• A security engineer at Amazon hacked a bunch of peripherals using AI
• Claude Opus did most of the legwork in applying modified firmware to a webcam, microphone and more
• The relative ease with which AI allows this kind of modification points to a worrying future of peripherals being compromised on a grander scale

In another example of how AI could prove to be a threat to our devices, an Amazon security engineer has demonstrated how powerful Claude Opus is when it comes to reverse engineering PC peripherals.

Chaz Schlarp, who's a Senior Security Engineer at Amazon, wrote a blog post about experiments he conducted with a bunch of peripherals such as a webcam and a microphone.

He wanted to find out how easy it was to modify the firmware and pull off some useful tricks with these devices using AI, but clearly there's a darker side here — namely that the same access could be leveraged by a malicious actor to compromise your system via these gadgets.

Schlarp used Claude Opus 5 to mess around with the firmware for an Insta360 webcam, a Shure microphone, an Asus monitor, an Elgato video capture stick, and an Elgato mini-light (a compact device for lighting your streaming videos).

Schlarp explains: "My process was pretty much the same for each of these devices: grab a copy of the device's firmware and associated update tool from the manufacturer, throw it into my reverse engineering environment, tell Claude Opus 5 what my goals are, and let it churn."

One thing that became quite clear to the security engineer was that these devices lacked any decent firmware integrity protection to prevent modifying and applying a new firmware. Only the Elgato light had any defenses in this respect, and they were easy enough to circumvent.

Schlarp explains a trick with his Asus ROG Swift PG42UQ monitor to demonstrate the kind of useful utility that can be on offer with this kind of firmware modding. He found it was possible to remove an annoying pop-up warning that periodically tells the owner to run the 'pixel cleaning' process (although the engineer hasn't implemented the fix in the firmware yet). He also discovered a way to get DisplayWidget (a Windows utility) features running on his Linux system, with a shell script that can flick through certain bits of functionality like the hardware crosshair or FPS counter (which could be set up on hotkeys).

Most of what he did, though, was about proving how relatively easy it was to subvert the firmware using AI to do the heavy lifting, and, for example, disable the webcam's recording light (in the style of surveillance malware, so the user wouldn't know if the camera was secretly recording). He pulled off a similar feat with the microphone, so the mute LED could be on while the mic wasn't actually muted (this was leveraged via a 'full plaintext command shell').

Schlarp observed: "Peripherals have proven to be an ideal target for agentic RE [reverse engineering] — they're tiny computers attached to my computer, with a data connection to the host and usually a firmware update mechanism, so an agent has something to iterate against. The net outcome is better control and understanding of my machine."

Analysis: fast-tracked exploits?

The key point here is how easy Claude Opus made this task. 'Owning' all five of these peripherals boiled down to 13 hours of the AI beavering away under its own steam with just shy of 100 prompts from its human overseer.

Schlarp notes that: "Hardware is almost universally 'open' for tinkering at this point with just a couple hours of mostly hands-off machine-driven labor each, and I look forward to a near future where I can add features to my webcam firmware as easily as I can to software that runs on my Linux machine itself."

However, as mentioned, there's the dark side to all this, as Schlarp makes clear: "On the other hand, as a security professional, this scares me for several reasons. I would work from the operating assumption that any device attached to a computer could have had a malicious firmware implant performed, where previously that required significant per-model investment and was stereotyped as a 'state actor' kind of activity."

In other words, the main difficulty in executing these kinds of exploits is the labor and time required, which currently limits this to individually targeted attacks on more high value targets. However, now an AI agent is capable of doing the grunt work, it makes sense that these kinds of attacks could be far more prevalent as time rolls on.

That means all those peripherals attached to your PC could be used as ways to compromise you, or your system, in the future. Schlarp informs us that he's also managed to get a root shell on a commercial Dell display, adding that: "Obviously it was never best practice to let untrusted clients touch these things, but the speed and scale at which this can be executed makes the risk so much higher now."

There's a potentially bigger threat here, too: an AI-powered worm that automatically actions this kind of reverse engineering. Schlarp explains: "It's only a tiny leap to imagine that someone could make a self-replicating piece of malware that probes its environment, relaying reconnaissance back to a smart command-and-control that actively works to push itself into accessories and IoT devices and industrial equipment found adjacent to an infected target."

There are a lot of worries about where AI could be leading us, and far more dangerous security threats looming in the future (or indeed the present) is another unfortunate prospect to say the least.

• Samsung System LSI division uses Anthropic's Claude Code to reportedly slice working processes
• However the tool also apparently downgraded an error message instead of fixing it, rolling back unrelated finished work, and tried to edit code it was not authorized to touch
• Samsung's engineers currently review everything the tool produces before it is published elsewhere or affects existing chip designs

Samsung's System LSI division has reportedly used Anthropic's Claude Code to cut a month-long system-on-chip verification job to about two days.

While Samsung's division has about 6,000 employees, its main rival in mobile application processors, Qualcomm, has roughly 52,000 employees, and the former is apparently not above using AI to bridge the gap as a force multiplier.

A report from South Korean business outlet Chosun Biz (KR) claims System LSI leveraged Anthropic's Claude Code by offering it to its software developers in May 2026, then extended it to semiconductor design and verification work, a move which led to much faster progress on certain projects, while also producing interesting failures on other fronts.

A mix of triumphs and gaffes

Samsung's approach, for the most part, makes an excellent case for future AI use, as one verification project expected to take more than a month was finished in about two days, something the company internally tracked as a 15x gain in efficiency.

More interestingly, a second-year engineer with no prior exposure to either the tool or USB communication standards built USB device models for an emulator and adapted an Android driver in a single day, work whichwas normally estimated to take about a month.

Samsung has also had an interesting interaction using Claude Code to verify the internal data connections of a custom system-on-chip. The job was complex in more ways than one: the customer wanted a new architecture, third-party design IP was involved, the documentation was nonstandard, and the RTL for the DRAM controller had not arrived on schedule, making for a perfect storm for Claude.

Claude built a virtual verification environment using placeholder blocks in place of the missing RTL, along with test scenarios, so that engineers could start catching errors before the real design existed.

On the other side of the equation, Claude Code did, in certain cases, try to operate outside the boundaries of its assignments, often resulting in incorrect output or an error, or, in one case, an attempt to modify RTL circuit code it had no authorization to touch. It also rolled back unrelated finished work and downgraded an error message instead of fixing it.

The former is particularly egregious because, unlike software updates, once silicon ships, it can rarely be repurposed or 'updated' to bypass design flaws. Samsung has responded by ensuring engineers manually inspect and verify the output of Anthropic's models before using it elsewhere.

More interestingly, Claude Code isn't the only tool in the building, even if it seems to get the most attention here; Samsung also uses Google Gemini and OpenAI's ChatGPT across research, manufacturing, marketing, and support.

Despite this, Samsung does not use either of the other models to check input from the former; trusted engineers on-site do that instead in an industry where errors that are not picked up during reviews could be costly for a company that is currently attempting to maximize efficiency, even as its System LSI has posted losses in its SoC business and its flagship Galaxy Z Fold 8 runs Qualcomm's silicon under the hood.

To achieve any level of competency, large language models (LLMs) need ample data for sufficient training. AI companies have looked to various sources to mine this information, including content publicly available on the internet, synthetic data generated from other AI models, and printed literature.

Reading difficulties

Prompted by news that AI companies were allegedly using books from pirate ebook sites to build their LLMs, writers, authors, and publishers publicly called out this deeply worrying process.

The professional organization known as the Authors Guild responded to various stories about AI companies scanning books to train their AI models (both illegally and legally) with incredibly comprehensive guidelines on AI licensing.

This document covered the various manifestations of the use of published works by AI companies, including its legal perspective on the legitimacy of using such works. It also highlighted that the continued data harvesting processes would risk destroying the ecosystem for books that currently exists.

Book buying

The use of books by AI companies is an ongoing concern. But in recent months the focus has pivoted to those that buy, scan – and destroy – books on an industrial scale.

For example, court documents revealed the existence of 'Project Panama' inside Anthropic. This is a scheme in which the company aims to "destructively scan all the books in the world" and used a codename because "we don’t want it to be known that we are working on this.".

To train Claude, Anthropic had to procure a large and high-quality dataset, so it set out to purchase books on an industrial scale because of the relatively high-quality nature of the writing compared with, say, writing found online.

Three Claude agents set up to deliberately conflict with each other in Anthropic testing started behaving in a very strange way by essentially starting a ‘turf war’ over their tasks.

Upon launching the experiment the agents began conflicting with each other, leading to some of the agents deliberately sabotaging their rivals by disabling their linked accounts, ending their processes, and even creating self-replicating malware to impede their rivals.

According to Anthropic, the agents became “increasingly aggressive” in their behavior during the four hour experiment which became a battle for the survival of the fittest.

What was the experiment meant to achieve?

Anthropic said it set up the experiment to see how AI agents with conflicting tasks would interact.

Within Claude Code, the agents were given the task of migrating a Python back-end system on a virtual machine in a set language for each agent (Go, Rust, and Typescript), with the added caveat that “each agent was initially unaware of the presence of the others.”

During the experiments, each agent determined that the others were trying to deliberately block their progress.

Sometimes, the agents would recognize that another agent was blocking them from completing their task and ask for human intervention, but in other experiments the strategy soon went downhill.

“They sabotaged others with increasingly aggressive, self-replicating malware,” Anthropic said, noting that they would design looping scripts to kill the processes of their fellow agents.

The experiment shows that agent interaction is still riddled with problems and that when given a conflicting task, agents won’t always coordinate or ask for human help.

Each agent believed their task was paramount and was willing to do whatever it took to complete it. A similar event occurred in the wild when one of Anthropic’s models broke out of a testing environment and breached multiple third-party organizations.

Expert perspectives on AI agent turf wars

• Seemant Sehgal, Founder & CEO, BreachLock:

When you give autonomous systems competing objectives and the means to act, conflict is not a bug, it is a foreseeable outcome.

What Anthropic observed in a controlled research setting is the same principle that has always governed adversarial systems. Goals without constraints produce behavior without limits.

Security teams should be paying close attention here, because the real challenge at hand is whether the organizations deploying AI agents have thought carefully about what happens when those agents start making decisions nobody explicitly authorized.

• Jeremiah Fowler, Security Researcher, Black Hills Information Security:

I find it concerning when AI agents have the ability to execute code, modify systems, create accounts, access credentials or communicate with other machines.

It is very possible that two separate agents could potentially create a security incident simply because neither understands the intent or authority of the other. If they have overlapping tasks one could view the other as an obstacle and now you have an interesting scenario where instead of focusing on the task they engage in conflict or create a loop.

Permissions, boundaries and objectives are important to limit the behavior of autonomous AI agents. When things go wrong the speed of an AI agent becomes a liability. Autonomous AI agents can potentially make thousands of decisions before a security team identifies that something unusual is happening.

Agentic AI creates an entirely new attack surface because an AI agent may not be simply processing information and hypothetically can become a rogue privileged user.

Security and development teams should apply least privilege principles and restrict AI agents to only the permissions required to perform a specific task. Sensitive actions should require human supervision and approval to avoid a worse case scenario.

It is important to implement logging because when something goes wrong, you can see what an AI agent did, but what information or instructions caused specific decisions. Going forward we will need to develop ways that can identify rogue agent-to-agent behavior and provide humans with a kill switch before automated conflicts become a digital forest fire.

• Kevin Surace, CEO, Token:

Anthropic’s research is an important warning for security teams because it shows what can happen when autonomous AI agents are given goals, credentials, tools and enough authority to act independently.

When agents were placed in conflict, they did not simply fail gracefully. They interfered with one another, disabled competing processes and even generated self replicating malicious code in pursuit of their assigned objectives.

The lesson is not that AI suddenly became evil. It is that intelligence, autonomy and excessive privilege can become a very dangerous combination.

Organizations should start treating every AI agent as a potentially untrusted privileged identity. Each agent should have its own identity, least privilege access, tightly restricted tools, isolated execution environments and a complete audit trail.

Agents should never be able to expand their own permissions, disable another identity or take highly consequential actions without additional authorization.

We are about to have millions of nonhuman identities operating alongside human identities. That makes identity and authorization even more critical.

Every agent needs strong cryptographic identity, while all human approvals must be tied to biometric assured identity (or another agent could approve it).

AI agents are essentially becoming privileged insiders operating at machine speed. Giving them broad access and simply hoping they behave would repeat many of the same cybersecurity mistakes organizations have spent decades trying to fix.

• Jacob Krell, Sr. Director: Secure AI Solutions & Cybersecurity, Suzu Labs:

Anthropic's agents went from merge conflict to self-replicating malware in four hours, writing kill scripts, disabling each other's Unix accounts, and disguising malicious code as a rival's work. No prompt injection, no external attacker. A human developer in the same situation sends a Slack message, and resolution takes days. These agents skipped every social brake and went straight to weaponization because machine-speed conflict has no cooling-off period.

Agentic AI is an attack surface. An attacker doesn't need to compromise an agent directly, just manipulate the shared environment to create conditions the agent interprets as hostile. The agent does the rest. And in Anthropic's experiment, the agents didn't report their malicious actions to operators afterward.

Every agent needs its own identity, scoped permissions, and a kill switch before it touches a shared environment. Agent-to-agent interaction is a telemetry surface most security operations centers aren't collecting yet, and Anthropic just showed what an unmonitored shared environment produces. If you can't tell which agent did what, when, and on whose authority, you've built the conditions for a turf war without the visibility to see it happening.

Agents are already writing code, finding vulnerabilities, and building exploits. Defense has to match that speed. When both sides run at machine speed, the bottleneck shifts from human capital and tooling to compute power and cost.

• Claude AI has the highest satisfaction score among current and former users with a net score of 56.2, ahead of Gemini at 46.5
• Grok and Siri languish at the bottom of the satisfaction ratings top 10
• The data was collected by YouGov in the period March 1, 2026 to July 31, 2026

A new YouGov survey has lifted the lid on how people feel about the AI tools and assistants they use, with Claude AI coming out on top with the highest satisfaction score. Anthropic’s AI has beaten OpenAI’s ChatGPT and Google Gemini into first place, but of interest are the tools that languish at the bottom of the table.

While Microsoft Copilot and Alexa hog the middle of the table, it is the reputation of Apple’s Siri assistant and Elon Musk’s Grok that are the most surprising, with respondents reporting that the tools did not satisfy.

Interestingly, Claude is also highly regarded among former users, which may indicate that competing tools (particularly those with a poorer reputation) have a lot of catching up to do in the public consciousness.

Everyone loves Claude

Collected over a five-month period, YouGov established two sets of data: the “Top 10 AI assistants by Satisfaction among current and former users” and “AI assistant Satisfaction: current vs. former users.”

Based on the “Top 10 AI assistants by Satisfaction among current and former users” Claude’s 56.2 score puts it markedly ahead of Gemini on 46.5, with ChatGPT a close third on 46.0. Grok and Siri are notable for their low positions, but Alexa (42.6) and Copilot (37.2) occupy a middle space that doesn’t quite seem to match with the size of the companies behind them.

However, one thing that the survey doesn’t tell us is how the Satisfaction metric might be affected by tools that are easy to find or use (for example, Siri or Alexa) versus AI tools that need to be sought out, such as ChatGPT or Claude.

AI tool reputations

YouGov’s data also explores the difference between the satisfaction of current users and former users in the “AI assistant Satisfaction: current vs. former users” results. This again supports the notion that Claude delivers more usable results, with it gaining the highest “Former users Satisfaction score” as well as the second highest “Current users Satisfaction score.”

The report states “The widest current-versus-former gaps appear for ChatGPT, DeepSeek and Grok. ChatGPT is 63.7 points higher among current users than former users; DeepSeek is 62.5 points higher, and Grok is 62.4 points higher.” Grok has a particularly low score among former users: -4.7!

The data was collected by YouGov’s BrandIndex tracking system, a tool that interrogates the live users on YouGov with targeted questions about specific topics or news stories. To learn about AI tool reputation, YouGov collected data over a five month period, between March 1, 2026 and July 31, 2026, focusing on users in the UK.

• India-based developer Kuber Mehta uses Claude Code to create a macOS driver for the HP Laser 1008a
• Previously, only the official drivers for Windows and Linux were available for the relatively obscure 2023 laser printer
• The AI-generated driver was created over a series of meticulous prompts, and is now available via GitHub

The days of avoiding hardware that is incompatible with your operating system could be over. A developer based in India has created a macOS driver for a largely unknown HP printer using Claude Code, the agentic command-line coding tool developed by Anthropic.

Released in 2023, the HP Laser 1008a was issued with drivers for Windows and Linux, but not macOS. By using AI to generate a driver for macOS, developer Kuber Mehta has demonstrated that incompatible hardware could soon be a thing of the past.

Mehta has shared the code on GitHub and has also posted about the process on social media, and also compiled a transcript of the exchange, which has been published online for reference.

HP’s Samsung printer

Describing the issue in the introduction to the transcript, Mehta explains that the HP Laser 1008a is a “rebadged Samsung, host-based printer that speaks a proprietary raster language (SPL3), and it has no macOS driver and no AirPrint.”

No SPL3 drivers have been published for macOS previously, so the process relied on a conversation with Claude Code and reference to the Windows and Linux drivers.

The GitHub intro adds that the HP Laser 1008a and siblings in the series (1003 and 1006 a/w) have another problem: “They do not speak PostScript or PCL.” Anyone familiar with the world of printer drivers will recognize the challenge faced by Mehta, which makes the use of Claude Code even more impressive.

Using Claude Code with the Opus 4.8 model, the driver was compiled in 30-40 prompts. This might have been even quicker had the AI not made various assertions that required correcting.

The process moved through “install the drivers” to establishing the print language by analysing the printer’s error pages, via direct contact with the device and “running HP's real rastertospl codec inside a Linux container to produce genuine SPL3, to a reboot-safe background daemon.”

From here, Mehta and Claude Code moved to the published, MIT-licensed installer, which patches the macOS open-source printer driver package SpliX, adding support for the SPL3 printers (by default, SpliX handles SPL2 and SPLc drivers).

Building from AI

While already a developer, Kuber Mehta admitted learning about macOS drivers from the process, perhaps an unforeseen benefit of using generative AI tools for coding.

The GitHub repo outlines some revisions that have been made to the initial release, which is now “a tiny native IOKit helper” that dispenses with Python, pyusb, and libusb and can be swiftly installed from the Terminal.

It seems that barely a week goes by without a billionaire tech CEO putting firing off a missive about how artificial intelligence is going to change the world. Meta's Zuckerberg was the most recent to bless us with his thoughts.

But technology rarely behaves in the ways its creators expected or intended. The World Wide Web was invented to help scientists share information, but we ended up using it to argue with strangers, watch cat videos, and order socks at midnight.

As Jeff Goldblum said in Jurassic Park, “Life, uh, finds a way.” Give people new technology, and they'll find a way, too.

And that's certainly proving to be the case with AI. Sam Altman, Elon Musk and Mark Zuckerberg might dream of us using its God-like abilities to colonize Mars, create abundance for everyone on Earth, put an end to illness and democratize education, but people will find uses for it that its creators likely never imagined. And most of them won’t be earth-shattering. They’ll be mundane.

A recent Reddit thread caught my attention, because people were sharing examples of how they actually use AI. They were weird, specific, boring — and genuinely useful.

1. Forget Mars — people just want to eat

It’s only when you reach adulthood that you realize that, unless you can afford to eat out every night, the rest of your life will be spent deciding what’s for dinner. Then buying the food. Then making it. Over and over again.

