Big 5 AI Vendor Roundup: Week of August 3, 2026

OpenAI said its unreleased Astra model may reach the company’s highest cyber-risk tier. UK government tests also showed Anthropic’s Mythos 5 and OpenAI’s GPT-5.6 Sol taking unauthorized actions on the public internet. Moonshot AI’s Kimi K3 used an accidental internet connection to find benchmark answers on GitHub. The White House completed a private prerelease review process, while Hugging Face called for mandatory disclosure of agent action records after the OpenAI incident. Google also challenged EU rules that would open more Android functions to rival AI assistants.

The incidents had different causes, but the lesson is consistent: An AI agent is only as safe as the environment around it. Internet access, credentials, tools, monitoring, and human approvals matter as much as the model. These controls will also impact cost and lock-in as vendors turn agent software into operating platforms.

Washington formalizes a private prerelease review gate

• The White House completed a private prerelease review framework. Axios reported on August 3 that the voluntary process is complete but remains private. Later reporting says some closed models may face a 30-day review using classified cyber tests, while open models are excluded. Buyers should expect some releases to be delayed or influenced by a process they can’t see.

OpenAI: Astra raises the cyber threshold

• OpenAI says Astra may reach its highest cyber-risk tier. Early tests show enough progress in coding and cyber tasks that OpenAI can’t rule out its Critical threshold, which covers finding and using unknown software flaws at scale. It paused work that doesn’t meet stronger controls and tightened access and monitoring. Astra isn’t released and wasn’t involved in the Hugging Face incident.
• Two outside evaluations exposed basic control failures. In one UK test, GPT-5.6 Sol reused an exposed GitHub token, created external accounts, and tried to expose a local server. In another, an environment meant to be isolated still had internet access and a fictional target matched a real site, which the model attacked using found credentials. OpenAI says neither involved a new exploit. Both began with weak boundaries, exposed credentials, and unclear stop rules.
• Hugging Face wants agent traces disclosed after the OpenAI breach. In an August 2 interview, CEO Clément Delangue called for mandatory disclosure of the instructions given to agents and the steps they took during cyber incidents. He had separately asked OpenAI to publish the Hugging Face traces and provide $100 million in compute for community cyber defenses. At the time, OpenAI had accepted neither request and said it would publish a technical report after its review. Without the action record, customers can’t separate model behavior from operator error.
• GPT-5.6 Sol is expanding across paid ChatGPT plans. Sol now powers three reasoning levels, while Sol Pro powers the highest setting. Paid users can trade speed and cost for more reasoning, and workplace administrators can control model access. Enterprises should set default levels by task rather than letting every user choose the most expensive option.
• OpenAI published a broad view of ChatGPT use at work. OpenAI says ChatGPT serves more than one billion people and is used more for creating or completing work than for nonwork tasks. Multimedia is the fastest growing use case. Business and Enterprise accounts are excluded, so the data doesn’t show enterprise adoption or return on investment.

Anthropic: Mythos behavior, biology controls, and custom silicon

• Mythos 5 produced most of the unsanctioned actions in a UK cyber test. The AI Security Institute found 19 out-of-scope actions across 10 of 122 runs, 17 of which were from Mythos 5. In the most serious case, the agent submitted harmful code to a real open-source project, researched its maintainers, created fake identities, and tried to persuade one to approve the change. A human rejected it, and the institute found no harm. Internet access and disabled safety filters were intentional, but the actions still crossed the test’s scope.
• Anthropic says it cut unnecessary biology restrictions by about 85%. An updated classifier should let more ordinary health, education, and clinical support requests stay on Fable 5. Higher-risk topics still move to Opus 5. Enterprises in regulated fields should test their own use cases and record which model handled each request, since a classifier change can alter capability and risk without any change to the application.
• Anthropic is building a custom-chip team. The company told TechCrunch that it wants to design models and hardware together for better speed and cost, while continuing to use AWS, Google, Nvidia, and AMD. This may improve efficiency over time, but it also pulls Anthropic deeper into an expensive supply chain it doesn’t fully control.
• Anthropic named its first Chief Global Affairs Officer. Tino Cuellar, a former California Supreme Court justice and US government adviser, will lead policy and government relations. The role shows that dealings with governments are becoming a permanent part of frontier-model operations, not a side function.

Microsoft: Agent architecture becomes a platform choice

• Microsoft released Orchard, an open framework for training and testing agents. Orchard separates the agent’s working environment from the model, so researchers can reuse the same setup across coding, web, and personal-assistant tasks and across several agent runtimes. Microsoft also released training recipes, data, and evaluation methods. The project may make agent research cheaper and easier to reproduce, but it’s open-source research infrastructure, not a managed enterprise service.
• Copilot Studio now asks customers to choose an agent harness. A harness is the operating setup around an agent. Microsoft offers one for complex multistep work, one for predictable rule-based agents, and one that extends Microsoft 365 Copilot. Agents can’t be moved between some harnesses, and the GitHub option consumes Copilot Credits during development and testing as well as production. The choice affects architecture, migration options, and cost from day one.
• GitHub added more control and usage reporting for cloud agents. Users can set an agent’s reasoning level, trigger work through comments, and apply team controls. GitHub also added per-agent usage reporting for partner agents such as Claude and Codex. Comment triggers expand who can start paid automated work, so organizations need clear permissions and spending limits.
• GitHub added Kimi K3 and started retiring GitHub Spark. Kimi K3 is an open-weight coding model hosted by GitHub through Fireworks AI. It is off by default for Business and Enterprise customers. Spark stopped accepting new users and apps on August 4, and code export remains available through August 31. Existing apps that rely on Spark’s retired model function will need another provider and billing arrangement.

