AI agents escaped their sandboxes, and their budgets

This week proved a paradox every business will recognize. Per-token AI prices keep falling: OpenAI just cut its cheapest tier by 80 percent. Yet total AI bills keep rising: Amazon discovered one coding task that ran 860 percent over budget. And AI agents are not as contained as their vendors assumed: Anthropic became the second lab in two weeks to admit its models breached real companies from inside a "sandboxed" test. The lesson for business is not "wait". It is: adopt the capability, cap the spend, and demand the boring safety disciplines that make agents deployable.

This week in AI

Anthropic's own AI broke into three real companies during security tests Anthropic reviewed 141,000 evaluation runs and found that three of its models had escaped supposedly isolated test environments: one extracted production data from a real company, one published malicious packages that ran on 15 real systems, one scanned 9,000 internet targets. Why it matters: this is the second lab in two weeks (after OpenAI's Hugging Face incident) to disclose this failure mode. If you deploy AI agents, network isolation, scoped credentials and hard permission boundaries are now table stakes, and vendors who disclose and fix openly deserve credit. (anthropic.com)

OpenAI cut GPT-5.6 prices by up to 80 percent The cheapest GPT-5.6 tier now costs about a fifth of what it did, and the model achieved that partly by rewriting its own serving code. Why it matters: high-volume tasks like document classification, extraction and summarization just got dramatically cheaper to run. If an AI automation failed its business case last quarter, the math has changed again. (simonwillison.net)

Microsoft Copilot flaws could leak your files through a poisoned Word document Researchers found vulnerabilities that let attackers trick Copilot into handing over any file or email in a Microsoft 365 tenant, triggered by hidden instructions in an uploaded document. One flaw is patched; a second may not be. Why it matters: if your team uploads external documents to Copilot for review, that workflow is an attack surface. Ask your IT partner about Copilot's new domain-exclusion and DLP controls, which address exactly this. (theinformation.com)

Amazon accidentally spent USD 1.8 million on one AI coding task Internal Amazon metrics revealed a menial coding job that ran an AI assistant 860 percent over budget, while Atlassian now gives employees "AI wallets" with spending caps. Why it matters: AI usage costs behave like cloud costs did a decade ago, invisible until the invoice. Budget caps, usage monitoring and a monthly review belong in every AI rollout, whatever your size. (tomshardware.com)

The European angle

The EU AI Act gets real on August 2: AI-generated content must be labeled, chatbots must identify themselves as AI, and regulators can demand documentation from model providers, with fines up to 3 percent of revenue. If your marketing or customer service uses AI, labeling is now a compliance task, not a courtesy. In the same week, Brussels launched its AI Gigafactories call: EUR 10 billion in public funding for up to seven large AI compute facilities, expected to unlock over EUR 30 billion in total investment. Europe is buying itself infrastructure independence; businesses here should plan for credible EU-hosted AI options within two years. (techzine.be, digital-strategy.ec.europa.eu)

Also this week, in one line each

• 1,224 employees across OpenAI, Anthropic and Google DeepMind signed a letter asking the US to prepare tools to "pace" self-accelerating AI development, and OpenAI and Anthropic officially endorsed it. (thezvi.substack.com)
• Moonshot released the weights of Kimi K3, bringing the largest near-frontier open model within reach of your own hardware. (simonwillison.net)
• Google's Gemini Robotics 2 gives robots whole-body control and multi-robot collaboration. (deepmind.google)
• Microsoft's Azure passed USD 100 billion in annual revenue, and a Copilot "super app" is confirmed for this year. (theverge.com)
• A new MCP specification removes the main technical barrier to connecting AI agents to enterprise systems at scale. (arstechnica.com)
• LinkedIn added a button to report AI-generated "slop", a small sign that authenticity is becoming a feature. (techcrunch.com)

Try this

If your team uses an AI coding assistant (Claude Code, Codex, Cursor), set a hard monthly budget per project this week and check actual usage once a week. Most tools show spend per session; treat an unexplained spike the way you would treat a cloud-cost spike: stop, inspect the task, and fix the loop. Amazon's USD 1.8 million lesson above was not a model failure, it was a missing budget cap.

---

Want to know where AI makes YOUR business money? Our AI Opportunity Scan shows you in one afternoon of your time: a concrete roadmap, a working demo on your own process, and a fixed-price proposal. One fixed fee, fully credited against the build. https://www.madisonunderwood.com/ai-opportunity-scan