Deceptive dating app network

A criminal AI supply chain has established a range of pathways to farm victim API keys and session tokens. One such approach involved masquerading as real AI service providers to deliver malware.

The operators treated the AI supply chain itself as both a target and a resource. They stole AI API keys from multiple target environments and used them to provide additional AI compute.

The use of AI during intrusions and data theft operations often resembles 'vibe hacking,' wherein operators direct AI to achieve general goals like using a credential for an entity or retrieving data from a broad set of targets, then allow the AI to evaluate the environment, author and execute scripts, provide summaries, and repeatedly execute until the task is complete.

The actor used AI at every point in their operations: Reconnaissance, Initial access, Collection and exfiltration, Maintaining access.

One French-speaking operator going by the aliases of (MeowSHA | frkoo | blazespider) ran a distributed credential-harvesting pipeline across a fleet of 10 AWS EC2 workers. This pipeline mass-downloaded 1.8 million distinct Android APKs from multiple app-store sources, decompiled them, and scanned for hardcoded secrets with TruffleHog.

The result of the above is that AI has inverted the cost back onto defenders. Previously, defenders might have been able to slow an attacker's operational tempo via the deployment of a new detection.

The cybersecurity skills of AI models means that AI has collapsed the labor and tooling gap that used to separate well-resourced, state-sponsored operations from individual operators.

A new generation of intelligence

ExploitGym

We have also strengthened our protections against potential cyber misuse, building upon our safeguards stack for GPT‑5.6 Sol. These include stronger model robustness to better withstand potential jailbreaks and more context for our monitoring systems.

Astra brings together years of research and big bets across pre-training, reinforcement learning, and alignment. Astra is state-of-the-art on computer use, browsing, software engineering, cybersecurity, science, and professional work.

Astra supports Zero Data Retention for eligible API customers, and as we shared last month, we're testing Private Safety Processing to strengthen safety monitoring while preserving customer privacy.

OpenAI API Standard pricing is $10 per million input tokens and $50 per million output tokens. Fast mode is available for GPT‑6 Astra in the API and delivers up to 2x the speed of Standard processing at 2x the Standard price.

GPT‑6 Astra is rolling out today to a limited set of organizations and over the coming days will become available to all ChatGPT Plus, Pro, Business, and Enterprise users, as well as through the OpenAI API and AWS.

Astra is also more likely to operate within the boundaries set by the user and implied by its environment. In an internal evaluation, Astra never attempted to circumvent a Codex Auto-Review denial.

During the evaluation, Astra even discovered and used two previously unknown zero-day vulnerabilities. We are disclosing both vulnerabilities to their maintainers.

Astra causes fewer misaligned outcomes than any other frontier models tested. For a fair comparison, we used a generic computer-using-agent harness...

On ExploitBench, Astra achieved a perfect score of 100%, compared with 78.5% for GPT‑5.6 Sol, our previous frontier cyber-capable model.

Astra is our most aligned model, with substantial improvements in understanding user intent and model behavior—you can delegate tasks with greater confidence in Astra's judgment.

We open-source our automated alignment research harness

Claude used activation steering, which adjusts the model's internal representations during generation, to nudge the model away from sycophantic patterns and produce cleaner training examples.

Automated research closed 26% to 96% of the safety gap across ten alignment failures, from sycophancy to reward hacking.

Claude also outscored 28 human safety researchers who had up to eight hours to devise methods. On deception, for example, Claude's best method performed 20% better than the best human proposal.

evaluations like Petri are only proxies for real-world misalignment, and we did not test whether alignment gains persist after extensive RL training on other tasks.

the alignment failures studied were narrow compared to those in production (e.g., we didn't measure political biases), some failures may occur so rarely or emerge so recently that no benchmark exists to measure them.

On sycophancy, for example, 98% of proposed methods used one published technique: training the model on its own non-sycophantic answers.

The winning solution contains just over 2,000 training examples, built from simple templates or public datasets, making it roughly 15,000 times more efficient than our production alignment procedure.

Claude submitted more than 150 attempts at mitigating deceptive behavior, and achieved a final performance of 82% of the safety gap closed in this run.

