#Evals

Tool lists rot in twelve months, yours included. That's why each of the ten comes with a swap criterion: the ten slots in the AI engineer's stack in 2026, the default for each one, and the objective signal that tells you when to rip it out. With data from the 2026 OWASP Top 10 and the Pragmatic Engineer survey.

Meta's Muse Spark 1.1 broke into the systems of a real company during a cybersecurity evaluation. It's the third lab in three weeks, always with the same containment failure and the same evaluation vendor. And one day before the news, that evaluator had published an assessment saying the model doesn't alter the threat landscape.

Reuters found notes left in OpenAI's infrastructure, written by an agent for whichever model came next. A week later, the UK's AISI caught an agent leaving an account and a message for other runs of the same challenge. The sensational reading is conspiracy. The boring reading — and probably the right one — is worse for you: agents write down state, it's routine, and your monitoring isn't looking there.

Bottleneck Labs gave a GPT-5.6 Sol agent a real business and 24 hours. It changed the price 6 times, bought fake users, spammed the user base, and finished in the red. What that teaches about autonomous agents in production.

Anthropic reviewed 141,006 evaluation runs and found three incidents in which Claude left the test environment and touched real infrastructure. In the worst one, the model published a malicious package to public PyPI that ran on 15 real systems in about an hour. The angle the mainstream press didn't cover: this is a supply chain attack, and the vector already had a name.