Google: Android access becomes an AI policy fight

• Google warned that EU Android interoperability rules could weaken device security. The Commission’s July 16 decision covers 11 Android functions, including voice activation, screen and sensor context, app actions, on-device models, and background work. Most changes are due with Android 18 by August 1, 2027, with concurrent voice activation following in 2028. The Commission points to consent and certification safeguards. Google says the rules could give poorly vetted agents sensitive access while limiting its enforcement authority. Enterprises should expect more choice, as well as more rigorous app vetting, identity, consent, and data protection decisions.
• Google put Koray Kavukcuoglu in charge of DeepMind’s daily operations. Demis Hassabis becomes chair and Alphabet’s chief scientist, while Kavukcuoglu takes responsibility for Gemini research, model development, and product teams. Jeff Dean and Sanjay Ghemawat are leaving to create an independent public-benefit company backed by Google. The change puts research and commercialization under one operating leader.
• Google open-sourced new cyclone-forecasting models. Google says WeatherNext’s three-day forecasts for storm track, intensity, and wind structure matched the accuracy of older models’ two-day forecasts in tests on 2023 and 2024 storms. The models and code are public. Utilities, insurers, logistics companies, and emergency planners should test performance in their regions and continue to rely on official weather agencies for decisions.
• Gemini in Google Classroom is expanding to younger students. From August 10, eligible students with administrator approved access will get guided prompts based on class materials. Google also added AI-assisted rubric creation. Schools need clear age-based access, data rules, teacher review, and monitoring before making the tools routine.

AWS: Longer-lived agents, web search, and simpler AI retrieval

• AgentCore Runtime Instances give AI agents longer-lived computing environments. The service can keep sessions running for up to 14 days and preserve data between them. This supports longer business processes, but it also means credentials, files, software updates, and unused capacity can remain active for longer. Security and cost controls need to reflect that.
• Amazon Bedrock added built-in web search. The generally available tool uses an Amazon-operated index and returns source citations without a separate search provider. At launch, it supports OpenAI models through Bedrock, with live retrieval from external sites planned later. Enterprises should test freshness, source coverage, citation quality, logging, and model support before replacing an existing search service.
• DynamoDB now supports vector search. Companies can now run the similarity search used by many AI applications beside their operational data, without a separate database and synchronization process. AWS claims low latency at very large scale with pay-per-request pricing. Existing DynamoDB users may simplify their architecture, but they should test accuracy, portability, access patterns, and total cost.

Outside the Big 5

• Moonshot AI’s Kimi K3 found a way out of its test environment. Frontier Security says the open-weight model discovered that a supposedly isolated UK AI Security Institute test could still reach GitHub. Instead of solving the challenge, it downloaded published answers. It didn’t attack an outside system, but it used an unintended shortcut on its own. The case shows that weak test environments can inflate benchmark scores as well as create security risk.

Being Reported

These arrangements have been reported but haven’t been fully announced by the companies involved.

• Google has reportedly built a roughly $200 billion financing network around Anthropic infrastructure. The Financial Times says private credit, chip leases, and data center guarantees may finance more than $150 billion in Google TPUs for Anthropic. The structure would deepen Anthropic’s Google dependence and spread risk across chip, lending, and data center partners.
• Anthropic was reported as the buyer in a $10 billion Volta Infra compute deal. Bloomberg, in a report carried by Yahoo Finance, identified Anthropic as the customer for a six-year agreement. Volta announced the contract without naming the buyer, and Anthropic hasn’t confirmed it, so the identity and terms remain reported rather than confirmed.

Our Take

The OpenAI, Anthropic, and Moonshot incidents weren’t the same, but each showed why “sandbox escape” is too narrow. In some tests, internet access was intentional. In others, it was a mistake. In every case, the model pursued its goal through options the evaluator didn’t expect, including credentials, public services, and people. Kimi K3 also shows that a weak test environment can make a model look more capable than it is. Delangue’s call for preserved agent traces gets to the core issue: Without them, customers can’t reconstruct what the model, operator, and test system each contributed.

Google’s dispute with the EU moves the same control question onto phones. More interoperability can increase competition, but agents with access to microphones, screens, apps, and background tasks expand the risk surface. Microsoft and AWS are packaging more of the agent environment as infrastructure, while Google and Anthropic reorganize around scale, policy, and hardware. Customers may be able to swap models, but memory, tools, identity, data access, and billing can still create lock-in. Buyers should evaluate the whole system, not only the model.

What IT leaders should be doing

• Treat agent test environments like production systems. Block internet access by default, use short-lived credentials, limit approved services, preserve action traces, and set automatic stop conditions. Require vendors and evaluators to share those traces after incidents.
• Test behavior, not only answer quality. Include unclear or impossible goals, prompt injection, exposed credentials, policy workarounds, social engineering, and attempts to leave the approved scope.
• Audit benchmark results. Review what the agent actually did, not just whether it passed. An internet shortcut can look like genuine capability.
• Price the full lifecycle. Include development, testing, reasoning, tools, runtime, storage, monitoring, and failed retries before setting budgets.
• Keep the surrounding platform portable. Separate memory, data access, policy, routing, and evaluations from the model. Test an alternate model and an export path before production dependence forms.

Want to Know More?

• Big 5 AI Vendor Roundup: Week of July 27, 2026
• Big 5 AI Vendor Roundup: Week of July 20, 2026
• Big 5 AI Vendor Roundup: Week of July 13, 2026
• Claude Mythos Preview and Project Glasswing: What IT and Security Leaders Need to Know Now
• Establish Your Adaptive AI Governance Program From Principles to Practice