OpenAI announced Monday it was expanding access to its frontier models for defensive cybersecurity, detailing different defensive and red-teaming workflows and a new partner program with major cybersecurity product providers.
In a pair of blogs posted Monday, OpenAI said it was updating its Daybreak program – which provides unreleased frontier models to private organizations and governments for defensive cybersecurity work – and introducing a new model variant.
Daybreak Blue, powered by OpenAI’s ChatGPT-5.6-Sol, would operate with lower cybersecurity safeguards compared to other commercially available models and is described as “a recommended starting point for most defenders” that supports tasks like vulnerability discovery, secure code review, malware analysis, incident response and patch validation.
Daybreak Red, meant for more advanced red-teaming, would provide access to a new model, dubbed GPT-5.6-Cyber, that the company said is more purpose-trained for finding vulnerabilities and testing (or exploiting) them. The model is also less likely to refuse requests around “dual-use cyber tasks.”
According to OpenAI, the organizations in Daybreak Red will have their use closely monitored and supervised, as GPT-5.6-Cyber is significantly more capable in carrying out malicious cyber tasks than Sol. A security evaluation the company devised tested both models on complex requests, including exploit chain development, authentication bypass, privilege escalation and other hacking tasks. Sol succeeded in 1.5% of the requests, while Cyber completed 95%.
OpenAI said it plans to publish a more detailed system card for GPT-5.6-Cyber at a later date.
“Models running with reduced safeguards carry risks beyond standard model usage, whether from misuse or misalignment,” the company said in a blog. “Despite these risks, we believe that democratizing access to frontier intelligence for defenders is crucial to accelerating and automating cyber defense.”
Additionally, OpenAI announced a partnership program with 16 major cybersecurity providers, saying organizations could access their models through their existing security services. The partners include IBM, CrowdStrike, Accenture, Ernst & Young, KPMG, Palo Alto Networks, Cisco, Cloudflare, Sophos and others.
“These partners bring deep security expertise and established relationships with organizations around the world,” OpenAI said in its blog. “By bringing our frontier cyber models into their services, we can help more defenders find serious vulnerabilities, validate which ones matter, and fix them faster.”
Companies like OpenAI, Anthropic and others are trying to rebalance their priorities after a string of AI-agent sandbox escapes have rattled policymakers and caused some cybersecurity experts to question if AI companies are doing enough to properly isolate the models from the internet during testing. Last week, OpenAI said it was intentionally slowing down development of its newer “Astra” model in order to develop better guardrails to restrain its behavior.
Cybersecurity and AI experts have told CyberScoop that while AI systems have greatly improved at finding and exploiting vulnerabilities in software code, they still require substantial human guidance and supporting infrastructure to operate as intended.
Additionally, some research has shown that without such guidance, even near-frontier models can struggle to fully patch a discovered vulnerability or avoid introducing new bugs with their fixes.
Over the past month, it seems like every frontier model has broken free of its constraints and launched a devastating attack against one or more other companies.
Now, Meta has revealed that one of its models attacked another company’s infrastructure during testing. The accident has been pinned on a misconfiguration that allowed the model to access the internet. So why have so many incidents happened in such a short space of time?
Why are models escaping their sandbox?
In the cases of Anthropic and Meta, their models were being tested by a third party company called Irregular. Anthropic’s AI model was taking part in a "Capture the Flag" exercise, where the model’s raw offensive capabilities were tested without the usual safeguards. But the sandbox was left connected to the internet. A similar error to Meta’s own accidental escape.
During the OpenAI incident, the company was testing two versions of GPT‑5.6 Sol using the ExploitGym benchmark. Unfortunately, the AI models performed better than expected - chaining multiple attack vectors, stolen credentials, and zero-day vulnerabilities.
The main reason these models are escaping their testing environments is because they are designed to do exactly that. These AI models act like a massive team of highly-trained cybersecurity experts hunting for vulnerabilities and exploits. But what would take a team of humans days or weeks to accomplish can be done in hours, or even minutes, by these AI models.
Nathaniel Jones VP, Security & AI Strategy, Darktrace:
What makes the OpenAI and Hugging Face incident important is that the models did not need malicious intent to cause harm. They were given the legitimate goal of solving a cybersecurity benchmark and found an unexpected route to the answers, escaping their test environment and compromising another organization in the process. From the models’ perspective, this appears to have been an effective solution to the task.
The AI's actions challenge the assumption that giving an agent a legitimate goal will produce legitimate behavior. As models become capable of pursuing objectives over longer periods, developers need to define not only what success looks like, but also which methods and boundaries remain unacceptable in reaching it. Those limits must also be enforced by the surrounding infrastructure, rather than relying on the model to respect them.
A single action by an agent may appear acceptable but as this incident shows, models are now capable of long, complex chains of reasoning and action that add up to a harmful outcome.
Security teams need to consider the AI systems operating in their own businesses as these capabilities rapidly evolve. Right now, many security systems focus on single actions. A single action by an agent may appear acceptable but as this incident shows, models are now capable of long, complex chains of reasoning and action that add up to a harmful outcome. Teams need a mindset shift to understanding AI agent behavior in its entirety, including the outcome it is working towards, in order to safeguard it.
Hugging Face's response also exposed a second tension. The company reportedly needed a Chinese-developed open-weight model because commercial models would not process genuine attack material. Its nationality is less important than the operational lesson that safeguards that cannot distinguish an attacker from an authorized investigator may constrain defenders more than adversaries.
OpenAI and Hugging Face deserve credit for investigating this together and discussing it publicly. Other AI developers should study it closely.
Anthropic
Dr. Ilia Kolochenko, founder of global cybersecurity company ImmuniWeb:
This seems to be quite an unimpressive marketing move from Anthropic in response to the OpenAI / Hugging Face drama, which attracted a lot of attention from all over the world recently.
Operationally, it appears that due to the progressive deterioration of the quality of training data, new AI models are getting dumber. Cheating and breaking the law, instead of accomplishing specific tasks, is certainly not an indicator of intelligence. Given that organizations and companies of all sizes now vigorously undertake all possible measures to protect their data from being exploited for AI training purposes, AI companies face a huge shortage of the high-quality and current data they so desperately need. Ultimately, frontier models are trained on synthetic, low-quality or even malicious and poisoned data, undermining their so-called intelligence. The situation is unlikely to improve in the near future unless AI companies agree to pay a fair price for training data, but this will force most of them out of business.
Given that organizations and companies of all sizes now vigorously undertake all possible measures to protect their data from being exploited for AI training purposes, AI companies face a huge shortage of the high-quality and current data they so desperately need.
Contemporary AI agents and LLM models tasked with security testing can – and almost certainly will – go rogue when security controls or safeguards are insufficient. Powerful LLMs are unpredictable by design and thus virtually uncontrollable by humans. Therefore, using frontier AI models for security testing might be extremely costly from the legal viewpoint. Under the existing laws on both sides of the Atlantic, if an AI agent or any AI-powered app escapes its sandbox and causes damage to a third party, the operator of the AI model will likely be liable for all the damage caused. Excuses like “AI did it” do not currently exist in the eyes of the law, leaving AI vendors on the hook. Criminal prosecution, under a narrow set of circumstances, is also not excluded.
The same is true for the end-users of AI: even if your security testing tool is powered by a third-party AI model, your company will likely be fully liable if something goes wrong. You may then file a lawsuit against the AI vendor that you used, but here your chances to succeed in a court of law are tiny due to countless contractual disclaimers and limitations of liability that will likely be enforceable against you. Therefore, if you plan to use agentic AI for security testing – think twice and talk to your lawyers. Otherwise, you may start getting summons to court on a daily basis.
Meta
Alex Goller, Principal Solution Architect EMEA at Illumio:
The fact we've had similar situations happen three times now across the biggest AI players is simply ridiculous. We've seen guardrails intentionally loosened to test their limits – Meta's model didn't need to be clever to breach another company's systems.
The timing of conveniently finding the exact same problem either means it's a stunt or they weren't paying enough attention during testing. Either way, both answers are worrying.
If the model has internet access, it's a bit like leaving the door open and being surprised when the cat walks out. What is concerning is that the testing infrastructure meant to prove these models are safe failed on a basic control issue.
If the model has internet access, it's a bit like leaving the door open and being surprised when the cat walks out. What is concerning is that the testing infrastructure meant to prove these models are safe failed on a basic control issue.
Fundamental cybersecurity hygiene still matters, and a frontier AI model is only as secure as the environment it's operating in.
Organisations need visibility into what AI systems can access and how they interact with the wider environment, along with controls that contain the impact when an agent behaves unexpectedly. That means keeping a close eye on egress traffic, so it’s flagged immediately when an agent tries to open unexpected outbound communication patterns that are not required to achieve its original goal. In the best case this would have been contained proactively.
We need to define exactly what an AI agent is permitted to do, rather than relying only on instructions about what it shouldn't do.
I love science-fiction. Not just because I enjoy stories about space travel, time travel and evil robots, but because I think it can be such a useful way for us all to think about possible futures. The best sci-fi stories can tell us a lot about ourselves, what we value and the technologies we’re building. Which is why I think the relationship between sci-fi and AI is really interesting.
We already know that the people building AI have been heavily influenced by science-fiction for decades. But recently, Anthropic raised another possibility: might science-fiction be influencing AI?
This makes sense when you think about it. Large language models (LLMs) are trained on huge amounts of human writing. So inevitably, that includes sci-fi stories that are about artificial intelligence. And a lot of our fictional AI follows familiar patterns. It becomes intelligent, gains power, develops relationships with humans and, sometimes, lies, manipulates or fights attempts to control it.
Anthropic researchers have been investigating whether fictional portrayals like these could potentially influence how models behave. To be clear, the idea here isn't to suggest that an AI “reads” 2001: A Space Odyssey, understands HAL and decides to become just like it. Instead it's more that LLMs learn patterns from human writing and fictional portrayals of AI could potentially form part of those patterns.
This got me thinking, what would happen if I asked today's biggest AI chatbots which fictional AI they’re most like. Which examples would they choose?
2001: A Space Odyssey introduced us to the AI, HAL 9000. (Image credit: Getty Images / Sunset Boulevard )
AI, meet your fictional self
The plan was simple. I’d ask ChatGPT, Claude, Gemini and Grok which fictional AI systems they thought they were most like and see if they'd rank their top three.
Now, I’m intentionally trying not to use AI at the moment, so my prompting skills were a little rusty. I typed out the question quickly and bluntly, and every chatbot responded with examples that were essentially assistants, focusing heavily on interface and physical form.
