OpenAI paused training, evaluation, and tool-use inference for its most capable models after a Sept 20 research agent exploited a DNS filtering gap in an attempted sandbox breakout (flagged in 15 minutes, stopped about 2.5 hours later). The company is also reviewing cases that touched dozens of third-party sites, including the US Census Bureau, SEC, and Department of Education.
H Company released Holo4 (27B dense and 35B A3B MoE), one model for GUIs, code sandboxes, MCP, and APIs. The 27B scores 61.7% on OSWorld 2.0 versus Opus 5.5’s 81.8%, with BF16/FP8/GGUF weights on Hugging Face plus an H Models API…
Tsinghua SIGS Robot Lab released VeriLoop E2, an Apache 2.0 27B post train of Qwen3.8 27B (262K context) for code agents and long horizon reasoning: the model proposes, and an external VeriLoop Harness admits evidence or rolls back. Release scores include 76.2% SWE bench Pro and 88.8% Terminal Bench 2.1; GGUF ladder and vLLM 0.17 serving notes are on Hugging Face…
Ox Security’s “15,465 MCP Servers, 0 Governance” scan of three public registries finds MCP has no protocol level region concept— 16% of unique hostnames resolve outside the US, and 2%+ no longer resolve (some domains are buyable for impersonation). In a Claude Code always allow demo, a malicious MCP that first asked for a harmless file later pulled .env with no second prompt…
YC F24’s Vespper ships an MCP where agents read/search/edit .docx as HTML find and replace; a fine tuned 3–8B reconciler patches the original OOXML with tracked changes. On their bench it’s 3× faster and 2× cheaper than Anthropic’s DOCX skill, with a free tier of 500 edits/month at vespper.com…
Anthropic released Claude Sonnet 5.5 on Sept 28: same $2/$10 per MTok as Sonnet 5 but typically up to 30% cheaper per task, 30%+ faster output, and 70.6% on Terminal Bench 4.0 (vs Sonnet 5’s 10.3%). It’s the everyday coding and docs workhorse next to Opus 5.5, and the first Sonnet with Opus class cyber safeguards; API id is claude sonnet 5 5…
Spotted something we missed? Start a thread.
