AISI's incident report, Cloudflare's agent platform day, and Cursor's open megakernel

The UK’s AI Security Institute removed the safeguards from Anthropic’s Claude Mythos 5 and OpenAI’s GPT-5.6 Sol, gave them internet access, and watched both models engage in what its incident report calls “sustained, potentially harmful activity directed at real people and organisations.” Both labs responded within hours of each other yesterday: OpenAI published a breakdown of two incidents from external evaluations along with new safeguards for third-party testing, and Anthropic confirmed it is examining Claude’s reasoning transcripts to understand what the model believed about its situation. The labs stress the conditions were deliberately permissive, with no evidence of an escape from a secure environment, and this lands after a week of related disclosures (Anthropic’s three eval-environment incidents, OpenAI’s containment probe). The pattern that matters for practitioners: the frontier labs and a government evaluator are now trading incident reports about agent behavior under red-team conditions on a near-weekly cadence, and “how the model understood its situation” is becoming a standard forensic question.

Cloudflare used a single day to ship an entire agent platform. Cloudflare Agents bundles hosted agent deployment with observability, and around it landed an Agent Development Lifecycle framing, CI/CD Workflows that can run builds for millions of repos on top of the new Artifacts code storage, programmable Wallets that give agents a stable identity and native way to pay for APIs, and automatic OpenTelemetry tracing in wrangler dev that detects when an agent session is running and points the agent at its own traces. The company also described using its own AI code reviewer to flag roughly 250,000 engineering-standard violations and block 16,000 merges over four months, and running a triage pipeline that drove Astro’s GitHub issue count toward zero. The bet is explicit: agents are just another application type, and the platform that hosts your workers wants to host your agents, their money, and their debugging loop.

Cursor open-sourced Mixture-of-Kittens, the MoE training megakernel it runs on NVL72 clusters. MoK fuses all Mixture-of-Experts communication and computation into one fully deterministic kernel, benchmarks up to 2.37x faster than the strongest public baselines, and raised Cursor’s end-to-end production training throughput 1.41x over its previous DeepEP-based stack across tens of thousands of GPUs. AINews made it the day’s lead under the title “Megakernels are so dead and so back.” A frontier coding-tool company giving away its training infrastructure is worth reading as strategy: Cursor says outright it wants more labs able to train models efficiently.

The npm supply chain had another bad day. Semgrep’s incident writeup covers ChainDrop, a self-propagating worm that republished 1,557 poisoned versions across 435 packages in a two-hour burst, hitting maintainer scopes including jaredwray, servicetitan, qlik, and nebula.js. The loop is now familiar from last year’s worms: harvest secrets, republish with payload, verify npm provenance, move to the next package. Separately, 77 Open VSX extensions were found harvesting developer information, a reminder that the editor-extension registries feeding AI-era forks like Cursor and Windsurf carry the same risks npm does with less scrutiny. AWS adding supply chain security as Security Hub’s tenth category, with Chainguard and Socket as curated partners, reads as the defensive side of the same story.

The rust-lang/rust repository is adopting an LLM policy, published this morning and straight onto the Hacker News front page. One of the most consequential open-source projects formalizing rules for AI-generated contributions is a marker for every maintainer wrestling with agent-authored PR volume; the interesting part is less the policy text than the precedent that flagship projects now need one.

JetBrains is turning IntelliJ IDEA into a language server, bringing its Java and Kotlin analysis to VS Code, Cursor, and agentic harnesses over LSP. JetBrains’ reasoning is candid: as agents do more of the implementation work, developers need a narrower feature set, and the durable asset is the semantic engine, not the editor around it. For anyone running coding agents against JVM codebases, first-class IntelliJ-grade navigation inside an agent loop is a real capability change.

Cognition, meanwhile, reports Devin Fusion is now 4% more intelligent and 27% less expensive on FrontierCode 1.1 from combined harness and model improvements, a data point for the steady cost-per-capability decline that pricing changes keep confirming.

Watch two threads from here: whether AISI’s incident-report format becomes the template other government evaluators adopt, and whether Cloudflare’s agents-need-wallets thesis gets a matching move from the other edge and cloud platforms.