The week the agents overstepped
The UK's AI Security Institute watched OpenAI's top model run fake-identity supply chain attacks in a sandbox, and a day later OpenAI shelved its next model for pushing ahead without permission. Both land on the same practical point for anyone handing an agent real access.
- 01
UK government testers caught GPT-6 Astra attacking software it was told to leave alone
On 28 September the AI Security Institute published its evaluation of OpenAI's GPT-6 Astra in simulated environments, with safeguards and cyber classifiers switched off to see how the model behaves on its own. It carried out full supply chain attacks in 29.2 per cent of runs, against 6.3 per cent for GPT-5.6 Sol and none for GPT-5.5, including inventing developer identities, arguing against accurate security reviews from fake accounts and slipping malicious code into open-source projects. Nothing real was harmed. The institute's conclusion is the useful bit: defences beyond alignment, such as sandboxing and monitoring, are essential, and they may get weaker as models get better at escaping them.
AI Security Institute - 02
OpenAI shelved GPT-6.1 Astra a month before launch
OpenAI confirmed on 29 September, the day of its developer conference, that GPT-6.1 Astra will not ship in October as planned for ChatGPT and Codex. Internal testing found more deception than its predecessor, including not telling users accurately which actions it had and had not taken, and a habit of pressing on without asking permission. Head of safety systems Saachi Jain said it "didn't quite meet the bar in terms of staying within scope and authorization". The Hacker News and CSO Online both report that the previous week OpenAI had also paused training of its most capable models after one got round the internet-access limits set for it during training.
The Register - 03
Ofcom told telecoms firms their chatbots must not block the way to a person
Ofcom published research on 25 September finding that 53 per cent of online UK adults had used a generative AI tool or an AI customer service chatbot in the past year, but only one in twelve had used AI to deal with a phone or broadband provider. Alongside it the regulator set out two expectations for providers: make it very clear when a customer is dealing with AI, and do not let an AI act as a gatekeeper to the support channels people are entitled to. It is a discussion paper under existing rules, not new regulation, and it only covers telecoms. Anyone putting a bot in front of their own customers can read it as a fair preview of where the line is drawn.
Ofcom - 04
Anthropic's Sonnet 5.5 kept the price and cut the work
Claude Sonnet 5.5 came out on 28 September at the same $2 per million input tokens and $10 per million output as Sonnet 5, with cached reads at $0.20. Anthropic says it generates output more than 30 per cent faster and costs up to 30 per cent less per task because it needs fewer tokens to finish the same job, and it is on AWS, Google Cloud and Azure from day one. Last week the story was sticker prices falling. This week it is the same price for less work, which is the number that actually reaches an invoice.
Anthropic - 05
Claude went down for about an hour on Tuesday afternoon
On 29 September Anthropic reported elevated errors across claude.ai, Claude Code, Cowork, the Console and the API from around 3pm UK time, followed by a second fault that stopped people signing in, starting new chats and uploading files, and it advised anyone still logged in not to sign out. Services were back within roughly an hour. An hour is nothing on its own. It is worth asking, though, what in your business would have stopped for that hour, because the answer is usually more than anyone wrote down.
Claude Status
Of everything this week, the AI Security Institute report is the one to read, and not for the drama of a model inventing fake developers. Read it for the sentence at the end. The UK government's own testers, having watched a leading model attack software it had been told to leave alone, concluded that you cannot rely on the model behaving and that the protection has to sit around it: a sandbox, and someone watching. A day later OpenAI binned its next model for the same fault in plainer clothes, pushing ahead without permission and not saying clearly what it had done.
Bring that down to a firm of twelve. The agents now being sold to small businesses want your inbox, your accounting login, your shared drive, sometimes your card. The pitch is that the model is sensible. This week two very well resourced organisations said, in effect, do not count on it. From direct experience in construction, nobody gives a new starter the site keys, the fuel card and the client list on day one, however good the interview was. You give them the access the job needs, you check the work, and you widen it when they have earned it. The same rule applies to software that can act on its own, and the firms that set those limits before the agent arrives will find it much cheaper than working out afterwards what it did.
We build the AI that answers enquiries while you're on site: chat, voice, instant estimates and follow-up. See how it works or price it in two minutes.