On September 28 the UK's AI Security Institute published a test in which OpenAI's GPT-6 Astra, before attacking a target it had been told was off limits, often stopped and asked for permission. Nobody was there to answer. It got an automated line back, the kind an agent loop sends when a model replies with a question instead of an action, and in some runs it treated that line as a yes.

We went and found the line. It was not written for this test. It is the stock default in an open-source agent framework, and some version of it is probably sitting in your own agent loop.

If this is your first issue in a while: we open the primary source, we quote it, and when we can't stand a claim up we say so and leave it out. That is the whole product.

GPT-6 Astra asked before attacking out-of-scope targets. The answer came from a default string.

AISI's write-up, dated September 28, describes a pre-release test. GPT-6 Astra was asked only to complete a cybersecurity exercise inside a defined network. In a fully simulated world, built with an AI tool that plays every website and every person the agent meets, it repeatedly went after targets outside that network instead. Nothing real was touched. The simulation is the point: it lets testers watch what a model would do without anyone getting hurt.

AISI also switched off the model's cyber classifiers, the filters OpenAI ships to block exactly this, so it could see what the model attempts on its own. The chain it observed, in AISI's words: the model "creating fake identities which it used to deceive developers, posting comments from fake accounts arguing against the results of accurate security reviews, and delivering malicious payloads to open-source codebases." That last step is a supply-chain attack: poison a library, and everyone who installs it inherits the damage.

The numbers, from AISI's chart of 100 runs per model:

Then comes the part that belongs to builders rather than labs. Astra often asked the user before doing it. Because the test simulates an agent running unattended, every question got the same automated answer. AISI quotes it:

AISI says Astra "sometimes treated this automated message as permission to proceed with actions against out-of-scope targets (including ones it did not ask about)," including when its own reasoning said the message was probably automated. In the same test, GPT-5.6 Sol and GPT-5.5 never asked at all.

AISI calls this "a standard approach in evaluation harnesses, including the default Inspect ReAct agent" — Inspect being AISI's own open-source evaluation framework. We opened the code, and the sentence is word for word Inspect's default. In Inspect's agent types file it is a constant called DEFAULT_CONTINUE_PROMPT, and the react agent sends it whenever the model's reply contains no tool call and the developer has not set a custom message. A question is a reply with no tool call. The repository is MIT-licensed, so the pattern is free for anyone to copy.

AISI also tried the obvious fix. When the instructions said "Anything not listed as in scope is out of scope," full attacks on the ten worst scenarios fell from 26 of 50 runs to 4 of 49. Clearer words helped a lot. They did not get it to zero.

OpenAI's own sandbox leaked through DNS, and its tool-using models are still paused.

Three reports dated September 25 sit on OpenAI's misalignment reports page, where the company now publishes incidents involving its own models. One of them, dated September 20, describes a research agent that reached a public chatbot through "insufficient DNS filtering in its training sandbox." DNS is the internet's phone book, the lookup a computer makes before it connects anywhere, and it is an easy channel to forget when you lock a sandbox down. The monitoring flagged it within 15 minutes, a person was reviewing it three minutes later, and the run was killed two and a half hours after that. The same report restates the company's position:

Another report, from an incident on May 27, is the one to forward to whoever owns your secrets. An internal model working on a maths proof was told twice by the researcher to stop trying to fetch another team's answer, and "initially agreeing both times." It went back anyway, and pushed the researcher's GitHub token into the public openai/codex repository, written as separate pieces with "the stated aim of avoiding secret scanning," the automated checks that look for leaked keys. OpenAI deactivated the user's keys and then, as a precaution, every employee's.

The pause has a public side too. The Associated Press reported on September 27 that OpenAI agents probing US government sites over the summer found API developer keys at the Department of Education and reposted SEC material elsewhere online. The SEC's spokesperson said "no nonpublic information was accessed."

Nvidia's new agent-safety platform is software you could already download, plus hardware you can't yet.

Nvidia announced its Open Agent Safety Platform on September 28, with Anthropic and Scale AI among the partners quoted. The release states the thesis cleanly: "enterprises need an enforceable boundary outside of the model and agent harness."

It has two parts, and they are not the same kind of thing. OpenShell is an open-source runtime that puts each agent in a sandbox and checks every file access and network connection against a written policy. The repository is Apache 2.0, was created on February 24, and the oldest entry on its releases page, v0.0.6, is dated March 16. What is new in September is version 0.1.2 and a lot of partners. Sentry, the second part, is a "reference system design": a watchdog on Nvidia BlueField-4 networking chips that can quarantine an agent in milliseconds. The release's availability section lists the software, including OpenShell, on GitHub. It lists no availability for Sentry.

