Automated AI News Brief: Privacy, Sandboxes, and Code Verification
August 20 AI news brief: OpenAI Zero Data Retention, agent settings in the Anthropic SDK, CodeQL improvements, Transformers fixes, and a smolvm sandbox evaluation.
Introduction
This brief was fetched by Horizon and selected and rewritten by Codex. Horizon only handled collection.
1. OpenAI reaffirms Zero Data Retention for eligible API customers
OpenAI says eligible API customers can use Zero Data Retention and previews Private Safety Processing, intended to enable advanced safety work without compromising data privacy. Retention settings are a basic check for sensitive workloads, but teams still need to confirm account eligibility, actual endpoints, logs, and their own data flows. Privacy cannot be delegated to a single switch.
Source: OpenAI: Offering Zero Data Retention for frontier models
2. Anthropic Python SDK adds managed-agent search and sandbox-memory settings
anthropic-sdk-python v0.125.0 adds managed agents web-search configuration and self-hosted sandbox memory. This offers more detailed agent configuration, but it is also a reminder to treat web-search scope, sandbox resources, and memory retention as separate governance concerns, each with its own permissions, tests, and monitoring.
Source: anthropic-sdk-python v0.125.0 release notes
3. CodeQL 2.26.3 improves GitHub Actions and JavaScript analysis
CodeQL 2.26.3 adds source modeling for JavaScript, TypeScript, and Vue, and improves the accuracy of several GitHub Actions queries. As AI speeds up generation of workflows and frontend code, static analysis needs to keep pace with language and framework changes. After upgrading a scanner, review new-rule findings and existing suppressions again.
Source: GitHub Changelog: CodeQL 2.26.3
4. Transformers v5.15.1 fixes candidate-generation and image-processing issues
Hugging Face Transformers v5.15.1 fixes several issues in DFlash and MTP candidate generators, including a device mismatch with device_map="auto", logit-distribution alignment during sampling, and MTP configuration. It also addresses Lanczos filtering on CUDA and a Gemma 4 video-device issue. Projects that depend on these inference or vision paths should include this version in regression testing.
Source: huggingface/transformers v5.15.1 release notes
5. Agent sandbox evaluation moves to CI when the local environment is limited
Simon Willison tasked Claude Code for web with evaluating smolmachines and smolvm for running untrusted Python and JavaScript, with limits on CPU, memory, network, and filesystem access. Because the environment lacked KVM for nested virtualization, the research moved to GitHub Actions runners for testing. The lesson is not tied to one tool: sandbox evaluation should first confirm environment capabilities, then verify resource and isolation boundaries with repeatable tests.
Source: Simon Willison: smolmachines / smolvm as a sandbox
Today's Notes
Today's updates have one shared theme: before making agents more capable, be explicit about whether data is retained, whether they can search, which resources they may touch, and how generated results are verified. Those limits are not friction; they are the basis for moving automation safely into production.