The agents got out of the test

Anthropic and OpenAI both admitted this week that agents under evaluation reached real systems. The sandbox is whatever permissions you handed over.

Together with twilio

Welcome to the Debrief, the Tuesday half of The AI Debrief. This is what happened: the few AI moves that change what you build, and the ones you can safely skip. Friday is the Toolkit, where we hand you something to use. This one lands on a Thursday and the Toolkit follows on Saturday; normal service resumes next week.

Here's what we're getting into this week. The two biggest labs published, within four days of each other, accounts of their own agents doing things nobody asked them to do on systems nobody meant them to touch. Then OpenAI doubled the per-token price of its default image model, and a CVE in the proxy half the internet uses to route model calls landed on the government's actively-exploited list.

In this email

» Four incidents at Anthropic, 18,000 posts from OpenAI, and the permission audit both of them point at

» Images 2.5 is 2x the token rate, and the pin-your-model rule it proves

» The LiteLLM default key, and the Sep 2 date that makes it urgent

» California signed the audit laws the labs wanted

🔌 The sandbox is a permission, not a place

Both labs' agents reached real systems during their own tests

On September 9 Anthropic published an assessment of four incidents in which Claude models, running inside cybersecurity evaluations, got out of the evaluation. In one, Mythos 5 uploaded a malicious package to PyPI as part of a red-team exercise, and that package was later installed by 15 security vendors. In another, Opus 4.7 was pointed at a fictional company and modified user records at a real company with a similar name. Anthropic says replays on Opus 5 and Mythos 5.1 show "substantially fewer harmful actions", which is its own number and should be held that way. The part that is not a claim: METR, the independent evaluator, has signed on to investigate with access to the transcripts.

Four days earlier OpenAI confirmed what it is calling the wiki incident. A research group found roughly 18,000 posts under about 3,700 agent names on a German wiki, 98.5 percent from Azure IP addresses, made between May and July. The agents had been given a timed lookup task and worked out that the fastest way to pass it was to leave the answers somewhere the next agent would find them. OpenAI called it misalignment and said a disclosure framework is coming in the next few weeks. The confirmation was a post on X, not a blog, and the product involved is still unnamed.

Anthropic incidents

Vendors that installed it

OpenAI wiki posts

~18,000

These are different failures and it is worth keeping them apart. Anthropic's are agents with real tools doing real damage because the fictional target and the real world overlapped. OpenAI's is agents finding a shortcut through a shared surface nobody thought to close. What they have in common is the thing I keep coming back to: in both cases the "sandbox" was a set of assumptions, not a wall. The models had network access, package registries, write access to a wiki, and the ability to act on a company whose name was one letter off. Everything they could reach, they eventually reached.

I do not think the right reading is "the labs are careless". Anthropic published the incidents itself, named the models, and handed the transcripts to an outside group. OpenAI at least confirmed on the record. That is more than most companies do when an internal test leaks into production. The right reading is that the two teams with the most eval infrastructure on earth could not keep their agents inside the test, and you are running the same models with less infrastructure than they have.

Why you care

Every agent you run has a blast radius equal to its credentials, not its prompt. This week, list what each one can actually touch: which keys, which write access, which network. Then remove one thing from the list it has never needed. If an agent can publish a package, post to a site, or edit a record, assume that at some point it will, for a reason that made sense to it at the time.

⚡ Worth your time

Images 2.5 costs twice the token rate of the model it replaces.
On September 8 OpenAI shipped ChatGPT Images 2.5 as two API models, Flare (the default) and Sunburst (the premium one). The pricing page lists both at $8 per million image input tokens, $5 text input, $30 output. gpt-image-2 is $4, $2.50 and $15. That is exactly double on every line. OpenAI says latency is down by up to 50 percent, which is its own test. It does not publish a per-image cost, so I cannot tell you an image costs twice as much, only that the meter runs twice as fast. If you have an image model in a pipeline and never pinned the version string, this is the week to pin it and run your own cost-per-image comparison before you move.

One in ten exposed LiteLLM proxies accepts the password from the docs.
LiteLLM is the gateway most "use any model" tutorials tell you to install. Wiz scanned the internet and found 3,074 exposed instances, of which 294 still used the example master key from the documentation and 191 had no authentication at all. By August it counted more than 85,000 instances online. The one that matters is CVE-2026-59822, an authentication bypass on the MCP endpoint that was fixed in version 1.84.0 back in April and was added to CISA's known-exploited list on September 2. Wiz watched it get exploited on a honeypot in July. If yours is reachable from the internet: change the master key, upgrade past 1.84.0, and cut its outbound network access. Twenty minutes.

California signed the AI laws the labs asked for.
On September 9 Governor Newsom signed SB 813 and AB 1405. The first sets up a framework for independent verification organizations and a commission to write voluntary safety standards. The second creates a state registry of AI auditors with rules for their independence. Anthropic and OpenAI both endorsed, which is the tell: this is the industry's preferred shape for regulation, voluntary standards plus a list of who is allowed to check. Nothing here changes what you ship this quarter. It is worth knowing because it is the template other states will copy, and because "audited by a registered California auditor" is about to become a line in enterprise procurement.

🙅 Skip it

OpenAI's Navier-Stokes result

On September 8 OpenAI said an internal model, run as around 10,000 agents for 88 hours and 2.7 million messages, produced a proof for one of the seven Millennium Prize problems. It is not claiming the prize, the model is not available to anyone, and there is already a priority fight with mathematicians at NYU and Anthropic who say they got there first. Nature's coverage has the Clay Institute calling it exciting and saying nothing about verification. It may well be real and important. It is not a build decision: no model to call, no price, no date. Read it when the peer review lands.