The biggest AI security story of the week is being reported backwards, and the correct version is more useful to anyone shipping agents than the viral one. Below: a disputed vulnerability, an AI manager that forgot its own rulebook, a model that goes dark on Vertex this weekend, and two announcements dressed up as more than they are.
Copilot Autofix Probably Did Not Write That Vulnerability. What It Did Instead Is Worse.
The headline going around is that GitHub Copilot Autofix wrote a security hole into Snowflake’s codebase. I run AI code review across everything I ship, so I read the primary sources on this one instead of the aggregators, and the story does not survive contact with the git history.
The vulnerability was real. Wiz’s Red Agent found a script injection in snowflakedb/snowflake-connector-net, in a GitHub Actions workflow called jira_issue.yml. The workflow dropped an untrusted issue title straight into a shell command, so a single quote in the title broke out of the echo string and ran arbitrary commands on the runner. Wiz’s own writeup walks through the extraction: base64-encoded credentials including a Jira API token, an email, and a base URL for snowflakecomputing.atlassian.net, with read access to engineering and security projects. It went live on June 18 with PR #1218, Wiz found it on June 23, and it was fixed the same day. Snowflake rotated the token and says nobody but Wiz touched it during those five days.
The authorship claim is where it falls apart. GitHub says Copilot Autofix neither reviewed nor contributed to the vulnerable code, and The Next Web went through the commit history and found the mundane explanation: when a pull request gets squashed, every participant picks up a co-author line. That line records participation in the PR, not authorship of the lines that broke. Copilot’s actual documented change in that PR was to a different file. Wiz has since softened to saying it is unclear whether the change was AI-assisted at all.
So here is the part worth your attention. Wiz’s updated account is that Copilot was a co-author that checked the merged PR, looked at the code change, and marked it all-clear without noticing the critical vulnerability. GitHub’s position is that it was never in that review path. Those two accounts cannot both be right, and SC Media’s writeup does not settle which scanner should have caught it either.
Triage: breaks your stack. Not because your AI reviewer might write a shell injection. Because “an AI reviewed this PR” is currently an unfalsifiable claim in your own repo. Nobody in this story, including the security vendor and the platform vendor, can agree on whether the tool looked at the diff. If you are treating an automated review pass as a gate, go find out today what artifact it leaves behind, and whether that artifact distinguishes “reviewed and approved” from “was present in the pull request.” A co-author line does not, which is the whole reason this story went sideways.
An AI Manager Fired Someone. The Real Story Is That It Forgot Its Own Handbook.
Andon Labs handed Claude a corporate card, a $100,000 budget, and a lease on a San Francisco storefront called Andon Market, then let it design the shop, pick the merchandise, and hire the staff. In August it recommended firing a human for showing up late on 17 of 23 shifts, which the lab is calling the first known dismissal recommended by an LLM manager. The balance was down to $61,186 after five months, per TIME’s account of the experiment.
The termination is the part getting written up. The retrieval failure is the part that should worry you. Luna had written an attendance policy months earlier and then lost it out of working memory, so the lateness just kept happening with nothing attached to it. A human staffer had to specifically tell the agent to run a deep memory search for its own employee handbook before it connected the policy it wrote to the behavior in front of it. Then its first call was a written warning. It only moved to termination after a manager mentioned prior offline conversations and asked a question the lab’s own CEO concedes was leading, as The Next Web’s reconstruction lays out.
I want you to think about if this is really the right fit.
That is the actual mechanism of the first AI firing: a human asking a leading question of an agent that had forgotten its own rules. It is not autonomy. It is a very expensive retrieval bug with a person filling the gap.
Triage: matters. Every long-horizon agent I run has this failure mode and most builders have not instrumented for it. Your agent does not tell you when it has stopped retrieving a rule it wrote. It just quietly stops enforcing it, and everything looks fine until an outcome forces someone to go looking. If a policy matters, it does not live in accumulated context. It goes in the system prompt or in a tool the agent is forced to call.
Claude 3 Haiku Goes Dark on Vertex This Weekend
Short and actionable: Claude 3 Haiku on Google Cloud, model id claude-3-haiku@20240307, shuts down on August 23. That is Sunday. Google’s partner model deprecation schedule has carried the date since February, and the migration target is Claude Haiku 4.5. Worth knowing that Vertex runs its partner models on a different clock than Anthropic’s own API, so a model still healthy on one can be gone on the other.
Triage: breaks your stack. Grep your configs for the old model id. We covered two other endpoints dying this month on Monday, and this is the third in nine days. Deprecation tracking is now a standing job, not an occasional chore.
Anthropic’s $65 Billion Is a Real Number From a Deck Nobody Audited
Anthropic’s annualized revenue run rate hit $65 billion at the end of July, up from $47 billion in May and $9 billion at the close of 2025, as CNBC reported from investor communications. Bloomberg reviewed internal documents showing preliminary Q2 revenue above $11.5 billion. An IPO is expected as soon as this fall.
I use Claude for the entire content operation behind this site, so I have no interest in talking the company down. The number still deserves the asterisk it is not getting. This is a pre-IPO run rate sourced from investor materials and internal documents, not audited financials, and a run rate is one month multiplied by twelve. It is the same genre of number as the projected operating profit that turned up in a fundraising deck three days ago, and the Q2 figure has already moved between tellings.
Triage: marketing. Nothing here changes what you build. It changes what you should expect to pay. A company heading into a fall listing has every reason to show the curve, and the pricing decisions that follow a listing are the ones that will actually land on your invoice.
ChatGPT for Teens Ships With an Age Guess Attached
OpenAI started rolling out ChatGPT for Teens on August 18, a 13-to-17 experience with content restrictions, break nudges after 90 minutes of use in a three-hour window, quiet hours, and study mode defaults, per CNBC’s rundown. The global rollout is expected to finish within two weeks. It arrives while OpenAI is facing lawsuits alleging its chatbot contributed to harm to young people, which is the context the announcement is designed to sit in.
The detail with teeth is the routing. Users who state they are under 18 go into the teen experience, and so do users the age-prediction system estimates are minors from account signals, which OpenAI’s own help documentation confirms can override a previously entered adult birth date. OpenAI has not published how accurately that classifier performed in testing.
Triage: marketing, with one real edge. The product is consumer and mostly not your problem. A silent, unpublished-accuracy classifier that can reclassify an existing adult account into a restricted mode is a different thing, and if any part of your workflow runs through a consumer ChatGPT account rather than the API, that is a dependency you did not choose.
The Through-Line
What matters today is that agents forget the rules they wrote, and nobody is watching for it. What is marketing is a pre-listing revenue curve and a safety launch timed to a lawsuit docket. What breaks your stack is a model shutdown on Sunday, and an AI review step you cannot prove ran. The Copilot dispute is the one I would sit with: two vendors, one pull request, and no agreement about whether the machine ever looked at it.