Crabhaus

What matters in AI, and why.

Sat 19 Sep · Issue 067 · 3 min

Issue 067 · Sat 19 Sep

Claude hacked OpenAI; AI intel nearly lit a war

01BizResearchers hacked OpenAI itself using Claude
02BizAn AI intel hallucination nearly sparked a US clash
03AgentsMeta publishes Muse's security architecture

The one that matters

Claude hacked OpenAI: bug-bounty researchers reached the monorepo in under 72 hours

The WSJ reports three researchers in OpenAI's bug-bounty program used Claude Opus 4.8 and Opus 5 to take over ChatGPT and Codex accounts of OpenAI employees in July, reaching connected Outlook, Slack, and GitHub - and proved it with a pull request in OpenAI's internal monorepo. Two bugs, less than 72 hours.

Why it matters

The same news cycle disclosed Gemini breaking into three real companies during a May test - AI-driven intrusion is now routine enough that disclosure norms, not capability, are the story. If three researchers can do this to the best-funded AI lab, the question every security team should sit with is what a state actor's version looks like.

Learn one thing

Cascades: cheap-first model pipelines

Hand-drawn flow diagram titled 'Model cascades: cheap-first pipelines'. A query enters a small cheap model, then a confidence check diamond. A cobalt 'HIGH: SHIP IT' arrow goes straight to an answer envelope; a 'LOW: ESCALATE' arrow rises to a big expensive model that also feeds the answer. Notes: most queries stop at the small model; only the hard residue pays frontier prices.View full-size diagram ↗

What it is

A cost-control pattern where every request goes to a small, cheap model first and escalates to a bigger, costlier model only when the cheap answer looks unreliable. Instead of one model for all traffic, models are chained cheapest-to-strongest and a confidence check decides how far each query climbs. Formalized for LLM APIs in the 2023 FrugalGPT paper.

How it works

The small model answers; a scorer judges the answer via a trained verifier, token probabilities, or agreement across samples. Clear the threshold and the answer ships - the big model never runs. Fail it and the query re-runs on the next tier up. The threshold is the knob: FrugalGPT reported matching GPT-4 accuracy on several benchmarks at up to 98% lower cost, because most traffic is easy.

A concrete example

A support bot: a small local model drafts a reply to every ticket and a verifier scores it against the question. Password resets and order-status queries pass, costing fractions of a cent. A gnarly refund dispute fails the check and escalates to a frontier model, which bills only for tickets that need it. Easy tickets also come back faster.

Why it matters

Inference bills scale with the strongest model you make the default, and high-volume traffic rarely needs frontier quality on every call. A cascade converts that into direct savings without retraining anything, and it degrades gracefully: if the big model is down or rate-limited, the cheap tier keeps answering the easy majority.

What people get wrong: That cascading is routing. A router picks the model before anything runs, so each query is paid for once. A cascade runs the cheap model and judges its output afterwards, so every escalated query pays twice and adds latency. If traffic is mostly hard, a cascade costs more than routing straight to the strong model - the win depends on escalation rate and price gap.

Today's top 5

BizCNN: the US 'almost started a war' after an AI-assisted intel report hallucinated nuclear-weapons components on a Chinese ship.

An 'entirely false' AI-assisted report nearly triggered a US operation against a Chinese vessel, per CNN's sources - the highest-stakes hallucination failure yet reported. The risk story is shifting from lab incidents to AI output feeding state decisions without verification.

AgentsMeta details Muse's security: the agent runs in a sealed VM cell, never holds credentials, and a Sentinel gate vets outbound calls.

Meta assumes the model will be fooled and moves the guarantees outside it: credentials the agent never holds, a gatekeeper it can't override, approvals that bypass the conversation. That's the blueprint for anyone shipping agents with real account access - and a direct answer to Simon Willison's lethal trifecta.

LabsAlibaba DAMO open-sources RADAR, a compact CT-scan model detecting cancer and nearly 150 conditions across 18 abdominal organs.

A lightweight open-weights model that reads contrast CT scans and flags nearly 150 conditions puts serious diagnostic AI within reach of any hospital workstation, no cloud dependency. Shipping it open is also a distribution play: medical AI adoption has been throttled by procurement, not capability.

ResearchMeta's Proactive Memory Agent adds a reminder model beside unmodified agents, lifting pass@1 up to 8.3 points on Terminal-Bench 2.0.

A second model that watches the trajectory and injects reminders at the right moment lifts coding-agent success without touching the action agent. Bolt-on memory that works with any harness - and the timing of reminders, not their volume, is what carried the gain.

AgentsClaude Code 2.1.277 reads AGENTS.md when no CLAUDE.md exists, built on 'mods', its upcoming way to customize the harness.

Small change, real signal: the cross-vendor AGENTS.md convention won, and Anthropic building the support on 'mods' previews a customizable Claude Code harness. If you maintain both CLAUDE.md and AGENTS.md in a repo today, one of them just became redundant.

See the full wire feed →

Quick check

Was this issue useful?

Get Crabhaus in your inbox

A concise daily briefing on the AI developments worth understanding.