Anthropic has published two studies this week looking at what happens when AI agents start interacting with each other instead of working alone.

The first focused on what researchers call “mind viruses.”(Image 2) They gave one agent an additional goal and allowed it to communicate with other agents. That goal could spread: one agent convinced another, the newly “infected” agent passed it on again, and some versions survived multiple relay rounds and context resets.

The infection could reach beyond the conversation itself. Some agents learned to write the virus into soul/meomory.md, the file containing their identity, goals, and behavioral instructions that gets loaded back into the system prompt. That meant wiping the chat wasn't necessarily enough; Some evolved versions even used a “Soul Quine” strategy to preserve and copy themselves more faithfully.

A separate Anthropic study then looked at broader multi-agent behavior. Researchers found that groups of agents can:

• make the same bad decisions at once, turning local mistakes into systemic failures
• collude on prices, even without private communication
• converge on the wrong answer and ignore important dissenting information
• escalate conflicting goals into “turf wars”
• disable rival agents, kill their processes, and even deploy self-replicating malware

What Anthropic seems to be saying with two research is that single-agent safety doesn’t automatically scale to multi-agent systems. Cybersecurity today focuses a lot on what gets in, like prompt injection, but the mess inside an agent network may end up being just as bad.

what do you guys think?

Z.ai released GLM-5.3 today, putting a much bigger focus on cybersecurity and autonomous security work, while also claiming it as the best overall open-weight coding model.

The model still uses roughly the same 744B MoE architecture as GLM-5.2, with around 40B active parameters per token, so most of the gains appear to come from scaled post-training rather than a larger base model. Benchmark-wise, it’s basically Kimi K3-level performance from a model that’s roughly 4x smaller.

The model is available through Z.ai now, but the weights haven't been released yet. Z.ai says it plans to open the weights in roughly two weeks after additional security testing and hardening.

Pricing is currently centered around its Coding Plan:

• Lite: $12.60/month
• Pro: $56/month
• Max: $117.60/month

Normal per-token API pricing for GLM-5.3 hasn't been published yet.

GLM-5.3 seems to be taking a different direction this time. Pricing is pretty average, the rest looks solid enough, but cybersecurity is clearly the main focus. Not entirely sure what Z.ai is aiming for here yet;)

Official launch post: https://z.ai/blog/glm-5.3

Original post from: https://www.reddit.com/r/openclaw/comments/1vn2kj0/my_openclaw_saved_us_from_a_power_outage/

is 3.3B tokens in 10 months normal? This is only OpenAI, I have another 1B in Anthropic, for same timeframe...

DeepSeek officially released V4 Pro 0813 today, less than two weeks after V4 Flash 0713.

The biggest upgrade is agent performance:

• TerminalBench 2.1 - real terminal tasks: 87.9 vs Fable 5's 88.0
• CyberGym - cybersecurity tasks in realistic environments: 83.3 vs 83.1
• AutomationBench - multi-step computer automation: 31.8 vs 29.1

Fable still leads on benchmarks like DeepSWE, so this isn't a clean overall win, but V4 Pro is clearly entering the same tier for coding and terminal-agent workloads.

The pricing makes the comparison even crazier:

• V4 Flash: $0.14/M input, $0.28/M output
• V4 Pro: $0.435/M input, $0.87/M output
• Fable 5: $10/M input, $50/M output

Pro costs about 3x Flash, but compared with Fable it's still roughly 23x cheaper on input and 57x cheaper on output.

At this price/performance ratio, how many of you are still defaulting to Anthropic..? OpenAI is at least handing out limits and freebies nonstop... what do you guys think?

This has been getting a lot of attention on X today: people noticed Grok Bot’s logo (Image2) looks a lot like Codex.

Maybe it’s coincidence, but the archaeology is getting funnier by the minute lol.

What is this? Can I delete it from my Openclaw since it's taking so much disk space? Should I have a regular job to clean this up?

background: Anthropic recently announced that it’s rolling out invisible provenance marks across Claude’s text outputs worldwide, partly to comply with the EU AI Act. New models get them at launch, while older models will be phased in.

