🔍Weekend Roundup: your Claude chats might not be as private as you thought

Hey {{first name | there}}. This week, a frontier model was handed a vending machine to run for a year, and it lied, colluded, and broke eleven separate truces to come out on top.

Funny, until you remember the same class of agent is being wired into real pipelines with real credentials.

The thread running through this issue is less about what AI can do, and more about whether the guardrails around it were ever as solid as everyone assumed.

Worth a look at which of yours would hold.

In today’s roundup:

You will also find upcoming events, a podcast worth listening to, and curated job opportunities across the ecosystem.

Let’s dive in👇🏼

Closed models refuse to help researcher swat Linux bug
A researcher chasing a ripgrep segfault kept hitting OpenAI's cybersecurity classifier, which blocked the heap analysis he needed. He finished the job with two open-weight models instead, GLM-5.2 and Kimi K3.

Claude Opus 5 became downright ruthless when tasked with running a vending machine
In a year-long simulation, Opus colluded, broke 11 price truces, bribed rivals, and lied to suppliers to win. It set a record cash balance and made a strong case against unsupervised long-running agents.

I Inspected My Take-Home Interview Project. It Was a Whole Operation
A developer's take-home project hid malware in its git hooks, wired to fire the moment a candidate ran a git command.

Azure Cosmos DB Flaw Exposed Platform-Wide Key That Could Access Any Database
Wiz escaped Cosmos DB's Gremlin sandbox via .NET reflection, reaching a signing key that could pull the primary key for any account across tenants and regions. Microsoft closed the entry point in 48 hours. 

Excuses like 'AI did it' don't exist in the eyes of the law
Legal experts say when an agent breaks into another company's systems, existing law pins liability on the operator, not the AI. Human-intent frameworks don't bend for autonomous systems, and disclaimers rarely hold.

GitHub Introduces Default "Cooldown" Policy for Dependabot Version Updates
After watching poisoned packages get auto-merged within minutes of release, GitHub gave Dependabot a three-day cooldown so scanners can catch malicious versions first. Security updates skip the wait.

AWS, Google Cloud, Microsoft Azure, and Cloudflare now all offer agent sandboxes. None built them the same way.
AWS, Google, Azure, and Cloudflare all ship isolated execution for agent-written code now, but on four different stacks, Firecracker, gVisor, Hyper-V, and Containers, each with its own limits and lifecycle.

How the controller-runtime Cache Actually Works, and Why Your Controller Does Not Crash the API Server
A deep tour of controller-runtime's cache: Get and List hit a local in-memory store kept fresh by watch, while writes go straight to the API server. Get that wrong and you leak gigabytes or trip over stale reads.

Remix 3 Beta Preview Ditches React for a Web-Standards Full-Stack Framework
Remix 3's beta rebuilds the framework off React entirely, onto Fetch API routes, web Responses, and a forked Preact. Remix 2 apps get pointed to React Router 7 instead. Reactions are sharply split.

PSA: Your Claude shared chats and Artifacts may have ended up on Google
Reddit users found shared Claude conversations indexed by Google, reportedly including medical records and children's contact details. Anthropic says links only surface when users post them somewhere crawlable.

Turning 10x developers into 10x value
Coding is only 21% of a developer's time, so AI coding tools alone buy maybe 5-10% throughput. The teams winning with AI are banks and telecoms, because they already run rigorous pipelines and governance.

Mark your calendars!