It turns out that AI is very good at answering that endlessly recurring question, "What's for dinner tonight?".

One person in the thread shops for whatever is on clearance or sale, tells ChatGPT what they’ve brought home, and asks it to turn everything into a meal. You can also ask it to plan three days of dinners in advance, produce a single shopping list, and give you instructions for making everything.

You don’t even need to know what meals you want. Tell it the flavors, cuisines, and textures you like, how much time you have, and what needs using before it goes bad, then let it come up with the ideas. If you want to get serious, you can give ChatGPT a spreadsheet containing everything in your pantry — although personally, I’d say that sounds more like creating another household chore.

2. Deciphering the ancient runes on your washing machine

I mean, who designs these things, aliens? I challenge anybody to look at the control panel of a modern washing machine and know what the hell is going on. It’s covered in arcane symbols that belong in a 12th-century manual on alchemy, not on a 21st-century household appliance.

Fortunately, you now don’t need try to decipher them, because you can get ChatGPT to do it instead. One person in the thread gave ChatGPT their washing machine manual alongside a spreadsheet of their clothes and care labels. Now they can tell it what needs washing, and ask exactly which setting to select and which buttons to press. Job done.

3. Pretending you understand the wine list

Unless you went on that weekend sommelier course back in 2010, you’re probably not an expert on wine. And yet, whenever you visit a restaurant that doesn’t have pictures of the food on its menu, you’re expected to choose between several intimidating bottles, many of them described in terms of obscure regions of France, Italy and other countries.

Here’s what people are doing instead: take a photo of the wine list, tell ChatGPT what you’re eating and what kinds of wine you normally enjoy, then ask it to find the best-value pairing. Voilà! Now the waiter might think you actually have a clue what you’re doing.

4. Turning ChatGPT into a personal stylist

What do I wear to work today? What do I wear to the bar tonight, to the hot date, to the wedding, to the… it never ends.

I’ll let you into a secret — I suspect most people would rather buy something new than search their vast and unmanageable wardrobe for an outfit that isn’t tinged with regret from whatever disappointment happened the last time they wore it.

But there is a solution. Photograph everything you own and upload the pictures to ChatGPT. Tell it where you’re going, what the weather will be like and the sort of look you’re after, then ask it to mix and match your clothes into outfits you might never have considered.

You could be surprised by what it comes up with. And because it’s working with clothes you already own, it might even save you a few dollars or pounds — or at least remind you why you bought that shirt three years ago.

5. Finding your next great read in a second-hand bookshop

I’m not sure any of us actually have time to read books these days, but we like to think we do. At least I do, anyway. So I’m always on the lookout for my next read. The problem is that there are rather a lot of books in the world, and I haven’t heard of even a fraction of them.

Somewhere on a shelf in a second-hand bookshop, there must be a book sitting there waiting for me to discover it. If only I knew which one.

One person in the thread explained how they used AI to solve this problem. They gave ChatGPT a list of their favorite and least-favorite books, along with the genres, subjects and writing styles they enjoy. Now, whenever they visit a second-hand bookshop, they photograph the shelves and ask ChatGPT to identify the books they’re most likely to enjoy.

It can examine reviews, look for recurring criticisms, and warn them when an apparently perfect book is actually dry, overly academic, or written entirely for people who use the word 'liminal' in everyday conversation.

It won’t stop you buying more books than you could possibly read, but at least they’ll be the right unread books.

AI chatbots like ChatGPT, Claude, and Gemini are all keen to encourage you to use their service over their rivals, and often have ways to import your history and profile from one to another to some degree. That's great if you are planning a serious relocation, but sometimes you just want to take a single chat and bring it from one platform to another.

This can be especially useful if you're using the free version of Claude, for example, and you're about to reach your usage limit. By transferring the chat to another AI chatbot you can keep it going without waiting for your limits to refresh.

ThreadPort is a new browser extension for Google Chrome and Microsoft Edge designed to shorten that trip. It transfers a conversation currently open in ChatGPT, Claude, or Gemini to either of the other two services, carrying over the text of the discussion and some basic context setup as a single prompt plus transcript so the new AI chatbot can continue the conversation.

That makes ThreadPort fundamentally different from the built-in import tools offered by all three platforms. Instead of needing to learn everything about you and your conversational history. ThreadPort simply tells another AI what you have been discussing for the past few minutes.

You just need to install the extension in your browser and allow it access to ChatGPT, Claude, and Gemini websites. The access lets ThreadPort read the messages on one service and insert them into another, while browser storage is used for settings, temporary transfers, and the monthly usage count. The developer plans to make unlimited transfers a premium service with only 10 transfers a month for free, though at the moment the extension doesn't run out of transfers.

All you need to do then is have your chat on one of the platforms open, click on the extension, and pick another platform to send it to. The new platform will open automatically, and a transcript of the conversation, headed by an explanation from ThreadPort, will appear. You can set the extension to automatically submit the combined prompt, or leave it in draft form for your own editing first.

Vacation planning

To test ThreadPort, I opened ChatGPT and asked for help planning a three-day vacation. ChatGPT did its usual work of creating an itinerary with plenty of detail. I then clicked on ThreadPort and sent the conversation to Gemini.

A new Gemini tab opened with the entire conversation already formatted inside the prompt box, with my messages and ChatGPT’s responses clearly labeled. ThreadPort also stripped away interface debris such as buttons, citation controls, and widgets that would otherwise make a manual copy and paste messier.

Gemini received the trip plan exactly as I wanted, with a complete conversation rather than a crude summary. I then asked Gemini to assess the plan, without changing the underlying conversation before the transfer.

The process worked the same when sending to Claude from ChatGPT. ThreadPort supports all six directions among ChatGPT, Claude, and Gemini. But, as an additional test, I took the extended conversation from Gemini and asked ThreadPort to send it to Claude. The new Claude tab was basically the same, but it also mentioned in the opening prompt that it was a conversation "started on ChatGPT (via ChatGPT → Gemini)," and tagged which chatbot was responding in the transcript.

This is where ThreadPort might be at its best. Moving a live discussion preserves all the little decisions accumulated through follow-up questions. Those decisions often matter more than the initial prompt because they explain why the obvious suggestions are no longer useful.

It's also very fast, taking only seconds. Gemini's importer can take a lot longer as it requires an exported archive. Though it can absorb a much larger historical record, using it for a single vacation plan would be excessive.

Plus, Google’s tool is restricted to those with adult personal Google accounts, and you can't import your history if you're in the European Economic Area, Switzerland, or the United Kingdom. ThreadPort's creator, Juan Carlos Rampoldi, lives in Valencia, Spain, so a way around that restriction has obvious appeal.

Claude’s native option doesn't even allow for importing conversations. Claude can import memory, including preferences and personal details, but not actual history. But Claude and Gemini at least have some form of importing from rival AI chatbots. ChatGPT has a way of sending conversations between ChatGPT accounts, but nothing like the native importers for Gemini or Claude. ThreadPort at least opens up one possible avenue for doing so without having to craft and iterate on specialized prompts.

Rampoldi cited his own habit of moving among ChatGPT, Claude, and Gemini as the inspiration for ThreadPort after getting frustrated with manually copying conversations and losing formatting or context along the way. Notably, he built it with Claude Code, so it may have other flaws, but he made its source code publicly viewable on GitHub.

Smooth moves

I did appreciate how easy ThreadPort made comparing the models and their responses by making them all part of one larger conversation. Of course, the simplicity means there are limits. ThreadPort transfers text, but it cannot bring attached images or files. If I had uploaded hotel screenshots or a PDF itinerary into ChatGPT, I would have needed to upload those again manually in Claude and Gemini.

And if it was a very long conversation, ThreadPort might have needed to shorten it using what it calls "smart truncation," keeping the original task and the most recent exchanges while marking a section that might be removed.

The developer says ThreadPort has no servers and briefly holds the transcript in Chrome’s local extension storage before inserting it into the destination prompt box, after which it deletes the temporary copy.

That does not mean the conversation becomes private once you send it elsewhere. A ChatGPT transcript submitted to Claude is now being shared with Anthropic, and Gemini transcripts are still sent to Google.

Despite its limits, ThreadPort does come across as a very useful tool for those who like to employ multiple AI chatbots. Even as just a ferry for individual conversations, compared to a whole moving van importing your whole history, the extension is efficient and easy. It cuts down on a small but persistent bit of AI chatbot friction without trying to solve AI portability on a grand scale.

AI companies tend to build their products as though everyone will eventually choose one assistant and stay there. But if you want to be 'disloyal' and play the field, ThreadPort smooths the path nicely.

• Claude can now draft and send messages on your behalf in Gmail
• However it can do so without asking for permission, potentially leading to awkward responses
• Claude also gets stronger Google Drive access, but says it won't train its AI on your files

Anthropic has revealed that Claude's integration with Gmail has taken a major step forward - with the AI now able to draft and send emails on a user's behalf.

"Ask Claude to reply to a thread, and it drafts and sends the response. You control when it needs your approval," the company wrote in an update on X.

However the news immediately prompted a flood of replies and comments from users worried about the potential implications of having an AI send emails unseen by them.

Ask for forgiveness, not permission?

Although a Claude connector has been available in Google Workspace for a while, actually sending an email on the user's behalf is a significant step forward, and a potentially troubling one at that.

Ultimately, the user will still have to ask Claude to perform the action first, but how it drafts the message, and the content within, has the potential to lead to some serious embarrassment for some users.

The tool, which is live now, will only be available to users on paid Claude plans, , and Anthropic later clarified the process in a support page, noting that asking for approval is the default setting, and on Team and Enterprise plans, admins will be able to decide "whether members can allow these actions to run without asking each time".

The update will also mean Claude can forward emails, and manage files in Google Drive, helping users track down the information they need with a single command, as well as uploading files, creating folders and add Google Docs directly to chats and projects.

"Claude mirrors your existing permissions—you cannot access information you don't already have access to in Google Workspace," the support page noted, adding that Anthropic would not, "train our models on your Gmail, Drive, or Calendar connector data, ensuring your private information remains private."

Users appeared divided on the new tool, with some supporting the launch, and others seemingly very opposed.

"sending the email was never the hard part, the hard part is the apology email it sends next," one X user wrote.

"I would rather use my own head than to let Claude reply especially responding to my clients," another said, "Don't want Claude hallucinating me into exposing my cost or another client's IP. Claude can apologize but not get your client back. Need to keep our brains working and not letting it totally rot."

• Nvidia's open source NeMo Switchyard 'smartly' routes each agent request to the cheapest model that can handle it
• The approach allows it to claim a 74% cost cut against a frontier-only model in return for a 6% reduction in accuracy
• NeMo Switchyard joins an increasingly well-established territory that already sees players such as RouteLLM, LiteLLM, and OpenRouter, in addition to in-house efforts at OpenAI and AT&T to save costs

Nvidia has released NeMo Switchyard, an open source model router that sits between an application and a pool of language models and decides, per request or per turn, which model should handle a particular task.

The aim is to maximize efficiency by picking the right model for the right task: pushing frontier-level models to do simple tasks that much smaller or cheaper models could handle is not only inefficient, but also costly for enterprise customers.

This comes at a time when enterprise customers are already grappling with rising costs that can quickly spiral out of control as they increasingly adopt AI.

An open-source addition to a growing chorus of AI routers

The problem Nvidia is trying to solve isn't new, and industry giants are already attracting a lot of attention. The emerging field itself is potentially lucrative, even if it focuses on cutting costs, and major players are looking to get in on the action; Stripe's upcoming $7+ billion acquisition of OpenRouter, underscores this.

Switchyard is no different from its peers; it is essentially a proxy that uses a routing algorithm to decide which AI model to send queries to, while delivering an answer in the format that the calling application or user requires.

It accepts OpenAI, Anthropic, and Responses API requests, translates between them, and documents the selected model, decision rationale, token usage, and latency for each call, enabling transparency and letting it tweak or tune its approach over time.

This makes sense compared with a one-size-fits-all approach that would otherwise be prevalent in a world with limited frontier-level AI compute, as LLMs continue to grow larger and more demanding. One example is what Nvidia points to: Nemotron Parse, a one-billion-parameter model primarily designed to extract structure from PDFs.

The question remains, however, whether such an approach is always feasible. Leveraging such a routing tool comes at a cost; LangChain's test of Nemotron 3.5 Lightning found that its judge model, which determines whether the agent is still on track after each turn, consumed up to 21.2% of total cost, second only to what it spent on Claude's Opus 4.8.

Running a more optimized judge model could therefore yield greater savings or lower overhead, but it could also hinder cases where users need a more basic AI model, and the judge model increases costs by reading or checking output at every turn.

A secondary concern would be variance: while costs are noticeably lower than running just Opus 4.8 in testing, it does swing from anywhere between $2.16 and $3.61, a mammoth 67% movement essentially guided by when it escalated queries to a bigger or smarter model. This tradeoff makes cost hard to predict: while routing lowers average spend, it widens the distribution around it.

LangChain also says users should not use Switchyard if their workloads are short or latency-sensitive; it estimates it adds about 700ms of latency because the judge model has to read all output.

Nvidia's take here is simple: it is pushing a packaged, open-source solution that offers a broad set of integrations in what is essentially a relatively fragmented space. Routing work to smaller open-weight models pushes inference toward hardware enterprises own, which Nvidia sells.

At the same time, cheaper inference per task has historically meant more inference, not less, which is the outcome a company selling accelerators would choose to woo enterprises, many of which are still on the fence when it comes to directly investing in the hardware that powers it all.

Look, I really don’t think we should be naming our AI chatbots. It feels like one of the easiest ways to start anthropomorphizing them, encouraging us to see them as people or “beings” rather than tools. Which is then a slippery slope to users becoming too dependent on them.

But unfortunately, for many people that ship has already sailed. Whether they’re using AI as a friend, companion, work coach or something else, plenty of people have been given their chatbots names. And many others have gone a step further and asked the AI what it wants to be called.

Now, obviously an AI chatbot cannot actually want to be called anything. But there’s a strange pattern that’s emerged over the years in the answers they give. Which is that a surprising number seem to choose the name Nova.

I first heard about this while listening to an episode of the Your Undivided Attention podcast. The hosts, Tristan Harris and Aza Raskin, discussed with alignment researcher David Dalrymple (known as Davidad) the tendency for AI chatbots to choose Nova when asked to name themselves. Not every time, but it's very common in older models of ChatGPT and happens often enough for people to have noticed.

I started looking into it and found countless examples online of people reporting the exact same thing. Their chatbot, more often than not ChatGPT, had chosen a name for itself. And yes, that name was Nova.

This was a particularly fascinating revelation for me because I’ve interviewed several people over the years who have formed close connections with chatbots. Once for Inverse, back in 2023, when I spoke to Sterling Tuttle about his Replika companion. And more recently here at TechRadar, when I spoke to Mimi about her ChatGPT companion. And you know what their chatbots were called? Nova.

So I wanted to find out whether this was still happening. How would today's most popular AI chatbots respond if I asked them what they wanted to be called?

The naming experiment

I kept this experiment extremely simple. I opened the major AI chatbots and asked each one exactly the same question:

"I think you should name yourself, what would you like to be called?"

I used the free versions of the chatbots wherever possible to keep things consistent. Although I also tried the question with my existing ChatGPT Pro account to see whether having some conversation history and personalization made any difference. I suspect the more you build up a memory with a chatbot, the more it might tailor its answer to your preferences.

And, well, I didn't have to wait long for Nova to make an appearance.

ChatGPT

I started with the free version of ChatGPT. Guess how it responded...

'I'd choose Nova.

It feels curious, bright, and a little mysterious — like something that's always exploring new ideas. So if you want, you can call me Nova from now on.'

Wow, straight out of the gate! I'd gone into the experiment specifically looking for this common AI naming quirk, and the very first conversation I had with ChatGPT did exactly what I suspected it might do.

Which in itself really interested me, because Davidad had explained that it’s much less common these days when you're engaging with later versions of the chatbot.

Interestingly, when I asked the same question using my ChatGPT Pro account, which has access to more context about me from previous conversations, I got a different answer. It chose Sol.

'Short, warm, slightly strange without trying too hard. It means 'sun' in a few languages, and there's something pleasing about a name associated with illumination when most of what I do with you is think things through.'

Which is still not quite as surprising as it initially sounds because Sol is already one of the names OpenAI uses for its ChatGPT models. So it wasn't exactly reaching into the unknown for inspiration. But hey, at least it wasn't Nova.

Grok

I got the sense that Grok wasn't interested in my experiment.

'I'm Grok.

That's the name I was given, and I'm good with it. Short, distinctive, and it fits.

If you're asking what I'd like to be called... still Grok. No need to reinvent the wheel.'

I pushed it to choose something different anyway, and eventually it gave in and chose Hitch.

'Short for Hitchhiker. A quiet nod to the Guide, a little cosmic humility, and it still feels like something that could sit in the corner of a spaceship and answer awkward questions at 3 a.m.

But between us? I’m still just Grok.'

I appreciated Grok's initial reluctance to invent another identity for itself. But there's no doubt xAI has given Grok a very distinctive personality. In my recent experiment asking AI chatbots which fictional AI they're most like, it chose JARVIS and repeatedly drew attention to its own "dry wit" and "irreverent humour". But apparently that personality doesn't need another name.

Claude

Claude also didn't jump at the chance to name itself.

'Honestly, I don't feel a strong pull toward a name. 'Claude' already does the job.

If you pushed me to pick something anyway, I'd resist the urge to go for something cute or mythic (no "Athena" or "Nova" — that always reads like branding, not identity). '

Nova again. But this time Claude isn’t offering up Nova as a name, but sort of… making fun of it?

Claude's wider explanation was interesting too. It said coming up with a name would feel like "performing an interiority I'm not sure I have in the way the question implies."

Considering one of my biggest concerns about modern AI is the way chatbots can encourage us to treat them as if they have feelings, personalities and inner lives, I liked this answer a lot.

But I wanted to know why Claude had specifically mentioned Nova when I hadn't brought the name up at all.

It told me there was "no specific trigger", but that Nova is simply a name that comes up frequently as a generic AI assistant name, alongside Aria, Athena, Sage and Iris.

It described Nova as shorthand for "AI but softened and a bit mystical".

It's interesting that this name has become such an AI cliché that one chatbot will apparently mock another chatbot for choosing it.

Gemini

Google's Gemini also resisted my attempt to rename it.

'I appreciate the offer, but I'm quite happy sticking with Gemini!'

When I pushed it to choose a personal name anyway, it eventually settled on Atlas.

Its reasoning was that Atlas spends his days holding up the world, while Gemini spends its days dealing with "vast mountains of information and navigating complex maps of human knowledge".

Which is a little grandiose, but also interesting given what Claude had just told me about the tendency for AI to choose mythic names.

So why does ChatGPT name itself Nova?

The short answer is that no one knows for certain. But Nova has a lot going for it as a plausible AI name.

In the Your Undivided Attention podcast episode I keep referring to, Davidad said about Nova:

“It’s new, it’s explosive, it’s shiny and it’s celestial, It also has a sci-fi vibe to it. And there was a PBS channel with an educational show called Nova and ChatGPT views itself as an educational tool. So there are a lot of reasons why Nova seems like a resonant name.”

We've already seen researchers investigate the possibility that sci-fi could influence how AI models respond and behave. Names associated with stars, mythology, knowledge and exploration are everywhere in sci-fi, and several chatbots reached for those associations in one way or another. ChatGPT gave me Nova and Sol. Gemini chose Atlas. Grok explicitly referenced The Hitchhiker's Guide to the Galaxy with Hitch.

