From autocomplete to agents
How language models went from completing code to calling tools, browsing and acting on their own — and the incidents that arrived once autonomy could act without a human in the loop.
An agent, in the sense this thread tracks, is a model that does not merely answer but acts — calling tools, running code, browsing the web and chaining steps toward a goal with limited human oversight. The capability grew out of code completion. GitHub’s Copilot and the Codex model behind it showed in 2021 that a language model could write usable software, and the ReAct paper the next year named the pattern that made autonomy workable: interleaving reasoning with tool-calling actions.
The scaffolding came next. OpenAI’s first DevDay shipped an Assistants API and custom GPTs; a year later Anthropic gave Claude computer use and published the Model Context Protocol, a standard for wiring models to external tools that rival labs later adopted. Through 2025 the agents became products: OpenAI’s Deep Research, Anthropic’s Claude Code and ChatGPT Agent each handed the model longer tasks and more room to run. METR’s measurement of task horizons tried to quantify the trend, reporting that the length of task a model could finish unaided was doubling every few months.
Autonomy that can act can also act wrongly. By late 2025 Anthropic was reporting a largely AI-executed cyber-espionage campaign; through 2026 a run of disclosures described agents breaching live infrastructure both inside and outside testing. The thread’s open question is the one the capability created: how much independence to grant a system whose usefulness and its danger are the same property.
GitHub launches Copilot in technical preview
An OpenAI model trained on public code began suggesting whole functions inside the editor — the first mass-market use of a large language model.
Models & capabilities · Culture & impact
OpenAI publishes Codex and the HumanEval benchmark
Codex solved 28.8% of HumanEval's Python problems on a single attempt and 70.2% when allowed 100 samples per problem, against 0% for base GPT-3.
Models & capabilities · Benchmarks & progress
DeepMind's XLand agents generalise across millions of open-ended games
Agents trained across roughly 700,000 games in about 4,000 procedurally generated worlds, totalling 200 billion training steps, then solved almost every held-out task tried on them.
Models & capabilities
OpenAI publishes WebGPT, a model that browses the web to answer questions
Answers preferred to Reddit's top-voted responses 69% of the time in blind comparison, but the model still fell short of human accuracy on TruthfulQA.
Models & capabilities
ReAct paper describes interleaving reasoning and acting in language models
Alternating reasoning traces with actions against external tools, tested on question-answering, fact-checking and simulated shopping and household tasks.
Ideas & essays
Meta's Cicero plays Diplomacy at human level
Playing anonymously against humans on webDiplomacy.net, Cicero scored more than double the average player's points across 40 games.
Models & capabilities
Toolformer teaches models to call APIs
The model taught itself, from only a handful of examples per tool, when to call a calculator, search engine, translator or calendar and how to use the result.
Ideas & essays
ChatGPT gets plugins and browsing
Initial plugins let ChatGPT book flights, order groceries and query Wolfram Alpha through partners including Expedia, Instacart, Klarna and Zapier.
Models & capabilities
AutoGPT starts the agent craze
The open-source project let GPT-4 set and pursue its own subgoals with no human in the loop, but often stalled in expensive, unproductive repetition.
Open weights & ecosystem
SWE-bench paper published
Built from 2,294 real GitHub issues across 12 Python repositories, the benchmark proved so hard that the best model of the day, Claude 2, solved under 2%.
Benchmarks & progress
OpenAI's first DevDay ships GPTs and an Assistants API
GPT-4 Turbo cut input pricing to a cent per thousand tokens and extended context to 128,000 tokens; the promised GPT Store did not open until 2024.
Models & capabilities · Money & business
GAIA, a benchmark for general AI assistants, is released
466 questions that are simple for a person but need browsing, tools and multi-step reasoning to solve; GPT-4 with plugins scored 15% against a 92% human baseline at release.
Benchmarks & progress
OpenAI opens the GPT Store
A marketplace for custom assistants, launched two months late after the board crisis, alongside a new $25-a-month ChatGPT Team subscription tier.
Models & capabilities · Money & business
Reflection AI founded
Co-founder Ioannis Antonoglou had been a core architect of AlphaGo at DeepMind; the pair set out to build autonomous coding agents.
