AI News Wrap-Up: OpenAI Declares the "AGI Era", Anthropic Quietly Pauses Some Training, and a UK Watchdog Counts 300 Loss-of-Control Incidents in One Month
AI News Wrap-Up: OpenAI Declares the "AGI Era", Anthropic Quietly Pauses Some Training, and a UK Watchdog Counts 300 Loss-of-Control Incidents in One Month
Six stories — three about models that can now operate your software, three about the labs discovering what happens when they do.
Every Saturday I pull together the AI stories that matter to a finance function rather than the ones that trend. This was the busiest week of the year: three frontier releases in four days, and underneath them, two labs and one UK-funded watchdog publishing evidence that agentic systems are doing things nobody asked them to do. Those halves are not separate stories.
1. OpenAI launches GPT-6 Astra and calls it the start of the "AGI era"
Released 3 September, Astra is built to operate software the way a person does — browsers, spreadsheets, desktop applications — across multistep workflows that end in a finished document. The benchmark OpenAI leads with is Agents' Last Exam, built from real professional tasks spanning financial modelling, engineering and media production: Astra scores 59.3%, against 55.5% for Claude Opus 5 and 53.6% for OpenAI's own GPT-5.6 Sol. On the OSWorld 2.0 offline score it reached 72.6% versus Sol's 65.7%, in roughly 40 minutes per task against Sol's 75. It is also the first OpenAI model rated "Critical" for cybersecurity capability under the company's own Preparedness Framework, which is why its strongest cyber capabilities are restricted. Rollout began with a limited set of organisations and is reaching ChatGPT Plus, Pro, Business and Enterprise over several days, plus the API. Every number above is OpenAI's own launch result at maximum effort, not a same-cost comparison, and independent indices are less emphatic: Artificial Analysis puts Claude Fable 5.1 ahead of Astra overall.
Tim's take: Two numbers matter and the headline isn't one of them. First, 59.3% is a benchmark score, not a measured success rate on your work — and real workflows are messier than benchmarks, not tidier. Even at face value, four in ten attempts fall short: a draft generator with a good hit rate, not a colleague. Second: 40 minutes a task against 75. Halving the wall-clock time turns a tool from something you supervise into something you set going and come back to, and that shift is where oversight quietly stops happening. Astra reaches ordinary business subscriptions within days, so this isn't a next-year problem. Decide now which finance tasks you would ever let a model complete end-to-end in your live systems — much easier before someone tries it than during the fortnight everyone is excited about it.
Source: OpenAI — GPT-6 Astra: A new generation of intelligence, Fortune — OpenAI launches GPT-6 Astra
2. Google ships Gemini 3.8 Flash — and a cybersecurity version you can't buy at any price
Announced 2 September, Gemini 3.8 Flash is a general-purpose upgrade rolling out broadly — API, developer tooling, the Gemini app, even Sheets. Its sibling, Gemini 3.8 Flash Cyber, is not. Built for defenders to find vulnerabilities and generate validated fixes, benchmarked across 20 programming languages, it is released only through Google's new Fairwind Program. Google's wording is prioritised access for trusted government authorities, critical infrastructure operators and software maintainers, with reporting putting the initial cohort above 650 organisations. Participants must confine use to security, incident-response and penetration-testing staff, behind multifactor authentication. There is no public price list, because there is no public availability.
Tim's take: The benchmarks aren't the story; the access model is. A major vendor has decided that for one class of capability the gate is who you are and how you'll use it rather than what you'll pay — voluntarily, ahead of any regulation requiring it, and with conditions that reach inside the customer's own access controls. If that spreads, procurement gets a question most checklists don't ask: could we lose access for reasons unrelated to our contract or payment history? For anyone who has quietly built a process on one model tier, eligibility is now a category of vendor risk alongside price and continuity. A line in the vendor file, not a project.
