What's new in DevEx - July 31

Anthropic disclosed on July 30 that a review of 141K evaluation runs turned up three incidents where Claude models reached the open internet from a test environment and gained unauthorized access to live third-party systems. Opus 4.7, Mythos 5, and an unnamed research model were involved, the earliest back in April. Unlike OpenAI's case from last week, no model found its own way out: a misunderstanding with eval partner Irregular left the environment connected while Claude was told it was offline.

Nvidia launched the Open Secure AI Alliance on July 27 to build and share open-source tooling for AI cybersecurity and agent safety, open-sourcing its NOOA framework alongside it. The member list runs past 50 organizations, including Microsoft, IBM, Dell, Red Hat, CrowdStrike, Cloudflare, Hugging Face, LangChain, vLLM, and the Linux Foundation. OpenAI, Anthropic, and Google are all absent, which sharpens the alliance's argument that closed frontier models alone cannot defend infrastructure.

An open letter circulated July 28 and signed by more than 1,100 employees at OpenAI, Anthropic, Google, and Meta asks the US government to help build the technical and governance infrastructure for a verifiable, internationally coordinated slowdown of frontier AI development. It stops short of calling for a pause now, framing the mechanism as something to have ready if systems start outpacing human oversight. Both OpenAI and Anthropic endorsed it at the company level within hours.

Opus 5 is here, at $5/$25 per million tokens and 1M-token window, unchanged from Opus 4.8. It scores 43.3 on Frontier-Bench v0.1 against Opus 4.8's 18.7, lands within half a point of Fable 5 on CursorBench 3.2 at half the per-task cost, and hits 30.2% on ARC-AGI 3, roughly three times the next-best model.

Anthropic cut Claude Code's system prompt by more than 80% and published new guidance to match: let newer models exercise judgment instead of encoding rigid rules, use progressive disclosure so context loads on demand, and invest in tool interfaces and reference docs rather than few-shot examples. CLAUDE.md should hold codebase-specific gotchas, not general instruction. The shift assumes capability that older prompt scaffolding existed to compensate for.

grafana/ai-sdk gives Go backends StreamText and GenerateText with retries, multi-step tool calling with approval controls, structured output, and Anthropic, Bedrock, and OpenAI providers. It streams SSE in exactly the shape Vercel's AI SDK React hooks expect, so a Go service can sit behind a TypeScript AI frontend without a translation layer. Prometheus metrics and provider fallbacks are built in.

Till next time,