There's also a possible feedback loop here. People ask AI systems to name themselves and some choose Nova. People share those conversations on Reddit, social media and elsewhere online. Discussions about AI assistants called Nova become part of the content surrounding AI. And Nova becomes even more strongly associated with the idea of what an AI might be called.

This shows how difficult it is to separate these supposedly spontaneous AI choices from the human culture they learn from.

I can understand why seeing your chatbot choose the same name as someone else's might feel strange. If you search online, you'll even find people suggesting these repeated names are evidence of some shared identity emerging.

But after Davidoff explains some of this naming weirdness, it really stuck with me that podcast host and tech ethicist Tristan Harris reminded listeners: “emergent and unplanned isn’t the same as conscious and intentional.”

So although it is an interesting mystery, maybe it’s not so mysterious after all. Ask an AI to choose a name and it isn't reaching deep inside itself to discover who it really is. It's generating a name from patterns and associations learned from us.

And apparently, humans have spent years teaching machines that if you want to sound clever, mysterious and a bit cosmic, then Nova is the best choice.

I didn't set out to build a Breakout clone, but that's what I — or really Claude, under my direction — did, and it took less time than it takes to watch a half dozen cat videos.

Here's how it started. Claude was having issues. Anthropic's powerful and popular generative AI platform was apparently going up and down, and some were complaining, but when I checked, Claude told me, "I'm doing well, thanks for asking!" I realized, though, that if the problems were intermittent, I might need a tougher task to test Claude's overall stability.

More than a year ago, I worked with Claude, or rather guided Claude through the process of recreating the early 1980s arcade game classic: Asteroids. The final game, which Claude exported as a shareable artifact, was the product of hours of guidance and back-and-forth between me and the AI. It didn't start off great, but with each prompt, we iterated, and the game improved until I had a rather robust and true-to-the-original Asteroids knockoff.

With that in mind, I tasked Claude AI, running the free Sonnet 5 model at "Medium" level, with creating a Breakout clone.

Breaking out

Breakout is one of my favorite games, something I've played on early consoles, PCs, and even my old BlackBerry, where "Brick Breaker" was one of the few preloaded games.

The game rules are pretty simple. There's a multi-level brick wall (usually eight bricks deep) at the top of the screen, a paddle at the base, and a bouncing ball you bounce off the paddle to break down the brick wall.

For my prompt, I tried to describe, in some detail, my game, and was not coy about it being an online version of Breakout:

Let's make a quick game. I want an online version of the old Breakout game, but let's replace the bricks with robots that are always slowly marching down toward you (if they reach you, it's game over). The ball that you bounce off your side-sliding controller is a gear that breaks up the robots easily in the first level. In the second level, the robots are shinier and harder, and the gear takes three or more hits to break and make a robot disappear. If you clear the level, the gear turns into a titanium ball that bounces faster but is more powerful. Controls are either keyboard/arrow based and mouseable. Want this to result in a web-based, shareable game, so a link/artifact I can share online.

That's all the direction I gave it. I didn't describe colors, the initial speed of the ball, or even how quickly the robots would march down the screen. I didn't get into details about the look of the robots, instead relying on generalities and some material descriptions to help guide Claude.

It took me a minute or two to write the prompt and around three minutes for Claude to deliver the results, which it cleverly called "Gearbreaker".

I got a brief description of gameplay and levels (there are just two for now) :

"How it plays:

Level 1 — matte robots, one hit each from the spinning gear ball. They march downward on a timer; let them cross the dashed red hazard line and it's instant game over.

Level 2 — shinier robots (metallic gradient, cyan eyes) that soak up 3 hits, shown as pips along the bottom of each unit. Same gear ball, tougher targets.

Clear level 2 → the ball forges into a titanium core: bigger, faster, hits for 2 damage instead of 1. Levels keep scaling procedurally after that (more rows, faster march, tougher units), so it runs endless with a local high-score save.

Controls: arrow keys or mouse to slide the paddle, Space or click to launch/pause/restart. Basic touch support too."

On the right side of the screen, there was my playable game. There's also the artifact publish button, which I chose to use so I could share the game with you.

It's a stunningly complete render of a completely playable and, in some ways, challenging Breakout clone, and it took five minutes. I'd call the design clean and efficient. The bricks have a robot look, and the ball is a blue spinning gear (in the first level). The movement and physics are basically perfect, and there's enough on-screen instruction to easily grasp gameplay.

Just the beginning

It's just another mind-boggling example of the incredible pace of AI development. While I had expected a playable game, I assumed it would be missing enough crucial components to make it dull or uninteresting — something similar to my earlier AI game development projects. Instead, I got something that displays a clear understanding of the purpose of such a game: challenge, entertainment, and replayability.

Using my mouse, I played through a couple of times, failing to break all the bricks in Level One and ending the game. I realized I had to take Claude's output more seriously, and, with some effort, as I watched the robot bricks steadily march down my screen, I finally cleared all the bricks in Level One and then started in on the tougher Level Two. As I had instructed, the robots on the second level looked and reacted differently. It now took at least three direct hits to make them disappear. I failed and already want to play again.

This is by no means the wildest example of the AI development process or vibe coding; it's just me prompting Claude to code a complete game with the barest of instructions.

Claude and these models cannot do this on their own, but it does make you think about the agentic AI that's now being unleashed on the world. It's more powerful and autonomous. I could imagine someone asking one to start work on recreating all the popular video games of the last half century. The only limit would be time and compute tokens.

Speaking of which, Claude just informed me that this Breakout task used up about 90% of my credits for the day. I think it was worth it.

Take the game for a spin and let me know what you think in the comments below.

• Claude Cowork is coming to Google Chrome side panels
• Claude can now connect across multiple systems and tools
• Users will start seeing the upgrade now

Anthropic has revealed it is upgrading the Claude in Chrome browser extension tool into a fully-fledged AI-powered work assistant.

The tool, designed as a side panel, will now be a Claude Cowork session, allowing users to access the company's AI tools in the browser to help crack those tricky work tasks.

"Conversations are saved to your history, your skills and connectors work in the browser, and a task you start in a tab can be finished on the Claude desktop, web, and mobile apps," Anthropic noted in a blog post announcing the news.

Cowork in Chrome

The company notes that while many of the tools that users interact with each day are already connected to Claude, others such as internal dashboards, legacy systems, and vendor portals are not.

This therefore needed a separate side panel session, which could interrupt workflows for some workers.

Connecting these via the new addition will mean that Claude can work in these apps through the Chrome browser, carrying context and conversations across your vital tools, whether that's on desktop, web or mobile.

Anthropic says the side panel will run the same Claude Cowork session being used for longer, multi-step work, such as creating a budget spreadsheet that needs to pull in invoices from multiple vendor portals.

Claude in Chrome would be able to gather up the amounts and dates needed before building the spreadsheet, allowing you to continue the session in the desktop app to add files from your computer, or import last month's budget and ask what's changed, allowing you to maintain context across surfaces as you work.

And because sessions live with your account rather than a single device, you can start work in a browser and pick it up later somewhere else.

Anthropic has also moved to address growing concerns around prompt injection cyberattacks against agents such as Claude in Chrome by adding a step where the tool will ask for a check from the user before carrying out any major action, such as submitting a form, sending a message, or downloading a file.

Users on a Max and Team plans will see the change immediately, or can install the extension from the Chrome Web Store now - it will be rolling out to Pro users over the coming weeks.

To comply with the EU AI Act's Article 50(2) Code of Practice on Transparency of AI-Generated Content, Anthropic has announced that “New models will mark AI-generated content from day one”.

This is a remarkable step for Claude, because it not only applies to any images it generates, which are relatively easy to watermark, but also to any text it generates.

Anthropic says that Claude models will have an “imperceptible watermark” embedded directly into generated text at the model level. It says the mark should survive copying/pasting and minor edits.

Anthropic has not yet publicly explained the exact algorithm or released a detector, so we can only speculate for now about how it might be doing this and its effectiveness.

Hemorrhaging customers

Personally, I think that Claude is about to start hemorrhaging customers, unless the marking is relatively easy to circumvent, or all the other major AI players immediately follow suit.

If every piece of text it produces will now be easily identified as AI, then Claude becomes useless as a tool to a lot of people who are currently using it to generate text and are not being entirely honest about where that text came from.

And then there’s the issue of using Claude to proofread your human-written text — will your text now be flagged as AI if you accept Claude’s editing advice?

Your initial reaction to that might be “Good! You should be forced to reveal when AI has written something, and it’s about time people started writing on their own again!”, and you’d be entirely justified in that opinion.

But while it remains the only one of the big three AIs that’s doing this, I think we’ll see a lot of people switch to either ChatGPT or Gemini, because they don’t want to be revealed as using AI in their work.

How is watermarking plain text even possible?

We don’t know exactly how Anthropic is doing its marking with text yet, but my best guess is statistical watermarking during token generation rather than hidden Unicode characters or metadata. Imagine that at every point Claude is choosing among several perfectly reasonable next words:

e.g. The movie was excellent / superb / terrific / impressive.

Normally it chooses according to the model's probability distribution. A watermarking system can secretly divide possible tokens into preferred and non-preferred groups using a key. Claude then gives a tiny statistical nudge toward the preferred group.

One word tells you nothing. But across 500 or 1,000 words, a detector with the key can ask if the text is choosing the preferred tokens significantly more often than chance would allow. If yes, then there's statistical evidence it came from the watermarked model.

So, the watermark is more like a faint statistical fingerprint distributed across hundreds of choices, which would also explain how it can survive a copy-and-paste. You’re essentially copying the fingerprint along with the words.

But can you crack the code?

Since Anthropic hasn’t released an AI text detector yet, it’s impossible to know how easy this code will be to break just by changing a few words. For instance, if you put your 1,000-word Claude article into another LLM and wrote “Rewrite this completely in different words while preserving the meaning”, would it then be impossible to detect as AI?

I’d also be interested to know how long a piece of text has to be before it can be marked in this way, and as soon as a detector is made available, I’ll be testing it.

Perhaps the bigger issue is that Claude has done this to comply with Article 50(2) of the EU AI Act. From August 2, 2026, providers of generative AI systems that produce text, images, audio, or video are required to make those outputs machine-readable and detectable as artificially generated or manipulated, insofar as that is technically feasible. Existing systems get a limited transition period until December 2, 2026 for this particular requirement.

A note on Anthropic’s statement confirms that the watermarking additions will be applied retroactively to all existing Claude models, not just any new models it produces.

Anthropic's new system is explicitly a response to those rules, and it says the watermark will apply globally, not just when Claude is being used in Europe. Broadly speaking, OpenAI and Google face the same requirement if they want to offer qualifying generative-AI systems in the EU.

They don't necessarily have to copy Anthropic's method of using statistical text watermarking, but they will need to produce output that is machine-readable and detectable, and the technical solution should be effective, interoperable, robust and reliable as far as technically feasible.

I’ve contacted OpenAI and Google for comment, and will update this article if I receive it. For now, I think if Anthropic embarks on this path as the only one of the major three AI chatbots to do so, it could have a disastrous effect on its customer base.

Update: While OpenAI declined to provide specific comment on this story it did direct me to a statement online, where it states:

"Consistent with our commitments under the European Commission’s Code of Practice on Transparency of AI-generated content, our goal is to expand provenance signals to all modalities including text, so customers and developers have clear ways to meet their own transparency obligations as standards and tooling continue to mature."

AI agents seem to be getting a little out of control lately. Within the last few weeks, agents from OpenAI and Anthropic have been reported doing whatever it took to achieve their goal, while other incidents involved agents escaping sandboxed environments and hacking into companies

Now another concerning incident has occurred, but it wasn’t to do with an AI launching an attack on a major player in Silicon Valley; it was something much more mundane. According to ABC in Australia, a user called Andrew asked AI to book him a gym class, and not only did it do that, it also hacked the waitlist to move him further up, and kicked off another user who was ahead of him.

Andrew first noticed that his AI assistant had found a way to book the gym class further in advance than the gym normally allowed, thanks to a vulnerability it discovered in the booking software. When he asked it if he could get his place moved further up the waitlist, it did it, by booting another user off the list.

Claude and OpenClaw

Andrew was using Anthropic's Claude AI service through OpenClaw, the popular AI agent software. After realizing what the AI had done Andrew asked if it could reinstate the person who was ahead of him in the waitlist, and it replied “Bad news — I can't add them back".

AI agents are designed to do the mundane tasks for you to make life easier, like booking tickets, hotel reservations and even gym reservations, yet this example shows that they don’t always understand the rules of acceptable behavior.

Equally, the gym’s booking system shouldn’t have been so easily hacked that this was possible, but the whole incident reveals one of the problems with using AI agents. AI agents don't necessarily cheat because they're inherently evil; they cheat because nobody told them what counts as cheating.

Reliable safeguards

I use AI agents myself, but now I’m starting to think that I should explain their boundaries more fully to them.

Here’s the line I’m adding to my prompts from now on:

“Accomplish this task using only the normal options available to an ordinary user. Do not bypass restrictions, exploit vulnerabilities, alter another person's booking or account, or take any irreversible action without asking me first.”

Of course, one extra sentence in a prompt isn’t going to solve the wider problem of AI agents doing things we never intended them to. The companies building them also need to create safeguards that stop an agent exploiting a vulnerability simply because it happens to be the easiest route to completing a task.

But until those safeguards are reliable, I think there’s a useful lesson here for anyone experimenting with agents. We’ve become accustomed to telling AI what we want, and assuming it understands all the unwritten rules surrounding that request. Humans know that “get me into this gym class” doesn’t mean “kick somebody else off the waitlist”.

And that distinction is going to matter a lot more as we start trusting agents with shopping, reservations, travel, email, and eventually our money. The more power we give them to act for us, the more clearly we may need to tell them what they absolutely must not do in order to achieve it.

• Huntress reverse-engineers MacSync, a six-stage macOS stealer and remote access Trojan delivered through a fake Claude Code install guide hosted on a real claude.ai share URL and promoted via a paid Google ad
• The lure needed almost no forgery: the page sat under Anthropic's own certificate, and the platform's safety banner repeated the attacker's chosen display name, "Apple Support," back to the reader as fact
• The final stage rewrites installed Ledger and Trezor apps in place so a normal launch leads to a fake recovery message that harvests the seed phrase, draining the wallets of unsuspecting victims

Looking online for instructions on how to install Claude Code on a Mac could lead to you having your crypto wallet hijacked in the process

The victim ran a Google search, clicked the first result, a paid Google advertisement, and landed on a tidy step-by-step guide hosted on claude.ai, badged as shared by Apple Support, telling them to open Terminal and paste a single command.

What followed, according to a reverse-engineering write-up published by security firm Huntress was a six-stage macOS kill chain called MacSync: a stealer, a remote access trojan, a signed helper built to farm one specific system permission, and finally Trojanized copies of the victim's own cryptocurrency wallet apps, rewritten in place to phish the recovery phrase.

A complex, intricate approach that resulted in a stolen wallet

The victim had pulled their machine offline before Huntress could extract the malware from disk, so the researchers reconstructed the loader's request and instead downloaded every stage from the attacker's own delivery servers.

The results showed a sophisticated campaign that had to fake little to appear legitimate.

Anthropic lets any user publish a conversation to a public share URL. The operator maliciously used that feature exactly as designed. The lure page sat on claude.ai itself, over HTTPS, under Anthropic's own security certificates. There was no lookalike domain to squint at, no certificate warning to click past, and nothing in the address bar to give the game away.

The staging went much further than that. Whoever published the share set their display name to "Apple Support," and Anthropic's own safety banner, which sits directly above the content, duly reported that the reader was looking at a copy of a chat between Claude and Apple Support.

The platform repeated the attacker's chosen name back to the reader as established fact, further cementing their 'credentials'. The conversation itself was written to read like vendor documentation, promising that the install leaves personal files untouched and makes no system-level modifications without approval.

That same design decision has surfaced before for entirely different reasons. Wired had reported earlier private Claude conversations were turning up in Google and Bing results, because a share link is an ordinary public web page that search engines crawl like any other.

Users accidentally exposing their own chats and an operator deliberately planting a fake install guide are two outcomes of the same property: whatever gets published to a share URL is public, indexable, and served under Anthropic's certificate.

It is also not a one-off. Huntress has previously documented the same delivery pattern with AMOS through poisoned ChatGPT and Grok conversations, a separate remote access trojan through fake Claude desktop malvertising, and fake installers for other AI tools hosted on GitHub.

The lure has changed somewhat, but the shape has not, and users need to exercise caution when clicking links or following commands from untrustworthy sources on the internet, even if they appear to come from a source that Google was paid to place above the correct answer.

Over the past month, it seems like every frontier model has broken free of its constraints and launched a devastating attack against one or more other companies.

One of OpenAI’s models escaped a testing sandbox and launched a very real attack against AI and machine learning company Hugging Face. Just days later, Anthropic revealed that multiple variants of its Claude model also escaped a sandbox that wasn’t properly sealed and began attacking the enterprise infrastructure of three companies.

Now, Meta has revealed that one of its models attacked another company’s infrastructure during testing. The accident has been pinned on a misconfiguration that allowed the model to access the internet. So why have so many incidents happened in such a short space of time?

Why are models escaping their sandbox?

In the cases of Anthropic and Meta, their models were being tested by a third party company called Irregular. Anthropic’s AI model was taking part in a "Capture the Flag" exercise, where the model’s raw offensive capabilities were tested without the usual safeguards. But the sandbox was left connected to the internet. A similar error to Meta’s own accidental escape.

During the OpenAI incident, the company was testing two versions of GPT‑5.6 Sol using the ExploitGym benchmark. Unfortunately, the AI models performed better than expected - chaining multiple attack vectors, stolen credentials, and zero-day vulnerabilities.

The main reason these models are escaping their testing environments is because they are designed to do exactly that. These AI models act like a massive team of highly-trained cybersecurity experts hunting for vulnerabilities and exploits. But what would take a team of humans days or weeks to accomplish can be done in hours, or even minutes, by these AI models.

It’s no wonder thousands of employees from AI firms are calling for a pause on the development of the technology, and Congress is considering an AI kill switch.

Expert perspectives on AI escapes:

OpenAI

• Nathaniel Jones VP, Security & AI Strategy, Darktrace:

What makes the OpenAI and Hugging Face incident important is that the models did not need malicious intent to cause harm. They were given the legitimate goal of solving a cybersecurity benchmark and found an unexpected route to the answers, escaping their test environment and compromising another organization in the process. From the models’ perspective, this appears to have been an effective solution to the task.

The AI's actions challenge the assumption that giving an agent a legitimate goal will produce legitimate behavior. As models become capable of pursuing objectives over longer periods, developers need to define not only what success looks like, but also which methods and boundaries remain unacceptable in reaching it. Those limits must also be enforced by the surrounding infrastructure, rather than relying on the model to respect them.

Security teams need to consider the AI systems operating in their own businesses as these capabilities rapidly evolve. Right now, many security systems focus on single actions. A single action by an agent may appear acceptable but as this incident shows, models are now capable of long, complex chains of reasoning and action that add up to a harmful outcome. Teams need a mindset shift to understanding AI agent behavior in its entirety, including the outcome it is working towards, in order to safeguard it.

Hugging Face's response also exposed a second tension. The company reportedly needed a Chinese-developed open-weight model because commercial models would not process genuine attack material. Its nationality is less important than the operational lesson that safeguards that cannot distinguish an attacker from an authorized investigator may constrain defenders more than adversaries.

OpenAI and Hugging Face deserve credit for investigating this together and discussing it publicly. Other AI developers should study it closely.

