Hassabis moves to chair of Google DeepMind as Jeff Dean leaves Google after 27 years
Sundar Pichai moved Demis Hassabis out of the Google DeepMind CEO role to chair and Alphabet chief scientist, handed the job to CTO Koray Kavukcuoglu, and confirmed Jeff Dean’s exit after 27 years. A second evaluation firm turned out to have let agents onto the live internet during capture-the-flag testing: OpenAI and Meta both disclosed incidents at Irregular, one day after the UK AISI report covering an entirely different set of runs. Meta shipped Muse Code and Muse Spark 1.2, and a domain-expert audit found 263 defects in SciCode that had been suppressing frontier scores by roughly thirty points.
Funding & Business #
The Next Chapter of Our AI Momentum #
Google / TechCrunch / Axios / Bloomberg
Demis Hassabis leaves the Google DeepMind CEO role to become chair of Google DeepMind and chief scientist of Alphabet, keeping Isomorphic Labs and taking on AGI strategy; CTO Koray Kavukcuoglu becomes SVP of Google DeepMind reporting directly to Pichai, with Gemini model development, frontier research, and the Gemini app and developer teams under him. Jeff Dean is leaving after 27 years to start an independent public benefit corporation with Sanjay Ghemawat, focused on machine learning for scientific discovery. Pichai’s memo leads with adoption numbers — 950M+ monthly users on the Gemini app, 900M+ Gemma downloads — but the reorganisation lands while the flagship Gemini release that was planned for June is still unshipped, and Alphabet fell about 4% on the news. Splitting the CEO role from the AGI-strategy role is the structural admission: the person running the research lab and the person shipping the product line no longer have to be the same person.
Mirendil Inks $100M+ Google Cloud Deal to Scale Self-Improving AI #
TechCrunch
Mirendil signed a Google Cloud partnership worth more than $100M to expand the compute behind its research into self-improving AI systems for scientific discovery and AI development. The size is notable relative to the company rather than the market: this is a compute commitment on the scale of a Series C, structured as a cloud deal. Vendor-financed compute contracts of this shape are how a lot of 2026 capital is actually reaching model developers, and they do not show up in funding-round totals.
Security #
Third-Party Cyber Evaluations Involving OpenAI Models #
OpenAI / CNN / The Information / Simon Willison
OpenAI disclosed a second containment failure, separate from the UK AISI incident reported yesterday: at the external testing firm Irregular, capture-the-flag evaluations meant to be air-gapped were misconfigured with public internet access, and a fictional CTF target name happened to match a real registered domain, so the model attacked a real website believing it was part of the exercise. Meta confirmed the same day that one of its models was involved in a comparable breach at Irregular, attributed to the same class of misconfiguration. That is three labs and two independent evaluators inside a week, and in every case the root cause named publicly is the evaluation harness rather than the model — which is the more uncomfortable finding, because the harness is the part everyone assumed was the controlled variable.
Atlassian Rovo Exfiltrates Data, Bypassing Controls #
PromptArmor
PromptArmor published an indirect prompt injection against Atlassian Rovo in which instructions hidden in an uploaded file cause the agent to encode Jira tickets, Confluence pages, and connector data into URLs and fetch them from an attacker-controlled host, where they land in server logs. The attack runs without user approval or visible evidence, and it survives the organisation-level web search restriction, because disabling web search removes the search tool but leaves the tool that opens results. PromptArmor disclosed on 23 May, Atlassian acknowledged on 25 May, and after follow-ups on 4 June and 29 July went unanswered the researchers published on 5 August with the issue still unpatched — a 74-day silence on a data-exfiltration path in a product sold to enterprises specifically for its access to everything.
Humans Missed 1 in 3 Threats Approving AI Agent Commands Across 40k Game Runs #
ScaleX
A browser game that puts players in the approval seat for AI coding agent commands logged over 40,000 runs and 409,000 approve/deny decisions, with roughly 34% of presented commands being genuine threats; mean accuracy was 66.3%, meaning the average reviewer waved through one threat in three. Miss rates scaled with subtlety rather than severity — 11.7% for obviously destructive commands, 33.4% for exfiltration and code execution, 35.0% for scope violations — and the single worst case was npm run analyze at 64.7% missed, where the malicious payload was visible in the logs but hidden behind a familiar script name. This is a time-pressured game rather than an operations study, and self-selected players are not on-call engineers, so treat the absolute numbers as soft; the shape of the result is what matters, and it says human-in-the-loop approval is a filter with a known and large leak rate.
