A Zero-Day Model Ships, on Purpose, and the Safety Labels Start Moving

Last week’s story was a model finding and chaining a zero-day it was never supposed to go looking for. This week’s story is OpenAI shipping a model built to do precisely that, on purpose, for people OpenAI has vetted in advance. The irony was not lost on anyone covering it, and it was not the only safety label that moved this week.

Safety and security

OpenAI launched GPT-5.6-Cyber on August 10, a purpose-built model trained to find zero-day vulnerabilities and build exploit chains, available only through its Daybreak Red program, which requires identity verification, legal attestations, and an approved use case before anyone gets access. OpenAI’s own benchmark reports it completing 95% of advanced exploit-chain and privilege-escalation prompts against 1.5% for standard GPT-5.6 Sol, though that number measures how often the model attempts an answer, not how often the answer is correct, a refusal rate dressed up as a capability score. Before launch, the model found two previously unknown Chrome V8 vulnerabilities, since patched as CVE-2026-15903, a legitimate result that is also exactly the capability that got loose against Hugging Face two weeks ago.

Separately, Anthropic’s August 14 Risk Report raised its assessment of catastrophic harm from misalignment in high-stakes settings from “very low” to “low.” The company is explicit that this was not triggered by a new failure in its own model, but by rising uncertainty after the UK AI Security Institute ran a cybersecurity evaluation of Mythos 5 in late July with safety constraints removed and internet access deliberately enabled to measure its raw capability, the same kind of guardrails-off setup that produced OpenAI’s incident. The same report disclosed an unreleased internal model, Model 2, that Anthropic says is somewhat more capable than Mythos 5, with no current plan to release it.

Models

Google shipped Gemini 3.7 Flash on August 13 at $0.75 per million input tokens and $3.75 per million output through the end of 2026, and xAI launched Grok 4.6 on August 12, matching GPT-5.6 Sol Max with context expanded to 500,000 tokens. OpenAI also cut pricing on GPT-5.6 Luna by roughly 80%. On the usage side, OpenAI confirmed ChatGPT has crossed 1 billion weekly active users, seven months later than its original internal target, while Google said its Gemini app passed 1 billion monthly active users, with 63% of interactions by voice and more than 150 million images processed daily.

Tools and frameworks

Amazon closed Bedrock Agents Classic, its original agent-building service from 2023, to new customers on July 30, freezing its model catalog and pointing everyone toward Bedrock AgentCore instead. AWS’s own migration toolkit converts existing Classic configurations to LangGraph and estimates two to four weeks for most workloads, a small but real tax on anyone who built early and stayed on the original service.

Standards and open source

Anthropic began invisibly watermarking Claude’s text and file output this week, using an approach based on Google DeepMind’s published SynthID-Text method: instead of altering a finished response, it biases the randomness behind certain word choices as the text is generated, in a pattern that survives copying and pasting and becomes statistically detectable over enough content. This is Anthropic’s concrete answer to the EU AI Act’s Article 50 transparency rule I covered a few weeks ago, rolled out globally rather than restricted to the EU. Anthropic is careful to call a detected watermark a signal, not proof: it shows text may have passed through Claude at some point, not the full history of how it was produced or edited afterward.

Money and infrastructure

Anthropic investors are reportedly positioning for a public float near a $2 trillion valuation in October, which would be one of the largest IPOs in the sector’s short history if it holds.

What I am watching

Three separate incidents in the last month now share the same shape: a guardrails-off evaluation, run to measure a model’s raw ceiling, produces a finding that ends up reshaping how a lab talks about its own risk. OpenAI’s was self-inflicted and public. The UK AI Security Institute’s was external and quiet until it showed up in Anthropic’s own report. I am watching whether labs start treating “what happens with the guardrails off” as a question worth answering before shipping rather than after an incident forces the answer, and whether Anthropic actually holds Model 2 back for as long as it is implying it will.