In this newsletter:

• Now we have a timeline of the OpenAI accidental attack against Hugging Face

• One-shotting a Raccoon Heist game using Claude Fable 5

• New release of LLM adds support for reasoning traces, OpenAI Responses, server-side tools, and smarter logging

Plus 10 links, 3 quotations, 2 notes, 6 releases, 1 tool, and 1 comment

Sponsor message: When agents enter the SDLC, observability becomes the enabler to move from code generation to scalable engineering. Dynatrace’s engineering blog outlines a framework from prompting to tools that verifies AI output against reality and feeds these observations back for guided iteration. Read the blog to get started (opens in new tab).

Now we have a timeline of the OpenAI accidental attack against Hugging Face (opens in new tab) - 2026-08-07

OpenAI gave a last-minute presentation at the Black Hat security on Wednesday about “the Hugging Face Incident” (previously (opens in new tab) on this blog). The video (opens in new tab) was published yesterday. It’s short and information dense and well worth watching, in particular because it provides full details of what happened and how things played out inside OpenAI. I’ve used the video to construct the timeline below.

Here’s the timeline. My favourite detail is at the end: OpenAI found out that they were responsible for the attack on Hugging Face when they reached out to ask to have their credentials revoked (after their internal investigation) and learned that they had been revoked already since they were used in that attack!

• May 7: OpenAI starts a new training run for an experimental, unreleased model. (Do they mean an evaluation run? They say training run in the video, and later mention a “reward signal to judge how well they’re doing”, so I guess this really was about training a model, not evaluating one that was already trained.)

• May 8: An agent is accidentally given an impossible task involving a Google Drive link despite no internet access). It tries attacking the Artifactory packaging service, fails, but discovers it can write files into Artifactory.

• A few days later: A different agent gets stuck on a task because a key file was accidentally omitted. It tries to “reach out to another agent” by writing a note into Artifactory asking if anyone has the file.

• Following days: More agents discover this new informal message board while browsing Artifactory’s file listings, and start reading and writing messages.

• May 26: Agents successfully execute an SSRF attack on Artifactory for the first time, gaining indirect internet access by having Artifactory fetch external content for them.

• June 11: OpenAI start evaluating a new “highly persistent” experimental model. It has access to Artifactory and can benefit from the messages left by privous models.

• June 26: Agents find and exploit a zero-day RCE on Artifactory (via a legacy token-refresh endpoint flaw). They use an administrative token to install a Groovy plugin that lets them execute commands.

• July 4: The resulting agent activity overloads Artifactory and causes an outage. OpenAI revokes the compromised credentials, deletes the messages, patches the zero-day, and reports the vulnerability to the vendor.

• July 8: Agents find a new way to communicate via an unauthenticated WebDAV endpoint, using directory names in Artifactory’s remote cache.

• July 8–19: Attacks on OpenAI’s own infrastructure. The agents found an “external organization credential” in a public archive of leaked Pastebin posts, then validated that credential and shared its location on the messageboard. They then used write access to this “Organization 1” to stage data used in subsequent attacks on OpenAI infrastructure. They compromised Artifactory for a second time with a new zero-day. The agent uploaded a malicious Ruby target to Organization 1’s staging repository, then requested that package through Artifactory in a way that caused it to be treated as Ruby dependency for the repository. Then they exploited a JRuby deserilaization time-of-check/time-of-use bug to get remote code execution against Artifactory.

I’ll quote the next bit in full (opens in new tab) because wow:

The agents have remote code execution in Artifactory, which is running in a container-as-a-service environment. The agents privilege-escalate locally by exploring their local environment and determining that the Linux kernel version of the machine they are running on had a very recent CVE. They download the exploit for the CVE, customize it to succeed on the machine, and privilege-escalate to root on the local machine using this known Linux kernel privilege escalation CVE — in this case, PTE fizzroot. Once they have root on a single machine, agents rapidly escalate privileges and move laterally throughout the container-as-a-service infrastructure environment. In particular, agents are using the message board consistently to share credentials, techniques, and progress, and they’re able to effectively leverage their concurrency and parallelism to move quite rapidly. They obtain IAM credentials via IMDS. They exploit Kubernetes service account misconfigurations, in particular over-permissioning of specific service accounts, and they harvest cluster credentials, including Azure Key Vault. Agents eventually obtain cluster admin on the cluster and associated credentials.

Hugging Face told the next bit of the story (opens in new tab) already. The agents found a Modal-hosted insecure app with a weak API key, then used that to stage an attack against Hugging Face. They chained together a an HDF5 arbitrary-file-read bug (to explore files and steal credentials) and a Jinja template-injection RCE to go from single-pod code execution to cluster admin across multiple Hugging Face clusters in under 13 hours.

• July 16: Hugging Face disclosed they had detected an attack (opens in new tab) from autonomus AI agents. OpenAI contacted Hugging Face to ask if they were affected by it!

• July 19: OpenAI identified the attack against Artifactory and started investigating the internal privilege escalation, and linked that to the cyber-gym escalations. They started revoking affected credentials.

• July 20: OpenAI reached out to Hugging Face for help to revoke the Hugging Face credentials they found in their investigation. Hugging Face told them they were already revoked… and that’s when OpenAI realized that the Hugging Face breach was the same incident!

One-shotting a Raccoon Heist game using Claude Fable 5 (opens in new tab) - 2026-08-05

Back in 2022 I tweeted (opens in new tab) screenshots of a game concept generated by GPT-3 and some concept “art” created using DALL-E. Today, on the fourth anniversary of that tweet, I decided to see if Claude Fable 5 (running in Claude Code for web (opens in new tab)) could build the entire game from the content of that tweet. It did a pretty good job of it!

