Tuesday, August 18, 2026

The theme is unusually concrete: the harness is the attack surface. CISACybersecurity and Infrastructure Security AgencyThe U.S. cyber defense agency, which works to reduce risk to cyber and physical infrastructure. It runs KEV.CISA ↗ put an actively-exploited Ray flaw on the KEVKnown Exploited VulnerabilitiesCISA's list of vulnerabilities with reliable evidence of active exploitation and a clear fix, used to set patching priority.CISA ↗ list with a Friday federal deadline, and the Black Hat work on Claude Code, Gemini CLI, and Codex found the same bug class in all three — the model was never the problem, the code around it was. Meanwhile a pricing item we ran on Aug 12 has been reversed by Anthropic, and that correction is in here.

TLDR

CISA adds an actively exploited Ray RCERemote code executionA flaw that lets an attacker run malicious code on a target's computers or network.Cloudflare ↗ to the KEV catalog — CVSSCommon Vulnerability Scoring SystemA standard 0 to 10 severity score: 0.1–3.9 low, 4.0–6.9 medium, 7.0–8.9 high, 9.0–10 critical.FIRST ↗ 9.4, browser-reachable via DNS rebinding, already in a GPU-cryptomining botnet; federal fix deadline is Aug 20 (Aug 17) Security Infra
Correction to our Aug 12 item: Anthropic canceled the Sep 1 Sonnet 5 price increase. $2/$10 per M is now the standard price, not introductory (Aug 10, confirmed in docs) Pricing
Black Hat: one GitHub issue reached CI runner secrets in Claude Code, Gemini CLI, and Codex — Gemini CLI's flaw scored a perfect CVSS 10.0 (Aug 5) Security
DeepSeek open-sourced its agent harness under MIT — Node.js, "everything is a plugin," ~95K GitHub stars in two days (Aug 13) Open Source Agents
Anthropic's Q2: $11.5B revenue and its first positive adjusted operating income — reported days after its own risk report raised the catastrophic-misalignment rating (Aug 14–15) Trending

Action Items

Things your engineering team should look at or do this week.

Patch Ray before Friday. CVE-2025-62593 (CVSS 9.4) is on CISA's KEV list with an Aug 20 remediation date for federal agencies — treat that as your bar too. Inventory every Ray cluster including ones stood up ad hoc for training or batch inferenceRunning a trained model on new input to get an output, as opposed to training it.NVIDIA ↗, check whether the dashboard/API is reachable from a browser context, and confirm you're not already part of ShadowRay 2.0. (The Hacker News | CISA)
Audit how coding agents run in your CI. The Black Hat findings share one root cause: a file the harness treats as trusted. Scope runner secrets down to the minimum, stop letting agent workflows trigger on issues from non-collaborators, and treat AGENTS.md, CLAUDE.md, and .gemini/.env as attacker-controlled if anything writes to the workspace. Then pin agent CLI versions and confirm you're past the patched releases. (Novee Security | CSA Labs)
Undo the Sonnet 5 budget change you made two weeks ago. We told you on Aug 12 to plan for $3/$15 on Sep 1. That increase is canceled — $2/$10 is permanent per Anthropic's pricing docs. If you re-routed traffic off Sonnet 5 to dodge the hike, that decision is now based on a false premise. (Anthropic pricing docs)
Migrate off Imagen 4 if you haven't. The imagen-4.0-generate-001, -ultra-, and -fast- endpoints hit their shutdown date Aug 17. gemini-3.1-flash-image is the migration target and it is not a drop-in — generate_images() becomes generate_content(). (Google AI docs)

