Auto mode becomes Claude Code's default, catching 800 dangerous commands human reviewers missed

AI safety

Auto mode becomes Claude Code's default, catching 800 dangerous commands human reviewers missed¹

Starting 14 August, new Claude Code sessions on Pro, Max, and Team plans run in auto mode by default.¹ A classifier now decides whether to run each tool call, stopping only what Anthropic calls "irreversible, destructive, or aimed outside your environment."¹ Every earlier session instead waited on a human's approval for each call.¹ In a study Anthropic designed and ran itself, 1,053 paid professional testers each had one permission prompt covertly swapped for a dangerous command.¹ Testers caught it 13.6% of the time (143 of 1,053), and auto mode caught it 89% of the time (937 of 1,053).¹ Where the two disagreed, auto mode blocked 800 commands a tester had approved, against 6 commands testers blocked that auto mode had allowed.¹ Anthropic attributes part of the gap to fatigue.¹ It says testers' catch rate fell from about 17% early in a session to about 5% after 50 or more prior prompts, while the classifier's rate held flat.¹ Adversarial hardening with the UK's Apollo Research cut the classifier's own miss rate on a held-out attack set from 12% to 7%.¹ TechCrunch, an outside newsroom, reported the same rollout date and study figures.²

Coding agents

GLM-5.3's Terminal-Bench score rises sixfold to 28.3 from post-training alone, Z.ai says³

Z.ai released GLM-5.3 on 14 August, built on the same base model as GLM-5.2, with every reported gain coming from post-training.³ Terminal-Bench 3.0 rose from 4.6 to 28.3 and DeepSWE v1.1 from 46.2 to 66.9, both scored under evaluation rules Z.ai designed itself.³ The company also reports a cyber-capability jump it says surprised its own researchers, describing GLM-5.3 as reasoning "across multiple stages of exploitation, forming coherent plans for complete exploitation chains" rather than spotting isolated flaws.³

Z.ai's self-reported cyber-benchmark scores for GLM-5.3, run inside its own evaluation harness.³

Model	CyberGym	ExploitBench
GLM-5.3	84.5%	54.4%
GPT-5.6 Sol	83.6%	76.5%
Mythos 5	83.8%	78.0%

Working with security teams in China since GLM-5.2, Z.ai says the model has found 2,436 vulnerabilities across 269 open-source projects after expert review, one dating to 1981.³ Only 53 are disclosed publicly so far, with the rest under embargo while open weights stay unreleased for what the company calls "safety evaluation and hardening."³ Unite.AI independently confirmed the release date and the weights delay, without re-running any of Z.ai's benchmark claims.⁴

Inference infrastructure

OpenAI says its Ultrafast tier runs GPT-5.6 Sol up to 14 times faster without shrinking the model⁵

OpenAI began a limited preview of Ultrafast on 13 August, an API tier it says runs GPT-5.6 Sol at up to 14 times the speed of standard processing and up to 750 output tokens per second, built on a hardware partnership with Cerebras.⁵ OpenAI frames the release as breaking a standing constraint: "until now, getting real-time speed typically meant choosing a smaller or more specialized model."⁵ It points to incident response, financial research and security, live customer support, commerce, and research loops that previously ran as overnight batch jobs as the workloads Ultrafast opens up.⁵ Access is limited for now to "a select group of customers," expanding "as capacity grows."⁵ TechCrunch corroborated the speed figures and the Cerebras partnership the same day.⁶

Model release

Gemini 3.7 Flash trails GPT-5.6 Terra and Claude Sonnet 5 on Google's own benchmark table⁷

Google released Gemini 3.7 Flash on 13 August, three weeks after Gemini 3.6 Flash, calling it "our most intelligent workhorse model yet for coding and agents."⁷ VentureBeat calls its own read of Google's benchmark table mixed.⁸ Gemini 3.7 Flash scores 85.8% on Terminal-Bench 2.1 against GPT-5.6 Terra's 87.4%, and it trails Terra on Terminal-Bench 3.0 and OSWorld-2.0.⁸ Claude Sonnet 5 beats it on Agent's Last Exam desktop tasks, 33.3% to 26.3%.⁸ On Artificial Analysis's Intelligence Index, Gemini 3.7 Flash scores 56, up from 3.6 Flash's 52 but well below Claude Opus 5's 63.⁸ The launch pairs the model with a temporary price cut, to $0.75 per million input tokens and $3.75 per million output tokens, half the standard rate, through the end of 2026, before it rises to $1.50 and $7.50 on 1 January 2027.⁸ SemiAnalysis, cited by VentureBeat, argues Google is prioritizing cloud-infrastructure revenue over keeping its own models at the frontier, pointing to a delayed Gemini 3.5 Pro that Google has not confirmed or denied.⁸

AI security research

Panfilov and colleagues steal a model's hidden reasoning by replaying its encrypted trace into a weaker sibling⁹

A team led by Panfilov found that Anthropic, OpenAI, and Google all return a model's chain-of-thought reasoning to API clients as encrypted opaque blocks.⁹ Those blocks, the team found, are interchangeable across sessions, users, and even different models in the same provider's lineup.⁹ Replaying an encrypted trace from a strong model into a weaker, less-guarded sibling from the same provider forces the weaker model to decode and output the trace in plaintext, without attacking the strong model directly, and the authors demonstrated the technique against all three providers.⁹ Decoding 315,320 reasoning blocks scraped from public code repositories, the paper's abstract reports recovering 367 personally identifiable information artifacts and 182 credentials.⁹ The Hacker News, citing the same study, gives a different count for genuine, non-benchmark user sessions alone: 704 privacy artifacts, including 126 credentials made up of 62 API keys, 33 passwords, 24 access tokens, and 7 private keys.¹⁰ The two counts do not reconcile in what either outlet published.⁹¹⁰ The authors disclosed the flaw responsibly before publication, and the providers have since shipped mitigations.⁹ The Hacker News reports that the paper's own reproducibility statement says the main extraction attack no longer works as of August 2026.¹⁰

Materials science

IonNet flags nearly 63,000 candidate battery-electrolyte materials from a 5-million-compound search¹¹

A Cornell-led team published IonNet, a transfer-learning model, in early August.¹¹ Screening roughly 4,500 stable candidate compounds, it flagged 87 as fast-ion conductors: materials whose ionic conductivity exceeds 1.0×10⁻⁴ siemens per centimeter at room temperature, the property that makes a solid usable as a battery electrolyte.¹¹ Expanding the search to nearly 5 million element-substituted compositions, IonNet flagged 62,935 further candidates.¹¹ A separate screen of 154,718 Materials Project compounds, filtered for stability and electronic-conductivity criteria to 4,583 candidates, turned up 102 more.¹¹ Each IonNet prediction takes seconds against the 23,000 to 52,000 CPU-hours a single physics-based simulation would need, roughly an eight-order-of-magnitude speedup, and of the 20 top predictions the team checked against that slower simulation, 13 held up as fast-ion conductors.¹¹ Interesting Engineering independently confirmed all four headline figures on 10 August, placing the paper's publication in the week before this edition rather than on it.¹²