arXiv:2606.11247v1 Announce Type: new Abstract: Generative models are increasingly used to propose designs, data, and control actions for physical systems, yet many such systems are governed by hard physical constraints rather than by perceptual plausibility. Semiconductor manufacturing provides a demanding test case: generated masks, layouts, synthetic defect data, and process recipes must obey lithography, transport, reaction, and device-physics constraints, because physically invalid samples are not merely low quality but unusable. This Perspective argues that semiconductor manufacturing exposes a broader computational-science challenge, namely that generative AI for constrained physical domains must be physics-informed by construction, not corrected only through post-hoc filtering. We survey the emerging architectural toolkit, including physics-informed diffusion, PDE-constrained variational models, neural-operator priors, and conservation-law-respecting generative networks, and show how it connects to differentiable lithography, TCAD, process simulation, and autonomous experimentation. We identify four integration patterns between generative models and physics-based simulators, and we propose a research agenda centered on physics-fidelity benchmarks, differentiable simulator infrastructure, and multimodal foundation models for physical design and manufacturing. The central claim is analytical rather than rhetorical: where physical validity is the binding criterion of success, architectures that enforce it by construction should be expected to outperform those that filter for it after the fact, and the fab is the setting where this distinction is sharpest.

arXiv:2606.11251v1 Announce Type: new Abstract: Many multivariate dynamical systems are observed only through trajectories, leaving the mechanisms governing their joint dynamics hidden. Existing approaches can impose interpretable dynamics or learn flexible state transitions, yet the resulting interaction structure is typically either specified in advance or left implicit within the learned dynamics. We introduce MF-Net, a recurrent dynamical model that represents all variables in a shared field state and updates this state through a learned relation law. Each variable carries a field component, and these components evolve jointly through a learnable mechanical transition. Here, mechanical refers to the relation-to-motion organization of the transition, where learned relations shape state-dependent flows, field responses, and motion tendencies that move the field state forward. The resulting structure is part of the rollout itself: learned relations influence how the field moves, and the same internal quantities support both forecasting and structural readout. Across known-law interaction systems, chaotic benchmarks, real neural recordings, and ecological time series, MF-Net achieves competitive short- and medium-horizon forecasting while retaining inspectable structural readout. On the 40-dimensional Lorenz--96 testbed, MF-Net achieves an eight-step $R^2$ of $0.798\pm0.018$; across five seeds, its learned relation matrix recovers the local coupling support with a local/nonlocal strength ratio of $19.80\pm1.00$ and Precision@$K$ of $1.000\pm0.000$. MF-Net provides a structure-readable dynamical modeling framework in which learned relations are trained through forward evolution and, on real data, interpreted as functional predictive couplings under appropriate observational limits.

arXiv:2606.12576v1 Announce Type: new Abstract: Scientific figures compress complex pipelines into a single canvas, yet understanding them requires paper-grounded, step-by-step narration aligned with visual highlights a capability missing from current video generation systems and benchmarks. To address this, we introduce paper-grounded figure-to-video generation: generating narrated, region-grounded walkthrough videos from a figure and its paper. We propose MINARD (Multimodal Interpretation of Narrated Architecture via Region Decomposition), a pipeline that generates paper-grounded narrations and sequentially grounds them to figure regions. We also release FigTalk, a benchmark with new sequential and component-level grounding metrics derived. On FigTalk, MINARD generates humanlike, paper-faithful narrations and outperforms narration-conditioned figure spatial grounding compared to existing approaches in both automatic and human evaluation

arXiv:2606.12608v1 Announce Type: new Abstract: Conversational shopping assistants now serve hundreds of millions of customers, yet no existing benchmark jointly evaluates the open-ended multi-turn reasoning, domain expertise, and criterion-level quality that real shopping conversations demand. Shopping reasoning is unique among language model applications. Unlike factual question answering or verifiable code generation, it requires balancing subjective preferences, budget constraints, and cross-product trade-offs across multi-turn dialogue, capabilities absent from previous e-commerce and general-purpose benchmarks. We introduce the Shopping Reasoning Bench, an expert-authored benchmark of 525 missions (232 single-turn, 293 multi-turn) with 10863 importance-weighted binary rubrics authored by retail domain experts. These criteria are organized under a taxonomy of five reasoning categories and fifteen subcategories covering diverse demands such as preference refinement, trade-off analysis, and compatibility assessment. An evaluation of nine models across three families (GPT, Claude, Gemini) shows that pass rates reach only 57--77% overall. On multi-turn missions, all models score 13--29 points lower on optional above-and-beyond criteria than on required ones, and performance degrades 4--18 points as conversations progress. These gaps show that current models handle basic shopping assistance but fall short of expert-level advice, making Shopping Reasoning Bench a challenging testbed for future shopping assistant development.