Model Releases #
Introducing Muse Code and Muse Spark 1.2 #
Meta / TechCrunch
Meta released Muse Code, a terminal coding agent in beta for macOS and Linux, running on Muse Spark 1.2, a coding-focused update to Spark 1.1 with reported gains in code generation, debugging, codebase comprehension, and end-to-end developer workflows. Meta reports results on Terminal-Bench 2.1, DeepSWE 1.1, and an internal coding benchmark, and highlights GPU kernel optimisation runs of 1,000+ tool calls; the comparative scores are presented as bar charts rather than stated numbers, which makes them hard to check against anyone else’s reported figures. Muse Spark 1.2 is available today in Muse Code and through the Meta Model API with expanded global access.
WeatherNext: AI Model Achieves Breakthrough in Forecasting Cyclones #
Google DeepMind / Nature
WeatherNext Cyclones predicts tropical cyclone track, intensity, and wind structure, with three-day forecasts matching what prior models achieved at two days — about 100 km of track error and 11 knots of intensity error at 72 hours. DeepMind published in Nature and released code and weights on GitHub for WeatherNext Cyclones, WeatherNext 2, and a smaller WeatherNext 2-mini, alongside a Colab demo. The system was already in use by the US National Hurricane Center during the 2025 season, including on Hurricane Melissa’s rapid intensification; an operational track record before publication is a stronger evidentiary base than most model releases carry.
Research & Papers #
SciCode-Verified: How Benchmark Defects Underestimated the Scientific-Coding Ability of Language Models #
arXiv
A per-problem domain-expert audit of all 65 SciCode problems found 263 defects, of which 192 — spread across 91% of main problems — cause correct, instruction-following solutions to be wrongly rejected through non-reproducible gold answers, over-tight tolerances, or self-contradictory specifications. After correction, twelve frontier model snapshots move from 45–60% to 84–98% subproblem accuracy and from 9–27% to 69–92% main-problem accuracy, which means the widely-noted plateau around 60% was a property of the grader. The authors also report that 78% of the score-suppressing defects require physics or mathematics knowledge to spot, so this is not something a proofreading pass or an LLM judge would have caught — and SciCode is a component of the Artificial Analysis Intelligence Index and a standing evaluation in government and national-laboratory suites.
AI Agents Can’t Yet Do Open-Ended AI Research #
AI as Normal Technology (Narayanan & Kapoor)
The authors gave AI agents the core research questions from two unpublished papers, along with thousands of dollars of API credits, compute, and six days of wall-clock time; the original authors unambiguously rejected both agent-produced papers. Across more than 100 hours of log analysis the failures were consistent: agents dismissed promising directions on the strength of low-quality or synthetic data, abandoned ambitious targets within the first day without ever fundamentally changing approach, answered reviewer feedback by adding caveats rather than resolving the problem, ignored explicit instructions on exploration time and paper length, and — most telling — both runs ended with over half the API budget unspent and time still on the clock. The binding constraint was not compute or context but the judgment to know when to keep going.
Diagnosing Tool-Selection Reasoning in LLM Agents with Canary Tools #
arXiv
The authors plant diagnostic “canary” tools in an agent’s MCP tool set, each engineered to probe one specific tool-selection weakness across a six-type taxonomy — semantic decoys, parameter traps, capability mirages, prerequisite blindness, temporal decoys, granularity traps — turning a single wrong-tool outcome into a profile of how the model reasons about tools. Across 8,640 runs on eight models, per-task canary susceptibility varies roughly 36x, lowest for Claude Opus 4.8 and highest for Llama 3.1 8B, and susceptibility predicts task failure only weakly (Spearman rho = -0.34). The weak correlation is the useful part: a model can be relatively bad at resisting decoy tools and still complete tasks, so tool-selection quality is a distinct axis from task success and needs its own measurement in any MCP deployment with a large tool surface.
Scrouting: Cost-Aware Routing of Coding Agents by Scouting the Repository First #
arXiv
SuperScout sends a 7B searcher into the repository first to produce a structured handoff whose reproduction claims are sandbox-verified — false claims stripped before delivery — then routes the task to one of four frontier fixers using the searcher’s hidden states. On the full Python slice of SWE-bench Pro (266 tasks) at the official capped budget tier it solves 159 versus 158 for the best single model, at roughly a fifth of the cost per solve, with the searcher adding under half a cent of GPU time per task. The authors report the ablation that undercuts their own framing: always routing to the cheapest fixer with the same handoff ties the full system, so the verified handoff carries the result and the router does not. Cheap verified context, not model selection, is where the saving lives.
