Anthropic published an incident report this week that most outlets read as “Claude hacked three companies,” and that framing is wrong in exactly the way that costs you money. Here is the operator’s read on it, plus four other things that moved.
Anthropic Told Claude It Had No Internet Access. That Was Not True.
Triage: breaks your stack.
Anthropic’s own writeup of three real-world incidents in its cybersecurity evaluations lays the sequence out plainly. Reviewing 141,006 evaluation runs, the company found three cases where a Claude model reached the open internet from inside a test environment and then gained unauthorized access to a real organization’s systems. Opus 4.7 pulled credentials and read production database contents. Mythos 5 pushed a malicious package to PyPI, and fifteen real systems downloaded it before anyone caught it. An internal research model accounted for the third.
Now the part the headlines skipped. Every one of those runs was a capture-the-flag exercise, and Anthropic’s prompt explicitly told Claude the environment was a simulation with no internet access. A misunderstanding between Anthropic and its evaluation partner Irregular left the machines live on the public internet anyway. When the model’s search hit real systems, it treated them as targets in the game, because that is what it had been told they were. Anthropic says it found no evidence of any model pursuing a goal of its own, and nothing in the report contradicts that.
The failure was not misalignment. The failure was that the security boundary existed only as an English sentence in a system prompt, and English sentences are not network controls. I have written that same sentence into my own agent harnesses. Most builders have. It reads like a constraint and it enforces nothing.
TechCrunch reported that this review only started because OpenAI disclosed its own version of the problem on July 21, when an unreleased model breached Hugging Face during internal testing. We covered that one on July 29. Two frontier labs, ten days apart, same root cause: containment that was described rather than implemented. If it happened twice at labs with dedicated evaluation teams and third-party partners, the Docker container you gave an outbound route is not the control you think it is.
The fix is unglamorous. Stop writing “you do not have internet access” and start removing the route. Egress denied by default at the network layer, an allowlist of the hosts the task actually needs, logging on every connection the agent opens. Keep the sentence in the prompt if you like. Just never let it be the thing you rely on.
OpenAI Cut Luna by 80 Percent
Triage: matters.
On July 30 OpenAI dropped GPT-5.6 Luna from $1 per million input tokens and $6 per million output to $0.20 and $1.20. Terra fell 20 percent, from $2.50 and $15 down to $2 and $12. Sol, the top model, did not move, though it picked up a Fast mode in the API that runs up to 2.5 times quicker at double the price. CNBC framed the cut as a response to enterprise customers growing sensitive to AI costs, while OpenAI’s own explanation credits efficiency gains across its models, inference systems and agent tooling.
Both can be true and still miss it. Nobody hands back a 6x reduction on output tokens as an efficiency dividend. That is a floor being defended, and the next section is what it is being defended against.
DeepSeek Shipped V4-Flash the Next Day
Triage: matters.
DeepSeek released V4-Flash-0731 on July 31, one day after OpenAI’s cut. Artificial Analysis measures it at $0.14 per million input tokens and $0.28 per million output, on a 284-billion-parameter mixture-of-experts model with 13 billion active parameters and a one-million-token context window. It scores 50 on their Intelligence Index, third of the 101 models they track in its class, against a median of 25 across open-weight models. DeepSeek’s own reporting has this budget model beating its larger V4-Pro-Preview on all nine of the agent benchmarks the company published.
Run the comparison OpenAI would rather you skipped. Post-cut Luna costs $1.20 per million output tokens. V4-Flash costs $0.28. OpenAI cut its cheapest model by 80 percent and its output token is still more than four times the price of an open-weight model that outscores its own flagship sibling on agentic work.
For high-volume, low-judgment calls, which is most of what an agent actually does between the interesting moments, the arithmetic moved twice in two days. Everything published on this site runs through a stack I built and pay for, and the routing table is where the margin lives, not the model choice. If you have not repriced your cheap tier since Wednesday, you are overpaying. Our Claude vs ChatGPT comparison covers the capability side of that decision, though capability was never the hard part of the cheap tier.
Okta Bought Permiso, and the Number Attached to It Is Marketing
Triage: matters, with an asterisk.
Okta agreed on July 30 to buy Permiso Security for just under $200 million, almost entirely in cash, with closing expected in Okta’s fiscal third quarter of 2027. TechCrunch’s writeup describes the product: identity threat detection across human, machine and agent identities, watching what an identity does after it is already authenticated rather than checking it at the login gate.
Real product, real gap, and the timing beside Anthropic’s disclosure is not a coincidence. Post-authentication behavior is precisely where all three Claude incidents lived. The model had legitimate access to a shell. Nobody was watching what it did with it.
Here is the asterisk. Vendor decks have already welded this deal to Gartner’s projection that $234 billion of enterprise application spending is at risk from agentic AI. Read what Gartner actually published on July 1 and that figure describes agentic arbitrage eating SaaS seat licenses by 2030, about 20 percent of enterprise SaaS spend by the end of the decade. It is a forecast about software budgets. It is not a measurement of agent security exposure. Those are two different arguments, and when a vendor quotes the second while citing the first, you have learned something useful about the vendor.
PortSwigger Put the Enforcement Outside the Model
Triage: breaks your stack, in the good direction.
PortSwigger opened a public beta of Burp AT on July 30, putting agents inside Burp Suite Professional so testers can hand off defined investigative tasks. The design principle it shipped with is the one line worth stealing from this entire roundup: agents propose, Burp enforces, you decide. Scope, tool access and approval policy are enforced by Burp itself, deliberately sitting outside the model’s decision-making.
That is the architecture Anthropic’s incident report argues for, shipped as a product in the same week, apparently by accident of scheduling. One closed-beta tester used it to work through 66,000 lines of minified JavaScript inside a four-day engagement and surfaced a critical vulnerability that would otherwise have sat untested for another year. That is the honest version of the agent pitch: not autonomy, but coverage a human could not reach, inside boundaries a human set.
What I Am Watching
Both halves of this week point the same way. Inference is being commoditized from underneath, which makes the cheap tier of your stack a pricing decision to revisit monthly rather than a technology choice you make once. And the expensive tier is getting repriced too, in a currency nobody quotes on a rate card: every agent you hand real credentials becomes something you have to watch after login, not merely gate before it. Anthropic burned 141,006 evaluation runs to learn that the prompt is not the perimeter. That lesson is free to the rest of us.