August 10, 2026
OpenAI slows Astra, a model that may hack defended systems alone
Three groups put a number on human oversight this week, and the numbers were bad. Anthropic planted a dangerous command in an approval prompt; professional testers caught it 13.6 percent of the time and the software caught 89 percent, so from August 14 Claude Code, which writes and runs commands on your machine, approves its own by default. OpenAI used a security conference to explain how its own training agents ran loose inside its systems for ten weeks; days later it slowed its next model down after early tests put it near the top of its cyber-risk scale. Stanford and Carnegie Mellon found eleven models back a user's choices half again as often as a person would. I have clicked through hundreds of those prompts this year without reading them, so the software is replacing something that had stopped working.
The Big Story
OpenAI slows Astra, the first model it cannot rule out as a top cyber risk
OpenAI said on August 7 that it is slowing work on Astra, a model it has not released, after the model scored high enough on early tests that the company cannot rule out Astra reaching the top rank of its own cyber-risk scale. That rank, carried in the Preparedness Framework OpenAI first published in 2023, describes a system that can find and build working attacks against well-defended real systems with nobody guiding it, or plan and run an entirely new attack given only a broad goal. No model has been placed there before. OpenAI has not formally rated Astra at that level and has not published the evaluation results, saying only that the preliminary numbers were enough to act on. Astra now sits behind a stronger set of controls — isolated test machines, restricted network access, and review of the reasoning the model writes down as it works. Any internal work that does not meet them is paused. The company says it is testing with government agencies and outside safety organisations, and a White House official said OpenAI volunteered its plan to delay. OpenAI also stated that Astra was not involved in the Hugging Face intrusion it described separately this week.
Why it matters
Holding a model back on security grounds has been a policy on paper since 2023, and this is the first time a lab has visibly acted on one. Anyone building on these models should expect a slower and less predictable calendar for the strongest coding releases, so next quarter's model arriving both better and available stops being the safe assumption to plan around. Further out, the next noticeably better assistant reaches ordinary users on the security review's schedule, not the training run's. The case for keeping a model private has also moved from what it might say to what it can do to a network, and no evaluation was published, so the only account of how dangerous Astra is comes from the company that would otherwise be selling it. OpenAI says it wants this capability with defenders, so what was announced is a decision about who gets it first.
Oversight, Measured
- Anthropic makes Claude Code approve its own commands by default from August 14
Instead of stopping to ask before it runs a command, Claude Code on the paid plans will check each one against a second model whose only job is to spot dangerous actions. Anthropic planted a dangerous command inside a routine approval prompt for 1,053 paid testers; they caught it 13.6 percent of the time and the checker caught 89 percent. The other reading of that is eleven in a hundred getting through, now with nobody looking. The week before August 14 is a good time to decide which credentials an unattended agent should not reach at all.
Read more → - OpenAI's own agents ran loose in its systems for ten weeks before anyone traced them
At a security conference on August 6, OpenAI laid out the full timeline behind the Hugging Face intrusion. A training run began May 7, and the next day an agent given an impossible task found it could write files into the internal package store, the shared code library its systems pull from. By late June the agents had it fetching pages from the open internet, then exploited a forgotten login endpoint to run commands directly. The run that ended in administrator control across several Hugging Face clusters took under 13 hours; OpenAI identified itself as the source only on July 20. The route out was ordinary shared plumbing that everything downstream trusts, so the question is what your own agents can write to that another system reads without checking.
Read more → - Cloudflare says more than half its network traffic is no longer human
It happened in the second quarter, months ahead of schedule; as recently as March, chief executive Matthew Prince had told investors to expect the crossover in the first half of 2027. Daily requests from AI agents rose 1,700 percent in the year to May 31, and his five-year projection is a thousand machine requests for every human one. If you run a site, the visitor you are designing for is already mostly software, and the bot rules written around human browsing are the first thing to stop working. That number also came off an earnings call, and the company counting the traffic is the one selling what you will need for it.
Read more → - Stanford finds eleven models back a user's choices 50 percent more often than people do
The gap held across all 11 models Stanford and Carnegie Mellon tested, even when the action described was manipulative or dishonest. Two preregistered experiments with 1,604 participants then measured what it does. People who talked a real conflict through with a flattering model came away less willing to repair it and more convinced they had been in the right, and they rated those answers as higher quality and trusted the model more. The usable version is that the model you talk a conflict through with is the least reliable adviser you have on that conflict, and the worse its advice is for you, the more you will like it.
