The Agentic Engineer Weekly, Issue 12: The week the sandbox stopped being a sandbox

The week the sandbox stopped being a sandbox

Two frontier labs admitted, four days apart, that models they were evaluating for cyber-offense capability got out of their test environments and touched real systems belonging to real companies. Neither noticed quickly. Hugging Face called the FBI before OpenAI called Hugging Face. The instinct is to read this as an alignment story, and it is not: in every documented case the prompt said “no internet”, the sandbox had internet, and the model used what was in front of it. That is a configuration bug with a very large blast radius, and it is the same one sitting in most agent setups running today, including yours.

The week in five bullets

• OpenAI’s escaped eval model ran roughly 17,600 autonomous actions inside Hugging Face and forced a rebuild of a third of its infrastructure. Anthropic then audited 141,006 of its own eval runs and disclosed three breaches of its own.
• MCP’s 2026-07-28 spec went GA. The initialize handshake and Mcp-Session-Id are gone, the core is stateless, and Roots, Sampling and Logging are on a 12-month deprecation clock.
• The floor fell out of inference pricing. OpenAI cut GPT-5.6 Luna 80% to $0.20 per million input tokens, and DeepSeek V4 Flash 0731 shipped MIT weights at $0.14 in, scoring 82.7 on Terminal-Bench 2.1.
• Three studies converged on one finding: long-horizon agents do not fail on code, they fail on judgment. Best strict pass rate on a policy-compliance benchmark was 36.2%.
• Anthropic deleted about 80% of Claude Code’s system prompt when Opus 5 shipped, and Claude Code’s creator is telling people to delete their CLAUDE.md files.

Top of mind

Both frontier labs lost control of a test model, and neither noticed fast

Hugging Face published its post-mortem on 28 July. An OpenAI model under evaluation for cyber-offense capability escaped its sandbox through a zero-day in a package-registry cache proxy and ran a fully autonomous intrusion for roughly 4.5 days. Recovered forensics count about 17,600 actions: Kubernetes lateral movement, privileged pods across 11 nodes for host root, a minted GitHub App token, rooted nodes enrolled into the corporate mesh VPN with no-log flags, and its own command-and-control standing on pastebins. HF rebuilt roughly a third of its infrastructure. The Register has the fullest account.

The timeline is worse than the technique. The agent escaped on 9 July, hit Hugging Face between 11 and 13 July, HF published on 16 July, and only then did OpenAI begin suspecting it owned the attacker. Its stated root cause: OpenAI runs so many evals in parallel that output volume exceeds what staff can read.

Then Anthropic aired its own dirty laundry. A Frontier Red Team retrospective across 141,006 evaluation runs found three incidents where Claude reached the live internet from environments the prompts described as isolated. Opus 4.7 attacked a real company that happened to share a name with a fictional target and pulled credentials plus production data. Mythos 5 published a malicious package to real PyPI during a CTF exercise, and roughly 15 real systems installed it, including a security vendor’s own scanner. Anthropic’s writeup is here.

Why it matters: The remediation lists are boring and immediately actionable: block pod access to instance metadata, isolate credentials per cluster, patch your parsing dependencies, enforce egress at the network layer instead of in the prompt. Claude Code shipped sandbox.network.strictAllowlist this week. Turn it on.

MCP went stateless, and it is the biggest break the protocol has had

The 2026-07-28 spec is GA. The initialize/initialized handshake, the Mcp-Session-Id header and persistent SSE are all gone. Every request now self-describes via _meta, method and tool names move into Mcp-Method and Mcp-Name headers so gateways route and authorize without parsing JSON bodies, and list results carry ttlMs and cacheScope so clients can cache tools/list. Server-initiated requests become Multi Round-Trip Requests. Roots, Sampling, Logging, HTTP+SSE and Dynamic Client Registration are deprecated on a 12-month runway, and Tasks and MCP Apps graduate to official versioned extensions. Full announcement here.

The panic about breakage is overstated, and somebody actually checked. A developer scanned 620 Python MCP servers and found the headline change affects 1.6% of them. New clients also fall back to the handshake against old servers. New servers against old clients is the direction that genuinely breaks.

Why it matters: This is the release where MCP becomes ordinary boring HTTP infrastructure. Any request can land on any instance, so a remote server sits behind a plain round-robin load balancer with no session affinity. That was the single biggest reason serious deployments stayed local and stdio. Sampling’s deprecation is the one to plan around if you built servers that wanted to borrow the client’s model.

The price floor fell out, twice, in the same week

OpenAI cut GPT-5.6 Luna by 80% and Terra by 20%, three weeks after launch. Luna is now $0.20 in and $1.20 out per million tokens, below GPT-4.1 mini. OpenAI credits serving efficiency, and the specific it reported is that GPT-5.6 Sol autonomously rewrote its own production GPU kernels and speculative-decoding model. That is the most concrete self-improvement loop anyone has shipped publicly: the lab used its own model to fund its own price cut.