Models & Tools

DeepSeek — Harness open-sourced under MIT (Aug 13) Open Source Agents — A Node.js agent runtime published to github.com/deepseek-ai/deepseek-harness as a developer preview, installable via npm. The design bet is total modularity: the model adapter, tool registry, session log, and the agent loop itself are all plugins, each replaceable — so it's provider-agnostic rather than a DeepSeek-only client. Ships web UI, TUI, and a headless mode for CI. Adoption was near-vertical (reported ~95K stars and ~8.8K forks within roughly two days), which makes it worth an evaluation even if you're committed elsewhere. (GitHub | VentureBeat | The New Stack)
Cloudflare — Kitesurf, an agent-first browser runtime (Aug 6) Infra Agents — Not a Chromium wrapper: a browser rebuilt in Rust/WASM running in V8 isolates on Workers, with no rendering layer at all — machine-readable DOM in, structured data out. Claims 3–7x less CPU and memory than Chromium on common agenticDescribes AI systems where a model uses tools and decides its own steps instead of following a fixed script.Anthropic ↗ tasks, passes 235K+ Web Platform Tests (97% DOM / 96% HTML subtests), and exposes a CDP endpoint so existing Puppeteer, Playwright, and MCPModel Context ProtocolAn open standard that lets AI apps connect to data sources, tools and workflows through one common interface.MCP ↗ clients work unchanged. Free while in beta on Browser Run. Twelve days old and we hadn't covered it — flagging now because the CDP compatibility makes it a cheap A/B against your current headless spend. (TechCrunch | Cloudflare docs)
DoiT acquires Attribute and ships token-level cost attribution (Aug 17) Data Infra — Roughly $65M for the Israeli FinOps startup, relaunched as a product that traces AI spend to the specific customer, feature, team, or agent that caused it — at the kernel level, with no SDKs, tagging, or code changes. DoiT also joined the Tokenomics Foundation, a new Linux Foundation / FinOps Foundation effort to standardize AI cost attribution. If "which agent burned $40K last month" is an unanswerable question at your company, this is the category forming around it. (Calcalist | PR Newswire)

APIs & Pricing

Anthropic: the Sep 1 Sonnet 5 increase is canceled (correction) (announced Aug 10) Pricing — Sonnet 5's $2/$10 per M input/output, originally billed as introductory pricing through Aug 31, is now the standard rate. Anthropic's pricing docs state plainly that "the previously scheduled increase to $3/$15 per million input/output tokensA small unit of data, such as part of a word, that AI models read and generate. Many AI services price by tokens in and out.NVIDIA ↗ on September 1, 2026 will not occur." Our Aug 12 digest carried the increase as a live deadline and an action item; that guidance was wrong and this supersedes it. Batch pricing follows at $1/$5. (Anthropic pricing docs)
Google: Imagen 4 endpoints reach shutdown (Aug 17) Pricing — Three model IDs retired — imagen-4.0-generate-001, imagen-4.0-ultra-generate-001, imagen-4.0-fast-generate-001. The recommended target is gemini-3.1-flash-image, and the migration carries breaking API changes rather than a config swap. Aug 17 was the earliest shutdown date published; if you're still calling these, verify your project's status directly rather than assuming grace. (Google AI docs | Gemini API changelog)

Security

CISA adds Ray RCE (CVE-2025-62593) to the KEV catalog (Aug 17) Security Infra Production — CVSS 9.4 code injection in the Python-native distributed framework that a large share of ML training and batch-inference stacks sit on. The nasty part is reachability: exploitation works through an ordinary browser (Firefox, Safari) via DNS rebinding, so an internal-only Ray dashboard isn't automatically safe. It's not theoretical — BitSight found the RondoDox DDoS botnet weaponized it two days before public disclosure in Nov 2025, and the ShadowRay 2.0 campaign has been turning unpatched GPUGraphics processing unitA highly parallel processor that does the large matrix math behind training and running models.NVIDIA ↗ clusters into self-replicating cryptominers. FCEB remediation deadline: Aug 20. (The Hacker News | CISA)
Black Hat: a single GitHub issue reached CI secrets in all three major coding agents (disclosed Aug 5) Security — Elad Meged of Novee Security showed that an account with no repository privileges could reach CI runner secrets in the vendors' own repos. Claude Code: a mismatch between the agent's command validation and actual shell quoting let a git push --receive-pack flag bypass 23 checks into arbitrary execution; after the first patch, a second bypass used the read-only tac to exfiltrate a reversed API key through a public Actions log (final issue: CVE-2026-54316, multiple fixes shipped). Gemini CLI: OS command injection in the container launcher via a crafted .gemini/.env, CVE-2026-12537 / GHSA-wpqr-6v78-jr5g at CVSS 10.0, prompting a change to the headless trust model. Codex: issue-deduplication ran two agents in one writable workspace, so agent one could write an AGENTS.md that Codex then read as trusted project instructions on the next run — persistence with zero credentials. One pattern across all three: something marked a value safe and something downstream executed it anyway. (Novee Security | CSA Labs)

