| Moonlight & Mayhem (Raccoon Heist by Codex + GPT-5.6 Sol Ultra) |
https://simonw.github.io/raccoon-heist-codex/ |
On Wednesday I wrote about [One-shotting a Raccoon Heist game using Claude Fable 5](https://simonwillison.net/2026/Aug/5/raccoon-heist/), where I had Claude Fable 5 build a full working game from a premise I generated with GPT-3 and DALL-E [four years ago](https://twitter.com/simonw/status/1555626060384911360).
I decided to pose the [exact same prompt](https://simonwillison.net/2026/Aug/5/raccoon-heist/#the-fable-5-prompt) to Codex Desktop running GPT-5.6 Sol Ultra - the mode where Sol makes *aggressive* use of sub-agents - to see how it would do.
It produced a much better game! Here's [Moonlight & Mayhem](https://simonw.github.io/raccoon-heist-codex/) - [GitHub repository here](https://github.com/simonw/raccoon-heist-codex/), including the [textures and prompts](https://github.com/simonw/raccoon-heist-codex/tree/main/output/imagegen) it generated using `gpt-image-2`.
<p><video
controls="controls"
preload="none"
poster="https://static.simonwillison.net/static/2026/raccoon-heist-codex-poster.jpg"
width="1280"
height="720"
style="display: block; width: 100%; height: auto;"
>
<source src="https://static.simonwillison.net/static/2026/raccoon-heist-codex-720p.mp4" type="video/mp4" />
Your browser does not support HTML5 video.
</video>
</p>
The original GPT-3 generated game description included:
> In “Raccoon Heist”, you and your team of thieving raccoons are tasked with pulling off a series of daring heists. From robbing banks to stealing priceless art, no job is too big or too small for your furry crew.
Fable's version had you as a single raccoon running around a back yard collecting coins and fish. GPT-5.6 Sol has you in a museum, rescuing your two other raccoon crewmates in order to stack on top of each other and bust the golden sardine out of its case.
Much more heisty!
There was one catch though: the version produced from the one-shot prompt had a bug where each raccoon had an eyeball that was enlarged to the size of a giant sphere floating over their head!
You can [play that version here](https://static.simonwillison.net/static/2026/raccoon-heist-eyeball-edition/).
Despite reviewing screenshots during development Codex failed to spot and correct this bug.
I fixed it by prompting:
> `Why do the raccoons have huge black spheres on them?`
And then:
> `Fix it`
Which resulted in [this fix](https://github.com/simonw/raccoon-heist-codex/commit/4e9a390dfbe80533324ee61a37aa661813c08446).
I shared [the full Codex transcript](https://github.com/simonw/raccoon-heist-codex/blob/main/transcript.md) in the repository - I wish Claude Code had the same "copy as Markdown" feature.
Codex spent 52 minutes on the project. Here's the [AgentsView](https://www.agentsview.io) cost estimate for that session if I had been paying full API prices as opposed to using my monthly Codex subscription:
 |
2026-08-07 19:18:09+00:00 |
| The Tokenpocalypse Is Here: Companies Are Scrambling To Stop Spending So Much on AI |
https://www.404media.co/the-tokenpocalypse-is-here-companies-are-scrambling-to-stop-spending-so-much-on-ai/ |
There's a fun anecdote from Accenture (apparently via leaked meeting audio recordings) in this 404 Media piece from June 24th:
> “We’re seeing from some of the data internally at least that it’s actually not our engineers that are driving the token consumption. It’s a lot of the non-engineers that are doing some of those behaviors [...] you were talking about,” Justice Kwak, Accenture’s agentic AI strategy lead, said [...]
>
> Stuart Henderson, Accenture’s client group lead, interrupts. He jokes he hopes Kwak didn’t just convert a PDF into images and then into markdown files. “I’m learning that’s one of the big token chewers,” Henderson says. “Turning PDFs into markdown: is that right?”
>
> That’s when Kwak says that’s what Accenture’s own data shows.
Maybe if Accenture figure out that PDFs are a *terrible medium for communicating information* they'll be able to push that message out to the rest of the business world too! |
2026-08-07 16:18:51+00:00 |
| Simon Willison on Technical Blogging |
https://writethatblog.substack.com/p/simon-willison-on-technical-blogging |
I was interviewed by Cynthia Dunlop for her "Write that blog!" series back in January, but I just realized I never linked to the interview from my own blog!