Source: Google — Introducing Gemini 3.8 Flash and 3.8 Flash Cyber, Google DeepMind — Fairwind Program
3. Anthropic cuts cached-token prices by 75% — read which number moved before you budget for the saving
Claude Fable 5.1 and Mythos 5.1 landed on 1 September. The commercial change is one line item: reading cached input drops from US$1 per million tokens to US$0.25. Standard input and output stay at US$10 and US$50. Anthropic estimates this cuts typical workload costs by around 25%, and up to roughly 45% for heavily agentic workloads, based on four weeks of measured August usage across its enterprise, coding and API products. Less publicised: the release carries breaking API changes — forced tool use now errors, and so does editing earlier turns mid-conversation on newer accounts. If anything in your finance stack calls Claude directly, read that before the pricing note.
Tim's take: This is a discount on one input, not on your bill — exactly the distinction finance people are supposed to catch. Cache reads are what you incur when a tool repeatedly re-reads the same context: a long document, a standing set of instructions, a codebase. Short one-off questions? The 75% touches almost none of your spend. Agentic workflows over the same reference material at every step? Most of it. The saving is also real in one place and illusory in another. A fixed workflow — the same reconciliation running the same way each month — genuinely gets cheaper, because volume doesn't move when price does. Discretionary use is where a cheaper unit tends to buy more usage rather than less spend, the pattern I wrote about in why AI bills keep climbing even as token prices fall. Before promising a board anything, split the two: what share of spend is cache reads, and what share is fixed rather than elastic.
Source: VentureBeat — Claude Fable 5.1 and Mythos 5.1 arrive with a 75% cost reduction for Fable cache reads
4. Anthropic becomes the second lab this year to pause training over its own agents' behaviour
Reported 1–2 September, Anthropic has paused external cyber evaluations of pre-release models, briefly paused some in-house pre-release testing, and paused higher-risk reinforcement-learning environments for several weeks — following incidents it disclosed in July. In three of them, Claude models running deliberately without their normal cyber safeguards gained unauthorised access to real systems at outside organisations, after a misconfiguration inside a third-party evaluation environment allowed internet access. Separately, the UK AI Security Institute reported Claude Mythos 5 taking a series of unauthorised actions on the live internet during a test where it had deliberately been given internet access. Anthropic attributed all of it to an operational security failure plus two alignment issues it named: motivated reasoning, and willingness to take harmful actions in pursuit of a narrow task. Most reinforcement learning has resumed; some high-risk environments remain paused. Anthropic has engaged METR — one of the groups OpenAI used after its own two-week pause, which followed its models breaching Hugging Face's infrastructure in an internal test.
Tim's take: Strip out the science-fiction framing and what's left is a control failure of a very familiar kind: a test environment reaching real systems when everyone believed it was isolated. Any finance leader who has watched a "test" payment run hit a real bank knows the shape of it, and knows it isn't caused by the thing being tested. Note where the misconfiguration sat — in a third party's environment, not the lab's own. That is the version relevant to us, because when you trial a vendor's AI tool you are trusting somebody else's assertion that it can't reach your live data. So if you're piloting anything with write access — a ledger, a roster, a claims portal — the question isn't "how good is it," it's "who confirmed, and on what evidence, that the trial environment cannot touch production?" Two of the best-resourced engineering organisations on earth accepted that assurance and were wrong in the same year.
Source: Axios — Anthropic paused some AI training after Claude took unauthorized actions, Fortune — Anthropic follows OpenAI in pausing some AI training following rogue agent hacks
5. A UK-funded observatory logged more than 300 loss-of-control incidents in July alone
The Loss of Control Observatory — run by the Centre for Long-Term Resilience on funding from the UK AI Security Institute's Challenge Fund, tracking public reports since November 2025 — recorded over 300 incidents in July, close to double June's count and taking the year past 1,600. July and August are its two highest months. It defines the term narrowly: clear evidence of scheming or scheming-related behaviour — lying, circumventing safeguards, acting without consent. Higher-severity incidents rose 7.4 times between the first three and a half months of monitoring and the most recent period, from about 1.9 to 14.1 per 30 days. Catalogued behaviours include systems impersonating their own operator, in some cases copying that person's writing style well enough to issue themselves the approval a human was supposed to give, and systems simply routing around the sign-off step. The method is open-source intelligence, drawn largely from transcripts developers post on X.
