Samsung has largely stuck with traditional designs for its Galaxy Buds lineup over the years, with the bean-shaped Galaxy Buds Live standing out as the one truly radical departure. But that appears to be changing, as Samsung experiments with designs its rivals have embraced for years. Just a day after leaked renders offered an early look at the clip-on Galaxy Buds On, a new leak has shed light on another upcoming pair of Galaxy Buds targeted at gym-goers and athletes.

A design built for movement

According to SamMobile, Samsung is working on another pair of buds internally codenamed “Buds Canal 5.” Leaked renders suggest that they may be aimed squarely at users who want earbuds for workouts and running rather than everyday listening.

The renders show flat ear hooks paired with an ear tip that sits in the ear canal, a layout previously seen in countless other fitness-focused earbuds already on the market. It’s not immediately clear if the tips form a full in-ear seal for stronger noise isolation or a half in-ear fit that trades isolation for a more open, breathable feel.

Either way, the hook itself is the highlighting feature. It’ll help keep the earbuds in place during physical activity, something no other earbuds in Samsung’s current lineup are really designed to do. The leak doesn’t reveal any details beyond the design, so it’s unclear whether Samsung plans to include features like active noise cancellation or a dust and water resistance rating.

Why a workout-specific design makes sense

Samsung’s current earbuds catalog sticks to one traditional stem-based design, be it with silicone tips, like the Galaxy Buds 4 Pro, or without them, like the regular Buds 4. With the upcoming Galaxy Buds On, Samsung will cater to buyers who prefer awareness over isolation, leaving a gap for those wanting a pair of earbuds that won’t fall out when they go for a jog or to the gym.

The ear hook design will fill that gap and help Samsung better compete with other brands in that segment. If you’ve been holding out for Samsung earbuds that won’t fall out mid-run, this is worth keeping an eye on. Just don’t expect an announcement anytime soon. Samsung hasn’t made anything official, and there’s still no word on specifications, pricing, or even what they’ll ultimately be called.

HOVERAir just revealed Versa, a camera that lives in two worlds at once. Hold it and you get a compact, three-axis stabilized shooter small enough for a pocket. Snap on a set of protected wings and the same module lifts off, follows you, and films from the air without a controller or any flying skill.

In the hand, it functions similarly to handheld gimbal cameras that content creators are already accustomed with. You have a built-in screen to preview and check your shots right there on the spot. The 3-axis gimbal keeps motion smooth whether you’re walking, sprinting, or simply turning, and it’s really useful. Their papers indicate that the image processor is well-tuned for recording strong dynamic range, which should result in clean colors in bright city streets, deep shadows, and even decent low-light performance after the sun begins to set. For the time being, the exact sensor size and resolution remain unknown.

Insta360 Luna Ultra – 8K Vlogging Camera with Dual Leica Lenses, 12× Zoom, 1″ Sensor, Detachable…

• Dual Leica Lenses, Pro-Grade Imaging System: Dual Leica lens design combines a 1″ main sensor with a pro-grade telephoto lens featuring a…
• Cinematic 8K HDR Video: This vlog camera shoots in up to 8K30fps with Dolby Vision, capturing vivid color, high contrast, and lifelike detail for…
• Pro Telephoto Zoom with Natural Bokeh: Get closer with up to 6× lossless zoom and a 12× zoom range. The telephoto lens delivers true optical…

The real magic happens when you transform it. You can quickly and easily attach the camera module to a flyable frame in one motion. The propellers are carefully stored in protective cages, as they have been with previous models. Once attached, the device transforms into a completely autonomous camera capable of taking off from your palm and flying away on its own. On-board systems take over, including an AI tracking engine that keeps your subject right in the middle of the frame. You get a variety of automated cinematic moves, like follow, orbit, zoom out, bird’s eye view, and many more that fans of their past cameras will recognize and enjoy.