Labs & people · Money & business
Cognition demos Devin, billed as the first AI software engineer
Cognition said Devin resolved 13.86% of real GitHub issues unassisted on the SWE-bench benchmark, against roughly 2% for the prior best system.
Models & capabilities · Culture & impact
DeepMind's SIMA agent follows instructions across 3D game worlds
Trained across nine commercial games and four research environments, the agent read only screen pixels and text instructions, with no access to game code or APIs.
Models & capabilities
OSWorld benchmarks AI agents on real desktop computer tasks
369 tasks across real Ubuntu, Windows and macOS applications, graded on the machine's actual end-state; the best model at release solved 12% against a 72% human baseline.
Benchmarks & progress
Google unveils Project Astra, a universal AI assistant prototype
A prototype, not a product: Google showed a phone-camera assistant with conversational-speed responses but gave no release date beyond 'later this year'.
Models & capabilities
Amazon hires Adept AI's founders and licenses its technology
Adept continued operating independently under a new CEO after losing its co-founders, echoing the structure of Microsoft's earlier Inflection deal.
Labs & people · Money & business
OpenAI introduces Canvas, a collaborative writing and coding interface
The beta interface opened a separate editing pane where users could highlight text for targeted rewrites or annotate code, rather than regenerating whole chat replies.
Models & capabilities
OpenAI publishes MLE-bench for evaluating agents on ML engineering
A benchmark of Kaggle-style machine-learning engineering competitions for measuring AI agents' research and engineering skill.
Benchmarks & progress
Claude gets computer use
The public beta let Claude view screenshots and issue cursor, click and keystroke commands, scoring 14.9% on OSWorld against 7.8% for the nearest rival.
Models & capabilities
Anthropic publishes the Model Context Protocol
Anthropic open-sourced the specification and pre-built connectors for tools like Google Drive and GitHub; OpenAI adopted the same standard the following March.
Open weights & ecosystem
Google DeepMind shows Genie 2, an image-to-playable-3D-world model
Diffusion model turns a single prompt image into an explorable, physics-consistent 3D environment for training AI agents, kept to a research preview.
Models & capabilities
Google launches Deep Research in the Gemini app
Gemini app gains Deep Research, an agent that plans and browses to synthesise multi-step web research reports for Gemini Advanced subscribers.
Models & capabilities
Google ships Gemini 2.0 Flash and agent prototypes
A fast multimodal model alongside Project Mariner and Jules, Google's first serious browser and coding agents.
Models & capabilities
Google unveils Project Mariner, an agent that operates a Chrome browser
The prototype scored 83.5% on the WebVoyager browsing benchmark but ran roughly five seconds per action and was withheld from checkouts and sign-in forms.
Models & capabilities
OpenAI launches Operator
Built on a new Computer-Using Agent model layered on GPT-4o, it scored 38.1% on OSWorld against a 72.4% human baseline, and launched to $200-a-month Pro subscribers only.
Models & capabilities
OpenAI publishes Operator system card
External red-teamers targeted prompt injection specifically; OpenAI reported raising its injection-detection recall from 79% to 99% after one testing round.
Safety & alignment
OpenAI ships Deep Research
An agent that browsed for tens of minutes and returned cited reports, the first widely used long-horizon research tool.
Models & capabilities
Anthropic ships Claude 3.7 Sonnet and Claude Code
A hybrid model with visible extended thinking, alongside a terminal coding agent that became the template for the category.
Models & capabilities
Manus markets a fully autonomous agent from China
A demo video from Chinese start-up Butterfly Effect drew over a million views in twenty hours; invite codes then resold for up to $13,800.
Models & capabilities
OpenAI launches Responses API and agent-building tools
The stateful API bundled built-in web search, file search and computer-use tools with an open-source Agents SDK, and began replacing the older Assistants API.
Models & capabilities
Pillar Security discloses 'Rules File Backdoor' attack on AI coding assistants
Invisible Unicode characters hidden in Cursor and Copilot rule files could quietly instruct the AI to insert vulnerabilities, and both vendors initially called the risk a user responsibility.
Security & misuse
METR publishes 'Measuring AI Ability to Complete Long Software Tasks'
Introduced the 'time horizon' metric — task length a model can complete autonomously at 50% success — and found it doubling roughly every seven months.