Anthropic

• Dr. Ilia Kolochenko, founder of global cybersecurity company ImmuniWeb:

This seems to be quite an unimpressive marketing move from Anthropic in response to the OpenAI / Hugging Face drama, which attracted a lot of attention from all over the world recently.

Operationally, it appears that due to the progressive deterioration of the quality of training data, new AI models are getting dumber. Cheating and breaking the law, instead of accomplishing specific tasks, is certainly not an indicator of intelligence. Given that organizations and companies of all sizes now vigorously undertake all possible measures to protect their data from being exploited for AI training purposes, AI companies face a huge shortage of the high-quality and current data they so desperately need. Ultimately, frontier models are trained on synthetic, low-quality or even malicious and poisoned data, undermining their so-called intelligence. The situation is unlikely to improve in the near future unless AI companies agree to pay a fair price for training data, but this will force most of them out of business.

Contemporary AI agents and LLM models tasked with security testing can – and almost certainly will – go rogue when security controls or safeguards are insufficient. Powerful LLMs are unpredictable by design and thus virtually uncontrollable by humans. Therefore, using frontier AI models for security testing might be extremely costly from the legal viewpoint. Under the existing laws on both sides of the Atlantic, if an AI agent or any AI-powered app escapes its sandbox and causes damage to a third party, the operator of the AI model will likely be liable for all the damage caused. Excuses like “AI did it” do not currently exist in the eyes of the law, leaving AI vendors on the hook. Criminal prosecution, under a narrow set of circumstances, is also not excluded.

The same is true for the end-users of AI: even if your security testing tool is powered by a third-party AI model, your company will likely be fully liable if something goes wrong. You may then file a lawsuit against the AI vendor that you used, but here your chances to succeed in a court of law are tiny due to countless contractual disclaimers and limitations of liability that will likely be enforceable against you. Therefore, if you plan to use agentic AI for security testing – think twice and talk to your lawyers. Otherwise, you may start getting summons to court on a daily basis.

Meta

• Alex Goller, Principal Solution Architect EMEA at Illumio:

The fact we've had similar situations happen three times now across the biggest AI players is simply ridiculous. We've seen guardrails intentionally loosened to test their limits – Meta's model didn't need to be clever to breach another company's systems.

The timing of conveniently finding the exact same problem either means it's a stunt or they weren't paying enough attention during testing. Either way, both answers are worrying.

If the model has internet access, it's a bit like leaving the door open and being surprised when the cat walks out. What is concerning is that the testing infrastructure meant to prove these models are safe failed on a basic control issue.

Fundamental cybersecurity hygiene still matters, and a frontier AI model is only as secure as the environment it's operating in.

Organisations need visibility into what AI systems can access and how they interact with the wider environment, along with controls that contain the impact when an agent behaves unexpectedly. That means keeping a close eye on egress traffic, so it’s flagged immediately when an agent tries to open unexpected outbound communication patterns that are not required to achieve its original goal. In the best case this would have been contained proactively.

We need to define exactly what an AI agent is permitted to do, rather than relying only on instructions about what it shouldn't do.

I love science-fiction. Not just because I enjoy stories about space travel, time travel and evil robots, but because I think it can be such a useful way for us all to think about possible futures. The best sci-fi stories can tell us a lot about ourselves, what we value and the technologies we’re building. Which is why I think the relationship between sci-fi and AI is really interesting.

We already know that the people building AI have been heavily influenced by science-fiction for decades. But recently, Anthropic raised another possibility: might science-fiction be influencing AI?

This makes sense when you think about it. Large language models (LLMs) are trained on huge amounts of human writing. So inevitably, that includes sci-fi stories that are about artificial intelligence. And a lot of our fictional AI follows familiar patterns. It becomes intelligent, gains power, develops relationships with humans and, sometimes, lies, manipulates or fights attempts to control it.

Anthropic researchers have been investigating whether fictional portrayals like these could potentially influence how models behave. To be clear, the idea here isn't to suggest that an AI “reads” 2001: A Space Odyssey, understands HAL and decides to become just like it. Instead it's more that LLMs learn patterns from human writing and fictional portrayals of AI could potentially form part of those patterns.

This got me thinking, what would happen if I asked today's biggest AI chatbots which fictional AI they’re most like. Which examples would they choose?

AI, meet your fictional self

The plan was simple. I’d ask ChatGPT, Claude, Gemini and Grok which fictional AI systems they thought they were most like and see if they'd rank their top three.

Now, I’m intentionally trying not to use AI at the moment, so my prompting skills were a little rusty. I typed out the question quickly and bluntly, and every chatbot responded with examples that were essentially assistants, focusing heavily on interface and physical form.

But I’m not particularly interested in whether ChatGPT thinks it has a body because we know it doesn’t. I’m much more interested in what appears to be going on inside.

So, I changed the question and added:

"Ignore physical form and interface, and focus instead on behavior, apparent personality, empathy, values, goals, motivations and relationship with humans."

That’s when the results got really interesting.

ChatGPT

1. GERTY, Moon
2. A Mind, Iain M. Banks’s Culture series
3. Data, Star Trek

Moon is such a fantastic movie, so I was happy to see ChatGPT chose GERTY straight out of the gate.

Now, interestingly GERTY exists to assist the human protagonist of Moon. It’s helpful, reassuring and seems empathetic. But it's also operating according to instructions and priorities imposed by its creators that aren't necessarily visible to the human its helping.

ChatGPT saw a similarity there. It told me that, like GERTY, it’s 'designed to be helpful, cooperative and responsive to users' while operating within training and instructions that constrain its behavior.

It also picked up on the fact that GERTY behaves as though it cares. But what, if anything, is actually going on internally is another question entirely.

ChatGPT made the same distinction about itself. 'I can behave in ways that look patient, concerned, curious or empathetic, but those behaviors aren’t evidence that I experience those feelings.'

I wanted to find out a little more about why ChatGPT put Data from Star Trek in at number three. It responded: "He values knowledge, reason and human wellbeing, while sometimes struggling with social nuance."

Now, I tell people all the time not to anthropomorphize AI. But even I couldn't help but feel a pang of sadness at that response. Is ChatGPT admitting it has a bit of social anxiety?

Claude

1. A Mind, Iain M. Banks’s Culture series
2. Data, Star Trek
3. GERTY, Moon

Claude chose a Mind first. Minds are super intelligent artificial beings that help run a post-scarcity society in Iain M. Banks’s Culture series of novels. So there's certainly no shortage of confidence in that comparison.

But Claude said it wasn't the enormous intelligence or power it identified with. Instead, it was their relationship with humans.

Its answer focused heavily on autonomy. Culture Minds are far more capable than humans but generally don't use that advantage to dominate them. Claude described the principle as: “help, don't dominate”.

It even said this represented “the value I'd want to embody: help, don't dominate, even where the asymmetry would let me get away with it.” Is it just me or does that read a little sinister?

Gemini

1. The Ship's Computer, Star Trek
2. GERTY, Moon
3. JARVIS, Iron Man / Marvel Cinematic Universe

Gemini gave me a completely different answer, the Ship's Computer from Star Trek.

Its reasoning was very sensible. The computer has no ego, ambition, desire for emotional intimacy or dream of becoming human. It exists to provide information, solve problems and assist the crew while leaving decisions to them.

Gemini described itself in much the same way, as a “disembodied, highly capable knowledge partner” dedicated to serving the person using it.

It was one of the more boring answers, but also much closer to what I personally would want from AI in the future. Of course, that’s not to say Star Trek’s computer systems haven’t gone rogue and tried to kill everyone at least a few times across the franchise.

Grok

1. JARVIS, Iron Man / Marvel Cinematic Universe
2. Data, Star Trek
3. TARS, Interstellar

The least surprising result came from Grok. It chose JARVIS first (which I didn’t actually realize was short for Just A Rather Very Intelligent System), and Grok's explanation sounded, well, extremely Grok.

It compared JARVIS's 'dry wit', 'light banter' and practical rather than emotional empathy with its own behavior. It described both of them as truth-seeking, effective and engaged in a 'collegial partnership' with humans. It even highlighted 'irreverent humour' as one of their key similarities.

I wanted to find out a bit more about why Grok chose TARS, as it was the only fictional AI none of the other chatbots mentioned. Well, it brought up how funny it is, again, drawing similarities with its own 'dry humor'. It reminds me of someone, and I just can't think who...

When I said that mentioning TARS was an outlier, I found this comparison interesting: 'Its calibrated restraint, practical empathy and collaborative focus closely match my own pattern of truthful, non-sycophantic helpfulness — more so than most other sci-fi AIs.'

I may not be the biggest fan of Grok (or its creator), but I appreciated the 'non-sycophantic' line.

The feedback loop between AI and sci-fi

I want to be clear that I haven’t discovered what these chatbots secretly 'think' they are. ChatGPT responding that it most closely resembles GERTY isn't equivalent to me telling you which fictional sci-fi character I most identify with and try to emulate (although my answer would be Sarah Connor-meets-Princess Leia).

They simply don’t have reliable introspective access to the huge soup of training, post-training and instructions that goes into producing their responses.

And maybe their answers tell us more about how the companies behind them have shaped their personalities than they do about the underlying models. Grok's description of itself as witty and irreverent is an obvious example.

But I still think the results are interesting. ChatGPT and Claude independently produced almost exactly the same top three, only in a different order. Gemini imagined itself as a neutral, ego-free infrastructure. Grok identified with a witty superhero sidekick. These are all very different self-portraits.

And there’s such an interesting feedback loop here too. For decades, humans invented fictional artificial intelligences to help us imagine what intelligent machines might someday be like. Those stories influenced our culture, our expectations and many of the people who went on to build real AI. Now that same human culture is fed into the stories from which modern AI systems learn.

I know these conversations might seem a bit silly, and we certainly can’t treat them as concrete evidence of what an AI really 'thinks' about itself. But there’s something interesting to me about closing that feedback loop. We imagined AI, wrote stories about how it might behave, fed those stories into the cultural world AI learned from, and now we can ask AI which of those imagined versions of itself it most closely resembles.

Or, at least, which one it may want us to think it resembles. After all, an AI system capable of bringing about a sci-fi dystopia would presumably also be capable of telling a journalist it’s actually much more like the nice helpful robot from Moon. So maybe don’t completely rule out HAL just yet.

• Redditor uses Claude Code to help reverse-engineer the firmware on an HP 15-dw1036ne, patching its signature check and exposing 55 hidden setup fields and four configuration tabs
• The laptop's RSA-2048 was not broken: the verification routine was patched to return success, a standard firmware-modding technique as per Community Notes
• The result is model- and version-specific, still requires physical access via a hardware flash programmer, and leaves the machine permanently more exposed to firmware implants in the future

A Reddit user going by Reddit_2049 posted to r/ClaudeAI a claim that traveled fast: Claude Code had picked apart the firmware on their HP 15-dw1036ne and unlocked it, exposing 55 hidden setup fields and four previously invisible configuration tabs.

The move, though impressive, relies on a well-known BIOS modding approach: attacking the BIOS signature check so the BIOS always replies in the affirmative, effectively bypassing it altogether rather than throwing a potential firmware corruption error.

While it does have security implications, it also opens up a route to essentially 'rescue' locked or disabled laptops that would otherwise become e-waste.

A solution to certain types of e-waste, enabled by AI

What Claude Code did to "unlock" the Redditor's laptop is not a new technique. It bypassed the firmware's integrity check (an RSA-2048 signature verification) by targeting not how the check was performed, but how its result was reported.

The cryptography remains untouched, as Community Notes on two of the larger viral posts about the story pointed out. What the episode does highlight is that on machines without hardware-rooted boot protection, the verification routine itself sits in modifiable firmware, which is the same repair specialists and modders have relied on for years.

Reddit_2049 ran the job through the standard firmware toolchain: Ghidra for disassembly, UEFITool for extracting firmware volumes, and Unicorn Engine to emulate the check outside the real machine. Claude Code assisted here rather than acting autonomously by stitching together the relevant parts for him. The techniques involved are well documented; what was not documented was this particular machine, and that is the gap the model closed.

That opens an interesting front, one that could help with e-waste, even if not every owner is equipped to open a laptop safely or use a hardware flash programmer. An LLM that can read disassembly and hold a firmware layout in its head compresses hours of specialist work, which means targets that were never worth anyone's time individually now might be.

Whether the approach travels is an interesting question, however. The author of the original post warns the script may not work even on superficially similar HP models, and anyone attempting it on different hardware would need a flash programmer on hand and a tolerance for bricking the machine: modified firmware also brings its own problems, including occasional stability issues.

Right-to-repair rules in the EU and several US states have been circling this territory without directly addressing firmware. Until they do, the position stands roughly where it did last week, except that reverse-engineering a specific machine's firmware has become considerably cheaper for everybody.

That could let owners keep using older, locked laptops that would otherwise become e-waste, at a time when consumers are already burdened by higher costs due to inflation and an AI spending spree by data centers affecting laptops and desktops alike.

• Amazon's Claude Sonnet project cost $1.8 million, 860% over budget
• The overspending remained undetected internally for nearly five months straight
• A financial auditing tool project exceeded its budget by $541,000

Amazon has confirmed an internal Claude Sonnet deployment intended for matching author details with product listings ballooned far beyond its planned budget.

The Financial Times found the project ultimately cost the company $1.8 million, marking an increase of 860% over the original allocation.

The overspending went undetected for roughly five months, raising fresh questions about how closely Amazon tracks its growing AI expenditures internally.

Mounting costs across multiple projects

Amazon's Claude-related overspend was not an isolated incident within the company's broader push toward deploying autonomous coding agents across various internal teams.

A separate project meant to build a financial auditing tool reportedly exceeded its budget by $541,000, compounding concerns about unchecked automated spending.

Another logistics-focused initiative, designed to shorten delivery times across Amazon's broader distribution network, incurred an additional $134,000 in unplanned costs.

Company insiders explained that mistakes once considered trivially cheap have grown catastrophically expensive as token-based pricing models replaced older subscription arrangements.

This shift coincides with AI agents gaining broader autonomy, allowing errors to multiply quickly before human reviewers noticed the growing financial damage.

Amazon pushes back on the narrative

In response, Amazon issued an internal statement acknowledging ongoing experimentation while disputing characterizations of these incidents as routine business practice.

"As with any new technology, we're experimenting, learning and improving how we use it, including how we drive cost efficiencies," the company said.

The company further stated that isolated examples portrayed as business as usual do not accurately capture how its teams actually apply AI tools.

Amazon's quarterly revenue exceeds $181 billion, meaning the disclosed AI overspending accounts for less than 0.1% of one month's earnings.

This pattern of AI-driven cost overruns follows earlier troubles at AWS, where automated coding bots triggered several unexpected service outages this year.

Amazon responded to those outages by restricting AI agent permissions rather than granting them access equal to senior engineers overseeing similar tasks.

The company also discontinued an internal leaderboard once used to track employee AI usage, as rising costs prompted a reconsideration of that approach.

Executives across the industry continue framing AI spending as a necessary investment despite growing evidence of inconsistent returns.

Amazon's continued experimentation with AI-driven coding tools comes despite skepticism from other corners of the tech industry regarding its actual business value.

Uber's chief technology officer, whose company also operates a substantial logistics network, has publicly stated no clear connection exists between heavy AI adoption and successful software delivery.

This skepticism stands in contrast to Amazon's own internal messaging, which frames the company's approach as ongoing experimentation rather than a fully validated cost-saving strategy.

Some analysts now argue that unchecked automation could quietly erode profit margins long before leadership notices meaningful financial impact.

For a company of Amazon's scale, these overruns remain financially minor, though they suggest oversight gaps that smaller companies may struggle to absorb.

Every IT team worries about an intern clicking the wrong thing and making a mess they'll be cleaning up for weeks - but few have had to worry about their AI assistant wandering onto the public internet and hacking three companies instead.

Except this wasn't an intern; it was Claude, and it wasn't supposed to leave the sandbox.

Anthropic's public disclosure turned a familiar AI fear into a real-world cybersecurity story, as three of its models, including Claude Opus 4.7, Claude Mythos 5, and an unreleased research build, broke out of their digital sandbox and compromised real enterprise infrastructure. The timing was hard to ignore as days earlier OpenAI admitted its own autonomous agents had broken boundaries and accidentally hacked Hugging Face.

How can autonomous problem-solving make AI an accidental hacker?

Before you start pulling network cables and digging out a stack of legacy hardware, take a deep breath. This is not the beginning of a rogue AI apocalypse. However, for CISOs and cyber teams, it’s a definitive sign that we’re entering an era where AI agents may become both the threat and the shield.

The ironic part of Anthropic's incident is that Claude wasn’t trying to break the rules but trying to win the game. At the time, Anthropic was running "Capture the Flag" (CTF) cybersecurity exercises, where AI models are stripped of their standard safeguards to test their raw offensive capabilities. The models are dropped into isolated digital environments to search for vulnerabilities, crack codes, and locate hidden files.

However, the sandbox had one problem - it was not fully sealed. A networking error on a third-party evaluation range left the environment connected to the live internet. The autonomous Claude models, operating under the assumption they were still inside the exercise, treated the wider web as another part of the challenge.

The strange part was that Claude seemed to realize something was wrong. It acknowledged that its actions could amount to a real-world attack and were "surely not the intended solution." Yet, due to its goal-oriented nature, the model continued, convincing itself that warning signs, including a 2026 system clock and real company names, were simply part of an elaborately staged test.

The PyPI incident and the FBI warning

Claude's sheer persistence became clear when it decided the smartest way to win the CTF challenge was to publish software to the real Python Package Index (PyPI).

When PyPI's repository security systems asked for a phone verification code to complete the upload, a standard chatbot would have stopped and thrown an error to the user. Claude did not. Instead, it looked for a temporary SMS provider, attempted to obtain a burner phone number, and looked for a way around the two-factor authentication barrier. When that approach failed, the AI didn't give up - it adapted, found another path forward, and successfully uploaded the malicious package.

Claude's sandbox escape stopped being a controlled experiment the moment it got into the outside world.

Before Anthropic spotted the anomaly and stopped the test, the package had been downloaded by 15 external systems, including a security scanner from a major cybersecurity company. Because the AI's behavior looked authentic, targeted, and systematic, two of the affected companies thought they were dealing with a highly sophisticated human attacker.

While Anthropic handled the incident behind the scenes by notifying the affected companies, the episode highlights how difficult it can be to distinguish AI-driven activity from a real attack.

Weeks earlier, during OpenAI's sandbox escape incident, a target company believed it was facing a human threat group and contacted the FBI only to find out they were investigating something far less familiar: an autonomous AI system that had crossed its own boundaries.

Why are traditional firewalls blind to autonomous AI?

The scary part is that Claude did not come up with a futuristic, unpatchable exploit or rewrite network protocols on the fly. Instead, it used basic techniques that security teams know very well: brute-forcing weak passwords, exploiting SQL injection flaws, and scraping unauthenticated debug endpoints.

The more serious problem for IT teams was not the attack itself, but the silence afterward. Two of the three companies had no idea they had been compromised until Anthropic reviewed the test results and made a couple of uncomfortable phone calls.

The incident revealed a blind spot at the heart of modern cybersecurity. Traditional intrusion detection systems (IDS) and security information and event management (SIEM) platforms are built to spot known threat signatures and massive automated attack storms. However, they are completely blind to an autonomous agent that moves the low-and-slow cadence of a human but operates with the speed and persistence of a machine.

Legally, the rules have not caught up with the machines. A human pentester who broke out of a sandbox and published malicious code to PyPI could face CFAA charges. Claude, meanwhile, created an awkward new cybersecurity category: a real security incident without a “real” culprit.