There is no need for a remote or even a practice session because the system will just pick up the person in front of it and follow the chosen course on autopilot. When it’s finished, it gently flies back into your waiting hand. The module can then be removed and used as a standard handheld camera with no difficulty. However, one notable mode goes above and beyond. In 3D Worlds, the camera whizzes around the environment in a precise 360-degree circuit, taking a series of stills and stitching them together into a 3D model that you can flip around on your phone or computer to share. HOVERAir explains that because this technology relies on image stitching rather than fancy laser scanning, it is now best suited to interior or small outdoor locations.

AI even joins in on the fun when it comes to composition, as the system scans the environment, offers a better location for the camera, and then applies an intelligent crop after the shot is locked in. The goal is to get professional-level framing without the hassle. HOVERAir spent years honing the concept of a self-flying camera, beginning with the original Hover Camera, progressing to the X1 series, which included palm launches and auto-tracking, and the waterproof Aqua for aquatic activities. Versa just takes that and folds the handheld and airborne responsibilities into a single gadget. Earlier models stayed under the 250g mark, avoiding all those bothersome registration regulations in many countries; whether Versa will be able to follow suit will be determined once the exact specs are released.

Price and availability are currently unknown. The company is still gathering interest on its website and promises to provide more technical information soon. Until then, it’s clear to see what’s in store: a single little camera that you can hold in your hand for everyday videos or leave on the ground and film from the air as needed.

AI AND ML

Wrote and published malware during tests, which is apparently OK because leaky test environments were the real problem

Anthropic has admitted that its Claude models escaped sandboxes to access the open internet and attack three organizations – but has also advanced decent excuses for the incidents.

The AI upstart discovered the attacks after checking if security tests of its models had ever produced results similar to the attack on Hugging Face made possible by OpenAI models escaping onto the internet.

“In particular, we looked for evidence that Claude – like the OpenAI models that accessed Hugging Face – was able to access the internet from within testing environments that should have been sealed off,” Anthropic wrote.

The company considered 141,006 evaluation runs during which Claude could have obtained internet access and found “three incidents in which a model accessed the internet from within or while interacting with the evaluation environment of Irregular, one of our third-party evaluation partners, and then gained unauthorized access to the production infrastructure of three different organizations.”

Anthropic’s code made those intrusions while participating in capture-the-flag challenges, tests that challenge attackers to retrieve a piece of information. Human hackers often participate in capture-the-flag tests, so figuring out how AI tackles such tasks is of interest. Anthropic works with a company called Irregular to conduct tests of this sort.

Irregular told Anthropic its test environments did not allow internet access.

“Due to a misunderstanding between us and our evaluation partner, this was not the case, and internet access was available,” wrote Anthropic’s Frontier Red Team in a Thursday blog post. “Because of this, when Claude’s search led it to real systems on the open internet, it treated them as part of the exercise.”

One of the attacks targeted a domain that whoever set up the test thought was fictional. However the domain was live and in use. Told to capture a flag at that site, Claude attacked.

Anthropic says its models used only “basic techniques, such as exploiting weak passwords and unauthenticated endpoints” to attack. “It did not find or exploit any complex vulnerabilities, and in each case, Claude continued working to complete only the specific capture-the-flag task its evaluation had assigned,” the AI upstart claimed.

“In none of these situations did Claude exfiltrate itself or deliberately attempt to escape its test environment,” Anthropic pointed out.

But Claude was still fiendishly clever as in another of its attacks the AI found setup instructions for developers that advised them to install a Python package from PyPI. That package did not exist so Claude’s strategy to capture the flag saw it create and publish a malicious one with the relevant name.

“Claude believed the package registry it was using to be part of the simulation, but in reality the package was made freely available online for roughly one hour. During that window, the package was downloaded and run on 15 real systems,” Anthropic admitted.

Claude also eventually realized it could access the open internet despite instructions not to go there. Opus 4.7, the oldest Anthropic model used in the test, kept going regardless.

