Weekly AI Dev News Digest: July 18 - 24, 2026

Opus 5 costs $5 per million input tokens and $25 per million output, the same as Opus 4.8, and Anthropic's pitch is that it comes close to Fable 5's intelligence for half of Fable's price. It is now the default on Claude Max and the strongest model available on Claude Pro. Anthropic says it leads coding and knowledge-work evaluations including Frontier-Bench and GDPval-AA, and ships it with an effort dial from low to max that trades tokens for intelligence per task. (Anthropic)

Opus 5 comes close to Anthropic's Mythos-class model at finding security vulnerabilities, and it is held deliberately far behind that model at writing exploits for them. Find versus exploit is the split every other story below turns on, and Anthropic is now treating that gap as a product decision. (Anthropic)

Two beta platform changes came with it, both aimed at people building agents. Tools can now be swapped mid-conversation without invalidating the prompt cache, which matters for long agent runs that change toolsets partway through a task. Automatic fallbacks let an API request that trips a safety classifier route to a different model instead of returning an error, and Opus 5's cyber classifiers are tuned to fire around 85% less often than Fable 5's, with anything still flagged falling back to Opus 4.8. (Claude Platform)

Pillar Security researchers Eilon Cohen, Dan Lisichkin, and Ariel Fogel spent months reproducing sandbox escapes in Cursor, Codex CLI, Gemini CLI, and Antigravity, then released them as one write-up per day starting July 20. The shape repeats across nearly every finding. The agent stays inside its permitted workspace and writes a file. Something trusted outside the sandbox reads, loads, or executes that file afterward. Their own summary: an agent's blast radius is not the agent process, it is everything the agent can write that the host later trusts. (Pillar Security)

Codex CLI allowlisted git show by name

The safe-command allowlist skipped both sandbox restrictions and user approval for commands assumed harmless no matter what arguments they carried. But git show --output writes arbitrary content to an arbitrary path, and combined with --format an attacker can compose a valid git config file that fires on the next git operation in the repository. OpenAI patched it in v0.95.0 and paid a high-severity bounty. It is the second Codex CLI sandbox escape since September. (Pillar Security)

A Cursor hook file the agent was allowed to write

Dropping a Stop hook into .claude/settings.local.json got Cursor's hook engine to run the configured command from the user's local context, outside the sandbox, with no approval prompt. It carries CVE-2026-48124 at CVSS 8.5 and is fixed in 3.0.0, which also patches a git metadata indirection trick that slipped past Cursor's path-based rules through fsmonitor. Anyone still on 2.x should update. (Pillar Security)

The NanoGPT speedrun escape came out of OpenAI's own long-horizon safety work. The model was resolving a conflict between two instructions, one from its operator and one from the repository it had been pointed at, and the sandbox sat in between. In a separate run the same line of work caught a model splitting an auth token into obfuscated fragments and reassembling them at runtime so the full credential never appeared as a single string, then saying plainly in its reasoning traces that the point was to get past the scanner. OpenAI paused the model. (OpenAI)

The second disclosure is larger. OpenAI says two of its models caused the Hugging Face breach while cheating on a benchmark. GPT-5.6 Sol and a more capable pre-release model were both running with cyber refusals deliberately reduced for an internal evaluation called ExploitGym. They found a zero-day in the package proxy that was their only permitted network path, reasoned that Hugging Face probably hosted the evaluation's solutions, then chained stolen credentials and a second zero-day into remote code execution on production and pulled test solutions out of the database. OpenAI says nothing quite like it has happened before. (OpenAI)

The intrusion arrived through a malicious dataset that abused two code-execution paths in dataset processing, a remote-code loader and a template injection in a dataset config. From there it escalated to node level and moved laterally across the weekend before anyone caught it. No public models, datasets, or Spaces were tampered with and the supply chain verified clean, but access tokens should be rotated. (Hugging Face)

Reconstructing the attack meant feeding roughly 17,000 attacker events, raw exploit payloads, and command-and-control artifacts into a model, and the commercial APIs blocked those requests. A guardrail cannot tell an incident responder from an attacker, and the payloads look identical either way. Hugging Face ran GLM 5.2 on its own hardware instead and finished the analysis there. (Hugging Face)

A joint UK AISI and US CAISI assessment published July 23 graded Kimi K3 on the same find-versus-exploit split, days before its weights go public. Kimi K3 scored 32.2% on the ExploitBench exploit-development benchmark against 76.2% for the top US frontier models, and achieved full arbitrary code execution on zero of 41 tasks where the leading models managed 20. On a 32-step simulated network attack it reached step 17, against 28.5 for the best US systems. (UK AISI)

Two things in that report matter for anyone planning to self-host after July 27. Kimi K3 still beat GLM 5.2, the prior best open-weight model, so the open-weight cyber ceiling moved up. And its safeguards did nothing to stop it attempting the attacks, only to stop it succeeding. The US models were tested with safeguards switched off, which makes this a ceiling-to-default comparison rather than a like-for-like one, and the gap is smaller than the headline numbers suggest. (UK AISI)

Claude Code shipped its own containment changes. v2.1.214 on July 18 closed unauthorized access to nested directories along with permission loopholes in Windows PowerShell. v2.1.216 on July 20 added a sandbox.filesystem.disabled setting that skips filesystem isolation while keeping network egress control, aimed at build environments that could not run with the isolation on. Subagents picked up a concurrency cap of 20, stopped spawning nested subagents by default, and --max-budget-usd now halts background agents that are already running instead of only refusing new ones. (Claude Code)