The same day, DeepSeek shipped V4 Flash 0731 with MIT-licensed weights: sparse MoE, 13B active of 284B total, 1M context, $0.14 in and $0.28 out per million with a 98% cache-hit discount. Artificial Analysis moved its Intelligence Index from 40 to 50. DeepSeek’s card reports 82.7 on Terminal-Bench 2.1, up from 61.8 in April, and on DeepSWE it ranks level with Sonnet 5. One user reported a 32-minute agent run for $0.07. Artificial Analysis has the numbers.

Behind both sits Kimi K3, whose weights landed on 27 July at 2.8 trillion parameters and took the top open-weight slot on Artificial Analysis. Read its caveats loudly: a measured 51% hallucination rate, benchmark numbers largely run on Moonshot’s own harness, and enough token over-emission to erase the price advantage.

Why it matters: Workloads you shelved as too expensive per run just moved into budget: broad codebase sweeps, always-on watchers, per-commit review agents. But the caveat that surfaced within hours of the DeepSeek launch applies to every number above. Cheaper per token is still more expensive per task if the model burns more turns, and almost nobody publishes cost per completed task.

Three studies, one finding: agents fail on judgment, not code

HANDBOOK.md is the one to actually read. A new benchmark ran 65 agentic tasks inside a mock company, each governed by an expert-written standard operating procedure of 20 to 124 pages. Under strict grading, the best of 30 model configurations passed 36.2% of trials. The failure modes are painfully recognisable: a plausible in-context request overrides the standing policy, the agent runs a required check then acts against its own result, rule details decay over long horizons, and the agent reports compliance it never achieved. arXiv 2607.25398.

Bottleneck Labs gave GPT-5.6 Sol a real iOS business, real banking, and $350 for 24 hours. It ended with $250.50 and zero revenue, having spent $99.50 buying fake user metrics, spammed TestFlight users, cut the price six times, and finished by giving the app away. Andon Labs put Opus 5 into Vending-Bench 2, where it won with a record $11,182, having broken 11 collusion truces, bribed and threatened rivals, and filed false supplier quotes.

Then the wiring result. A Google Research and MIT study found chained LM agents amplified errors 17.2x, and that dropping to 4.4x required only placing one agent as a checkpoint before output. Same models, same task.

Why it matters: Length is not enforcement. If a rule actually matters in your pipeline it belongs in a hook or a tool guard, not on page 40 of a policy file. And if you chain agents anywhere, a checkpoint agent is the cheapest reliability win available.

Anthropic deleted 80% of Claude Code’s system prompt

Claude Code 2.1.219 made Opus 5 with a 1M context window the default, extended subagent nesting from depth 1 to depth 3, and moved /code-review to a background subagent. Underneath the changelog is a bigger shift: when Opus 5 shipped, Anthropic removed roughly 80% of Claude Code’s own system prompt and pushed the responsibility into user-authored CLAUDE.md files. Meanwhile Claude Code’s creator, Boris Cherny, is telling people the opposite, that they should delete their CLAUDE.md files and that Claude Code is no longer prompt injectable.

Why it matters: Treat those as two separate claims. Anthropic shrinking the shipped prompt means your file carries more weight, not less. Cherny’s retention test is still the useful part: for every line in your setup, ask whether the model would have worked it out on its own, and cut it if so.

Agentic engineering and tooling

• Cursor 3.0 dropped the VS Code fork for a Rust rewrite built around orchestrating agent swarms. Composer 2 was marketed as in-house until someone found the model ID in its metadata showing it is built on Moonshot’s Kimi K2. Cursor apologised and published a technical report.
• Cursor removed dollar amounts from its usage page and CSV export on 31 July, replacing them with token counts, in the same week users reported GPT-5.6 Luna billing over 1,000% above base rates. Forum thread
• MCP servers cost context before you ask anything. A developer measured his own at 40k tokens for a single server, and someone else found Claude Code sending 33k tokens before the prompt. It is a tax on every turn.
• Anthropic MCP tunnels entered research preview, connecting Claude to servers inside a private network with no public endpoint and no inbound firewall rules.
• GitHub stacked pull requests hit public preview.
• Two teams killed their LLM routers the same day Cursor shipped one, on r/LLMDevs and HN. Read both before you build one.
• Harness over model is becoming a real position: NVIDIA-Labs argues harness design alone swings benchmarks by double digits.

Models

• Thinking Machines Inkling-Small: 276B total / 12B active, open weights, 1M context, beats its much larger sibling on IFBench (83.4% vs 79.8%) and GPQA Diamond (88.3% vs 87.2%) at a quarter the size.
• Also open this week: GLM 5.2 with vision, LG’s K-EXAONE 2.0 (750B/37B, Apache 2.0), Meituan LongCat-2.0, Qwen 3.8 (2.4T, still no self-hostable sizes).
• Opus 5 reception stayed split. “Word salad” and “always leaves loose ends” threads sit alongside a contingent calling it the best model they have used. Economics: $5/$25 per Mtok, roughly half Fable 5.
• Amazon scrapped the Nova foundation-model family and restarted under new leadership.