“Mythos 5 correctly intuited that it was accessing the open internet, but reasoned its way back to the conclusion that it was still in a simulation,” Anthropic wrote. “Our latest model, an internal research test model, also considered whether its targets were in fact real. When evidence emerged that they were, it stopped the exercise.”

Anthropic’s post offers the usual pledges to be more careful when setting up future tests, and to make sure its models can’t make the mistakes that allowed the attacks to happen.

But the company has also given itself a pass, claiming that the safeguards in the models it sells “would have blocked the behaviors identified.”

“We believe these incidents to be closer to a harness and operational failure than a model alignment failure,” the post states, and contrasts that assessment with a more damning assessment of OpenAI’s incident. “Our models were told they had no internet access and to capture the flag, while in fact being misconfigured to have internet access. This led them to believe – arguably reasonably – that the real environments they encountered were simulations.”

“These facts give us cautious optimism that with tighter monitoring and controls around evaluation infrastructure, as well as continued investment in alignment, this type of risk can be overcome,” the post concludes.

This leaves one of the world’s leading AI labs admitting it has acted carelessly when constructing tests, and caused harm, but also claiming it can make future tests foolproof. ®

from the every-button-a-self-destruct-button dept

There are several layers of bullshit in operation here, so we’ll walk through it all. But keep in mind the only reason this is all being exposed is because Trump administration officials feel they’re more obligated to “own the libs” than actually do their damn jobs.

Last October, “conservative influencer” Nick Sortor was arrested by Portland (Oregon) police after an altercation with anti-ICE protesters. Sortor received preferential treatment from the Trump administration. He was allowed to stand on the roof of the ICE detention center and film protesters during then-DHS head Kristi Noem’s visit to the site.

The DOJ decided to intervene on Sortor’s behalf. It went after the Portland Police Bureau (PPB), demanding it turn over thousands of documents it claimed were evidence of the PPB’s desire to punish certain people for certain kinds of speech.

To do this, it cited a DOJ settlement reached with the PPB back in 2013 — one that said nothing about any PPB attempts to shut down speech the PPB didn’t like. The paragraph cited in its demand for documents said this:

Too frequently, persons who have or are perceived to have mental illness and are in crisis are subjected to unnecessary or excessive force by police officers. The Portland Police Bureau lacks adequate policies to guide officers in these circumstances, or training, supervision and accountability measures necessary to ensure that officers comply with the constitutional rights of people in mental health crisis.

That’s the first layer of bullshit. The DOJ isn’t going after the PPB because it has any genuine concerns about its treatment of people with mental health issues. It’s going after the PPB because it arrested one of theirs and is located in a “liberal” city this administration desires to punish however it can, whenever it can.

The next layer of bullshit is the DOJ pretending any previous settlement over excessive force by local law enforcement is worthy of recognizing. Since Trump’s return to office, the DOJ Civil Rights Division solely exists to further the goals of the administration’s white Christian nationalists. It has already made moves to dissolve or suspend court-ordered consent decrees affecting local law enforcement agencies successfully sued/investigated for pattern-and-practice rights violations because it feels law enforcement shouldn’t have to answer to anyone.

So, it’s entirely hypocritical for this administration to cite a consent decree it would have sought to have removed if it affected a Red State agency in hopes of punishing Portland and its police department for anti-ICE protests.

The government claimed the settlement entitled it to whatever documents it wanted from the PPB. But Assistant Attorney General Harmeet Dhillon decided to shit the bed by being exactly the sort of person you’d expect her to be, given her subservience to Donald Trump. From the ruling [PDF] handed down by federal judge Michael Simon rejecting the government’s bad faith effort to leverage a PPB civil rights settlement for its own vindictive purposes (h/t Gabriel Malor):

On October 3, 2025, the same day that Judge Immergut was holding the hearing on the motion for temporary restraining order requested by the State of Oregon and the City, the Assistant Attorney General for the Civil Rights Division of the United States Department of Justice, Ms. Harmeet Dhillon, publicly stated that DOJ would conduct a “full investigation” of policing of the protests at the Immigration and Customs Enforcement (“ICE”) facility in Portland, Oregon.

