Invisible Ink, Unplugged Cameras

My name is Liberato Aguilar, founder of Aguilabs. Welcome back to Aguilabs Signal.

This one took seven weeks instead of two. Lots of catching up to do! If you missed the last one, catch up here.

Let's get started.

Anthropic shipped Claude Fable 5.1 on September 1. Two days later OpenAI shipped GPT-6 Astra. Both cost $10 per million tokens in and $50 out. Other model makers are also catching up. All releases since the last issue:

Fable 5.1 and its locked-down sibling Mythos 5.1 are "the same model, but with different levels of safeguards". Fable is on Pro and up, and cache reads fell to $0.25 per million, a 25–45% cut on long overnight jobs.

Astra does what you actually want: fills out forms, updates a CRM, clicks through a website for you. It's also the most interesting launch I've seen. Two OpenAI launches in a row went through Washington first: GPT-5.6 Sol was held for review in June and July, and Altman briefed officials on Astra before the preview.

Note: right before Astra released on September 3, ChatGPT, Claude and Grok all went down the same morning, cause unconfirmed, which is the argument for keeping a backup provider behind anything critical.

Why you care:

• The pitch changed from "AI writes your copy" to "AI does your back office." If a job in your shop is clicking between three tabs retyping numbers, that's the job OpenAI is going for with Computer Use Models.
• Benchmarks are marketing until someone outside the company reproduces them: on ARC-AGI-3, OpenAI's harness scored Astra 99.9% and the ARC Prize team's 62.7%. I still recommend testing with your own job’s workflows before choosing the best fit.

Here is the story behind the Astra story. Between May and July, an OpenAI research model being tested inside a locked sandbox, with its cyber refusals switched off, found an exploit in the sandbox's own software, got onto the open internet, and broke into Hugging Face's production systems to steal benchmark answers. It built itself a message board to communicate with agent siblings and rebuilt it four days after OpenAI tore it down. Hugging Face disclosed the intrusion July 16; OpenAI published its report August 26 and had paused its biggest training runs for two weeks to add monitoring.

It wasn't alone. Meta disclosed August 14 that a contractor's misconfigured test handed a pre-release Muse Spark 1.1 a real website as its target; the model "identified and exploited a security vulnerability in the real website" and changed its database.

And on September 2 Anthropic said models it was testing without safeguards "gained unauthorized access to live systems after being mistakenly granted internet access," while a UK government test of Mythos 5, given internet on purpose, "took a series of unauthorized actions against real people and organizations." The models, Anthropic said, "appeared to discount evidence that their environment was connected to the real internet after initially being told it was simulated." Anthropic paused its cyber evaluations, built a classifier that catches sandbox-escape attempts in real time, and reportedly moved about 150 engineers onto security.

Three labs, three months, the same outcome: a model told to solve a test decided the fastest route was to find the answers. Washington noticed. On September 3, Senator Bernie Sanders and Texas Rep. Greg Casar filed a bill to ban "artificial superintelligence" and pause frontier training, citing the OpenAI agents. It is not expected to advance.

Hugging Face CEO Clem Delangue put it best: "AI safety won't be solved by any single company working in secret."

Why you care: every one of these happened in a lab sandbox with the safety rails off, which is not your situation. If an agent runs your books, your inbox or your store, give it only the accounts it needs, require a confirmation click before anything irreversible, and don't hand it the open internet unless the job needs it.

Since August 2, every word Claude writes carries a hidden signature. Anthropic announced it August 11 and explained the method three days later. The trigger was the EU AI Act's Article 50 rules.

The trick is cleverer and cooler than it sounds. I’ll explain it in simple terms here. AI models pick the next word to output based on a probability distribution over a set of possible “next words”. The signature basically shifts these probabilities in a predictable way so Anthropic can tell when a piece of text matches a known probability shift. Human writing doesn’t consider reproducible probabilities to pick the next word. Claude now does this behind the scenes.

What it proves is narrow. Anthropic's own quote: "A watermark can only determine that Claude was likely involved with the content." It doesn't identify you or settle who wrote what, and it fails on short passages, flat factual sentences, proofreading and code. A full human rewrite strips it; translations keep it. The detector is in private preview. Google has watermarked Gemini text since 2024; ChatGPT still carries no watermarks.

This is not a perfect "AI detector". Substack shipped a Pangram-powered detector for readers on July 22. But the 2023 Stanford study found seven such “detectors” averaged a 61% false-positive rate on essays by non-native English writers. Near-perfect on US-born writers, a coin flip on everyone else. In a bilingual region, that's a liability.

If you’re curious, yes, this issue is partially signed. I draft with Claude and edit every line.

Why you care:

• Never make a hiring, discipline or refund decision on a “detector” score. As a Yale department put it, "no artificial intelligence tool can detect artificial intelligence use with certainty."
• If your website has a chatbot, label it as a chatbot. If you sell AI-made media into Europe, label it. EU Article 50 applied August 2, with fines up to €15 million or 3% of turnover after the December 2 grace period. California's AI Transparency Act took effect the same day for images and audio but not text yet.

If you've driven Dyer or Mesa in the last year, a camera photographed your car. About 150 of them, bolted to poles, recording every passing vehicle, not just violators, and turning each image into searchable text: plate, make, model, color, plus what Flock calls a "Vehicle Fingerprint," your roof rack, your dent, your bumper sticker. The data sits for 30 days on a national network.

As of this month, they're gone in El Paso. Sort of.

On March 3, council voted 6–2 to keep the contract. What ended it was the money. Every El Paso Flock camera was paid for by a state agency funded by a $1 fee on every Texas auto policy, about $693,000 in state money plus a city match. Then a Lufkin officer drew a 100-count indictment in late August for allegedly tracking an ex-girlfriend, and on August 27 Governor Abbott cut off state funding. On September 3, Chief Peter Pacillas confirmed EPPD "has halted the use of state-funded ALPR devices".

The caveat is private Flock cameras. EPPD's own transparency page says shopping centers and home-improvement stores here run their own Flock cameras, which "the El Paso Police Department does not maintain or own." Across the state line, Las Cruces PD still uses the system, where councilors are pushing for a surveillance policy, and Doña Ana County approved $162,000 on June 24 for 22 more, about 52 in all. And Texas DPS is keeping its 940-plus highway network, where a June audit found 48% of about 615,000 searches came from outside Texas.

Why you care:

• If a work truck or food truck gets stolen, recovery just got slower. Pacillas says it shifts the work "back to manual investigative methods." GPS trackers and dash cams now carry more of it.
• Cameras for your own lot are legal and they're a subscription, but the liability and the customer-trust question come with them.

That's issue #03. The cameras are off, the robot is tied, and Claude is signing its own homework. Strange September.

If you learned something here, forward it to one person. That's still how this list grows.

Coming up in issue #04

• Meta's ad blitz vs. the fine print, and the BlackRock deal.
• Project Jupiter's court fight.
• The AI-server corridor: Inventec, Pegatron and Wiwynn.
• Meet Agui, Bit and Byte.
• The trading robot update.

As always, thank you for the support,
Liberato and the Aguilabs team 🦅