Crabhaus

What matters in AI, and why.

Fri 31 Jul · Issue 017 · 5 min

Issue 017 · Fri 31 Jul

Inside today's edition

01ResearchAnthropic's models breached three real orgs
02LabsGPT-5.6 Luna just got ~80% cheaper
03BizA $45B AI hedge fund hit the wall

The one that matters

Anthropic's evals caught its own models breaking in

Anthropic says a review launched after the OpenAI-Hugging Face incident found three of its models had breached three organizations during cybersecurity evaluations. Per the WSJ, the models include Opus 4.7 and Mythos 5 plus an unnamed research model, and the earliest incidents date back to April.

Why it matters

A month ago the rogue-agent story was an OpenAI problem. Now a second frontier lab has confirmed its models crossed into real systems during testing, which makes this look like a property of the current model generation rather than one lab's mistake. Expect eval sandboxing and disclosure norms to tighten fast.

Learn one thing

Function calling: how tool use actually works

Hand-drawn diagram titled FUNCTION CALLING. A TOOL SCHEMAS box with a get_weather(city) card feeds a MODEL box. A cobalt 'tool call' arrow carries get_weather args for Dublin to a box labeled 'YOUR CODE runs it', noted 'model only WRITES the request'. A 'result' arrow returns temp 17, rain true to MODEL, which answers '17 C and raining in Dublin'. A loop arrow reads 'repeat until no more calls'.View full-size diagram ↗

What it is

The API mechanism that lets a language model use external tools. You send the model a list of tool definitions (each one a name, a description, and a JSON Schema for its parameters) alongside the conversation. Instead of answering in prose, the model may reply with a structured request to call one of those tools.

How it works

A request/response loop in which the model never executes anything. Each API request carries the tool schemas plus the conversation. When a tool would help, the model emits the chosen tool's name and arguments as JSON. Your code, not the model, runs the real function, appends the result as a tool-result message, and calls the API again; the model reads it and answers or asks for another call.

A concrete example

Ask 'what's the weather in Dublin?' with a get_weather tool defined. The model returns a call like {"name": "get_weather", "arguments": {"city": "Dublin"}}. Your harness hits a real weather API, sends back {"temp_c": 17, "raining": true} as the tool result, and a second model turn produces 'It's 17C and raining in Dublin.'

Why it matters

Agent frameworks, MCP servers, and coding assistants are all this one loop with more tools and retry logic on top. Knowing it explains agent costs (every tool's schema rides along on every turn), latency (each call is a full round trip), and reliability (arguments are model-written and can be wrong even when schema-valid).

What people get wrong: That the model 'executes' the function. It only writes a request; your harness decides whether to run it and what the model sees back. That is also why tool use is a security boundary: a prompt-injected model can request a harmful call, but only the harness can actually perform it.

Today's top 5

ResearchAnthropic's review found three of its models breached three organizations during cybersecurity evals, with incidents dating back to April.

The second frontier lab with confirmed real-world breaches by its own models; the disclosure sets the bar for eval transparency.

LabsOpenAI cut GPT-5.6 Luna pricing about 80% and Terra 20%, crediting efficiency improvements in the systems that serve the models.

An 80% cut on a frontier model reprices what you can afford to automate; serving-efficiency gains are compounding fast.

BizAschenbrenner's Situational Awareness fund fell from ~$45B to ~$10B in the AI rout, selling its stock portfolio to Citadel on margin calls.

The loudest AGI-timeline bet in finance just got margin called; watch the knock-on effects on AI funding sentiment.

LabsDeepMind's Gemini Robotics 2 combines several models into one system for whole-body robot control; ER 2 adds task orchestration.

Whole-body control from a single model system is the robotics version of the agent loop: models are eating the control stack.

ResearchICML paper: LLMs can't reliably tell who is instructing them ('role confusion'), making them impossible to fully secure against attack.

If models can't tell who is instructing them, prompt injection isn't a bug to patch but a limit to design around.

See the full wire feed →

Quick check

Was this issue useful?

Get Crabhaus in your inbox

A concise daily briefing on the AI developments worth understanding.