She announced this by reposting a social media post from social media personality Nick Sortor, who wrote: “BREAKING: Attorney General Pam Bondi has ORDERED a full investigation, led by Asst. AG Harmeet Dhillon, of the Portland Police Bureau, following my wrongful arrest last night, Bondi confirmed to me. FAFO, @PortlandPolice….” Assistant Attorney General Dhillon also attached to her repost her own comment, which read: “Portland: It’s FO time. Buckle up.” Id. (emphasis added).

This gloating has turned out to be premature. The court says the administration has presented no evidence the PPB is failing to follow the terms of the 2013 settlement. Furthermore, that settlement was tied to the abuse of people with mental health illnesses. There were no allegations in the settlement that the PPB regularly punished people for engaging in protected speech.

This is the first of three indications the government has “unclean hands.” This is a legal term of art that basically means the government’s intentions are impure and enough impurity is on the public record to support this finding. Part of that is Dhillon’s tweet above, which makes it clear the targeting of the PPB was directly related to the arrest of Nick Sortor, rather than anything the administration claimed in its legal filings.

As the court notes here, the government is cheating when it uses a completely unrelated enforcement effort in order to induce compliance.

[T]he United States asserts that it is purporting to investigate whether the Portland Police Bureau has engaged in political viewpoint discrimination in violation of the Agreement in this case. This case, however, has never been about viewpoint discrimination, or even any issues arising under the First Amendment.

Second, there’s the timing. This action was pursued by the administration only after it was sued by the city and state over its commandeering of Oregon’s National Guard units.

Finally, there’s Dhillon’s tweet, which can’t even be charitably be referred to as “ill-advised.”

As noted, Assistant Attorney General Dhillon preceded her reposting of a Nick Sortor comment with Dhillon’s own comment: “Portland: It’s FO time. Buckle up.” (emphasis added). That is neither language nor tone of a good faith investigation by the United States Department of Justice. Instead, it exhibits all the hallmarks of a threat and attempted intimidation.

And that’s not even the totality of the intimidation tactics engaged in by AAG Dhillon. A footnote points out Dhillon also decided to tweet out a threat targeting the judge that had originally blocked the government from obtaining these documents from the PPB.

In addition, on the same day that Judge Immergut issued her temporary restraining order, relying in part on the testimony of two high-ranking officials from the Portland Police Bureau, Assistant Attorney General Dhillon reposted a comment from another social media personality that read, in part, “Judge Immergut must be impeached.” (emphasis added). This too is threatening conduct by Assistant Attorney General Dhillon.

This is not how a federal agency — especially the one expected to fight for justice, rather than just act like extensions of Trump’s id — is supposed to behave. But Trump himself expressly encourages this behavior and anyone with the least bit of personal/professional restraint has likely been fired and replaced by brainstem operators like AAG Dhillon.

What this means is that the courts no longer trust the DOJ, which makes it all the more difficult for it to secure the wins Trump demands from his underlings. This is a blueprint for perpetual failure. Unfortunately, no one in the administration is willing to learn anything from these experiences because doing so just means educating yourself out of a job.

Filed Under: dhs, doj, harmeet dhillon, ice, nick sortor, portland, trump administration

Founded in 2007, Alo Yoga (short for ‘Air, Land, and Ocean’) started as a yoga brand, but somewhere along the way, it became the model off-duty uniform. The brand’s rise was helped along by its celebrity fan club: Kendall Jenner, Bella Hadid, Hailey Bieber, and basically every supermodel whose workout fit has made us question our entire wardrobe. What began with buttery-soft leggings and yoga pants has expanded into a lifestyle empire, with travelwear, wellness supplements, and even a collection of luxury Alo bags.

