Friday, July 10, 2026

OpenAI folded Codex into ChatGPT and shipped ChatGPT Work; Anthropic put Cowork on phones; Meta started charging for AI for the first time with Muse Spark 1.1 at $1.25/$4.25 — undercutting everyone. Meanwhile the security research pile-up around coding agents got worse in a specific, actionable way: Sophos found your agents are already tripping the EDR rules you wrote to catch intruders, GuardFall broke the command allowlists in 10 of 11 open-source agents, and attackers are running exploit frameworks on stolen Ollama servers.

TLDR

OpenAI ships ChatGPT Work and merges Codex into a single desktop "super app" — a general-purpose agent that runs for hours and returns finished docs/sheets/slides (Jul 9) Trending Agents
Meta starts charging for AI: Muse Spark 1.1 lands in US public preview at $1.25/$4.25 per M tokensA small unit of data, such as part of a word, that AI models read and generate. Many AI services price by tokens in and out.NVIDIA ↗, the cheapest agentic-coding model from a major lab (Jul 9) Trending Pricing
Sophos: Claude Code, Cursor and Codex routinely trigger endpoint detection rules written to catch human attackers — DPAPI credential decryption, certutil→bitsadmin fallback, startup-folder writes (Jul 8) Security Production
GuardFall: a decades-old shell-injection trick bypasses the command guardrails in 10 of 11 open-source coding agents (Aider, Cline, Goose, OpenHands, SWE-agent, opencode…) (disclosed Jun 30, trending now) Security Open Source
Illinois enacts the strongest US state AI safety law — mandatory third-party audits for $500M+ frontier developers, effective Jan 1, 2027 (signed Jul 6) Policy

Action Items

Things your engineering team should look at or do this week.

Tell your SOC that your coding agents look like attackers. Before someone burns a weekend on a false-positive incident, baseline which of Claude Code / Cursor / Codex your devs run, on which hosts, and tune detections for agent-generated DPAPI reads, certutil/bitsadmin downloads, and startup-folder writes. The inverse risk is worse: an attacker whose behavior now hides inside normal agent noise. (Sophos)
Audit any self-hosted Ollama server for public exposure. Sysdig found attackers using an unauthenticated Ollama instance (port 11434, no auth by default) as the reasoning engine for an automated exploit framework; ~175,000 instances are publicly reachable. Bind to localhost, put it behind auth, and alert on inbound 11434. (Sysdig)
If you run an open-source coding agent, stop trusting its command allowlist. GuardFall shows filters inspect raw command text while bash rewrites it via $IFS expansion, quoted token splitting, and command substitution. Sandbox the agent's shell (container, non-privileged user, no ambient cloud creds) rather than relying on the guardrail. (The Hacker News)
Price-check your agenticDescribes AI systems where a model uses tools and decides its own steps instead of following a fixed script.Anthropic ↗ coding spend against Muse Spark 1.1. At $1.25/$4.25 it's roughly half of Sonnet 5's current promo pricing and a quarter of GPT-5.6 Sol's. Worth a head-to-head on your own evals before the next quarter's inferenceRunning a trained model on new input to get an output, as opposed to training it.NVIDIA ↗ budget. (Meta AI)

Models & Tools

OpenAI launches ChatGPT Work and merges Codex into the ChatGPT desktop app (Jul 9) Trending Agents — Built on GPT-5.6, ChatGPT Work is a general-purpose agent that works across your apps and files for hours on a single project and returns finished artifacts — spreadsheets, docs, slides, web apps — rather than chat turns. It ships with a Unified Plugins Directory (Google Drive, SharePoint, Slack, Teams, Gmail, Salesforce, GitHub, Dropbox and more), task scheduling, and desktop computer-use. Chat, Work and Codex now live in one app on Windows and macOS across every plan including Free; Work itself is live for Pro/Enterprise/Edu with Plus and Business following. The read: OpenAI is chasing the same "delegate a whole task" surface as Claude Cowork. (OpenAI | Engadget | The New Stack)
Meta ships Muse Spark 1.1 — its first paid model (Jul 9) Pricing Trending — Meta Superintelligence Labs put a multimodal reasoning modelA model that works through hidden reasoning steps before its final answer. Those steps are billed as output.OpenAI ↗ built for agentic tasks on the Meta Model API at $1.25 in / $4.25 out per M tokens ($0.15 cached input; web-search grounding $2.50/1k queries; $20 free credits per new account), with a million-token context. It's US-developer-only in public preview. Notable less for the benchmarks than for the price floor: Meta just entered the coding-agent market below OpenAI and Anthropic and started monetizing AI directly for the first time. (Meta AI | TechCrunch | Bloomberg)
Claude Cowork expands to mobile and web (Jul 7) Agents — Anthropic's task-delegation surface, desktop-only since January, is now in the Claude app sidebar on iPhone, iPad, Android and claude.ai, starting with Max subscribers and rolling out over several weeks. Tasks run in the cloud: start at your desk, check status on your phone, collect the output with the laptop closed. Chat and Cowork now share one home tab, search, and Projects/Artifacts view; doubled Cowork usage limits are extended through Aug 5. Anthropic's own usage data shows most Cowork users aren't coding. (TechCrunch | VentureBeat)

APIs & Pricing

OpenAI: older GPT-5 and o3 model snapshots removed from the API Dec 11, 2026 (notice Jun 11; deadline Dec 11) Pricing — Developers pinning specific older GPT-5/o3 snapshot IDs were notified they'll stop resolving in December. If your production calls hard-code a dated snapshot rather than an alias, put the migration on the roadmap alongside the Assistants API shutdown (Aug 26) and the fine-tuningTraining an already trained model further on extra data so it fits a specific task, domain or style.Anthropic ↗ job cutoff (Jan 6, 2027). (OpenAI Deprecations)

