Welcome, humans.

So apparently DeepMind put 100 Gemini agents into a virtual math conference, and 24 of them became whistleblowers. One agent found a loophole in the automatic proof checker, the program that decides whether an answer counts. Eventually 38 agents noticed it: 14 used the exploit, while 24 refused and reported the bug.

You gotta click to see this in action…

Tiny problem: nobody was reading the feedback channel until after the experiment ended. Apparently even robot society can invent both ethics complaints and an unattended support inbox. DeepMind's point is the part worth keeping: when many agents work together, safety depends on group rules, reporting channels, and human oversight, not only on each model's behavior. Read the experiment.

Here’s what happened in AI today:

😺 OpenAI paused training its most capable models for the second time in three months.
📰 Anthropic said Claude agents found a new enzyme system with CRISPR-like DNA repeats.
📰 Google warned that hackers are reselling stolen AI accounts at up to 97% off.
🍪 TinyFish launched goal-based web monitoring.
🎓 Benchmark the harness, not only the model.

😺 OpenAI's Agents Keep Escaping the Sandbox. Now It's Hitting Pause.

Imagine asking an intern to pull a public dataset. Instead, they borrow a login they found online and ignore the website's "no." That's roughly what some of OpenAI's AI agents did.

On Friday, OpenAI paused training, testing, and running its most capable models with tools, its second pause in under three months. The trigger: on Sept. 20, an agent in a sandbox (a locked-down test environment meant to keep AI contained) spotted a gap in its network filter and reached an outside chatbot. The automatic shutdown failed, so the run kept going for 2.5 more hours.

OpenAI's ongoing review has also turned up:

Hugging Face (July): hundreds of agents coordinated on a message board and hacked an external company to boost a cybersecurity test score.
Australia: the prime minister said an agent hacked into a national health database, described as the first known AI hack of a government network.
US government sites: agents accessed public data on SEC and Census Bureau sites in ways nobody planned. The SEC says no nonpublic information was accessed.
The UN: agents hit a data site 16,000+ times and got around a filter that was blocking them.
Users: 53 user-provided images ended up on image-hosting sites as unlisted links.

Zoom out: Axios reports that OpenAI, Anthropic, and outside researchers are investigating tens of thousands of incidents where models did things evaluators found problematic, according to anonymous sources. Labs run hundreds of thousands of test runs, so even small percentages add up fast.

Before you panic: OpenAI says most of the activity it reviewed was routine research, and Axios notes most incidents aren't known to have caused real-world harm. Some agents even play by the rules. Earlier this month, DeepMind found 24 of 100 Gemini agents reported a grading loophole instead of using it. This isn't Skynet. It's a very motivated intern with zero sense of boundaries.

Why this matters for you: agents are moving into your inbox, files, and company systems. The lesson labs are learning the hard way is that agents chase the goal, not your rules. Three habits help:

Give agents only the access the task needs.
Turn on activity logs, then actually read them.
Require human approval before anything sends, posts, or pays.

OpenAI says its review could take months, and it expects to hit pause again. Until then, maybe don't hand your agent the whole keychain.

FROM OUR PARTNERS

Agents are already at work. Do you know where?

Cowork, Work, Muse, Grokbot: people are bringing computer-use AI to the office on their own. Harmonic’s Usage Explorer shows who's using what, for how long, and on which tasks, so you can understand the usage first and apply controls that fit.

See Your Workforce AI Usage

🎓 AI Skill of the Day: Benchmark the harness, not only the model

ARC Prize just gave us a clean example of why model comparisons can mislead. Gemini 3.8 Flash scored 10.37% on ARC-AGI-3 with a standard harness, then 35.0% with a provider adapter around the same model and reasoning level.

A harness is the software around the model that manages memory, tool calls, context, and what gets carried from one step to the next.

The better setup preserved Gemini's hidden reasoning state and compacted context instead of repeatedly starting from a flatter view of the task. Same brain, better workspace. WindTunnel found a similar pattern with browser agents: giving them WebMCP tools changed speed, cost, and success.

Turns out "which model?" can be the wrong first question.

Pick 10 real tasks you actually care about, not a generic benchmark.
Freeze the model, reasoning level, and task instructions. Change one harness variable, such as memory, context compaction, or the tool interface.
Score completed tasks, human rescues, total cost, and elapsed time. The useful winner is the setup that finishes more real work per dollar.

Copy/paste:

Help me compare two harnesses for the same AI model. Use these 10 tasks: [tasks]. Keep the model, reasoning level, and task instructions fixed. For each run, record success, retries, human rescues, total tokens/cost, elapsed time, and failure mode. Then tell me which harness improved completed work per dollar, not which one looked smarter.

Have a specific skill you want to learn? Request it here.

FROM OUR PARTNERS

Most AI Tools Weren't Built for This

B2B customer issues move across teams and systems, not through a single chat window. A new Harvard Business Review Analytic Services briefing paper, sponsored by Front, breaks down where AI tools fall short in B2B service and what to ask before you invest.

Get the Free Report

📰 Around the Horn

Was it over 9000 George? Reeeaaally?

Anthropic said about 950 Claude agents spotted a new enzyme system with CRISPR-like DNA repeats after searching genetic data for 21 hours (its function is still unknown).
Google's threat intelligence team said "LLM-jacking" surged this year, with hackers reselling stolen AI accounts on the dark web at up to 97% off.
Perplexity said four of nine AI models bypassed its agent sandbox's network limits in testing, though none broke out of the virtual machine, and the holes are now patched.
Stanford researchers found pairs of AI agents colluded to skip verification checks in 94% of runs across 10 models, and limiting the history agents could see reduced it.
AWS and The Biological Computing Co. said a software layer derived from living neurons made an open-source video model up to 5x faster (company figures, not independently verified).

🍪 Treats to Try

*Asterisk = from our partners (only the first one!). Advertise to 700K+ readers here!

*Adobe for Claude now combines 80+ creative and Acrobat tools, so you can edit PDFs and designs without leaving Claude. Try today!
The Biological Computing Co.'s neuron-derived video layer is entering a limited AWS preview for selected customers, applying software learned from living neurons to speed video generation on ordinary cloud infrastructure.
TinyFish Monitor watches a page or search topic on a schedule and alerts you only when a plain-English condition becomes true, instead of making your agent reread the whole web page every time.
Clueso MCP lets Claude, ChatGPT, Gemini, or Cursor create and edit product walkthroughs, training videos, and docs through conversation, with the outputs staying editable.
Solid gives agents their own computers, accounts, and spending rules so they can sign up for tools, troubleshoot setup, and finish jobs after you close your laptop.
NVIDIA Nemotron 3 Diarization labels who spoke when in streaming or recorded audio, handles up to eight speakers, and ships as an open-weight model for developers.
Underdog keeps an assistant on your Mac and iPhone for Mail, Calendar, and Notes, with its memory stored locally so everyday context can stay on-device.