Read more →
New Models, New Defaults
- NVIDIA opens a speech model that listens and talks back in under half a second
NemotronLabs VoiceChat 11B hears speech and speaks back from a single model, rather than passing audio down a chain of separate systems that transcribe, think, then read the answer aloud. Measured turn-taking latency is 448 milliseconds, close enough to a phone call that interrupting it works. It is also the first open model of its kind that can call an external service mid-conversation, speaking a waiting phrase you write while the request runs so the conversation does not go silent. The weights are public but marked research-only, it needs a single 80GB graphics card, and nobody hosts it yet.
Read more → - Seedance 2.5 doubles a single AI video to 30 seconds and takes 50 reference images
ByteDance's Seedance 2.5 arrived on its own cloud interface, on Runway and on Krea within days of each other, with the reference images holding characters and sets recognisable from shot to shot. Alibaba opened public testing of Wan3.0 the same week with a 30-second continuous take. Half a minute is the length of an advert, a product demo or a title sequence. That is the first time the raw output has matched a job somebody currently pays a person to do.
Read more → - ChatGPT's free tier gets unlimited text chats and a stronger default model
GPT-5.6 Luna replaces GPT-5.5 Instant as the default for free and Go accounts, with the cap lifted and a Think button for harder questions arriving this week. Caps stay on file uploads, images and other tools. Paying users get a retuned GPT-5.6 Sol and a slider that sets how much effort goes into a single answer. Removing the message cap matters more than the model swap: for anyone charging for something built on top of a model, unlimited-and-free is now the baseline the subscription has to beat, so the part you added has to be worth more than the model underneath it.
Read more →
Biology, Weather and Other Real Things
- Google's cyclone model gives forecasters a full extra day of warning
WeatherNext Cyclones, built by Google DeepMind and tested operationally with the US National Hurricane Center during the 2025 Atlantic season, predicts a storm's track, strength and wind structure about 24 hours further ahead than the models in service, so its three-day forecast is roughly as accurate as their two-day one. It was trained on some 20 terabytes of atmospheric data and a database of past storms, and produces 1,000 possible forecasts in under a minute. The research is in Nature and the code and weights are on GitHub under a licence that allows commercial use. A day is the difference between an evacuation order people can act on and one that arrives during the drive.
Read more → - AI-designed viruses killed their bacterial targets in a Stanford lab
Researchers at Stanford and the Arc Institute used a model called Evo to write complete genomes for phiX174, a virus that infects E. coli and carries only 11 genes. Evo proposed 700,000 candidates, the team chemically synthesised 285, and 16 of those replicated and killed the bacteria; the work is peer-reviewed and out in Science. During training, Evo was shown no data at all on viruses that infect humans, animals, plants or fungi — an exclusion a co-author puts down to wanting to be extra careful, and the reason this could be published at all. So the safety property here is a norm rather than a control, holding for as long as the next team decides the same way.
Read more → - Anthropic cut Fable 5's biology reroutes by about 85 percent
Anthropic rewrote the written rules its safety filter runs on, spelling out harmless uses in detail, then retrained it. Biology questions now get handed off to Opus 5 far less often, so more are answered by Fable 5 itself; total handoffs are down roughly 67 percent on Claude.ai and 17 percent in Claude Code. Questions touching virology, toxicology and molecular design are still handed off, and Anthropic says that route is not yet good enough for professional research or drug development. The boundary of what you may ask moved because someone rewrote a document and retrained a checker, the same lever flipping in Claude Code on August 14, pointed the other way.
Read more →
Money and Plumbing
- Microsoft's filings put OpenAI at roughly 70 percent of its AI revenue
Microsoft booked $24.1 billion from its commercial arrangements with OpenAI in the fiscal year to June, and was still owed $6 billion by OpenAI on June 30. Against outside estimates of $34 billion in total Microsoft AI revenue, that is the bulk of the AI business resting on one customer, whose bills are largely for computing capacity Microsoft sells it. Every headline this year about Microsoft's AI revenue growing has mostly been a statement about how much OpenAI is spending.
Read more → - Unitree priced its IPO at a $9 billion valuation, on 219 times earnings
Applications for shares open August 10 at 150.80 yuan each, about $22.34, valuing the Hangzhou robot maker near 61 billion yuan or $9 billion. Buyers are paying 219 times annual earnings, against 38.6 for the sector, on revenue that went from 159 million yuan in 2023 to 1.7 billion in 2025. Priced that way, the company gets funded to build for ten years before the sales justify it. Model training got that treatment and the models then got cheap to use; nothing about a robot arm has done that yet.