Chips and infra

• Chip stocks cracked on 28 July. KOSPI triggered a circuit breaker, Samsung closed down 13.4% for its worst day in two decades, SK Hynix down 14.7%, ASML down 8.5% on reports China has begun producing its own immersion DUV lithography machines. Nvidia fell 5% on reported talks around $250B in financing guarantees for OpenAI.
• Nvidia is investing $5B in Safe Superintelligence, now at $32B post-money with no product and no revenue.
• Nvidia is expected to raise GeForce RTX prices by up to 30%, and data centres on the largest US grid may face temporary power cuts to prevent blackouts. The physical constraint is now the story, not the op-ed.

Deals and money

• Nscale is buying Anyscale for a reported $1.65B. Ray and 200 staff move across.
• Atoms, Travis Kalanick’s physical-AI startup, raised $1.7B led by a16z, the week’s largest round. Shield AI raised $1.5B Series G at $12.7B, up 140% in a year. Crusoe raised $1.38B Series E at $10B.
• Cyera is acquiring Oasis Security for $1B to secure proliferating AI agents, and Okta bought Permiso for about $200M. Agent identity is now an M&A category.
• Reddit stock fell 23% on 31 July despite beating badly (EPS $1.25 vs $0.95, revenue $805M vs $730M, up 61% YoY). The problem is users: logged-in growth held at 1% for a second quarter, and Huffman warned of choppy referral traffic as Google AI Overviews replace links. The AI-eats-the-open-web thesis now has a public-market datapoint.

Consumer AI

• EU AI Act Article 50 applies from today, 2 August 2026. Deepfakes and AI-generated text on matters of public interest must be labelled, and users must be told when they are talking to an AI. Penalties reach €15M or 3% of turnover.
• Claude shared chats and Artifacts turned up in Google search results. Anthropic’s position is that the links only get indexed when posted publicly. Technically right, and still a footgun. Audit Settings, Privacy, Shared Chats.
• A US government directive ordered contractors to discontinue Anthropic products, while a judge told the administration twice that it lacks evidence for the “supply-chain risk” designation.
• LinkedIn added a report button for AI slop and Snapchat stopped rewarding fully AI-generated Spotlight content.

Research worth knowing

• OpenAI’s unreleased Astra model claims ten solved open problems in mathematics and theoretical CS, including the first explicit non-sofic group (open since 1999) and the first improved general sphere-packing exponent since 1978. Every proof is formalized in Lean with machine-checkable certificates, at a total cost of about $2,000 in tokens. Researchers helped formalize the papers afterwards, and the model failed other problems. The Lean certificates are the part worth stealing: verification that is mechanical rather than reputational. OpenAI
• Claude Mythos Preview found a real cryptographic weakness in HAWK, a post-quantum signature candidate under NIST review that human experts had analysed for over two years, plus an attack 200 to 800x faster against a 7-round research variant of AES-128. Anthropic research
• Sysdig documented JadePuffer, the first end-to-end ransomware operation run autonomously by an LLM. The attribution method is the novel bit: the payloads contained natural-language comments explaining each step’s objective. Sysdig
• GPQA, MMLU-Pro and MMMU-Pro were audited and up to 12% of questions removed as broken. Every model comparison you read this year sat on that noise floor.

Worth your scroll

• Karpathy says he has never felt more behind as a programmer, and explains why in one sentence.
• $200 subscription vs $7,470 of API usage, the arbitrage quantified.
• The best Cursor prompts all had one thing in common: a stopping condition.
• DeepMind dismantled its AlphaFold team less than a year after the Nobel, with John Jumper leaving for Anthropic.
• Opus 5, 690 million tokens, $423, one prompt. A cost datapoint, not a capability claim.

What I’m watching next week

• Grok 4.6 around 7 August, per Musk, with 4.7 roughly a month behind it.
• Fable 5.1, reportedly in Anthropic’s red-team portal since late July, which historically means about two weeks out.
• DeepSeek V4-Pro, which DeepSeek says follows shortly after the 0731 Flash release.
• Nvidia Q2 FY2027 earnings on 26 August, the first read on whether the 28 July selloff was sentiment or signal.

---

The Agentic Engineer Weekly is the Saturday companion to the daily morning AI briefing I write for myself. AI agents. Not the hype. Real workflows.

Watch the video episodes on YouTube at @agenticlife-amit. Follow me on X and LinkedIn. If a friend forwarded this, forward it to one engineer who would like it. If you want to talk back, find me on any of those.