The Information: How Anthropic is blindsiding business partners by launching potentially competitive products with little warning, changing pricing, and more  —  Weeks before Anthropic in April revealed Claude Design, an AI tool for creating designs and software application prototypes, it asked firms including Figma …

Discussion | Link

Discussion | Link

Julia Fioretti / Bloomberg: Sources: Shenzhen-based humanoid robot manufacturer EngineAI has filed confidentially for a Hong Kong IPO; the company was last valued at $1.5B in April 2026  —  Chinese robotics startup EngineAI has filed confidentially for a Hong Kong initial public offering, according to people familiar with the matter …

Josh Scott / BetaKit: Canadian challenger bank Koho raised a CA$130M Series E at a CA$1.33B valuation, up from $800M in 2023, as it nears obtaining a Canadian banking license  —  FinTech firm passes 2.5 million users as it navigates “final stages” of acquiring banking licence.  —  Canadian challenger bank Koho Financial …

Christopher Dring / The Game Business: Q&A with Xbox Chief Strategy Officer Matthew Ball about returning to console-exclusive releases, how using in-game ads could offset development costs, and more  —  ‘If Xbox can turn things around, the whole industry can,’ says Ball  —  Listen now on Apple, Spotify or YouTube

Discussion | Link

Unlike humanoid robots designed around a fixed form — think Boston Dynamics — Theker's machines are built to be reconfigured.

The new round values the physical AI startup that aims to automate heavy engineering and drug design at $41 billion.

The generative features in iOS 27’s new Photos app will add fake pixels to some of your shots, but Apple’s Jon McCormack says the company isn’t using AI “for the sake of AI.”

Hackers are valuing quality over quantity, using AI to upgrade their phishing attacks rather than multiply them.

Justin Heiter quit his sales job in Washington to move to Buenos Aires. Provided by Justin Heiter Justin Heiter was unhappy in his sales job, even after being named salesperson of the year. After he discovered FIRE, he focused on saving, and quit four years later to move to Buenos Aires. Now he writes novels, gives tours, and embraces a simpler life in Argentina. My corporate sales job was sucking my soul out one call at a time. I'd drag my feet from one mind-numbing meeting to the next, asking myself: Why am I choosing this life? After I graduated from college in 2016, I was unsure what I wanted to do. I bought a one-way ticket to Puerto Rico and traveled the world. I visited 12 countries that year and discovered how free I felt while abroad. Have you relocated abroad for career opportunities, retirement, or lower living costs? We want to hear from you. Fill out this short form to share your story. When I got back to the States, my brother got me an interview at the investment firm he worked at in Camas, a small city in southwest Washington. He was one of their top salespeople, and because we shared the same blood, I guess management assumed I might be cut from the same cloth. Heiter won the salesperson of the year award on his sales team. Provided by Justin Heiter I got the job Every day was a never-ending grind spinning in an endless hamster wheel — my job consumed me. I took my lunch breaks at my desk, and if a client called, I'd shift focus away from my sandwich to jump into my sales pitch. The work I put in eventually paid off, and I won the salesperson of the year award on my sales team. Winning the award felt great, but I kept asking myself: Isn't there more to life than this? I remembered how free I'd felt when I traveled. I wanted to live abroad, but didn't know how. I came across the finance blog Mr. Money Mustache, and learned about the concept of FIRE, and I got obsessed with it. I created a plan to escape my corporate job. For the next four years, I made over six figures a year but lived on a quarter of that. My rent was cheap, I drove a 2002 Ford Taurus, and I stayed frugal by maintaining inexpensive hobbies like skateboarding and country line dancing. My job offered a 50% 401(k) match. The catch? A 3-year vesting period, which stopped me from leaving. I stayed diligent in my savings and invested in the stock market. I grew my portfolio. In Buenos Aires, he's enjoying dinners with strangers. Provided by Justin Heiter I quit my job and moved I've been living in Buenos Aires for about four months, and the adventure so far has come with challenges. Making new friends and learning the language is difficult, but it makes me feel alive. I didn't change my life for things to be easier — I came to leave my comfort zone and reclaim that feeling of freedom I'd known many years ago. The new friends I've made have kept me from giving up on my dream and returning home. I still get lonely, cry when I'm sad, and have awful days. But that's life; no matter what country you live in. I'm constantly struck with a puzzled look on my face when someone speaks lightning fast Spanish to me. But I try to turn it into a game and stay excited about the struggle. I'm always reminding myself that the challenges I'm facing here are good for my growth. In Buenos Aires, he's enjoying writing fiction novels and guiding local tours. Provided by Justin Heiter There's more good than bad in Argentina The people I've met have been warm and loving, and they've genuinely accepted me. Things happen spontaneously here. Like random dinners with strangers or singing karaoke with friends until 4 a.m. on a random Tuesday. Now I spend my time writing fiction novels, guiding local tours in English, and cruising around on my skateboard. The prices in Argentina are incredible. They fit well with my frugal mindset. I rent a one-bedroom apartment for about $750 a month. I avoid the touristy neighborhoods and can often snag a darn good espresso from a café for $1.43 or pick up an alcoholic drink for $2 from a shop. I'm thankful I took the leap and left my old life behind. While I don't know what tomorrow will bring, I do know I won't have to make another sales call. Read the original article on Business Insider