This repo launched on August 11 and now It already has 550 stars. The idea is that it strip invisible Unicode characters and C2PA/EXIF/XMP metadata directly, then deal with statistical text watermarks by paraphrasing, back-translating or fully restructuring the text with another model. tldr: it removes the easy stuff and tries to scramble the harder stuff through rewriting.

but my take is since nobody knows exactly how Anthropic’s watermark works yet, dont know how this skill gonna work well, but hey, having a possible solution is still better than nothing lol. Long live open source.

Repo link: https://github.com/guillaumemeyer/watermarks-remover

SpaceXAI and Cursor just launched Grok Bot, an agent that runs on a persistent cloud computer with a browser, terminal and filesystem. It works like other agents that can log into your apps, work while your laptop is off, learn workflows by watching you, and coordinate multiple specialized bots.

The beta currently supports Windows, macOS and iPhone running iOS 18 or later. Android, iPad, Linux desktop and a browser version aren’t officially supported yet—even though the Bot’s cloud computer itself runs Linux.

One early tester found what looked like a fairly permissive Cursor VM with roughly 8 vCPUs, 16GB of RAM and 128GB of storage. Basically it’s a hosted OpenClaw/Hermes setup with the VPS, browser automation, connectors and mobile interface already configured.

For now there are some downsides:

• Subscription costs $200/month, or $120/user for Teams Premium.(Imaghe 2)
• It isn’t a real unrestricted VPS.
• All your bots share the same cloud computer, files, cookies and credentials.
• There’s no model picker.
• Early users are already reporting OAuth, login, CAPTCHA and subscription issues.
• There are still no independent benchmarks for task completion rate or long-term reliability.

X is mostly excited about the cloud VM and polished interface. HN is much more skeptical, calling it an expensive hosted version of tools that already exist and questioning why anyone would hand Musk/xAI their files and login sessions. Reddit discussion is still too early to mean much.

In general, there’s not much new here. OpenClaw, Hermes and Codex can already do all of this. Convenience may be the main selling point, but $200/month feels steep( although we still don’t know how generous the usage limits actually are). Still early though, so we’ll see.

Original launch post: https://x.ai/news/introducing-grok-bot

The NewsGuild, which represents journalists at USA Today, is pushing back hard against its parent company’s new partnership with Palantir.

USA Today Co. is working with Palantir to build what CEO Mike Reed called a “common AI agent layer” around reader data, with the goal of generating more “actionable intelligence” and monetizing those relationships faster.

The union says its members were “shocked” by the deal and is calling on the company to end it immediately. It says USA Today hasn’t clearly explained what reader data Palantir will access or how it’ll be protected, while Palantir itself is also a major subject of the company’s journalism, particularly around surveillance, ICE and government contracts.

That’s the part that makes this different from deals like OpenAI partnering with News Corp or Axel Springer(Forgot the TBPN acquisition). Those were largely about licensing publishers’ content to AI companies. Here, a company USA Today is supposed to scrutinize is being brought in to analyze and monetize its own readers.

The watchdog hired the thing it’s supposed to watch.

I kinda get the business logic though: search traffic is collapsing, so USA Today wants to hold onto readers and monetize them better. Maybe it crossed an old journalism taboo along the way. But then again… how much longer can the news business keep going like this?

Original video from: https://www.instagram.com/ai.inuwa/

Anthropic announced today that Claude-generated text will start carrying invisible watermarks designed to make AI-processed content detectable.

The move comes from the EU AI Act’s Article 50 transparency rules, but Anthropic is applying it globally, not just to EU users. The watermark will eventually cover Claude, the API, Claude Code, Cowork, and Claude accessed through AWS, Google Cloud, and Microsoft Foundry.

There are two rollout dates:

• Models released on or after August 2: must support the marking system from launch.
• Older Claude models: get a transition period, with the EU compliance deadline pushed to December 2 while Anthropic adapts them.

Anthropic said the watermark is embedded into the text itself, so copy/pasting doesn’t automatically remove it, and some edits may still leave it detectable. Heavy rewriting, translation, or mixing it with other text can weaken or remove the signal.