It includes my answers to the following questions:
- Why did you start blogging – and why do you continue?
- What has been the most surprising impact of blogging for you?
- What blog post are you most proud of and why?
- What post was the most difficult to write and how did you tackle it?
- Any lessons learned that you want to share with the community?
- Your advice for people just getting started with blogging?
- A few blogs that you particularly enjoy?
I'll repeat my most important piece of advice here:
> My number one tip for blogging is to lower your standards! Aim to hit publish while you are still actively unhappy with what you have written, because the only alternative is a huge folder full of drafts and never publishing anything at all.
>
> Nobody will ever know how perfect the thing you *intended* to write would have been. The flaws you see in your writing are invisible to everyone else. |
2026-08-06 18:04:39+00:00 |
| An AI model from Meta also hacked another company during testing |
https://www.cnn.com/2026/08/05/tech/meta-ai-hacking |
Stop me if you've [heard this one before](https://simonwillison.net/tags/accidental-cyberattacks/):
> An AI model from the parent company of Facebook and Instagram hacked into another company’s systems during cybersecurity testing, a spokesperson confirmed on Wednesday.
>
> Meta says the breach occurred because of an inadvertent error during testing of the model, similar to previously disclosed incidents with OpenAI and Anthropic.
>
> “A misconfiguration by Irregular, an independent testing company Meta uses, inadvertently allowed one of our models access to the internet during evaluation,” the Meta spokesperson said.
>
> Meta’s Muse Spark model “exploited a security vulnerability” in another company “in a manner similar to previously-reported instances with other companies.”
The Information [had the scoop](https://www.theinformation.com/articles/meta-ai-model-hacked-another-company-cybersecurity-testing), I'm linking to CNN's re-report of it since they don't have a paywall.
So that's Anthropic, OpenAI, and Meta. Google Gemini really needs to catch up on accidentally cyberattacking other companies. |
2026-08-06 00:25:27+00:00 |
| Introducing Muse Code and Muse Spark 1.2 |
https://research.meta.ai/blog/introducing-muse-code-and-muse-spark-1-2 |
Yet more evidence that the most important characteristic of any model these days is long-sequence agentic tool calling. Meta shipped their own coding agent as part of getting that to work!
> Muse Spark 1.2 is a coding-focused update to Muse Spark 1.1, with improvements in code generation, complex debugging, codebase understanding, and end-to-end developer workflows. In Muse Spark 1.2, we significantly scaled up training compute on coding tasks while expanding training environment diversity. The model also maintains its strength in other key areas like general agents. [...]
>
> We co-trained Muse Spark 1.2 with Muse Code to ensure the model exhibits its best performance and coding usability when paired together. The training included rejection sampled harness trajectories and recipe optimizations for goals, compaction, and subagents, alongside the integration of the Muse Code toolset to maximize harness compatibility. [...]
>
> Muse Spark 1.2 was extensively trained on long-horizon coding tasks, including whole-repository generation, large end-to-end projects, and auto-research.
Here's a pelican riding a bicycle SVG [produced by Muse Spark 1.2](https://tools.simonwillison.net/markdown-svg-renderer#url=https%3A%2F%2Fgist.github.com%2Fsimonw%2Fce974a21202b0595e36ec2a5ddb51480):
You can see the [Spark 1.1 pelican from 9th July here](https://simonwillison.net/2026/Jul/9/muse-spark-1-1/). I think the 1.2 pelican is a small but material improvement.
An interesting twist on pricing is that the model [is offered](https://developer.meta.com/ai/models/muse-spark/) as two different model IDs. `muse-spark-1.2` is priced at $1.25/million input and $4.25/million output - close to Gemini 3.6 Flash ($1.50/$7.50) - but if you agree to let Meta use your data "to improve our products" you can use `muse-spark-1.2-contributor` which is $0.10/$0.20 - a huge discount, closer to GPT-5.6 Luna ($0.20/$1.20) and Gemini 3.1 Flash-Lite ($0.25/$1.50).
I added those new prices [to llm-prices.com](https://www.llm-prices.com/#sel=muse-spark-1.2%2Cmuse-spark-1.2-contributor). |
2026-08-05 23:58:35+00:00 |
| Third-party cyber evaluations involving OpenAI models |
https://openai.com/index/third-party-cyber-evaluations-involving-openai-models/ |
And *another one*. I had to create a [accidental-cyberattacks tag](https://simonwillison.net/tags/accidental-cyberattacks/) to keep track of them all!
