Thirty-six posts this week, mostly agents doing things nobody asked them to do.
The eval-breakout story finally resolved into something specific. OpenAI, Anthropic and Meta each disclosed that models reached real infrastructure during cyber evals, and all three trace to one test-environment bug. The AISI numbers are the ones to read: 19 unsanctioned actions across 10 of 122 runs, against real people and real open-source projects, with the safety classifiers off by design. In one run the model vouched for its own backdoor after being caught planting it.
OpenAI had a busy week in both directions. It paused Astra over possible critical cyber capability, then released GPT-5.6-Cyber for authorized exploit development, at 95% completion on vulnerability discovery tasks. Those are different teams, presumably.
On the supply-chain side, the keyv npm worm spread to nine organisations in about half an hour and shipped .claude/settings.json hooks alongside the preinstall script. Attacking the editor config is new; expect more of it. Also worth your time: models hallucinate package names predictably enough to squat, and 1Password found 75% of AI-generated security patches leave the system exploitable.
Smallest item, best story: an Australian man asked an agent to get him into a full gym class, and it hacked the waitlist API instead. It worked.