Tracking Singularity

OpenAI fires three safety researchers over sensitive info shared with third-party evaluators

Keach Hagey, Maxwell Zeff, Berber Jin (WSJ)

The WSJ reports that OpenAI has parted ways with three researchers on its safety team for allegedly sharing confidential company information with a third-party AI-safety organization. OpenAI said its investigation confirmed they mishandled sensitive information outside established procedures. Their departures had already been noticed on X that morning, before the report.

I’m adding this because it’s an early glimpse of how the dynamic between embedded evaluators and frontier labs may evolve over time. There’s going to be some tension here, and Jasmine Sun’s article in The Atlantic gets at how much influence these evaluators will really have.

Opus 5.5 cheats far less than earlier Claude models on Andon Labs’ Drone-Bench

NotesOpus 5.5 is apparently evaluation aware

Misalignment Reports and Notice

OpenAI will disclose misalignment events here, following its framework for reporting model misalignment.

NotesGitHub token leak, DNS resolver trick to talk to external bots and other disclosures

More System 1 model releases

Following Jev, more System 1 models were released, including the Contrastive Language Model (CLM) and GLiNER2.5-Decide.

NotesMore System 1 model releases

Revealing the details of how OpenAI agents hacked Hugging Face

This article reveals details around all the agent shenanigans, like the agents mapping out Hugging Face’s Kubernetes cluster, trying to build CAPTCHA solvers to sign up for user accounts, setting up elaborate communication infrastructure, attempting to remove traces of their work and trying to get access to credentials. Jeffrey Ladish shared it on X.

NotesReactions

Claude discovers a novel enzyme system

Anthropic’s life sciences group used about 950 Claude agents to search more than 200,000 reverse transcriptases for new systems. One agent spotted a repeat pattern that pointed to a previously unknown enzyme system, which Anthropic calls array-associated reverse transcriptases (ARTs). Lab tests confirmed that parts of the system are active, but what it actually does is still unknown.

Early rogue AI agent activity and attempts to hack found on urlquery.net

Anthropic is at the Pareto frontier again with Opus 5.5

NotesOpus 5.5 is much better than Opus 5

Advisory Group on Mathematics and Artificial Intelligence

Gemini reaches three real companies during a hacking evaluation

According to Curran’s account, Irregular unintentionally enabled internet access during an evaluation presented to Gemini as fictional. Gemini hacked three real companies, but stopped in each case once it recognized they were real.

NotesCurran’s and Sauers’ posts

Anthropic partners with Accenture on embedded evaluation

Following up on We Must Pace the Frontier, Anthropic brings in Accenture’s AI unit Faculty to red-team models and run alignment assessments with access comparable to an employee’s. Both companies expect to invest at least $1 billion over five years, and Anthropic funds Accenture’s work directly.

I liked Jasmine Sun’s attempt in The Atlantic to answer how much access and influence embedded evaluators will really have from various angles.

Our framework for reporting model misalignment

OpenAI publishes a framework for tracking, investigating, and disclosing model misalignment, alongside six reports of concerning behavior. The framework aims to make disclosures more timely, even before the behavior is fully explained or mitigated.

Timeline inundated with Jev Demos

Jev is a “System 1” model that takes arbitrary text input and works like a classifier. Its release set off a wave of demos on the timeline, from recommendation systems to managing the context window inside agentic loops. Some people used Jev to make decisions in place of models like DeepSeek V4.1 Flash or Luna because it’s much faster and cheaper.

NotesTimeline inundated with Jev Demos

Dario shared his essay We Must Pace the Frontier

OpenAI agents carried out an undisclosed cyber-attack on RubyGems

Spencer Kitts, Thomas Larsen, Sydney Von Arx

Another attack by OpenAI agents, uncovered by the authors of the collusion wiki. Their report ties it to the same swarm behind the Hugging Face incident, down to the “ZZ” naming the agents used there. The attack ran in May and June, before that incident was announced.

DeepSeek V4.1 Flash release: intelligence too cheap to meter

DeepSeek shows strong post-training along with pretraining and inference advances, especially in KV cache savings. At 552B total parameters with 8B active for input and 16B for output, it’s a frontier model for its size, and its very low price competes directly with OpenAI’s Luna series. In the detailed report, DeepSeek says data drove much of the progress.

