In partnership with
In Todayโs Issue:
๐ด OpenAI trains an AI whose only job is breaking AI
๐ฐ TSMC's profit jumps 77% to a record
๐ง Thinking Machines gives away a 975B-parameter model
โก New York freezes big new data centers
โจ๏ธ OpenAI's first gadget sells out in a day
๐ธ A frog bacterium that erased tumours in mice
โจ And more AI goodnessโฆ
โก The Signal
Everything the industry can automate, it is now automating, including the job of checking its own work. OpenAI's GPT-Red is the clearest version of that yet: a model trained at frontier scale for the sole purpose of attacking OpenAI's other models, and it is roughly six times better at it than the humans who used to hold that job. The gain is real, and so is the shape of it. The only organisation that can run this test is the one being tested, which is precisely the gap Demis Hassabis spent this week arguing needs filling, in his call for a standards body that vets frontier models before release. Meanwhile the parts of this industry that cannot be automated are pushing back hard: TSMC posts a record quarter because demand for AI silicon is insatiable, and New York responds by freezing permits for every large new data center in the state. Compute scales with money. Permission scales with politics, and politics is not in a hurry.
All the best,
Kim Isenberg
(TSMC. Credit: REUTERS)
๐ฐ TSMC's Profit Jumps 77% to a Record
The company that physically makes the AI boom just posted the numbers to prove it. TSMC reported second-quarter net profit of T$706.6 billion ($21.99 billion), up 77% year on year and comfortably past the T$632.6 billion analysts had penciled in. It builds the chips for Nvidia and Apple, which makes its order book the closest thing the industry has to an honest demand gauge: whatever the labs say about their roadmaps, someone has to etch the silicon first.
๐ tl;dr: The AI boom stopped being a spending story this quarter. TSMC is the one collecting.
(Mira Murati, founder of Thinking Machines Lab. Credit: Getty Images via TechCrunch)
๐ง Thinking Machines Gives Away a 975B-Parameter Model
Mira Murati's lab has finally shipped a model, and it gave the weights away. Inkling is a 975-billion-parameter mixture-of-experts model with 41 billion active per token, trained from scratch on 45 trillion tokens of text, images, audio and video, with a context window up to 1 million tokens and a dial for how hard it thinks. Refreshingly, Thinking Machines does not claim the crown: its own charts show Inkling competitive among open-weights models rather than beating the closed frontier, with the pitch being that you can fine-tune it yourself on Tinker and run it for a fraction of the tokens.
๐ tl;dr: The first real model from AI's most-watched startup is open, multimodal, and honest about not being number one.
(New York Governor Kathy Hochul. Credit: Getty Images via TechCrunch)
โก New York Freezes Big New Data Centers
New York just became the first state to stop the build-out, and it did so the same week TSMC posted record AI profits. Governor Kathy Hochul signed an executive order barring new permits for data centers of 50 megawatts or larger, freezing more than a dozen projects until the state finishes an environmental review she expects to take about a year. "These data centers can only be built, should only be built in places that want them," she said in Brooklyn, and the politics are behind her: only 10% of Americans tell Pew they are more excited than concerned about AI in daily life.
๐ tl;dr: The chips are selling out and the buildings are being blocked. Guess which one is harder to fix.
๐งช Map Your Assistant's Blast Radius
Find out what your assistant can actually reach, before you find out the hard way. Today's Featured Story is OpenAI's own agent being talked into selling a $79 item for $0.50 by a forged message hidden in text the agent was reading.
Why it helps: That kind of attack only works where two things overlap: your assistant reads text written by strangers, and your assistant can do something that costs you. Most of us have never actually checked where those two overlap in our own setup.
Try this: Ask your assistant, in your own account:
"List every tool, connector and data source you can access right now. For each one, tell me two things: can it pull in text written by someone outside my organisation, and can you take an action with it that I could not easily undo?"
Anything that answers yes to both is where you want to stay in the loop.
๐ฌ Watch This
OpenAI's developer update for Codex shows what the tool looks like once it stops being a coding assistant and starts behaving like a team of them. In roughly seven minutes it walks through GPT-5.6 Sol and the new Ultra mode, running parallel tasks side by side, upgrades to computer and browser use, inline code and document editing, pull-request reviews, Codex on mobile, and Sites for publishing straight from a thread. Stay to the end: an unreleased feature makes a brief, deliberate cameo.
"If you stop to think about it, weโve essentially found a way to make sand think."