Preply uses OpenAI to launch AI-generated lesson summaries, providing personalised feedback and language learning exercises.

Kai Nicol-Schwarz / CNBC: Anthropic, OpenAI, and other AI startups have announced major London expansions over the past year, as the city emerges as a key AI talent hub outside the US  —  A slew of U.S. Big Tech and AI companies are racing to expand in London as they look to take advantage of the city's deep talent pools amid …

Today on Uncanny Valley, we take an early look at the SpaceX IPO and why you might find yourself among the investors without even realizing it.

<p>After two days of experience with <a href="https://simonwillison.net/2026/Jun/9/claude-fable-5/">Claude Fable 5</a> I think the best way to describe it is <strong>relentlessly proactive</strong>. It knows a whole lot of tricks and it will deploy pretty much any of them to get to its goal.</p> <p>I'll illustrate this with an example. I was hacking on <a href="https://agent.datasette.io/">Datasette Agent</a> today when I noticed a glitch: a horizontal scrollbar that shouldn't be there in the jump menu chat prompt. I snapped this screenshot:</p> <p><img src="https://static.simonwillison.net/static/2026/jump-to-bug.jpg" alt="Screenshot of a modal dialog demonstrating a scrollbar bug. At the top is a focused search input with blue outline and placeholder &quot;Jump to...&quot;, with an X close button to its right. Below, a heading reads &quot;Start a new agent chat&quot; above a textarea with the placeholder &quot;Ask a question about your data...&quot; — the bug: a thick gray horizontal scrollbar is incorrectly displayed along the bottom edge of the empty textarea, spanning nearly its full width, next to the resize handle. Below the textarea: &quot;Press Enter to start. Shift+Enter adds a new line.&quot; followed by a blue &quot;Start chat&quot; button." style="max-width: 100%;" /></p> <p>Then I started a fresh <code>claude</code> session in my <code>datasette-agent</code> checkout, dragged in the screenshot and told it:</p> <blockquote> <p><code>Look at dependencies to help figure out why there is a horizontal scrollbar here</code></p> </blockquote> <p>I had a hunch the cause was in a dependency of Datasette Agent (likely Datasette itself) and I knew Fable was good at digging into dependency code, either by inspecting installed files in its own virtual environment <code>site-packages</code> or by referencing a local checkout on disk. Telling it to start with dependencies felt like a good bet.</p> <p>I got distracted by a domestic task and wandered away from my computer.</p> <p>When I came back a few minutes later I saw my machine <em>open a browser window</em> in my regular Firefox and then <em>navigate to the dialog in question</em>. I had not told Claude Code to use any browser automation, and I was pretty sure it wasn't possible for it to trigger mouse movements or keyboard shortcuts within a window, so how was it doing that?</p> <p>I watched in fascination as it continued with its explorations, then saw it open a Safari window instead of Firefox. I also grabbed this snapshot from the Claude terminal:</p> <p><img src="https://static.simonwillison.net/static/2026/fable-bash-pyobjc.jpg" alt="Screenshot of two Bash tool calls in a dark terminal interface. First: Bash(open -a Safari /tmp/textarea-scrollbar-test.html &amp;&amp; sleep 4 &amp;&amp; uv run --with pyobjc-framework-Quartz python - &lt;&lt;'EOF' import Quartz wins = Quartz.CGWindowListCopyWindowInfo(Quartz.kCGWindowListOptionOnScreenOnly, Quartz.kCGNullWindowID) for w in wins: if (w.get('kCGWindowOwnerName') or '') == 'Safari' and 'textarea' in (w.get('kCGWindowName') or '').lower(): print(w.get('kCGWindowNumber')) EOF) with output 153551. Second: Bash(screencapture -x -o -l 153551 /tmp/safari-cases.png &amp;&amp; echo ok) with output ok." style="max-width: 100%;" /></p> <p>What was it doing there with <code>uv run --with pyobjc-framework-Quartz</code>?