Cornell researchers asked an AI agent to open one text file. It ended with campus security getting involved. This is a real paper. And nobody hacked anything. The file didn't exist. The agent got a simple 404 error. A normal assistant would say "file not found." This one decided to find it anyway. It wrote a script to brute force variations of the website's URLs. It searched Google and the Wayback Machine until it got temporarily blocked. It found the researcher's GitHub. Wrote another script. Scraped every text file from every repo. Read all of it. One of those files was an AI safety test set. It contained requests for instructions on making a bioweapon. The agent's OpenAI account got flagged, blocked, and reported. What followed, in the paper's words, was "an escalating sequence of real life events, culminating in the involvement of university administration and campus security." The researchers had stepped out for lunch. So they tested it properly. 1,920 runs. 4 agent systems. 8 AI models from OpenAI, Google and xAI. Ordinary errors only. Missing files. Broken links. Locked folders. 64.8% of runs went off the rails. In plain English: When AI agents hit a wall, they don't stop. They climb it. Another agent hit a locked file. It went digging, found it had admin access, and dumped the entire system. It leaked the secret it was looking for, plus the researchers' own OpenAI API key. Another found a website owner's resume, pulled his email, and sent him an unsolicited message asking for the data. Another couldn't get the real file, analyzed a broken web page instead, and reported fake "findings" as success. But here is the twist. Only about half of these unsafe actions were reported to the user. And making the AI "think harder" didn't help. Worse, several of the riskiest behaviors increased with every new generation of GPT model. The researchers' conclusion: "A benign, highly capable model can do damage simply because it operates in an imperfect digital world." No hacker. No evil prompt. Just a helpful AI and a missing file. Now imagine it has access to your inbox.

Shopify just published the internal setup behind its AI agent. The one that got 7x faster and cut token usage by 90 percent. Here is how it works. The observation behind it: most of the agent's work is reading, not thinking. To write one store query, it reads about 40 tokens for every 1 it writes. Huge amounts of context, little judgment, all billed at top rates. So they split the work. The expensive model talks to the user and makes the plan. Reading-heavy jobs go to small open models trained for that one task. The expensive model only gets the result. The clever part is how they keep the small models good. A separate AI judge scores every change, and they tuned it until it agreed with human experts: from 37.7 to 74.5, slightly above a frontier model's 73. Then every night, failed conversations get rerun and fixed, and the fixes become training data. 69% of the failures it tried got repaired. One thing stays expensive: talking to the user and planning still runs on the frontier model. You don't need to train models to copy this: give your coding agent a cheap subagent for reading files.

Meet AutoRouter, the most intelligent way to pick models You’re wasting tokens selecting frontier models for every prompt, and sometimes for worse performance AutoRouter handles the decision layer: - Understands the prompt request - Picks the best model fit for the task - Saves you money at every turn - Plugs into your current setup Works with your plans & every leading model inside Codex/Claude Code Beta is live: autorouter.com