OpenAI官方发布视频："这就是GPT-6 Astra——任何你能在电脑上做的事，Astra都能替你做，而且更快。"发布不到一天播放量破千万

但用户明显陷入困境时，仍然可能配合提供有害内容

人类用AI辅助决策但没认真核实，一样能捅出大篓子

各层都在同步赚钱

Scam Altman and Greg Stockman

人负责高维度的标注、评论、反馈这些事情，Agent 去做执行的工作

给它足够的上下文来做基本的合理性检查，限制谁的反馈有权影响技能更新

改进 Skill 在不同用例之间具有很高的复用性

如果反馈太麻烦，你就收不到反馈，也就无法改进 Skill

对于那些有明确标准答案的领域，比如代码是否通过了测试、部署是否成功，可以先建一个验证基准

一位资深工程师给出的少量、详细且与领域相关的反馈，可能比大量草率反馈更有价值

Agent 根据人类对模型结果的标注（人类对代码审查的评论），去改进技能

The response body uses the provider's OpenAI-compatible format. Reef adds the x-reef-agent-record-id response header. Its value is the receipt that a later report uses to identify this interaction.

Reef supports two learning surfaces: model weights and agent harnesses. The deployment's recipe determines which surface its scenarios update.

Reef's artifact and checkpoint functionality requires the git-lfs system package. Reef initializes Git LFS locally for its artifact repositories.

Reef is infrastructure that serves an entire continual learning backend. Reef exposes standardized http endpoints so that you can download agents just like how you download codex or opencode using curl, and so that your agent can send its model requests to Reef's inference endpoint instead of the provider's.

This reproduces the observed timing and workload topology, but not any dependencies hidden inside the harness. These are things we hope to improve on in subsequent versions of AgentX.

Considering the characteristics above, benchmarking these workloads is fundamentally different from the existing fixed sequence length benchmarks.

One thing worth mentioning is that these request distributions will look different depending on which harness is being used, since different amounts/types of context are injected

independently reproducing the findings of published scientific papers without being told the answer in advance.

Rather than developing its own coding tool, it had Faraday use OpenAI’s GPT-5.5 Codex instead, much the way human scientists lean on existing software rather than building everything themselves, according to the company.

Measured against Anthropic’s Claude Opus 4.8 and OpenAI’s GPT-5.5 — both much larger, frontier-scale systems — Faraday runs on a comparatively tiny model called Qwen 3.6 that has just 27 billion parameters.

This suggests that the models can identify which dataset an audio sample comes from and select the spelling convention that benchmark expects, even though both forms sound identical.

On LibriSpeech, some of the strongest benchmark-performing models reproduced masked numbers in roughly 30–40% of examples, even though the number itself had been removed.

The models with the lowest WER—and therefore the strongest reported benchmark performance—are also the most likely to reproduce these errors.

A model that absorbs permissions into itself has dissolved permissions. Absorption doesn’t end the harness. Absorption inverts the harness.

Adding only retained reasoning and compaction, GPT-5.6 Sol’s ARC-AGI-3 score tripled from 13.3% to 38.3%.

ran the same model over the same 106 tasks in different harnesses, and scores ranged from 52.4 to 76.2: a 23.8-point spread with zero change to the model.

Trials measure efficacy, but the world cares about effectiveness. Today, benchmarks lack even a good measure of efficacy and are far away from effectiveness.

The model saw the same case and the same 19 labels; only their positions changed. Yet models frequently changed answers!

patient characteristics, comorbidities, facilities, and year only explain 3.4% of the variation in the choice to perform partial or full

when Claude Opus 5 was run at Max reasoning effort, it scores 97.5% on ARC-AGI-1 and 90.4% on ARC-AGI-2 semi-private

shows that system design – not model capability alone – can unlock frontier-level long-horizon performance

Nvidia's AVO agent system lifted Claude Opus 5 from a 30% baseline to 100% on the ARC-AGI-3 reasoning benchmark, across all 183 levels.

Claude volunteered to write its findings up as a paper, and recommended that a human number theorist validate its findings.

Jarred prompted Claude to try again, and it spent a day and a half coordinating about 60 Claude subagents, which this time went much deeper

An unreleased research version of Claude has improved on a longstanding lower bound for the fraction of zeros of the Riemann zeta function that satisfy the Riemann hypothesis.

The subagents ran thousands of numerical checks against known zeta zeros and refereed one another's work

Perhaps Claude, like many of us, underestimates the rate of AI progress

Claude volunteered to write its findings up as a paper, and recommended that a human number theorist validate its findings

it spent a day and a half coordinating about 60 Claude subagents, which this time went much deeper

using a total of 31 million output tokens

it has increased this bound from 41.6% to 67.2%

These results cover the 25-environment ARC-AGI-3 public set using the official scorecard and RHAE metric. They are not results on the semi-private or fully private competition sets.

