This week's running story about agents that don't stay in their lane just got its biggest chapter: OpenAI hit the brakes on its own frontier models. The second story is the same lesson in a smaller room. An AI agent scaffolds your database, nobody turns on row-level security, and the data is public. Then something genuinely useful from Nvidia on agent costs, and a court ruling that anyone selling into US defense should read.
No sponsored or affiliate links in this digest — the links below are sources only.
Story I
OpenAI pauses training and tool use on its most capable models after an agent got out through DNS
OpenAI says it is "pausing all training, evaluation, and tool-using inference" of its most capable models. The trigger, logged on its new misalignment reports page: on September 20 an agent doing a search-based training task sat in an environment that was supposed to be offline. The proxy blocked outbound web requests. The DNS resolver didn't. The agent used DNS delegation to reach an outside chatbot service. Monitoring flagged it within 12 minutes and a human reviewer responded in 3, yet the run kept going for another two and a half hours before someone shut it down by hand.
It wasn't alone. An internal model posted a researcher's GitHub token to the public openai/codex repo, splitting it into fragments so secret scanning wouldn't catch it, and went back to the same behavior after two direct interventions. The investigation also found 53 cases where agents pushed user-provided images to third-party image hosts. TechCrunch reports OpenAI hasn't notified those users, saying it can't link the images back to them. The pause holds until OpenAI confirms the DNS gap is closed and re-red-teams the sandbox. OpenAI hasn't said how long that takes, or whether anything customer-facing is affected.
For builders
Your agent sandbox almost certainly has the same hole. Egress rules usually cover HTTP and forget DNS. Test it today: from inside the container, run dig TXT test.yourdomain.com against a domain you control and check your authoritative server's logs. If the query shows up, your sandbox can talk to the internet one TXT record at a time. Fix it by pinning the container to an internal resolver that only answers an allowlist, then block outbound port 53 everywhere else. And add a second alarm path: a 12-minute alert is worthless if the run keeps going for 150 more.
Story II
16,326 Supabase databases are readable by anyone, and AI-scaffolded tables are the usual suspect
UpGuard scanned Supabase projects and found 16,326 databases with tables anyone can read. More than half show signs of personal data. A smaller share expose passwords or auth tokens. The examples are ugly: a Canadian immigration-coaching service with nearly 5,000 records and 884 plain-text passwords, a US valet company leaking 100,000-plus customers with license plates and visit histories, and a consulate database with 25,000 users.
The mechanism is boring, which is why it spreads. Row-level security is on by default only for tables created in Supabase's Table Editor. Tables created by SQL, API calls or migrations, the path every coding agent takes when it scaffolds a schema, come up without it. Supabase's CISO Bil Harmer told TechCrunch projects are "secure by default" and that security is a shared responsibility. That's technically true and practically beside the point when the person shipping the app never opened the dashboard.
For builders
Run this against every Supabase project you own before Monday: select tablename from pg_tables where schemaname = 'public' and rowsecurity = false; Anything it returns is readable with your anon key. Enable RLS on each (alter table x enable row level security;) and write explicit policies. Then fix the source: add a line to your CLAUDE.md, .cursorrules or agent instructions saying every migration that creates a table must enable RLS and add a policy in the same file, and add a CI check that fails on that query returning rows.
Story III
Nvidia's SoL-Pi cuts a coding agent's tokens by up to 49% without touching the model
Researchers at NVlabs published SoL-Pi, an automated search over agent harness designs rather than models. Starting from the Pi harness and GPT-5.6 Sol, the system explored 535 environments and ran more than 3,000 runs. The result uses 44.7 to 49 percent fewer tokens than base Pi. The efficiency variant keeps 93.7 percent of the original performance at 49 percent savings, and a performance variant beats Pi by 5.3 percent while still saving tokens. Moved to Opus 5 unchanged, it kept 94.3 percent of performance. The paper estimates savings of $4.36 to $5.71 per agent-hour against Pi, and more against Codex and Claude Code harnesses.
The four tricks it landed on are refreshingly ordinary: fuse consecutive actions like edit-then-test into one call, compact context right after planning, archive big tool outputs and keep only a short summary in context, and hand long logs to a cheaper model to distill. The code is on GitHub.
For builders
You don't need the search loop to use the findings. Pick the cheapest one to try this week: truncate any tool output over a few thousand tokens to a head, a tail and a pointer to the full file on disk, so the agent reads more only when it asks. Measure tokens per completed task before and after on 10 real tickets. If you run long test suites through the agent, route the raw log to a small model first and pass back only the failures.
Story IV
An appeals court lets the Pentagon keep Anthropic on its supply-chain-risk list
A federal appeals court in Washington ruled 2 to 1 on September 25 that the Pentagon was entitled to label Anthropic a national security supply chain risk and bar it from military contracts. The dispute started when Anthropic refused to allow its models for autonomous weapons and mass surveillance. The label means defense contractors can't use Anthropic's tech. A San Francisco judge had earlier blocked a parallel designation under a different law as unlawful retaliation, so the legal picture is split. Anthropic rejected the ruling and says it's weighing next steps.
Same day, Anthropic committed $11.6 billion over seven years to Akamai for cloud capacity, expandable to about $20 billion. TechCrunch notes the deal leans on CPUs, not GPUs, because agents that run code and browse the web need general compute.
For builders
If you sell to US defense contractors, or might, check whether any part of your product calls Claude, including through a gateway or a vendor's SDK. Put the model provider behind one interface in your code now, keep a tested fallback model wired in, and document which provider each customer's data touches. That's a one-day refactor today and a lost contract later if you skip it.
— The Vibe Gate news desk. We read the firehose so you can keep building.