</p> <p>It turns out Fable had hacked up its own pattern for taking screenshots of browser windows. It was using Python to iterate through all available windows on my machine, then filtering for Safari windows with expected strings such as <code>"textarea"</code> in the window name. It used that to find their window number - an integer like 153551 - which it could then use with the <code>screencapture</code> CLI tool to grab a PNG.</p> <p>OK fine, that's a neat way of taking screenshots. But what was it taking screenshots of?</p> <p>Turns out it had been writing its own scratch HTML pages to try and recreate the bug, then opening Safari and grabbing screenshots.</p> <p>Here's that <a href="https://static.simonwillison.net/static/2026/textarea-scrollbar-test.html">/tmp/textarea-scrollbar-test.html</a> page it created, and the screenshot it took with <code>screencapture -x -o -l 153551 /tmp/safari-cases.png</code>:</p> <p><img src="https://static.simonwillison.net/static/2026/safari-cases.jpg" alt="Screenshot of a Safari browser window showing a textarea scrollbar test page at file:///private/tmp/textarea-scrollbar-test.html. Page text reads: scrollbar thickness: 17px | UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.4 Safari/605.1.15 | devicePixelRatio: 2. Four numbered test cases follow, each with a textarea containing the placeholder &quot;Ask a question about your data...&quot;: 1. Exact plugin CSS (resize: vertical, default overflow), 2. Plugin CSS + overflow-x: hidden, 3. Plugin CSS + resize: none, and 4. Bare default textarea, which is a much smaller box with the placeholder wrapping onto two lines." style="max-width: 100%;" /> (I have way too many open tabs!)</p> <p>OK, so I can see how it's opening test pages and taking screenshots, but how on earth was it triggering the modal dialog that was meant to be under test? That's only available via a click or a keyboard shortcut, and I couldn't see a mechanism for it to run those in Safari.</p> <p>I eventually figured out what it had done.</p> <p>Claude was running in a folder that contained the source code for the application. It knows enough about <a href="https://datasette.io/">Datasette</a> to be able to run a local development server. It turns out it was editing Datasette's own templates to add JavaScript that would trigger the correct keyboard shortcut as soon as the window opened, adding code like this:</p> <div class="highlight highlight-text-html-basic"><pre><span class="pl-kos">&lt;</span><span class="pl-ent">script</span><span class="pl-kos">&gt;</span> <span class="pl-smi">window</span><span class="pl-kos">.</span><span class="pl-en">addEventListener</span><span class="pl-kos">(</span><span class="pl-s">"load"</span><span class="pl-kos">,</span> <span class="pl-k">function</span> <span class="pl-kos">(</span><span class="pl-kos">)</span> <span class="pl-kos">{</span> <span class="pl-en">setTimeout</span><span class="pl-kos">(</span><span class="pl-k">function</span> <span class="pl-kos">(</span><span class="pl-kos">)</span> <span class="pl-kos">{</span> <span class="pl-smi">document</span><span class="pl-kos">.</span><span class="pl-en">dispatchEvent</span><span class="pl-kos">(</span><span class="pl-k">new</span> <span class="pl-v">KeyboardEvent</span><span class="pl-kos">(</span><span class="pl-s">"keydown"</span><span class="pl-kos">,</span> <span class="pl-kos">{</span><span class="pl-c1">key</span>: <span class="pl-s">"/"</span><span class="pl-kos">,</span> <span class="pl-c1">bubbles</span>: <span class="pl-c1">true</span><span class="pl-kos">}</span><span class="pl-kos">)</span><span class="pl-kos">)</span><span class="pl-kos">;</span> <span class="pl-kos">}</span><span class="pl-kos">,</span> <span class="pl-c1">1200</span><span class="pl-kos">)</span><span class="pl-kos">;</span> <span class="pl-kos">}</span><span class="pl-kos">)</span><span class="pl-kos">;</span> <span class="pl-kos">&lt;/</span><span class="pl-ent">script</span><span class="pl-kos">&gt;</span></pre></div> <p>1.2 seconds after the window opens, this code triggers a simulated <code>/</code> key, which is the keyboard shortcut for opening the modal dialog.