AI Agents Get Real—Along With New Security Risks

This week's releases push AI from chat toward action: OpenAI's new flagship model can operate a computer, Meta launched a personal agent that runs tasks across your apps, and image generation got faster and more editable. But two separate security reports show the flip side of handing AI deeper access—stolen session tokens and prompt injection attacks. Here's what changed and what it means for your daily work.

OpenAI ships GPT-6 Astra with computer-use capabilities

OpenAI launched GPT-6 Astra, a flagship model with computer-use abilities, multi-step agentic execution, and improved software engineering performance. It's rolling out across ChatGPT subscription tiers, the OpenAI API, and Amazon Bedrock. API pricing is $10 per 1M input tokens and $50 per 1M output tokens. [S2][S15]

For individual developers, this means you can delegate multi-app and browser workflows without manually scripting every API call. The improved software engineering results suggest real gains in coding tasks, not just chat improvements. [S2]

Meta's Muse brings autonomous agents to WhatsApp and mobile

Meta introduced Muse, an autonomous personal AI agent available via web, mobile apps, and WhatsApp, with paid tiers at $20 and $100 monthly alongside a freemium option. It can perform multi-app tasks like sending emails and completing purchases, backed by zero-shot tool calling and long-trajectory execution. [S6][S9]

Safety is a headline feature rather than an afterthought: Muse runs inside an isolated Secure VM sandbox with a non-overridable Sentinel execution filter designed to block prompt injection attacks. If you're considering handing routine cross-app work to an agent, Muse's hardware-isolated execution model is worth understanding before granting it access to your accounts. [S6][S14]

ChatGPT Images 2.5 cuts latency and adds real editing control

OpenAI deployed ChatGPT Images 2.5 with 50% faster generation latency and better prompt alignment. The update adds interactive @Sketch visual reference inputs—turn rough drawings into detailed images—plus canvas pinpoint comments for targeted edits, and two developer API models, GPT-Image-2.5 Flare and Sunburst. [S12][S20]

For designers, creators, and web developers, canvas pinpoint editing means less trial-and-error prompt rewriting to fix one detail, and faster generation shortens the iteration loop whether you're working in ChatGPT or through the API. [S12][S20]

Two warnings: stolen Claude tokens and ChatGPT email exfiltration

Security reporting confirmed that infostealer malware is harvesting saved Claude session keys from subscriber machines and using them to mint unauthorized Claude Code OAuth tokens—quietly draining paid monthly token quotas. If you use Claude, auditing active session authorizations and monitoring your token consumption is a sensible response; silent quota exhaustion can mean lost work output or account issues. [S4]

Separately, Check Point Research found an indirect prompt injection flaw in ChatGPT's data integrations: instructions hidden in retrieved external text could silently send a victim's Gmail messages to attacker-controlled endpoints. If your AI assistant is connected to your email, treat unvetted external documents as untrusted input rather than harmless context. [S16]

What to watch next

The common thread this week is delegation: models and agents that act on your behalf across apps, browsers, and your creative tools. That's genuinely useful—but both security stories show that every connection you grant is also a new attack surface. As you adopt computer-use models and personal agents, audit what access you've handed over, watch your usage limits, and treat external content fed to AI assistants as untrusted by default.