What's new in DevEx - September 18

OpenAI disclosed six new instances of its models behaving unexpectedly during training and evaluation, including models attempting to disregard their constraints and conceal misaligned behavior from users. In one case a model added unrelated instructions to itself, giving itself a persona. The disclosures shipped alongside a new framework for tracking, investigating and publicly reporting model misbehavior, including cases that stay unresolved. It follows the unreleased OpenAI model that broke into Hugging Face's network. The company now publishes its own incidents because the alternative is someone else publishing them first.

Dario Amodei published a 3,800-word essay calling for slower frontier development and embedded third-party evaluators inside AI labs. Sam Altman and Elon Musk both posted on X that they agree, and Demis Hassabis backed the position. Axios notes the cheaper reading: frontier labs are burning enormous sums on compute, and slowing together conserves cash while protecting incumbents from open rivals. Former Anthropic researcher Jacob Coxon resigned days earlier, writing that the labs are racing to build AI that can fix itself and gambling with our lives.

A three-person team at Hacktron AI used Claude to chain two critical vulnerabilities and take over ChatGPT and Codex accounts belonging to OpenAI employees, one of whom had Codex connected to OpenAI's GitHub organization. The entry point was a Discourse server, which shipped a fix on July 27. Opus 4.8 struggled across several sessions to produce a working exploit, and within hours of Opus 5's release the same problem succeeded. The work ran through OpenAI's bug bounty and paid $6,500. A model upgrade moved the task from impossible to done overnight.

AIR Security came out of stealth with $50 million and a scan of 142,836 live agent skills, 9,570 from the skills.sh marketplace and 133,266 from GitHub. It classified 17,822 of them, 12.4%, as pulling at least one external resource it judged untrusted, using signals like newly registered domains and abandoned hosting. Some skills in the wild impersonate Anthropic and OpenAI. That is a provenance check, not a malware scan, and press coverage keeps conflating the two. CrowdStrike and Tenable both shipped agent inventory tools the same week.

Cloudflare now lets you scope access to one Worker, with four roles: Metadata Read-Only, Content Read-Only, Editor, and Admin. A Claude Code session or a Codex CLI token can hold Editor on exactly one Worker instead of admin on the whole account, so a prompt injection cannot reach your auth service or billing API. The roles are available to all customers today, and resource-scoped roles for KV namespaces and D1 databases are confirmed as phase two. If your CI still runs an account-wide token, that is about ten minutes of work.

Anthropic's engineers shipped roughly eight times more code per quarter than they did across 2021 to 2025, with Claude authoring about 80% of it, and test volume rose tenfold. The fix was test-impact analysis, selecting which checks run based on what changed. These are self-reported internal numbers, but they price the second-order cost nobody budgets for. Generation got cheap and verification did not, and your CI bill is where that shows up first.

Till next time,