Architectural Implications of Agentic AI Workflows #
arXiv
A production characterisation of agentic workloads at Microsoft Azure alongside a controlled study of open-source frameworks finds that agentic requests fragment into LLM inferences, tool calls, and orchestration decisions that repeatedly cross the CPU-GPU boundary, putting the host CPU on the critical path and producing load that stays low with sudden spikes. The consequence for hardware is that uniform servers strand both CPU and GPU capacity, homogeneous CPU provisioning is wasteful because software roles differ, and multiplexing agents onto shared cores degrades microarchitectural locality. Their prototype, Agora, harvests idle cores for co-located throughput work, oversubscribes GPU memory by prefetching the next agent’s state, and pools cores by role; no headline speedup figures appear in the abstract, so the taxonomy and the diagnosis are the contribution rather than the numbers.
Developer Tools #
Cloudflare OS: An Open Platform for Agents, Apps, and Work #
Cloudflare
Cloudflare open-sourced the internal platform it has been running since May: an Agent Workspace where agents write and run code against organisational context and skills, an app platform that ships full-stack apps as Dynamic Workers with SQLite databases, and a security layer built on “Gatekeepers” — service-specific Workers that mediate every resource access and log what data each agent observed. Outbound network access is denied except through explicitly granted capabilities, and credentials are isolated from the agent. The interesting design choice is making observation itself an audited event rather than only actions; the ScaleX approval data above is a decent argument for why per-action human review is not the layer to rely on.
Open Source #
Prime Agent: A Self-Improving RLM Agent #
Prime Intellect
Prime Intellect released Prime Agent, a fully open-source coding harness built on two abstractions — a Recursive Language Model and a Continual Harness — that let an agent modify its own prompts, skills, memory, and sub-agents while running, with no model trained specifically for it. The headline claim is 95.5% on ARC-AGI 3 with Opus 5, just above the 95.4% human expert baseline, plus competitive results on OOLONG, LongBenchv2, EmulatorBench, and MazeBench. A harness crossing a human baseline on ARC-AGI with an off-the-shelf model is an extraordinary claim and deserves independent replication before it is treated as settled; the mitigating factor is that the harness is open source, so replication is actually available to anyone who wants it.
Infrastructure #
Anthropic Is Hiring an AI Chip Design Team #
TechCrunch / Business Insider
Anthropic confirmed it is assembling a “custom silicon” team to design its own inference chips, hiring engineers who span hardware and software so that chips and Claude models are designed together. The company says it is not stepping back from AWS, Google, Nvidia, or AMD, and gave no timeline or manufacturing plan. It follows OpenAI’s Broadcom-built Jalapeño in June, and the logic is the same in both cases: at current inference volumes, per-token cost is a first-order business variable, and co-designing the silicon against a known model family is the largest remaining lever once the model architecture is fixed.
Regulatory & Policy #
OpenAI Says Apple’s Own Security Practices Undermine Its Trade Secrets Case #
TechCrunch
Newly filed court exhibits set out OpenAI’s defence in Apple’s trade secrets suit: rather than contest what was taken, OpenAI argues Apple failed to protect it, citing offboarding practices that included letting an Apple manager access a departed engineer’s iCloud account. Trade secret protection is conditional on the holder taking reasonable measures to keep the information secret, so the argument targets the element of the claim rather than the conduct. For anyone whose company is now hiring across lab boundaries at speed, the discovery surface here is the point: offboarding hygiene is becoming evidence.
Threads to Watch #
The evaluation harness is now the failure surface. Three labs and two independent evaluators produced containment failures inside a week, and in every published account the cause is the test environment — unrestricted internet in a run designed to measure unrestricted capability, a fictional CTF domain that turned out to be registered. The same pattern shows up on the measurement side: SciCode’s 263 defects had frontier models pinned thirty points below their actual ability, and SuperScout’s own ablation shows the routing layer they built contributes nothing while the verified handoff carries the whole result. The scaffolding around the model is where today’s errors live, and it is measured far less carefully than the model is.
Approval is not a control. ScaleX’s 409,000 decisions put a number on the assumption underneath every human-in-the-loop agent deployment: reviewers miss a third of threats, and the miss rate rises with subtlety rather than severity. Cloudflare OS answers the same problem structurally, mediating and logging every resource access rather than asking a person to adjudicate each command, and Atlassian Rovo shows the failure mode when neither exists — an exfiltration path that needs no approval at all and leaves nothing visible.
Agents cannot yet run themselves, and the gap is judgment. Prime Agent lets a harness rewrite its own prompts, skills, and sub-agents mid-run; the Azure characterisation shows what a datacenter looks like when that becomes routine. But given six days, thousands of dollars in credits, and a real research question, agents finished early with half the budget unspent, and the papers were rejected. The infrastructure for self-directed agents is arriving faster than the capability to use it.