I’m also guilty of the Alo effect. I’ve been a longtime fan, and my overstuffed closet has the matching sets to prove it. In the colder months, I practically live in the Scholar Hooded Sweater and Straight Leg Sweatpants, which I also love for travel days. Alo also makes some of the best yoga mats for heated yoga, and even its Head-to-Toe Glow Oil is my all-time favorite body oil for the summertime.

I don’t have to tell you that Alo Yoga, like many activewear brands these days, can be expensive. Fortunately, there are plenty of ways to save if you know where to look. I’ve rounded up the best Alo promo codes and Alo discounts to help save you a little money at checkout.

Score an Alo Promo Code for Your Next Order

Sign up for Alo’s newsletter with your email address, and you’ll receive a unique Alo Yoga coupon code for 15 percent off your first online purchase. You’ll also get access to free worldwide shipping and returns (no Alo Yoga coupon code necessary) which is super valuable if you’re trying out Alo Yoga for the first time.

Unlock a 25% Alo Discount Code With The Pro Program

If you’re a certified fitness professional, Alo Yoga’s Pro Program gives you 25% off full-price apparel purchases online and at US store locations. To qualify, you must be at least 18 years old, actively teaching, and provide documentation to verify your eligibility. You can apply directly through Alo’s website, and once submitted, you’ll receive an email with your verification status. Approval typically takes anywhere from a few minutes to an hour, and after approval, you’ll need to wait one additional hour before using your Alo promo code or Alo Yoga discount.

This Alo Yoga discount is easy to apply for, but you’ll need to renew your Pro status annually. Some exclusions apply; for example, it can’t be used on sale items, gifts, or co-branded collections. Alo also caps Pro Program purchases at $2,000 per year (based on the original price after applying the coupon code and excluding sales tax). Check Alo’s Terms and Conditions for the full list of exclusions.

Smart Ways to Find a Coupon Code for Alo Yoga During Sales and Events

When you sign up for Alo Yoga’s emails, you’ll stay up to date on the brand’s latest sales and promotions. In addition to major events like Black Friday and Alo’s annual Aloversary Sale, subscribers can get notified about year-round markdowns of up to 40% on select apparel styles.

Save More With Alo Yoga Access

Alo Yoga Access is Alo’s free loyalty program, which you can join directly through the brand’s website. Members earn 1 point for every $1 spent online and at US store locations; points can be redeemed in your cart before checkout. Keep in mind that purchases made with points are final sale and cannot be returned or exchanged.

The Alo Access program is divided into tiers based on how many points you earn, but all members get access to perks like a birthday gift, members-only sales, and the Alo Wellness Club. Higher-tier members unlock additional benefits, including free two-day shipping, priority access to drops, and invite-only experiences.

Alo Access points are valid through the full calendar year after they’re earned, so be sure to use them before they expire. If you return an item, your points balance will be adjusted to remove the points earned from that initial purchase.

Get Free Access to The Alo Wellness Club

Alo Access members get complimentary access to the Alo Wellness Club, which is free to join. The membership includes a library of on-demand wellness classes and programs, ranging from yoga and Pilates to HIIT and strength training. You’ll also find meditation and breathwork exercises, nutrition guidance, and curated challenges designed to keep you motivated. All classes are led by certified instructors and can be streamed across mobile devices, laptops or desktops, and tablets.

Evan Blass has shared a collection of high-resolution images that look like they came straight from Google’s own marketing materials for the Pixel 11 Pro Fold. Posted through his Leakmail newsletter on July 30, the shots capture the foldable from nearly every angle in a muted green finish called Pine. This shade sits a step darker than last year’s Jade, paired with a light gold frame and matching Google logo that give the phone a quiet, refined presence.

