaching 100% against platform-side and user-side detection. The practical takeaway for developers is uncomfortable: when you code with someone else’s shared assistant, the trust boundary is the system prompt, a layer you usually cannot see.
MMAligner: multimodal jailbreaks as a coverage bug with a cheap fix
A familiar alignment gap in multimodal models: the same harmful request gets refused as plain text but sails through as a semantically equivalent image-plus-text input. The paper’s diagnosis is that unsafe multimodal inputs land outside the model’s existing refusal boundary internally; the refusal capability is there, the coverage is not. Their fix calibrates the internal representation of such inputs back inside the boundary, reaching about 99% refusal on unsafe multimodal inputs with under 2% quality loss on benign ones. If the diagnosis holds, a good share of multimodal jailbreaks can be patched at very low training cost.
Firebird switches on an AI factory in Armenia, which NVIDIA calls the largest in the CIS
Firebird launched an AI data center in Hrazdan, Armenia, with plans to reach 300 megawatts of capacity and over 70,000 NVIDIA Blackwell and Rubin GPUs by the end of 2027. The factory runs on Dell PowerEdge servers, NVIDIA says it intends to invest in the company, and Perplexity is an early customer. Compute geography keeps spreading: after the Middle East and Southeast Asia, a small Caucasus nation is now building a regional hub under the sovereign-AI banner, and NVIDIA is happy to show up for every one of them.
One line for today: per-command approval lost its default status because the data keeps showing humans are bad at it; but per-command review, human or classifier, shares one blind spot, which is risk that accumulates across steps while each action looks harmless. Trajectory-level guardrails exist in papers like DreamGuard; I haven’t seen a shipping product advertise one yet.