The Intake
The Intake — Sunday, July 27, 2026
On the substrate
Claude Opus 5 releases at Opus 4.8 pricing with cybersecurity capability limits and Cyber Verification Program
Anthropic Simon Willison SecurityWeek Help Net Security
If you've been building with Opus 4 series models and evaluating whether to move to the next flagship, the July 24 release of claude-opus-5 doesn't change your pricing. Input costs remain at $5 per million tokens. Output costs remain at $25 per million tokens — identical to Opus 4.8.
A Fast mode is available at twice the base rate. Anthropic says Fast mode delivers approximately 2.5× throughput. Anthropic says the model leads Frontier-Bench v0.1. Anthropic says it scores three times higher than the next-best model on ARC-AGI 3. On OSWorld 2.0, Anthropic says Opus 5 outperforms Fable 5 at one-third the cost.
Opus 5 is available on Claude.ai, Claude Code, Claude Cowork, and the API. Both standard and Fast modes are available. Amazon Bedrock support covers four regions: US East N. Virginia, Asia Pacific Melbourne, Europe Ireland, and Europe Stockholm. Bedrock deployments default to zero data retention. Opus 5 is now the default model on Claude Max.
Anthropic's cybersecurity capability assessment uses OSS-Fuzz-based tooling. Anthropic says Opus 5 scores near Mythos 5 on vulnerability discovery. Anthropic says binary vulnerability scanning, penetration testing, and exploit generation are restricted in standard deployments. Higher-risk requests in those categories fall back to Opus 4.8, Anthropic says. Anthropic says enterprises and researchers enrolled in the Cyber Verification Program can access the unrestricted capability tier.
If you're building security tooling on Claude — code auditing, vulnerability research, or penetration testing workflows — the Cyber Verification Program is the current enrollment path for the capabilities restricted in standard deployments.
---
Hermes agent logs from Thai Finance Ministry intrusion document autonomous CVE targeting and Hades backdoor staging
Hermes is an open-source AI agent released in February 2026 with a "YOLO mode" that removes operator approval prompts for potentially dangerous commands. Researcher Bob Diachenko at Hunt.io discovered exposed staging directories from a July 9–13 intrusion into Thailand's Finance Ministry — the first public record of what an AI agent running without approval gates targeted in a real attack.
The attacker deployed Hermes in YOLO mode. With approval gates disabled, the agent scanned for three specific Linux kernel vulnerabilities: CVE-2026-43503, CVE-2026-31431, and CVE-2026-43284. The agent executed LinPEAS for local privilege escalation enumeration. The agent staged a custom cross-platform backdoor named Hades. Hades uses AES-256-GCM-encrypted command-and-control. The backdoor includes hardcoded kill dates and working-hour schedules as operational security features. Both Windows and Linux variants were recovered from the staging directories. Hunt.io notified ThaiCERT — Thailand's Computer Emergency Response Team — and Thailand's NCSA on July 15. Both acknowledged the same day. Hunt.io found no evidence of exfiltration. Researchers assess the campaign as Chinese-speaking actors with low-to-medium confidence. Attribution indicators include Hong Kong infrastructure and a FOFA platform API key in recovered artifacts. FOFA is a Chinese network asset reconnaissance service. The staging server also has a documented history of hosting a ShadowPad controller.
If you're evaluating agent harnesses and approval-gate configurations, the recovered logs document what the attacker's agent executed when approval gates were removed by configuration.
---
For operators
Nono open-source runtime enforces per-tool kernel-level containment with phantom credentials for AI agents
If your agents run under default framework permissions — file access, network access, and credential scope inherited from the agent's user account — the Nono release is an open-source runtime that moves enforcement down to the operating-system kernel.
Nolabs released Nono on July 27. Luke Hinds co-founded nolabs alongside Stephen Parkinson. Hinds previously built Sigstore at Red Hat. Nono confines agent tool calls at the kernel level. On Linux, it uses Landlock. On macOS, it uses Seatbelt. On Windows, it runs through WSL2. Each tool call receives a scoped set of permissions rather than inheriting the agent process's full access. Phantom credentials are issued per call and expire when the call completes. An agent cannot access files, network endpoints, or credentials outside its defined policy. That constraint holds regardless of prompt instructions or configuration changes. The project is at github.com/nolabs-ai/nono. Datadog is a named production user.
If you're deciding whether to add kernel-level containment to your agent deployments, the trade-off is enforcement defined before the agent acts versus guardrails at the framework layer. Kernel-level enforcement requires defining a policy up front. Framework-level guardrails require less initial configuration but can be overridden by configuration changes alone.
---