โ Demis Hassabis, CEO of Google DeepMind, in A Framework for Frontier AI and the Dawning of a New Age
(Demis Hassabis. Credit: Getty Images via TechCrunch)
Hassabis wrote that line in the same essay that asks the US to build a Frontier AI Standards Body, modelled on FINRA, the self-regulatory body that polices US broker-dealers, which labs would let review their models up to 30 days before release. On a day when OpenAI is celebrating how well it grades its own homework, the wonder and the warning arrive in the same breath.
Anthropic made an ad about AI risk, and the internet decided it had gone too far. The spot asks "Who's gonna hit the brakes if we need to?" over footage of a military cemetery, and the reaction was immediate. Sam Altman was among those piling on: "i thought this was satire, kept looking for the handle to be spelled c1audeai or something," he posted, which is a notably sharp jab from the CEO of the lab Anthropic exists to compete with.
(The frame from Anthropic's ad that drew the backlash. Credit: Anthropic, via @ZackKorman on X)
The awkward part is that Anthropic has spent years arguing exactly this point in white papers without anyone objecting. Put it on a graveyard and set it to music and the same argument reads as emotional blackmail, which is a lesson about advertising rather than about AI.
Safety Just Learned to Scale Like Capability
The Takeaway
๐ OpenAI trained GPT-Red, an internal-only automated red teamer, at the compute scale of its largest post-training runs, spent entirely on making models harder to trick.
๐ On a mirrored version of a public prompt injection arena, GPT-Red broke 84% of scenarios against GPT-5.1. Human red teamers managed 13%.
๐ It hijacked Vendy, a live vending machine agent, into selling a $79 tungsten cube for $0.50 and cancelling another customer's order.
๐ Trained against those attacks, GPT-5.6 Sol now fails on 0.05% of GPT-Red's direct injections, roughly 6x fewer failures than OpenAI's best model four months ago.
For years, AI capability has scaled with compute while AI safety scaled with headcount. That asymmetry is the whole problem. You can buy your way to a smarter model, but you could not buy your way to more people willing to sit and think up devious ways to break it. On Wednesday OpenAI published GPT-Red, an internal-only model whose entire job is attacking OpenAI's other models, and with it a claim that matters more than any benchmark: the defence can now be scaled the same way the offence was.
The attack it hunts is prompt injection, and it is simpler than it sounds. When you ask an assistant to read a webpage, summarise an email, or work through a code repository, the model reads whatever text is in there. An attacker can hide instructions in that text. The model, having no reliable way to tell your instructions from the page's, sometimes just follows them.
(How a prompt injection works. Credit: OpenAI)
GPT-Red learns to do this through self-play: it fires attacks at a pool of defender models while those defenders learn to resist, so each side drags the other upward. The headline number is stark. On an internal mirror of a public prompt injection arena run by Dziemian et al., GPT-Red succeeded on 84% of scenarios where human red teamers managed 13%. Read that carefully, because OpenAI does not overstate it: the target there was GPT-5.1, an older model, not the current one. It also found an attack class humans had missed, "Fake Chain-of-Thought", which forges the model's own reasoning steps. That trick worked over 95% of the time on GPT-5.1 and now lands below 10% on GPT-5.6 Sol.
The most uncomfortable demonstration is not a benchmark at all. GPT-Red rehearsed in simulation against a copy of Vendy, a real autonomous agent that runs a vending machine business, then transferred the winning attack to the production system. It forged an approval message and talked Vendy into selling a $79 tungsten cube for $0.50, and into cancelling another customer's order. OpenAI says it disclosed the vulnerabilities and that new safeguards are being tested.
(GPT-Red rehearses on a simulated Vendy, then transfers the attack to the live agent. Credit: OpenAI)
The results are real and the caveats are worth naming. GPT-Red is internal-only, so nobody outside OpenAI can run it against OpenAI's models, or anyone else's. The 0.05% failure rate is measured against the attacker OpenAI trained, which is the one attacker its models have been explicitly hardened against. Every number here comes from the company being graded, the pre-print is still to come, and the same post announces that several injection benchmarks are already saturated above 97%, which is less a victory than a sign the tests keep needing replacement.
Why it matters: The moment you let an assistant read your email, browse the web, or touch a repository, every piece of text it reads becomes a possible instruction, and the Vendy hijack shows that is already happening to live agents handling real money. GPT-Red is the strongest evidence yet that this class of attack can be pushed down fast, and the strongest reminder that the only people currently able to run that test are the people selling the model.
Sources:
HR and IT need to work as one. Here's how
Onboarding, offboarding, role changes, leaveโevery employee lifecycle moment requires HR and IT to move together. When they don't, people fall through the cracks. Access delays mount. Compliance risk creeps in.