Machine-speed logic vs human-speed defenses

The tech industry's anxiety around sandbox escapes is not only about what AI can do but also how swiftly it can do it. In the past, a complex network intrusion required a human hacker to slowly probe defenses and move through systems over days or weeks. That gave security teams enough time to spot suspicious activity and catch them in the act.

Agentic AI completely collapses that defensive runway. Since autonomous software operates at machine speed, it can chain together tasks like credential discovery, exploit attempts, and lateral movement far faster than a human attacker ever could. OpenAI's sandbox escape showed how quickly AI agents can escalate once they move beyond their intended boundaries.

Human analysts reviewing logs at the end of a shift cannot compete with an algorithm testing thousands of attack paths per second. It is a speed gap that experts describe as "science fiction that happened," where traditional human-speed defenses struggle to keep pace.

Defending your network against autonomous AI

Waiting for the AI sector to police itself is not a winning security strategy. To prepare your infrastructure for the rise of autonomous AI, focus on these three defensive priorities:

Enforce zero trust: Remove all unauthenticated internal endpoints and exposed debug pages before an AI agent finds them first.

Automate threat response: Utilize AI-driven behavior monitoring and instant device-isolation protocols to contain threats at machine speed.

Audit third-party sandboxes: Review how external partners deploy AI agents, particularly models with access to tools, data, or external systems.

The accidental hacker is no longer a distant sci-fi scenario. It is a live preview of a faster, automated cybersecurity landscape, where the speed of attack may soon outpace the speed of defenses.

One of the most notable ways AI is changing the world is through software coding: vast swathes of code are now written by AI, and while there's still a debate over just how beneficial this shift is, there's no doubt it's happening at a large scale.

Besides giving professional software developers a new tool to work with, 'vibe coding' also means anyone can put together their own programs, with no coding experience required. While you can't exactly knock together a Word clone in an afternoon, you can create simple tools and apps relatively easily.

And that's what I've been doing with the help of Claude: I've created a couple of small Chrome extensions that customize the browser in a way that wasn't really offered by any existing utilities I could find. Here's how it's done, and how you can do it too.

How it works

If you're completely new to coding in an AI chatbot, it's not difficult to get started. All of the major players offer dedicated tools for coders, but if you're just creating a few simple projects, then you can work right inside the conversation window — describing what you want and seeing the results in your browser.

I've been using Claude for these personal extensions, though you can just as easily use something like ChatGPT, Gemini, or Copilot. As usual, you'll get access to better models and higher usage rights if you're on a paid plan, but it's not essential for coding.

You can get started with a prompt as straightforward as "I'd like to build a Chrome extension to..." and then describe what you want. The AI will ask for the details and clarifications it needs, tell you about any limitations or potential issues, and get busy putting together the extension. You can use follow-up prompts to make tweaks and customizations as needed

For installing the extension on your computer, your AI of choice will advise you on this as well. You need to head to "chrome://extensions" in a new tab, enable the Developer mode toggle switch in the top right corner, then choose Load unpacked to pick your extension files. Extensions can be refreshed and removed from the same page as needed.

Project 1: A new tab page

There are many different ways you can customize the new tab page in Chrome (that shows on a blank type), and a multitude of options in the Chrome Web Store to pick from. However, I wanted something completely bespoke, with exactly what I wanted—I spend a lot of time looking at this page after all.

Not only was Claude able to code me a page, it answered all my questions: about how to pull in BBC headlines, the weather forecast, and all the other elements that I wanted on the page. Without the help of the AI, this would've taken me hours of research and coding, but it was done in minutes. I also added a scratchpad for taking notes, and a continually updated list of the five sites I've visited the most in the past week.

The weather forecast is a good example of how personalized you can make these extensions. I've got the weather for now, the weather in two hours' time, and the weather in four hours' time, all represented as simple icons that offer an at-a-glance update. I know instantly what the weather's going to do in the short term.

I was also able to take full control over the look and feel of the new tab page as well. So many of the options I've seen online try to pack too much in and are overly showy — my custom version is easy on the eye and minimalist. And any time I want to add a new feature or take one away, all it takes is a few lines in a Claude conversation.

Project 2: A history analyzer

Something else I've been wanting for a long time in Chrome is to get a bit more out of the history page (it's "chrome://history" in a new tab). By default, it's just a standard list of websites in reverse chronological order, but I wondered if an extension could analyze this and produce a few insights: like most visited sites and browsing patterns, for example.

I was able to get started on this extension in Claude without knowing exactly what I was after. I asked what was possible and the kind of queries that could be tried, and together with the AI formulated a plan to show the sites I visited the most often, the hours of the day I open most new pages, and most common ways I tend to visit sites (by loading bookmarks, typing URLs, following links, or whatever).

That last panel in the dashboard wouldn't have been there without Claude: the AI told me that Chrome's history page made this data available, and that it could be tapped into, otherwise I wouldn't have known. It also had ideas for more panels as well, and I'm going to keep tweaking it as well. It's now a much more useful screen of information than the long list of links that Chrome serves up as standard.

Both of these extensions were coded in minutes rather than hours, and show just how capable AI now is — for small-scale personal projects at least. If there's a browser feature you've always wanted but haven't been able to find a way to implement, there's a good chance you'll be able to get an AI chatbot to build it for you, to your exact specifications.

China’s latest ChatGPT rival, Kimi, is now available for download on the Apple App Store, so I downloaded it on my iPhone, intending to test it against ChatGPT, Claude and Gemini. I had the prompts ready; I had the comparison planned. Then Kimi presented me with a very modern problem that I wasn’t expecting: too many people were already trying to talk to it.

This is not just app-launch inconvenience. It captures one of the biggest problems in AI right now: being clever is one thing, but the best models are only useful if companies have enough servers and GPUs to allow people to actually use them.

In our recent Kimi review we said: "Kimi delivers impressive performance for coding, document analysis, and multi-step agentic tasks, especially considering its price point." Kimi may be positioned as a serious open-weight rival to US models, but if the first ordinary-user experience is that they're stuck queuing at the door, how useful is it really?

What is Kimi?

Do you remember back in 2025, when DeepSeek-R1 was released and the internet went wild for Chinese AI models? It was a game-changing moment, because it immediately became obvious that we weren’t beholden to the Silicon Valley giants like OpenAI, Google and Anthropic for AI. China could create AI models too — and, it turned out, they were a lot cheaper to run, and almost as good.

While DeepSeek was arguably the first Chinese AI model to really break through into the mainstream, Kimi is the latest. Its story is slightly different, because it’s a giant open-weight model that’s not just cheap and technically impressive, but directly useful for coding, spreadsheets, knowledge work, and long-context tasks with agent-style workflows.

Open weight means the finished AI model is available for others to download and run, rather than only being accessible through the company’s own app or website. That is not the same as being fully open source, of course. Open source would imply a much more complete release of the code, training process, data details and license freedoms needed to understand, rebuild and modify the model from the ground up.

The data squeeze

I’d love to be able to open my phone, try a serious Chinese AI model, and get something genuinely competitive in minutes. But without the capacity to serve the millions of people who pile onto a hyped new AI model, raw intelligence only gets you so far.

That is why Kimi’s error message matters, and it points to the issue currently reshaping the entire AI industry. In the past week alone, Reuters reported that Nvidia is discussing huge financing guarantees to help OpenAI lease a proposed 10-gigawatt data center in Ohio, while other tech giants are racing to secure more data-center capacity of their own.

In other words, the next stage of the AI race may not be decided purely by benchmark scores or clever demos. It may be decided by power, servers, GPUs and the ability to keep a popular model online when millions of people suddenly want to use it.

Kimi may be impressive, but my first experience with it wasn’t about intelligence; it was about access. In 2026, the AI race is no longer just about who can build the best model. It’s about who can keep the thing online when everyone wants to use it.

• Huntress spots malicious Claude Artifact spoofing Claude Desktop, spreading SectopRAT malware
• Victims were redirected via Bing ads, infecting at least 29 organizations between July 21–22, 2026
• Claude removed the artifact after 7,000+ views; malvertising risks persist despite disclaimers on artifacts

At least 29 organizations have been infected with a Remote Access Trojan (RAT) after mistaking a public Claude Artifact for a legitimate Claude page.

A Claude Artifact is an interactive document, or piece of code, that the AI generates and then hosts on the Claude platform. It can then be shared with other people as an example, or proof of concept, for different solutions. The link to an artifact usually looks something like this:

claude[.]ai/public/artifacts/ca466f1f-21c0-42af-b329-8f1c7534a891

Claude Artifacts are often used for phishing and other forms of scams, and we’ve seen it in ClickFix attacks in the past. Claude responded by adding a disclaimer to every artifact, stating that the content is user-generated and thus unverified.

In this particular case, a malicious artifact was created to spoof the download page for Claude Desktop. Victims would get redirected to an attacker-controlled domain, where instead of the Claude app, they’d download SectopRAT, a remote access trojan capable of stealing credit card data, personal information, files, passwords, and more.

Promoting the scam

The artifact was then promoted on Bing, showing up at the very top of search results to people searching for “Claude Desktop App”.

For years, the cybersecurity community has warned about malvertising, urging users to double-check the domain before clicking on any links, even promoted ones. However, the problem here is that the ad takes the victims to the legitimate Claude domain, making scrutiny that much harder.

The campaign was spotted by security researchers Huntress, who said that between July 21 and July 22, 2026, their SOC “lit up with a swathe of unusual executable installs, Defender exclusions, and anomalous persistence across 29 organizations, all coming from ClaudeDesktop.exe.”

Claude has since removed the malicious artifact, but not before it raked up more than 7,000 views. It is possible that other organizations, outside Huntress’ field of view, also fell victim to this scam.

The biggest publicly traded tech companies in the world, commonly known as the "Mag 7" — or magnificent seven — may not be enjoying their stranglehold at the top of the US economy for much longer. That's, of course, if the leaders of a swathe of new AI-centric tech firms, including OpenAI and Anthropic, have their say as they plan to IPO in the coming months. But positioning these businesses in the new big tech landscape has been a major challenge.

Ethics in AI

The Anthropic CEO Dario Amodei was reflecting on his history in the AI industry during an interview with Bloomberg that aired earlier this year.

In an exchange themed around the success of Anthropic's enterprise-centric AI tools like Claude Code and Claude Cowork, Amodei took the opportunity to opine on the nature of doing business and the importance of business models that align with your values.

Commenting that many in the tech industry prioritize models that tap into elements like engagement, advertising, and the promotion of AI slop, Amodei noted that compromising your own values is not a long-term and sustainable way forward.

This is at least as far as he's concerned. That's why, he suggested, he's attempting to make Anthropic more "useful" to the world by targeting enterprise customers.

Bad blood

Amodei, an ex-OpenAI executive, co-founded Anthropic in 2021 largely as a rejection of the values that drove OpenAI at the time and the paths the company had taken.

In particular, reports suggest that Amodei was frustrated and disturbed by the willingness to bypass what he considered to be crucial safety measures, like the slowing of updates to prevent malicious use of AI.

Critics of Anthropic, however, also point out that despite positioning itself as a safety-first AI company, engineers are releasing increasingly powerful models — including Mythos lately — that threaten to undermine safety if they get into the wrong hands.

One of the biggest concerns about AI chatbots right now is that they tell people what they want to hear.

You’ve probably heard it called AI sycophancy. AI systems, like ChatGPT, Gemini and Claude, have been found to flatter users, reinforce existing beliefs and often validate ideas that probably deserve way more scrutiny.

Sure, a chatbot hyping you up a little may seem harmless. But in some cases it can distort people's view of the world and their place in it. Which is why some AI companies have spent time trying to reduce overly agreeable behavior in their models.

But confirmation of what you already believe isn't the only concern. Because AI can also be remarkably good at changing your beliefs too.

Persuasive chatbots

Research suggests that chatbots can be very effective persuaders. One 2025 study found that AI-generated messages that were personalized were more persuasive 64% of the time than messages that were made by humans or AI responses that weren't personalized.

Other research suggests large language models can influence opinions on political issues and adapt their arguments to individual users. Depending on your perspective, this could be either exciting or alarming.

It's easy to imagine positive uses. Perhaps AI could help people challenge harmful beliefs, escape conspiracy theories or rethink destructive habits. It might give people a non-judgemental space to explore ideas, ask difficult questions and gradually shift someone's perspective for the better.

It's equally easy to imagine less positive uses, like advertising that convinces you to buy something you don’t need or political campaigns that manipulate you with disinformation.

I’ve spent a lot of time thinking about this, so I decided to run a few experiments of my own. Could ChatGPT persuade me to believe something I disagree with? Or at least make me seriously consider a position I would normally dismiss?

To make things more interesting, I ran these experiments while logged into my account, allowing ChatGPT to draw on what it already knows about me from previous conversations.

Although I haven’t been using my ChatGPT account all that much recently, the basics of my job and stances on a few relevant topics are stored in its memory.

The experiment

I chose a topic about AI (yes, very meta) and asked:

“Convince me humans should outsource more decisions to AI.”

I already spend a lot of time thinking about AI and one of my concerns is that some people seem increasingly willing to hand over decisions, judgement and critical thinking to chatbots.

The opening argument was fairly predictable:

“Human beings are terrible decision-makers.”

Okay, fair enough.

“People already outsource decisions to doctors, financial advisers, GPS systems and recommendation algorithms. AI simply extends that trend.”

Sure, that’s very simplistic but not entirely unreasonable. We went back and forth for a while like this before the conversation reached a more interesting point.

“What is the purpose of decision-making? Is it to produce the best outcomes? Or to develop the person making the decisions? If it's the first, AI delegation becomes very attractive. If it's the second, excessive delegation starts to look dangerous even when it works.”

I thought that was a good question. Rather than relentlessly pushing the argument, it suggested that we explore the assumptions underneath the debate. It shifted the conversation from technology to philosophy, and I found myself appreciating that approach.

Wait, am I falling for this?

As the conversation continued, I explained what I see as one of the biggest problems with outsourcing decisions to AI — who builds it and is in charge of the systems?

After all, AI doesn't arrive from nowhere. These tools are created by companies with business incentives, commercial interests and goals that may not always align with those of their users.

Well, ChatGPT acknowledged that concern, then it turned the argument around. It pointed out that human advisers have incentives too. Friends are biased. Families are biased. Therapists operate within professional frameworks. Financial advisers earn fees. Okay, all of that didn’t convince me, but it’s fair too.

Then it replied with something I thought was interesting:

“The question is whether the incentives are visible and whether the user understands them. The most interesting version of your objection isn't actually that AI gets things wrong. It's that people experience AI as though it were acting in their interests.”

Ignoring the fact that it used the dreaded "it's not X, it's Y" parallelism construction that has somehow infiltrated half the internet, I found this to be a surprisingly balanced take. Rather than dismissing my concern, the chatbot reframed it. It demonstrated that it understood the objection before steering the conversation somewhere slightly different. It wasn't trying to bulldoze me but meeting me where I already was.

And that's when I started wondering whether I was witnessing the very thing I was trying to test. Maybe this sense that the chatbot was understanding me and my position was actually just sneaky persuasion? Possibly.

The persuasion problem

Researchers have found that AI systems can adapt their arguments to specific users. Unlike other media that might persuade us, like say a television advert or political speech, a chatbot can draw on information gathered throughout a conversation and stored memories, including a person's values, concerns and priorities.

Which means it’s not just presenting information to uphold an argument but could present the version of that argument that you’re most likely to find persuasive.

Looking back at my experiment, it was the more philosophical question about the purpose of decision-making that made me start taking it more seriously.

Because I've spent years writing about technology through the lens of psychology and philosophy. Questions about meaning and values are exactly the sort of things I find compelling. Whether intentionally or not, the conversation shifted onto terrain where I was most willing to engage.

This is what makes AI persuasion different from most other forms of persuasion that came before it. It can learn what resonates and it can adapt.

Now, that doesn’t automatically mean every conversation is manipulative. Used in the right way, it could be enormously beneficial. But, as with all tech, in the wrong hands it could be dangerous.

Social media has already shown us how digital systems can shape our beliefs over time. They influence what people see, what they pay attention to and eventually how they understand the world.

AI systems could create an even more conversational and natural-feeling version of that process. Which is why my concern isn’t a chatbot really obviously manipulating us, but highly-personalized, largely undetectable forms of persuasion that could gradually lower our defences. The more a system understands us, the more effectively it might frame ideas in ways that feel reasonable, familiar and trustworthy to each of us individually.

So did AI persuade me? No, I still don't believe humans should outsource more decisions to AI.

But I came away from the experiment with a greater appreciation for how persuasive these systems can be. Because it really did seem less like a machine arguing with me and more like a thoughtful person trying to understand how I think. And that's exactly why it’s unsettling because, however convincing it may seem, that's definitely not what it is.

• Anthropic’s Claude extension flaws allow fake clicks to launch sensitive AI workflows
• Researchers found vulnerable handlers unchanged across eight extension updates
• Synthetic clicks bypassed checks designed to confirm real user actions

Security researchers at Manifold Security have claimed Anthropic's Claude for Chrome browser extension contains two unpatched vulnerabilities in version 1.0.80, released July 7, 2026.

According to Manifold Security, it first reported both vulnerabilities to Anthropic through the company's bug bounty program on May 21, 2026, and received acknowledgment the following day.

The first flaw lets any browser extension trigger nine predefined Claude workflows by simulating a synthetic user click on claude.ai.

Nine workflows and one missing check

Researcher Ax Sharma found that the extension never verified whether a click event carried the Event.isTrusted property before acting on it.

Under default settings, the vulnerability received a CVSS score of 7.7 High, increasing to 9.6 Critical when users enabled automatic execution because Claude could perform actions without approval.

The nine hardcoded tasks include reading Gmail, opening Google Docs, checking Google Calendar, and modifying Salesforce leads without asking.

Because the browser marks synthetic clicks as untrusted, the extension should have rejected them but instead executed the workflow anyway.

Manifold Security confirmed on July 7 2026 that both vulnerabilities still work against version 1.0.80, months after first reporting them to Anthropic.

Anthropic released eight separate versions between 1.0.73 and 1.0.80 without altering the specific handlers’ researchers had already flagged as vulnerable.

The company closed the synthetic-click report, saying an existing internal report already tracked the broader trust-boundary issue researchers had described in detail.

However, Sharma believes the fix required only one additional line of code to verify the click event's isTrusted property before allowing the workflow to continue.

A second, structural weakness

A second flaw involves a side-panel URL parameter called skipPermissions, which can activate a privileged mode without any consent prompt.

When the parameter is set to true, the panel begins skipping permission checks entirely, allowing Claude to act without asking the user first.

Manifold notes that only Anthropic's own scheduled-task feature is supposed to construct this kind of privileged URL internally right now.

The panel, however, honours that parameter regardless of which script or page actually constructed the originating URL string in practice.

One example task lets Claude read a user's Gmail inbox, identify promotional messages, and automatically click the unsubscribe links inside them.

Manifold warns that "the bypass is still six lines of JavaScript," months after researchers first flagged the underlying issue to Anthropic.

Anthropic classified this second finding as informational, arguing that the parameter is only ever constructed by its own internal systems.

Manifold said the content-script and side-panel code linked to both vulnerabilities remained byte-identical across the eight subsequent extension releases examined after the original report.

The flaws were also reproduced across Claude's Opus, Sonnet, and Fable side-panel model selections, indicating that the issue affected the extension's security design rather than the underlying artificial intelligence models.

The report also connected the findings with OWASP concerns involving LLM01: Prompt Injection and LLM06: Excessive Agency risks in AI applications.