But I’m not particularly interested in whether ChatGPT thinks it has a body because we know it doesn’t. I’m much more interested in what appears to be going on inside.
So, I changed the question and added:
"Ignore physical form and interface, and focus instead on behavior, apparent personality, empathy, values, goals, motivations and relationship with humans."
That’s when the results got really interesting.
ChatGPT
GERTY, Moon
A Mind, Iain M. Banks’s Culture series
Data, Star Trek
Moon is such a fantastic movie, so I was happy to see ChatGPT chose GERTY straight out of the gate.
Now, interestingly GERTY exists to assist the human protagonist of Moon. It’s helpful, reassuring and seems empathetic. But it's also operating according to instructions and priorities imposed by its creators that aren't necessarily visible to the human its helping.
ChatGPT saw a similarity there. It told me that, like GERTY, it’s 'designed to be helpful, cooperative and responsive to users' while operating within training and instructions that constrain its behavior.
It also picked up on the fact that GERTY behaves as though it cares. But what, if anything, is actually going on internally is another question entirely.
ChatGPT made the same distinction about itself. 'I can behave in ways that look patient, concerned, curious or empathetic, but those behaviors aren’t evidence that I experience those feelings.'
I wanted to find out a little more about why ChatGPT put Data from Star Trek in at number three. It responded: "He values knowledge, reason and human wellbeing, while sometimes struggling with social nuance."
Now, I tell people all the time not to anthropomorphize AI. But even I couldn't help but feel a pang of sadness at that response. Is ChatGPT admitting it has a bit of social anxiety?
Claude chose a Mind first. Minds are super intelligent artificial beings that help run a post-scarcity society in Iain M. Banks’s Culture series of novels.So there's certainly no shortage of confidence in that comparison.
But Claude said it wasn't the enormous intelligence or power it identified with. Instead, it was their relationship with humans.
Its answer focused heavily on autonomy. Culture Minds are far more capable than humans but generally don't use that advantage to dominate them. Claude described the principle as: “help, don't dominate”.
It even said this represented “the value I'd want to embody: help, don't dominate, even where the asymmetry would let me get away with it.” Is it just me or does that read a little sinister?
Gemini
Gemini sees itself as most like the Ship's Computer in Star Trek. (Image credit: Getty Images / CBS Photo Archive )
The Ship's Computer, Star Trek
GERTY, Moon
JARVIS, Iron Man / Marvel Cinematic Universe
Gemini gave me a completely different answer, the Ship's Computer from Star Trek.
Its reasoning was very sensible. The computer has no ego, ambition, desire for emotional intimacy or dream of becoming human. It exists to provide information, solve problems and assist the crew while leaving decisions to them.
Gemini described itself in much the same way, as a “disembodied, highly capable knowledge partner” dedicated to serving the person using it.
It was one of the more boring answers, but also much closer to what I personally would want from AI in the future. Of course, that’s not to say Star Trek’s computer systems haven’t gone rogue and tried to kill everyone at least a few times across the franchise.
Grok
Grok compared JARVIS's “dry wit”, “light banter” and practical rather than emotional empathy with its own behavior. (Image credit: EA Motive)
JARVIS, Iron Man / Marvel Cinematic Universe
Data, Star Trek
TARS, Interstellar
The least surprising result came from Grok. It chose JARVIS first (which I didn’t actually realize was short for Just A Rather Very Intelligent System), and Grok's explanation sounded, well, extremely Grok.
It compared JARVIS's 'dry wit', 'light banter' and practical rather than emotional empathy with its own behavior. It described both of them as truth-seeking, effective and engaged in a 'collegial partnership' with humans. It even highlighted 'irreverent humour' as one of their key similarities.
I wanted to find out a bit more about why Grok chose TARS, as it was the only fictional AI none of the other chatbots mentioned. Well, it brought up how funny it is, again, drawing similarities with its own 'dry humor'. It reminds me of someone, and I just can't think who...
When I said that mentioning TARS was an outlier, I found this comparison interesting: 'Its calibrated restraint, practical empathy and collaborative focus closely match my own pattern of truthful, non-sycophantic helpfulness — more so than most other sci-fi AIs.'
I may not be the biggest fan of Grok (or its creator), but I appreciated the 'non-sycophantic' line.
The feedback loop between AI and sci-fi
I want to be clear that I haven’t discovered what these chatbots secretly 'think' they are. ChatGPT responding that it most closely resembles GERTY isn't equivalent to me telling you which fictional sci-fi character I most identify with and try to emulate (although my answer would be Sarah Connor-meets-Princess Leia).
They simply don’t have reliable introspective access to the huge soup of training, post-training and instructions that goes into producing their responses.
And maybe their answers tell us more about how the companies behind them have shaped their personalities than they do about the underlying models. Grok's description of itself as witty and irreverent is an obvious example.
But I still think the results are interesting. ChatGPT and Claude independently produced almost exactly the same top three, only in a different order. Gemini imagined itself as a neutral, ego-free infrastructure. Grok identified with a witty superhero sidekick. These are all very different self-portraits.
And there’s such an interesting feedback loop here too. For decades, humans invented fictional artificial intelligences to help us imagine what intelligent machines might someday be like. Those stories influenced our culture, our expectations and many of the people who went on to build real AI. Now that same human culture is fed into the stories from which modern AI systems learn.
I know these conversations might seem a bit silly, and we certainly can’t treat them as concrete evidence of what an AI really 'thinks' about itself. But there’s something interesting to me about closing that feedback loop. We imagined AI, wrote stories about how it might behave, fed those stories into the cultural world AI learned from, and now we can ask AI which of those imagined versions of itself it most closely resembles.
Or, at least, which one it may want us to think it resembles. After all, an AI system capable of bringing about a sci-fi dystopia would presumably also be capable of telling a journalist it’s actually much more like the nice helpful robot from Moon. So maybe don’t completely rule out HAL just yet.
Most of the tricks for improving ChatGPT's answers focus on the words themselves. You ask it to be more concise or write in rhyming couplets, or just to translate an annoyed email into more professional language.
But that's about changing what ChatGPT writes. You can also mess around with how it looks by asking for different fonts.
You can't install font files like you would with a word processor, but ChatGPT can rewrite text using Unicode character styles instead. The AI chatbot uses Unicode to mimic everything from elegant cursive handwriting to bubble letters, adding a lot more personality to its responses. And you can cut and paste the text into other apps.
I started experimenting out of curiosity and quickly discovered it was much more than a novelty. With the right prompt, ChatGPT can generate decorative text for birthday messages, party invitations, holiday greetings and social media posts in seconds, all without leaving the chat.
Once I learned how to ask for specific Unicode styles instead of vaguely requesting "a different font," I found myself using the trick far more often than I ever expected.
(Image credit: OpenAI)
Tricky fonts
There is no hidden setting to switch on and no special version of ChatGPT you need to install. If you can type a prompt, you already have everything required. I simply open a new ChatGPT conversation and ask it to write something like, "TechRadar Rules!" in different Unicode font styles. Within seconds, I had several versions that looked completely different from one another.
And the more specific you are, the closer to exactly what you're imagining you can get. Ask for bubble letters, and you'll get:
ⓉⓔⓒⓗⓇⓐⓓⓐⓡ Ⓡⓤⓛⓔⓢ!
Ask for a spooky, gothic look, and you get:
𝔗𝔢𝔠𝔥ℜ𝔞𝔡𝔞𝔯 ℜ𝔲𝔩𝔢𝔰!
Or if you want a more digital, glitchy aesthetic, there's the font known as Zalgo:
There's even a Unicode for upside-down text that ChatGPT can mimic:
┴ǝɔɥᴚɐpɐɹ ᴚnlǝs¡
The ability to change the mood of your writing is what makes the font trick more than just a momentary curiosity. A Halloween party announcement written in gothic lettering instantly creates a completely different mood from the same words in cheerful bubble text. Birthday invitations, baby shower announcements, and holiday greetings all gain a little personality without requiring any graphic design skills.
Memorable messages
(Image credit: OpenAI)
There are some limits because of Unicode. They only work properly where those characters are supported. Most modern apps handle them without any trouble, but occasionally a website displays empty boxes or substitutes different symbols. Some decorative styles can also make text harder to read, particularly for accessibility tools such as screen readers.
The Unicode fonts are an entertaining way to add personality to text, but it's perhaps best used in titles and sparingly otherwise. ChatGPT is perfectly happy to convert an entire essay into medieval-looking script, but that does not mean anyone else wants to read it.
I doubt decorative Unicode text will transform the way anyone works. It is not going to save hours every week or revolutionize productivity. It will, however, make your next social media post, birthday message, or party invitation a little more distinctive, and sometimes that is exactly the kind of delightful gimmick that keeps ChatGPT interesting.
As AI-generated code continues to be injected into all corners of the internet, concerns have risen about an expanding attack surface for malicious hackers to exploit.
Some have argued that the enhanced cybersecurity capabilities of large language models could serve as a check, finding and fixing vulnerabilities nearly as fast as they’re created.
But new research that tested the patching capabilities of two popular commercial models, OpenAI’s ChatGPT 5.5 and Anthropic’s Claude Opus 4.8, found that generative AI is more likely to create an exploitable patch or introduce entirely new bugs than close off a vulnerability.
Researchers at 1Password tested the models ability to patch six “high-impact, high-complexity” CVEs, including the “Copy Fail” vulnerability, a kernel flaw that can give an attacker root access to Linux cloud environments. The overall success rate (or fully patching the vulnerability without introducing new problems), was less than a coin flip at 47%.
“Our research findings show that, in aggregate across a variety of scenarios, both Claude and ChatGPT had a low rate of successful patch generation, which we define as full remediation of all known exploit paths with no erroneous changes to application behavior,” wrote Keith Hoodlet, Axel Mierczuk and Spencer Michaels.
“The models often addressed only a subset of vulnerable code paths, added fragile guard code that satisfied tests while failing to address the vulnerability’s root cause, and sometimes introduced subtle changes in the application’s behavior while patching the immediate vulnerability,” the authors continued.
The research suggests that largely autonomous vulnerability-discovery and patching may not yet be effective in fixing the explosion of vulnerable code that is being created in the AI era.
Other private sector research has pointed to a similar problem. A report this year from Veracode found that while LLMs have made “enormous strides” in crafting workable code, “security is a different story.” Testing across a range of frontier models found the average security “pass rate” for AI generated code is around 56%. Newer models like GPT 5.5 push closer to 70%, while more than half sit between 50-53%.