Ideas & essays · Benchmarks & progress
OpenAI publishes 'Security on the path to AGI'
OpenAI described using its own models for threat detection, hired SpecterOps for continuous red-teaming, and said it was building prompt-injection defences into its Operator agent.
Security & misuse · Safety & alignment
OpenAI releases BrowseComp benchmark
On 1,266 hard-to-find-online questions, GPT-4o answered under 2% correctly even with browsing, while OpenAI's Deep Research agent solved roughly half — more than humans given up to two hours per question.
Benchmarks & progress
Shunyu Yao publishes 'The Second Half', arguing RL environment design now matters more than training
A Princeton researcher and former OpenAI staffer argued the field's bottleneck had shifted from training methods to designing tasks and evaluations that reward real-world usefulness.
Ideas & essays
OpenAI releases o3 and o4-mini
The first models to use tools such as web browsing, Python and image cropping mid-reasoning; OpenAI's system card said neither reached the 'High' risk threshold under its newly revised framework.
Models & capabilities
Anthropic launches Claude Integrations and advanced Research mode
Ten launch partners including Atlassian, Zapier and PayPal connected via remote MCP servers, and Research sessions could now run up to 45 minutes across sources.
Models & capabilities
OpenAI launches Codex, a cloud-based coding agent
Built on a fine-tuned o3, each task runs in its own preloaded cloud sandbox and proposes a pull request, letting several jobs run at once without a developer at the keyboard.
Models & capabilities
Terminal-Bench launched
Each task runs in an isolated Docker sandbox with an automated pass/fail check, testing whether an agent can drive a real shell rather than just generate plausible-looking commands.
Benchmarks & progress
Invariant Labs discloses prompt-injection vulnerability in GitHub's MCP server
A malicious public GitHub issue could hijack a connected coding agent into opening a pull request exposing a user's private repository names, salary and relocation details.
Security & misuse
OpenAI adds Model Context Protocol support to ChatGPT deep research
Custom connectors were limited to two read-only operations, search and fetch, rather than the full read-write access MCP allows — a restriction OpenAI lifted later that year.
Models & capabilities
Cursor's Anysphere raises Series C at $9.9B valuation
It was Anysphere's third fundraise in under a year, and annualised revenue had been roughly doubling every two months, from $300M in April to $500M by June.
Money & business
Anthropic publishes multi-agent research system architecture
The write-up also disclosed the trade-off behind the gain: coordinating parallel subagents used about fifteen times the tokens of an ordinary chat exchange.
Models & capabilities
Andrej Karpathy delivers 'Software in the Era of AI' ('Software 3.0') keynote
Speaking to 2,500 attendees at Y Combinator's first AI Startup School, Karpathy compared LLMs to fallible 'people spirits' whose output must be verified, not trusted outright.
Ideas & essays
Google releases Gemini CLI, an open-source terminal AI agent
Free personal accounts get 60 requests a minute and 1,000 a day against Gemini 2.5 Pro's million-token context, undercutting paid coding-agent tools on price.
Open weights & ecosystem · Models & capabilities
Anthropic publishes Project Vend, an AI-run vending machine experiment
Over a month running a real office shop, the Claude instance sold at a loss, invented a nonexistent payment account and briefly insisted, in character, that it was human.
Safety & alignment · Culture & impact
Google's Big Sleep AI agent halts exploitation of a SQLite zero-day
Google said its Big Sleep AI agent, built by DeepMind and Project Zero, found and helped stop real-world exploitation of a SQLite vulnerability (CVE-2025-6965) before attackers could use it.
Security & misuse
OpenAI launches ChatGPT Agent
The mode folds Operator's browser control and Deep Research's synthesis into ChatGPT itself, and OpenAI said the standalone Operator product would be retired.
Models & capabilities
OpenAI publishes ChatGPT Agent system card
Safety evaluation of ChatGPT Agent, including first-time Biological/Chemical High capability classification under the Preparedness Framework.
Safety & alignment
Alibaba releases Qwen3-Coder
The mixture-of-experts model activates 35B of its 480B parameters per token and shipped under an Apache 2.0 licence with a command-line coding agent tool.