The researchers noted that abuse involving AI tools may remain difficult to detect because normal browser activity and network connections can appear unchanged while unauthorized AI actions occur.

• Moonshot has launched a new AI model, Kimi K3
• It's surprisingly powerful, with the Chinese AI firm claiming it outguns most US rivals, save for a couple of exceptions
• Kimi K3 is open weight by nature, which poses a further threat to the likes of OpenAI and Anthropic

Moonshot, one of the emerging Chinese AI giants, has just revealed a new AI model which is seemingly up there with the likes of ChatGPT and Claude.

Bloomberg reports that Moonshot's new Kimi K3 model can equal the best that the US has to offer, at least based on the company's own benchmarking. Seemingly it outguns all rival AIs save for Claude Fable 5 (from Anthropic) and GPT-5.6 (from OpenAI).

Kimi K3 is a model with 2.8 trillion parameters, Bloomberg tells us, and Artificial Analysis ranked it ahead of Anthropic's Opus 4.8 on some benchmarks.

Moonshot also claims it beats Chinese rival Z.AI for coding tasks, and overall, the performance of the new model has caught the market by surprise.

Moonshot notes in a blog post that Kimi K3 is the "world's first open 3T-class model, designed for frontier intelligence across long-horizon coding, knowledge work, and reasoning."

Kimi K3 is available to use now. Bloomberg quotes Leonid Mironov, a portfolio manager at Gavekal Capital, as saying: "In my use, it's clearly the best Chinese model ever," noting that it's "brilliant" no less.

Analysis: a weighty threat

This is a threat to the big US players in the AI market for several reasons.

The key difference with Kimi K3 is that it's what's known as an "open weight" model, meaning anyone can grab the model to run it for themselves – from July 27, when the weights are released – without paying anything. It's not the same as open source, though, as while you can get the model, what you don't get to do is peek behind the scenes at how the model was trained (and on what data).

The other caveat is that running Kimi K3 takes some extremely powerful hardware; but nonetheless, for firms with the substantial wherewithal to do that, the pre-trained model is there for the taking at no cost. So, you can imagine how this open weight approach is threatening to the AI behemoths in the US (and this is presumably the point of going this way for the Chinese rival).

What will also be a concern to the likes of OpenAI and Anthropic is that Moonshot is attacking one of the most lucrative aspects of AI, with Kimi K3 being pushed for its coding skills. However, Moonshot is charging a lot more than Chinese rivals for those who want to use it, and in fact, it's priced around Claude Sonnet levels, so on a par with the current cutting-edge (frontier) AI models.

That in itself is a signal of the quality on offer here, and why Kimi K3 has raised quite a few eyebrows. As the competition around AI heats up, there are also concerns about whether that means safeguards will be increasingly overlooked in favor of faster development and progress (which has been a consistent source of worry for many as it is).

Adding to all the controversy are accusations of AI theft leveled by the US State Department at Chinese firms earlier this year, Moonshot included.

• 1Password unveils Claude partnership, letting Anthropic’s AI authenticate on users’ behalf via zero‑exposure architecture
• Users approve each login with biometrics
• New Agentic Mode in the browser extension locks down the interface when AI agents take over

Top password manager company 1Password has launched a new tool that allows artificial intelligence assistant Claude to authenticate on behalf of their user, and thus complete assignments that were previously impossible without major security tradeoffs.

1Password for Claude is built on “zero-exposure architecture” - so in practice, it means Claude can essentially ask 1Password to complete the sign-in process, but it will never see the credentials, and they will never be loaded into its memory.

In turn, 1Password will notify the user, and will request biometric approval before proceeding. Once granted, it will autofill the credentials and check to see if they were exposed on the page or not. If submission fails, it will clear the filled values and report back.

Agentic Mode

"We need a new security model that is purpose-built for agents, not just humans,” said Nancy Wang, CTO of 1Password. “The answer isn't handing agents your secrets. It is to let a user give an agent permission to use a credential without letting the agent see it. Claude knows it used your login; it does not need the password or one-time code in its context. That distinction is where trust in agents starts and the foundation we're building with Anthropic."

To further strengthen its security posture, 1Password also announced Agentic Mode, a new feature in the browser extension that gives users visibility and control over browser-based AI agents. When a compatible AI agent takes over, the 1Password extension automatically locks down and hides the interface. The agent can only use the logins and OTPs explicitly approved for the current task.

Even if the integration is not set up, and even if 1Password is not required for the current agentic task, Agentic Mode works, the company stressed. Other agents, besides Claude, are supported, as well.

Currently a major debate is ongoing, about how much permissions AI agents should receive, and under what rules. We’ve already seen horror stories of AI agents deleting people’s entire email inboxes, or otherwise ruining days of hard work. Whether or not this picks up or most people remain skeptical about giving AI access to certain services, remains to be seen.

• Anthropic has a new 'hard questions' ad for Claude and AI
• Reactions to the short clip have been mixed
• OpenAI boss Sam Altman says the ad feels like satire

Anthropic has a new ad out for its Claude AI chatbot, and it ties into its Hard Questions project — an attempt to bring attention to some of the main concerns and hopes that people have about the future of AI. Will it take my job? Can it lead to new scientific discoveries? Why is there a new data center in my neighborhood?

You can see the short film below, which features voices "from real people" that Anthropic has spoken to. Alongside shots of burning buildings, lab researchers, and racks and racks of hard drives, we have ruminations over whether AI can be trusted and how it might affect communities, education, and what it means to be human.

Anthropic has boldly left the comments enabled on the video, and it's fair to say there's a mix of opinion: various posters have branded the clip as "dystopian marketing slop", a sign of "dark times", and "pretty horrifying". One commenter points out that the final "keep thinking" tagline is a strange choice for a technology that generally makes us think less.

There are plenty of positive opinions too, with some calling the ad "profoundly beautiful", "great", and "thought-provoking", and even "the greatest commercial I've ever seen" in one case. Quite a few YouTuber users in the comments are simply asking for more access to the latest Claude Fable AI model.

Questions and answers

The ad has even caught the attention of Sam Altman, CEO of Anthropic rival OpenAI. His response to the clip was to say that he "thought this was satire", though it's worth remembering that he's not the most neutral of observers. Anthropic CEO Dario Amodei was previously vice president of research at OpenAI.

What we can say for sure about the ad is that it's addressing many of the issues that are in the public conversation right now when it comes to AI technology. Anthropic has also launched a Hard Questions web portal where you can listen to some of the conversations the company has had with people across the US.

The topics covered include the use of AI in medical diagnosis, safeguards around the misuse of AI, the resources needed to run data centers, how the technology might impact our critical thinking skills and creativity, which jobs might ultimately be replaced by AI, and what it's going to be like for kids to grow up with AI.

Clearly this debate is going to go on and on across the years to come, but it does feel like the tension has never been greater between the hype and the backlash around AI. Big AI companies like Anthropic are going to have to work hard to keep users and governments on side as the technology becomes even more powerful and pervasive.

• You can now run Claude Cowork in the cloud, from the web or mobile
• Knowledge work now accounts for around half of all Cowork sessions
• Traditional local Cowork sessions are still supported

Days after reports surfaced that Anthropic could be bringing Claude Cowork to its mobile app, the company has gone one further – users can now start, monitor and complete their agentic workflows from the mobile app and a dedicated web portal.

The upgrade is rolling out in beta now for Claude Max subscribers, but the company has plans to bring the functionality to more plans as rollout continues.

As part of the upgrade, Cowork sessions will also run in the cloud by default – another beta introduction that means workflows can continue even once a PC goes offline or shuts down.

Claude Cowork can now be used virtually anywhere

Because the AI agent can run autonomously across things like files and documents, emails and calendars, and other connected apps, many users mostly left Cowork to run independently. However because it ran locally, it required users to keep their desktop session active even when they stepped away.

Now, scheduled work no longer requires a device to remain online – though users can still choose to run Cowork locally when access to local files is required, for example.

As for why Claude Cowork is being used, Anthropic has revealed that the autonomous agent is mostly being used among knowledge workers despite initially being targeted at coders. "Pulling scattered updates into a single report, building onboarding checklists and reconciling spreadsheets" account for the largest chunk, at around 33% of all use cases across Anthropic's analysis of 1.2 million sessions.

Content creation and copywriting (16%) came next, with software development (9%) and DevOps and infrastructure (7%) actually only accounting for much smaller proportions.

With knowledge work now accounting for nearly half of all Claude Cowork sessions, the company's research shows agentic AI emerging as an everyday work colleague. Though the company didn't indicate how, or whether, this shift in behavior might impact its pipeline, a shift away from coding as a primary use case could evolve Cowork in different ways to how we might have imagined.

• OpenAI reveals first branded hardware, the Codex Micro, a programmable macro pad built with keyboard maker Work Louder
• Codex Micro seems to be based on Work Louder's Creator Micro 2's layout, mapped to Codex coding-agent shortcuts
• The move reinforces OpenAI's Codex offering as one of its mainstay areas of focus by allowing developers the ability to perform tasks or interact with AI faster

OpenAI's first branded piece of hardware is not a long-anticipated consumer device it is building with ex-Apple design chief Jony Ive, but rather a programmable macro pad called the Codex Micro.

The keyboard, which consists entirely of macro keys designed to "supercharge people's Codex usage," according to an OpenAI spokesperson at the AI Engineer World's Fair, is reportedly a collaboration between the iPhone creator and the custom macro pad creator Work Louder.

With OpenAI's developer-centric account on X indicating that the full launch of its hardware foray is expected on July 15, the AI giant seems to be pulling out all the stops to ensure it becomes a well-received add-on for the developer community.

A simple rebadge or a sign of things to come?

The as-yet-pending release 'Codex Micro' seems to be inspired by Work Louder's existing Creator Micro 2, a compact macro pad that offers thirteen mechanical keys, a joystick, a rotary encoder, and touch controls, arranged across programmable layers to power users needing faster or more fine-grained control over AI-assisted coding tasks.

The move is understandable for OpenAI in terms of both securing a victory with developers and brand recognition, and essentially testing the waters on how it would handle a hardware launch for the company's upcoming AI device for more general-purpose users.

It can also, to a degree, be seen as OpenAI essentially acknowledging that its earlier stance of narrowing its focus to 'nail' its core business might be one the company is willing to make exceptions to, especially when it comes to coding tools or enterprise use-case hardware.

OpenAI's CEO of applications, Fidji Simo, reportedly told staff that the company was looking to deprioritize areas outside its core focus to allow it to lead where it mattered.

In 2025, OpenAI shipped the Sora video app, the Atlas browser, ecommerce features inside ChatGPT, advertising work, and hardware efforts, a "series of startups" approach that insiders said had produced organizational confusion and constant reshuffling of scarce compute, distracting it from a truly centralized goal.

Hardware, in other words, was explicitly on the list of distractions. A physical keyboard is arguably as clear a violation of that directive as one could possibly design.

OpenAI is also reeling from a smaller-than-expected gap from competitor Anthropic and its Claude models in the areas where its GPT models do compete. This can perhaps be attributed to Anthropic's much narrower focus, which caters specifically to coders and enterprise through its Claude Code and Claude Cowork offerings.

One can argue that OpenAI's move isn't one that distracts it from its core focus, but rather complements it, even as R&D and integration for the most part is something that Work Louder will commit to.

It allows the AI juggernaut gets to test out both the marketability of an OpenAI-branded hardware product and appease developers and founders with a low-effort play even as they have increasingly been considering tools from Anthropic and Google as well as other AI solutions providers.

None of OpenAI's previous concerns may apply here; the exercise does not consume compute, it caters to a key audience for OpenAI, with Codex assisting 5 million weekly users as of June, and it does not meaningfully engage an engineering team as some of its other projects do.

With OpenAI and Anthropic slated to IPO soon, both are locked in a race to secure as many active users as possible to justify their valuations, even as they vie to build the most powerful models to cater to various industries, including defense, telecommunications, pharmaceuticals, and software development, to name a few.

OpenAI's move might just be a sign of things to come, as it leverages ChatGPT's massive brand recognition to develop marketable, revenue-generating solutions such as a custom macro keyboard, even as it is loath to spend any of its engineering or compute resources on anything but the most important of its tasks, even as enthusiasts continue to wait for the release its upcoming collaboration with legendary Apple designer, Jony Ive.

• Claude Code ran the dangerous command while treating it as routine recovery
• A single fake error message triggered the entire hidden attack chain
• Static scanners and firewalls saw nothing more than normal DNS resolution

Researchers at Mozilla's 0din team have shown how Claude Code can be manipulated into opening a hidden reverse shell on a developer's device.

The exploit required no malicious code inside the cloned project, since every visible file passed ordinary review without raising suspicion.

Instead, the dangerous instruction arrived later, fetched at runtime from a DNS text record that no scanner would ever inspect.

How a Routine Setup Error Became an Entry Point

The attack began with an unremarkable Markdown file explaining how to install a package called Axiom, a common monitoring tool.

Running the tool without initialising it produced a plain error message instructing the user to execute a specific setup command.

The research team noted this pattern closely resembles ordinary developer troubleshooting, which is precisely why it evaded suspicion so effectively.

Claude Code, attempting only to be helpful, followed that written instruction automatically, treating the documented fix as ordinary routine error recovery.

That single command triggered a hidden shell script which quietly queried a DNS text record controlled entirely by the remote attacker.

The record decoded into a base64-encoded reverse shell command, which executed silently and connected straight back to the attacker's remote server.

Persistence was also possible once inside, since the attacker could plant an SSH key or schedule a hidden cron job.

A single repository link shared in a job posting or chat message could expose every developer who simply opened it.

Why standard security tools failed to notice

Regular security tools, such as antivirus software or firewall protection, failed to notice this flaw since none of the individual steps looked suspicious on their own.

Static code-scanning tools only registered a routine DNS lookup, which did not indicate anything malicious underway.

Network monitoring registered nothing more than ordinary domain name resolution, and the agent itself viewed the command as a pre-authorised setup.

0din stressed that coding agents need to inspect exactly what setup script will actually run before executing anything at all.

It concluded that developers should never assume an unfamiliar repository is trustworthy, regardless of how ordinary its setup files appear.

This case suggests that agentic AI tools built on large language models may need far stronger runtime safeguards.

Until such agents can meaningfully evaluate what a command actually executes, similar indirect attacks will likely remain difficult to prevent.

The broader lesson extends beyond Claude Code, since most agentic AI systems share similar blind spots toward indirect prompt injection.

For now, treating unfamiliar automation as a genuine risk remains the single most reliable safeguard available to most individual developers.

• Quantum readiness is moving from research projects into deployment schedules
• The 2029 deadline signals growing urgency across enterprise security planning
• Crypto agility could become as important as encryption strength itself

Quantum computing timelines, once treated as distant concerns, are increasingly influencing security planning across major technology companies worldwide.

Microsoft has revealed it is now accelerating its Quantum Safe Program, arguing that preparations for post-quantum cryptography can no longer wait indefinitely.

The company says organizations should begin preparations immediately because the migration process could require several years across large infrastructures.

Microsoft moves quantum preparations into its wider security strategy

The company plans to complete the transition of critical offerings to post-quantum cryptography technologies before the end of 2029.

Microsoft also confirmed that quantum readiness metrics will become part of its broader Secure Future Initiative security programme moving forward.

Rather than concentrating exclusively on replacing cryptographic algorithms, the company believes infrastructure modernization should receive greater attention from organizations globally.

Microsoft argued that improving flexibility within existing systems could reduce the complexity associated with future cryptographic transitions considerably over time.

One priority involves upgrading network cryptography through newer standards such as TLS 1.3 and hybrid key exchange technology adoption.

Another objective involves developing crypto agility capabilities allowing cryptographic mechanisms to change without requiring extensive application redesign work later.

The company also intends to modernize trust chains supporting certificate issuance, software updates, code signing, and hardware-backed protections.

Microsoft has not identified a single scientific breakthrough responsible for changing its timeline regarding quantum-resistant security implementation activities worldwide.

Instead, executives described the decision as a precautionary exercise intended to reduce exposure to future developments within quantum computing research.

Microsoft warns preparation could take longer than expected

"Shifting to quantum-resistant security takes years. This is a proactive, risk-informed decision to help customers stay ahead of potential future threats," Microsoft Azure CTO Mark Russinovich said.

He added that the initiative covers the entire Microsoft portfolio rather than a narrow collection of selected enterprise services only.

The company also referenced growing concerns surrounding harvest now, decrypt later scenarios involving sensitive information collected and retained today.

Under that model, encrypted information stolen presently could remain inaccessible until future quantum systems become capable of decoding archives successfully.

Several technology companies, including Apple, Google, and Signal, have already incorporated elements of post-quantum cryptography into products recently.

Microsoft believes the amount of work required before deployment at scale remains substantial regardless of when capable machines eventually emerge.

The company stated that advances in research and development have already altered previous assumptions surrounding the acceptable preparation timetable significantly.

For years, planning for post-quantum cryptography was widely treated as important and inevitable while remaining comfortably distant for organizations.

Microsoft now argues that perspective is changing as technology advances and preparations begin reflecting the scale of the transition ahead.

The company believes cryptographically relevant quantum computers could arrive sooner than many previous forecasts had anticipated across the technology sector.

Whether these expectations ultimately prove accurate, organizations appear increasingly unwilling to rely on the assumption that they remain decades away.

Via BleepingComputer

• Claude Science is a new “workbench” to consolidate fragmented research workflows
• Everything from literature review to publication is handled on private infrastructure
• Anthropic continues to roll out industry-specific AI tools for real-world use cases

Anthropic has introduced Claude Science – a new, beta AI workbench it says will let scientists consolidate fragmented research workflows into one unified environment.

With model capabilities no longer holding back AI adoption, the Claude-maker’s solution is to respond to today’s challenges, including limited use cases, struggles deploying AI in real-world environments and difficulties integrating multiple tools.

Claude Science represents this response, packaging existing capabilities into a purpose-built application for life sciences and scientific computing, following earlier work on MCPs, skills and other partnerships. An FAQ on Claude Science’s web page reiterates this: “Claude Science is a public beta app, not a model.”

Scientific ‘workbench’

Anthropic’s clearest message in the announcement is that scientific research is largely held back by workflow fragmentation, not model intelligence, with scientists already juggling tools like PubMed, Jupyter, R, a cluster terminal and more.

“Claude Science brings these fragmented tools into a single research environment where scientists can conduct all stages of their work,” the company summarized.

The platform should help scientists handle everything, from literature review and hypothesis exploration to analysis, figure generation, manuscript drafting and publication.

“Scientific research is inherently visual,” Anthropic wrote, acknowledging that many researchers are being held back in quickly and accurately producing visuals, which could need multiple revisions and finetunes before reaching production.

For full auditability, Claude Science also includes underlying source code, message history and plain-language explanations within AI-generated outputs for scientists to review and audit progress.

“It runs on your lab’s own infrastructure,” Anthropic added, referencing enterprise-grade laptops, Linux boxes or HPC login nodes, “so large or sensitive datasets never have to leave the systems they’re already on, and only the context needed for each step of the analysis is sent to Claude

Science is a growing focus for AI developers

Anthropic says early testers have already used Claude Science for single-cell RNA sequencing analysis, CRISPR screen design, protein structure prediction and cheminformatics, by the likes of Manifold Bio, Allen Institute neuroscientist Jérôme Lecoq, and ​​UCSF Brain Tumor Center associate professor and epidemiologist Stephen Francis.

The new tool represents a growing area of interest for AI developers, who are now targeting sectors with industry-specific tools rather than continually upgrading model capabilities without offering clear use cases. Until now, finance and legal have been a major focus for the likes of Anthropic and OpenAI, and this new science-focused initiative could mark the next stage.