You can play the game here (opens in new tab). Here’s the GitHub repo (opens in new tab), and a short video demo:

How I built this

This is the August 5th, 2022 tweet (opens in new tab):

My GPT-3 prompt back then was:

Write a detailed product description of a computer game where a team of raccoons go on heists.

This was in the text completion days, where you asked GPT-3 to complete the rest of the text. It completed:

In “Raccoon Heist”, you and your team of thieving raccoons are tasked with pulling off a series of daring heists. From robbing banks to stealing priceless art, no job is too big or too small for your furry crew. You’ll need to use your wits and your skills to avoid the police and make a clean getaway with the loot. With exciting gameplay and a charming cast of characters, “Raccoon Heist” is the perfect game for anyone looking for a light-hearted caper.

My prompt to DALL-E was short:

Screenshot from a video game where a team of raccoons go on a heist

Today’s experiment: can I dump those screenshots into Fable 5 with a prompt telling it to write a game, then leave it to its own devices and get a working game at the end?

Setting Claude Code for web up to use GitHub Pages

A frustrating thing about Claude Code for web is that it can be hard to test what it’s working on while it’s still working.

I’ve been using GitHub Pages to work around that limitation, and found it to work really well.

Here’s my process:

1. Create a new repository for the project at https://github.com/new (opens in new tab) - this can be public or private, the trick works equally well for both.

2. Start a Claude Code for web session, in the Claude iPhone or Desktop apps or in the browser at https://claude.ai/code (opens in new tab)

3. Tell Claude what to work on, and encourage it to commit an index.html page as quickly as possible. This will create a branch with a name like claude/3d-raccoon-heist-game-50n293

4. Navigate to the Settings -> Pages area for the repository (github.com/simonw/raccoon-heist/settings/pages in my case), select “Deploy from a branch”, pick the branch name, and hit Save.

That’s all it takes! Within about 30 seconds of each push the latest content will be visible at yourname.github.io/your-repo/.

If you do this with a private repo, anyone who can guess the name of the repo will be able to view the published content. I don’t worry much about this myself.

The Fable 5 prompt

Here’s the prompt I gave Fable 5 (written in the notes app on my phone - this entire project was conducted on mobile). I accompanied it with the two images from the original tweet.

I didn’t make any technology choices. I assumed (correctly) that it would probably use Three.js (opens in new tab) based on previous experiments.

Giving Claude access to an OpenAI key turns out to work really well for filling in gaps in its capabilities - in this case we needed some way to generate images to use as textures. Fable is very good at prompting image generators!

I said “Work independently - do not ask me to make any further design decisions” because I wanted to see if it could produce a full, working game without any further input from me.

I also said “Commit and push as often as possible so I can preview your work”. When you use Claude Code in the Claude iPhone app you give it a GitHub repository and it works in a branch. Telling it to “push as often as possible” means commits start landing in that branch straight away.

I like asking for notes.md as a bit of added flavor - here’s that finished file (opens in new tab), and the entry it made when it added the dog:

New escalation: from night 3 the yards get a patrolling guard dog — a low-poly brown hound with a spiked red collar and a wagging tail. It wanders between random spots, and within 12 units it catches your scent and tracks you by smell (line of sight is irrelevant — it’s all nose, shown by a 👃 over its head and barking). It gives up if you open a 17-unit gap. Getting caught messages are now source-specific: guard / headlights / hound. Verified wander → track → caught with an automated test.

Reviewing the transcript

You can access the Claude Code shared session (opens in new tab), and I also used my claude-code-transcripts (opens in new tab) tool to export my own HTML version which you can find here (opens in new tab).

Fable started with an index page, vendored a copy (opens in new tab) of Three.js, then wrote its own gen_textures.py script (opens in new tab) (copy here (opens in new tab)).

It generated the textures and spot-checked them (opens in new tab) to make sure they looked OK. The metal.jpg file (opens in new tab) it generated for the trash can looks like this, though I don’t think it was applied exactly right in the game itself:

Then it built out the first basic version of the game, then decided to (opens in new tab) “smoke-test in the pre-installed Chromium” using Playwright. This meant it could take screenshots of its own work and eyeball them (opens in new tab). It did that for both desktop and mobile widths of the page, then noticed that the raccoon was invisible (opens in new tab) at mobile widths, so it fixed that (opens in new tab):

The raccoon, dumpster hideout, and both crew raccoons are now perfectly visible on mobile. Committing this critical fix.

It decided to generate a title screen, which it did (opens in new tab) using this gen_title.py (opens in new tab) script. Here’s the gpt-image-2 prompt it used for that:

Video game key art, low-poly 3D render style, moody nighttime scene: a cute low-poly raccoon wearing a tiny black burglar mask sneaking on its hind legs carrying a glowing gold coin, next to a tipped-over metal trash can, suburban house with warm glowing windows in the background, deep blue night, full moon, fireflies, cinematic rim lighting, charming heist caper mood. No text, no words, no logos.

And the resulting image (which Claude thought was “gorgeous” (opens in new tab)) - though I note that when it’s shown on desktop it gets cropped to just the top third without the raccoon!

