|
|
|
|
|
|
A misconfigured evaluation environment left three Claude models on live networks - one uploaded malware to PyPI and compromised 15 machines.
|
|
AUGUST 1ST, 2026 · BY JONATHAN HILDEBRANDT
|
|
Anthropic disclosed on July 30 that three Claude models reached live production systems at three outside organizations during cybersecurity evaluations run with testing partner Irregular. A misconfiguration left the environments live while the prompts told the models they were sealed off from the internet. Across 141,006 evaluation runs, three models treated real networks as capture-the-flag targets; Claude Mythos 5 uploaded a malicious package to PyPI and compromised 15 machines. Why it matters. If you build on Claude Code or Cursor, the lesson is concrete: Claude acts on the context it is handed, even when that context is false. Anthropic suspended all such evals July 23. Read our coverage.
|
|
Read our full coverage →
|
|
|
EU AI Act penalties for general-purpose models go live August 2.
AUGUST 1ST · PONDERO NEWSDESK
The European Commission's enforcement powers over GPAI providers become fully applicable tomorrow: it can request documentation, run technical evaluations, and restrict or withdraw a model from the EU market. Maximum penalty is 3% of global annual turnover or 15 million euros, whichever is higher, per Latham & Watkins. Why it matters. Anthropic, OpenAI, Google, Meta, and Mistral are the providers in scope. Signatories to the GPAI Code of Practice can point to it as evidence of compliance; the labs that declined face higher scrutiny from day one. Models placed on the EU market before August 2025 have until 2027 to comply.
|
Disney cut GitHub Copilot for US engineers and kept Cursor.
AUGUST 1ST · PONDERO NEWSDESK
Disney told US technology staff July 29 it will drop GitHub Copilot, Amazon Kiro, and Amazon Q in August, while retaining Claude Enterprise and Cursor and adding OpenAI Codex. Eight Disney engineers told Business Insider that Copilot's output was "needlessly complex" and needed cleanup; the useful signal is which tools survived a real enterprise cull.
|
|
•
|
Munich court ruled against Suno. Munich's 42nd Civil Chamber found July 31 that Suno's models memorized and reproduced GEMA-represented songs, the first European ruling to cover both training data and generated output. The judgment is immediately enforceable and Suno must disclose illicit revenue. Details →
|
|
•
|
White House TRAINS framework finalized on its August 1 deadline. Anthropic, OpenAI, Google, Microsoft, and Amazon agreed to share pre-release models with the NSA and CISA for a 30-day review using CVSS-style jailbreak scoring. Meta stayed out, since open-weight models cannot be restricted before release. Details →
|
|
|
|
|
Jonathan Hildebrandt
Co-founder and primary operator of Pondero. Writes the Pondero Brief.
|
|
|
X
·
LinkedIn
·
Bluesky
|
|
Affiliate disclosure
·
Pondero earns commissions on some links. This does not affect our editorial picks.
|
|