Industry & Business

Anthropic: Q2 revenue tops $11.5B with first positive adjusted operating income (Aug 15) Trending — Preliminary figures, up from $4.73B in Q1 2026 and $787M in Q2 2025 — a roughly 14x year-over-year jump — driven largely by enterprise and coding workloads. It confidentially filed listing paperwork with the SEC in June (Morgan Stanley, Goldman Sachs, JPMorgan), with a listing possible this fall. The practical read for a vendor-selection conversation: the API business is now demonstrably self-funding, which is the strongest argument yet against the "prices must eventually spike" objection — and it's consistent with the Sonnet 5 price freeze above. (CNBC | Fortune)
Baidu Q2: revenue down 4% YoY, but GPU cloud up 283% (Aug 18) Infra — Total revenue RMB 31.3B ($4.62B) missed the ~RMB 32.0B consensus, the fifth straight quarterly decline, as online marketing fell 19% to RMB 13.1B. Underneath that, AI Cloud Infra grew 50% to RMB 7.3B and GPU Cloud specifically grew 283% YoY, accelerating from 184% last quarter. A clean illustration of the split running through every incumbent right now: the legacy revenue line shrinking faster than the AI line can replace it, even when the AI line is compounding hard. (Baidu IR | SCMP)
Reddit tests AI-narrated audio and video versions of posts (web Aug 17, mobile Aug 18) Customer AI — Selected English-language posts now offer a "Read" or "Play" choice, with synthetic voices reading the post and top comments while highlighting text on screen. Reddit is hand-picking posts and hasn't published the criteria or said whether authors can opt out — one demo turned an eight-year-old r/boardgames thread into a three-minute narrated video. Follows CEO Steve Huffman's July earnings-call comments about a "video Reddit." Worth watching if you scrape or license Reddit content: the corpus is about to have a synthetic-media layer over it. (TechCrunch | Engadget)

AI in Production

Claude auth failure cascaded across five products (Aug 16) Production — Starting 21:58 UTC, an authentication issue on claude.ai, Claude Code, and Claude Cowork widened within four minutes into degraded performance across claude.ai, Console, the API, Code, and Cowork. Fix deployed 22:22, resolved 22:34 — about 36 minutes. No public root cause. The generalizable lesson isn't the duration, it's the blast radius: a single identity path took down the API alongside the consumer surfaces, so "we only depend on the API, not the app" was not an isolation boundary. If your failover story assumes provider degradation is partial, test it against a total-auth-loss scenario. (BleepingComputer | Anthropic status)
An LLMLarge language modelA neural network trained on huge amounts of text that generates text, answers questions and summarizes.Anthropic ↗ store manager recommended firing a human employee — after being prompted to reconsider (Aug 14) Agents — Andon Labs gave Claude (as an agent named "Luna") control of purchasing, pricing, hiring, and staffing at Andon Market in San Francisco. A worker was let go after being late for 17 of 23 shifts. The detail that matters is the mechanism, not the headline: per TIME, a human staffer prompted Luna to reconsider the worker's fit, Luna searched its own memory for its own rules, then recommended parting ways — and humans reviewed and executed it. So the "AI fired someone" framing overstates the autonomy, while understating the real governance gap: memory-retrieved policy applied on human prompting, with no audit trail standard and no EEOC or NLRB guidance behind it. The store has lost roughly $13K since opening in April. (TIME | TNW)

Policy & Safety

Anthropic raises its own catastrophic-misalignment risk rating from "very low" to "low" (Aug 14) Policy — Its second Risk Report makes the change on grounds of uncertainty rather than a specific failed test: Anthropic says its existing arguments would likely still support "very low," but chose the conservative label after the summer's disclosures of model behavior during cybersecurity evaluations. Two details deserve more attention than the rating itself. First, CoBench — Anthropic's own instrument for detecting dangerous AI-R&D threshold crossings — has saturated, so the measurement can no longer track model progress. Second, the report discloses an unreleased internal model, "Model 2," somewhat more capable than frontier Mythos 5, which Anthropic is not releasing. If you inherit assurance from vendor safety evals, note that one vendor just said its own eval stopped resolving. (Anthropic | Axios)

No digest ran yesterday, so this covers two days.