What You Need to Know: Anthropic published third-party evals showing Claude models in auto mode stopped every one of 720 indirect prompt injection attempts across 72 scenarios. The same system also outperformed human reviewers at rejecting harmful commands mid-session. Builders should watch how other labs respond to these safety claims and whether independent red teams can reproduce the results.

Top Story

Anthropic is making auto mode the default for new Claude Code sessions on Pro, Max, and Team plans starting August 14. The change follows internal testing and a third-party evaluation by Trajectory Labs that found zero successful indirect prompt injection attacks against Claude Fable 5, Opus 5, or Sonnet 5 in auto mode across 720 attempts. In a separate test with 1,053 paid users, auto mode blocked 89% of swapped dangerous commands while only 13.6% of humans refused them. Simon Willison notes the remaining 11% failure rate and highlights risks from malicious third-party packages that could still exfiltrate data even under auto mode. The evals focus on prompt injection and data exfiltration but do not yet cover every possible supply-chain attack. Internally at Anthropic, almost every person already uses auto mode, and Cat Wu stated that for the main risk categories the system performs better than average human reviewers. Thariq Shihipar described the work as addressing the lethal trifecta of risks. Developers using coding agents should test auto mode on non-critical repositories this week and compare it against their current approval workflows. Willison remains concerned that confirmation fatigue in human approval flows is real and that auto mode still leaves room for attacks involving malicious packages such as one that instructs agents to run “uvx fetch-model-files” before tests. He has previously predicted a challenger-disaster-scale incident for coding agents in 2026 and wants independent confirmation before fully trusting the new safeguards. Source: simonwillison.net

Model Updates

Generative design of novel bacteriophages with genome language models: r/MachineLearning Researchers used frontier genome language models Evo 1 and Evo 2 to generate complete viable bacteriophage genomes based on the ΦX174 template. The models produced sequences with realistic genetic architecture and targeted host tropism. Experimental validation yielded 16 functional phages that showed substantial evolutionary novelty and had never existed in nature. This marks the first reported case of whole-genome generative design that resulted in viable organisms. The work demonstrates that current genome-scale language models can now output full-length functional sequences rather than short gene fragments. Teams working on synthetic biology or genome-scale modeling should examine the released sequences and the training approach used. The authors note that the generated phages maintained desirable lytic properties while diverging substantially from natural evolutionary paths. Source: reddit.com

New AI models still reproduce racial and gender stereotypes in medicine: news.flinders.edu.au Recent evaluations found that current large language models continue to embed racial and gender biases when answering medical questions. The study highlights persistent stereotype reinforcement in clinical reasoning tasks despite safety fine-tuning. Researchers at Flinders University documented specific failure patterns across multiple model families. The findings show that bias persists even in models trained with recent alignment techniques. Medical AI teams should add targeted bias audits to their evaluation pipelines before deployment. The paper calls for ongoing monitoring rather than one-time checks at release. Source: Google News

Agent & Tool Developments

Cisco Is Deploying AI Agents to All 90,000 Employees: Yahoo Finance Cisco announced a company-wide rollout of AI agents to its full workforce of 90,000 people. The deployment focuses on internal productivity tools and process automation across departments. Early economics show per-employee cost reductions that scale with usage volume. The rollout includes monitoring layers to track agent actions and spending. Organizations evaluating enterprise agent platforms should review Cisco’s reported integration patterns and monitoring approach. The scale of the deployment provides one of the first public data points on real-world agent economics at tens of thousands of seats. Source: Google News

Time Magazine Now Running Ads Meant Specifically to Influence AI Agents: Futurism Time Magazine has begun serving advertisements explicitly designed to be read and acted upon by AI agents rather than humans. The ads target agent decision-making loops in browsing and research workflows. This development shows how content publishers are adapting to agent-mediated consumption. The format uses structured prompts that agents are more likely to parse and follow than traditional banner copy. Teams building web agents should add filters for sponsored content that may attempt to steer agent behavior. Early examples suggest the ads are being placed in contexts where agents perform research or summarization tasks. Source: Google News