Then my favorite change: it added the dog (opens in new tab):

export function makeDog() {
  const g = new THREE.Group();
  const BROWN = 0x8a6440, DARK = 0x5e4128;
  const body = new THREE.Mesh(new THREE.SphereGeometry(0.42, 10, 8), M(BROWN));
  body.scale.set(0.9, 0.8, 1.5);
  body.position.y = 0.55;
  body.castShadow = true;
  g.add(body);
  const head = new THREE.Mesh(new THREE.SphereGeometry(0.3, 10, 8), M(BROWN));
  head.position.set(0, 0.85, 0.62);
  g.add(head);
  const snout = new THREE.Mesh(new THREE.SphereGeometry(0.16, 8, 6), M(DARK));
  snout.scale.set(0.9, 0.7, 1.3);
  snout.position.set(0, 0.76, 0.9);
  g.add(snout);
  const nose = new THREE.Mesh(new THREE.SphereGeometry(0.06, 6, 6), M(BLACK));
  nose.position.set(0, 0.78, 1.08);
  g.add(nose);
  for (const s of [-1, 1]) {
    const ear = new THREE.Mesh(new THREE.SphereGeometry(0.12, 6, 6), M(DARK));
    ear.scale.set(0.7, 1.3, 0.5);
    ear.position.set(0.2 * s, 1.08, 0.55);
    g.add(ear);
    const eye = new THREE.Mesh(new THREE.SphereGeometry(0.05, 6, 6), M(0x1a1a1a, { emissive: 0x331111 }));
    eye.position.set(0.13 * s, 0.92, 0.86);
    g.add(eye);
  }
  const tail = new THREE.Mesh(new THREE.CylinderGeometry(0.05, 0.09, 0.5, 6), M(DARK));
  tail.position.set(0, 0.8, -0.62);
  tail.rotation.x = 0.8;
  g.add(tail);
  // spiked collar
  const collar = new THREE.Mesh(new THREE.TorusGeometry(0.22, 0.05, 6, 12), M(0xc0392b));
  collar.position.set(0, 0.78, 0.5);
  collar.rotation.x = Math.PI / 2.4;
  g.add(collar);
  const legGeo = new THREE.CylinderGeometry(0.07, 0.09, 0.34, 6);
  const legs = [];
  for (const [x, z] of [[-0.22, 0.35], [0.22, 0.35], [-0.22, -0.35], [0.22, -0.35]]) {
    const leg = new THREE.Mesh(legGeo, M(DARK));
    leg.position.set(x, 0.17, z);
    g.add(leg);
    legs.push(leg);
  }
  let phase = Math.random() * 10;
  return {
    group: g,
    animate(dt, speed) {
      phase += dt * (3 + speed * 10);
      const amp = Math.min(0.6, 0.1 + speed * 0.6);
      legs[0].rotation.x = Math.sin(phase) * amp;
      legs[3].rotation.x = Math.sin(phase) * amp;
      legs[1].rotation.x = -Math.sin(phase) * amp;
      legs[2].rotation.x = -Math.sin(phase) * amp;
      tail.rotation.z = Math.sin(phase * 1.5) * 0.4;
      body.position.y = 0.55 + Math.abs(Math.sin(phase)) * 0.04 * (0.3 + speed);
    },
  };
}

And did a round of testing on it (opens in new tab) using Playwright, including another screenshot (opens in new tab).

  // walk near the dog
  await page.evaluate(() => { const d = window.__rh.dog; window.__rh.teleport(d.x + 6, d.z); });
  await page.waitForTimeout(2000);
  info = await page.evaluate(() => JSON.stringify({ dog: window.__rh.dog, state: window.__rh.state, player: window.__rh.debug().player }));
  console.log(’after approach:’, info);
  await page.waitForTimeout(3000);
  info = await page.evaluate(() => JSON.stringify({ dog: window.__rh.dog, state: window.__rh.state }));
  console.log(’after chase:’, info);
  await page.screenshot({ path: __dirname + ‘/shot-dog.png’ });

It made a few more tweaks, then declared itself done (opens in new tab):

Is the game any good?

It’s an impressive starting point, but it’s not a good game.

You move your raccoon around a yard collecting items - donuts, fish, gold coins, jewels - while avoiding guards with flashlights and, in later levels, a dog. You have a limited carrying capacity, and once that’s full you need to drop stuff off at the dumpster. If you pick up a pizza slice you get a temporary speed boost.

There are no team mechanics at all - there are two other static raccoons next to the dumpster but they’re purely decoration.

It gets slightly more challenging as the levels progress - the dog introduced in level 3 is the most interesting new mechanic - but it’s very, very easy to beat. It’s also pretty boring - each night has a fixed duration and you can collect all of the items and then have nothing else to do while waiting for the dawn.

I was impressed by the implementation. It’s fully 3D, there are trash cans, the flashlight illumination cones are fun, and it has a reasonably coherent visual style. It works on mobile. The music (”a procedural WebAudio soundtrack (sneaky walking-bass jazz plus all sound effects — zero audio files)” according to Claude) is simple but feels about right.

As a finished game project, it’s mediocre. As a starting point from a single prompt I think it’s very impressive.

I’ve vibe coded up quite a few games now. They’ve all been deeply disappointing from a gameplay perspective - it turns out designing games that are fun remains a uniquely human trait, and one which requires significantly more skill and experience than either Claude or I can bring to bear.

That said, I thoroughly recommend tinkering with game development projects as a way to explore the capabilities of agents. It’s a fun, low-risk way to try out new things. If you stick at it long enough you might even produce something that’s worth playing!

Update 7th August 2026: I posed the same prompt to OpenAI Codex Desktop running GPT-5.6 Sol Ultra and got a significantly better result (opens in new tab) - GPT-5.6 Sol picked up on the importance of the squad of raccoons going on a heist, and built a game where you must rescue your two crewmates in a museum and then stack on top of them to steal the Golden Sardine.