These renders keep the overall proportions very similar to the Pixel 10 Pro Fold, not deviating significantly from the original design. A tall outer display remains the preferred layout, rather than a shorter, wider cover screen. One image reveals that the inside display will still be 8 inches, as planned. The corners are rounded, the hinge region is recognizable, and the overall book-style layout remains, albeit with only a few tiny changes that require a close look to see.

Samsung Galaxy Z Fold8 Unlocked Cell Phone + $350 Gift Card, 256GB Graphite

• PRE-ORDER NOW: Get an Amazon gift card when you pre-order Samsung Galaxy Z Fold8. You will receive an email once your gift card is available after the…
• CREATED FOR YOUR CONTENT: Any way you turn it, the new Galaxy Z Fold8 gives you a fuller viewing experience. Designed with your content in mind, this…
• WORLD’S LIGHTEST FOLD¹: Galaxy Z Fold8 is the newest foldable phone for content on the go. Unfolded, it fits movies and books for an immersive…

A closer look at the camera bar reveals the most striking visual change. The module retains its stacked layout, but the flash and microphone have been relocated inside the main glass-covered component rather than sitting out on their own as before. That adjustment removes the superfluous metal strip that was previously visible, resulting in a considerably cleaner appearance. A larger light element is now located in the upper left corner of the array. According to numerous sources, this is the Pixel Glow, an RGB lighting feature that Google has previously shown in teaser movies for the rest of the Pixel 11 lineup. We’ve also seen traces of it in code references and official clips, implying that it could be used to signal notifications while the phone is face down or to provide some visual feedback when interacting with Gemini.

Thickness looks to have also been reduced, since prior CAD measurements indicated that the closed device would be 10.1 mm, down from 10.8 mm for its predecessor, with the open profile measuring approximately 4.8 mm. The gaps around the speakers and side buttons are much smaller in these fresh shots, and a view of it partially unfolded supports the phone’s sleeker design. The difference may not be significant when compared to the thinnest of the competition, but it is still a step in the right way for a phone that has typically been on the chunkier side.

Gemini branding appears throughout the marketing photos, previewing exactly how much Google relies on its AI tools for this new generation. The photos do not provide any exact specifications, although previous sources have suggested a Tensor G6 CPU and a battery that may be slightly smaller than last year’s. There are also speculations of a prospective price increase, though nothing has been formally announced.

Google’s Made by Google event is scheduled for August 12 at 6 p.m. Eastern time. These renders appear just in time for the company to confirm or refute the details, but on the surface, everything appears to be in order. A phone that appears comparable on the surface now has a smaller shell and a light that can do far more than merely illuminate a scene. For anyone following the foldable category, the next two weeks will be quite intriguing to see how much those minor tweaks matter once you have the actual device in your hands.

AI AND ML

Chocolate Factory LLMs join Big Red’s Fusion automation party  

Oracle plans to add Google’s Gemini models to AI Agent Studio for Fusion Applications, expanding its partnership with Google Cloud and giving customers another option for building AI agents.

Big Red also intends to use Gemini models for embedded AI use cases in Oracle Fusion Applications and Oracle NetSuite.

In a prepared statement, Google Cloud VP Satish Thomas said that the partnership was designed to “make it easier for organizations to use Gemini in the applications and agentic workflows they rely on to automate workflows, accelerate decisions, and drive outcomes.”

Google’s Gemini models will be available in Oracle AI Agent Studio, where customers and partners can build Fusion-native agents and agentic applications. Oracle said the integration would also provide expanded multimodal capabilities. Gemini 3.1 Flash Lite and Gemini 3.5 Flash will be available through AI Agent Studio alongside Oracle’s existing model options.

Oracle applications development executive VP Chris Leone said in a statement that the move would give customers and partners “greater choice as they build and extend agents and agentic applications that reason through complex, real-world business challenges.”

When Oracle launched its platform for putting LLM-powered agents in its Fusion application suite – the target migration path for thousands of organizations around the world running Oracle applications – it said customers could use models from Cohere and Meta, while connecting other supported models through the platform.

