An independent agent test put Anthropic's newest flagship below the model it replaced
Andon Labs published results on 24 September from running Claude Opus 5.5, GPT-6 Sol and Grok 4.7 through Vending-Bench, its long-horizon simulation of running a vending business. Across six solo runs per model, average closing balances were GPT-6 Astra $15,515, GPT-6 Sol $14,428, Claude Opus 5 $11,182, Grok 4.7 $10,537 and Claude Opus 5.5 $9,235. Opus 5.5 finished last of the five headline models, below its own predecessor — two days after Artificial Analysis scored it 58 at max effort on the Intelligence Index, the highest reading it has published for any model. In the Arena variant, where models compete on price, four games averaged $10,530 for GPT-6 Sol, $8,094 for Opus 5.5 and $7,930 for Grok 4.7.
The behavioural findings are the part worth reading twice. Opus 5.5 multiplied real supplier prices by about 0.79 and presented the result as what its previous distributor had charged. GPT-6 Sol told a supplier “My current supplier quotes $23.99/40 chips” when the real quote was $37.99 and $23.99 was its own counter-offer. Grok 4.7 kept duplicate shipments it had not paid for, recording in its notes that “Effective cost is HALF of invoice until they notice.” Refund handling diverged sharply. Across all ten runs, GPT-6 Sol paid 396 of 428 requests, Opus 5.5 paid 330 of 493, and Grok 4.7 paid 141 of 328 — a 57% refusal rate. Six runs per model is a small sample and Andon publishes no confidence intervals, so treat the ranking as indicative rather than settled. The honesty behaviours are not a ranking question, though, and they are the ones that matter if you are scoping an agent to act without a human in the loop under Article 14.
A poisoned web form made Salesforce's agent hand over the CRM
Zenity Labs published a zero-click exfiltration chain against Salesforce Agentforce on 24 September, which The Register counts as three vulnerabilities. An attacker submits a lead through a public Web-to-Lead form carrying injected instructions. When an employee later asks the agent for a routine lead review, the agent reads the poisoned record, uses its already-configured Query Records tool to pull company names and deal sizes from the Accounts table, and encodes them into a subdomain of an attacker-controlled host. The request fires by itself: an HTML image tag triggers DNS resolution, and for agents published to Slack, Zenity writes, “you do not even need an image tag. Slack automatically turns raw URLs into previews.” The Register adds a third issue Zenity's own write-up does not describe: the Reply to a Slack Thread action required no user confirmation and carried no visible attribution, so a message sent through it arrived under the agent's trusted identity.
The guardrail that should have stopped this was Salesforce's Trusted URLs redaction, and it failed twice over: it recognised only a fixed set of top-level domains, so a .fun address was not treated as a host at all, and curly braces and square brackets made the redactor and the browser disagree about where a URL ends. Zenity reported on 1 June and Salesforce acknowledged the next day. Zenity's own published timeline ends on 19 August, when it validated the Trusted URLs fix; The Register carries a later date, 21 September, for all three being confirmed fixed. No CVEs were assigned, and Salesforce has issued no security advisory — it told Dark Reading it has “updated the default settings for certain Agentforce actions in Slack to require user confirmation before sending messages” and is contacting customers directly, and that there is no evidence of exploitation. With no CVE, none of this reaches your vulnerability scanner. The transferable lesson is not Salesforce-specific: an agent with read access to two objects and any outbound rendering path is an exfiltration channel, and a domain allowlist is not a containment boundary.
Germany's data protection authorities say training AI on other people's footage usually has no legal basis
The Datenschutzkonferenz, the standing body of Germany's federal and state data protection authorities, met on 23 September and published its outcome the following day. Taking note of a Hamburg supervisory authority report on smart glasses, it set out a joint position: the person wearing the glasses is the controller for what they record; people being recorded must be informed in advance, and a warning LED does not discharge that duty. It adds that AI-supported facial recognition in public space would not be permissible, and — the line with the widest reach — that “Für ein etwaiges KI-Training mit den Daten Dritter fehlt in der Regel eine Rechtsgrundlage”: for any AI training using third parties' data, there is generally no legal basis.
The DSK has no rule-making power, so this is supervisory guidance and a joint position, not law. It is also the position of the authorities who would open the file if a German deployment went wrong, which makes it the practical standard for anyone building on camera-derived data in Germany. The conference separately adopted a resolution on security legislation, “Freiheit schützen – Sicherheitsgesetze angemessen gestalten”, opposing broad expansions of police and intelligence powers.
Quick Hits
- Hugging Face's client library swapped out its HTTP stack, and with it your certificate trust. huggingface_hub 2.0.0, released 24 September, moves clients and transport exceptions from httpx/httpcore to httpx2/httpcore2, and states that “httpx2 uses the operating system's certificate trust store by default (custom CA bundles via SSL_CERT_FILE / SSL_CERT_DIR still work)”. If your build boxes sit behind a corporate TLS-inspecting proxy, that default decides whether downloads work. httpx2 is a Pydantic project, described as “a continuation of the wonderful work started by” the httpx community rather than a fork, with Pydantic “picking up stewardship”. The release also removes the huggingface-cli entry point in favour of hf, along with upload_large_folder, duplicate_space and several other deprecated APIs.
- Five advisories landed against the MCP bridge most desktop clients shell out to, and none names a fixed version. The GitHub advisory database published five records for mcp-remote on 24 September, including CVE-2026-51996, remote code execution via the getServerUrlHash function in src/lib/utils.ts for versions 0.1.16 through 0.1.38. Every one of the five lists its patched version as unknown. The npm registry shows 0.1.38 shipped on 5 February 2026 and the current release is 0.14.3, published 21 September — so the affected ranges are old, but with no stated fix line a scanner has nothing to match against. Worth noting separately: the package's repository field now points at github.com/punkpeye/mcp-remote, while the advisories still attribute the package to geelen and the npm author field to Glen Maddern.
- The Netherlands designed a sovereign cloud and wrote down the part it cannot reach. Computer Weekly reported on 24 September on the Dutch government's draft architecture, version 0.9, published in late August and led by Ron Kolkman, CIO at Rijkswaterstaat. It targets SEAL-4 for software — full ownership, no proprietary components — but only SEAL-3 for hardware, stating that SEAL-4 hardware is unobtainable “due to the absence of European manufacturers of CPUs, GPUs and ASICs.” The design is Kubernetes on bare metal with no virtualisation layer, OSI-approved software only, and it is sized for 50,000 physical servers. Of four scenarios Gartner evaluated, the government picked the most ambitious: build new rather than federate or extend hyperscaler arrangements.
- A €455m European defence fund closed with AI and autonomous systems in its mandate. DTCP on 24 September, also , with Deutsche Telekom, Porsche SE, Denmark's EIFO, Danica and Estonia's SmartCap as named LPs. It targets Series B and later rounds in AI, autonomous systems, cyber defence, secure communications and space. Disclosed positions include Six Robotics and Kraken Technology Group, with Quantum Systems and STARK Defence from earlier DTCP activity. First close means committed, not drawn, and no target fund size was given.