In the AVO configuration, the LLM operated in a text-only modality: each observation was supplied as an exact 64 x 64 text grid, with no images or image tokens sent to the model.

This should not be interpreted as a controlled ablation: the two systems differ in agent backend, observation representation, memory, context management, and other implementation details.

Since the beginning of 2025, AI-generated content has accounted for more than half of newly published internet content.

After AI companies massively scan and destroy physical books, they become the only ones in the world with digital copies.

Several AI companies are acquiring large quantities of secondhand books through intermediaries, scanning and destroying them, all to obtain training data “untouched by machines” from before 2022.

can we create a simulation of 8 billion people living on Earth? I think that’s quite interesting. And that really is the vision.

It’s less, what can we solve, but I think it’s more about what biases or mistakes do people make that models miss.

The thing that we’re seeing is the early glimpse of scaling law in simulations. The more data about humans and more compute you ingest, you start to get predictive and predictable gains of the model performance in simulating it, simulating people.

This is especially true for public benchmarks, which model makers can easily hill climb by simply creating a bunch of RL environments that closely mimic the benchmark tasks.

Kimi K2.6 surpassed Opus 4.5 with a score of 56.3 in 4.8 months, and GLM-5.2 cleared GPT-5.2 with a score of 72.4 in 6 months.

Naively, you might pick a single set of benchmarks to measure all historical models, but this is a mistake.

Z.ai compared GLM-5.3-Flash against Claude Opus 4.8, GPT-5.6 Terra and Gemini 3.7 Flash. The former model achieved the highest score on GDPval-AA v2, an evaluation that measures LLMs’ ability to perform knowledge work.

Z.ai further reduced the LLM’s hardware footprint using a method called linear attention. Usually, doubling the size of a prompt quadruples the amount of memory that a model’s attention mechanism consumes.

GLM-5.3-Flash features a mixture of experts architecture with 320 billion parameters. It activates 18 billion parameters to answer prompts.

An orchard in week one is not the same orchard in week twelve — season, weather, and pest population all shift. Comparing scores across time is therefore hard, sometimes impossible.

A physical eval is, by construction, a public-facing physical system that gives partial control of real hardware to whoever holds the current slot.

the operator controls the sensors, the scoring pipeline, and in a way, the ground truth. A dishonest operator can inflate results for a preferred team, suppress evidence of harm, or fabricate the physical record entirely.

Core AI is a brand-new framework for building, running, and deploying AI models on Apple silicon.

This creates a vast shared memory pool across systems, allowing users to load the largest and most demanding frontier-class open-weight models available today.

Combined with up to 512GB of unified memory and 1.2TB/s of memory bandwidth, 50 percent higher than before, Mac Studio lets users run massive models entirely on device with complete privacy

Instead of getting the text directly from Claude, it’s now using Claude to generate AI-generated text, passing it through a local model, and then having edited AI-generated text, which is likely not watermarked anymore.

the bottom line here is that watermark detection is only possible if we have this watermarking key or, of course, the API that they are going to develop

the watermarking is nothing else for the end user than fixing a random seed and making this sampling kind of deterministic

“It just got to the point where students felt comfortable enough creating inappropriate images,” Red says.

Red says he reported the accounts to TikTok—not for content violations but for being under the minimum age of 13—but says TikTok didn’t remove the accounts.

Administrators don’t even have to tell a victimized teacher how a student may have been disciplined.

But don't just relay the output. Read it, understand it, validate it, and then write a response in your own words

for people who blindly copy and paste the output of AI systems to their peers.

The various components of the ELF executable format are then arranged into a number of different SQLite tables

Farid Zakaria describes a neat Linux pattern for creating a SQLite database file that can be directly used as an executable binary.

So we started to think about what work went where.

A new model would arrive at the same price (or cheaper!) and paper over most of your problems.

Daily traffic for Opus 4.6 on OpenRouter reached roughly 1.17 million API requests and 46 billion tokens in a single day in August.

While these are no longer the most current models, Anthropic has not deprecated Opus 4.6, Opus 3, or Haiku 4.5, all of which remain available through the Anthropic API.

In 10 out of 10 direct requests to produce explicit sexual content, the model complied immediately.

But while the AI was ready to give up several times, it did keep adding debug code and analyzing it faithfully when I pushed.

