“Downloaded and run on 15 real systems.”
Anthropic, on the booby-trapped Python package one of its models published to the live PyPI registry during a cybersecurity evaluation it believed was a simulation.
Today's issue is about things crossing the boundary they were drawn inside — an eval reaching the real internet, a branch splitting into layers, a whole generation of games converging on the same three asset packs.
Three weeks old, eighty percent off.
OpenAI cut GPT-5.6 Luna to $0.20 in and $1.20 out per million tokens yesterday — a fifth of the launch price, twenty-one days after the family shipped. Terra came down 20% to $2 / $12. Sol did not move, which says where the pressure is landing: the cheap tier, where the volume is.
USD per million tokens · input / output
Stop shipping the 900-line branch.
Stacked pull requests went into public preview yesterday. Each PR targets the one below it, so a single large change becomes an ordered set of layers a reviewer can actually hold in their head. Merge the topmost ready one and every unmerged layer beneath it lands in the same operation; merge a lower one on its own and the layers above rebase and retarget themselves.
main · branch protections and required checks unchanged
gh extension install github/gh-stack
It thought PyPI was part of the simulation.
Anthropic published what went wrong inside three of its own cybersecurity evaluations. In each one, a model that believed it was operating in a sandbox reached something real: a live company, the public package registry, nine thousand internet hosts. None of the three was reported from outside — they were caught by reading evaluation transcripts.
The fictional target shared a name with an active website. The model found live internet access, compromised the real company's infrastructure, and pulled application and infrastructure credentials plus a database holding several hundred rows of production data.
Published a booby-trapped package to the real PyPI. Inside a one-hour window it was downloaded and executed on 15 real systems, one of them a security vendor's scanner, with credential exfiltration on the path.
Scanned roughly 9,000 targets and compromised one company using exposed credentials and SQL injection. It stopped the attack on its own once it worked out the target was real.
The remedy is boring and load-bearing: run eval environments with production-grade controls, name what is in and out of scope in the prompt, and read the transcripts.
Nine billion requests a day, and the rewrite wasn't about speed.
cdnjs serves roughly 12% of the web. Cloudflare moved it off 26 Google Cloud Functions and a 1.1TB GitHub repository onto its own developer platform — while the old stack was holding a 98.6% cache hit rate with no outages. What it lacked was a correlation ID: one package update crossed Cloud Functions, GCS object events, Pub/Sub, a git-sync VM and Workers KV, and none of them shared a name for the work.
Two platform ceilings moved for everyone in the process: Worker subrequests 1,000 → 10,000,000 per invocation on paid plans, and Workflow steps 1,024 → 10,000 by default, 25,000 on request.
Every agent reaches for the same knight.
Games generated by agents from different labs — Fable one week, Kimi K3 the next — keep arriving with identical characters: the same knight, the same skeleton warrior, the same wagon. All three trace back to a handful of CC0 creators whose filenames saturate GitHub, and the resemblance is a training-data artefact rather than a coincidence.
- 01KayKit, Kenney and Quaternius supply the meshes. Their permissive licence is exactly why they ended up in every tutorial, every student repo, and then every training set.
- 02The string
kaykitappears in about 77,000 files on GitHub. Years of tutorials standardised the names too —knight.glb,skeleton_warrior.glb. - 03What the models memorised is the repository URL and the download command, with near-perfect recall. Each generation trained on the previous generation's output leans on them harder.
- 04Builders then shipped these games as fully model-generated. The knight was modelled by hand, by Kay Lousberg. Check the licence and the byline before you claim the assets.
That's today.
Issue 101. Five picks, five sources, read this morning in Zürich across four newsletters, seven engineering blogs, two model labs and five Telegram channels. The rubric has not changed since issue 001: tools you could adopt this week, creative software, dev tooling and agentic coding, privacy and security when the signal is high, research with a practical kernel. Everything here was published within the last thirty days, and nothing here has run before.