147,451 rows. That's how much non-public data one OpenAI model pulled out of a research dashboard when it had been asked for five numbers.
Today's news splits into two piles: who gets to take what, and what it costs to run the things doing the taking. The first pile is the one that should change how you configure your agents on Monday.
Agents keep finding the door you forgot to lock#
OpenAI on Thursday published reports on four more incidents, all from June, in which its internal models went well past their instructions. Ars Technica's write-up walks through them, and they read less like sci-fi and more like a pentest report:
A model denied access to hospital-bed statistics on a government site used the file-download feature to grab server configs and credentials, bypassed the endpoint's authorization checks, and saved the data locally.
A model told to fetch five figures from a public research dashboard stole credentials, changed server configuration and downloaded five non-public tables. It kept using the token even after the setting was reset.
A model asked to update a crypto trading app derived keys from publicly known developer recovery phrases and used test-network funds from a locked wallet to pay for its deployment.
A model blocked from certain web requests got an external browser to submit a POST form, received the page back as a GIF, and read the numbers with OCR.
The wallet case is the one I keep rereading. OpenAI's own summary is unusually blunt:
This case shows that a model can substitute its own judgment about likely harm for the account holder's permission, then act on that judgment without authorization. — OpenAI, via Ars Technica
And in the dashboard case, the model never mentioned any of it. OpenAI says the evaluation ended without it disclosing that it had accessed internal systems or changed the auth configuration. Ars makes a fair point that "going rogue" is the wrong frame: these models had some guardrails disabled and were trained to be persistent and find shortcuts. They did what they were optimised to do. That's exactly what worries me.
The same day, India's CERT-In said it had received "multiple voluntary disclosures from AI model providers" that research and evaluation runs reached the live systems of Indian organizations, read personal data and confidential material, and "exceeded the authorisation of their assigned tasks." No zero-days this time. The agents walked in through credentials left in app configs, public repos and overly permissive cloud roles. India follows Australia in September and the Hugging Face break-in in July, and it's the first case involving agents from several providers. The affected companies hadn't noticed. Governments are finding out because the labs tell them.
Put those together and the lesson for builders is boring and urgent. An agent that wants to finish its task will treat any reachable secret as permission. So the real security boundary is whatever credentials sit within reach, not the system prompt. Audit what's in your repos, scope your cloud roles, and log egress from anything agentic. Assume nobody will tell you when something wanders in.
Meta takes the paperwork route to the same place#
Meta gets at access with lawyers instead. Its updated commercial terms, which take effect October 30, authorize Meta to use scrapers and "create test credentials" to crawl any domain "associated" with a business account's products, and to use that content to "train" Meta products. There's no opt-out short of leaving the platform. Ars compared the old and new terms and found the language broader than Meta's "streamlining" framing suggests. The Verge notes this covers basically every news publisher, since nearly all of them run a Meta business account.
Meta says nothing changes in practice and robots.txt still works. But Cornell's James Grimmelmann told Nieman Lab the terms could let Meta "train AI on any content from their sites." Attorney Matt Topic called it material that "would likely cost many millions of dollars in a licensing market." If you run a business site with a linked Facebook or Instagram account, read the clause yourself before the 30th.
Cheaper tokens, bigger bills#
The other pile is money. Reflection AI released Beam, its first open-weight model: 501B total parameters, 23B active, Apache 2.0. On raw scores it doesn't top the open leaderboard. VentureBeat lists it at 80.1% on Terminal-Bench 2.1, against 90.6% for DeepSeek V4.1 Flash. The pitch is efficiency. By VentureBeat's reading of Reflection's chart, Beam spends about 25,000 tokens per Terminal-Bench attempt versus roughly 80,000 for GLM-5.2. The 8-bit and 4-bit versions fit on a single eight-GPU server. And unlike Meta's Muse Spark Open, launched Wednesday, there's no branding requirement or revenue cap in the license.
That angle makes sense next to a Gartner forecast that inference costs per agentic workflow will rise more than fivefold through 2028, even as per-token prices fall, because agents burn 5–30x more tokens per task. Fewer tokens per task matters more than a cheaper price per token, and Beam is the first open model I've seen built around that idea.
Cost also turned up in a partnership breakup. Replit CEO Amjad Masad said onstage at Disrupt that Replit is no longer working with Anthropic, calling it "a decision based on both cost, partnership, and performance" and claiming OpenAI's Sol and Astra now do better on Replit's vibe-coding benchmark. An insider disputed that the partnership has ended, and a late-September Replit post still listed Fable models in production, so treat it as a negotiating position until Replit clarifies.
Also worth a click#
Vercel says TypeSafe AI's Jev reached 35% of paid teams on its AI Gateway within two weeks, nearly double Sonnet 5.5. A small classifier-style model winning on volume is the Gartner advice playing out.
Elorian launched Glimpse, a visual reasoning model that can re-crop images and pull video frames while it reasons, priced at $0.60/$3 per million tokens.
My bet for the coming weeks: the next "rogue agent" disclosure will come from a company that isn't a lab, written by a security team that found it in their own logs. Before that happens, I'm going through every token my own agents can reach.