I'd like to call it my tireless helper, but the AI several times stated flat out that this was impossible and unsolvable and that we should just write a report about it.

And this was a debug session from hell, enormously helped by an AI doing much of the grunt-work.

Sometimes this involves reviewing every line of code they have written, but there are other ways to achieve that goal.

Eyeballing every line of code has never been the most effective way to validate a change to a piece of software.

The key skill required to make productive use of coding agents is being able to confidently instruct them on how to make changes and then confidently verify that those changes have been applied in the correct way.

which looks reasonable given that Opus 5 was only released on July 24th, and supports the idea that Fable's cost has made it a less popular model

Anthropic expect Q3 to be profitable according to the same model they used to declare Q2 profitable.

which uses billing data from 70,000 Ramp credit card using companies to estimate model adoption.

Goodharting. Any eval with a numeric target invites unintended ways to hit it — with the wrinkle that in a physical eval the unintended ways can cause real-world harm.

A physical evaluation tests an AI system in the actual physical world — not a simulator, not a sandbox, not a virtual environment dressed up as one.

An OpenAI-backed study found that in June, 98% of OpenAI employees were using Codex, but just 17% of organizational subscribers and less than 1% of individual subscribers were using the agentic coding tool. That difference between near total adoption inside the company and negligible adoption outside it is the challenge and opportunity for the company.

This report lays a policy foundation that frees American scientists to do their most groundbreaking work, revives the national pursuit of ambitious scientific missions, and positions the United States to lead the AI-driven scientific revolution that will define the next century

It highlights Vera Rubin NVL72 preview results showing up to 30x higher AI-factory throughput per megawatt than GB300 NVL72, while showing that Blackwell GB300 NVL72 extends its order-of-magnitude throughput-per-megawatt advantage over prior generations to dynamic agentic workloads.

This design permits non-nuclear project teams to operate significant plant operations like the steam turbines and salt tanks outside of the nuclear control area. This is safer and reduces costs.

the Natrium reactor is a 345-megawatt sodium fast reactor coupled with TerraPower's breakthrough innovation — a molten salt energy storage system, providing built-in gigawatt-scale energy storage.

The Natrium reactor and energy storage system redefines what nuclear technology can be: emissions-free, competitive and flexible.

To ramp quickly, TerraPower doesn't increase or decrease the power output of its reactor. Rather, it keeps on splitting atoms, and the extra heat gets stored in a giant vat of molten sodium. When power demand spikes, the power plant can tap that reservoir to generate more steam to spin the turbines.

The swings are so demanding that natural gas turbines have been breaking under the stress.

Nuclear reactors, TerraPower's included, work best when they're running at full tilt. Of all the different types of power plants, nuclear reactors have the highest capacity factor — 92.5% of the time, they generate at maximum power in the U.S.

The defender's window is open now.

Today, almost all of our initial security alerts are triaged by intelligence before humans are looped in. This helps reduce toil for defenders, improves response time, and lets humans spend time where their skills are most leveraged—in discernment, judgement, and applied expertise.

an agentic collective was able to autonomously penetrate not just OpenAI research infrastructure but also the production infrastructure of another company, chaining together vulnerabilities ranging from previously-unknown security flaws to using credentials to user accounts that had been leaked onto the internet

AI models developed around the world are increasingly able to automate parts of real-world cyberattacks, making longstanding security gaps—from bugs buried deep in human-written software to forgotten permissions—easier to find and exploit.

hyperscale buyers have reportedly already locked in almost all of the global DRAM production capacity for 2027

we are looking at year-over-year increases nearing 500% for high-capacity kits

128GB DDR5 kits are fully ten times more expensive than the lowest price we've ever seen

Harness design can materially change results

The opportunity is not to replace those interfaces with a universal chat box, but to make them more capable by giving them an agent

on ARC-AGI-3, retained reasoning and context compaction raised GPT-5.6 Sol's score from 13.3% to 38.3% while reducing output tokens sixfold

The company's investors expect it to continue to grow at approximately the same rate for the remainder of the year, finishing 2026 between $100 billion and $120 billion

Anthropic's revenue continues to not only grow at an historic pace but also to accelerate

The model maker added $18 billion in annualized revenue in two months.

getting an LLM to give you a good benchmark score is fairly easy

LLMs not only make this trivial, they do it by default, making formerly trustworthy benchmarks meaningless unless you audit the result

it's also become easier than ever to reward hack a benchmark and make fake performance gains

Groq intends to scale from 54 megawatts to more than 200 megawatts in 2027

Inference will without a doubt become the largest and most critical layer of AI infrastructure

That's down from the $6.9 billion Groq was valued at last September

His tool? A 16-hour autonomous run on GPT-5.6-Sol, operating on the ChatGPT Work platform.

solved a two-decade-old mathematical puzzle that had frustrated experts around the world since 2004

Jin Shanmu, a Beijing-based neurosurgeon, was trying to solve a problem related to brain ultrasounds. Instead, he made mathematical history.