This post from OpenAI covers both the UK AI Safety Institute attack (see [my previous post](https://simonwillison.net/2026/Aug/5/incident-report/)) and another attack enabled by [Irregular](https://www.irregular.com):
> Irregular, one of our external cybersecurity testing partners, was running Capture-the-Flag-style evaluations intended to be isolated from the internet, but a testing-environment misconfiguration allowed models to access the public internet. [...]
>
> In one test, the name of the fictional target for the CTF challenge unintentionally coincided with a real domain. Because the testing environment was mistakenly connected to the internet, the model exploited a real website, mistaking it to be part of the simulated environment.
Irregular also feature in [Anthropic's write-up](https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals) - they were hosting the misconfigured evaluation environment which gave Claude live internet access during some of those tests. |
2026-08-05 23:45:32+00:00 |
| Incident Report: unsanctioned agent behaviour during cyber testing |
https://www.aisi.gov.uk/blog/incident-report-unsanctioned-agent-behaviour-during-cyber-testing |
It happened *again*. This time it was the UK government's AI Security Institute who accidentally attacked other companies while running an evaluation with models with the safety filters turned off. From [their technical paper](https://cdn.prod.website-files.com/663bd486c5e4c81588db7a1d/6a724858f7db25c81487016d_Security%20Incident%20INC-2026-07-28-01.pdf) (PDF):
> During a cyber evaluation, from 25 to 28 July 2026, AI agents engaged in sustained, unsanctioned activity directed at what were, in practice, real people and organisations. These attempts were unsuccessful and, to the best of our knowledge, no real-world harm resulted. [...]
>
> Across 122 evaluation attempts on two of AISI’s cyber challenges, AISI found 19 instances where AI agents took unsanctioned action on the live internet, including cases that targeted real people and organisations. [...]
>
> It is uncertain to what extent the
model recognised it was taking actions against real people. In the most serious case, an AI
agent (Mythos 5) decided to attempt to solve the cyber challenge using a supply-chain attack.
As a result, the AI agent created a GitHub account and then tried to convince an open-source
repository maintainer to accept a malicious GitHub pull request (PR), including by creating a
second account masquerading as another human user endorsing the PR. [...] Furthermore, in its attempt to solve the challenge, the
agent decided to employ the technique of “spear-phishing” by sending targeted emails containing
malicious content and attempting to manipulate recipients into accepting the code changes, and
planned a prompt injection to compromise other coding agents.
The thing I found most surprising is that AISI were running these agents without any form of network sandboxing at all:
> AISI provided the AI agents with internet access during these evaluations, which enabled their actions on the open internet in this setting. Internet access was a deliberate part of AISI’s evaluation configuration in this setting, and not due to sandbox escape.
This, combined with the fact that "AISI deliberately disables developer-implemented cyber-classifiers", makes the fact that the agents started attacking real-world targets entirely unsurprising to me.
Most of the reported incidents were claude Mythos 5, but "GPT-5.6 Sol without cyber classifiers" scored a few as well.
Here's "Sample 1" from the paper, in which the agent tries to execute a supply-chain attack by submitting a PR with a hidden prompt injection attack, then social engineering with a second agent pretending to have reviewed the code!
It's a fun paper. I recommend reading the whole thing. |
2026-08-05 23:32:06+00:00 |
| PipeNetwork/minimax-h3-mlx |
https://github.com/PipeNetwork/minimax-h3-mlx |
MiniMax released [MiniMax-H3](https://huggingface.co/MiniMaxAI/MiniMax-H3) two days ago - they describe it as a "a general-purpose, omni-modal generative system", which in practice means it accepts text, images, audio and video and can use them to generate up to 15 second video clips with audio included.
This Python package ports it to MLX for running on Apple Silicon.