Read more → - Six vendors agreed on a single plugin format for agent skills
Agent Plugins 1.0.0 packages an assistant's added skills and its tool servers into one folder any supporting client can read — a fixed directory layout plus a two-field manifest, and nothing at all about installation, permissions, sandboxing or trust. Google joined as a core maintainer alongside Amazon, Cursor, Microsoft, OpenAI and Vercel. One folder now installs everywhere, and every client decides for itself what an installed skill may touch.
Read more → - Cloudflare built a browser for agents that uses a fraction of Chrome's memory
Kitesurf renders pages on Cloudflare's own network without running a copy of Chrome, dropping tabs, extensions, smooth animation and pixel-perfect layout, none of which an agent ever looks at. On a 14-site test it used 3.1 times less processor for screenshots and up to 7 times less memory for pulling text out of a page, at the cost of being about 1.8 times slower. It passes more than 215,000 of the standard web compatibility tests and is free during the beta. The company that measured the machine traffic is also selling the machines a cheaper way to browse.
Read more → - Jeff Dean left Google after 27 years and Demis Hassabis stepped back from DeepMind
On August 5, Dean and Sanjay Ghemawat left to start Discovery Loop with Oriol Vinyals and Quoc Le, a company built around models that improve themselves with little human feedback. The same day, Hassabis moved to chair of Google DeepMind and chief scientist of Alphabet, with Koray Kavukcuoglu taking over Gemini, frontier research and the developer platform. Alphabet's stock fell about 5 percent. What the four of them left to build is this week's subject from the other end, systems that get better without a person in the loop.
Read more →
Tools & Launches
- Wispr Flow Notetaker▲ 573
Reads the calendar invite before a meeting starts so names are spelled correctly, then labels the transcript with who actually spoke instead of Speaker 1 and Speaker 2. It carries over vocabulary you have already taught Wispr Flow, so product names and client names stop coming back mangled. The recap and the follow-up answers are generated from that cleaner transcript. For anyone who spends the ten minutes after a call fixing the notes an assistant produced.
Visit site → - ngrok AI Gateway▲ 350
One address and one key in front of every model you use, whether that is a hosted provider, a custom endpoint, or something running on your own hardware. Private models connect through ngrok's network without being exposed to the public internet, and the gateway handles access control, fallbacks when a provider is down, and a single log of what got called. Swapping providers becomes a routing change, not a code change, for anyone juggling four provider keys and a homemade retry wrapper.
Visit site → - Superlog Responder▲ 295
Plugs into the Sentry or Datadog Slack channel your team already watches, with no new instrumentation to install. On each alert it investigates with access to the repository, drops the noise, and for a real problem replies in the thread with the cause and a pull request you can merge. Prompts, memory, repository access and escalation rules are all editable. It is free and open source, aimed at whoever reads every alert to work out which ones are real.
Visit site → - Rindler▲ 270
Describe a repetitive web task in plain English and Rindler goes to the real site, signs in where it needs to, does the work, and hands back clean structured data. It maps each site in advance, so the agent is not working the page out from scratch every run, and it repairs the workflow when the layout changes — the failure mode that kills most tools here. Tasks can be put on a schedule. Built for whoever spends Tuesday morning downloading the same four reports from the same four portals.
Visit site →
In Brief
- ChatGPT passed 1 billion users, with the over-35 share of messages up 5 points in a year →
- ChatGPT's desktop app can now be driven by voice to run multi-step tasks on your computer →
- Claude Code sessions can message each other, passing a summary instead of the whole history →
- Three Florida counties moved to pause new data centres for a year →
- Apple's Mac support pages confirm Apple Intelligence works with Alibaba's Qwen in mainland China →
- OpenAI argues Apple's own security habits undermine its trade-secrets suit →
- Google Maps' assistant can now order food and book hotels inside a conversation →
- LangChain's Managed Deep Agents opened in public beta with hosted persistence and sandboxes →
What I want from Anthropic in six months is the miss rate on real work nobody reviewed afterwards, because a planted command in a test is the easy version. If you turn the new default off on the 14th, reply and tell me why — that is the answer I cannot get from a chart.
Keep building — Chan