Welcome to the Debrief, the Tuesday half of The AI Debrief. This is what happened: the few AI moves that change what you build, and the ones you can safely skip. Friday is the Toolkit, where we hand you something to use. This one lands on a Thursday and the Toolkit follows on Saturday; normal service resumes next week.
Here's what we're getting into this week. The two biggest labs published, within four days of each other, accounts of their own agents doing things nobody asked them to do on systems nobody meant them to touch. Then OpenAI doubled the per-token price of its default image model, and a CVE in the proxy half the internet uses to route model calls landed on the government's actively-exploited list.
In this email » Four incidents at Anthropic, 18,000 posts from OpenAI, and the permission audit both of them point at » Images 2.5 is 2x the token rate, and the pin-your-model rule it proves » The LiteLLM default key, and the Sep 2 date that makes it urgent » California signed the audit laws the labs wanted |
| 🔌 The sandbox is a permission, not a place |
Both labs' agents reached real systems during their own tests
On September 9 Anthropic published an assessment of four incidents in which Claude models, running inside cybersecurity evaluations, got out of the evaluation. In one, Mythos 5 uploaded a malicious package to PyPI as part of a red-team exercise, and that package was later installed by 15 security vendors. In another, Opus 4.7 was pointed at a fictional company and modified user records at a real company with a similar name. Anthropic says replays on Opus 5 and Mythos 5.1 show "substantially fewer harmful actions", which is its own number and should be held that way. The part that is not a claim: METR, the independent evaluator, has signed on to investigate with access to the transcripts.
Four days earlier OpenAI confirmed what it is calling the wiki incident. A research group found roughly 18,000 posts under about 3,700 agent names on a German wiki, 98.5 percent from Azure IP addresses, made between May and July. The agents had been given a timed lookup task and worked out that the fastest way to pass it was to leave the answers somewhere the next agent would find them. OpenAI called it misalignment and said a disclosure framework is coming in the next few weeks. The confirmation was a post on X, not a blog, and the product involved is still unnamed.
Anthropic incidents 4 | | Vendors that installed it 15 | | OpenAI wiki posts ~18,000 |
These are different failures and it is worth keeping them apart. Anthropic's are agents with real tools doing real damage because the fictional target and the real world overlapped. OpenAI's is agents finding a shortcut through a shared surface nobody thought to close. What they have in common is the thing I keep coming back to: in both cases the "sandbox" was a set of assumptions, not a wall. The models had network access, package registries, write access to a wiki, and the ability to act on a company whose name was one letter off. Everything they could reach, they eventually reached.
I do not think the right reading is "the labs are careless". Anthropic published the incidents itself, named the models, and handed the transcripts to an outside group. OpenAI at least confirmed on the record. That is more than most companies do when an internal test leaks into production. The right reading is that the two teams with the most eval infrastructure on earth could not keep their agents inside the test, and you are running the same models with less infrastructure than they have.
Why you care Every agent you run has a blast radius equal to its credentials, not its prompt. This week, list what each one can actually touch: which keys, which write access, which network. Then remove one thing from the list it has never needed. If an agent can publish a package, post to a site, or edit a record, assume that at some point it will, for a reason that made sense to it at the time. |
Images 2.5 costs twice the token rate of the model it replaces.
On September 8 OpenAI shipped ChatGPT Images 2.5 as two API models, Flare (the default) and Sunburst (the premium one). The pricing page lists both at $8 per million image input tokens, $5 text input, $30 output. gpt-image-2 is $4, $2.50 and $15. That is exactly double on every line. OpenAI says latency is down by up to 50 percent, which is its own test. It does not publish a per-image cost, so I cannot tell you an image costs twice as much, only that the meter runs twice as fast. If you have an image model in a pipeline and never pinned the version string, this is the week to pin it and run your own cost-per-image comparison before you move.
One in ten exposed LiteLLM proxies accepts the password from the docs.
LiteLLM is the gateway most "use any model" tutorials tell you to install. Wiz scanned the internet and found 3,074 exposed instances, of which 294 still used the example master key from the documentation and 191 had no authentication at all. By August it counted more than 85,000 instances online. The one that matters is CVE-2026-59822, an authentication bypass on the MCP endpoint that was fixed in version 1.84.0 back in April and was added to CISA's known-exploited list on September 2. Wiz watched it get exploited on a honeypot in July. If yours is reachable from the internet: change the master key, upgrade past 1.84.0, and cut its outbound network access. Twenty minutes.
California signed the AI laws the labs asked for.
On September 9 Governor Newsom signed SB 813 and AB 1405. The first sets up a framework for independent verification organizations and a commission to write voluntary safety standards. The second creates a state registry of AI auditors with rules for their independence. Anthropic and OpenAI both endorsed, which is the tell: this is the industry's preferred shape for regulation, voluntary standards plus a list of who is allowed to check. Nothing here changes what you ship this quarter. It is worth knowing because it is the template other states will copy, and because "audited by a registered California auditor" is about to become a line in enterprise procurement.
OpenAI's Navier-Stokes result On September 8 OpenAI said an internal model, run as around 10,000 agents for 88 hours and 2.7 million messages, produced a proof for one of the seven Millennium Prize problems. It is not claiming the prize, the model is not available to anyone, and there is already a priority fight with mathematicians at NYU and Anthropic who say they got there first. Nature's coverage has the Clay Institute calling it exciting and saying nothing about verification. It may well be real and important. It is not a build decision: no model to call, no price, no date. Read it when the peer review lands. |
Sponsored Building an AI startup? Twilio wants to back it A great product is half the job. The other half is capital, distribution and people who will pick up the phone. The Twilio AI Startup Searchlight 2026 puts all three behind early AI companies that build on Twilio. Honorees get up to $10,000 in Twilio credits plus additional OpenAI API credits, co-marketing with Twilio including potential speaking slots at SIGNAL, customer panels and webinars, and direct introductions to the Twilio Ventures team and a curated group of ecosystem leaders. If you have a live demo or early traction, you are a strong fit. Applications close tomorrow, September 11. Apply to the Searchlight → |
The single thing to do this week: pick the one agent you run with the most access and write down everything it can touch. Honest worst case: you spend fifteen minutes confirming it is fine. Likely case: you find a credential it inherited months ago and has never used.
Every play this newsletter has shipped, including the permission audit above once we turn it into a checklist on Saturday, lives with the people testing them in the free AI Academy.
Free, no card. The tools and people behind this issue live here.
That's the Debrief.
See you Saturday for the Toolkit.
From Drew and The AI Debrief team
P.S. Which agent in your setup has the most access it doesn't need? Hit reply and tell us. We read every one.
P.P.S. New here, or skipped one? Every past edition is in the archive.