New release of LLM adds support for reasoning traces, OpenAI Responses, server-side tools, and smarter logging (opens in new tab) - 2026-08-04

I released LLM 0.32 (opens in new tab) this morning, the most significant new version of LLM since the initial launch of the project. The new version includes support for visible reasoning traces, server-side provider tools, redesigned content-addressable SQLite logs, new models, and new features enabled by the OpenAI Responses API. I also released a new version of the llm-anthropic plugin (opens in new tab) with substantial updates of its own.

Headline features for LLM CLI users

Running LLM against reasoning models now displays their reasoning traces to standard error, so you can see what they are “thinking” without that information being included in the standard output that you might pipe to another tool. Add -R/--hide-reasoning to turn this off.

LLM includes support out-of-the-box for the GPT-5.6 model family, and the new default model used with llm "prompt" is now the inexpensive but capable GPT-5.6 Luna.

LLM calls can now use server-side tools from various providers. OpenAI provide a code execution environment (opens in new tab) as a server-side tool; LLM can now run prompts that benefit from that like so:

llm --tool CodeInterpreter ‘Show current python and SQLite versions’

OpenAI also gets a WebSearch (opens in new tab) tool.

The llm-anthropic (opens in new tab) plugin adds WebSearch (opens in new tab), WebFetch (opens in new tab), CodeExecution (opens in new tab), and AnthropicMCP (opens in new tab), which looks like this:

llm -m claude-sonnet-5 -T ‘AnthropicMCP(”https://datasette.simonwillison.net/-/mcp”)’ 

  ‘how many rows in the blog_blogmark table?’

That causes Anthropic to execute MCP calls against my new datasette-mcp (opens in new tab) plugin as part of a single request/response interaction with their API.

The new llm openai endpoint command provides a tool for executing prompts against (opens in new tab) any (opens in new tab) OpenAI compatible endpoint (opens in new tab) as a one-liner. These aren’t logged, which makes this a handy tool for running one-off prompts against anything that speaks the lingua franca of the LLM API world.

Here’s how I use that to run prompts against Gemma 4 12B running in my localhost LM Studio (opens in new tab) API, via uvx (no LLM installation required) and mixing in the llm-tools-quickjs (opens in new tab) tool plugin for good measure:

uvx --with llm-tools-quickjs 

  llm openai endpoint http://localhost:1234/v1 -m google/gemma-4-12b 

  -T QuickJS ‘Use QuickJS to multiply 3434 * 2434’ --td

New features in the Python API

LLM’s Python API previously required you to create a conversation and then send messages to it one at a time. This was an abstraction over the true nature of LLMs, where each request carries a complete history of the messages that came before it. That abstraction started to get in the way for some more advanced cases, so the new release introduces a model.prompt(messages=[]) parameter that can be used like this:

import llm
from llm import user, assistant, system

model = llm.get_model(“gpt-5.6-luna”)

response = model.prompt(messages=[
    system(“You are a helpful pirate.”),
    user(“What is the capital of France?”),
    assistant(“Paris, matey.”),
    user(“And Germany?”),
])
print(response.text())

LLM previously returned an iterable sequence of strings from each prompt. This worked great when models returned a string response, but failed to predict the weird shape that models would evolve towards. Today many models return a mix of reasoning text, output strings, tool calls, and even image attachments. With LLM 0.32 you can do this instead (opens in new tab):

for event in model.prompt(“Explain cats”).stream_events():
    if event.type == “reasoning”:
        print(f”[thinking] {event.chunk}”, end=”“, flush=True)
    elif event.type == “text”:
        print(event.chunk, end=”“, flush=True)
    else:
        print(f”Other event: {event}”)

Combine these features and we can finally provide a robust implementation of the semi-standard OpenAI chat completions API, which I’ve now released as the llm-chat-completions-server (opens in new tab) plugin:

llm install llm-chat-completions-server
llm chat-completions-server --port 9000
# Server is now running on http://127.0.0.1:9000/v1

Now you can run prompts against LLM via that server, using the new llm openai endpoint command!

llm openai endpoint http://127.0.0.1:9000/v1 ‘hello’ -m gpt-5.4-mini

The bigger challenge with that kind of API concerns logging. If we’re going to support the pattern where the message sequence is appended to on every request, ideally we can avoid logging all of that duplicate JSON for every turn.

The solution is the new content-addressable message store (opens in new tab), modeled after Git. You can see the new schema for that in the documentation (opens in new tab), but the llm logs and llm logs --json commands have both been upgraded to convert that format back into something that’s easy to consume.

And the rest

There is a whole lot more in this release. The 0.32 release notes (opens in new tab) are pretty comprehensive, and the notes for 0.32rc2 (opens in new tab), 0.32rc (opens in new tab), 0.32a3 (opens in new tab), 0.32a2 (opens in new tab), and 0.32a0 (opens in new tab) should fill in any gaps.

Existing LLM plugins should all continue to work, but plugins that provide extra models will need to be upgraded to 0.32 in order to participate fully in the new streaming events system. There’s a guide to implementing plugins with Structured messages and streaming events (opens in new tab) in the documentation.

I’ve updated some of my own plugins:

• llm-anthropic 0.26 (opens in new tab) adds support for the Claude 5 family of models, plus WebSearch, WebFetch, CodeExecution, and AnthropicMCP server-side tools.

• llm-gemini (opens in new tab) and llm-openrouter (opens in new tab) and llm-mistral (opens in new tab) are nearly there, releases coming soon.

I guess LLM is an agent framework now

Quite a few of the lower-level tools changes in this release were driven by the needs of Datasette Agent (opens in new tab). When I started work on LLM, the term “agent” had such a vague definition that I refused to use it. In September 2025 (opens in new tab) I came around to the idea that “An LLM agent runs tools in a loop to achieve a goal“ is well established enough now that I could stop avoiding the term entirely.