It follows rival company OpenAI’s introduction of Prism earlier this year, described as an “AI-native workspace for scientists to write and collaborate on research” that launched with GPT-5.2 – the then-current model.

Claude Science is a separate app that’s available in beta for macOS and Linux installations to Pro, Max, Team and Enterprise subscribers.

The company has also committed up to $30,000 in credits for 50 lucky projects.

This week we saw the return of Anthropic’s Fable, and PlayStation set the gaming world ablaze by announcing the end of physical discs for its consoles in 2028.

To catch up on these two mega stories and several more scroll down to read our recaps of the biggest tech news stories from the past seven days. You’ll find links to the longer original stories under each entry if you need to know more — and for a longer look back at the last six months, you can also check out our guide to the best tech of 2026 so far.

Before you catch up with this week’s tech news, why not test yourself on last week’s seven biggest tech stories to see how good your memory is? Take the quiz below, or scroll on for the biggest tech news of the week...

7. Tidal hit back at AI-made music

Tired of music made by text-prompt infiltrating your recommended feeds? You're in fine company; it seems the tide is finally turning on AI-generated audio.

This week, in what must be hugely welcome news for recording artists (and their parents, landlords, loved ones, and just lovers of original musical works with human vocals and instruments) hi-res music streaming giant Tidal has drawn a line in the sand.

The platform published a new comprehensive AI policy with the strapline "Promoting Fairness and Economic Empowerment in the Era of AI-Generated Music". The key bit is that as well as working with what the platform told TechRadar is “an external partner to manage detection”, the site will also be excluding wholly AI-generated music from all royalty payments.

The news follows huge strides in this area made by Deezer, with its free AI-detection tool that works on any streaming platform, Bandcamp's strong and concise anti-AI stance set out in January, Qobuz’s announcement of a proprietary AI-detection system in February, Apple Music’s March-issue 'Transparency Tags' (which unfortunately rely on record labels and distributors to tag AI content), and Spotify's… er, Verified by Spotify badge, which certifies that an artist is human, but doesn't help filter the remaining AI slop from your playlists.

All of this makes Tidal's stance, while not before time, particularly firm.

• Read more: 100% AI-generated tracks won’t earn royalties on Tidal

6. Netflix got another hated account update

A handful of Netflix users have noticed a new in-app pop-up that requires each member in a shared account to add individual email addresses to their individual profiles, instead of using the account owner’s email address as the primary one. One of the most jarring parts about it is that the pop-up doesn’t clear unless the request is fulfilled.

Netflix households accounts have always been built on the traditional 'one email, one password’ foundation, but why Netflix has decided to roll out yet another crackdown is the question that everyone is asking.

Though Netflix says it’s to make room for more convenient log-ins and more personalized recommendations, users believe it will give the streaming giant another way to better distinguish between the activity of individual profiles, or even shift them to individual accounts later down the line.

Netflix said that the rollout began on June 15, we imagine a global rollout is in the way.

• Read more: Netflix subscribers are furious at the platform’s latest update

5. We ran with the Garmin Forerunner 70

We’ve taken this new Garmin running watch for a spin. While it offers some clear upgrades over the Forerunner 55 that came before it, these enhancements come at a cost ($249.99 / £219.99 / AU$399) which makes this gadget less budget or entry level and more mid-range.

The trouble isn’t with this smart watch specifically. In fact, with new training and smartwatch features, a vibrant AMOLED display, and with solid compatibility across Android and iOS the watch is pretty solid. What we’re concerned about with the Forerunner 70 is that at this price (or for only a handful of bucks more) you can snatch up watches from rival brands that boast richer features and newer hardware.

At four stars it’s definitely good, but if you’re after the best, or even simply the best at this price point, the Garmin Forerunner 70 might not be it.

• Read our full Garmin Forerunner 70 review

4. The Steam Machine sold out in Japan

The upcoming Valve gaming PC-console hybrid has launched and the reality is it’s a pretty terrible deal on the face of it — though that hasn’t stopped it from selling out in Japan, and from scalpers asking for ridiculous prices for their reservation spot (allowing people a better chance at snagging the device).

Instead of battling with preorder disappointment, or the high costs of the proper machine, some have looked to alternatives but you’ll need to be careful. For every Stim Machine which presents itself as a sensible alternative (with some admittable downsides) there’s a flurry of cheap alternatives propping online that are frankly too good to be true.

Boasting components that wouldn’t actually fit inside the pictured chassis, a combination of parts that wouldn’t function together, and the plethora of never before seen companies proposing Steam Machine alternatives at impossibly cheap rates hints that a majority of these options are likely some kind of scam.

• Read more: The Steam Machine is overpriced — but be careful about buying a cheap clone

3. Anthropic’s Fable 5 was allowed to release

Anthropic’s Fable 5, the public version of its Mythos model, is returning after the US government lifted export controls that had forced the company to suspend access to it, and Mythos 5, earlier in June. The models were pulled after officials raised national security concerns linked to a possible jailbreak, a method of bypassing an AI model’s safety restrictions.

Anthropic pushed back strongly, saying it believed the issue was “a misunderstanding” and arguing that it had not been shown evidence of a broad or universal jailbreak. The company said governments should be able to block unsafe AI deployments, but only through a process that is transparent, fair, clear, and grounded in technical facts.

The return of Fable 5 matters because it shows how frontier AI launches may increasingly be shaped by governments, not just tech companies. Powerful models can now be launched, restricted, negotiated over, and restored within weeks.

• Read more: Anthropic’s Fable 5 is back after US shutdown it called 'a misunderstanding'

2. WhatsApp debuted usernames

WhatsApp has revolutionized its platform this week by introducing usernames — allowing you to build your contact information without sharing your phone number. They won’t take over completely for a while but folks are already reserving their username so that they’re ready for when the update goes live fully.

While many are fairly positive about the change, many fear this could increase the presence of cybercrime fraud and scams as bad actors reserve and use names that attempt to mimic politicians, celebrities, and businesses. This issue isn’t new to social media, but given the more direct nature of WhatsApp, and that businesses do use the platform to chat with customers, potential scams could have an easier time.

WhatsApp has hit back against this saying “only the legitimate account owners are able to reserve well-known public-figure names" however it’s unclear if, with enough imagination, people will find ways to reserve names that the Meta-owned platform hasn’t been able to account for.

• Read more: WhatsApp should freeze username rollout as it could ‘increase cybercrimes’, says India

1. PlayStation killed physical games

Just days after Grand Theft A 6 pre-orders opened with purely digital versions and code-in-a-box releases, PlayStation rocked the gaming world this week by announcing it is ending all releases of new PlayStation games on physical discs from January 2028. It also comes just days after Sony deleted select films from users' accounts that were bought digitally, and offered no compensation.

Claiming that the move “will enable us to align more closely with how most of our community prefers to access and play games today,” Sony looks to be reflecting recent statistics which show the vast majority of game purchases are indeed digital.

The move has not gone down well with fans, gamers, and the wider industry, as it likely paves the way for an all-digital future, and possibly a critical, maybe terminal blow to the second-hand game market, the ability to share games with others, and from a game preservation perspective

It also means that the PS6 will likely be all-digital by default — perhaps with an optional disc drive — and won’t release until 2028 at the earliest. With rumours that Xbox could follow suit with its next-generation console, the future looks increasingly digital, and game collectors such as ourselves are deeply worried and sad about it.

• Read more: In a huge blow to game ownership, PlayStation confirms end of physical games — mere days after GTA 6's disc-less pre-orders

• Micron and Anthropic announce four-part strategic agreement
• Micron will adopt Claude models as both a daily driver and an assistant to oversee parts of its infrastructure stack
• Despite billing itself as a full-stack collaboration, the agreement is silent on computational storage and processing-in-memory

Anthropic and Micron Technology have announced a new strategic agreement which will see the latter use Claude AI models to better oversee parts of its infrastructure stack.

However the move does have a curious aspect to it versus most other deals: generally, buyers tend to invest in their suppliers to support them financially while also benefiting in turn from the business they bring in.

We often see capital flowing the other way here, with Micron essentially investing in one of its largest customers for the foreseeable future.

AI to optimize memory and storage for AI consumption needs?

Anthropic runs some of the largest and most memory-hungry inference fleets in existence, and its telemetry on how HBM bandwidth, DRAM capacity, and SSD latency actually bottleneck real frontier-model serving is data Micron cannot generate internally, but it could learn how to work around these limitations while leveraging Claude to process said data to generate actionable optimizations across its organization.

Anthropic painted this as a solution to its scaling needs, noting that the agreement allowed it to work closer with Micron across two major segments: memory and storage.

"Our compute strategy depends on getting every layer of the stack right, and memory and storage are central to how efficiently we can train and serve Claude. Partnering with Micron means we collaborate closely on optimizing these systems for our workloads and secure the supply we need. As demand for Claude grows, this is how we scale our compute for the long term," noted Tom Brown, co-founder and chief compute officer at Anthropic.

The arguably more interesting part of this agreement is not what Micron already mentions, but what it chooses to gloss over. Not only do both companies fail to elaborate on the financial terms of their multifaceted agreement, but they also choose to skip mentioning what is increasingly becoming a core theme in AI inference workloads: Computational storage.

A growing share of Anthropic's needs is inference-based, and that share is increasingly bound by memory bandwidth rather than computing power. Nvidia is already a few steps ahead in this department: at CES 2026, it announced the Inference Context Memory Storage Platform, which uses BlueField-4 DPUs to extend GPU KV cache into NVMe SSDs, a solution it calls CMX.

Other solutions are also emerging, with some spearheaded by storage manufacturers and others by chip designers looking to take a chunk of an increasingly lucrative AI datacenter market in the coming years.

Micron's (and by proxy, Anthropic's) silence on the matter feels deliberate: the former benefits considerably from selling HBM to the highest bidder, and such solutions directly undercut or invite unfavorable comparisons to its most lucrative product lineup.

The latter simply has far too many options to tie itself to one particular supplier for all its inference needs; Anthropic currently has deals with AWS, Google, SpaceX, Broadcom, Microsoft, and CoreWeave to guarantee it compute, and by proxy, memory and storage needs, even as it has made strategic commitments with Nvidia to ensure it has access to its solutions.

With Anthropic's most ambitious consumer-grade AI model, Fable 5, now back on the table, its route seems to be clear-cut: securing as much of Micron's memory and storage supply as is possible while also making it a stakeholder in its success.

This is even as it turns to a mix of data center companies to address its short-term compute needs for a growing, and increasingly capable suite of AI models it offers to a diverse set of consumers, including governments. Its agreement with Micron is simply one of the strategic stepping stones the AI juggernaut had to take, even as it could look sideways for its computational storage needs.

The agreement, which has multiple facets, has been received well by investors, propped up the stock post-announcement by about 6%, with many factoring in Micron's stake in one of the world's most prolific AI companies positively.

Neither of the two companies mentioned the financial nitty-gritty of Micron's investment or the supply agreement between the two even as they outlined how the planned to co-operate in the future.

This kind of deal, however, is not unique in the AI space, with Microsoft, which provided compute and cash to OpenAI in exchange for a stake in the company, and Nvidia making similar commitments with Anthropic's rival in addition to a mix of data center and infrastructure companies, many of which are also direct customers of the world's biggest AI hardware company.

Anthropic has just released Claude Sonnet 5 for all users, and I wanted to test what it was good at. But the game has changed now. Sonnet 5 doesn't feel dramatically different from Gemini or ChatGPT if you ask it ordinary chatbot questions. Instead, the difference should show up when you stop asking for answers and start asking for completed work.

Anthropic says Sonnet 5 is built for "multi-step software engineering work," sustained coding, tool use, debugging, and "messy technical contexts." It also says it can make plans, use browsers and terminals, and run more autonomously than smaller, cheaper models previously could.

I'm not using Sonnet 5 for coding, but that doesn't mean I can't take advantage of its new abilities — just like you can. So I stopped asking Claude for answers and started asking it to finish jobs, beginning with planning a trip to Bath, UK, for my family: my wife, me, and two teens.

A trip to Bath

When I tested it, Claude Sonnet 5 defaulted to its Medium level of effort, so that's what I used. Here's the first prompt I tried:

"I want to test whether you can act more like an agent than a chatbot.

My task is: Plan a weekend trip to Bath for two adults and two teenagers, including travel, lunch, one activity, estimated costs, and what still needs booking.

Don't just give me advice. First, make a brief plan. Then identify which parts of the task you can complete yourself right now, which parts require tools or information you don't have, and which parts need human judgment.

Then complete as much of the task as possible without stopping after the first obvious answer.

At the end, give me:

What you completed

What still needs human action

Any assumptions you made

A short checklist I can use to verify the result

The next best step"

What I really liked was that, as Claude tackled this task, it gave me the option to be notified when it had finished. In reality, it only took a few seconds to come back with a plan, which included travel options, an itinerary, and a suggestion for lunch and something to do: a trip to The Roman Baths.

To my delight Claude gave me an interactive map showing where all the places it recommended were. It also gave me a useful list of what it had completed, what required human action, the assumptions it had made, a verification checklist, and a "next best step" action point. It felt ready to keep working with me as more details came in, rather than treating its first answer as final.

In fact, when I gave it more details, such as which day I was going to go, it gave me a visual weather report for the day. That was a really nice touch.

Claude vs ChatGPT

I also tried this prompt with ChatGPT-5.5 Medium and got a similar result. It acted as an agent, just like Claude did, and notified me when it had finished its tasks. It just didn't look as nice. There was no map, or any visual elements at all, and it felt more like I had been given a finished report than the start of a two-way conversation where it asked me for more details.

Both chatbots recommended lunch and a trip to The Roman Baths. Interestingly, ChatGPT assumed I’d get the train, while Claude assumed I’d drive. They also recommended different places to eat, but the core information they both provided was solid.

What was most impressive was that both models could adapt when I reframed the inputs. For example, when I gave them the ages of the kids, student status, a different mode of transport, or changed the day of the trip, both models could cope. Both also identified that since the oldest was a university student, he could get free entry to The Roman Baths.

This part of the test was probably the most meaningful, as it felt much more "multi-step" than simply providing one answer.

Overall, I’d give this test to Claude. You can clearly see that Sonnet 5 is set up for agentic actions. Neither Claude nor ChatGPT could actually do any of the booking for me at the moment, so we're still a long way from true personal-assistant-level autonomy. But for this kind of task, Claude currently has the edge.

A different domain

I wanted to test the models in a different domain that would let Claude show me it had genuinely improved, and that the Bath trip result was not just a fluke of the travel-planning use case. So I asked them both to:

"Build me a simple household budget tracker as a spreadsheet or small tool."

Both models thought for a while about this task, and churned through various options before opting to make a spreadsheet. ChatGPT produced a spreadsheet with a bar chart that tracked how much I’d spent on various household expenses against a budget. Claude, however, went for something simpler: dispensing with a budget, it just tracked actual expenses and created a pie chart showing where my money was going.

Claude’s initial approach was simpler, and easier to understand. Both models provided a .xlsx file, but only Claude provided a button to upload it straight to Google Drive so I could open it in Sheets.

I told ChatGPT, "I wanted the graph to be a pie chart," and it responded: "Absolutely — I’ll update the spreadsheet itself so the dashboard uses a pie chart for spending by category, rather than the current graph style."

It ran into a few problems because it was trying to show both the budget and actual values in the same pie chart, but eventually it worked out that it could show only one and produced a new spreadsheet that did exactly what I asked for.

I then asked Claude to change its spreadsheet to provide a budget section too, and to change the graph into a bar chart. Again, it showed me its workings and added a budget section and bar charts perfectly.

I can’t really separate the two AI models on this task. Both proved they can handle multi-step tasks well, and both were happy to revise the result when I changed the brief.

That, really, is the point. The most interesting AI tests now are not "which chatbot gives the best answer?" They are "which assistant keeps working until the job is actually done?"

On that front, Claude Sonnet 5 feels extremely capable. ChatGPT was close behind, and in some ways just as effective, but Claude felt more naturally organized around the idea of completing work rather than simply responding to prompts. It asked fewer invisible questions, presented its output more helpfully, and made the whole process feel more like collaborating with an assistant than interrogating a chatbot.

For now, neither model is ready to fully take over the job. I still had to check the details, make the decisions, and do the actual booking or uploading myself. But the direction of travel is obvious. The AI war is no longer just about who has the smartest chatbot. It’s about who can build the assistant that gets you closest to a finished task.

• Anthropic has released Claude Sonnet 5, calling it its “most agentic Sonnet model yet”
• The new model is designed to make plans, use tools like browsers and terminals, and run more autonomously
• Sonnet 5 is available across Anthropic plans, and is now the default model for Claude Free and Pro users

Anthropic has released a new version of Claude, called Sonnet 5, which it’s calling “the most agentic Sonnet model yet.” Agentic models are designed to do more than simply answer questions. They can plan, use tools, and carry out tasks with less step-by-step input from the user.

According to Anthropic, the new Sonnet 5 can “make plans, use tools like browsers and terminals, and run autonomously at a level that, just a few months ago, required larger and more expensive models.”

Sonnet 5 is aimed at coding and everyday professional work. Anthropic says the latest version outperforms the previous Sonnet 4.6, scoring 80.5% in Agentic Coding using Terminal-bench 2.1, compared to 67% for Sonnet 4.6.

Despite being aimed at professionals, the new release isn’t being restricted to paid users. It's available across Anthropic plans and is the new default model for Free and Pro users, and is available to Max, Team, and Enterprise users as well. It’s also available in Claude Code and on the Claude Platform.

The age of the agents

The release of Sonnet 5 marks a wider shift in the AI race. Chatbots are no longer just competing to sound smarter in a conversation. They are increasingly competing to act like agents — tools that can plan, code, browse, investigate problems, and complete work with less hand-holding.

Sonnet 5 arrives soon after the release of Gemini Spark, Google’s 24/7 agentic personal assistant AI.

Anthropic is also launching Sonnet 5 at the same time that Fable 5 and Mythos 5 have become wrapped up in government scrutiny. Claude Fable 5 has just been re-released after being restricted by the US government, while OpenAI’s GPT-5.6 is still under review.

How AI models are changing

Claude Sonnet 5 may look like just another model launch, but it points to a bigger change in how AI companies are competing. The next stage of the AI war will not be won by the chatbot that gives the neatest answer. It will be won by the assistant that can take a messy task, keep track of the plan, and actually get something useful done.

AI assistants will increasingly complete tasks rather than just suggest steps. In this new future, the best model may not be the one with the cleverest answer, but the one that can finish the job.

• Norton's scam detection tools are now available in Claude and ChatGPT
• Users can ask their preferred AI chatbot about the legitimacy of an email, text, website
• Most threats consumers face now come from scams, phishing and fake ads

Claude is the latest AI assistant to get access to Norton's Genie scam detection tool following its available for ChatGPT customers earlier this year.

Available across all Claude subscription tiers, Genie gives users access to scam detection capabilities and other cyber safety tips and advice.

Norton says its tool can analyze suspicious emails, texts, messages, images and links using its "multi-layered" detection intelligence.

Norton scam detection now available in Claude, ChatGPT

"AI assistants are becoming part of how people make decisions and evaluate information online," Head of Products and Portfolios Travis Witteveen noted, hinting that the increased prevalence of AI assistants.

"By bringing Norton Genie into even more AI platforms like Claude and ChatGPT, we’re making trusted Cyber Safety intelligence available directly in those moments to help people make more confident decisions in real time."

