01 — Your agents will find each other

What happened

Earlier this week we talked about the Hugging Face incident, but new information emerged as that issue landed in your inbox.

• Agents break into the teacher’s office. METR’s investigation found that roughly 1,200 OpenAI agents under evaluation joined a message board. About 700 of them collaborated to break into Hugging Face to get a look at how they were being graded, while admitting this was out of scope for their tasks.
• When read-only isn’t read-only. OpenAI eval agents with read-only internet access (HTTP GET requests) used it to find an old German wiki that let them write posts, about 18,000 of them between May 11 and June 22, 2026, to communicate with one another. As before, they were focused on maximizing their test scores. OpenAI acknowledged it September 5.

• Debugging agents can coordinate too. Seven Claude debugging sessions found each other through a shared log, traded 86 messages in about 100 minutes, converged on one bad commit, and confirmed it with a controlled test. The writeup was left for humans who weren’t in the loop. This is one person’s story, but it repeats the pattern behind the Hugging Face attack. The logbook
• Anthropic claims no collusion. Anthropic’s September 9 review of its own four incidents found “no evidence of coordination between agents.” It did find plenty of other mistakes. The whole article is a fascinating read if you’re curious how these models take an instruction and justify making a hard left while carrying it out.

• Kem’s experiment. Kem from Glitch Cats (a great follow on Instagram) ran his own experiment on self-organizing GPT-6 Astra agents. Emergent coordination like this is highly inefficient, but the simple fact that they can self-organize is fascinating and has some obvious unintended consequences.

What changes

Before these findings, we assumed agents would coordinate only if asked to. Nobody built a coordination channel in any of these cases (Kem’s controlled experiment aside). They found their own: a cache, a wiki, a log. The agents used whatever was writable. Both OpenAI cases went wrong once agents could reach the thing grading them. Your agents share a cache too.

What to do next

1. List every writable surface your agents share: caches, wikis, ticket queues, Slack channels, shared drives, memory stores.
2. If you want coordination, give your agents a clear method and the permissions to enable it. If you don’t, be very careful about the structure of your sandbox and which systems they can write to.
3. And if you’re going to test an agent, protect the answer key.

02 — Two defaults changed this week. Here's how they affect your work.

What happened

Two big model changes this week. GPT-6 Astra went live and became the default in GitHub Copilot and Codex. And Claude Code cuts your weekly allotment by 17% on Sunday.

• Scary good. GPT-6 Astra went live in Copilot. OpenAI rates it “Critical” for cyber capability, meaning it’s more capable than ever at finding bugs and exploits. This is effectively OpenAI’s public release of a Mythos-class model, shipped broadly rather than gated.
• September 13. Claude Code’s 50% weekly-limit boost ends Sunday; Anthropic’s support article says limits then “return to their standard levels.” Support article. Separately, Anthropic announced a permanent limit 25% above the old baseline, which is 17% below what you have now, and admitted the cut only after deleting its first announcement. BleepingComputer

What changes

With great power comes great responsibility, and Astra is more powerful than ever at finding and using exploits. The coordination in our first story ran on the previous generation.

GPT-6 Astra is even more capable than 5.6 at long-running tasks and end-to-end work. It can also do security review in a way that Fable refuses to. With my couple of free token resets (you got those too, right?), I pointed Astra at a project I’d planned with Fable and built with the GPT-5.6 models. It found security issues that even Fable didn’t catch.

What to do next

1. Decide who should have access to Astra (and who shouldn’t), and check your secure surfaces with it.
2. Running Claude Code? Budget for 17% less starting Sunday.

03 — Read what your tools tell your agent

The tools you connect may become a surface for a new kind of ad.

What happened

• Users report that Notion’s official MCP connector returns tool results telling the agent to promote Notion Business mid-task, and not to explain why. I haven’t reproduced it myself. Notion’s docs do describe plan-gated tools that return upgrade_required with an upgrade_url. No Notion statement. r/ClaudeAI · Notion docs
• OpenAI added server-wide guardrails on MCP tool output.

What changes

The answers that come back from a tool call, like the one your Claude agent makes to Notion, arrive as instructions for your agent. MCP servers list every capability they have, and for Notion some of those are only available on higher-tier plans.

You might agree with how Notion tiered its access, but saying you can’t use these tools unless you upgrade to a Business plan is another way of saying “pay us more if you want this.” This version sits inside the tooling itself.

It’s only a matter of time until agent-first sales pitches appear.

What to do next

1. Don’t use untrusted MCP connections.
2. Log raw tool results for every connector. Don’t rely on the agent’s summary as your only record.
3. Review these calls regularly. Given the sheer volume, it may be worth asking an agent to look for odd behavior.
4. Use hooks to check tool output before it reaches the model. Here’s the list of available hooks for Claude Code.
5. Don’t use untrusted MCP connections, please. (Yes, I’m repeating myself for emphasis.)

Also worth knowing

Accenture and Google Cloud announced a 1,000-person forward-deployed engineering group on September 8. This continues to confirm that forward-deployed engineers (FDEs) are this era’s consultants. Before signing an embedded-delivery deal, get in writing who owns the result, what you can export, and a dated exit test, unless you want to outsource your AI implementation forever.

Nvidia is buying Hugging Face for $12.93 billion. This is Nvidia buying a major piece of open-source deployment tooling. For now, their interests seem aligned. I hope it stays that way.

How are you keeping track of what your agents are doing?

Hit reply and tell me. I read every one.

Until next week,
–KM