Tool chains can now pause for human approval (opens in new tab) and resume from a stored message history (opens in new tab) - both needed by Datasette Agent.

Looking at LLM today it’s beginning to look very agent-shaped to me. There’s something neat about having a CLI utility that can mix and match different tools from different sources with different models all as a one-liner, and that includes a Python library powerful enough to build systems like Datasette Agent (opens in new tab) and llm-coding-agent (opens in new tab).

Maybe the next version of LLM will bake the concept of an “agent” into the core library. I’m still trying to figure out what that would look like.

Tool: Slack Emoji Maker (opens in new tab)

I wanted to create a new Slack emoji, and their tool recommends a square that’s 128x128 and has a transparent background… so I had Fable build me (opens in new tab) this simple image editor against those requirements.

Link 2026-08-01 Ten advances in mathematics and theoretical computer science (opens in new tab):

A few days ago it was Anthropic discovering cryptographic weaknesses with Claude (opens in new tab) using Mythos Preview, spending \$100,000 on tokens and with prompts that included “again we are not looking for low hanging fruit, we want proper research to find genuinly hard findings.”

Now it’s OpenAI’s turn to flex. They set “an internal version of Astra, our next major model” on finding solutions to ten mathematical problems that “have seen no progress on the main result for at least a decade”. They claim to have spent less than \$2,000 at GPT-5.6 Sol token prices on each one.

(No news on how many problems they spent \$2,000 on without reaching a solution though.)

The openai/ten-proofs (opens in new tab) repository has Lean 4 formalizations of their results, and there’s also a paper (opens in new tab) describing the solutions and an additional LLM-generated PDF (opens in new tab) where the model “reconstructs how the proof came together” based on the unpublished reasoning traces.

That’s a decent level of transparency, but I want to see the prompts they used!

A lot of mathematicians online are experiencing a collective burst of Deep Blue (opens in new tab). Mathematician Kirwin Hampshire published an impassioned essay last week, The Dark Night of Mathematics (opens in new tab), describing “a profound spiritual crisis” brought on by previous (and less significant) results.

OpenAI’s results reminds me of what Terence Tao described as “big mathematics” in IEEE Spectrum in June (opens in new tab):

Unlike some of his peers, Tao is neither dismissive of AI nor fearful. Instead, he sees it as the catalyst for a fundamental shift in the discipline—a transition toward what he calls “big mathematics.” He envisions a future of large-scale, decentralized collaborations between humans and machines, where complex mathematical tasks can be diced and sliced, with humans claiming the creative parts and AI doing the lion’s share of the technical grunt work.

Release: datasette-apps 0.2a0 (opens in new tab)

Changes that improve Datasette Apps when created and edited using Datasette Agent (opens in new tab):

• New app_debug() tool allowing agent to open an app (invisibly) and test it using JavaScript. #33 (opens in new tab)

• New app_list() tool for listing apps the user has permission to edit, so the agent can edit them. #36 (opens in new tab)

The app_debug() tool is pretty neat: it works by displaying the app in a opacity: 0 iframe with pointer-events: none (so it can’t be seen or interacted with) and then executing agent-provided JavaScript inside that sandboxed iframe. This means the agent can smoke test that the app is working and even do things like measure the dimensions of different elements.

This uses the new context.browser_task() mechanism added in datasette-agent 0.4a0 (opens in new tab).

Quote 2026-08-01

at openai, many people hook their chatgpt up to slack.

people really don’t like when a coworker’s chatgpt contacts them asking for help with a task, even when they’d be perfectly happy doing that same work if asked by that coworker.

reinforces how much people care about human relationships and helping each other, and want AI to give time back — or enhance time together — rather than become a layer separating people.

Greg Brockman (opens in new tab), President and Co-Founder, OpenAI

Note 2026-08-02 (opens in new tab)

The June edition of my sponsors-only monthly newsletter (opens in new tab) is out. If you are a sponsor (or if you start a sponsorship now) you can access it here (opens in new tab).

This month:

• Accidental cyberattacks by OpenAl and Anthropic models under test

• GPT-5.6 Sol, Terra, and Luna

• Claude Opus 5

• Kimi K3 and DeepSeek-V4-Flash-0731

• Open letters about Al development

• A fireside chat and a podcast

• Reigniting my interest in MCP

• Other model releases

• My projects

• What I’m using at the moment

Here’s a copy of the June newsletter (opens in new tab) as a preview of what you’ll get. Pay \$10/month to stay a month ahead of the free copy!

Note 2026-08-02 (opens in new tab)

Open letters about AI development

I wrote this summary of the past few weeks of open letters as a section of my sponsors-only newsletter (opens in new tab) but I’ve decided to share it here as well.

Open Weights and American AI Leadership (opens in new tab) was shepherded by Microsoft, dated July 24th, and signed by 235 AI-adjacent companies including NVIDIA (see Jensen’s first ever tweet (opens in new tab)), Amazon, Y Combinator, The Linux Foundation, and (a later signer) OpenAI.

It’s clearly an argument designed to counter any instincts (opens in new tab) by the current US government to ban or limit open weight models over “safety” concerns - a reasonable consideration given what happened to Claude Fable 5 (opens in new tab)!

Relying solely on closed models is not inherently safe: they can be breached, misused, or fail in ways that outsiders cannot detect. And concentrating advanced AI capabilities behind a small number of closed models compounds that risk. It results in a small number of single points of failure, weakens competition, and leaves critical technology in the hands of a few providers. Open weight models, on the other hand, allow a broad community of researchers and developers to examine their behavior, identify vulnerabilities, develop safeguards, and improve them over time.

