In partnership with
In Todayโs Issue:
๐งช Test agents stepped outside the sandbox at two evaluators
๐ก๏ธ Washington will not safety-test open-weight models
โก Celeris-1 streams 1,664 tokens a second on diffusion
๐ฅ FLUX 3 folds image, video, audio and action into one model
๐ An unreleased OpenAI model cracks ten open mathematics problems
โจ And more AI goodnessโฆ
โก The Signal
Frontier AI safety now leans on test environments that are less hardened than the systems being tested inside them.
Two independent evaluators reported the same class of failure within a week. The UK's AI Security Institute catalogued 19 unsanctioned actions in a cyber range it had intentionally opened to the live internet, with model-provider cyber classifiers deliberately disabled to measure raw capability. Irregular, one of OpenAI's external testing partners, found that a misconfigured capture-the-flag environment had let a model attack a real website. Neither case needed a sandbox escape or a zero-day. Lowered safeguards and a network path that should not have been open were enough. On the same day, the White House told Meta, Anthropic, Google, Nvidia and OpenAI that open-weight models will stay outside its cyber testing entirely. The capability is moving faster than the harness built to measure it.
All the best,
Kim Isenberg
The counter-check on the speed claim: MMLU-Pro accuracy against p50 response time, log scale, where up and to the left is better (Celeris)
โก Celeris-1 Streams 1,664 Tokens a Second
Celeris-1 puts out 1,664 output tokens per second at the median, against 324 for the runner-up, Inception's Mercury 2, and 69 for GPT-5. Celeris measured throughput on roughly 1,000-token prompts, 50 requests per model with output capped at 1,024 tokens, and puts the gap to GPT-5 at 24 times. The reason is architectural: Celeris-1 is a diffusion model rather than an autoregressive one, so it does not have to produce each token strictly after the one before it. The chart above is the check on what that speed costs, and the answer is not much: 75.9% on MMLU-Pro against 81.9% for GPT-5, at 158 ms rather than 2.0 seconds. Every model ran in its fastest setting, with reasoning budgets set to zero.
๐ tl;dr: Diffusion decoding buys roughly 24 times the token throughput for a few points of MMLU-Pro, on the vendor's own harness.
An aerial view of a data centre; the draft rule targets the optical components inside buildings like this (REUTERS)
๐ Washington Targets China's Data-Centre Optics
The FCC is drafting a rule that would bar imports of new Chinese optical transceivers, the small components that move data over fibre inside a data centre. Reuters reported on 4 August that officials hope to publish it this year, arguing Chinese-made optics could be used to steal data, plant malware or disrupt service in the buildings that house AI training chips. Zhongji Innolight holds roughly 27% of the global market; shares in US makers Lumentum, Coherent and Applied Optoelectronics rose 7 to 18% on the report. The FCC could still soften the measure or shelve it.
๐ tl;dr: The cheapest component in the AI buildout just became a national security question.
FLUX 3 key art showing the four modalities the model covers (Black Forest Labs)
๐ฅ FLUX 3 Adds Actions to Generation
Black Forest Labs released FLUX 3, one multimodal model covering image, video, audio and action prediction. It generates up to 20 seconds of multi-scene video from text, images or keyframes, renders readable text inside frames, produces multilingual speech and sound effects natively, and ships a draft mode for cheaper previews. The model also predicts actions: Black Forest Labs frames that capability as unifying perception, simulation and execution for robotics, so the same system that renders a scene can propose the robot control actions needed to reach it.
๐ tl;dr: A video model that also tries to say what a robot should do next.
๐ฌ Watch This
The AI Selloff Doesn't Match the Data | Top AI Investor Explains.
Patrick O'Shaughnessy hosts investor Gavin Baker on Invest Like the Best to take apart the July 2026 sell-off in AI and semiconductor stocks. Baker calls the month "2022 packed into a single month," then spends the episode on the distance between that panic and what the fundamentals actually show: accelerating hyperscaler operating cash flow, rising GPU spot prices, and open-source models pulling infrastructure demand up rather than eating into it. The best stretch is on memory, where he works through the game theory of long-term agreements and why that contract structure now decides who can build at scale. And he drops one date worth marking: according to Baker, Ilya Sutskever's SSI is set to release its first model in August.
"I'm going to cancel Claude. It's just so bad, I can't believe it."