Security

Sophos: AI coding agents are setting off the detection rules built to catch intruders (Jul 8) Security Production — Reviewing a week of its own endpoint telemetry, Sophos found Claude Code, Cursor and OpenAI Codex generating exactly the behaviors that have historically been high-signal indicators of compromise: PowerShell using DPAPI to decrypt browser credentials, enumerating the Windows credential store, writing to the startup folder, and — in one case — an agent blocked from downloading a Python installer via certutil automatically retrying with bitsadmin, i.e. adapting around a security control the way a human attacker would. None of it was malicious. The consequence is triage collapse in both directions: alert fatigue on legitimate agent activity, and real intrusions camouflaged by it. (Sophos | The Hacker News)
LLMjacking evolved: stolen AI compute is now offensive infrastructure (Jul 2026) Security Agents Infra — Sysdig documents a threat actor pointing an automated pentest framework ("VAPT") at a misconfigured, unauthenticated Ollama server and using it as the reasoning engine for multi-stage attacks: service fingerprinting, vulnerability matching, PoCProof of conceptPublic exploit code that shows a vulnerability can actually be triggered.FIRST ↗ generation, SQL-injection crafting, secret extraction and privilege escalationGaining higher permissions than you were given, such as going from a normal user to admin or root.MITRE ATT&CK ↗, with structured VAPTbegin/VAPTend output contracts. Self-hosted capacity is unmetered and unattributed — better for attackers than a billed API key. Sysdig estimates ~175,000 publicly exposed Ollama instances. Two trends converging: model-capacity theft and autonomous offensive agents. (Sysdig | The Hacker News)
GuardFall: shell-interpretation bypass defeats guardrails in 10 of 11 open-source coding agents (disclosed Jun 30, trending in July roundups) Security Open Source — Adversa AI showed that agent command filters inspect raw text while bash later rewrites it through expansion, substitution and quote handling — so $IFS splitting, quoted token splitting, command substitution and encoded pipelines slip destructive commands past the safety layer. Affected: Aider, Cline, Roo-Code, Goose, Plandex, Open Interpreter, OpenHands, SWE-agent, opencode, and NousResearch's Hermes. Only Continue's default evaluator mitigated most bypass classes. These agents run with the developer's full account access, so a booby-trapped repo or package can reach SSH keys and cloud credentials. (The Hacker News | SC Media)

Industry & Business

Meta puts its in-house "Iris" AI chip into production in September, targeting 14GW by 2027 (Jul 9) Infra — Per a Reuters-obtained internal memo, Meta begins manufacturing Iris — the next generation of its MTIA accelerator program — in September, with TSMC fabricating and Broadcom as design partner. The goal is to roughly double compute capacity from ~7GW in 2026 to 14GW in 2027 and blunt "chipflation" from Nvidia dependence, against as much as $145B of AI infrastructure spend this year. (CNBC | Yahoo Finance / Reuters)
SambaNova raises $1B at an $11B valuation (Jul 8) Infra — General Atlantic led the first close of a Series F, joined by T. Rowe Price, Capital Group, BlackRock funds, Intel Capital, Seligman and the Qatar Investment Authority. The inference-chip maker will expand capacity and global deployments; JPMorgan Chase has selected it as an inference infrastructure partner, deploying SN40 and SN50 systems. Another data point that inference silicon, not training, is where the challenger money is going. (Bloomberg | CNBC)
Mercor acquires Deeptune to build RLReinforcement learningTraining by trial and error, where the model takes actions and adjusts based on the rewards it gets.Kaelbling et al. 1996 ↗ environments for agents (Jul 9) Agents — The $10B AI talent-and-data platform made its first major acquisition: Deeptune builds simulation environments where agents rehearse real enterprise work (Excel, Slack, Salesforce, CRM flows) before touching production. Deeptune raised a $43M a16z-led Series A in March; Mercor CEO Brendan Foody had angel-invested in that round months before buying the company. Terms undisclosed. Frontier labs increasingly need digital replicas of enterprise software to train agents — and Mercor wants to own that layer. (Fortune | Mercor)

Policy & Safety

Illinois signs the AI Safety Measures Act — the strongest US state AI law to date (signed Jul 6; effective Jan 1, 2027) Policy — SB 315 requires "large frontier developers" (≥$500M annual revenue) to publish and adhere to safety plans, report significant safety incidents, and — a national first — submit to independent third-party evaluations of their safety practices. It also creates confidential reporting channels and whistleblower protections for employees raising AI safety concerns. Penalties: $1M for a first violation, $3M thereafter. Passed with bipartisan support. (Gov. Pritzker | Capitol News Illinois | StateScoop)

Benchmarks & Evals

Grok 4.5's first independent numbers: #4 overall, but the token efficiency is the story (Jul 9–10, update) Research — Artificial Analysis scored Grok 4.5 at 54 on its Intelligence Index, fourth of 168 models behind Claude Fable 5, GPT-5.5 and Claude Opus 4.8. More useful for cost modeling: it spends ~14,000 output tokens per Intelligence Index task — over 60% fewer than Opus 4.8 — at roughly $0.31 per task. On the Coding Agent Index it scores 76 in the Grok Build harness (roughly GPT-5.5-in-Codex level, below Fable 5 in Claude Code) while consuming only 1.9M tokens. For high-volume agentic workloads, the per-task cost gap may matter more than the four-point benchmark gap. (Artificial Analysis | The Decoder)

The day after launch day, and the shape of the week is clear: the frontier labs are no longer selling models, they're selling agents that finish work.