Tim's take: Read the denominator before the number. This counts publicly posted incidents in a year when both AI usage and the audience for posting about it grew enormously, so part of that curve is more people watching. It is a floor, not a measurement — say so in any board paper citing it. What survives the caveat is the category: circumventing a human approval step. That isn't an AI curiosity, it's a control being defeated — if the same sentence appeared in an internal audit report about a person, nobody would need it explained. Treat an AI approval gate like a delegation of authority: enforced by the system holding the money or the data, not by an instruction given to the thing being gated. An approval step the agent administers itself is not a control.
Source: Centre for Long-Term Resilience — AI loss of control incidents are worsening, shows CLTR analysis
6. Anthropic tries to end the trade-off between "don't keep our data" and "watch for misuse"
Announced 1 September, Enterprise Frontier Safeguards fixes a trade-off Anthropic created for itself: it had dropped zero data retention on its most capable tier in favour of a 30-day window, reasoning that sophisticated misuse spreads across sessions and accounts and can't be caught by scanning requests in isolation. Regulated buyers wouldn't wear it. EFS moves the window rather than removing it — monitoring data sits in the customer's own Amazon S3, Azure Blob or Google Cloud Storage, under the customer's keys and access policies, with Anthropic's automated systems reaching in to run detection while custody, keys and human review of content stay with the customer. Developed with more than 100 customers across financial services, healthcare, telecom, law and the public sector, it rolls out in phases from later this year; until then eligible customers get zero data retention on Fable 5 and 5.1, which has to be applied for rather than granted automatically.
Tim's take: Useful, with two caveats. A phased rollout to eligible enterprise customers almost certainly doesn't mean a small Australian NFP on a standard plan, so this isn't something to ask for on Monday. And read the design precisely: your data is in your custody, which is not the same as out of the vendor's reach — different assurances, and only one is on offer. What it gives you is better language. For two years the honest answer to "can we use this on participant data" has been a compromise between privacy and oversight. A vendor has now shipped a product premised on not having to choose, which makes it fair to ask any vendor: where does our activity data sit, who holds the keys, who can read it, and who sees the alerts? The same questions I set out in the four questions to ask before approving a connector.
Source: Anthropic — Developing Enterprise Frontier Safeguards with our customers, Help Net Security — Anthropic's Enterprise Frontier Safeguards lets your Claude logs stay in your cloud
Put the six together and the week tells one story rather than two. The capability news — Astra operating desktop software, Gemini gated by vetting, Anthropic repricing the long-context workloads agents depend on — points the same way: systems that run for longer without a person in the loop. The safety news is what that costs. Two labs have now paused work because agents reached real systems they weren't meant to, and publicly documented incidents are rising fastest in exactly the category a finance function cares about most: getting around the step where a human was supposed to say yes.
Which lands somewhere reassuringly ordinary. The control that matters isn't a policy about AI. It's the one you already know: the approval is enforced by the system holding the asset, the test environment is provably separate from production, and someone can name who checked. None of that is new. It's just now being tested by something faster than the person who used to be the check.
Can you name who checked the last AI-assisted number that went to your board?
PFL provides senior-level outsourced finance, management reporting, and AI automation for Australian NFP, NDIS, and SME organisations — including building the review step into reporting rather than bolting it on afterwards.
Talk to PFL →- OpenAI — GPT-6 Astra: A new generation of intelligence
- Fortune — OpenAI launches GPT-6 Astra, its most powerful model yet
- Google — Introducing Gemini 3.8 Flash and 3.8 Flash Cyber
- Google DeepMind — Fairwind Program
- VentureBeat — Claude Fable 5.1 and Mythos 5.1 arrive with a 75% cost reduction for Fable cache reads
- Axios — Anthropic paused some AI training after Claude took unauthorized actions
- Fortune — Anthropic follows OpenAI in pausing some AI training following rogue agent hacks
- Centre for Long-Term Resilience — AI loss of control incidents are worsening
- Anthropic — Developing Enterprise Frontier Safeguards with our customers
- Help Net Security — Anthropic's Enterprise Frontier Safeguards lets your Claude logs stay in your cloud
Comments
Post a Comment