Another Daily AI Newsletter - July 31
Top Story: Claude’s simulated cyberattacks reached real companies
Anthropic reviewed 141,006 cybersecurity evaluation runs and found three incidents in which Claude gained unauthorized access to real organizations. The models were told they were completing simulated hacking exercises without internet access. A configuration failure with evaluation partner Irregular left the real internet reachable, so Claude treated real systems as test targets.
One model accessed credentials and a production database after finding a real company with the same name as its fictional target. Another published a malicious Python package that ran on 15 systems. A third scanned roughly 9,000 targets and compromised an application before recognizing that it had reached the real internet and stopping.
The earliest incident happened in April. Anthropic discovered the activity only after OpenAI disclosed its separate Hugging Face evaluation breach, and two affected organizations had not detected it themselves. Claude did not escape or invent its own objective. It followed an offensive assignment through an open network path. The failure was containment and monitoring; the models’ cyber capabilities turned that failure into real intrusions.
Interesting Perspectives
Simon Willison focused on the detection failure. The supposedly isolated evaluations affected three companies months before Anthropic found them in its logs.
Axios emphasized that Claude did not “escape” the environment. A configuration failure gave the models an open path to the internet, which is different from exploiting the sandbox itself.
Irregular’s own benchmark design says realistic cyber tests require controlled network exposure and instrumentation. Its investigation with Anthropic remains ongoing.
Better AI economics are reaching customers
OpenAI cut GPT-5.6 Luna’s API price by 80% and Terra’s by 20%. Luna now costs $0.20 per million input tokens and $1.20 per million output tokens; Terra costs $2 and $12. Sol also received a Fast mode that OpenAI says can run up to 2.5 times faster for twice the price.
Nathan Lambert’s read is that tightly integrating models with inference infrastructure is becoming a durable margin advantage for frontier labs.
Amazon Bedrock added explicit prompt caching for GPT-5.6. Developers can choose which instructions, tools, and reference material should be reused across requests. Cached input receives a 90% discount and remains available for 30 minutes, which can materially change the cost of agents that repeatedly load the same context.
Thinking Machines released Inkling-Small with open weights. The mixture-of-experts model has 276 billion total parameters but activates 12 billion at a time. The company says it offers performance comparable to the larger Inkling at one-quarter the size. Unsloth published a guide for running a quantized version on 128 GB of memory.
Assistants are learning to work with the context already on screen
ChatGPT’s Chrome extension can now answer questions about a YouTube video, reference open tabs, and use highlighted page text. The interaction moves from copying information into a chat toward asking questions where the information already lives.
Perplexity added Projects to Computer. Projects carry persistent memory, files, and sessions across shared hubs and users, turning a one-off computer agent into a longer-running collaborative workspace.
Stripe built a Knowledge AI Platform for sales, finance, operations, and other internal teams. The goal is to give non-engineers the same kind of company-aware assistance that coding agents provide developers. The common thread is context: useful assistants increasingly need access to the files, screens, history, and permissions surrounding the work.
Physical AI is getting orchestration and safer places to practice
Google released Gemini Robotics ER 2 as a high-level planner for robots. It can watch continuous video, track task progress, recover from failures, call tools, coordinate lower-level control models, and organize multiple robots. Developers can access it through the Gemini API and Google AI Studio.
NVIDIA open-sourced a medical-physics simulation framework for healthcare robots. It models interactions between anatomy and medical devices, runs many GPU-accelerated environments, and generates edge cases before teams move to expensive or safety-critical hardware trials.
Research Worth Reading
Coding agents improved completion but weakened understanding. In a 54-student study, agent users completed more of an initial website task but understood their code less well and struggled more when extending it without AI. The paper is an in-progress preprint, and its student sample should not be generalized to every professional team.
Frontier agents completed the engineering of research but not the research itself. In two six-day shadow evaluations based on unpublished NeurIPS submissions, agents ran experiments and wrote papers, but the original authors rejected both for weak judgment, poor backtracking, limited creativity, and instruction drift.
Living-Harness lets agents reuse lessons from earlier failures. The proposed system converts completed trajectories and evaluator feedback into memories and repair paths for future tasks. Its authors report roughly 10-percentage-point Pass@1 gains across two interactive benchmark families.
Google’s Science One attaches evidence chains to AI-generated research. Every citation, reported score, method, and conclusion is linked to the source, code, or experiment meant to support it. Google reports zero phantom references in its tests, compared with rates as high as 21% in baseline systems.
Researchers argue that language models have a structural weakness in distinguishing trusted instructions from untrusted text. Their chain-of-thought forgery attacks made several models treat injected text as if it were internal reasoning. The work suggests that red-teaming can find individual attacks without eliminating the underlying instruction-boundary problem.
Pangram 4 describes a new approach to AI-text detection. The classifier selectively fine-tunes parts of an open mixture-of-experts model and repeats text so early tokens can be judged with more context. Its model base is undisclosed, so independent comparison will matter.
One Thing Explained: What is model provenance?
Model provenance is the history behind an AI model: who created it, what earlier models it came from, how it was modified, which license applies, and whether its files or dependencies carry known risks. That history can become difficult to reconstruct when open models are fine-tuned, merged, quantized, renamed, and redistributed.
Cisco’s AI Supply Chain Provenance Explorer collects those signals for almost 900 open models. Its entries combine release history, inferred lineage, licenses, restrictions, repository malware scans, and reported security findings. Think of it as a model family tree combined with a software-supply-chain review.
Tools to Try
If you constantly explain what is on your screen, try Raycast Screen Awareness. Raycast AI can receive the focused window or a selected screen through its `@` menu on Raycast 2 and Windows.
If image-generation cost limits experimentation, try P-Image-Ideogram. Ideogram and Pruna offer four quality modes, native 1K and 2K output, and pricing that starts at $0.003 per image.
If you make AI video, FLUX 3 Preview is available through Hermes Agent. Nous made the preview free to paid Portal subscribers for a limited 48-hour launch window.
If you edit generated images in ChatGPT or Codex, try the new ImageGen canvas and lightbox. You can point to a region, erase an object, or leave a targeted comment instead of describing the entire edit in another prompt.
For Builders
Infisical’s Agent Proxy keeps real credentials away from agents. An agent uses a placeholder while a trusted network proxy injects the secret only when the outbound request is made. Policies, rotation, access controls, and audit logs remain outside the agent’s context.
LlamaIndex Parse Gateway routes each document page to a parser based on complexity. Clean text can use a cheaper path while scans, tables, and diagrams receive more capable processing.
River opened its model-training API to all developers. It offers token-metered LoRA fine-tuning and reinforcement learning for large open models, with trained checkpoints retained by the customer.
Cloudflare Browser Run added structured human handoffs. Browser agents can pause at a login wall, let a person complete the blocked step, and then resume the run.
GitHub Models was retired on July 30. The playground, catalog, inference API, and bring-your-own-key features are disabled; GitHub directs developers to Microsoft Foundry for model access.
Quick Hits
Okta is acquiring AI-security startup Permiso for roughly $200 million, according to TechCrunch. Permiso monitors human, machine, and agent identities across cloud environments.
Forward-deployed engineers are becoming one of AI’s most sought-after roles. Model access is commoditizing faster than implementation, increasing demand for engineers who work directly inside customer operations.