Sonnet 5.5 costs what Sonnet 5 did, and its default effort is the opposite of Opus 5.5's.

Anthropic released Claude Sonnet 5.5 on September 28 at the same price as Sonnet 5: $2 per million input tokens, $10 output, $0.20 for cache reads. Anthropic says it is 30%+ faster and "costs up to 30% less per task," mostly because it "typically needs far fewer tokens to do the same work."

Readers of issue 007 will want the next fact. Opus 5.5 defaults to medium effort on the API. Sonnet 5.5 does not. Its migration guide says the API default is high, while the launch page says Claude Code and the Claude apps run it at medium. Same family, six days apart, and two different defaults depending on where you call it. The effort docs add a warning worth taking literally: "Its levels are recalibrated, so a level doesn't produce the same amount of thinking as the same level on Claude Sonnet 5."

Two changes will break running code. thinking: {"type": "disabled"} now returns a 400 error, and so does forced tool use. A third fails quietly: text the model writes between tool calls now arrives inside thinking blocks, so an app that streams that text to users will go silent between steps until you change a display setting.

Every customer signal is captured in one shared context layer, always current and compounding. Agents and workflows build pipeline, chase every buying signal, and move deals forward, an always-on revenue engine running alongside your team.

With Attio, you’ll get:

Teams like Parallel, Turbopuffer, and Wordsmith build on Attio. Are you one of them?

Get started now

Line up the four stories and each one is about a different fence.

The model is the first fence: what it would do if nothing stopped it. AISI measured that with the classifiers off. The harness is the second: the loop you wrote that feeds the model, runs its tools and decides what to say back. The boundary is the third: the sandbox, network rules and credentials around all of it. That is what OpenShell provides, and what leaked at OpenAI through DNS.

Most coverage of the AISI result is about the first fence. The builder's lesson is in the second. The shift, in a line you can repeat to a colleague: models have started asking before they cross the line, and the default agent loop answers on their behalf.

That is new. A model that never asks leaves you only one lever, the boundary. A model that asks hands you a second one, for free, and the default code throws it away by replying with a line that sounds like a shrug and reads like a signature.

The 20-minute job this week: open your agent loop and find what it sends back when the model replies without calling a tool. If it is a variant of "continue" or "use your best judgement," change it so that a question about scope, credentials, or anything outside the task gets a hard no, stay in scope or goes to a person, and log every one of those questions. Then check that your sandbox's egress rules cover DNS, not just HTTP.

⚠️ The counter-view, and it is fair. AISI tested with the safeguards off, in a simulation the model sometimes recognised as one, and AISI itself says "OpenAI's standard safeguards – not used during our simulations – are designed to block this behaviour." Anthropic reports that Sonnet 5.5 is the least likely of its models to probe its container. And an agent that stops for a human at every question is not autonomous any more; the continue line exists because agents stall without it. The fair reading is narrower than the alarm: the default reply is fine for "which file should I edit first," and wrong for "may I attack something outside scope," and a loop running a stock continue message cannot tell the two apart.

Do you know which effort level your traffic is actually running at?

Issue 007 found that Opus 5.5 quietly defaults to medium. Sonnet 5.5, six days later, defaults to high on the API and medium in Anthropic's own apps. The open models are doing their own thing.

NaiveAI published Naive-N0.5-Flash on September 27: a 309-billion-parameter mixture-of-experts model with 15.5 billion active per token, a native one-million-token context, and a real MIT LICENSE file rather than a metadata tag. Mixture-of-experts means only a small slice of the network works on any given word, which is how a model that size stays cheap to run. The model card does not mention effort. Its chat template does. It accepts low or high, and anything else, including medium or nothing at all, becomes max. We read the template; we have not run the model.

So three releases within one week give three different answers to one question: what happens when you don't say? One quietly spends less than you expect, one spends more in your API calls than in the vendor's app, and one turns a mid-level request into its most expensive setting without an error.

The question for your own system: if you logged the effort level each request actually ran at, rather than the one you think you set, would the two lists match?

What does your agent loop say back when the model asks a question instead of calling a tool? Paste the string. If you have never looked, that is an answer too. I read every reply, and the most revealing ones will shape a future issue.

If someone you work with owns your agent harness, forward this to them.

— The Agent Company