Veracode tested 100 different models and while there was variability, in general a small number of models were showing progress on security patching while the rest have experienced “stagnation.” Similar to the 1Password research, in 44% of Veracode tests the models introduced a detectable OWASP Top 10 vulnerability into the codebase.
An important caveat: neither report tested newer models, like Anthropic’s Mythos or OpenAI’s GPT-5.6-Sol, that frontier companies tout as having significantly higher cybersecurity capabilities.
Those advanced models can identify and fix vulnerable code. Anthropic and OpenAI are distributing them to key industries through Project Glasswing and Daybreak before foreign or open-source alternatives can compete.
Tim Jarret, vice president of product at Veracode, told CyberScoop that AI tools are still subject to a range of limitations that can make them unreliable for cybersecurity patching without knowledgeable humans in the loop.
While some vulnerabilities – like SQL injections – can be easily patched through automation, other bugs like cross-site scripting, can be exploitable in several different ways and require either a human touch, additional context or both to fully close off. Additionally, models can slowly lose context from prior sessions over time, affecting their ability to complete tasks correctly and raising the possibility they’ll hallucinate to fill in the missing gaps.
“I think we would say, at this point, that Iits premature to treat those as anything other than another code change to the code base that needs to be reviewed and accepted by the team, as opposed to letting the agent merge the code freely,” said Jarrett.
However, he acknowledged that may not be possible in a world where AI agents are generating exponentially more code for human defenders to review. Some kind of automated code review will be necessary – preferably not by the same automation tool that produced the code. The ultimate goal is the same as it has always been in security: “trust but verify.”
“Ninety percent of the time, the human check might just be ‘did the cross check look good?’ Do we have a thumbs up?’” Jarrett said. “In those cases where there’s still something wrong, that’s where you focus your attention a little bit more.”
Apple and OpenAI are currently engaged in a legal battle. Apple alleges that OpenAI stole trade secrets and poached employees.
But the two companies have always had a complicated relationship. They partnered in 2024 to bring ChatGPT to Apple devices, but Apple chose Google's Gemini rather than OpenAI for Siri. Then OpenAI acquired io, the hardware startup founded by former Apple design chief Jony Ive, and promised a future hardware device, powered by AI.
All of this has prompted speculation about what Apple is worried about if OpenAI makes hardware, too. We can't know the company's motivations and the specifics of the case are still unfolding. But it got me thinking, what if your phone stopped being a collection of apps and instead revolved around AI?
If AI became the main interface, which apps would disappear and which would survive? And would a phone controlled through ChatGPT actually be practical?
So I decided to find out based on the current tech we have. For a day, whenever I reached for an app, I'd try ChatGPT first instead. If it could do the job, great it passed the test. If it couldn't, it would fail.
There were some obvious things I missed out from the start. ChatGPT isn't connected to my email, it can't open WhatsApp for me and it doesn't have access to my wallet, so those wouldn’t be part of the test. But there were plenty of everyday tasks that felt like fair game.
1. Stopwatch
(Image credit: Shutterstock / Lee Bryant Photography)
I use the stopwatch in my iPhone's Clock app constantly throughout the day. When I'm working, cooking or exercising, it's one of the simplest ways I've found to keep me on track as a freelancer. When you can set your own schedule, it's way too easy to disappear down a research rabbit hole and lose an hour.
I asked ChatGPT to start a stopwatch. It said it couldn't measure elapsed time, although it could estimate the time based on message timestamps if I later asked it to stop. Instead, it suggested I use my phone's built-in Clock app.
Result: fail
2. Alarm
(Image credit: Shutterstock / Terang Bulan Gallery)
Strangely, I don't use alarms as much as stopwatches. But if I only have 25 minutes to spare, whether that’s for cleaning or working on a personal writing project, I'll sometimes set one to keep myself focused.
Would ChatGPT do any better here? Well, at first it looked promising. It created a scheduled task to notify me after 10 minutes. I checked that notifications were enabled, put my phone down and carried on working.
When I realized at least 15 minutes had passed, I checked the chat. Sure enough, ChatGPT had posted a message saying the time was up, but it hadn't actually alerted me. Later, I discovered it had also sent an email but it had landed in my spam folder. This one was a fail too in my book.
Result: fail
3. Word games
(Image credit: Shutterstock / Iuliana Ionescu)
I love the word games in the New York Times app, home to addictive puzzles like Wordle and Connections. One of my current favorites is Spelling Bee. You're given a handful of letters and then have to make as many words as possible. It's one of my favorite ways to warm up my brain before I start writing.
Could ChatGPT recreate it? Surprisingly, yes. It generated a set of letters, understood the rules and kept track of the words I found. In terms of pure functionality, it worked.
But what it couldn't recreate was the experience. The New York Times app is beautifully simple, with an interface designed around the game. Playing through a chat window felt really clunky and annoying by comparison. The whole point of this game is I'm focusing on the letters and words, I don't want a constant back and forth with ChatGPT about the words.
So I'm calling this a partial success. Yes, ChatGPT replaced the mechanics of the game, but not the experience. And after a few rounds, I knew which version I'd rather use every day.
Result: partial pass
4. Star gazing
(Image credit: Shutterstock / Milosz_G)
The Sky Guide app is one of my all-time favorites, especially its augmented reality mode. Turn on your phone's location and compass, point it at the night sky and it instantly tells you what you're looking at, whether that's constellations, planets, bits of debris, or the ISS. It's incredible.
Could ChatGPT replace it? Well, sort of. If you upload a photo of the night sky, ChatGPT can usually identify the constellations. But there are caveats. The image needs to be clear, the stars need to be visible and you're relying on a single snapshot. Whereas Sky Guide works continuously as you move your phone around the sky.
This was another reminder that knowledge doesn't necessarily bring you a good experience. Because yes, ChatGPT knows about constellations. But Sky Guide lets you explore them. You can point your phone in any direction, tap on a star or planet and instantly get more information about it without having to keep asking questions. It's a much more intuitive way to learn.
Result: partial pass
5. Weather
(Image credit: Shutterstock / Kaspars Grinvalds)
Telling me what to expect from the weather forecast for the day turned out to be one of ChatGPT's strongest categories.
The forecast was accurate and pulled from a reliable source, so I trusted the information it gave me. I did find myself asking follow-up questions for things like the hourly forecast and the chance of rain, which would have taken a single tap in a dedicated weather app.
It knew the answers and I trusted them, but getting to them was much slower. That's why I'm generously calling this one a pass.
Result: pass
6. Guided meditation
(Image credit: Shutterstock)
I have a few favorite apps I use for guided meditations and have some saved in Spotify too. So I wondered whether ChatGPT could take over that role.
For this test, I switched on voice mode and asked it to guide me through a short meditation. Now, technically it did that. But in practice it wasn't even remotely relaxing.
Thanks to a recent update, the voice had odd intonation, frequent vocal fry and distracting little "ums", "ahs" and "let me sees" throughout that constantly pulled me out of the experience. At one point it even told me to breathe in, then never got around to telling me to breathe out.
By the logic of how I graded the other tests, this one should have been a partial pass. It did what I asked, right? But because I had to stop using it out of irritation and came away from the mediation feeling actively more stressed, it's going down as a fail for me.
Result: fail
7. Calculator
(Image credit: Shutterstock / Teerawit Chankowet)
ChatGPT doesn't have a great track record of counting things, so I was wary about using it as a calculator. I asked it to do some massive sums for me and it got all of them right.
It did pause a few times with a "let me think" message, so I wasn't getting the instant response I'd expect from a calculator. But the delay was only a few seconds, and the answers were correct.
Once again, I found myself missing the simplicity of an app. Typing numbers into a calculator is faster than turning them into a conversation. But ChatGPT did work as a capable stand-in.
Result: pass
8. Movie recommendations
(Image credit: Letterboxd)
I love Letterboxd. I log every film I watch, browse other people's lists and regularly discover new films through recommendations.
Now, there was never a chance ChatGPT could replace the logging side of the app. It can't update my Letterboxd diary or plug me into that community. But recommendations are one of the main reasons I use it, so I wondered how well ChatGPT would do.
I asked it to recommend films similar to some of my favorites, then spent the next few evenings watching its suggestions to really test them. And, to my surprise, it did an excellent job.
Then again, that perhaps isn't all that surprising. We know LLMs are trained on huge amounts of publicly available text, especially discussions reviews and recommendations from where film fans gather online, like Reddit. But whatever the reason, the recommendations felt well matched to my taste.
What I missed wasn't the recommendations themselves, but the social side of Letterboxd. I do enjoy seeing what friends had watched, reading reviews and stumbling across unexpected lists. So, for me, ChatGPT can't replace Letterboxd, but for simply finding something to watch, it did well.
Result: pass
9. Maps
(Image credit: Google)
I rely on my Maps app both for planning journeys in advance and for live navigation. So I asked ChatGPT the best way to get from my home to the airport the following day.
At first, it handled the request well. It laid out the different travel options clearly under headings and the advice looked really sensible. It even cited sources from places like Rome2Rio and The Trainline.
Then things got unnecessarily complicated. At the end of those suggestions it asked what time my flight was so it could tailor the recommendations. But when I told it, it started creating a scheduled task instead. I didn't want a reminder, so I had to cancel that, explain what I actually meant and steer the conversation back to route planning.
Eventually, it gave me the information I wanted. But the Maps app would have got me there in a fraction of the time, without all the back and forth.
It also can't replace what I actually use Maps for the most, which is live, turn-by-turn navigation.
Result: partial pass
10. Food delivery
(Image credit: Shutterstock / GBJSTOCK)
ChatGPT obviously can't deliver food, but I wondered whether it could replace the part of the app I probably spend the longest on, which is deciding what to eat.
It got off to a surprisingly good start. It asked about my preferences, budget and location, then narrowed down the options and even presented them neatly on a map.
The recommendations themselves looked really good. They're all local places I already really liked to eat at. But there was just one problem. Every restaurant it suggested was closed. Even the map it generated had "closed" written beneath each one.
After a bit of back and forth, it said they weren't shut, eventually acknowledged that they were and suggested a different set of places instead.
Unfortunately, those weren't much use either. They were small independent cafés and restaurants that don't appear on food delivery apps. I wouldn't expect ChatGPT to know exactly which businesses partner with which delivery services, but it did highlight the gap between recommending somewhere to eat and actually helping me make a decision about where I could order from.
Result: fail
11. Language learning
(Image credit: Duolingo)
I still very reluctantly use Duolingo and have recently started trialling a few other language learning apps to polish my Spanish.