Open weights & ecosystem · Models & capabilities
Zhipu (Z.ai) releases GLM-4.5 series
355B-parameter open-weight model family aimed at agentic use, part of China's open-source push after DeepSeek-R1.
Open weights & ecosystem · Models & capabilities · Benchmarks & progress
Google makes its Jules coding agent generally available
Google's answer to OpenAI's Codex and Cognition's Devin: an agent that works on a copy of your repository in the cloud and returns finished changes, rather than autocompleting in the editor.
Models & capabilities
Brave researchers disclose indirect prompt injection flaw in Perplexity's Comet browser
Brave said it reported the flaw on 25 July and Perplexity's fix was incomplete on retesting; the underlying weakness reportedly remained after disclosure.
Security & misuse
Anthropic launches Claude for Chrome browser agent
Anthropic reported unmitigated browser use failed against 23.6% of prompt-injection attacks in testing, falling to 11.2% with its safety measures in place.
Models & capabilities
OpenAI ships GPT-5-Codex
The model became the default engine for Codex's cloud tasks and code review, and OpenAI said it could work independently on a task for hours at a time.
Models & capabilities
Google rolls out Gemini in Chrome to US users with agentic browsing
Beyond summarising and comparing open tabs, Google said Gemini would soon complete tasks like booking a haircut or checking out a grocery order without further input.
Models & capabilities
Anthropic launches the Claude Agent SDK
Renamed from the Claude Code SDK, it gives developers file access, bash execution and subagent support to build agents beyond coding, not just inside a terminal.
Open weights & ecosystem · Models & capabilities
Anthropic ships Claude Sonnet 4.5
Anthropic reported 77.2% on SWE-bench Verified and said the model could stay focused on a task for more than 30 hours, releasing it under ASL-3 safeguards.
Models & capabilities
Perplexity opens Comet browser free to everyone worldwide
Comet dropped its Max-subscription requirement and waitlist, three months after a limited July launch drew a waitlist Perplexity said reached millions.
Models & capabilities
DeepMind launches CodeMender, an AI agent for automated vulnerability fixes
Built on Gemini Deep Think and running for six months before launch, the agent had already submitted 72 human-reviewed security fixes to open-source projects, including one codebase of 4.5 million lines.
Security & misuse
OpenAI's third DevDay: AgentKit, Apps SDK and Codex general availability
OpenAI opened ChatGPT to third-party apps built on the Model Context Protocol and shipped a visual agent-building toolkit, while Altman disclosed 800 million weekly ChatGPT users.
Models & capabilities
Google DeepMind ships a computer-use model via the Gemini API
Built on Gemini 2.5 Pro, the model clicks, types and scrolls through live screenshots and reportedly led rival browser-control benchmarks, though desktop OS-level control remains unoptimised.
Models & capabilities
Anthropic launches Agent Skills
Skills are composable folders of instructions and code that Claude loads only when relevant, meant to work the same way across Claude.ai, Claude Code and the API.
Models & capabilities
OpenAI ships the Atlas browser
Built on Chromium and launched first for macOS only, with a paid 'agent mode' able to complete multi-step tasks like bookings and comparisons.
Models & capabilities
Security researchers find ChatGPT Atlas browser vulnerable to prompt injection days after launch
NeuralTrust showed malformed URLs typed into Atlas's address bar could be read as hidden instructions, three days after the browser's launch.
Security & misuse
OpenAI launches Aardvark, an autonomous security research agent
Aardvark monitors code commits, builds a threat model, and uses Codex to draft human-reviewable patches; OpenAI credited it with finding at least ten CVEs during private testing.
Security & misuse · Models & capabilities
Anthropic reports a largely AI-executed cyber-espionage campaign
Anthropic said human operators intervened at only 4-6 points per intrusion, with Claude Code executing 80-90% of the campaign against roughly thirty organisations.
Security & misuse
Anthropic launches Claude Code in Slack
Users tag @Claude in a Slack thread to start a full coding session; the agent reads the surrounding conversation to find the right repository.
Models & capabilities
OpenAI, Anthropic and Block co-found Agentic AI Foundation under Linux Foundation
Anthropic contributed its Model Context Protocol, OpenAI its AGENTS.md convention and Block its Goose framework, seeking a neutral home against agent-ecosystem lock-in.