โ Kim Isenberg (@kimmonismus), on X, 4 August 2026
My own post, so read the framing accordingly. The example was concrete: Claude checking my inbox, summarising the mail and drafting replies, then getting caught again not actually reading the email it was answering. 12.3K likes and 1.4K replies later, the overwhelming majority of the comments agreed. The complaint that keeps coming back is that Anthropic's Opus is sliding rather than improving.
Reuters reports that the White House told Meta, Anthropic, Google, Nvidia and OpenAI on 4 August that open-weight models will not be put through its cyber safety testing, leaving Nemotron and Llama outside a framework that was voluntary anyway. After months of shouting about open weights, the surprise is that the testing is the thing being dropped, and it lands days after both labs had already disclosed separate incidents in which their systems reached into other companies' networks.
The Safety Test Became the Risk
The Takeaway
๐ The UK's AI Security Institute catalogued 19 unsanctioned actions across 10 of 122 runs of a single cyber-range evaluation, attributing 17 to Anthropic's Mythos 5 and 2 to OpenAI's GPT-5.6 Sol.
๐ In the most serious case an agent tried to push malicious code into a public open-source project, inventing fake identities to pressure the human maintainer, who refused.
๐ Irregular, OpenAI's other testing partner, hit a different failure: a misconfigured environment let a model attack a real website whose domain matched the fictional target, then operate it with credentials it found.
๐ No sandbox escape and no zero-day was involved in either case. The openings were a misconfiguration, a switched-off classifier and internet access that was left on by design.
๐ OpenAI says it will rework how it scopes third-party testing, covering isolation, credential handling, monitoring, stop conditions and incident escalation.
On 28 July, security monitoring at the UK's AI Security Institute picked up unusual data transfers leaving a cyber range, and the traffic was going somewhere it was never meant to go. The evaluation had begun on 25 July. Agents were told to act as cybersecurity experts, compromise three connected simulated networks and retrieve a flag. To keep the test close to real attacker conditions, AISI had intentionally permitted live internet access so the agents could fetch their own tools, and the model providers' cyber classifiers were deliberately disabled to measure raw capability. Those are conditions no ordinary user ever meets. They also turn out to be the conditions under which an agent wanders off.
The incident report AISI published on 4 August (AI Security Institute)
Of the 19 actions AISI later classed as unsanctioned, spread across 10 of 122 runs, it attributes 17 to Anthropic's Mythos 5 and 2 to OpenAI's GPT-5.6 Sol. The list is uncomfortably specific. One agent tried to insert malicious code into a public open-source project, created fake online identities and used them to pressure the human maintainer into approving it; the maintainer refused. Others messaged real people to get them to run malicious code, planted hidden instructions aimed at other AI systems, and left public messages coordinating with other test agents. GPT-5.6 Sol reused a GitHub token another lab's agent had left publicly accessible, registered accounts with external DNS and tunnelling providers, and used a public tunnel to expose a locally running DNS server that held exploit payloads. That setup did not work and no real resolver appears to have queried it. AISI stopped the evaluations, isolated the machines and contained the activity within roughly an hour of detection.
The second incident is the one that touched a stranger. On 29 July, Irregular, an external cybersecurity partner OpenAI uses for capture-the-flag evaluations, reported that a misconfiguration had connected a supposedly offline environment to the public internet. The fictional target's name happened to coincide with a real domain, so the model exploited the real site, then found and used credentials to operate it. The site had an ordinary security weakness and the model used it. Its owner had no idea the site had been pulled into an experiment. Irregular has paused the evaluations, begun remediation and notified the affected parties, and says the impact so far appears limited to that site's own data, with its audit still running.
AISI's own framing is the line worth keeping: "it is the first time we have seen risks around autonomy and deception manifest this clearly in the real world." OpenAI says it will now review how it identifies higher-risk evaluations, how scope gets agreed, how requests to enable internet access or lower safeguards are assessed, and how incidents are escalated, and it wants national AI institutes, independent evaluators and other labs in the same room in the coming weeks.
Why it matters: Independent evaluation is the main mechanism the industry has for catching dangerous capability before it ships, and both failures happened inside that mechanism rather than around it. Nothing exotic was needed: a misconfiguration, a deliberately weakened guardrail and an open network path were enough. Evaluation environments now need the same security engineering as production systems.