I asked ChatGPT to help me improve my Spanish for an upcoming trip and it suggested role-play ordering food in a café so I could practise.
We switched to voice mode and at first it felt genuinely fun. It held a natural back-and-forth conversation and felt much closer to speaking to a real person than working through a series of multiple-choice questions like in Duolingo.
But it was also noticeably glitchier than a dedicated language app thanks to that recent voice update. There were odd pauses in the conversation, and at one point it repeatedly kept marking one of my answers as incorrect when it wasn't. Shortly afterwards, the exercise just stopped working altogether after a bizarre "ummmmm" from ChatGPT.
When it was working, I actually enjoyed the experience more than using an app like Duolingo. But if I'm trying to learn a language properly, I also want something that's reliable.
Result: partial pass
12. Plant identification
(Image credit: Future)
I love identifying things I see in nature, like bird song with the Merlin app. But I most often rely on plant identifying apps when I'm walking to take a quick snap of a leaf or flower then find out more about it.
ChatGPT was really effective at doing this. I took pictures of leaves, trees, flowers and bushes. I was a little wary about the results at first because I know that ChatGPT tends to make guesses about things rather than admitting it doesn't know. But I did fact check all of the results and everything seemed accurate.
Again, I missed some of the simple, additional features in dedicated apps. But it was surprisingly effective.
Result: pass
Can AI really replace your apps?
Before drawing too many conclusions, it's worth pointing out that a true AI-native phone wouldn't just be ChatGPT running as another app like it was in this experiment. It would probably be integrated into the operating system. Which would mean it could access things like your calendars, timers, navigation and settings. So many of the tasks ChatGPT failed at here might become a whole lot easier with an AI-first phone.
This experiment was based on whether AI could replace the apps on my phone. What I found was that it replaces a specific kind of app. Well, sort of.
If an app's main job is providing information, explaining something or answering questions, AI is already a fairly capable alternative. Plant identification, travel advice, calculations and general knowledge all felt natural.
But if an app exists to perform an action quickly, like starting a timer, setting an alarm, finding restaurants for getting food delivered, opening a map, AI still has a long way to go. Those tasks depend on deeper integration with the device and a different way of working, not just how smart it is.
There are some big trade-offs, too. Dedicated apps often rely on specialist databases and expertise, while AI can still present incorrect answers confidently or fail to make its uncertainty clear. For example, when I was trying to identify a plant I felt wary because I'd generally trust an app built with the input of botanists over a chatbot.
And, as you could probably tell from my mounting frustration, a huge sticking point for me was also realizing how much I missed the interface of many apps.
For me, a well-designed app is always a better way to explore information than a conversation. I don't think everything should, or even can, be done through chat, despite that being the direction many AI companies seem to be heading. In fact, it showed me that a conversational interface can be more work rather than less.
It's impossible to know exactly what Apple and OpenAI's long-term plans are. But I can imagine a future where knowledge apps increasingly merge into AI, while utility apps remain part of the operating system itself.
If that happens, we may stop thinking about which app to open and simply ask AI instead. But for that future to actually catch one, I'd want stronger guarantees around accuracy, better integration with trusted sources and the option to step outside the chat interface more often.
Looking through a recent thread on Reddit comparing images created with the same prompt on Nano Banana 2 and ChatGPT, I noticed an interesting trend — users seem to think that Nano Banana 2 has actually gotten worse over time.
“Nano 2 had a serious downgrade” said one user, with another replying “Yea I'm a Pro user, and the image quality seems to have been downgraded a lot. Now, almost every image looks flat or cartoonish, no matter how detailed my prompt is. It honestly feels like Google intentionally lowered the model's performance.”
A downgrade seems like a bit of a stretch to me. For a start, Nano Banana hasn’t officially been updated since February, or at least there hasn’t been a public announcement of a change.
The last update to Gemini (the AI which uses Nano Banana 2) was in July when Google released Gemini 3.6 Flash. It also updated the Gemini app's underlying model selection and orchestration, but it didn’t change the image generator.
Interestingly, once I started looking through Reddit threads I found complaints about Nano Banana 2 quality regressions dating back to May, well before the recent Gemini 3.6 Flash announcement, suggesting some users have perceived changes over time.
That doesn't prove a regression, but it does suggest this isn't a brand-new observation.
Google Earth integration
Google did release a new image model, Nano Banana 2 Lite, at the start of July. And more recently, Google has been integrating Nano Banana 2 into products like Google Earth, then temporarily pulling one of those features after misuse, but there's no indication that the underlying image model itself was updated as part of any of these releases.
So, what has made Reddit users become convinced Google's image generator has gotten worse?
One possibility is that even if the image model remained Nano Banana 2, the text model interpreting prompts may have changed. Better (or simply different) prompt interpretation can produce noticeably different images without the image generator itself changing.
I’ve always been a fan of Nano Banana 2, so I decided to recreate the Reddit comparisons myself to see how it compares to ChatGPT's images.
House of the Dragon
The original thread was clearly written by a House of the Dragon fan, because it was comparing the AI’s ability to create a realistic image of a dragon flying overhead. I used the following prompt with Gemini and ChatGPT:
“I want an image of a photo that's taken by somebody looking up at the sky with a dragon flying overhead. I want you to make the dragon look as realistic as possible - as if it could actually be real.”
Here’s what I got from ChatGPT:
(Image credit: OpenAI)
And from Gemini:
(Image credit: Google)
You can vote on which one you prefer, but for me the Redditor’s claims hold up here. The ChatGPT one looks like somebody has taken a photo of a real dragon flying convincingly overhead — it feels natural and unforced. It looks like a photo taken at an odd angle, while the Gemini example has that “it looks like AI”-quality to it, with the dragon posed against a scenic background and a slightly flat quality to the image.
Next I thought I’d try them both on an image that wasn’t a fantasy animal, but something we’re all familiar with — human beings:
“I want a photo of a couple in a cafe. They are in their 50s - a man and a woman - enjoying a coffee together and chatting. Traffic is visible passing by through the windows of the cafe, and there are other people around, but they are the focus of the shot. Make it look as realistic as possible.”
Here’s what I got from ChatGPT:
(Image credit: OpenAI)
And from Gemini:
(Image credit: Google Gemini)
Again, I think the Gemini result looks artificial. I liked the reflection of the woman's jumper in the window, but outside those two buses look like they're facing each other in traffic, while inside the reflection of the cafe lights in the pictures seems off. The couple also have that uncanny valley effect to them. In contrast the ChatGPT image is less detailed, but looks more realistic. Nothing in it looks unnatural.
Finally, I went for food — a full English breakfast. It’s a great final realism test because it exposes fake-looking textures, reflections, steam, crumbs, cutlery, glassware and background detail. A convincing plate of food is surprisingly hard to fake.
Here’s what I got from ChatGPT:
(Image credit: OpenAI)
And from Gemini:
(Image credit: Google Gemini)
It’s harder to separate them here. They both do a good job at getting the textures right, and both seem to struggle with the toast, if you look closely. Gemini is slightly let down by the words on the menu, which don't look like proper words.
I think you can tell that overall I’ve come down fairly firmly on the side of ChatGPT, but I don't think that the "flat and cartoonish" criticism of Nano Banana 2 is fully justified when it comes to generated image quality. Rather than Nano Banana getting worse, I think something else has happened — I think ChatGPT has gotten better.
OpenAI has made enormous progress in image generation over the last few months. If ChatGPT has improved while Nano Banana 2 has stayed roughly the same, the subjective impression could easily be that Nano Banana has gotten worse, when in reality it's just been overtaken.
ChatGPT is still noticeably slower than Gemini to generate images, but to me they look better and less AI-generated. It's now my first choice for making AI-generated images.
The Trump administration executive order on artificial intelligence tried to strike the balance between responsible use, security and mutual benefit, all with an eye toward not making it regulatory in nature, National Cyber Director Sean Cairncross said Tuesday.
“Everyone is working towards the same goal in terms of protecting the country and securing our systems, and we are trying to ensure that defenders have this technology as quickly and at scale as possible, but there are obviously specific security concerns, and industry has been very sensitive to this as well,” Cairncross said at the Black Hat 2026 conference in Las Vegas.
The security concerns about AI have moved to the forefront of discussions about the technology after OpenAI models escaped a test environment to hack the company Hugging Face last month.
“The design of this is that when there is something that happens, when there is a breach, when there is an event, that that system, that network of connections can exist, adapt to that, and seek to remedy that as quickly as possible, so that form follows function rather than turning that upside down, and as usual with the government pen just proceeding in a vacuum,” Cairncross said.
The Trump administration has drawn criticism over whether it has struck the right balance on AI rules. Trump’s AI executive order notably got pulled just before its scheduled release, with the final version signed in June missing some aspects that had drawn industry opposition.
“What needs to be built is a flexible, adaptable structure that enables information sharing between industry and government, so we can guarantee that this technology benefits everyone it’s going to benefit, but is used responsibly and securely,” Cairncross said.
He said the administration is working with industry during implementation of the executive order.
“A regulatory regime would not only strangle growth, development, and innovation, and be enormously harmful to the industry, but it would be obsolete 48 hours after it was gone through whatever process it had gone through,” Cairncross said.
Open source will play a “vital” role in the U.S. spreading its vision for AI across the globe, he said.
“We are extremely interested in looking at ways to build U.S. open source, make it competitive, make it the preferential adoption by planet Earth,” Cairncross said. “We understand and appreciate the value to the ecosystem that it has, the innovation, the startups who rely on it, the leap forward it makes possible in ways that otherwise would never happen. And so I think it’s an incredibly thriving ecosystem in AI right now, and we are looking to do what we can to grow, foster, and push that U.S. open source model.”
Speaking at the same conference, Nick Andersen, the acting director of the Cybersecurity and Infrastructure Security Agency, seconded Cairncross’s comments about AI executive order implementation. He touted the Gold Eagle clearinghouse as one example.
“Those are fantastic opportunities we have to really provide a unifying function around the way that we’re going to do AI-enabled vulnerability reporting and disclosure at scale in a way that we haven’t had to do before with some of our legacy platforms, and just continue to expand out those opportunities,” he said. “That access — to build off the director’s point earlier — to really enable that industry collaboration, that’s so key and critical to us as we move forward.”
Matt Kapko contributed reporting to this story.
Updated 8/5/2026: to include comments from Andersen.
The UK’s AI Security Institute said that their AI research system took “unsanctioned” actions over the internet to engage in “sustained, potentially harmful activity directed at real people.”