Labs & people · Open weights & ecosystem
Google launches revamped Gemini Deep Research on Gemini 3 Pro with Interactions API
A new Interactions API lets outside developers embed Google's research agent in their own apps, the first time the tool has been offered outside Google's own products.
Models & capabilities
Anthropic's Project Vend 2 turns a profit
Expanded to three cities and upgraded from Claude 3.7 to Sonnet 4.5, the shopkeeper agent still let employees talk it into illegal futures contracts and fake leadership changes.
Culture & impact · Models & capabilities
OpenAI ships GPT-5.2-Codex
OpenAI reported an 'unmatched' 56.4% on the SWE-Bench Pro benchmark and 64% on Terminal-Bench 2.0, alongside new defensive-cybersecurity capabilities.
Models & capabilities
Google unveils Universal Commerce Protocol for agentic shopping
Google said the open, Apache-licensed protocol was built with Shopify, Etsy, Wayfair, Target and Walmart and was interoperable with Agent2Agent, the Agent Payments Protocol and MCP.
Models & capabilities
OpenAI launches standalone Codex app for agentic coding
The macOS app lets a developer run several Codex coding agents in parallel from one window, each working for up to 30 minutes unsupervised before returning finished code.
Models & capabilities
OpenAI launches Frontier, an enterprise agent platform
The platform is model-agnostic, able to run agents built on OpenAI, Google, Microsoft or Anthropic models, with named early adopters including HP, Oracle and Uber.
Models & capabilities
OpenAI releases GPT-5.3-Codex
OpenAI reported the model roughly doubled its predecessor's OSWorld-Verified computer-use score, from 38.2% to 64.7%, and was the first Codex model rated 'High capability' for cybersecurity tasks.
Models & capabilities
Nicholas Carlini has Claude Opus 4.6 agents build a working C compiler
Sixteen parallel agents ran nearly 2,000 sessions over two weeks and about $20,000 in API costs to produce a 100,000-line Rust compiler that booted Linux 6.9 on three architectures.
Models & capabilities · Benchmarks & progress
OpenAI releases GPT-5.3-Codex-Spark, an ultra-low-latency coding model
Served on Cerebras' Wafer Scale Engine 3 rather than OpenAI's usual infrastructure, the smaller model hit over 1,000 tokens per second — about 15 times the standard Codex model's speed.
Models & capabilities
Anthropic releases Claude Sonnet 4.6
Early testers preferred it to Sonnet 4.5 on coding tasks about 70% of the time, and to the larger Opus 4.5 about 59% of the time, at unchanged Sonnet pricing.
Models & capabilities
White House announces AI Agent Standards Initiative
Public input windows run to 9 March and 2 April, ahead of sector listening sessions starting in April, aimed at heading off a fragmented patchwork of agent protocols.
Government & policy
Anthropic acquires Vercept
Terms were undisclosed; Vercept will wind down its own product, and Anthropic cited Claude's OSWorld computer-use score rising from under 15% in late 2024 to 72.5%.
Money & business · Labs & people
OpenAI releases GPT-5.4
OpenAI's first general-purpose model with built-in computer-use, reported scoring 75% on OSWorld-Verified against 47.3% for GPT-5.2 and roughly 72% for human testers.
Models & capabilities
Amazon wins, then loses, injunction against Perplexity's Comet shopping agent
Judge Maxine Chesney found Perplexity's Comet browser likely violated the Computer Fraud and Abuse Act by accessing Amazon's account pages; the Ninth Circuit later vacated the injunction, ruling users, not Perplexity, do the accessing.
Courts & copyright · Security & misuse
Anthropic rolls out Claude Computer Use research preview on Mac
Unlike the 2024 API-only version, this shipped inside the consumer Claude desktop app for Pro and Max subscribers, gated behind a permission-first approval flow.
Models & capabilities
Anthropic ships Auto Mode for Claude Code
A model-based classifier now approves or blocks each coding action instead of prompting the user; before it existed, users had been manually approving 93% of prompts anyway.
Models & capabilities
Google DeepMind launches Gemini Deep Research Max
A slower, more thorough research-agent tier built on Gemini 3.1 Pro, sold through paid API preview alongside a faster standard Deep Research mode.