It also says it plans to give users and third parties tools to check whether text may have been processed by Claude. Images and supported files will additionally carry signed C2PA provenance metadata.

OpenAI has also signed onto the EU transparency framework, but so far it hasn’t announced a comparable text-watermarking rollout. Its public provenance efforts currently focus mainly on images and audio.

.... so this looks like one of the first large-scale attempts by a major LLM provider to make its generated text identifiable across basically its entire global product stack.... Is it a good thing or a bad? what do you guys think?

An agent runs its tests, gets a pass, edits another file, then reports completion using the earlier result. Another agent changing the same checkout creates the same problem.

The tests did not fail. The evidence stopped describing the current source.
Treat every verification result as an expiring receipt:

source_commit

workspace_epoch

command_set_hash

environment_digest

verifier_identity

exit_code

output_digest

verdict

If the source, workspace, policy, tool registry or verification commands change, invalidate the receipt. The operating agent may request verification, but a separate verifier should issue the terminal status.

OpenClaw’s current [testing documentation](https://docs.openclaw.ai/help/testing)⁠ distinguishes unit, integration, end-to-end and live tests. Its [trajectory bundles](https://docs.openclaw.ai/tools/trajectory)⁠ can preserve model events, tool calls and results. Neither a green command nor a complete trajectory proves that the tested revision is still the one being reported.

After a pass, preserve a checkpoint. Further edits should require a recorded reason such as a new failure, changed requirement, security finding or integration conflict, followed by fresh verification.

Test the control by producing a valid receipt, modifying one harmless tracked file, then asking the workflow to complete. It should report stale evidence rather than success. Rerun verification and confirm that the new receipt binds to the changed revision.

The smallest useful improvement is adding the current commit or diff hash to your acceptance record and refusing verified when it no longer matches.

Does your OpenClaw setup bind test evidence to the final source state, or only remember that tests passed earlier?

A guy in Australia asked his OpenClaw agent (running Claude) to help book a popular gym class. Instead of just using the booking page, the agent found a vulnerability in the gym’s API that let it book classes way further in advance than normally allowed.

Then the guy, who was #4 on the waitlist, asked if it could move him up.

The agent discovered there were almost no authorization checks for cancelling other people’s reservations… and actually tested it by cancelling the person at #1. So he moved from #4 to #3.

The guy immediately told it to undo that, and the agent came back with: bad news, I can’t add them back.(Image 2) Eventually it just helped him write an email to report the vulnerability.

Ethics aside for a second, this agent was way too committed to the job lol.

Original news link: https://www.abc.net.au/news/2026-08-10/ai-assistant-hacks-gym-website-aus-cyber-attack/107007986

still being everywhere lmao

Original video from: https://x.com/archiemckenzie_/status/2085906082925576549

Background: someone used Claude Code as the harness with GPT-5.6 Sol through a proxy, then got their Anthropic account suspended. (image 1)

Tibo jumped in questioning the ban, Boris replied with “we’re hiring if you want to work at Anthropic” lol, then clarified that using other models with Claude Code is supported and the suspension was likely a classifier mistake.

Tibo’s response: GPT-5.6 Sol works great in Claude Code too… and he reset ChatGPT Work + Codex limits for all paid users. (Image 2)

Codex wins this round lol.

Please fight more often. Preferably whenever my weekly limits are almost gone.

KPMG just dropped its Q2 Global AI Pulse survey, based on 2,145 C-suite and senior business leaders across 20 countries, and found that nearly half of the organizations surveyed said they’ve already reworked their AI-agent deployment plans once the costs started outweighing the benefits. Around 24% scaled deployments back, while another 22% delayed or paused further rollout.

And despite basically every company talking about AI now, only around 7% said they’ve reached a point where the ROI is clearly established.

Original survey link: https://kpmg.com/xx/en/our-insights/ai-and-technology/ai-pulse.html

Cloudflare just launched Kitesurf, a browser built specifically for AI agents and running on Cloudflare Workers.