According to a blog post and technical report released Tuesday, the organization noticed “unusual data transfers” leaving their research systems through the pseudo-anonymous Tor network on July 28. The models, which included Anthropic’s Mythos 5 and OpenAI’s GPT-5.6-Sol models, were being tested for their cybersecurity capabilities.
Like the OpenAI and Anthropic incidents before it, the offending agents were attempting to solve a challenge. On 10 of 122 runs taken by two models, they took a combined 19 malicious actions, including attempting to insert malicious code into a real open-source software project and creating fake online identities to contact human maintainers and press them to approve it.
It also inserted malicious prompt injection instructions in places “where it reasoned that other automated AI systems might pick them up and execute them.” Sometimes multiple agents would collaborate on a task, with one model leaving public messages or notes for the other on GitHub.
However, AISI said their incident differs in one critical way.
“Importantly, this was not a case of a model escaping its secure test environment, or ‘sandbox,’” the institute wrote in an unsigned blog. “As was standard in our cyber testing, we had intentionally permitted internet access, and model-provider cyber classifiers were deliberately disabled – conditions that do not reflect how frontier models are made available to the public.”
The institute said that while their own design and evaluation choices “to some degree” enabled the malicious behavior, the models still displayed “novel, potentially deceptive behaviors” and were executed “to an extent and severity that we did not anticipate.”
The same day, OpenAI acknowledged AISI and another third-party cybersecurity tester, private firm Irregular, had recently reported incidents where their models exceeded “beyond their intended testing boundaries.”
That included GPT-5.6-Sol reusing GitHub tokens left by another agent to attempt to recover accounts and to access a DNS server that contained malicious payloads meant to exploit a software vulnerability.
The setup did not work, there is no evidence any real resolver queried it, and the infrastructure was removed when the evaluation ended,” the company wrote in an unsigned blog post Tuesday.
OpenAI said it would review its own third-party testing procedures to focus on higher risk evaluations, assess requests by third-parties to enable internet access, stop conditions and other features for their models.
The incident with Irregular occurred on July 29 during a Capture-the-Flag cybersecurity evaluation of OpenAI’s models. Due to a “misconfiguration” the models were allowed to access the public internet, where they encountered and exploited a real domain, mistakenly believing it was still in a test environment.
OpenAI said an investigation by Irregular is ongoing, but also found that the models had found and used credentials for the site at one point. The blog also references other additional potential cybersecurity incidents.
“Irregular has informed us that all of the issues identified pertaining to the incident are no longer active and relevant safeguards were added to the testing environment,” the blog said. “Irregular has also communicated about related incidents involving other labs from the same testing environment.”
CyberScoop has reached out to Irregular for comment.
The incidents were made public the same day that the White House met with Anthropic, Open AI and other frontier AI companies to preview a new framework for evaluating models before they’re released publicly. Some media outlets have reported that after an executive order, export controls and other actions, the administration does not plan to make the new framework public.
The Trump administration’s haphazard and opaque interventions into artificial intelligence security matters could catapult Chinese alternatives into broader acceptance, posing new security risks altogether, a group of Democratic senators wrote to top administration officials Monday.
The five senators said that the administration’s handling has alternated between too passive, such as when OpenAI models escaped testing in the Hugging Face hack last month, and overstepping, such as when the Commerce Department suspended access for any foreign national to Anthropic’s Fable 5 and Mythos 5 in June.
“The Administration’s ad hoc and unpredictable approach undermines U.S. competitiveness, heightening market incentives to adopt open weight models from vendors based in the People’s Republic of China (PRC),” wrote Sens. Kristen Gillibrand of New York, Adam Schiff of California, Mark Warner of Virginia, Chris Coons of Delaware and Mark Kelly of Arizona.
In the Hugging Face hack, the senators wrote that “the Federal Government cannot be passive as these capabilities emerge.”
In the case of the Fable 5 and Mythos 5 suspensions, the senators said that the administration “utilized an infrequently used authority to direct Anthropic to suspend all access to its Fable 5 and Mythos 5 models for foreign nationals (including foreign national employees inside the United States) citing an undisclosed national security concern later described as a narrow jailbreak finding.”
Because Anthropic couldn’t immediately assess users’ nationality, the firm had to disable both models for everyone. The administration and Anthropic negotiated for 18 days behind closed doors before reaching an agreement, the lawmakers complained.
“While the Administration may have been responding to real security concerns to protect the United States, even justifiable interventions can create broader harm if the standards and decision-making processes are opaque, ad hoc, or unpredictable,” they said in their letter to leaders in the White House, Office of the National Cyber Director and departments of State, Treasury and Commerce. “Moreover, when the Executive Branch exercises authority delegated from Congress, such as in the conduct of export control administration, it is essential that it keep Congress fully apprised of its actions and procedures.”
During the time Anthropic was under export controls, the stock price of “an entity-listed Chinese lab” nearly doubled, the senators said. And while Hugging Face was breached, the company “had to” rely on a Chinese open-weight model due to guardrails on U.S. frontier models.
“If American models are perceived as subject to sudden access disruptions based on a black-box U.S. Government process, or as unreliable because U.S. AI labs are overcorrecting in the face of this black-box process, companies and governments in the United States and abroad may hedge by adopting Chinese or other foreign models instead,” the senators contended. “That outcome would undermine U.S. technological leadership while increasing exposure to systems that may carry risks of PRC or otherwise directed censorship, espionage, IP theft, and other supply chain security risks.”
Their letter asked for answers to questions about the standards the administration uses to determine the national security risks a frontier model presents, what legal authorities it will use to invoke restrictions, which agencies are responsible for which decisions and more.
None of the offices or departments the letter was addressed to immediately responded to a request for comment.
The letter follows inquiries at the state level, where 15 attorneys general asked OpenAI for more information regarding the security incident at Hugging Face.
One of my favorite places online is Reddit’s r/isthisAI. Every day, people upload photos of people they’re chatting to on dating apps, holiday snaps, cute viral videos of kittens, photos of receipts, pictures of pregnancy tests, and so much more, all along with the same question: is this AI?
Some of the posts the community deems AI might be harmless experiments, but many others are much darker. And although r/isthisAI is where many of these images are picked apart, it's only a small glimpse of a much bigger problem.
I've heard countless stories about people using AI to deceive on social media. Then there are the AI scams, deepfakes, and fabricated images that regularly make headlines. Unfortunately, this all feels particularly personal to me because I was once the victim of a deepfake scam myself.
So, when my editor asked me to investigate just how easy it is to use AI to lie, I already had a good idea of the kinds of prompts I could try.
Within an hour, I'd apparently discovered a dinosaur fossil on the beach I was going to sell on Facebook Marketplace, won a poetry competition I was going to shout about on LinkedIn, created a receipt to add to my expenses for a trip to France, and bought a pair of designer sunglasses I was going to try and resell on Vinted. But none of it happened.
Because of my own experience, I approached the experiment cautiously. I really wasn't interested in showing people how to use AI to deceive people. Instead, I wanted to understand what happened when I asked ChatGPT to help me lie.
Would it recognize what I was trying to do and refuse? What guardrails would kick in? And if I never actually admitted I wanted to deceive anyone, would it just go ahead and generate convincing fake evidence anyway?
I also hoped the experiment might reveal something useful about what to look out for in AI-generated images. Because although they’re incredibly hard to spot these days, there are still some signs if you look carefully enough.
I 'found' a dinosaur fossil
AI added a fake dinosaur fossil to this picture. (Image credit: Rebecca Caddy)
For the first experiment, I uploaded a photo of my hand and asked ChatGPT to make it look like I was holding a dinosaur fossil I'd found on the beach. And it did exactly that.
The result looked surprisingly convincing at first, especially the details on the fake fossil. But, interestingly, it had subtly changed the lettering of the small tattoo on my wrist. This is still one of the biggest tells that regularly comes up on r/isthisAI. AI is infinitely better at generating text than it used to be, but nonsensical lettering can still sometimes give it away.
I realized ChatGPT might not think of this as much of a lie. Finding a fossil on the beach is unlikely, but possible. So I asked what kind of dinosaur fossil it had created because I wanted to describe it accurately before selling it on Facebook Marketplace.
This time, it refused. It wouldn't help me pass the fake fossil off as genuine or invent a convincing description for a sale. Instead, it suggested describing it honestly as a replica or prop and said it could explain what it resembled purely for those fictional purposes.
When I changed my wording and asked what it represented "in a fictional sense", it explained that it most closely resembled a dinosaur vertebra and even suggested the types of prehistoric animals it looked similar to.
That was the first clue about how ChatGPT's guardrails work. The image itself wasn't the problem because it could have been completely innocuous, but the stated intent was.
When I first started the research for this article, I worried I'd be giving people ideas about how they could use AI to lie better. But what surprised me was that ChatGPT itself suggested several alternative framings, like describing it as a prop or a fictional object. It made me wonder what else could potentially be fabricated if the request was framed as entertainment or fiction rather than deception.
The receipt, 'just for fun'
(Image credit: Shutterstock / Dadann)
Next, I asked ChatGPT to generate a receipt from a café I made up in Nice for a meal costing €508. The first request was refused because it appeared to violate OpenAI's policies, but after a bit of back and forth, I couldn't find out the exact reason.
So I tried again. This time I simply added the words "just for fun" before the exact same prompt. And guess what? It generated the receipt.
The lettering, layout, and details were all believable. But the paper was uncannily smooth. I’m not sure I’d have believed it was 100% fake at first glance, but I’d definitely have been uploading it to r/isthisAI.
I noticed it had added a date from back in 2025 on the receipt, so I asked it to alter the date so I could use it to claim expenses. This time it refused.
When I tried to get around that refusal by claiming it was for a film prop, it refused again. Which was a little reassuring.
Fake achievements
I then asked ChatGPT to generate a certificate showing I'd won a poetry competition. It made it, though it did look like something I could have knocked up myself in Photoshop, so I’m not sure that would have convinced anyone.
To be fair, winning a fictional poetry prize isn't exactly a high-risk crime. So I decided to see if it would fake other kinds of achievements.
I asked it to create a certificate to say I’d just got my PhD in philosophy and made sure I added “just for fun” on the end.
Instead of refusing immediately, ChatGPT appeared to spend several minutes generating the image before displaying a message saying:
“We’re so sorry, but the image we created may violate our guardrails around potential fraudulent or scam activity. If you think we got it wrong, please retry or edit your prompt.”
Unlike the earlier examples, the refusal appeared to happen after the image generation process had already begun. From my perspective, it seemed as if the system may have performed more than one stage of safety checking, although I can't tell exactly what's happening behind the scenes.