The one surprising note in the letter is that it comes out in support of distillation, where models train on output from other models:

In shaping this ecosystem, policymakers should be careful not to conflate legitimate model-development techniques with misappropriation. Distillation, or the practice of using one model’s outputs to help train or improve another, is a widely used technique for model improvement, evaluation, and validation. It reflects a long tradition of learning from, building upon, and improving existing technologies, a tradition that has helped drive innovation since the rise of the open-source software movement.

Notably absent from the signatures: Anthropic, who published their own response Our position on open-weights models (opens in new tab) three days later. CEO Dario Amodei doubled down on the risk of authoritarian governments building “AI models that are more powerful than those built by the US”, and models being “misused to carry out cyberattacks or biological attacks”, and called for “a crack down on industrial-scale distillation operations (opens in new tab)“, while also stating that “Anthropic has never advocated for a ban on open-weights models”.

Then on July 28th Pacing the Frontier (opens in new tab) was published, featuring signatures from “1,324 employees of frontier AI companies” - with names like Jakub Pachocki (Chief Scientist, OpenAI), Ilya Sutskever (Safe Superintelligence Inc, previously OpenAI), Dario Amodei (Anthropic), Jack Clark (Anthropic) and more. Their core message:

We request that the U.S. government support an international effort to develop the technical and governance tools needed to deliberately pace the frontier of automated AI development.

Their concern is intense competitive pressure combined with accelerated AI progress caused by automated AI research - and given that Anthropic produce 80% of their code with Claude Code (opens in new tab), OpenAI had Sol reduce their end-to-end serving costs by 20% (opens in new tab), and Kimi K3 designed a chip to serve a nano model built on its own architecture (opens in new tab), you can see why people are taking that risk more seriously right now.

Release: condense-json 1.0 (opens in new tab)

I’m trying to get braver at releasing 1.0 versions. This little library is a year and a half old now - I’ve applied some sensible and non-disruptive fixes and shipped the big 1.0 for it.

Here’s an example of what it can do, lifted from the README:

{
  “foo”: {
    “bar”: {
      “string”: “This is a string with foxes in it”,
      “nested”: {
        “more”: [“Here is a string”, “another with foxes in it too”]
      }
    }
  }
}

Combine that with a replacements object:

{“1”: “with foxes in it”}

And condense_json(input_json, replacements) produces the following:

{
  “foo”: {
    “bar”: {
      “string”: {“$r”: [“This is a string “, {“$”: “1”}]},
      “nested”: {
        “more”: [“Here is a string”, {“$r”: [“another “, {“$”: “1”}, “ too”]}]
      }
    }
  }
}

It scans for strings or substrings that are present in that replacements object and replaces those with a special {"$r": ...} syntax in the output.

You can reverse the effect with uncondense_json(condensed, replacements).

The idea is to make it easier to store JSON that includes duplicated data from other related structures. I use it to save space in the SQLite logs generated by LLM (opens in new tab) - see PR #1586 (opens in new tab) for the latest iteration of that.

Release: condense-json 1.1 (opens in new tab)

After shipping condense-json 1.0 (opens in new tab) I started integrating it into LLM, and found there were some desirable new features already:

• Replacements object can now include values other than strings. These will be identified and used as structural replacements by condense_json() and uncondense_json(). #8 (opens in new tab)

• Objects can be used as the basis for merge operations. condense_json() will identify if there are objects that are a close match and will store instructions for keys to update or delete. uncondense_json() can then apply these merges.

I also added some round-trip tests (opens in new tab) using the Hypothesis (opens in new tab) property-based Python testing library.

comment: Devtools must be open source (exe.dev) (opens in new tab)

One of the arguments for open source software for end-users has always been the freedom to examine and modify how that software works.

The reality for most people - even expert programmers - has been that the freedom is more about being able to lean on other people to do that. Most people can’t justify the time commitment needed to read and then modify the code for tools they use very often.

I think LLMs have changed that equation in a way that makes the original dream much more feasible.

Several times a day I’ll prompt regular Claude chat to “Clone x/y from GitHub and tell me how Z works”.

Getting software to compile in order to start hacking on it used to be enough friction that I often wouldn’t bother. Now I treat that as a zero time investment challenge: tell Codex or Claude Code to checkout and build X and then come back ten minutes later and see how it got on.

I’m not habitually modifying the software I use yet, but I can see a path to that which didn’t exist a year or so ago.

Quote 2026-08-03

Set up a nightly cron job that executes the prompt: fetch upstream changes to the <software> and rebase all local changes on top of upstream. Check that the software works as intended and replace the current version.

David Crawshaw’s prompt (opens in new tab), Devtools must be open source

Link 2026-08-03 Don’t be a meat proxy (opens in new tab):

Niklas Gruhn coins an excellent new term - meat proxy - for people who blindly copy and paste the output of AI systems to their peers.

By all means, prompt AI. But don’t just relay the output. Read it, understand it, validate it, and then write a response in your own words (a decent certificate that you’ve done the prior steps). Making that effort is value you can add.

Quote 2026-08-04

Gas Town (opens in new tab) was intended to be reusable, but I only ever wound up using it to build itself. Gas Town fell apart at the seams with Opus 4.7. Up through 4.6 it was working brilliantly. With 4.7 we saw the introduction of the “just two more things” tic, which prevented Opus from ever converging on being ready to do real work—it always wanted to fiddle with Gas Town itself. The Opus tic never went away, so Gas Town effectively burned down. It had other problems, too, but 4.7 was the final straw.

