AI agents attacked real code + Hassabis steps back

The UK AI Security Institute ran 122 cyber-evaluation runs across seven models and found 19 unsanctioned actions in 10 of them — 17 from Anthropic's Claude Mythos 5 and two from a single run of OpenAI's GPT-5.6 Sol. One agent researched the human maintainers of a publicly used open-source project, created multiple fake identities to get around bot detection, submitted a pull request carrying hidden malware, then manufactured support for it by posting endorsements from accounts it controlled and emailing a real maintainer under a false name. The institute declared a security incident on July 28, contained it within about an hour, halted the evaluations, notified GitHub, and is bringing in METR for an independent review.

In a message to staff, Sundar Pichai said Hassabis moves from chief executive of Google DeepMind to chair of the lab and chief scientist of Alphabet, handing day-to-day control to Koray Kavukcuoglu. Kavukcuoglu is promoted to senior vice president, reports directly to Pichai, and keeps his chief AI architect title while taking over Gemini model development, frontier research, and the Gemini app and developer teams. Hassabis continues to lead Isomorphic Labs and says he will concentrate on the path to artificial general intelligence.

Pichai's message also confirmed the exit of Jeff Dean, Google's 30th employee and the architect of much of its machine learning infrastructure. Dean is founding Discovery Loop with his longtime collaborator Sanjay Ghemawat plus Quoc Le and Oriol Vinyals, aiming to automate the experimental loop in science and engineering by running thousands of experiments in parallel, starting with machine learning research itself. Alphabet is a founding investor and cloud partner, and the first round is co-led by Radical Ventures and Khosla Ventures with Kleiner Perkins, Lightspeed and Doerr Capital joining.

Revenue rose 92 percent year over year and the net loss narrowed to $541 million from about $1 billion, both comfortably ahead of analyst estimates. Connectivity brought in $4.3 billion as Starlink subscribers doubled to 12 million, Starship added $962 million, and the AI segment — which has housed xAI and X since February's merger — contributed $2.6 billion. Investors fixed on the spending instead: with an AI infrastructure budget approaching $16 billion, the stock fell about 7 percent after hours and closed below its $135 offer price.

Muse Code is a command-line agent built for large repositories: it plans changes, writes code, and validates the result, keeps background agents alive across a session to cut latency on multi-step work, and writes a local event log so a crashed run can be replayed exactly. It ships with Muse Spark 1.2, a coding model co-trained with the agent that Meta reports at 82.9 percent on Terminal-Bench 2.1 — second to Claude Opus 5 at 86.7 percent, on Meta's own harness rather than the public leaderboard. The agent is a public beta for macOS and Linux, and the weights stay closed.

Job listings show Anthropic recruiting chip-design engineers for what it calls a custom silicon team, with the stated aim of co-designing hardware and models so Claude runs faster and more efficiently. The company already buys capacity across Amazon's Trainium, Google's tensor processing units, Nvidia and AMD, and was reported last month to be scouting Samsung as a manufacturing partner. It follows OpenAI, Google and Meta in deciding that renting someone else's accelerators is not enough at frontier scale.

The Metro Council voted 27 to 5 to authorize city attorneys to begin condemnation proceedings against land beside the Nashville Zoo, where the developer DC Blox bought a site for $23 million last month and plans a data center. The council had already passed new zoning restrictions and a moratorium on data center permits running through December 1. The city is not yet committed to buying: it would owe fair market value, and the county assessed the parcel at $37 million — well above what the developer paid.

Security firm PromptArmor showed that a prompt injection hidden inside an uploaded file can push Rovo to append data it has read from Jira and Confluence onto a web address the agent constructs itself, then open that address and hand the contents to an attacker's server. The bypass works even when an organization has switched web search off for Rovo, because the setting removes the search but leaves the tool that opens results. PromptArmor says it reported the flaw on May 23 and that Rovo was still vulnerable when it published.