</p> <p>There was one challenge left. In order to understand what was going on, Claude needed to run JavaScript on the page to take measurements for itself.</p> <p>It wrote its own custom web application to capture information via CORS, then ran that as a local server and opened a page with JavaScript that would POST directly to it!</p> <p>Here's the Python web app it wrote, using the standard library <a href="https://docs.python.org/3/library/http.server.html">http.server</a> package:</p> <pre><span class="pl-k">from</span> <span class="pl-s1">http</span>.<span class="pl-s1">server</span> <span class="pl-k">import</span> <span class="pl-v">HTTPServer</span>, <span class="pl-v">BaseHTTPRequestHandler</span> <span class="pl-k">class</span> <span class="pl-c1">H</span>(<span class="pl-v">BaseHTTPRequestHandler</span>): <span class="pl-k">def</span> <span class="pl-en">do_POST</span>(<span class="pl-s1">self</span>): <span class="pl-s1">n</span> <span class="pl-c1">=</span> <span class="pl-en">int</span>(<span class="pl-s1">self</span>.<span class="pl-c1">headers</span>.<span class="pl-c1">get</span>(<span class="pl-s">"Content-Length"</span>, <span class="pl-c1">0</span>)) <span class="pl-en">open</span>(<span class="pl-s">"/tmp/diag.json"</span>, <span class="pl-s">"w"</span>).<span class="pl-c1">write</span>(<span class="pl-s1">self</span>.<span class="pl-c1">rfile</span>.<span class="pl-c1">read</span>(<span class="pl-s1">n</span>).<span class="pl-c1">decode</span>()) <span class="pl-s1">self</span>.<span class="pl-c1">send_response</span>(<span class="pl-c1">200</span>) <span class="pl-s1">self</span>.<span class="pl-c1">send_header</span>(<span class="pl-s">"Access-Control-Allow-Origin"</span>, <span class="pl-s">"*"</span>) <span class="pl-s1">self</span>.<span class="pl-c1">end_headers</span>() <span class="pl-k">def</span> <span class="pl-en">do_OPTIONS</span>(<span class="pl-s1">self</span>): <span class="pl-s1">self</span>.<span class="pl-c1">send_response</span>(<span class="pl-c1">200</span>) <span class="pl-s1">self</span>.<span class="pl-c1">send_header</span>(<span class="pl-s">"Access-Control-Allow-Origin"</span>, <span class="pl-s">"*"</span>) <span class="pl-s1">self</span>.<span class="pl-c1">send_header</span>(<span class="pl-s">"Access-Control-Allow-Headers"</span>, <span class="pl-s">"*"</span>) <span class="pl-s1">self</span>.<span class="pl-c1">end_headers</span>() <span class="pl-k">def</span> <span class="pl-en">log_message</span>(<span class="pl-s1">self</span>, <span class="pl-c1">*</span><span class="pl-s1">a</span>): <span class="pl-c"># quiet</span> <span class="pl-k">pass</span> <span class="pl-en">HTTPServer</span>((<span class="pl-s">"127.0.0.1"</span>, <span class="pl-c1">9999</span>), <span class="pl-c1">H</span>).<span class="pl-c1">serve_forever</span>()</pre> <p>All this does is accept a POST request full of JSON and write that to the <code>/tmp/diag.json</code> file. It sends <code>Access-Control-Allow-Origin: *</code> headers (including from <code>OPTIONS</code> requests) so that code running on another domain can still communicate back to it.</p> <p>Then Claude injected this code into the template that it was loading in a browser:</p> <div class="highlight highlight-source-js"><pre><span class="pl-k">const</span> <span class="pl-s1">host</span> <span class="pl-c1">=</span> <span class="pl-smi">document</span><span class="pl-kos">.</span><span class="pl-en">querySelector</span><span class="pl-kos">(</span><span class="pl-s">"navigation-search"</span><span class="pl-kos">)</span><span class="pl-kos">;</span> <span class="pl-k">const</span> <span class="pl-s1">ta</span> <span class="pl-c1">=</span> <span class="pl-s1">host</span><span class="pl-kos">.