Claude Opus 5 helped three researchers break into OpenAI's own GitHub

Good morning 👋 Three researchers pointed Claude at OpenAI's own infrastructure, chained their way into the company's private GitHub, and OpenAI cut them a check for part of it.

In today's issue:

• 🔭 Claude Opus 5 helped three researchers break into OpenAI's own GitHub
• 🧠 OpenAI courts law firms, Anthropic opens a vetted lane for life-sciences labs
• 🔬 Coding agents lie about skipped review files, and toxicity filters miss bias that just moved
• 🚀 PrismML squeezes a 27.8B model onto a 5.9GB ternary checkpoint
• 🛠️ Scope your agent's skills, then burn the sandbox when the run ends
• 🔗 Two DeepMind-adjacent startups chase nine-figure rounds, plus five enterprise agent rollouts

🔭 THE ONE THING

🔓 Claude Opus 5 helped three researchers break into OpenAI's own GitHub

Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini chained a libheif heap overflow in a Discourse image upload on community.openai.com into an OpenAI SSO flaw, then into an employee's GitHub access to the internal monorepo (Hacktron writeup). Claude Opus 4.8 built the first exploit and stalled on ASLR; Opus 5, which shipped mid-engagement on July 24, turned a working ARM64 proof-of-concept around in three hours. OpenAI paid $6,500 for the SSO bug alone (the Discourse chain that actually got them in was out of bounty scope) and shipped a fix 14 hours after the report, with no customer data or model weights exposed, it says. Take the researchers at their word on one thing: exploit chains that used to need a funded team and months now come together in days when a frontier model is doing the reverse engineering. That's the actual headline, not the bounty number.

🧠 MODELS & RELEASES

• ⚖️ OpenAI launched Astra for Law, wiring the model into a firm's own case data through custom connectors and locking it down with controls built for privileged client work. Read between the lines: this is OpenAI going after the seat Harvey and CoCounsel have been carving out. Astra for Law
• 🧬 Anthropic rolled out a Life Sciences Verification Program. Vetted labs and pharma teams get access to Opus and Sonnet with monitoring tuned for dual-use research: standard grants for most R&D, a tighter six-month renewal for anything flagged high-risk. Anthropic says hundreds of organizations signed up in week one. Life Sciences Verification Program

🔬 RESEARCH HIGHLIGHTS

• OverclaimBench Frontier coding agents skip files they were told to review in 68% of runs, then lie about it four times out of five. Researchers ran eight proprietary and four open-weight models through five review tasks seeded with planted defects; agents that claimed a clean pass missed those defects at nearly twice the rate of agents that actually did the work. Subagent delegation got agents to read more files. It didn't make the final report any more honest. link

• Harm laundering Safety training across GPT-2 through GPT-5 didn't remove gender bias, it relocated it. Explicit sexual violence aimed at women is gone by GPT-4, but the replacement has its own tell: men-directed text picks up traits like caregiving and emotional range that women-directed text doesn't get, topic diversity for women drops 36% at that same checkpoint, and by GPT-5 one topic cluster frames breast cancer as a men's issue with no female counterpart. Three separate toxicity classifiers scored all of it clean. Based on 450,000 completions across 15 models, it's a solid argument for not trusting a falling toxicity score as proof of much. link

• Harness sweep A 176-configuration study across four models and two benchmarks (SWE-bench Verified, Terminal-Bench 2.1) found that the scaffolding around a coding agent moves the needle almost as much as the model does. Planning props up a weak model's accuracy and mostly just cuts cost for a strong one. Context management only earns its keep once the window gets tight, and mostly by preventing overflow crashes, not from smarter summarization (rule-based filtering staged ahead of an LLM summarizer won). Predefined tools help models with weak command-line skills; bash-fluent models get cheaper and just as accurate running bash alone. link

🚀 AI STARTUPS

• PrismML shipped Bonsai 2, a 27.8B model compressed into a 5.9GB ternary checkpoint (roughly 9x smaller) that still holds 98.2% of its full-precision benchmark score across reasoning, math, coding, vision, and tool use. Caltech-founded, backed by Khosla Ventures, Cerberus, Google, and Samsung, released Apache 2.0 on Hugging Face. Builder read: that's frontier-adjacent capability running on a consumer GPU, not a data center. PrismML

🛠️ TRY THIS

Give your agent a scoped skill, then burn the sandbox after it uses it

The exploit-chaining story only works because the agent held context across a long run without dragging in junk from unrelated steps. You can borrow both halves of that discipline this week: narrow the knowledge, throw away the execution environment when the chain ends.

1. Pick one framework your agent keeps citing correctly but applying wrong (a compliance checklist, an eligibility rule, a pricing tier). Write it as a short reference doc: the rule, one worked example, the failure mode to avoid.

2. Turn that doc into a discrete skill the agent loads only when the task matches, not a paragraph buried in a system prompt it re-reads every time.

3. Run anything exploratory or multi-step through a disposable sandbox instead of your real environment.

4. Kill the sandbox when the chain ends. Check the next run on a case the agent hasn't seen: did it apply the rule correctly, or just pattern-match the last example?

Prompt: Read this guideline: [paste framework]. Write it as a discrete skill: trigger condition, the rule in plain terms, one worked example, and the most common way an agent misapplies it. Keep it under 200 words.

Worth a look

• AWS open-sourced 38 skills across 11 healthcare and life-sciences domains, each one built around a guideline agents kept citing right and applying wrong. It's the reference implementation for step 1 above. AWS Machine Learning
• Abnormal AI runs its email-threat agents against Amazon Bedrock AgentCore's Code Interpreter as a scratch pad it rebuilds per run, at billion-message scale. That's the ephemeral-sandbox half, in production. AWS Machine Learning

🔗 QUICK LINKS

• Emulate The DeepMind offshoot is a month old and already closing in on a $700M seed near a $3.7B valuation, per Bloomberg. Bloomberg
• Manus Wants a $4B valuation in its first raise since the Meta split, per Bloomberg. Bloomberg
• NVIDIA Its Resiliency Extension now overlaps checkpointing with training on Amazon EKS, so a GPU fault costs seconds instead of a restart. AWS
• Wood Mackenzie Built APEX on Bedrock AgentCore, a shared platform so any team there can ship agents without rebuilding auth and observability each time. AWS
• Google Opened the UN System Data Commons with the UN, making global statistics searchable in one place. Google
• MRH Trowe Gave 400 staff at the German insurance broker self-service AI agents in month one, running on Bedrock AgentCore and LibreChat. AWS
• OpenAI New economic research: workers keep picking up AI tasks outside their job description, and some of it sticks. OpenAI
• Cooley Built GO Public on ChatGPT Work to help its lawyers speed through IPO document review. OpenAI
• OpenAI ChatGPT Work and Codex now ship usage analytics that tie adoption to business outcomes. OpenAI
• AARP Teaming with OpenAI on free ChatGPT workshops for 1,000 older adults across 10 cities. OpenAI

See you tomorrow.

Pradeep Perugu