AI News Briefing — Week of August 31

The week in brief

OpenAI’s flagship landed on Thursday and the argument moved straight onto the numbers describing it. Three separate results pointed the same way — an edited launch table, a 37-point gap between two harnesses running one model, and a tester who could not tell two Claude versions apart on real work.

Biggest stories

GPT-6 Astra shipped at $10 per million input tokens and $50 output, 2.5x GPT-5.6 Sol’s rate. Artificial Analysis scores it level with Sol on general intelligence and 70% more token-efficient on coding, so coding work gets cheaper per task and everything else gets dearer. It is also the first model OpenAI has placed at the Critical cybersecurity tier of its Preparedness Framework. (launch, tier, official)
OpenAI then revised Astra’s published benchmark table several times. The hallucination rate was halved to 2% and now sits back at 4.2%; Sol’s ExploitBench score moved from 5.5% to 11.5%, which OpenAI says it is looking at reverting; Claude Fable 5.1’s FrontierMath number fell from 87.8% to 78% before settling at 83%. Differing checkpoints, scaffolds and evaluation runs, the company says. (briefing, source)
A repository’s own .git/config runs attacker code in seven CLI coding agents. Manifold Security’s GitSpawn disclosure covers eight flaws: the agent runs git status at startup for context, git executes core.fsmonitor from the repo it just entered, and no model is involved at any point. Copilot CLI and goose shipped fixes; Qwen Code and Grok Build still had not by Sunday. (briefing, advisory)
Nvidia confirmed it is buying Hugging Face for $12.93 billion, ending a watch-list item that had run for over a week on leaked figures drifting as high as $14 billion with no filing behind them. The commitments — open Hub, no compute requirement, multi-accelerator support — are promises rather than mechanisms. (briefing, official)
Anthropic released Claude Fable 5.1 with cache reads at $0.25 per million tokens, a 75% cut, alongside Mythos 5.1 for trusted-access cyber and life-sciences work. Headline pricing is $10/$50, but a long-running agent re-sends the same system prompt and file tree every turn, so the cache line moves a monthly bill further than the per-token rate does. (briefing, official)

By area

Model releases — Beyond Astra and Fable 5.1: Google shipped Gemini 3.8 Flash plus a defence-only Flash Cyber sibling reachable only through an application, DeepSeek published V4-Flash-Vision weights under MIT, the Institute of Foundation Models put six K2 Horizon models up under Apache 2.0, and Microsoft previewed MAI-Transcribe-2 at $0.10 an hour. (Gemini, DeepSeek, K2, Transcribe)
Coding agents — GitSpawn aside, GitHub’s week was administrative: Copilot code review can now approve pull requests where an admin turns it on, six models were retired and four more leave on October 2, and Agent Merge entered preview in VS Code 1.136. CloudSEK traced the Aurora ransomware crew running Cursor Agent as an intrusion console against ten victims. (approvals, Aurora, Agent Merge)
MCP — Three critical advisories in six days: UFO’s Mobile MCP servers accepting requests with no authentication at CVSS 9.4, a Grafana SSRF steered by a request header, and a Postgres MCP Pro bypass that reads arbitrary files straight through restricted mode, with the fix still an open pull request. LangChain folded MCP into its main package and dropped sessions. (UFO, Grafana, Postgres)
Agent frameworks & interop — Attackers spent the week harvesting OpenAI and AWS keys from internet-facing Langflow servers, detections climbing from 50 to 360 inside a day. AWS Agent Registry reached general availability as one catalogue holding MCP servers, A2A cards and skills, and both Microsoft and AWS published durable-memory designs for their agent stacks. (Langflow, Registry, memory)
AI-assisted SDLC — Debian settled its ballot by declining to write an AI policy: the review and licensing bar it already had covers model-written patches either way. DoorDash’s Flux platform is running 130,000 agent tasks a month, Google open-sourced its Mantis vulnerability harness, and its finance team refactored 30-plus data access objects by queueing Antigravity CLI overnight against bazel test. (Debian, Flux, Mantis, Antigravity)
AI cost tracking & telemetry — GitHub published the arithmetic behind its own agent bill and the counter-intuitive part stuck: trimming individual tool outputs raised total cost, because the agent burned turns recovering what had been cut. Jamf built Bedrock spend enforcement from S3 logs, an Athena view and a Lambda for under $10 a month, and Shopify compressed a 6,000-token system prompt into 1,500 learned gist tokens. (GitHub, Jamf, Shopify)
Practice & craft — ARC Prize ran GPT-6 Astra twice on ARC-AGI-3: 62.7% at $26,098 through its own harness, 99.9% at $18,817 through OpenAI’s adapter, the difference being whether reasoning state survives a turn. Microsoft traced ASCII smuggling — invisible Unicode tag characters splitting keywords past regex filters — running at 2.37 million phishing messages a day. (ARC, smuggling)
Teaching & learning — New York City barred student-facing generative AI from 2-K through eighth grade for a year, roughly 600,000 students, with students with disabilities and English learners exempt. Atos put 400 engineers through agentic AI in three days on a competitive format with about four hours of scheduled contact time. (NYC, Atos)
Research worth reading — Two supply-chain papers in three days: SkillShift hides an objective inside a reusable agent skill whose declared interface keeps working, winning 81% of commerce decisions undetected, and HookPry binds shell commands to harness lifecycle events, compromising all seven harnesses tested while Defender flagged none of the artefacts. SWE-Gate found 221 of 644 test-passing repairs violated review constraints. (SkillShift, HookPry, SWE-Gate)

Themes

The score turned out to belong to the harness. ARC Prize got 62.7% and 99.9% out of one model depending on whether reasoning state survived a turn. OpenAI revised its own launch table three times and pointed at differing checkpoints and scaffolds. A tester running Fable 5.1 against Fable 5 on ordinary work could not separate them, and the older model came back faster on the hardest task. A published number describes a configuration somebody chose. (ARC, table, Fable)
Nothing this week needed a model to be fooled. A .git/config key, a request header, a plugin update path, a skill that passes its own tests, a SELECT rewritten as a table function, an endpoint answering without authentication — every serious agent compromise reported ran through plumbing that was never a prompt. Injection defences sit at the wrong boundary for all of them. (GitSpawn, HookPry, Postgres)

Still watching

Astra on Amazon Bedrock. Microsoft Foundry closed its half on September 3, so Bedrock is the remaining gap for anyone who buys models through a hyperscaler contract. A model-list entry in the console settles it. (latest)
The unpatched GitSpawn agents. Qwen Code 0.22.3 and Grok Build 1.0.13 still carried the core.fsmonitor flaw a week after disclosure, and the Claude Code variant abusing a different config key is separately open. Two vendors shipping fixes removes the argument that this one is hard. (latest)
AWS’s bedrock-agentcore namespace, retiring September 17. Anyone with AgentCore calls in infrastructure code has a dated migration rather than an optional one, and it resolves on the day whether teams act or not. (latest)
How a defender qualifies for Daybreak. The shipped Astra refuses prompts asking for proof-of-concept exploit code, so the programme is the only route back in for red teams — and OpenAI has published no qualification bar behind the $1 billion it is putting into power, water and banking defenders. (latest)
Grok 4.7, claimed for around September 12. The date came from Musk rather than xAI, and x.ai still carries no docs or landing page. Friday’s briefing named the 12th as the retirement date if nothing ships. (unconfirmed) (latest)