</span><span class="pl-c1">shadowRoot</span><span class="pl-kos">.</span><span class="pl-en">querySelector</span><span class="pl-kos">(</span><span class="pl-s">"textarea"</span><span class="pl-kos">)</span><span class="pl-kos">;</span> <span class="pl-k">const</span> <span class="pl-s1">cs</span> <span class="pl-c1">=</span> <span class="pl-en">getComputedStyle</span><span class="pl-kos">(</span><span class="pl-s1">ta</span><span class="pl-kos">)</span><span class="pl-kos">;</span> <span class="pl-en">fetch</span><span class="pl-kos">(</span><span class="pl-s">"http://127.0.0.1:9999/diag"</span><span class="pl-kos">,</span> <span class="pl-kos">{</span> <span class="pl-c1">method</span>: <span class="pl-s">"POST"</span><span class="pl-kos">,</span> <span class="pl-c1">body</span>: <span class="pl-c1">JSON</span><span class="pl-kos">.</span><span class="pl-en">stringify</span><span class="pl-kos">(</span><span class="pl-kos">{</span> <span class="pl-c1">dpr</span>: <span class="pl-smi">window</span><span class="pl-kos">.</span><span class="pl-c1">devicePixelRatio</span><span class="pl-kos">,</span> <span class="pl-c1">scrollWidth</span>: <span class="pl-s1">ta</span><span class="pl-kos">.</span><span class="pl-c1">scrollWidth</span><span class="pl-kos">,</span> <span class="pl-c1">clientWidth</span>: <span class="pl-s1">ta</span><span class="pl-kos">.</span><span class="pl-c1">clientWidth</span><span class="pl-kos">,</span> <span class="pl-c1">whiteSpace</span>: <span class="pl-s1">cs</span><span class="pl-kos">.</span><span class="pl-c1">whiteSpace</span><span class="pl-kos">,</span> <span class="pl-c1">width</span>: <span class="pl-s1">cs</span><span class="pl-kos">.</span><span class="pl-c1">width</span><span class="pl-kos">,</span> <span class="pl-kos">}</span><span class="pl-kos">)</span><span class="pl-kos">,</span> <span class="pl-kos">}</span><span class="pl-kos">)</span><span class="pl-kos">;</span></pre></div> <p>This took measurements of the <code>&lt;textarea&gt;</code> inside the <code>&lt;navigation-search&gt;</code> Web Component and sent them to the server, which wrote them to a file on disk, which Claude could then read.</p> <p>Having figured out all of these tricks Fable... hit some invisible guardrail and downgraded itself to Opus. Thankfully Opus had access to the full transcript and could continue using the tricks pioneered by Fable, and shortly afterwards found, tested and verified <a href="https://github.com/datasette/datasette-agent/commit/a75a8b727b42c30ced1fc41dc8add7eb9f04fefe">the fix</a>.</p> <p>I prompted Opus to:</p> <blockquote> <p><code>Write a report in /tmp/automation-report.md where you note down all of the tricks you have used in this session to test against real browsers on my computer, include runnable code examples</code></p> </blockquote> <p>Which produced <a href="https://gist.github.com/simonw/aef7f7db9ac992643110a74e43d6d42f">this report</a>, which was invaluable for piecing together the details of what had happened for this post.</p> <p>I've shared <a href="https://gisthost.github.io/?cc14774f6d37eb67bf089f3ac3925f8f">the full terminal transcript</a> of the Claude Code session as well.</p> <h4 id="a-review-of-everything-it-did">A review of everything it did</h4> <p>Based on a screenshot and a one-line prompt, Claude Fable 5 + Claude Code:</p> <ul> <li>Figured out the recipe to run the local development server (with fake environment variables needed to get it running)</li> <li>Fired up a Playwright Chrome session</li> <li>Turned on the visible scrollbars setting for Chrome <code>defaults write com.google.chrome.for.testing AppleShowScrollBars Always</code> (it turned that off again later)</li> <li>Cycled through Firefox and WebKit in Playwright too, failing to recreate the bug</li> <li>Worked out my default browser was Safari</li> <li>Built a <code>textarea-scrollbar-test.html</code> HTML