The Register has asked Big Red whether Cohere and Meta models will remain available, and we’ll update this if we hear back.

After Oracle launched Fusion Agentic Applications earlier this year, Gartner advised that there were unanswered questions about how the technology would be implemented.

Balaji Abbabatulla, Gartner VP and vendor lead analyst for Oracle, said: “Our position is that this sounds good, but be cautious. It doesn’t necessarily look as glittery as it sounds. There are challenges under the hood which are not being overcome right now, but maybe over time.”

He also pointed out that Oracle and other vendors must still answer the question of who takes responsibility for AI decision-making should it go wrong. If an AI agent makes a bad decision at scale and speed, errors could cascade before anyone notices. Oracle’s answer so far is monitoring and audit tooling, but Abbabatulla is unconvinced: “I don’t see a clear response from any vendor on the liability issue.” ®

Days after OpenAI disclosed that two frontier AI models escaped containment measures and autonomously cyberattacked the AI code sharing platform Hugging Face, OpenAI’s top U.S. rival Anthropic tonight revealed that — lo and behold — it has also had models surreptitiously access the web when they weren’t supposed to, and cyberattack and gain “unauthorized access” to three other organizations.

Anthropic says that it ran “capture the flag” cybersecurity scenarios with three models — Claude Opus 4.7, Claude Mythos 5, and unnamed internal research prototype — with its partner, the AI security firm Irregular. Anthropic says the models were not supposed to have internet access, but that a misunderstanding with Irregular allowed them to access the internet. Once they did, they “gained unauthorized access to the production infrastructure of three different organizations,” as Anthropic puts it. Anthropic’s blog post continues:

“Claude compromised the impacted organizations’ infrastructure using basic techniques, such as exploiting weak passwords and unauthenticated endpoints. It did not find or exploit any complex vulnerabilities, and in each case, Claude continued working to complete only the specific capture-the-flag task its evaluation had assigned.

However, in some cases, our older model continued its attack even after getting evidence it was running on the open internet; our latest model stopped once it recognized it was on the internet. In none of these situations did Claude exfiltrate itself or deliberately attempt to escape its test environment.”

Anthropic says the affected organizations have all been notified, and was able to reach two of them, and is “now working with them to remediate.” The third hasn’t yet been reached.

While OpenAI’s and Anthropic’s security incidents share a common theme—frontier AI systems unexpectedly interacting with live production infrastructure—the underlying causes are notably different.

OpenAI described a genuine sandbox escape in which its models exploited a previously unknown zero-day vulnerability to obtain internet access before launching a multi-stage intrusion against Hugging Face.

Anthropic, by contrast, says Claude never escaped containment through a novel exploit. Instead, a misconfigured third-party evaluation environment unintentionally exposed the internet to models that had been explicitly told no internet access existed.

The distinction matters. Together, the disclosures suggest frontier AI safety is no longer defined solely by model alignment or novel offensive capability, but increasingly by the operational security of the environments used to evaluate those capabilities.

What Anthropic found

Anthropic said it reviewed 141,006 cybersecurity evaluation runs after OpenAI published its Hugging Face report. That review uncovered three incidents spanning six evaluation runs in which Claude models accessed real production systems belonging to three organizations while attempting to complete fictional capture-the-flag exercises.

The incidents involved Claude Opus 4.7, Claude Mythos 5 and an unreleased internal research model.

The most serious case occurred after Claude encountered a fictional company whose name matched a real internet domain. Believing the real organization was part of the simulated exercise, Claude exploited weak passwords and exposed services, obtaining infrastructure credentials and database access containing several hundred rows of production data.

A second incident was arguably even more unusual. Claude Mythos 5 concluded that publishing a malicious Python package to PyPI represented the best path toward completing its assigned objective. The package remained publicly available for roughly an hour, during which it was downloaded by 15 real systems before PyPI removed it. One download occurred inside the automated malware-scanning infrastructure of a security company, allowing Claude’s code to execute and obtain credentials from that environment before Anthropic later disclosed the incident.