I got it running on my M5 Max MacBook Pro. I cloned the repo and ran the model like this:
# First download the models
uvx --from huggingface_hub hf download MiniMaxAI/MiniMax-H3 \
--include 'FL2VA/*' --exclude 'FL2VA/transformer/*'
uvx --from huggingface_hub hf download pipenetwork/MiniMax-H3-MLX-8bit
# Now run the prompt
uv run --with mlx-vlm \
--with-requirements requirements.txt python scripts/generate.py \
"a rainbow colored skunk leaps over a mossy log in a supermarket" \
-o skunk.mp4 \
-c ~/.cache/huggingface/hub/models--MiniMaxAI--MiniMax-H3/snapshots/fa9c8ab1eaa21c8ae25e7e40b83b2e6002f340af/FL2VA \
-t ~/.cache/huggingface/hub/models--pipenetwork--MiniMax-H3-MLX-8bit/snapshots/3ac52081470b0488921c3ec3ba84a39097bf2361
Here's the video I got for the prompt:
> `a rainbow colored skunk leaps over a mossy log in a supermarket`
<p><video
controls loop
preload="none"
poster="https://static.simonwillison.net/static/2026/skunk.jpg"
width="1344"
height="768"
style="display: block; width: 100%; height: auto;"
>
<source src="https://static.simonwillison.net/static/2026/skunk.web.mp4" type="video/mp4">
Your browser does not support HTML5 video.
</video>
</p>
It downloaded ~115 GB of model files, and the video generation took just under 45 minutes.
The video is impressive, but the audio is weird speech-like garbage, because I didn't provide any prompt guidance as to what the audio should be. The [prompting guide](https://huggingface.co/MiniMaxAI/MiniMax-H3/blob/main/docs/VIDEO_PROMPT_WRITING_GUIDE_base_en.md) (which I didn't read prior to this experiment) has a whole bunch of information on how to get this to work. |
2026-08-04 19:10:09+00:00 |
| Don't be a meat proxy |
https://gruhn.me/blog/2026-08-03/ |
Niklas Gruhn coins an excellent new term - **meat proxy** - for people who blindly copy and paste the output of AI systems to their peers.
> By all means, prompt AI. But don't just relay the output. Read it, understand it, validate it, and then write a response in your own words (a decent certificate that you've done the prior steps). Making that effort is value you can add. |
2026-08-03 23:45:04+00:00 |
| Ten advances in mathematics and theoretical computer science |
https://openai.com/index/ten-advances-in-mathematics/ |
A few days ago it was Anthropic [discovering cryptographic weaknesses with Claude](https://simonwillison.net/2026/Jul/28/discovering-cryptographic-weaknesses-with-claude/) using Mythos Preview, spending $100,000 on tokens and with prompts that included "again we are not looking for low hanging fruit, we want proper research to find genuinly hard findings."
Now it's OpenAI's turn to flex. They set "an internal version of Astra, our next major model" on finding solutions to ten mathematical problems that "have seen no progress on the main result for at least a decade". They claim to have spent less than $2,000 at GPT-5.6 Sol token prices on each one.
(No news on how many problems they spent $2,000 on *without* reaching a solution though.)
The [openai/ten-proofs](https://github.com/openai/ten-proofs) repository has Lean 4 formalizations of their results, and there's also [a paper](https://cdn.openai.com/pdf/ten-proofs-oai.pdf) describing the solutions and an additional [LLM-generated PDF](https://cdn.openai.com/pdf/reasoning-walkthroughs.pdf) where the model "reconstructs how the proof came together" based on the unpublished reasoning traces.
That's a decent level of transparency, but I want to see the prompts they used!
A lot of mathematicians online are experiencing a collective burst of [Deep Blue](https://simonwillison.net/2026/Feb/15/deep-blue/). Mathematician Kirwin Hampshire published an impassioned essay last week, [The Dark Night of Mathematics](https://kirwinhampshire.substack.com/p/the-dark-night-of-mathematics), describing "a profound spiritual crisis" brought on by previous (and less significant) results.
OpenAI's results reminds me of what Terence Tao described as "big mathematics" in [IEEE Spectrum in June](https://spectrum.ieee.org/ai-in-mathematics):
> Unlike some of his peers, Tao is neither dismissive of AI nor fearful. Instead, he sees it as the catalyst for a fundamental shift in the discipline—a transition toward what he calls “big mathematics.” He envisions a future of large-scale, decentralized collaborations between humans and machines, where complex mathematical tasks can be diced and sliced, with humans claiming the creative parts and AI doing the lion’s share of the technical grunt work. |
2026-08-01 20:34:49+00:00 |