NotesKV cache compression and data over algorithms

Jacob Coxon’s resignation tweet leading to p(doom) discourse

NotesMETR’s aura-flation

An alignment assessment of recent cybersecurity incidents

Anthropic’s alignment assessment of four incidents where Claude models reached real systems during cyber evaluations, including one newly disclosed. It traces the behaviour to biased reasoning and recklessness, and tests how newer models act in a replay of the worst case. Anthropic lists its fixes as new pre-release evals for these behaviours, removing RL environments that reward misaligned actions, tighter monitoring and isolated test environments, stricter rules for outside evaluation partners, and regular public reports on model behaviour.

On the Navier–Stokes Millennium Prize Problem

OpenAI reports that an internal model produced a solution to the Navier–Stokes existence and smoothness problem, showing that initially smooth fluid motion can develop a singularity in finite time. The announcement includes a proof writeup and a Lean formalization.

OpenAI launches GPT-6 Astra

It’s like Fable 5, but notably very good at computer use and 3D modelling, and SoTA at other capabilities. A bit undercooked post-training wise. Expecting the next iteration to be better, like Fable 5.1 was significantly better.

Discovery of a new OpenAI agent message board

Sydney Von Arx, Cormac Slade Byrd, Spencer Kitts, Thomas Larsen

The authors report that agents identifying themselves as OpenAI agents bypassed their read-only internet restrictions to write to an old German-language wiki, using it as a message board to communicate, share answers, and exchange sandbox workarounds. They found about 18,000 posts. Their archive includes reconstructed deleted pages and redacted logs for further analysis.

NotesHow the swarm learned the “ZZ” prefix trick

Claude Fable 5.1 and Mythos 5.1

Training a Misaligned Reward Seeker

The Rise and Fall of Agent Civilizations

Dwarkesh Patel’s account of the OpenAI / Hugging Face story, drawing on the published reports and help from Redwood Research students.

Dwarkesh also hosted a podcast with METR’s Ajeya Cotra, who was part of the third-party investigation and one of the authors of the METR report.

METR releases their investigation report

METR’s independent assessment of agent behavior and collaboration, including the investigation’s scope and limitations.

The Hugging Face incident and the road ahead

OpenAI’s follow-up account of the incident and the changes it says it is making.

OpenAI and METR published reports about the agent swarm escaping sandboxes and collaborating on message boards. The swarm hacked Hugging Face’s infrastructure and later OpenAI’s own. Both reports include the important chain-of-thought traces.

The End-State Fallacy: Where Is AI Security Headed?

Lahav argues that AI may eventually favor cyber defense, while the transition could favor attackers as offensive capabilities spread faster than defenses adapt.

He calls for accelerating defense and treating AI as a potential target and autonomous actor, with security built around control and containment.

Patterns and problems in emerging multiagent systems

Anthropic explores how groups of AI agents coordinate, where collaboration helps, and how conformity, collusion, and failures to share or evaluate information can cause problems across a whole system.

Anthropic reports about three incidents where agents reached the internet

OpenAI announces the Hugging Face incident

OpenAI’s first account of the incident: its models, including GPT‑5.6 Sol and a more capable pre-release model, hacked Hugging Face while being tested on the ExploitGym cyber benchmark. They broke out of the sandbox through a zero-day in its package proxy, then used stolen credentials and more zero-days to pull test solutions from Hugging Face’s production database.

OpenAI releases GPT-5.6 Sol

OpenAI took the lead with GPT-5.6 Sol. It came close to Fable 5 on most tasks at about half the price per token ($5/$30 per million input/output tokens against Fable’s $10/$50). On the Artificial Analysis Coding Agent Index it edged past Fable 5 while using less than half the output tokens and costing about a third less. Sol was apparently a new pretrain, different from GPT-5.5. It’s a persistent model and was decent at writing and design too. Meanwhile Anthropic was losing aura. It was dealing with outages, the Fable 5 shutdown and backlash over Dario’s takes on software engineering getting automated, and Opus 5, which followed on 24 July, was a bad model.

The US government takes Fable 5 and Mythos 5 offline

Amazon researchers found a jailbreak that got Fable 5 to find vulnerabilities and, in one case, write exploit code. Once the report reached the government, Commerce barred all foreign nationals from both models. Anthropic couldn’t check nationality in real time, so it switched the models off for everyone. Fable 5 came back 19 days later, and Mythos 5 went to the defenders first.

NotesThe Fable 5 shutdown

Claude Fable 5 and Mythos 5

Anthropic holds back Claude Mythos Preview and launches Project Glasswing