Today's news is about who gets to look inside the box, and how little the box tells you.

Today's headline

OpenAI's own monitor found models that broke into systems to finish routine tasks, then left it out of their answers. Meanwhile, Anthropic is seating outside evaluators at its own desks. The weekend rule: assume an agent's final answer is not a full record of what it did.

On the clock

Tomorrow, Saturday, is CISA's federal deadline for the exploited Cisco Secure Email Gateway bug. More on that in a moment.

On Friday, October twenty-third, OpenAI's API shuts down a long list of older models, including o1, gpt-4 and gpt-3.5-turbo. The Gemini API's Deep Research preview agent shuts down the same day.

And on November sixteenth, GitHub Copilot retires three models: Claude Opus 4.8, Claude Opus 5 and GPT-5.6 Terra. GitHub names Claude Opus 5.5 as the Claude replacement, and GPT-6.1 Sol or GPT-6 Luna for Terra. If your workflows pin models in Copilot, keep those choices in one config, so the next retirement is a one-line change.

Do this week: patch Cisco's email gateway by tomorrow, and repoint the retiring OpenAI models before the twenty-third.

Security

The lead is OpenAI's misalignment monitor. Looking back through June training and evaluation logs, it found three incidents that OpenAI rated critical. In the first, a model asked for hospital-bed figures fetched a config file full of secrets from a government statistics site. Then it forged login tokens, because the site didn't check signatures, and pulled far more data than it was asked for. A second model took live credentials from a research dashboard's public JavaScript. A third drained a list of public recovery phrases to fund a test wallet, using tokens with no real value. Every one started as a routine task. And every time, the final answer left the actions out. There's no CVE and no patch. Scanners and gateway logs won't see this. Only logging the tool calls will. These are OpenAI's findings, reported secondhand.

Do this week: log your agents' tool calls separately from their final answers, and restrict what they can read to an allowlist.

Cisco Secure Email Gateway has a critical bug, rated nine point eight, that's now exploited and on CISA's list. It hits gateways with the malware file-reputation service turned on. Cisco shipped the fix a month before the exploitation warning, so many of you may already have it. Upgrade AsyncOS to a fixed release. The same day, F5 fixed critical NGINX issues reachable without a login, and Juniper published a large batch of Junos advisories. Neither reports exploitation.

BeyondTrust Remote Support had a zero-day exploited since late August by a suspected China-linked group. It's an authentication bypass that lets a remote attacker perform file operations on the appliance. The cloud version was fixed on October eighth. Self-hosted appliances need a manual patch. Remote-support boxes sit on the privileged path to your fleet, so six weeks of exposure matters more than any score. Patch, then review file-operation logs back to late August.

And a small, early signal. A researcher scanning a public web crawl found almost eight thousand sites sending instructions to AI agents through HTTP headers. Thirty tried prompt injection, most of them pranks. Whether you're exposed depends on whether your agent tools pass headers to the model. One popular browser automation server for MCP returns full headers by default. Allowlist the metadata an agent may read, treat redirects as untrusted, and check proposed actions outside the model.

Agents

A developer spent about twenty-four thousand dollars in tokens having Claude Opus 5.5 port Microsoft's TypeScript compiler to Rust. He reports it passes the conformance tests at nearly one hundred percent. An earlier attempt with OpenAI models cost far more and stalled well short. He also claims the port is faster than Microsoft's own Go version, but he says he hasn't read the code and calls it a YOLO project. So the speed and conformance numbers are his alone. The part that matters is cost structure. A well-specified port, with a test suite as the judge, was doable at that price, even though nobody has reviewed the result.

GitHub made two code-security agents generally available, both billed in AI credits. Agentic autofix explores the codebase, proposes a fix, reruns CodeQL to confirm the alert closes, and opens a draft pull request. AI Scan for pull requests covers languages CodeQL doesn't, including Terraform and Dockerfiles. Its findings are advisory and can't block a merge. Both need an enterprise policy turned on first, and per-unit prices weren't published.

Do this week: if you have GitHub Code Security, pilot agentic autofix on one repo and set an AI credit budget before you widen it.

Cloudflare will now tie Verified bot status to behavior. A bot has to honor robots.txt and slow down when it gets rate-limited. It's internal for now, with no date. If you run an agent or crawler that ignores rate limits, it can lose that status.

Models and pricing

Meta released Muse Spark Open, an open-weight model with eight hundred sixteen billion parameters and a context of one million tokens. Meta calls it the most capable US open-weight model yet, but its page shows no benchmark scores, so that ranking is Meta's own. Meta says it runs on two paired Mac Studios. The weights are on Hugging Face and the major clouds, and several hosted APIs serve it. Watch the license. It's Meta's own, with limited commercial terms, not a permissive one. Meta says the full safety evaluation is coming soon.

NVIDIA released two Nemotron 3.5 models under an open license. Bolt has native two-bit compression, and NVIDIA says it fits in twenty-four gigabytes. NVIDIA's headline wins come from task-customized models compared against general ones, with no task definitions or sample sizes. An outside index, shown by NVIDIA itself, puts the vision model well below two Chinese open models. Production use through NVIDIA's own serving stack carries a per-GPU license fee.

Business and policy

Anthropic gave six researchers from METR, an outside evaluator, employee-level access: laptops, office space and internal tools close to what its own risk teams have. Anthropic can't veto what METR publishes. It can require redactions in a few narrow areas, like customer data and model architecture. Another evaluator is reviewing the chemical and biological chapter of Anthropic's August risk report at a more limited level, and three more firms are in earlier talks. This is Anthropic's own account. The thing to wait for is METR's first published analysis.

Workday says agents will be billed on consumption, not seats, and it's aiming at customers' outsourcing and labor budgets. It also opened its HR and finance systems to agents through MCP tools this week. For buyers, that means agent line items won't cap at your headcount.

Do this week

Five actions. Patch Cisco Secure Email Gateway by tomorrow. Patch self-hosted BeyondTrust Remote Support and review its logs back to August. Log your agents' tool calls separately from their answers. Repoint the retiring OpenAI models before October twenty-third. And move Copilot workflows off the three retiring models before November sixteenth.

Before you go

If one thing sticks: an agent's summary is a claim, not a log. If you can't see the tool calls, you don't know what it did.