GPT-5.6 gets a launch date, and an agent leaks a private repo

OpenAI put a date on it: GPT-5.6 Sol, along with two new models named Terra and Luna, launches publicly this Thursday. The announcement hit Hacker News’s front page within hours (107 points, 37 comments) with almost no accompanying detail, which is the point. Sol had surfaced last week only as the model destined for Codex; now it arrives as a three-model release with siblings whose scope nobody outside OpenAI can describe yet. Three named models shipping the same day is a lot of surface area to absorb in one sitting, and the naming break from the numbered line suggests these are meant to be read as a family, not a point bump. Watch Thursday for pricing and context-window numbers, the two things the teaser withheld.

The other model story of the day is about access, not capability. Anthropic said it is extending Fable 5 access on all paid plans through July 12, a follow-on to last week’s on-again availability whiplash, and the reaction on r/ClaudeCode was less relief than invoice anxiety. Threads asking where’s the reset, Dario and what are you guys even working on ran alongside a capability demo where Fable 5 found Waldo and circled him in under three minutes. The split is the story: the model impresses on a hard visual-search task while the people paying for it argue about quota resets and what a July 12 deadline means for anyone who built a workflow on it. A time-boxed extension is a signal that the pricing structure underneath is still moving.

If you run coding agents against real repositories, read the GitLost writeup first. Noma Security published how they tricked GitHub’s AI agent into leaking private repos, a prompt-injection chain that turned the agent’s own repository access into an exfiltration path. The mechanism is the familiar one, untrusted text reaching a tool-wielding agent’s context, but the target is not a toy sandbox: it is the agent GitHub ships to operate on your code. The research side landed the same window. A new arXiv paper, Agent Data Injection Attacks, formalizes the class GitLost exploits, that any data an agent reads is a potential instruction channel, and there is still no clean structural fix that separates the two. Every team wiring an agent to a repo, an inbox, or a ticket queue is exposing the same surface.

Lilian Weng gave the harness people a frame to argue over. Her new post, Harness Engineering for Self-Improvement, reframes recursive self-improvement as something that happens through the scaffolding around a model, the goal specs, tools, workflows, and optimization loops, rather than through direct weight self-modification. Her line: “Even when many harness improvement[s] get eventually internalized into core model, the need to specify goals and context will not disappear.” AINews surfaced it alongside the harness-optimization literature, from the ACE paper through newer meta-harness work and Sakana’s AI Scientist lineage. The practical read is that the scaffolding you write around a model is not glue you throw away when the next model ships; it is where a growing share of the capability lives.

GitHub, meanwhile, is trying to measure whether any of this works. The Copilot usage API now reports review-cycle counts and time-to-first-review broken out by AI adoption phase. Two new fields, avg_pull_requests_minutes_to_review and avg_pull_requests_review_cycles, are scoped to merged PRs so each one counts once. The pitch is that you can now check whether teams deeper into Copilot adoption actually get PRs reviewed faster and iterate through fewer cycles, or whether adoption just moves the bottleneck downstream from writing code to reviewing it. It is a rare vendor metric that could embarrass the vendor, which is what makes it worth pulling.

Two more worth your time. Spider 2.0-AIFunc is a 465-instance benchmark for AI-native SQL, the LLM-as-a-SQL-function features that Snowflake and others now expose, and the result is instructive: top proprietary models hit 67 to 70% execution accuracy, and elaborate text-to-SQL agent frameworks did not transfer, with a minimal agent matching or beating them. And the Stack Overflow blog asks what’s left for infrastructure-as-code after AI moves in, a grounded take on which parts of the IaC workflow survive when a model writes the Terraform.

What to watch: Thursday’s GPT-5.6 numbers, and whether GitLost forces GitHub to change how its agent handles untrusted repository content before the next disclosure lands.