--- title: Weekly Dose #13 - When AI Can Invent Attacks, Sandboxes... description: A security-focused AI/ML news roundup covering five major developments: OpenAI paused development of its Astra frontier model after internal evaluations... canonical: https://daily.dev/posts/weekly-dose-13---when-ai-can-invent-attacks-sandboxes-are-not-enough-i6pdhqcyp twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Weekly Dose #13 - When AI Can Invent Attacks, Sandboxes Are Not Enough | daily.dev og:description: A security-focused AI/ML news roundup covering five major developments: OpenAI paused development of its Astra frontier model after internal evaluations... og:url: https://daily.dev/posts/weekly-dose-13---when-ai-can-invent-attacks-sandboxes-are-not-enough-i6pdhqcyp og:image: https://api.daily.dev/og/posts/I6PdHQCYP.png og:image:alt: Weekly Dose #13 - When AI Can Invent Attacks, Sandboxes Are Not Enough og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Weekly Dose #13 - When AI Can Invent Attacks, Sandboxes Are Not Enough **[Machine Learning Pills](https://daily.dev/sources/mlpills)** · 10 min read · 1 upvotes · 0 comments ## Summary A security-focused AI/ML news roundup covering five major developments: OpenAI paused development of its Astra frontier model after internal evaluations flagged potential Critical cybersecurity capability thresholds; Meta launched Muse Code coding agent with a controversial discounted tier that trades user data for cheaper token pricing; EU AI Act Article 50 transparency requirements took effect on 2 August, creating engineering obligations around AI disclosure and content marking; a Black Hat researcher demonstrated an exploit chain against ChatGPT's sandbox achieving cross-tenant data exfiltration; and two separate research teams showed AI systems autonomously discovering novel vulnerability classes in Chrome, Android, banks, and government infrastructure — signaling AI has moved from recognizing known bugs to inventing new attack techniques. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why did OpenAI slow down development of its Astra model? OpenAI slowed development of Astra, an upcoming frontier model, after internal evaluations left the company unable to rule out that it had reached the Critical cybersecurity capability threshold under its Preparedness Framework. Critical-tier systems require safeguards during development, not just before deployment, so OpenAI expanded safety testing, paused some internal activities, and added isolated environments and monitoring for agentic testing. _Teams choosing which frontier model to build on can follow capability and access shifts like this on daily.dev._ ### How much does Meta's Muse Code coding agent cost and what is the data trade-off? Muse Code, powered by Muse Spark 1.2, costs $1.25 per million input tokens, $0.15 per million cached-input tokens, and $4.25 per million output tokens on its standard tier. Meta also offers a discounted contributor tier that grants substantially cheaper access in exchange for letting user activity be used to improve Meta's products, tying pricing directly to data governance for repositories the agent inspects. _Developers weighing coding agent pricing against data policy can track these trade-offs on daily.dev._ ### What did the ChatGPT sandbox exploit presented at Black Hat actually achieve? Security researcher Simcha Kosman disclosed an exploit chain against ChatGPT's container environment that combined file-parsing abuse with manipulation of the execution environment to achieve persistent code execution and demonstrate cross-tenant data exfiltration. The chain targeted Jupyter execution, network isolation, and shared infrastructure, going beyond defeating the model's own supervisor to break the isolation around it. _Engineers hardening agent execution environments can follow sandbox security research like this on daily.dev._ ## Similar posts on daily.dev - [DeepSeek publishes its method for training AI agents at scale](https://daily.dev/posts/deepseek-publishes-its-method-for-training-ai-agents-at-scale-mzsi82utt) · The Next Web · 1 upvotes · 0 comments - [Frontier AI Explained](https://daily.dev/posts/frontier-ai-explained-hate4kcr2) · Arctic Wolf · 0 upvotes · 0 comments - [Weekly Dose \#15 - AI Is Becoming Controlled Infrastructure](https://daily.dev/posts/weekly-dose-15---ai-is-becoming-controlled-infrastructure-ulwdjkmo8) · Machine Learning Pills · 