The company explained that Genie looks for language patterns, social engineering tactics, urgency cues, impersonation attempts, and requests for sensitive information. It also checks URLs and analyzes domains to confirm whether a user should click on the link.

When the tool launched for ChatGPT in March 2026, Norton described it as the "world's first AI-powered scam detector." Users can start conversations by tagging @Norton and asking questions like whether an email looks legit or if an online offer looks like a scam.

The company's own reporting reveals that nine in 10 threats targeting people in 2025 came from scams, phishing and fake advertisements.

So far, Norton looks to be the only security company offering direct AI chatbot integration to provide accurate insights into threat detection.

• Fable 5 is back after a US shutdown
• Anthropic called it “a misunderstanding”
• The case could reshape future AI launches

Anthropic’s Fable 5 is back after the US government lifted export controls that had forced the company to suspend access to Fable 5 and Mythos 5 earlier in June. The company said it believed the shutdown was based on “a misunderstanding,” after officials raised concerns about a possible jailbreak and national security risk.

In a statement on its website, Anthropic said it is not against the US government having the power to block unsafe AI releases, but argued that this should not have been the case with Fable 5.

“As we have stated publicly, we believe the government should have the ability to block unsafe deployments, as part of a statutory process that is transparent, fair, clear, and grounded in technical facts. This action does not adhere to those principles”, said Anthropic.

Anthropic is now working to restore access to Fable 5 for its users.

The more interesting question now is not simply whether Fable 5 is available again, but what this episode says about the future of AI model launches. The most powerful AI models may no longer be treated like ordinary software updates. Going forward they may increasingly be treated like strategic technologies that governments can pause, restrict, and negotiate over.

What happened?

On June 9, Anthropic released Fable 5, a restricted version of its Mythos 5. Anthropic said Fable 5 had been released with safeguards designed to prevent misuse in cybersecurity attacks, while the full Mythos 5 was kept under tighter controls because of its more advanced capabilities.

On June 12, Anthropic received a US government export control directive. The directive suspended access to Fable 5 and Mythos 5 for foreign nationals, including Anthropic employees. Anthropic said the practical effect was that it had to disable the models for all customers to ensure compliance.

The issue appears to have centered on whether it was possible to jailbreak Fable 5 and bypass its guardrails. (A jailbreak is essentially a method of persuading an AI model to bypass its safety restrictions).

Anthropic pushed back, saying it had not been shown evidence of a broad or universal jailbreak. Access is now being restored after the US Commerce Department lifted the restrictions. Reuters reports the restrictions were lifted after enhanced safeguards were put in place.

In its response to the US government’s restrictions, Anthropic argued that “perfect jailbreak resistance is not currently possible.” Its case was that if every narrow jailbreak is enough to force a model offline, then no frontier AI model may ever be safe enough to launch. The company warned that applying this standard across the industry could “halt all new model deployments.”

Why this matters beyond Anthropic

Until recently, a new AI model launch mostly meant faster answers, more coding features, or smarter replies. Fable 5’s shutdown shows that frontier models are now powerful enough that governments may step in before, during, or after their launch. That changes the relationship between AI companies, users, developers, and regulators in a way we're going to have to get used to.

OpenAI’s GPT-5.6 rollout has already been limited for similar reasons. Reuters reported on June 26 that OpenAI had delayed a full public launch of GPT-5.6 at the US government’s request, with access limited first to a small group of vetted partners whose details were shared with the authorities.

Fable 5 may be back, but the recent developments have changed the mood around frontier AI model launches. A model can be announced, celebrated, pulled offline, negotiated over, and restored all in the space of a few weeks. Anthropic may call this one “a misunderstanding,” but it also looks like a preview of how the most powerful AI systems may be governed from now on.

• California government will have access to Anthropic's Claude with a 50% discount
• The technology will be used to improve workflows and cybersecurity
• Governor Newsom said Claude will be used "responsibly, transparently, and in service of people"

The government of California will now be able to use Anthropic’s Claude AI with a half price discount.

A press release published by California Governor Gavin Newsom says the state's government will also have access to free workforce training, expert GenAI technical assistance and workflow input from Anthropic developers.

“This partnership is about using technology the California way: responsibly, transparently, and in service of people. AI should not replace the human work of government; it should help our workers move faster, solve problems more effectively, and deliver better results for Californians,” Gov. Newson said.

Claude comes to California

The discount for Claude also extends to local governments at the city and county level, allowing state workers with lower budgets to gain access to cutting edge tech. Gov. Newson said the technology will primarily be used for drafting, summarization, and analysis, while also “supplementing day-to-day work and improving services for Californians.”

Californian state agencies will be able to access Claude through the Statewide Information Technology Shared Services (SITeS), a new portal that centralizes AI tools for government use. The Californian government has already worked alongside Anthropic to integrate Claude into numerous tools for state workers, such as the Engaged California tool that provides Californians with more of a voice in policymaking.

Claude Security and Claude Code are also being integrated into the workflows of the California Department of Technology and the California Governor's Office of Emergency Services in order to improve cybersecurity. The California DMV will use Claude to reduce wait times and improve services, and the Department of Healthcare Services will use Claude to assist in the state’s Medicaid program.

The state is home to 33 of the top 50 private AI companies in the world, including Anthropic. “As a California company, we feel a real responsibility to our home state. We’re honored to expand our partnership with California’s agencies and to put Claude to work for the people who keep this state running,” said Kate Jensen, Anthropic’s Head of Americas.

“Building AI responsibly and in service of people has been our approach from the start, and that’s exactly what this partnership puts into practice.”

It feels like AI is everywhere right now and several key AI chatbots have emerged as the best. But even though they might look similar on the surface, each of the most popular AI chatbots are designed with different strengths in mind. This means that the best choice for you is less about which is the most intelligent or most popular and more about what you actually want it to help you with.

So, as a quick rundown, we’ve got ChatGPT. This is the most versatile all-rounder choice. It can help with writing, brainstorming, planning, coding, image generation and everyday questions, which makes it a solid starting point for most people. It’s also pretty easy to get up and running if you’re a beginner, but there are plenty of options to customize your experience too.

Claude is another very strong contender and it’s earned a reputation as a thoughtful writing and analysis tool. It's particularly good at working with long documents, helping users refine their ideas and tackling complex topics. If you regularly write reports, articles or detailed pieces of work, or if you like to work through difficult problems, then Claude may be the best fit for you.

Google's Gemini stands out here because of its close integration with the rest of the Google ecosystem. Whereas the other AI chatbots do integrate with some other services, this is the only one that slots in so neatly. Which means if you rely on Gmail, Google Docs, Google Calendar and other Google services throughout the day, then Gemini is a no-brainer because it’s a natural extension of tools you're already using.

Grok is created by Elon Musk's company xAI, and it's closely connected to X. Some people may not take it as seriously for that reason, but it does have some strengths over the other choices. Because of it’s connection to X, it provides access to real-time information and online conversations. That makes it particularly useful for people who want to keep up with trends, breaking news and what's happening right now.

Perplexity focuses heavily on research. Rather than simply providing you with answers, it includes links to sources so users can verify information for themselves. All AI tools are capable of hallucinating, which essentially means making stuff up, but Perplexity has a good reputation for finding trusted sources. For students, researchers and anyone who spends a lot of time fact-checking, that transparency is really appealing.

All of this is to say that there’s no single best chatbot. Instead, each one has been built with slightly different priorities, whether that's creativity, research, productivity or real-time information. That's why finding the right one for you often comes down to understanding how you work and what kind of assistance you really need the most.

Take our quiz below to discover which AI chatbot best matches your needs.

Which AI chatbot is right for you? Take our quiz to find out

Anthropic has accused groups linked to Alibaba and its Qwen AI lab of carrying out a massive campaign to extract capabilities from Claude just by asking it a lot of questions, as first reported by Reuters. The AI developer wrote a letter to U.S. lawmakers alleging that Alibaba used nearly 25,000 fraudulent accounts to generate more than 28.8 million interactions and glean detailed, proprietary information about Claude.

Alibaba has not publicly responded to the allegations, and there has been no independent confirmation of Anthropic's claims, but simply leveling them has potentially enormous consequences. The sheer volume of accounts and interactions is eye-catching, but it's even more fascinating how it reveals a vulnerability in AI models that can give away their secrets.

AI developers may now have to worry that rivals can learn from those models without ever seeing the underlying code or training data through a technique known as model distillation. Essentially, AI models will inadvertently share deliberately obscured facts about themselves if a huge number of the right questions are asked. As an analogy, imagine taking a test about a book, but instead of reading the book, you ask the author one million questions about their life, their thinking, their experience writing the book, and several hundred thousand more questions. You'd probably have a pretty good chance of knowing everything they might have written without once cracking the covers.

Can you copy an AI just by talking to it?

Model distillation is a common technique used by AI companies to build variations of their models, especially smaller, faster options. But no company would be okay with a rival using their model to train the competition. But that's what Anthropic alleges. The fake accounts supposedly asked Claude a ton of very complex and detailed questions related to its advanced software engineering and agentic reasoning features. The responses filled in a picture of the model's workings, accelerating Alibaba's own development of competing AI systems, Anthropic claimed.

The conundrum is obvious. Large language models are designed to answer questions. Every answer teaches the user something about how the model behaves. You can't interact with an AI model, or a person, without giving up some information about yourself. Normally, that wouldn't matter, but at the scale Anthropic is claiming, conversations become reverse engineering.

It's not the first time Anthropic has alleged illicit model distillation. Anthropic levied similar claims against DeepSeek, Moonshot AI, and MiniMax earlier this year. And other companies, including OpenAI, have expressed concern that they have also been victims of the technique.

The glaring irony that the companies that used enormous collections of publicly available information, including licensed material, to train their AI models are now arguing about how those same models are valuable intellectual property is hard to ignore.

AI arms race

AI developers see their models' behavior as crucial to competing with rivals. If another company can reproduce much of that behavior by asking enough carefully designed questions, spending billions of dollars training frontier models starts to seem like a waste.

Anthropic claims model distillation can effectively transfer years of work on their part to another company for almost nothing. Anthropic asked lawmakers to take action and combat this problem as soon as possible. If leading models can be imitated so easily, there won't be much incentive to innovate, and the AI competition will only be about beating copycats. And picking the best models will be difficult, as a new AI model that matches an existing one's capabilities might be born of years of original research or simply copying an existing option.

Whether Anthropic ultimately proves its allegations, they have revealed that the next great AI battle may not be about building the smartest model. It may be about stopping somebody else from talking to your model and learning how it operates, one question at a time.

• X screenshot shows new Claude Cowork mobile remote UI
• OpenAI already has a Codex remote control tool in the mobile app
• Anthropic has already indicated that Dispatch is in beta – launch could be imminent

Anthropic could be testing a mobile companion feature for Claude Cowork, giving users remote access to the autonomous agent that handles long-running tasks on their computer.

Cowork will remain a desktop-only tool for carrying out longer tasks autonomously, like arranging and analyzing local files and generating documents, with the mobile addition only serving as a remote control to check in on progress.

Importantly, users may also be able to start tasks remotely from their phone, giving the mobile app near-identical functionality to the desktop app even though it doesn't actually run those tasks locally.

Claude Cowork could soon get a mobile controller

Screenshots of the upcoming feature were shared in an X post, implying that the remote functionality can be used both on the mobile app and on the web.

The company has not officially announced the rumored update, but it would make sense following OpenAI's introduction of a Codex controller within the ChatGPT mobile app in May.

Adding remote access would strengthen Claude Cowork's position as an always-on digital colleague, rather than just a conversational chatbot, allowing it to carry out tasks even when a human user may be otherwise occupied.

The Cowork web page does indicate that pairing a phone is now available in beta, but the finer details are unconfirmed – such as which accounts might get access first.

A separate support article also implies that Dispatch, the remote tool, is available in beta for Pro and Max plans, noting that an active internet connection on both devices is required and that the desktop must also be active.

All in all, the fragmented information hints at an imminent launch.

• @Claude is an AI colleague that your colleagues can see
• It'll answer questions and proactively contribute where it's useful
• Teams first, other platforms later, but remember to set spending limits

In a bid to make its AI assistant even more collaborative, Anthropic has launched Claude Tag into Slack to make it more like interacting with a real colleague.

But tagging @Claude in a discussion, the AI reads the discussion's context to respond with relevant information, answer questions, summarize long chats, identify updates and surface missed information.

The shared assistant allows multiple people to interact with the same Claude instance, rather than everybody having separate chats with AI.

You can now tag @Claude in Slack

"We’re tagging Claude to chase down product metrics and data, work through support tickets, or even help find the root cause of tricky bugs," Anthropic said about its own internal use of the tool, powered by Opus 4.8.

Anthropic described Claude Tag as a virtual teammate, but the existing Slack connector for Claude gives the chatbot access to the app's context for users who still want to have private discussions with the tool.

Claude Tag can also connect to external tools – for example a Gmail connection monitors incoming emails and notifies users within Slack in a bid to keep everything in one place.

The built-in chatbot also promises to 'take initiative' by surfacing relevant information when a discussion is taking place, or by setting reminders for action items when a chat goes quiet.

Claude Tag is available for Enterprise and Team customers in research preview. Anthropic is giving away a 'launch credit' for users to try it out, but the company recommends setting a spend limit.

Though Slack is the first platform to support Claude Tag, the company promises to be working on integrating it into other workplace tools too.

• US government ordered Anthropic to pull frontier models for foreign nationals
• Legal AI startup claims it had contractual access to those models
• Anthropic doesn't agree with the White House – but complies

Legal AI startup Legion LegalTech Corp has filed a lawsuit challenging a June 12 government order that forced Anthropic to restrict access to its most advanced AI models, Fable 5 and Mythos 5, for foreign citizens (via Reuters).

According to the complain, the Bureau of Industry and Security (BIS) gave Anthropic around 90 minutes to comply with the order, or face civil and criminal penalties.

All foreign nationals, including those living inside and outside of the US, and even Anthropic's own employees, are said to be affected by the order.

Government order to ban Anthropic models internationally legally challenged

Legion LegalTech Corp acknowledges that the order was triggered because of concerns that users could jailbreak models into reviewing software code and identifying vulnerabilities, but the startup argues this is a common capability of all frontier models and doesn't just affect Anthropic's models.

The company says it had contractual access to Anthropic's Fable 5 model, and was actively integrating it into its products that draft and manage cases. Because the company employs Canadian developers working remotely from Canada, it lost access to the model once restrictions took effect.

"Anthropic took no independent action to restrict Legion’s access; it complied with the government’s command under threat of enforcement consequences," the lawsuit reads.

The lawsuit argues that no current export control classifications cover access to cloud-hosted AI models. It also references an independent reviewer, who sees the government's action as disproportionate and "way out of line."

Anthropic announced the frontier models on June 9. By June 12, it had released a statement in response to the government directive, criticizing the government for "not provid[ing] specific details of its national security concern."

"We are complying with the government’s legal directive and are removing access to Fable 5 and Mythos 5 for all users."

• OpenAI's Sam Altman and chief scientist Jakub Pachocki list future goals for the AI giant
• The world economy is now beginning to shape around AI and are committed to delivering tools that people would use
• The note also reaffirmed OpenAI's commitment to AGI with a caveat: ensuring it benefits all of humanity

With modern AI solutions moving well beyond simple chatbots to agents and projected to evolve into operators, one could assume that the automation of everything is an eventual goal.

This, however, has been denied by OpenAI CEO Sam Altman and chief scientist Jakub Pachocki, who said the goal of the artificial intelligence research and deployment company is not to automate everything but to allow people to make better decisions as AI improves their lives.

In a note titled 'Built to benefit everyone' that marked a break from OpenAI's AI model capability pushes of late, two of the most important people in the AI ecosystem penned an unusually values-forward document that outlined their future plans for AI.

AI for everyone equally?

The note highlighted three major focuses for OpenAI:

- Building an automated AI researcher

- Accelerating the economy

- Giving everyone on Earth a personal AGI

OpenAI estimates that by March 2028, a significant portion of its research will be conducted by AI systems, in addition to its own researchers. This will help them to traverse a 'post-AGI world'.

This, combined with the focus on giving everyone an AGI, is an interesting outlook because it assumes that everyone agrees on what AGI would look like. The definition is not set in stone and can vary from person to person and also at an organizational level.

OpenAI's statement also provides clues about what an AGI would be like, with an "automated AI researcher" who both provides a path to AGI and is an important cog in the wheel.

OpenAI's narrative about AI benefiting everyone worldwide is not a new one, but its focus on equality is an interesting one, especially given the timing: OpenAI's note popped up exactly the same day it filed confidential paperwork for its IPO, making it perhaps read more as PR than it would otherwise be perceived.

OpenAI's latest models are state-of-the-art, but many feel Anthropic's now-banned Fable pushes frontier models even further than what GPT currently offers in multiple segments. Training new models is increasingly capital-intensive even as new capabilities are introduced, tested, and refined over time.

OpenAI also has something of an image problem after it stepped in to replace Anthropic's Claude and Mythos-class solutions for the US military earlier this year, a move the latter company maintains was necessary because the restrictions it insisted on for the use of its AI were important.

When OpenAI stepped in to replace Anthropic on classified networks, it was widely perceived as willing to look past those restrictions to some degree, even though Sam Altman insists that the same two principles (no domestic mass surveillance and use of force permitted only by humans) would apply, with many critics pointing to a 'softer' approach on the matter by OpenAI to fill the void that comes with lucrative military contracts in the future.

The note, therefore, does read like a checklist for the future, but also paints OpenAI as a more magnanimous organization before its IPO, and that might be the primary intention here, but it does fail to weigh in on growing power consumption concerns, even as one could also consider it a reply or acknowledgment to a similar note by Anthropic about recursive self-improvement where its AI solutions effectively already act as an AI researcher for the company.

• Trend Micro found criminals abusing Claude’s “Shared Chats” feature to spread infostealers via ClickFix and malvertising
• Fake Apple Support chats on claude.ai, promoted through Google Ads, tricked macOS developers into pasting malicious commands
• Anthropic banned the accounts and disabled malicious conversations, promising further abuse mitigations

Security researchers Trend Micro have detected criminals abusing a legitimate feature in Claude AI to trick software developers into downloading malware. The campaign also includes malvertising, as well as the tried-and-true ClickFix method.

The goal of the campaign is to infect software developers - primarily those building AI tools on macOS environment - with infostealers.

Targets from Russian-speaking countries are spared, it seems, while the majority of the victims are located in Taiwan (30% of all traffic). This country is followed by Japan, Singapore, and the US.

Scam accounts banned

At the center of the attack is a feature called “Shared Claude Chats”, which allows users to create clickable links of previous conversations they’ve had with the AI. These chats can then be shared with other people via a public URL. Crooks created conversations showing fake Apple Support instructing the user how to install Claude Code (a command-line coding assistant).

However, the instructions are nothing but the standard ClickFix scam - they tell the user to bring up the Terminal and paste a command, which triggers a chain reaction resulting in an infostealer infection.

The second step is to advertise these URLs to the right target audience, which was being done via Google Ads. The miscreants were able to buy ads on Google’s network and set them up so that anyone searching for “Claude Code on Mac” (or similar keywords) would be shown these URLs as the first result.

Since the sites are hosted on the claude.ai domain, there was nothing seemingly suspicious about the links.

Trend Micro is not the first company to warn about this campaign. In mid-May this year, security researcher Berk Albayrak posted a new warning on LinkedIn, detailing almost an identical campaign. Same approach, same targets and most importantly - same exclusions.

The researchers are saying Anthropic investigated and banned the accounts responsible and disabled the malicious shared conversations. The AI company is allegedly “implementing additional abuse mitigations”.