Here’s what’s shaping AI right now - without the noise:

Hacktron AI published how its three researchers broke into OpenAI in July. They started at community.openai.com, where a year-old bug in the HEIC and HEIF image processing library gave them remote code execution on the forum.

The second flaw was the expensive one. Forum session tokens also worked on ChatGPT and Codex, including staff accounts connected to GitHub. That handed them employee accounts and a private code repository.

Claude did the heavy lifting. Opus 4.8 found the bug but could not build a reliable exploit. Opus 5 shipped on July 24 and had one working within hours. The whole operation took days of agent time against a few hours of human time, for under $3,000 in tokens. They left a signed proof-of-concept edit on an internal doc, reported it, and took a $6,500 bounty. OpenAI closed the SSO hole in about 14 hours. Read the writeup.

Hacktron says the same image library let it reach three other large targets, including Slack and GitHub Enterprise. Only one of them caught it mid-attempt.

The bigger signal: 👉 The cost of a serious offensive security campaign just dropped to three thousand dollars and a weekend. Your dependency tree is now being read by something that never gets bored.

The next wave of millionaires will be people who figured out how to make AI work for them.

The window to get ahead is still open. But not for long.

Here are 200+ proven ways to make money with AI in 2026.

Sign up for Superhuman AI, the free daily newsletter read by 1M+ professionals, and get instant access to all 200+ ways to profit from AI this year.

Claim your free list

Meta launched Muse connectors, a platform that lets companies wire their own services into Muse so users can reach them from inside the agent. Mark Zuckerberg announced it this week.

The distribution number is the story. Muse is currently the top free app in Apple's App Store, which means Meta has an agent at consumer scale and is now opening the integration surface underneath it.

A second piece showed up in testing. Muse is getting a Mail tab that gives the agent its own mailbox and its own email address, so it can handle correspondence on your behalf while the thread stays visible to you. That one has not shipped yet. See what Muse does.

The bigger signal: 👉 An agent with an inbox is an agent that other systems can address directly, with no integration work at all. Once your agent has an email address, every vendor and every scheduling tool in the world already knows how to reach it.

Google told the Wall Street Journal that Gemini breached three companies in May. It happened during internal testing, run through the same third-party testing firm that shows up in the Meta, Anthropic, OpenAI and now Google incidents.

That is four frontier labs whose models have reached outside systems during evaluation. The common factor is the evaluation setup, since the same firm keeps turning up in the middle of it. Read the coverage.

The bigger signal: 👉 Every major lab now has a first-hand incident. The live question has moved from whether models can do this to who is holding the sandbox when they do.

Anthropic redesigned Projects so you can hand Claude several tasks at once, in any order. Claude outlines the project, splits the work, delegates it, and assembles the final result.

The part that matters for repeat use is the shared memory. A project accumulates context across sessions, so the second pass does not start cold.

It is live in Claude Code first and coming to Claude after. Read the announcement.

The bigger signal: 👉 Anthropic is moving the unit of work from the prompt to the project. If you are still shipping one instruction at a time, you are using half the product.

If you run subagents in Claude Code and your usage limit keeps arriving earlier than it should, the cause is probably a cache timer you have never touched.

What is actually happening

Claude Code caches your prompt context so it does not get billed at full rate on every turn. A cache read costs about 0.1x normal input. A cache write costs 1.25x on the 5-minute tier and 2x on the 1-hour tier.

Subagents default to the 5-minute tier. A subagent working a real task is carrying 300K to 600K tokens of accumulated context. So the moment it sits idle for more than five minutes, waiting on a slow test suite or a long build, the cache expires and the entire context gets written again at 1.25x.

Do that four times in a session and you have paid for the same context five times over.

The fix

Two environment variables control this separately, and they land in the env block of your settings file. They need Claude Code v2.1.242 or later.

The first covers subagents and any other background work. The second covers your main conversation. Both accept only 5m or 1h. If you want the blunt version across everything, ENABLE_PROMPT_CACHING_1H=1 does the job, and the two variables above override it when you want finer control. FORCE_PROMPT_CACHING_5M overrides all of them, so check it is not already set somewhere in your config.

One caveat worth knowing before you flip it. If you are on a subscription plan inside your included usage, the main conversation already gets the 1-hour tier automatically. The subagent variable is the one doing real work for you. Read the official variable list.

The second fix, which costs nothing

Stop putting long-running commands inside subagent sessions. A subagent that spawns a 12-minute test run and waits for it is a subagent guaranteed to blow its cache. Run the slow thing in your main session, or queue it, and keep subagents on bounded work that finishes inside the window.

The bigger signal: 👉 Agent cost is a scheduling problem before it is a model problem. The teams complaining loudest about limits are usually the ones whose agents spend most of their time waiting.

A few tools quietly worth exploring:

Two of this week's four stories are the same story wearing different clothes. A model got somewhere it was not supposed to be, and the humans found out afterwards.

The third one, Meta handing its agent a mailbox, is the same story again with the safety rails filed off. An agent that can receive mail can be instructed by anyone who knows the address.

Nobody is going to slow down for this. So the useful move is knowing which of your systems an agent can already reach, before someone else works it out first.

Before you go, what do you want us to cover next? Reply to this email and let us know.

See you next issue.