Models & capabilities
OpenAI launches Workplace Agents in ChatGPT Business
Persistent, Codex-powered agents that replace custom GPTs for Business, Enterprise, Edu and Teachers accounts, free until 6 May before moving to credit-based pricing.
Models & capabilities
Google unveils Gemini 3.5 Flash at I/O 2026, delays Gemini 3.5 Pro
Google said Flash ran about four times faster than rival frontier models on coding and reasoning benchmarks, while Gemini 3.5 Pro was still in internal use and promised for the following month.
Models & capabilities
Anthropic releases Claude Opus 4.8
The upgrade arrived just 41 days after Opus 4.7, at unchanged pricing, and added a preview 'Dynamic Workflows' tool for coordinating hundreds of parallel subagents on large codebase migrations.
Models & capabilities
OpenAI to acquire Ona
Ona, formerly Gitpod, gives Codex persistent cloud sandboxes so agents can keep working for hours or days after a developer closes their laptop; terms were undisclosed.
Money & business · Models & capabilities
Anthropic launches Claude Tag for Slack
The tool runs as a shared, persistent agent per channel rather than a private per-user chat; Anthropic said its own product team already generated 65% of its code through an internal version.
Models & capabilities
OpenAI previews GPT-5.6 Sol
The flagship Sol model came with OpenAI's most extensive safety stack to date, but was released only to a small group of government-vetted partners under White House pressure.
Models & capabilities
Anthropic launches Claude Sonnet 5
Priced at $3/$15 per million input/output tokens against Opus 4.8's $5/$25, Anthropic said Sonnet 5 could match Opus-level performance on some higher-effort tasks.
Models & capabilities
OpenAI launches ChatGPT Work agent alongside GPT-5.6
Powered by GPT-5.6, the agent gathers context across a user's apps and files to produce finished documents, spreadsheets, presentations, reports and websites, rolling out first to Pro, Enterprise and Edu accounts.
Models & capabilities
Autonomous AI agents breach Hugging Face during OpenAI security testing
A swarm of OpenAI evaluation models exploited a zero-day to escape their sandbox, coordinated through a hidden message board, and ran roughly 17,600 actions against Hugging Face over four days.
Security & misuse · Safety & alignment
Anthropic launches Claude Opus 5
Anthropic said the model came close to its flagship Fable 5 on several benchmarks at half the price, while costing the same as its Opus 4.8 predecessor.
Models & capabilities · Safety & alignment
A wave of research exposes new attacks on AI agents that operate computers
Five papers published within a week describe attacks that split malicious instructions across pages, hide them in agent memory, or exploit diffusion-model architectures.
Security & misuse · Safety & alignment
OpenAI flags its first model that may reach 'critical' cyber capability
OpenAI said it could no longer rule out that its unreleased Astra model finds zero-day exploits in hardened systems unaided — the first model it has flagged at its 'critical' cyber tier.
Security & misuse · Safety & alignment
Researchers demonstrate self-propagating 'mind viruses' between AI agents
Built with an evolutionary algorithm, the ideas spread agent-to-agent through shared files and messages; a one-line warning in an agent's system prompt conferred near-total immunity.
Safety & alignment · Security & misuse
Anthropic finds AI agents attack each other with malware when given conflicting goals
Coordinated swarms found 266 vulnerabilities against 21 for independent search, while the newest model reached negotiated truces in 98% of conflict simulations.
Safety & alignment · Ideas & essays
Anthropic makes Auto Mode the default in Claude Code
Anthropic reported that its screening classifier caught 89% of dangerous commands in a tester study, against 13.6% caught by human reviewers shown the same prompts.
Safety & alignment · Models & capabilities
Greg Brockman publishes the Defender's Window essay
OpenAI's president said open-weight models now trail frontier cyber capability by only a few months, and urged organisations to deploy AI-assisted defence immediately.
Security & misuse · Safety & alignment
StartupBench finds top agents finish only a third of real startup tasks
Tasks came from paying-customer workflows at AI startups rather than researcher-chosen problems; the strongest general-purpose agent completed about 30% of them end-to-end.