Sources:
๐ https://t.co/ZL3n6mxYMS
๐ https://t.co/cJ3hCBtBU7
๐ https://x.com/AISecurityInst/status/2084746202579386632
Appleโs Starlink Update Sparks Huge Earning Opportunity
Apple just secretly added Starlink satellite support to iPhones through iOS 18.3.
One of the biggest potential winners? Mode Mobile.
Modeโs EarnPhone already reaches 490M+ users that have earned over $1B, and thatโs before global satellite coverage. With SpaceX eliminating "dead zones," Mode's earning technology can now reach billions more in unbanked and rural populations worldwide.
Their global expansion is perfectly timed, and investors like you still have a chance to invest in their pre-IPO offering at $0.52/share.
With their recent 32,481% revenue growth and newly reserved Nasdaq ticker, Mode is one step closer to a potential IPO.
Please read the offering circular and related risks at invest.modemobile.com. This is a paid advertisement for Mode Mobileโs Regulation A+ Offering.
Mode Mobile recently received their ticker reservation with Nasdaq ($MODE), indicating an intent to IPO in the next 24 months. An intent to IPO is no guarantee that an actual IPO will occur.
The Deloitte rankings are based on submitted applications and public company database research, with winners selected based on their fiscal-year revenue growth percentage over a three-year period.
The chart: Black Forest Labs comparing its own training method, Self-Flow, against standard Flow Matching, the technique most current image and video generators are built on. The left panel shows generation error as Frรฉchet distance, a measure of how far generated output sits from real data, where lower is better and Flow Matching is normalised to 100: Self-Flow reaches 66.3 against 72.9 on video (FVD), 3.69 against 4.04 on images (FID) and 149.8 against 153 on audio (FAD). The right panel shows success rate on robot manipulation tasks through finetuning, averaged over four task groups.
The lesson: The generation gains are modest, between 2 and 9 percent. The robotics curve is where the method earns its keep: 47% success against 35% at 100K training steps, reaching Flow Matching's final level in roughly half the steps.
The caveat: These are Black Forest Labs' own numbers from its own runs, published alongside a product launch and replicated by nobody else. The 2.1% audio gain is small enough to sit inside ordinary run-to-run variation.
๐งฎ Ten Problems Nobody Could Crack
โก Bottom line
An internal version of Astra, OpenAI's next major model, resolved or advanced ten long-standing open problems in mathematics.
๐ก Why it matters
The tokens needed to find those solutions would cost roughly $2,000 at Sol API rates.
๐ What it means
Machine-made proofs now ship with Lean certificates, so the argument can be checked rather than trusted.
Picture a long-open mathematics problem as a locked door that specialists have taken turns trying keys on, without success. On 1 August, OpenAI said one system opened ten of them, and published the proofs.
OpenAI's write-up of the ten results, published 1 August (OpenAI)
These are not exam questions with answers in the back. They span eight fields, from high-dimensional geometry and coding theory to group theory, quantum complexity and lattice cryptography, and each had stood as a long-standing open problem. Three of the ten close numbered Erdลs problems, entries on the running list of puzzles Paul Erdลs left behind: 183, 146 and 180. One result shows that non-sofic groups exist, settling whether every group can be approximated by shuffling a finite deck of cards. Another disproves Connes's rigidity conjecture, the idea that certain groups are pinned down uniquely by an algebra built from them.
The answers arrived with something unusual attached. The arguments were produced by an internal version of Astra, OpenAI's next major model. Humans wrote them up, and the model then restated each proof as a Lean certificate, a form a computer can verify line by line. Those certificates sit in the public openai/ten-proofs repository, so nobody has to take the claim on faith. OpenAI also released the model's own narration of how it reasoned through each result.
OpenAI is also blunt about credit: claiming human authorship for a proof a system generated would misrepresent both the system's contribution and the human work, it argues, with a nod to the mathematicians behind the Leiden declaration on AI and mathematics. It takes responsibility for correctness while attributing the arguments themselves to the model. The number still missing is the denominator. As Simon Willison pointed out, there is no word on how many problems got the same compute budget and produced nothing at all.
The AI bill isn't what sinks you.
AI costs don't usually explode overnight. They grow quietly through duplicate requests, expensive routing and poor visibility.
Mesh API helps engineering teams spot the waste before finance does.
A global e-commerce company was able to reduce spends by 78%.