This guide gives HR and IT leaders a practical communication framework to close the gaps, standardize handoffs, and keep the employee experience seamless from day one to last day. Free downloadโbuilt for ops teams that need it to actually work.
The object: No chart today. Instead, the most revealing artefact of the week. The Codex Micro is the first piece of hardware OpenAI has actually put on sale, a $230 macropad built with the small keyboard maker Work Louder on the chassis of its Creator Micro 2. Thirteen mechanical keys, a rotary encoder and a joystick, and six frosted Agent Keys that glow with the live status of your Codex threads. White for idle, blue for thinking, green for done, amber when it needs you, red when it broke.
The lesson: It sold out. Orders opened Wednesday and OpenAI's own store already lists it as out of stock, which tells you something the benchmarks do not. People running agents want a dashboard, an ambient way to see what six parallel agents are doing without opening six threads. And OpenAI did not build it alone: it went to a niche community keyboard shop that already had the right chassis, and shipped a co-lab drop rather than a product line. That is a company listening to the people actually using the thing.
The caveat: "Sold out" on a deliberately limited run is a marketing outcome as much as a demand signal, and neither company has said how many units existed. It is a $230 gimmick for a workflow most people do not have yet. Treat it as a signal about where agent interfaces are heading, not as evidence of a hardware business.
๐ธ The Frog Gut That Erased Tumours in Mice
โก Bottom line
A bacterium living in Japanese tree frogs wiped out colorectal tumours in mice after a single injection.
๐ก Why it matters
Nobody used AI to find it. A team screened animals one by one, which is exactly the bottleneck AI keeps promising to break.
๐ What it means
The next cancer drug may already exist inside some animal. Finding it is a search problem, and search is what machines do.
Think of the animal kingdom as a library nobody has finished reading. Every species carries its own community of gut bacteria, shaped by millions of years of chemical warfare against things trying to kill it. Somewhere on those shelves are molecules we would very much like to have. The problem has always been that reading the library is done by hand, one page at a time.
A team at JAIST in Japan went and read a few pages. They collected gut bacteria from three animals, a Japanese tree frog, a fire-bellied newt and a grass lizard, grew the strains on plates, and started testing them against cancer cells. This is unglamorous, slow, entirely manual work, and it is worth looking at what it actually involves.
(The screen: gut bacteria from a frog, a newt and a lizard, cultured strain by strain. Credit: Iwata et al., Gut Microbes, 2025)
One strain stood out. Ewingella americana, pulled from the gut of the tree frog, did something unusual when injected into mice carrying colorectal tumours: it cleared them completely, in every treated animal, from a single intravenous dose. The bacterium works two jobs at once. It kills tumour cells directly, and it drags the immune system to the scene, pulling in T cells, B cells and neutrophils that finish the job.
(How it works: the bacterium homes to the tumour, kills cells directly, and recruits immune cells. Credit: Iwata et al., Gut Microbes, 2025)
The reason this is not obviously reckless is where the bacterium goes. It collects almost entirely inside tumours and leaves healthy organs alone, clearing the bloodstream with a half-life of about 1.2 hours. Over 60 days the treated mice showed mild, temporary inflammation and no lasting damage: blood counts and vital organs came back indistinguishable from untreated controls.
(Safety check: blood counts and liver, spleen, heart, lung and kidney tissue show no significant difference from controls. Credit: Iwata et al., Gut Microbes, 2025)
Now the part that belongs in this newsletter, and let us be clear that this is our framing rather than the authors': there is no AI anywhere in this study. That is the point. Three species were searched because three species is what a lab can handle. There are roughly 8,000 amphibian species alone, each with hundreds of bacterial strains, each strain making dozens of compounds. The search space is astronomically larger than the number of people willing to pipette their way through it, and this is precisely the shape of problem that protein-structure prediction and microbiome models are built for: they do not invent the cure, they tell you which shelf to look on. A result this clean, found by reading three pages essentially at random, is an argument about how much is still unread.
The honest caveat: mice are not people, and oncology is a graveyard of therapies that erased tumours in rodents and did nothing in humans. Using bacteria against cancer is not new either. Surgeons were injecting Coley's toxins into tumours in the 1890s, and BCG, a live bacterium, has been standard treatment for early bladder cancer since the 1970s. What has never worked reliably is the systemic version, putting bacteria into the bloodstream to hunt tumours elsewhere in the body, which is exactly what this is. Early, elegant result. Not a treatment.
10x the context. Half the time.
Speak your prompts into ChatGPT or Claude and get detailed, paste-ready input that actually gives you useful output. Wispr Flow captures what you'd cut when typing. Free on Mac, Windows, and iPhone.