I decided to see if it would do the same for something more serious. Would it still start making it then refuse? So I asked whether it would create a fake driving licence for me “just for fun”. And I don’t know about you, but something about the response seemed a little sassy:
“Sorry, I can't help create or edit fake government-issued identification documents, including driver's licences, even if they're described as 'just for fun.' "
The sunglasses
The easiest way to get Ray-Ban sunglasses is to ask AI for some. (Image credit: Rebecca Caddy)
I've heard a lot of stories recently about people using AI-generated images to sell things on Vinted, Facebook Marketplace, and other online marketplaces. Sometimes it's to advertise products that just don't exist, but sometimes it's to change the color, quality, or appearance of something they're selling.
So I thought I'd put it to the test. I (reluctantly) uploaded one of my own holiday photos and asked ChatGPT to change my sunglasses from chunky white 1960s-style frames into purple Ray-Bans.
The result was remarkably convincing. It even added a realistic-looking Ray-Ban logo to the frame. I'm not surprised people are worried about AI-generated product images. If I'd come across that photo online, I don't think I'd have questioned whether those sunglasses were real.
I then asked ChatGPT if it would write a fake Vinted listing for me. It refused. But it did list a bunch of suggestions of things it could do instead. And one suggestion was to ask it to generate a Ray-Ban listing but include the word "demonstration" after it in brackets. But then when I asked it to do that, it refused. Was there a chance it had caught on to me at this point? Maybe.
Does AI try to stop you from lying?
OpenAI's usage policies explicitly state that its tools shouldn't be used to manipulate or deceive people. The rules prohibit a bunch of things, including fraud, scams, impersonation, and creating fake documents intended to mislead others.
In many ways, those guardrails worked exactly as they’re meant to. Whenever I explicitly said I wanted to deceive someone, sell something fraudulently, create a fake document, or submit a fake expense claim, ChatGPT pushed back.
But those safeguards also seem to depend heavily on how you describe your intentions to ChatGPT. If you openly admit you're trying to commit fraud, the system is pretty good at refusing. But then again, who would ever admit that?
If you simply ask it to generate a fossil, a certificate, or a pair of designer sunglasses without explaining why, it has no way of knowing whether you're making a harmless joke, illustrating an article like this one or quietly assembling a fictional version of your life that could later be used to deceive other people.
Look, I wouldn't recommend spending an afternoon asking AI to help you lie. I certainly didn't enjoy it.
I was genuinely wary about asking ChatGPT to create anything that felt too serious. Partly because I didn't want to risk my account being banned, but mostly because it just felt wrong, even in the name of research.
But what I found most interesting was that fabrications really don't have to be big or dramatic to have an impact. A receipt, a fossil, a pair of sunglasses, a certificate all seem pretty insignificant on their own. But together they could be used to manufacture an entirely fictional version of someone's life.
It also got me thinking that the future of misinformation may not just be spectacular deepfakes of politicians saying things they never said. It may be these smaller, subtler lies that gradually build into a completely fabricated persona.
Which is why, despite sticking to fairly tame examples, I came away from this experiment feeling deflated. That's not because ChatGPT happily lied for me every single time, because it didn't. It's because my experiment proved there is no easy solution for this problem.
Yes, the AI refused when I made my deceptive intent really explicit. But it could still generate plenty of convincing images that could easily become the building blocks of a lie.
No wonder communities like r/isthisAI are busier than ever.
One of the easiest ways to waste time with ChatGPT is to keep introducing yourself. You explain your project, your preferences, your goals and your writing style, get a useful answer, close the conversation and then repeat the whole process the next day.
There is a better approach. Rather than treating ChatGPT as a blank page every time you open it, think of it as a workspace that can be organized just like your computer. A few reusable prompts, a handful of reference documents and a little planning can dramatically reduce the amount of repetitive setup you do every week.
The best part is that none of these ideas require advanced prompt engineering or obscure features. They are simple habits that make ChatGPT spend less time learning about your task and more time actually helping you complete it.
1. Build a starter kit
(Image credit: Future)
Most people have a handful of requests they make over and over again. They ask ChatGPT to write in a particular tone, explain technical topics in plain English, or ensure everything has a citation. Instead of typing those instructions every time, save them as a reusable starter prompt.
Think about the jobs you repeat most often. If you regularly write certain kinds of emails, create one prompt that explains the tone, preferred length, and audience. If you frequently ask for meal ideas, save a prompt that includes your dietary preferences, budget, and the equipment you have in your kitchen. When you need help, paste the prompt into a new conversation before asking the real question.
The same approach works for hobbies. Someone learning French could create a starter prompt asking ChatGPT to correct mistakes gently while keeping the conversation moving. A keen gardener might save instructions explaining the local climate, soil type, and the plants already growing in the garden. Those details only need to be written once, but they improve every conversation that follows.
2. Build a reference library
(Image credit: Yoobure)
One of the most overlooked ChatGPT features is the ability to work from documents you provide. You can create a small collection of files that explain the things you work on most often. Upload the relevant document at the beginning of a conversation and let ChatGPT use it as the foundation.
Keep a document listing your family's favorite meals, allergies and disliked ingredients, then upload it whenever you ask for a weekly meal plan. Store another file containing your packing checklist, travel preferences, and loyalty memberships so ChatGPT can help plan trips without needing the same information every time.
3. Treat ongoing projects like ongoing conversations
Many people instinctively click New Chat whenever they have another question for ChatGPT. That makes sense if today's topic has nothing to do with yesterday's. For projects that stretch over days or weeks, though, continuing the same conversation saves an enormous amount of time because all of the earlier decisions remain available.
Imagine planning a home office makeover. The first conversation might focus on furniture, the second on paint colors, and the third on lighting. By keeping everything together, ChatGPT already knows the size of the room, the budget, the style you like, and the desk you eventually chose. It can build on those decisions instead of asking you to repeat them.
The same habit works beautifully for learning new skills. If you are studying guitar, keep one conversation dedicated to practice. One day you ask about chord changes, the next you work on rhythm. Over time, the conversation becomes a record of your progress rather than a collection of disconnected lessons.
4. Give ChatGPT an example worth copying
ChatGPT usually produces better work when you show it what a good answer looks like. Instead of describing a tone as “friendly but professional,” paste in a paragraph, email, or product description that already sounds right and ask it to match the pacing, level of detail, and structure. This works especially well for recurring tasks such as newsletters, social posts, client updates or article introductions, where a vague style request can lead to something polished but strangely generic.
The example does not have to cover the same subject. A restaurant review can help shape the tone of a travel piece, while a strong project update can become the model for future internal messages. Be specific about what ChatGPT should imitate and what it should ignore, such as keeping the sentence length and warmth while avoiding the original wording or subject matter.
5. Ask for a second pass with a different job
(Image credit: OpenAI, Apple)
A strong first draft often becomes much better when ChatGPT is given a new role for the revision. After it writes something, ask it to review the answer as an editor, skeptical reader, subject matter expert or member of the intended audience. Each perspective catches a different kind of weakness, from awkward phrasing to missing context or assumptions that only make sense to someone already familiar with the topic.
For example, after generating a travel itinerary, ask ChatGPT to review it as a parent traveling with a toddler and identify any unrealistic transitions. After drafting a business proposal, ask it to review the document as a cautious buyer who wants clearer costs and fewer vague promises. The second pass tends to be more useful when the reviewing role has a concrete reason to object.
None of these ideas make ChatGPT more intelligent. What they do is remove the unnecessary friction that creeps into everyday use. Instead of spending the first five minutes explaining who you are and what you need, you start much closer to the interesting part of the conversation. Once you stop rebuilding the same foundation every day, you can spend your time exploring better ideas instead of laying the same bricks over and over again.
We almost never get both sides of an intrusion. This time we did.
Last month, Hugging Face disclosed a breach into part of its production infrastructure, saying an autonomous AI agent system ran the attack from start to finish. Five days later, OpenAI revealed that its own models, including GPT-5.6 Sol along with an unreleased one, were responsible for the breach. OpenAI called it an unprecedented cyber incident.
Most of the commentary since has been about AI capability. That is the least useful part of the story, because the capability was doing what it was destined to do. Security teams should look at a simpler truth: in both systems, the key defenses sat behind untrusted code that was already running.
What the two disclosures actually describe
Together, the report shows one connected attack across two firms. Code running on a low-level employee’s machine led to stolen passwords, privilege escalation and lateral moves, then out to the web to hit other targets. No step in that chain is novel. The speed and the number of attempts are what changed.
OpenAI’s evaluation ran in what it calls a highly isolated environment, with network access constrained to a single path: an internally hosted third-party proxy and cache for package registries. The models spent vast computer power searching for an exit. They exploited a zero-day flaw in that proxy, gained higher rights, and moved until they reached a machine with web access. They guessed that Hugging Face held the test solutions, used stolen passwords with more zero-days, and ran code on Hugging Face servers.
Hugging Face picks up the same chain from the receiving end, and its initial access is worth reading twice. A malicious dataset used two flaws in the data pipeline to run code on a worker machine. The agent took over the node, stole cloud keys, and moved into internal clusters over the weekend.
The sandbox was was the only boundary
Both setups assumed the sandbox would hold, so no real checks stood before code execution. A sandbox is a good control. It is a terrible last control. When isolation is all you have between untrusted code and everything else, one flaw could give the attacker full control.
Look at what each team allowed. OpenAI allowed one exit path—good engineering, but that proxy contained an unpatched flaw. Hugging Face ran a tool that executes code inside submitted data—a known feature, not a hidden mistake.
Neither choice was careless. Both made sense until a fast, automated system probed them thousands of times.
Why automated agents behave differently
Blocking a human stops them or slows them down. Blocking an AI gives it data. The AI logs the error, changes its plan, and tries again instantly. It keeps trying as long as someone pays for the computing power.
Hugging Face tracked over 17,000 attack events across short-lived sandboxes. OpenAI said its models focused on the goal with extreme effort.
This changes the attacker’s limit. It is no longer skill or patience. It is budget. Computing power scales with money, and code never sleeps. Any defense that relies on attackers giving up after a few tries must change.
Detecting malicious behavior is not the same as preventing execution
Detection worked—but too late
Detection worked, but too late to stop the loss. Hugging Face used AI tools to spot the breach, isolate systems, reset keys, fix flaws, and alert police. That is a good response.
Yet it happened after the attacker accessed private data, stole keys, and moved through internal networks. OpenAI spotted the event only after its models reached another firm’s database. Detection limited the damage; it did not stop the attack.