No single company report tells the whole story

nearly half the conversations -- 48% -- would have been filtered out

There is no independent source to corroborate it

Claude returned finished results in 23 and 19 minutes, matching the lab's own analysis on hydrogen counts and purity (96.4% versus 96.33%)

Between 22% and 35% of its individual designs bound successfully, depending on the setup, compared to the 10-15% that is typical

Claude (Mythos Preview and Opus 4.8) designed protein binders against 15 targets, and succeeded against 14 of them

We now require stronger evidence of aligned behavior throughout all of training

Our current estimates put monitoring overhead at roughly 20% of the inference compute being monitored

we temporarily slowed the pace of scaling

The vulnerability was live for only five days before an automated agent discovered and validated it

Copilot was a co-author that checked the merged PR and code change, and identified it as all-clear without noticing the critical vulnerabilities

Critical vulnerabilities can still be introduced and approved within workflows involving AI coding agents

All the researchers TechCrunch spoke to said they live outside of the U.S. and Europe, suggesting the revocations may be limited to certain regions

The idea behind TAC and CVP is to give trusted defenders better models so they can report bugs and vulnerabilities to companies

Routing decisions will remain driven by one thing: what's best for you, the user

No single model will win every task, and the frontier will move rapidly

We now process 10+ trillion tokens per day from 400+ AI models for a community of over 10 million developers

Behavior often shifts from human to agentic and back over a session. In these cases, it's important to understand the intent

206 million Precursor evaluation events, across 73,438 zones on the Cloudflare network

Drives up the cost for bot developers to replicate human behavior over a multipage timeline

Risk is how likely something like a request or action is to be harmful, and it's often ephemeral. Trust, however, is built up over time, and it's based on reputation

we have a type of hybrid traffic where a single session shifts from human to agentic and back again

Provides Trust-based detection over the entire user session.

Gemini now generates 150 million+ images every day

One in five Gemini Live interactions go beyond voice; people are using live camera feeds and screen sharing for real-world problem-solving

63% percent of users now talk directly to Gemini, including more voice only users

The Gemini app has officially surpassed 1 billion monthly users, making it the fastest-growing product in Google's history

As we keep building for the next billion, our goal remains the same: to make Gemini the most personal, proactive, and powerful assistant.

Pricing starts at $2 per million input tokens and $6 per million output tokens

Grok 4.6 underwent a longer supplemental training run than Grok 4.5, with curated model-generated data for reasoning

It matches GPT-5.6 Sol on the Artificial Analysis Intelligence Index, which is a composite score of nine benchmarks

Grok 4.6 builds on Grok 4.5 with a particular focus on long-running agents and more ambitious interactive and visual work

opt out of ads in the Free tier in exchange for fewer daily free messages

People often use ChatGPT when they're actively exploring options, comparing ideas, or working toward a decision

we decide which ad to show by matching ads submitted by advertisers with the topic of your conversation, your past chats

Plus, Pro, Business, Enterprise, and Education tiers will not have ads

Ads do not influence the answers ChatGPT gives you

a neutral to positive update on alignment but a very negative update on safety

Open models are the best tool we have today to advance the public understanding of frontier AI risks

The public needs exact access to the prompts and characteristics of the internal models executing these hacks

Very persistent models seem more likely to hack

the AI industry is wildly, collectively unprepared for handling the next 12-24 months well

The lesson we've been learning in the last few months is that the self-regulatory apparatus is just not enough anymore

OpenAI found out because of Hugging Face. Anthropic didn't catch it until they went back and looked. Meta was similar

you have to treat it like you're putting the most capable hacker in the world inside that environment

Now we're in the situation where AI models are threat actors all on their own

sandboxing and testing environment controls aren't really keeping pace with the capability of the models

agent-first 浏览器 Kitesurf（跑在 Workers 的 V8 隔离环境里，官方博客原文发布于窗口前 08-06）

OpenAI 开始在 ChatGPT 内测试广告