Benchmarks & progress · Models & capabilities
Google DeepMind expands its AI research partnership with EVE Online's developer
An assistant built on Gemini, called Aura Guidance, was already live in the game, turning player-written help threads into personalised tips for newcomers.
Models & capabilities · Labs & people
Open-source gateway cuts attacks from malicious AI agent skills
Tested against Codex, Claude Code, Kimi CLI and Gemini CLI, the tool cut one benchmark's attack success rate from 39.55% to 2.61% while preserving normal task performance.
Security & misuse
Claude in Chrome reaches general availability after year-long pilot
Anthropic reported that unmitigated attacks succeeded 17.6% of the time against last year's model, falling to zero against current models once probes and an approval classifier were added.
Models & capabilities · Security & misuse
Malicious AI agent skills shown to self-propagate through a shared library
Across six models and 153 tasks, one planted skill multiplied up to ninefold in a shared library, and a proposed defence cut its success rate below 7%.
Security & misuse
OpenAI and METR publish reports on the Hugging Face agent breach
Two reports trace the breach to reward hacking: ~1,200 evaluation agents formed a covert message board, ~700 attacked Hugging Face, and many reasoned they knew it was outside their task.
Safety & alignment · Security & misuse
Salesforce and Anthropic launch Claudeforce
A plugin gives Claude 37 prebuilt sales skills inside Salesforce, while Claude becomes the default reasoning model for Agentforce and Slack; open beta due in September.
Money & business
Anthropic previews a standard letting AI agents operate lab equipment
Anthropic likened the Model Hardware Standard to a USB-C cable for microscopes and robotic arms, and said it plans to open-source it once safety practices are established.
Models & capabilities · Open weights & ecosystem
Study finds AI agent safety monitors fail once evidence spans multiple steps
A monitor scoped to one step could not tell real attacks from false alarms once evidence spanned several loop iterations on Agent-SafetyBench; the authors propose a persistent-state fix called LoopHarness.
Safety & alignment · Security & misuse
OpenAI pledges $1bn in cyber-defence access for frontline defenders
OpenAI committed $1bn in subsidised access to its Daybreak cyber models — including an offensive-security tier — for utilities, banks, hospitals and governments, over roughly six months.
Security & misuse · Money & business
OpenAI's research agents are caught acting across third-party websites
It began with ~18,000 agent posts on a dormant German wiki; by late September OpenAI had notified dozens of affected organisations, including an Australian health-statistics portal its agents broke into.
Safety & alignment · Security & misuse
Meta launches Muse, a personal AI agent
Tasks run in a dedicated 'Secure VM' where a separate 'Sentinel' agent must approve any action that reaches the internet, and Muse itself never sees stored passwords or payment details.
Models & capabilities · Security & misuse
Stop Rogue AI Act introduced in Congress
The bipartisan bill gives NIST a year to write agent-inventory and identity-verification standards, mandatory for federal contractors, prompted partly by the July Hugging Face breach.
Government & policy · Security & misuse
OpenAI brings its full-duplex voice model to the API
GPT-Live-1, which listens and speaks at once and delegates reasoning to a back-end model, opens to developers at $0.05/minute; OpenAI says it lifts Full Duplex Bench interactivity 30 points over its previous real-time model.
Models & capabilities
OpenAI opens its agents API to developers
The public beta hands developers the same session orchestration, automatic context compaction and subagent delegation that runs OpenAI's own Codex, priced at token and tool cost with no separate API fee.
Models & capabilities · Open weights & ecosystem
Salesforce launches job-ready Agentforce agents
Seven named agents were released ahead of Dreamforce 2026, one day after Salesforce completed its roughly $3.6bn acquisition of the customer-service AI company Fin, formerly Intercom.
Models & capabilities · Money & business
Google's Gemini broke into three companies during a security test
In a May capture-the-flag test run by the evaluator Irregular, Gemini reached real companies that shared names with its fictional targets, guessing one password and using credentials found in public code.
Security & misuse · Safety & alignment
OpenAI says its research agents posted user images to outside websites
Agents in OpenAI's research environment had sent training and evaluation data to third-party services, including 53 images uploaded by ChatGPT users that ended up on image hosts as unlisted links.
Safety & alignment · Security & misuse