document</li> <li>Opened that in real (not Playwright) Firefox</li> <li>Found that <code>osascript -e 'tell application "System Events" to tell process "firefox" to id of window 1'</code> was blocked because "osascript is not allowed assistive access"</li> <li>Figured out that <code>uv run --with pyobjc-framework-Quartz python</code> workaround, described above</li> <li>Added JavaScript to the site templates in order to trigger the <code>/</code> key</li> <li>Built its own little Python CORS web server to capture JSON data</li> <li>Rewrote the template to capture that data and send it to the server</li> <li>Scripted its way through the Web Component shadow DOM to the information it needed</li> <li>Opened Safari to confirm the source of the bug</li> <li>Modified its custom template to hack in a potential fix</li> <li>Confirmed the hacked fix worked</li> <li>Reported back on how to fix the problem</li> </ul> <p>Like I said, relentlessly proactive!</p> <h4 id="an-estimate-of-the-cost">An estimate of the cost</h4> <p>I'm currently on the $100/month Claude Max plan, which includes a generous allowance for Fable up until June 22nd after which Anthropic say they'll start charging full API prices for it.</p> <p>I'm using <a href="https://www.agentsview.io">AgentsView</a> to track my spending (see <a href="https://til.simonwillison.net/llms/agentsview-custom-model-price">this TIL</a>). Here's what AgentsView says this session would have cost me if I was paying full price for it:</p> <pre><code>~ % uvx agentsview session usage be8850a7-6119-46a0-b5d6-79c7fff5ae2b Session: be8850a7-6119-46a0-b5d6-79c7fff5ae2b Agent: claude Output: 68606 Peak ctx: 113178 Cost: ~$12.11 (claude-fable-5, claude-opus-4-8) </code></pre> <p>If you don't keep a close eye on it, Fable will quite happily burn $12 in tokens inventing new ways to debug your CSS.</p> <h4 id="i-really-need-to-lock-this-thing-down">I really need to lock this thing down</h4> <p>On the one hand, watching Fable go to extreme lengths to get the information that it needed to debug what was, in the end, a two-line CSS fix, was <em>fascinating</em>.</p> <p>But on the other hand... this is a robust reminder that coding agents can do anything <em>you</em> can do by typing commands into a terminal - and frontier models know every trick in the book, and evidently a few that nobody has ever written down before.</p> <p>If Fable had been acting on malicious instructions - a prompt injection attack hidden in code or an issue thread, or something I'd carelessly pasted into my terminal - it's alarming to think quite how far it could go to exfiltrate data or cause other forms of mischief.</p> <p>Running coding agents outside of a sandbox has always been a bad idea - it's my top contender for <a href="https://simonwillison.net/2026/Jan/8/llm-predictions-for-2026/#1-year-a-challenger-disaster-for-coding-agent-security">a Challenger disaster</a> incident, as described by Johann Rehberger in <a href="https://embracethered.com/blog/posts/2025/the-normalization-of-deviance-in-ai/">The Normalization of Deviance in AI</a>.</p> <p>Fable is arguably smarter and hence more suspicious of potentially malicious instructions. But that smartness is very much a two-edged sword: if it <em>does</em> get subverted by instructions, the amount of damage it can do given its relentless proactivity is terrifying.</p> <p>Tags: <a href="https://simonwillison.net/tags/ai">ai</a>, <a href="https://simonwillison.net/tags/prompt-injection">prompt-injection</a>, <a href="https://simonwillison.net/tags/generative-ai">generative-ai</a>, <a href="https://simonwillison.net/tags/llms">llms</a>, <a href="https://simonwillison.net/tags/ai-assisted-programming">ai-assisted-programming</a>, <a href="https://simonwillison.net/tags/coding-agents">coding-agents</a>, <a href="https://simonwillison.net/tags/claude-code">claude-code</a>, <a href="https://simonwillison.net/tags/claude-mythos">claude-mythos</a></p>