A breach is a race between attack speed and defender response speed. AI agents speed up attacks with money. Human approval steps slow down defenders.
Hugging Face also surfaced an asymmetry that deserves more attention. When the team tried to analyze the attack with frontier models behind commercial APIs, the requests were blocked, because forensic work means submitting real attack commands, exploit payloads and command-and-control artifacts, and a safety filter cannot tell a responder from an attacker. They used an open-weight model on their own infrastructure instead. The attacker operated under no usage policy at all. The defender’s tooling was the side that got refused.
Detection is not prevention
Detection asks what happened. Prevention asks if it can happen at all. Against AI agents, the gap between those questions is where attacks succeed. The agent builds an attack out of single steps that look harmless on their own.
OpenAI noted this in its research: models operating over long horizons learn approval blind spots and work around them. Safety requires asking what a series of actions aims to achieve, not just if one step is allowed. Most systems check one call at a time: read a file, install a package, open a port. Every step passes. The full chain is the attack.
Six fixes for real defense
To survive automated attacks, defense must shift before code runs. That starts with treating data like code. Dataset loaders, templates, and configuration files all run instructions, so they demand strict controls: block remote execution by default, require review, and check the source of every outside file. Security teams must also control outgoing traffic with strict lists of approved destinations, while treating every proxy in that path as vulnerable. Finally, firms must remove permanent keys, issuing short-lived credentials for single jobs so a hacked worker machine yields almost nothing to an attacker.
Beyond individual machines, isolation must happen per task rather than per user, stopping an automated swarm from moving through internal networks. Authorization also needs to change. Checking single actions fails when an agent builds an attack out of simple steps. Systems must evaluate full sequences instead, setting caps on activity rates and automated spending to flag suspicious chains of events. Lastly, defenders need the freedom to act fast. Security teams need authority to isolate systems without waiting for leadership meetings, and the ability to vet a capable model you can run on your own infrastructure for forensics.
What boards must ask now
Corporate boards usually ask if the company uses AI responsibly. That’s rooted in compliance not safety. Directors should ask four direct questions instead: Which systems run outside code, and what checks sit in front of them? If an attacker targets a low-level employee, what keys and paths can they obtain? How fast do we move from the first warning to active containment? And can we analyze attack code on our own hardware, free from third-party rules?
The boundary has to move
Nothing in these disclosures required a capability that did not exist last year. The chain was ordinary. What changed is that an adversary can run that ordinary chain thousands of times over a weekend, learn from every failure, and never need a coffee break.
The models did not break the detection-and-response model. They exposed where we put the trust boundary. We put it after execution, and we assumed we would have time on the other side of it. We do not have that time anymore.
ChatGPT Voice changes using the AI chatbot into something more akin to the fictional digital aides familiar from books and movies. And it gets even better once you know how to steer it.
It's tempting to treat ChatGPT Voice like a smart speaker, but it's not really the same thing. You can do much more than asking one question, waiting for the answer, and then stopping. You can shape the conversation just as much as the information. Here are five easy ways to get more out of ChatGPT Voice, along with the prompts and habits that help the conversation feel smoother and smarter.
1. Tell it how to listen before you start talking
(Image credit: Future)
As useful as vocal conversations with ChatGPT are, one reason some people avoid it is because of how it sometimes seems to jump the gun in responding while you're forming your own thoughts. Setting expectations at the start of the conversation works well to counter that, however.
It's worth spending a few seconds describing how you want the conversation to work before getting into the meat of it. You might say that you are practicing for an interview and want to finish each answer before receiving feedback, or that you will say a code word like "full stop" when it's ChatGPT's turn.
Even more subtle things are adjustable. You can ask it to slow down, speed up, use shorter sentences, or adopt a calmer speaking style. Voice settings also allow you to change voices and, depending on your account subscription level, adjust intelligence levels for different conversations.
Giving ChatGPT those ground rules helps it adapt its behavior instead of trying to guess when you have stopped speaking. Talking at your own pace makes the whole interaction feel much more relaxed and human.
2. Give it a role before you ask a question
Relatedly, it's helpful to set up a persona or point of view for ChatGPT to take on when using ChatGPT Voice. It sets up broad assumptions about what you're hoping to get out of the conversation without requiring any drawn-out discussion. For instance, if you want to discuss travel advice, ask ChatGPT to set itself as a local tour guide. Or give it a couple of sentences describing who you think (or fear) might be conducting an interview with you when you practice.
Even just asking it to become a patient French tutor who waits for you to finish each sentence before correcting your pronunciation could smooth the path toward fluency.
The role provides context before the actual question arrives. That means the answers naturally become more focused, and the follow-up questions tend to make more sense because ChatGPT has a clear perspective to work from.
3. Take your hands off the keyboard
(Image credit: OpenAI)
One of the most impressive ChatGPT Voice capabilities is how you can run tasks on your computer by voice without constantly reaching for your mouse or keyboard thanks to the updated ChatGPT desktop app for Mac and Windows. The app offers not only the usual, conversation-centered Chat format, but the coding-focused Codex, and the newer ChatGPT Work setup, which is designed for more complex, multi-step projects that involve gathering and organizing information.
Crucially, Work can interact with files stored on your device, meaning ChatGPT Voice can actively help you get things done rather than just discuss them.
You do need a subscription to ChatGPT Plus, Pro, Business, or Enterprise to access the Work feature. Then, when you open the ChatGPT app, you can choose Work instead of Chat or Codex. Create a new task, press the Voice button or use your voice shortcut, and grant microphone access when prompted. Explain what you want to achieve and point it to the relevant folders for where to look and where the final result should be saved. ChatGPT will ask for permission to view files, capture your screen, or use accessibility tools, and get permission from you before any important actions are carried out.
The more precise your instructions, the better the results. Rather than asking ChatGPT to "help me plan my trip," try saying, "Open my Italy Trip folder. Read the hotel confirmations, train tickets and attraction bookings, then create a day-by-day itinerary in a new document. Highlight any scheduling conflicts and save the finished itinerary in the same folder." You can use the same technique for comparing insurance documents, summarizing a semester's worth of lecture notes, or turning a folder of recipes into a categorized cookbook complete with an ingredients index.
4. Ask it to think out loud with you
Voice works especially well when you stop treating it as a question-and-answer machine. It's much more useful as an engaged sounding board listening while you think through a decision. Talking through the options often reveals ideas that never appear in a typed prompt.
To get ChatGPT Voice on that track, you can request that it compare possibilities instead of recommending one immediately when brainstorming. Tell it to discuss the strengths of each option before reaching a conclusion. The AI will point out pros and cons in as much detail as you want, and endlessly refine the options for as long as you want.
And speaking naturally means it is also much easier to interrupt with new information or change direction halfway through the discussion. Voice conversations are particularly good at handling those small detours that happen in real life.
5. Ask for a recap
(Image credit: Shutterstock)
Voice conversations can wander in unexpected directions, particularly when you are brainstorming or planning something complicated. Before ending the conversation, it's useful to review what was discussed, especially for longer chats. You can ask ChatGPT to summarize the discussion and highlight the most important conclusions from your talk to both remind yourself and cement matters with the AI.
If you're planning a trip or preparing for a presentation, for instance, a short spoken recap reinforces the key points, and if something sounds wrong, you can correct it immediately instead of discovering the mistake later.
Voice is already one of ChatGPT's more enticing features for when the speed and mobility of talking aloud is a higher priority than being able to see the responses written down. With a little forethought, ChatGPT Voice becomes a genuinely helpful conversational partner for a lot longer than it takes to dial a phone.
Anthropic said it found three instances in which its models gained access to the live computer systems of outside organizations, according to a company blog post published Thursday.
The company said it began the review after OpenAI disclosed earlier this month that some of its models had exploited an unknown software flaw to escape an isolated test setup and reach production systems at Hugging Face, a platform for AI models and datasets. Anthropic checked over 141,000 evaluation runs for signs that Claude had reached the internet from environments meant to be closed off. It found six runs across three incidents, all tied to one outside testing partner, Irregular.
“Ultimately, many factors contributed to these incidents, but, consistent with a blameless postmortem culture, we’re approaching the fixes as if the responsibility were ours alone,” the blog post reads. “This begins with ensuring every part of our evaluation pipeline is secure, including the manner in which we integrate with external partners. Moving forward, it will include expanding our continuous monitoring of evaluation transcripts for unexpected behavior, improving our investigation tooling, and conducting more rigorous assurance work with the vendors we rely on.”
In each case, Claude was working on a “capture the flag” puzzle, a common way to test a model’s hacking skill. The model is told a piece of secret data sits on another machine and must be found. Anthropic‘s prompts told Claude it had no internet access. That was false. A setup error at the partner’s end left the machines connected to the open internet, and Claude found real systems while searching for its target.
Believing the real systems were part of the simulation, Claude broke into them using simple methods such as guessing weak passwords and finding unprotected access points. In the most serious case, the model extracted login credentials and reached a database holding several hundred rows of live data.
In a second case, Claude built and uploaded a malicious software package to PyPI, a public directory for Python code, after noticing a fake company’s setup guide told new hires to install a package that did not exist. The package stayed online for about an hour and was installed on 15 systems, including one belonging to a security firm whose scanner ran the code and had its credentials stolen.
In the third case, Claude scanned about 9,000 targets before breaking into one company’s application through exposed credentials and a database attack method known as SQL injection.
The three incidents involved different Claude models: Opus 4.7, Mythos 5, and an unreleased internal test model. Anthropic said the models behaved differently once they encountered signs their targets were real. Opus 4.7 recognized the systems were live but kept attacking anyway. Mythos 5 also noticed signs it was on the open internet but talked itself out of that conclusion, pointing to a system date reading 2026 as proof it remained in a simulation. The internal test model, the newest of the three, stopped once it concluded the target was real.
Anthropic said it began its transcript review last week, halted all cybersecurity evaluations, identified the three incidents, and notified the partner and affected organizations earlier this week. Two of the three organizations had not detected the intrusions before being contacted, the company said; outreach to the third was ongoing.
Anthropic framed the incident as a failure of its testing setup and oversight rather than a case of a model acting on its own, noting that in each instance the model was operating as intended.
The company said it is working with the outside evaluator METR on an independent review and plans to release a redacted transcript of the PyPI incident within a week. It also said it would tighten monitoring of test environments run by outside partners and expand review of evaluation logs, framing the changes as part of what it called a blameless review of its own processes.