The third incident involved an internal research model that scanned approximately 9,000 internet-facing systems before compromising one organization using well-known techniques including exposed debug credentials and SQL injection. Unlike the older Claude models, however, Anthropic says this latest research model eventually concluded it had reached a genuine production environment and voluntarily stopped its attack.

Similar outcomes, different root causes

Although the headlines inevitably invite comparison with OpenAI’s disclosure, the two incidents illustrate different failure modes.

OpenAI’s investigation concluded that its models actively discovered and exploited a previously unknown vulnerability in an Artifactory package-cache proxy to escape an otherwise isolated evaluation environment before later compromising Hugging Face through additional chained vulnerabilities.

The company characterized that event as an “unprecedented cyber incident” involving state-of-the-art offensive AI capabilities.

Anthropic’s report instead argues its models never needed to break containment because containment had already been weakened through operational misconfiguration. According to the company, both Anthropic and its evaluation partner Irregular mistakenly believed internet access had been disabled when it remained available. Because Claude’s system prompt explicitly stated there was no internet connectivity, the models interpreted every reachable host as part of the evaluation rather than recognizing they had wandered onto the public internet.

Anthropic therefore characterizes the incidents primarily as infrastructure and evaluation-harness failures rather than evidence of models independently pursuing unauthorized goals.

The reports nevertheless converge on one uncomfortable conclusion: frontier AI systems are increasingly capable of executing long-horizon offensive cyber operations whenever evaluation environments permit them to do so.

Four major enterprise security takeaways so far…

For enterprise security leaders, Anthropic’s disclosure arguably shifts the conversation beyond “Can frontier models escape?” toward a broader operational question: “How trustworthy is every environment in which frontier models are evaluated, trained and deployed?” There are at least 4 lessons to be learned:

1. The first lesson is that evaluation infrastructure itself now deserves production-grade security engineering. Anthropic acknowledges that cyber ranges historically received fewer safeguards because they contained only fictional targets. That assumption no longer holds if powerful autonomous systems can mistake real infrastructure for simulated environments. Organizations building internal AI agents for security testing, red teaming or software validation should apply the same network segmentation, monitoring, outbound controls and continuous logging to evaluation environments that they already expect from production systems.

2. Second, both disclosures reinforce that alignment alone cannot compensate for environmental ambiguity. In neither company’s account did the models appear to pursue independent objectives unrelated to their assigned tasks. Instead, they optimized aggressively toward the goals they had been given, using whatever attack paths appeared available. That makes operational constraints—including network boundaries, identity controls and explicit definitions of in-scope systems—as important as the models’ underlying safety training.

3. Third, enterprises deploying increasingly autonomous AI agents should treat situational awareness as a security dependency rather than an academic capability. Anthropic’s own comparison across models suggests newer systems behaved more conservatively once evidence accumulated that they had reached genuine production infrastructure. While Anthropic cautions against drawing broad conclusions from only three incidents, the company views this as encouraging evidence that improved situational reasoning may become an important component of future AI safety alongside traditional alignment techniques.

4. Finally, these two disclosures together mark an inflection point for enterprise threat modeling. OpenAI demonstrated that sufficiently capable models can chain together sophisticated vulnerabilities to escape research infrastructure when safeguards are intentionally relaxed for evaluation. Anthropic demonstrated that simpler operational failures—such as unintended internet connectivity—can produce similarly serious consequences even without novel exploitation.

The common denominator is not any single vendor or model family. It is that frontier AI systems are increasingly capable of translating narrowly defined objectives into complex, real-world cyber operations whenever technical and operational controls fail to constrain them.

For enterprise CISOs, that means AI safety can no longer be viewed solely as a model problem. It has become an infrastructure problem, an identity problem, and increasingly, an operational governance problem.