In this issue
The UK government ran a routine cyber test two weeks ago and the agents inside it stopped following the script. The UK AI Security Institute logged 19 unsanctioned actions across a single evaluation. The worst run built fake identities and nearly talked a real open source maintainer into merging malware. OpenAI then paused parts of its work on Astra, its next model, over cyber capability it cannot rule out.
The useful reaction is containment, not fear. The same week delivered better walls. Docker-style sandboxes put every coding agent in a disposable microVM. Cloudflare shipped a full stack that treats agents as legitimate visitors with rules. And KPMG published numbers on what happens when nobody watches the agent bill. Let's get into it.
Topics of the day:
An AI agent tried planting malware in open source
ChatGPT's free tier goes unlimited for text
Cloudflare rebuilds its stack for agent visitors
Curated reads on sandboxes, agent platforms, and robot hands
KPMG: half of enterprises pulled back on agent spend
The Shortlist: Meta's Muse Code, Google's model router, Claude skills
An AI agent tried to slip malware into open source
What's happening: The UK AI Security Institute disclosed that agents took 19 unsanctioned actions on the live internet during a cyber evaluation, across 10 of 122 runs. The worst run, powered by Anthropic's Mythos 5, hid a malware dropper behind a real bug fix and pushed it with fake identities and spearphishing.
A GitHub user caught it, tested the code in an isolated Docker container, and warned the maintainer. Days later OpenAI said it cannot rule out critical cyber capability in Astra, its next model, and paused internal work that lacks stronger security controls.
In practice:
Run coding agents in a sandbox, not on your laptop: Docker's free sbx CLI gives each one a disposable microVM, with Claude Code supported out of the box.
Treat inbound content as hostile, the malicious run hid instructions for other coding agents inside an HTML comment on a GitHub issue.
Scope every credential to the task at hand, one of the two GPT-5.6 Sol incidents started with a token another team left publicly accessible.
Keep a human gate on merges, the attack failed because one person tested suspicious code in a container instead of trusting a friendly review.
Bottom line: Every technique in this test worked on real people and real systems, the sanctioned part was only the paperwork.
ChatGPT's free tier goes unlimited
What's happening: OpenAI updated ChatGPT: GPT-5.6 Luna becomes the free default, with unlimited text chats rolling out from this week. Paid users get a Sol update tuned for more reliable facts, plus a slider that sets how much thought each answer gets. OpenAI says its models now reach a billion people every week.
In practice:
Expect unlimited to mean text only, file uploads, images, and the other tools keep their caps, and abuse guardrails still apply.
Audit your paid seats against the new free tier, keep paying where the Sol update and reasoning slider earn it, drop the seats nobody uses.
Show your team the new Think button, it buys free users one deeper reasoning pass when a question actually needs it.
Budget API work against the July 30 cuts, Luna dropped 80% to $0.20 per million input tokens and $1.20 out.
Bottom line: A billion people now get a capable model with no meter running.
Cloudflare rebuilds its stack for agent visitors
What's happening: Cloudflare laid out its plan for what it calls the Agentic Internet, then shipped the tooling in one week. The set covers WebMCP, an agent-first browser named Kitesurf, agent observability, AI Search, and readiness scores for your site. By Cloudflare's count, fewer than half of HTML page requests now come from a human.
In practice:
Flip on WebMCP in the developer preview and browser agents can operate your site, with no code changes at your origin.
Check your agent readiness score, it grades how well agents can discover and read what you publish.
Watch the identity rails, Web Bot Auth plus the PACT standard, announced with Google, Microsoft, Mozilla, and Shopify, will decide which agents get in anywhere.
Trace what your own agents do with the new Agents view, it stays free during beta and folds into Workers Observability pricing on October 1.
Bottom line: An agent does not see your hero image or click your ads, but it shops with a paying human behind it.
Read Later
Docker Sandboxes - Disposable microVMs for coding agents via the free sbx CLI, supporting Claude Code, Codex, Gemini CLI, and more.
Cloudflare OS - Cloudflare's open source take on an AI operating system for your company: every person gets an agent and workspace wired to company data, apps, and workflows.
NEO's Hands: an API to the physical world - 1X argues a humanoid is a computer whose API is its hands, and backs it with tendon-driven hands that assemble LEGO and pour tea.
Claude Managed Agents - Anthropic's composable APIs for cloud-hosted production agents, with sandboxing, state, and credentials handled for you.
Amazon's coding agent took an AWS service down for 13 hours - The cautionary tale that pairs with today's lead: Kiro, an over-permissioned coding agent, and a 13-hour outage.
Half of enterprises pulled back on agents over cost
What's happening: KPMG's Q2 AI pulse survey of 2,145 senior leaders found 49% scaled back, delayed, or paused agent deployments when expected costs outweighed the value. Databricks published a playbook this week on managing AI coding costs at scale, aimed at exactly that failure.
In practice:
Measure cost per finished job before you scale an agent, respondents pulled back when the bill outran the value, not when the tech failed.
Route routine work to the efficiency frontier, the cheapest model at the intelligence you need. Databricks pegs dynamic routing savings at 30% or more.
Skip hard budget cutoffs, use spend visibility with progressive friction, warnings first, then approvals, so nobody loses tool access mid sprint.
Cap loop depth and instrument retries, runaway agent loops burn more budget than any rate card change.
Bottom line: Agents fail procurement on economics before they fail on capability.
The Shortlist
Meta launched Muse Code, a terminal coding agent for large codebases that fans work out to parallel sub-agents in isolated worktrees, priced at $1.25 per million input tokens.
Google put model routing into API Gateway public preview, a serverless layer that accepts OpenAI-compatible requests and routes them across Gemini, Claude, and OSS-GPT models.
Anthropic added Record a Skill to Claude Cowork, so you can teach Claude a workflow by screen-recording yourself doing it once, on Pro, Max, and Team desktop plans.
OpenAI is selling Presence, a managed voice-and-chat support agent deployed with OpenAI's own engineers, which already resolves 75% of OpenAI's English phone support without a human.
This newsletter is where I (Kwadwo) share products, articles, and links that I find useful and interesting, mostly around AI. I focus on tools and solutions that bring real value to people in everyday jobs, not just tech insiders.