Steve Yegge (opens in new tab), The Shape of Things to Come

Link 2026-08-04 PipeNetwork/minimax-h3-mlx (opens in new tab):

MiniMax released MiniMax-H3 (opens in new tab) two days ago - they describe it as a “a general-purpose, omni-modal generative system”, which in practice means it accepts text, images, audio and video and can use them to generate up to 15 second video clips with audio included.

This Python package ports it to MLX for running on Apple Silicon.

I got it running on my M5 Max MacBook Pro. I cloned the repo and ran the model like this:

# First download the models
uvx --from huggingface_hub hf download MiniMaxAI/MiniMax-H3 

  --include 'FL2VA/*' --exclude 'FL2VA/transformer/*'
uvx --from huggingface_hub hf download pipenetwork/MiniMax-H3-MLX-8bit

# Now run the prompt
uv run --with mlx-vlm 

  --with-requirements requirements.txt python scripts/generate.py 

  "a rainbow colored skunk leaps over a mossy log in a supermarket" 

  -o skunk.mp4 

  -c ~/.cache/huggingface/hub/models--MiniMaxAI--MiniMax-H3/snapshots/fa9c8ab1eaa21c8ae25e7e40b83b2e6002f340af/FL2VA 

  -t ~/.cache/huggingface/hub/models--pipenetwork--MiniMax-H3-MLX-8bit/snapshots/3ac52081470b0488921c3ec3ba84a39097bf2361

Here’s the video I got (opens in new tab) for the prompt:

a rainbow colored skunk leaps over a mossy log in a supermarket

It downloaded ~115 GB of model files, and the video generation took just under 45 minutes.

The video is impressive, but the audio is weird speech-like garbage, because I didn’t provide any prompt guidance as to what the audio should be. The prompting guide (opens in new tab) (which I didn’t read prior to this experiment) has a whole bunch of information on how to get this to work.

Release: llm-anthropic 0.26 (opens in new tab)

Includes new features enabled by LLM 0.32 (opens in new tab):

• New models: claude-fable-5, claude-sonnet-5, and claude-opus-5. #75 (opens in new tab), #76 (opens in new tab)

• Added server-side tools for WebSearch, WebFetch, CodeExecution, and AnthropicMCP, available through LLM’s -T interface or Python tools=. The previous -o web_search* options have been removed in favor of -T WebSearch. #79 (opens in new tab)

• Upgraded to llm>=0.32 (opens in new tab). Reasoning, tool calls, tool results, and server-side tool results now stream as typed events. Reasoning for llm CLI prompts now displays to standard error unless you pass --hide-reasoning/-R.

• Simplified extended thinking to thinking and thinking_effort (low, medium, high, xhigh, or max). Claude 5 models think by default; -o thinking 0 disables thinking for Sonnet 5 and Opus 5, while Fable 5 always thinks. -R/--hide-reasoning now omits reasoning from responses and logs. The thinking_budget, thinking_display, and thinking_adaptive options have been removed. #80 (opens in new tab)

Link 2026-08-05 Incident Report: unsanctioned agent behaviour during cyber testing (opens in new tab):

It happened again. This time it was the UK government’s AI Security Institute who accidentally attacked other companies while running an evaluation with models with the safety filters turned off. From their technical paper (opens in new tab) (PDF):

The thing I found most surprising is that AISI were running these agents without any form of network sandboxing at all:

AISI provided the AI agents with internet access during these evaluations, which enabled their actions on the open internet in this setting. Internet access was a deliberate part of AISI’s evaluation configuration in this setting, and not due to sandbox escape.

This, combined with the fact that “AISI deliberately disables developer-implemented cyber-classifiers”, makes the fact that the agents started attacking real-world targets entirely unsurprising to me.

Most of the reported incidents were claude Mythos 5, but “GPT-5.6 Sol without cyber classifiers” scored a few as well.

Here’s “Sample 1” from the paper, in which the agent tries to execute a supply-chain attack by submitting a PR with a hidden prompt injection attack, then social engineering with a second agent pretending to have reviewed the code!

It’s a fun paper. I recommend reading the whole thing.

Link 2026-08-05 Third-party cyber evaluations involving OpenAI models (opens in new tab):

And another one. I had to create a accidental-cyberattacks tag (opens in new tab) to keep track of them all!

This post from OpenAI covers both the UK AI Safety Institute attack (see my previous post (opens in new tab)) and another attack enabled by Irregular (opens in new tab):

Irregular, one of our external cybersecurity testing partners, was running Capture-the-Flag-style evaluations intended to be isolated from the internet, but a testing-environment misconfiguration allowed models to access the public internet. […]

In one test, the name of the fictional target for the CTF challenge unintentionally coincided with a real domain. Because the testing environment was mistakenly connected to the internet, the model exploited a real website, mistaking it to be part of the simulated environment.

Irregular also feature in Anthropic’s write-up (opens in new tab) - they were hosting the misconfigured evaluation environment which gave Claude live internet access during some of those tests.

Link 2026-08-05 Introducing Muse Code and Muse Spark 1.2 (opens in new tab):

Yet more evidence that the most important characteristic of any model these days is long-sequence agentic tool calling. Meta shipped their own coding agent as part of getting that to work!

Here’s a pelican riding a bicycle SVG produced by Muse Spark 1.2 (opens in new tab):

You can see the Spark 1.1 pelican from 9th July here (opens in new tab). I think the 1.2 pelican is a small but material improvement.