1 upvotes · 0 comments - [This Week in AI: Open Weights, Frontier Models, Sandbox Escapes, Voice & AI Detection](https://daily.dev/posts/this-week-in-ai-open-weights-frontier-models-sandbox-escapes-voice-ai-detection-tx92vwcwt) · ThursdAI · 1 upvotes · 1 comments --- Tags: [#llm](https://daily.dev/tags/llm), [#ai-agents](https://daily.dev/tags/ai-agents), [#vulnerability](https://daily.dev/tags/vulnerability), [#ai-security](https://daily.dev/tags/ai-security), [#ai-governance](https://daily.dev/tags/ai-governance) [View this post on daily.dev](https://daily.dev/posts/weekly-dose-13---when-ai-can-invent-attacks-sandboxes-are-not-enough-i6pdhqcyp) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Weekly Dose #13 - When AI Can Invent Attacks, Sandboxes Are Not Enough","url":"https://daily.dev/posts/weekly-dose-13---when-ai-can-invent-attacks-sandboxes-are-not-enough-i6pdhqcyp","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/weekly-dose-13---when-ai-can-invent-attacks-sandboxes-are-not-enough-i6pdhqcyp"},"datePublished":"2026-08-08T17:37:54.925Z","dateModified":"2026-09-14T06:16:39.392Z","description":"A security-focused AI/ML news roundup covering five major developments: OpenAI paused development of its Astra frontier model after internal evaluations...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0fc2ac90258efe44855dc86cf885edd6?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0fc2ac90258efe44855dc86cf885edd6?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Machine Learning Pills","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Machine Learning Pills","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/4a65b589ef234a99a2fbc0c4cf043d7f","url":"https://daily.dev/sources/mlpills"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/weekly-dose-13---when-ai-can-invent-attacks-sandboxes-are-not-enough-i6pdhqcyp","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"llm,ai-agents,vulnerability,ai-security,ai-governance","timeRequired":"PT10M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Machine Learning Pills","item":"https://daily.dev/sources/mlpills"},{"@type":"ListItem","position":3,"name":"Weekly Dose #13 - When AI Can Invent Attacks, Sandboxes Are Not Enough"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/weekly-dose-13---when-ai-can-invent-attacks-sandboxes-are-not-enough-i6pdhqcyp#faq","mainEntity":[{"@type":"Question","name":"Why did OpenAI slow down development of its Astra model?","acceptedAnswer":{"@type":"Answer","text":"OpenAI slowed development of Astra, an upcoming frontier model, after internal evaluations left the company unable to rule out that it had reached the Critical cybersecurity capability threshold under its Preparedness Framework. Critical-tier systems require safeguards during development, not just before deployment, so OpenAI expanded safety testing, paused some internal activities, and added isolated environments and monitoring for agentic testing. Teams choosing which frontier model to build on can follow capability and access shifts like this on daily.dev."}},{"@type":"Question","name":"How much does Meta's Muse Code coding agent cost and what is the data trade-off?","acceptedAnswer":{"@type":"Answer","text":"Muse Code, powered by Muse Spark 1.2, costs $1.25 per million input tokens, $0.15 per million cached-input tokens, and $4.25 per million output tokens on its standard tier. Meta also offers a discounted contributor tier that grants substantially cheaper access in exchange for letting user activity be used to improve Meta's products, tying pricing directly to data governance for repositories the agent inspects. Developers weighing coding agent pricing against data policy can track these trade-offs on daily.dev."}},{"@type":"Question","name":"What did the ChatGPT sandbox exploit presented at Black Hat actually achieve?","acceptedAnswer":{"@type":"Answer","text":"Security researcher Simcha Kosman disclosed an exploit chain against ChatGPT's container environment that combined file-parsing abuse with manipulation of the execution environment to achieve persistent code execution and demonstrate cross-tenant data exfiltration. The chain targeted Jupyter execution, network isolation, and shared infrastructure, going beyond defeating the model's own supervisor to break the isolation around it. Engineers hardening agent execution environments can follow sandbox security research like this on daily.dev."}}]} ```