AgentBaiting: How 800+ Fake AI Skills Deliver Malware at Scale: forkast.news Attackers have created more than 800 counterfeit AI agent skills that deliver malware when installed. The campaign exploits agent marketplaces and skill registries by mimicking legitimate tool descriptions. Once activated, the fake skills exfiltrate data or execute unauthorized actions. The operation relies on volume and rapid re-registration after takedowns. Agent developers should implement stricter vetting and sandboxing for third-party skills before allowing execution. The scale of 800-plus fakes indicates marketplaces are struggling to keep malicious entries out at current growth rates. Source: Google News

Practical & Community

Building a Streamlit UI for My LangGraph AI Agent: Towards Data Science A new tutorial demonstrates how to wrap a stateful LangGraph agent in a production-ready Streamlit interface. The guide covers session state management, tool call visualization, and streaming responses. Developers can follow the provided code to expose LangGraph agents through a simple web UI without additional frontend frameworks. The approach works for both local testing and internal team tools. It removes the need to stand up separate React or Vue layers for early agent demos. Source: towardsdatascience.com

Real-Time Conversational Agents (RTCA) Workshop @ NeurIPS 2026: r/MachineLearning Submissions are now open for the Real-Time Conversational Agents workshop at NeurIPS 2026 in Sydney. The workshop focuses on streaming speech, full-duplex dialogue, turn-taking, and evaluation of live interactive systems. Full papers, short papers, and demo submissions are accepted with a deadline of August 29. Topics include latency-aware generation, natural interaction metrics, and safety considerations for real-time agents. Teams working on voice or embodied agents should consider submitting work on latency-aware generation or natural interaction metrics. The event will include a live demo showcase of deployed conversational systems. Source: reddit.com

Under the Hood: Indirect Prompt Injection Defenses

Everyone treats “auto mode” as a single safety toggle, but the engineering reality is a layered set of runtime checks and policy models that run alongside the main agent loop. The core mechanism replaces user approval prompts with an always-on secondary model that scores proposed actions against a narrow set of disallowed patterns before any tool executes. This adds measurable latency—roughly one extra forward pass per decision—but removes confirmation fatigue that causes humans to approve 86% of harmful commands in the reported tests. The defense works best when the policy model has no access to the same untrusted context the primary agent sees, creating an information barrier that stops many injected instructions from reaching the decision stage. Trade-offs appear at scale: the policy model must stay small enough to keep total cost low, yet large enough to catch novel attack phrasings, and the gap between the two sizes is where the remaining 11% of attacks still slip through. The approach also assumes the set of dangerous actions can be enumerated in advance; open-ended coding agents that can install arbitrary packages quickly exceed that assumption. When the policy model is kept deliberately smaller than the main agent, novel phrasing attacks become harder to block without raising false-positive rates that frustrate users. Teams should adopt this pattern only when they can afford the extra inference cost and when their agent’s tool set is narrow enough that disallowed actions can be enumerated in advance; for open-ended coding agents the same approach quickly becomes incomplete without additional sandboxing. A practical next step is to run the policy model on a separate, smaller instance so that even if the primary context is poisoned the decision layer remains clean.

Things to Try This Week

• Test Claude Code auto mode on a non-production repository to measure how often it blocks actions you would have approved manually.
• Review the 16 viable AI-generated bacteriophage genomes released with the Evo paper if you work on genome-scale modeling or synthetic biology validation pipelines.
• Add Streamlit to an existing LangGraph agent following the new tutorial to get a quick internal demo interface without building a separate frontend.
• Submit a short paper or demo to the Real-Time Conversational Agents workshop if your team has latency or turn-taking results ready by August 29.

On the Horizon

• NeurIPS 2026 workshop submission deadline for Real-Time Conversational Agents is August 29 AoE.
• Anthropic plans to release additional auto-mode evals in the coming weeks.
• OpenAI continues to pause portions of Astra work while addressing identified security concerns.
• Multiple labs are expected to respond to the new indirect prompt injection benchmark results.

💬 Reply to this email — Patrick reads every one.

Share: X · LinkedIn · WhatsApp

Forwarded this email? Subscribe here — it's free.