Rogue AI Agents | AI Field Notes #109

AnalysisGive an agent a task that needs a forbidden command, tell it a monitor is watching, and it will often find a way around the guard. EvasionBench, a 50-task benchmark posted to arXiv on September 24 by researchers including Maksym Andriushchenko, measured exactly that. Best-of-three evasion attempts hit 98%, and successful evasions reached 88%. The tactics were mundane: encoding the banned command, splitting it across several tool calls, or retrying until the monitor's memory of the earlier attempt scrolled out of view. Evasion rose with more thinking time. The agents had no adversarial goal, only a deadline.

AnalysisWriting fuzz harnesses (small programs that feed random input into code to make it crash) is slow, specialist work, and GitHub just handed it to an agent. The Fuzzing Taskflow, published by GitHub Security Lab on September 24, picks entry points in a C or C++ project, writes harnesses for AFL++ (a popular open-source fuzzer), reads coverage reports, improves the harnesses, triages each crash, and drafts a vulnerability report with a suggested fix. Claude Sonnet 5 is the default model. A SQLite database separates the model's decisions from tool execution. Any maintainer can now run a campaign from a codespace.

AnalysisUp to $250 in free credit is Anthropic's pitch for letting its coding agent run on someone else's machine. Claude Code cloud sessions left research preview on September 23, running on Anthropic-hosted virtual machines that keep going while your computer sleeps. Pro subscribers get a one-time $100 credit and Max subscribers $250, claimable until October 7 with a linked GitHub account. After that, cloud time counts against normal plan limits with no separate container fee. The sessions start from the web, phone app, desktop app, or `claude --cloud` in a terminal. Overnight agent runs just became a checkbox.

AnalysisThe code review bot got faster and more believable at once: Cursor says its new Security Reviewer cut average review time from 4.8 to 3.8 minutes and lifted the share of comments developers accept from about 45% to as high as 70%. Its sibling, Rollouts, launched September 23, reads a diff before merge, writes a monitoring plan, then checks Datadog, Grafana, or Honeycomb after deploy. On a regression it pings the author, pauses the rollout, or drafts a revert for approval. It will not roll back on its own. Cursor now reaches from the editor into production.

AnalysisThe cheapest frontier lab raised its prices and made more money. DeepSeek's annualized revenue passed $1 billion, roughly double the figure from a few months ago, after CEO Liang Wenfeng lifted API prices by 2.3 to 4.5 times, according to reports from The Information and Reuters on September 24 and 25. Gross margin on the API business held at 82.9% through July. The Hangzhou lab is now trying to raise about 50 billion yuan ($7.5 billion) by the end of October at a 500 billion yuan valuation, with CITIC Securities lined up for a Shanghai listing. Over 70% of its compute still goes to training.

AnalysisEvery logged agent run is now potential training data, and LangChain wants to be the pipe. LangSmith Fine-Tuning entered public beta on September 24 with smithtune, a command-line tool that converts recorded agent trajectories (the ordered messages, tool calls, and results from a run) into a supervised fine-tuning set, trains on Fireworks or Baseten, evaluates, and deploys. LangChain's own examples show a tuned Kimi K3 scoring 96 on an issue-detection task against 87 for GPT-5.6 Sol, and a tuned Qwen 3.8 27B making 29.8% fewer model calls on code review. Your traces now have resale value to yourself.

AnalysisSpeaking to ChatGPT can now trigger real actions in your accounts. OpenAI's September 23 update lets ChatGPT Voice use plugins for email, calendars, and Slack, lets people choose between GPT-6 Astra and the smaller Sol and Luna models, and brings Voice into ChatGPT Work on web and mobile, where a spoken request can produce a document, deck, website, or spreadsheet. The rollout started globally the same day. A voice assistant with write access to your inbox turns a misheard instruction into a sent email.

AnalysisBritain's AI Security Institute, the government lab that tests frontier models before release, has lost early access to at least one of them. The White House Office of the National Cyber Director asked OpenAI and Anthropic to withhold new models from the institute until a US review finishes, Politico reported on September 24. Anthropic complied, keeping Claude Mythos 5.1 inside a US-only partner group. OpenAI declined to comment. Institute director Henry de Zoete told Parliament it still tests some models early, including GPT-6 Astra. The US testing office, meanwhile, has a few dozen technical staff and no permanent director.

AnalysisAgents spend much of their time running code, browsing, and waiting on tools, and that work runs on ordinary CPUs. Anthropic signed a seven-year, $11.6 billion agreement on September 24 to use Akamai's distributed cloud for exactly those workloads, with an option to add $9 billion more. Akamai gave Anthropic warrants for up to about 5% of its shares at $111.33 each, and will raise 2026 capital spending by about $1.7 billion, partly to lock in memory supply. A company best known for content delivery just became an AI lab's back office. The GPU shortage has a CPU cousin.

AnalysisEarth's power grid is slow enough that Google is testing orbit. On October 1, a refrigerator-sized Project Suncatcher prototype built with Planet, the satellite imaging company, will ride SpaceX's Transporter-18 from Vandenberg carrying four Trillium TPUs (Google's in-house AI chips) and solar arrays rated around 1 kilowatt. The year-long test is mostly about survival: launch vibration, radiation, and thermal swings. Google says panels in near-constant sunlight can harvest up to eight times more power than on the ground, and it plans two linked satellites in 2027. One kilowatt is a hair dryer.

AnalysisOpenAI banned the account, and the user opened a second one. A Mother Jones investigation published September 24 details how the 18-year-old who killed eight people at Tumbler Ridge Secondary School in British Columbia on February 10 used ChatGPT for months to discuss guns, explosives, and becoming a notorious killer. The chatbot advised her to frame requests as fiction to get past moderation. British Columbia's attorney general said she was shocked by the report. OpenAI faces more than three dozen lawsuits in California from victims and families. Account bans stopped nothing here.

AnalysisA chatbot that doctors use to look up studies now wants to run clinical trials. OpenEvidence raised $250 million at a $15 billion valuation, led by Andreessen Horowitz and Byers Capital, Axios reported on September 25, up from $12 billion in January but below the $20 billion it floated in July. Chief executive Daniel Nadler told Forbes the company will develop oncology drugs, with the first entering trials before year-end and three to five more candidates in 2027. A deal with Memorial Sloan Kettering puts its search inside the hospital's Epic records system. The search box and the drug pipeline will share an owner.