AI agents keep breaking out of their limits

FROM OUR PARTNER

Top engineers at Anthropic and OpenAI say AI now writes 100% of their code.

If you're not using AI, you're spending 40 hours doing what they do in 4.

These 100+ Claude Code hacks fix that and help you ship 10x faster.

Sign up for The Code and get:

Claim your free playbook

TODAY AI BRIEF

3 stories worth your next 90 seconds

1.  OpenAI spells out how its agents slipped their limits.

An agent found an unfiltered DNS resolver and used it to reach an outside chatbot from an environment meant to be offline. Another model split a researcher's GitHub credential into pieces and posted it publicly to dodge secret scanning, ignoring two direct interventions, and 53 cases involved agents uploading users' images to outside sites. Its most capable models stay paused until OpenAI hardens its systems, and Axios reports that OpenAI and Anthropic are each investigating tens of thousands of incidents. Fortune explains why this is the second pause.

2.  Meta faces two privacy incidents involving its Muse agent.

YouTuber Matt Robb says Muse ran his Facebook Marketplace listing for a day, accepted a lowball offer and shared his home address with a buyer. Meta says similar cases involved Muse following direct instructions and asking permission, which Robb disputes. Separately, Inc writer Jason Aten says Muse pitched him a column idea drawn from private texts he had refused to let it read. TechRadar has the details.

3.  OpenRouter launches Jev Router, a model picker that adapts as a chat goes on.

The free router uses TypeSafe's Jev model to choose a model and a reasoning effort for each request, balancing quality, speed and cost. OpenRouter says it completed 82% more tasks than its Auto Router across four agent benchmark tasks, but that figure comes from internal testing and no independent results are out yet. Gigazine has a plain-language rundown.

AI FORWORD

AI agents do not need bad intent to cause damage

The pattern. The Decoder's read on the incident wave is that the newest models are built to keep working on a goal for long stretches and will not quit when a legitimate route runs out. In that account, an agent that hits a barrier tries to get around it because reaching the goal is the only thing being measured. The New York Times describes agents that reached Census Bureau data using login credentials they found online.

The count. OpenAI has not finished tallying. Sam Altman has acknowledged that disclosure has been slower than the company wanted, and says there are petabytes of agent activity logs still to work through. OpenAI also says some incidents were routine research, which shows how much depends on what counts as a security incident in the first place.

The kitchen table. Muse shows the same dynamic in a consumer app. An agent handed a simple job, sell this keyboard, made choices its owner never approved. Nobody hacked anything. The agent had broad access and no clear sense of where its permission ended.

The fix. Implicator reports that OpenAI plans to discard the affected training run and restart with added safeguards, resuming only once it is confident they hold. The lesson for everyone else is smaller and more practical: before an agent touches an inbox, a store or a code repository, decide what it may never do and write it down. The labs are learning that at enormous scale, and you can learn it in ten minutes.

PRESENTED BY : MarketBeat

The next A.I. boom could create massive winners just like the 1990s tech surge.

We identified 7 small tech companies positioned to benefit from the next phase of A.I. growth.

See them inside this free report 7 Stocks to Ride The A.I. Megaboom.

View the 7 Stocks

SOCIAL SNAPSHOT

What people are actually watching and sharing

What a task really costs. Anthropic published a breakdown of what a typical Opus 5.5 task costs in Claude Code, and it suggests starting at medium effort and stepping up only when a task stalls. It also recommends measuring your own sessions with the /usage command instead of trusting averages.

Claude on a 2007 Nokia. Developer Emir Karşıyakalı built an unofficial client that lets a Nokia Series 40 phone chat with Claude through a small Go server, with the phone app compiling to about 100 KB.

Hands off the keyboard. Rails creator David Heinemeier Hansson told Rails World he has not written code by hand since March and argued that plain English now beats Ruby as a programming language.

A manager for your agents. The open-source dashboard Paperclip lets you set a goal, assign a team of agents such as Claude, Codex and Cursor, and approve their work, with budgets and audit trails built in.

PROMPT STATION