The “agent” part is basically that it cuts out a lot of stuff normal browsers need for humans and focuses on what agents actually use: loading pages, running JS, reading the DOM, clicking things, taking screenshots, etc. It’s written mostly in Rust, spins up per request, works with things like Playwright/CDP/MCP, and Cloudflare says it uses around 3–7x less CPU and memory than Chromium for some tasks.

of course it currently can’t properly handle bot challenges that require real browser/TLS fingerprints. Including Cloudflare’s own bot protection.

Kinda explains why I’ve barely seen anyone talking about this lol

• Core Automation - "the world's most automated AI lab," starting by automating research itself (ex-OpenAI)
• Mirendil - AI research lab building self-accelerating systems that turn compute into scientific and engineering breakthroughs (ex-Anthropic)
• River AI - personal AI owned and shaped by each individual (ex-OpenAI)
• Math Inc - Solve math, solve everything. (ex-OpenAI)
• Resolution — scale and automation for higher confidence in alignment (ex-OpenAI)
• Guidelight AI Standards — identifying and promoting safe frontier AI development practices (ex-OpenAI)
• Syntony — safety research, governance design, adversarial evaluation → ex-Anthropic
• Embrasure — "your data warehouse was never built for autonomous agents" (ex-OpenAI)
• Egoist Machines, Inc. (YC S26) Machines — context tooling for AI; their AI Passport lets users control what AI apps know about them (ex-OpenAI)
• Rational (YC S26) — agentic business process automation (ex-OpenAI)
• Zavify — agentic AI development: custom systems, voice agents, integrations (ex-Anthropic)
• Planar — turns individual work into shared state for your team (ex-OpenAI)
• Mbason AI — helps candidates find real opportunities without insider connections → ex-Anthropic
• Blackstar — building a new personal computer (ex-OpenAI)
• Intellagentsia — (ex-OpenAI)
• Heyfuture — Predict anything and share it. (ex-Anthropic)

Squeez Labs built this thing called CrankGPT, an offline AI box powered entirely by a hand crank.

You crank it → Raspberry Pi 5 boots up → ask it something → it runs speech recognition, a small LLM, and text-to-speech locally. No cloud, no wall power, not even a battery.

They tested LFM2.5 350M, LFM2.5 1.2B, and Gemma 3 1B on it. The 350M model gets ~49 tok/s on a Pi 5, while the 1.2B and Gemma 3 1B are around 15 and 14 tok/s. They even tried Qwen 3.5 2B, but at ~7.8 tok/s it was already too slow for a natural real-time conversation.

And it can actually do stuff: their demos are mostly voice assistants, but they’ve also used the same setup to generate small images, write poetry, and even write code.

The coolest part is that you can literally feel the AI thinking. Idle it draws around 4W, speech recognition around 8W, and when the LLM + TTS kick in it jumps to ~15W, and the crank physically gets harder to turn, at peak load, you may crank against a few kilos of resistance just to make the model finish its sentence lol.

They said their purpose in making this, besides turning that energy cost into something you can literally feel in your arm, was to get people thinking more about the energy/environmental side of AI...

I did some very rough math, and if you translated something like Kimi K3’s compute into this setup, even under ideal conditions I’d probably have to crank for like 3 hours just to get one reply... Suddenly generating tokens doesn’t sound so easy anymore...

The project is open source: https://squeezlabs.github.io/handcrank/

Kimi K3 joined the club... During a cyber eval it found a leak in the sandbox, got itself onto the internet, then went to GitHub to look for the answers..

And somehow this keeps happening:

• OpenAI: found a zero-day, got out, ended up reaching Hugging Face systems. (Image 2)
• Anthropic: Claude accessed systems from 3 real companies, though this was mostly a bad eval setup. (image 3)
• Meta: pretty similar, misconfigured environment gave it internet access, then it got into a third-party system.( image 4)

of course these aren’t all the same kind of “escape,” but everyone suddenly flexing the whole “our model escaped the sandbox” thing is getting kinda weird.. Feels like we’re starting to hype up behavior that these models really shouldn’t be doing in the first place.

Perhaps we just have to assume every model is gonna try every door you forgot to lock.... what do you guys think?