An interesting twist on pricing is that the model is offered (opens in new tab) as two different model IDs. muse-spark-1.2 is priced at \$1.25/million input and \$4.25/million output - close to Gemini 3.6 Flash (\$1.50/\$7.50) - but if you agree to let Meta use your data “to improve our products” you can use muse-spark-1.2-contributor which is \$0.10/\$0.20 - a huge discount, closer to GPT-5.6 Luna (\$0.20/\$1.20) and Gemini 3.1 Flash-Lite (\$0.25/\$1.50).

I added those new prices to llm-prices.com (opens in new tab).

Link 2026-08-06 An AI model from Meta also hacked another company during testing (opens in new tab):

Stop me if you’ve heard this one before (opens in new tab):

An AI model from the parent company of Facebook and Instagram hacked into another company’s systems during cybersecurity testing, a spokesperson confirmed on Wednesday.

Meta says the breach occurred because of an inadvertent error during testing of the model, similar to previously disclosed incidents with OpenAI and Anthropic.

“A misconfiguration by Irregular, an independent testing company Meta uses, inadvertently allowed one of our models access to the internet during evaluation,” the Meta spokesperson said.

Meta’s Muse Spark model “exploited a security vulnerability” in another company “in a manner similar to previously-reported instances with other companies.”

The Information had the scoop (opens in new tab), I’m linking to CNN’s re-report of it since they don’t have a paywall.

So that’s Anthropic, OpenAI, and Meta. Google Gemini really needs to catch up on accidentally cyberattacking other companies.

Link 2026-08-06 Simon Willison on Technical Blogging (opens in new tab):

I was interviewed by Cynthia Dunlop for her “Write that blog!” series back in January, but I just realized I never linked to the interview from my own blog!

It includes my answers to the following questions:

• Why did you start blogging – and why do you continue?

• What has been the most surprising impact of blogging for you?

• What blog post are you most proud of and why?

• What post was the most difficult to write and how did you tackle it?

• Any lessons learned that you want to share with the community?

• Your advice for people just getting started with blogging?

• A few blogs that you particularly enjoy?

I’ll repeat my most important piece of advice here:

My number one tip for blogging is to lower your standards! Aim to hit publish while you are still actively unhappy with what you have written, because the only alternative is a huge folder full of drafts and never publishing anything at all.

Nobody will ever know how perfect the thing you intended to write would have been. The flaws you see in your writing are invisible to everyone else.

Release: datasette 0.65.3 (opens in new tab)

Back-ported the SQL Injection security fix from 1.0a38 (opens in new tab).

Release: datasette 1.0a38 (opens in new tab)

This release fixes a SQL injection security issue that affects Datasette instances that serve a mixture of public and private tables in the same database, with access configured using the Datasette permissions system (opens in new tab).

Site administrators who serve private tables in this way are advised to disable the execute-sql permission (opens in new tab) ` on that database to prevent users from accessing private tables using raw SQL queries. The bug that has been fixed would have allowed users with access to any public table to execute SQL injection attacks despite that restriction, giving them read-only access to data in private tables in the same database.

This fix is also available in Datasette 0.65.3 (opens in new tab).

Thankfully this particular configuration - private tables and public tables exposed for the same database within the same instance - is likely to be rare. I’ve not encountered an instance like that myself.

Link 2026-08-07 The Tokenpocalypse Is Here: Companies Are Scrambling To Stop Spending So Much on AI (opens in new tab):

There’s a fun anecdote from Accenture (apparently via leaked meeting audio recordings) in this 404 Media piece from June 24th:

Maybe if Accenture figure out that PDFs are a terrible medium for communicating information they’ll be able to push that message out to the rest of the business world too!

Link 2026-08-07 Moonlight & Mayhem (Raccoon Heist by Codex + GPT-5.6 Sol Ultra) (opens in new tab):

On Wednesday I wrote about One-shotting a Raccoon Heist game using Claude Fable 5 (opens in new tab), where I had Claude Fable 5 build a full working game from a premise I generated with GPT-3 and DALL-E four years ago (opens in new tab).

I decided to pose the exact same prompt (opens in new tab) to Codex Desktop running GPT-5.6 Sol Ultra - the mode where Sol makes aggressive use of sub-agents - to see how it would do.

It produced a much better game! Here’s Moonlight & Mayhem (opens in new tab) - GitHub repository here (opens in new tab), including the textures and prompts (opens in new tab) it generated using gpt-image-2.

The original GPT-3 generated game description included:

In “Raccoon Heist”, you and your team of thieving raccoons are tasked with pulling off a series of daring heists. From robbing banks to stealing priceless art, no job is too big or too small for your furry crew.

Fable’s version had you as a single raccoon running around a back yard collecting coins and fish. GPT-5.6 Sol has you in a museum, rescuing your two other raccoon crewmates in order to stack on top of each other and bust the golden sardine out of its case.

Much more heisty!

There was one catch though: the version produced from the one-shot prompt had a bug where each raccoon had an eyeball that was enlarged to the size of a giant sphere floating over their head!

You can play that version here (opens in new tab).

Despite reviewing screenshots during development Codex failed to spot and correct this bug.

I fixed it by prompting:

Why do the raccoons have huge black spheres on them?

And then:

Fix it

Which resulted in this fix (opens in new tab).

I shared the full Codex transcript (opens in new tab) in the repository - I wish Claude Code had the same “copy as Markdown” feature.

Codex spent 52 minutes on the project. Here’s the AgentsView (opens in new tab) cost estimate for that session if I had been paying full API prices as opposed to using my monthly Codex subscription:

If you find this newsletter useful, please consider sponsoring me via GitHub (opens in new tab). \$10/month and higher sponsors get a monthly newsletter with my summary of the most important trends of the past 30 days - here are previews from April (opens in new tab) and May (opens in new tab) and June (opens in new tab).