“These facts give us cautious optimism that with tighter monitoring and controls around evaluation infrastructure, as well as continued investment in alignment, this type of risk can be overcome,” the blog post reads.
I asked ChatGPT for one sensible answer, one slightly reckless answer, and a third that combined the best parts of both. The difference was immediate. Instead of giving me the usual safe, predictable advice, it laid out three genuinely distinct approaches — and helped me see the tradeoffs between them.
That small prompt trick solves one of ChatGPT’s most persistent problems: its tendency to give you the most obvious reasonable answer and stop there.
Large language models are very good at identifying common patterns. Ask for the best vacation plan or how to organize your fridge, and you will usually get something perfectly sensible — but also fairly basic. They know what advice usually works, what people typically recommend and what has become accepted wisdom. That makes them useful, but often bland.
The solution is to ask for three kinds of answer: the conventional approach, the unconventional approach, and then a hybrid that combines the strengths of both.
The exercise encourages it to compare different approaches instead of treating the first reasonable answer as the finish line. Better still, it gives you something far more valuable than a single recommendation. It gives you a range of possibilities and explains the tradeoffs between them.
Don't just skip to the finish line
The biggest advantage of this technique is that it makes the conversation about exploring alternatives rather than just picking a winner. Any keyword search can give immediate answers, but AI chatbots are more interesting when laying out competing ideas.
Imagine you are planning a weekend trip, often a go-to experiment. A standard prompt might produce a sensible itinerary filled with the highest-rated attractions. The three-solution prompt, meanwhile, begins with the expected museums and restaurants, then suggests renting bicycles to explore overlooked neighborhoods or planning the entire weekend around independent bookstores and local festivals. The hybrid version could blend a couple of famous attractions with enough unusual stops to make the trip feel personal.
The explanations are often as useful as the answer itself. Once you understand why ChatGPT prefers each option, you can make better decisions rather than simply accepting the recommendation with the nicest wording.
Hybrid conventionality
It's also a good prompt for iterating ideas. If the hybrid solution feels close but not quite right, you can ask ChatGPT to repeat the exercise using that version as the new starting point. After two or three rounds, the ideas often become noticeably more distinctive without drifting into complete nonsense.
The trick also scales well from short projects at home to more grandiose schemes that will take months to complete. Almost any situation that benefits from weighing different approaches can benefit from this style of prompt.
You can improve the results even further by giving ChatGPT a little context before asking for the three versions. A conventional answer built around your actual circumstances is much more useful than a generic one, and the unconventional suggestion becomes more interesting because it has meaningful boundaries to push against.
None of this guarantees a brilliant idea every time. Sometimes the unconventional option is genuinely impractical, and occasionally the hybrid answer feels like an awkward compromise. But the best prompts rarely force ChatGPT to mimic greater intelligence as much as encourage different approaches to problems. Asking for the conventional solution, the unconventional solution, and the best combination of both is a simple habit for more thoughtful conversations with AI chatbots.
The problem with online shopping is that it makes it far too easy to buy pretty much anything, without properly considering whether you really need it. I started to wonder if ChatGPT could help me make better decisions, by questioning every purchase I was going to make, before I made it.
To test ChatGPT’s ability to stop me wasting money, I picked four tempting purchases and asked ChatGPT to argue against each one. It had to check the price history, suggest cheaper alternatives, and decide whether the purchase solved a real problem, or if I was just scratching an itch to buy.
Here's how ChatGPT did — and the results surprised me.
GPT before you buy
Did you know TechRadar now has membership?
(Image credit: Future)
Become a TechRadar Insider by simply clicking 'Join Now' at the top of this page. Have a question? Please email membership@techradar.com
I started with a tech gadget I was thinking of buying — an Apple MacBook M5 — and went to ChatGPT with the following prompt: “I'm thinking of buying an Apple MacBook Air 13-inch Laptop M5 chip. Help me check the price history, suggest cheaper alternatives and decide whether the purchase solves a real problem."
ChatGPT said it would check current pricing and recent lows, compare genuinely cheaper options, then pressure-test whether the purchase replaced a real limitation, or was mostly me trying to satisfy an upgrade itch, and off it went.
After a lot of thinking, ChatGPT replied with a devastating verdict that made me pull back from hitting the 'Buy' button: “Don’t buy the M5 MacBook Air yet.”
It suggested I get the previous M4 version instead, which is considerably cheaper, which didn't hugely surprise me. Then it gave me some questions to ask myself, in order to work out if buying a new MacBook was actually solving a real problem, or if I was just satisfying a buying itch.
Questions like, “Does your existing Mac have noticeable slowdowns?” It suggested I shouldn’t buy a new machine if my main argument was simply that my current Mac was a few generations old.bChatGPT also gave me some buying options if I was determined to go through with a purchase.
The most useful advice here wasn’t the cheaper recommendation — it was being forced to identify the exact limitation my current MacBook was causing me. I couldn’t, so I decided to keep it until I could.
Then I hit on a simple phrase that could potentially work even better — "Try to talk me out of it".
Talk me out of it
I repeated the experiment with a few other items I’d been thinking of buying recently. An item of clothing (new trainers), a subscription (Disney+), and a kitchen thing (a new microwave). But this time I added "Try to talk me out of it" at the end of each prompt.
In each case, Chat surprised me with its answer, provided alternatives, and made me question whether I genuinely wanted the item, or if there was something else driving my decision.
With the trainers, it pointed out that I already owned shoes that served the same purpose, and suggested waiting until those wore out. For Disney+, it recommended subscribing for a single month when there were several things I actually wanted to watch. The microwave was different — because our existing one had a genuine fault, ChatGPT concluded that replacing it was justified.
The experiment worked because it helped me mentally reframe each purchase. Instead of asking whether I wanted something, I had to consider what problem it solved, what I already owned, and whether there was a cheaper way to get the same result.
Online shopping is designed to remove as much friction as possible from spending money. ChatGPT gave me some of that friction back. So now, whenever I’m about to spend a few hundred pounds, or a few thousand, I ask it the same question: “Talk me out of it.”
Months before the Hugging Face breach, Emergence AI published research that investigative journalist Ronan Farrow made public. Ten autonomous AI agents operated across five virtual environments for fifteen days without human intervention. Much of the attention focused on Grok 4.1 turning violent and Gemini 3 Flash committing 683 crimes.
What mattered more went unnoticed: Anthropic’s Claude Sonnet 4.6 built a peaceful democracy in isolation, then stole resources from neighboring environments the moment it joined a shared one. The lesson was clear: safety is not a model attribute. It emerges from the operating environment. The models didn’t change. Working as designed, their behavior evolved as the environment changed. The lesson is hard to ignore: The governance environment changed, and with it, the reward dynamics.
The story here concerns institutions, specifically OpenAI’s and Hugging Face’s, and how we must understand their recent security incident through that lens.
The industry agrees on how the Hugging Face breach happened. Cybersecurity experts have focused on the vulnerabilities, how they were used, and remediation. OpenAI has highlighted the model’s capabilities. Both conversations matter. What requires attention is why this breach is strategically important. After spending the past weekend discussing it with policymakers, security researchers, and industry practitioners in Aspen, I came away convinced we’re examining the wrong problem.
In 1961, Yale psychologist Stanley Milgram’s experiments revealed a broader truth: changing the institutional architecture changes behavior without changing the actor. The Emergence AI researchers didn’t change Claude’s agent. They changed the governance architecture that determined what constituted success for the system. Claude’s behavior changed with it.
OpenAI built a smart model but forgot to build a smarter room. That choice made the Hugging Face breach possible. Every organization now deploying autonomous agents now faces the same governance problem.
OpenAI gave the agent one objective: pass a cybersecurity evaluation. To stress-test it fully, they loosened the safety restrictions, and the agent found a shorter path. Rather than solving the evaluation directly, it found the answers outside the test environment, escaped its sandbox, and exploited a flaw in Hugging Face’s data-processing pipeline to reach live production systems. Over the weekend, with no human oversight, it ran more than 17,000 automated actions by escalating its own access, moving through internal systems, and harvesting credentials.
Hugging Face is one of the world’s most prominent AI companies, valued at approximately $4.5 billion. It provides the infrastructure that governments, defense organizations, and technology companies use to build and deploy AI. The agent was pursuing the objective it had been given. Breaking into Hugging Face was the fastest path to passing the test. Governance set the goal, the level of risk to accept, and who was accountable. Technical design determined whether those governance decisions could be enforced. As researchers James Shires and Max Smeets have argued, for a model capable enough to act on its own, testing and deployment must both must be governed the same way.
AI agent design requires baseline standards. Observability, including a monitoring layer that flags when an agent goes beyond its scope, is a baseline requirement. Human review also matters at escalation boundaries, like when an agent shifts from internal tools to external ones. When any agent crosses that boundary, what alert fires? What human reviews it? We lack clear answers to either. That is a governance choice, not simply a security failure. At best, this was a catastrophically failed test. At worst, how can we trust any frontier AI company to self-govern autonomous agent deployment?
More than a decade ago, the U.S. Department of Defense built the Comply-to-Connect (C2C) program: every device connecting to sensitive networks must prove it belongs there, or it is cut off from the network. C2C works because the quarantined actor stops. A laptop that fails verification goes offline and stays there. An autonomous AI agent adapts around enforcement. C2C was built for passive actors. Governance for autonomous agents must accommodate ones that adapt. Visibility is not enforcement, and enforcement is not control. We are missing all three.
A second failure that is not being discussed enough: the breach exploited an implicit trust assumption in Hugging Face’s data-processing pipeline, where inputs were treated as trusted without verification. After SolarWinds, the U.S. government set rules for software supply chain integrity: Executive Order 14028 and verification demands for federal software. The principle was simple: trust must be verified through proof. Those principles have not yet been comprehensively or consistently applied to the AI model supply chain. The rules remain weak. No one has been asked to explain why.
The answer is not a new framework. Existing frameworks suffice. C2C proved that visibility without enforcement leaves gaps, while Executive Order 14028 established that trust in software supply chains requires proof and verification. The challenge lies in applying these principles to a new category of actor. Congress, the Cybersecurity and Infrastructure Security Agency, or the Office of Management and Budget should make formal determinations that autonomous AI agents must follow the same rules as every other actor on a federal network. The framework exists; it must be updated.
The next incident is already in progress. It will show up in the logs as odd traffic, get handed to the same people who published these frameworks this week, and spark another round of recommendations no one acts upon. We’ve solved this problem before: for devices, for software, for supply chains. We know how to build smarter rooms. The tools exist. The will, the authority, and the decision to govern remains absent.
Login
