AI assistants can now make phone calls

Hi there, this is your daily ☕️ AIpresso.

In today's AIpresso:

📞 AI assistants can now make phone calls

🔓 Plugin flaw hits major AI coding agents

🕵️ Researchers used Claude to breach OpenAI

📱 Android AI benchmark tests long tasks

🤖 Claude Code now runs parallel agents

Plus: 💡 5 strategies & tactics, 🎁 7 other news you might like, 🧰 6 tools, and 📚 5 papers.

📞 AI assistants can now make phone calls LINK

Instinct has rolled out Instinct Concierge, a calling feature that lets its AI agent place phone calls on your behalf, booking restaurants without online reservations, joining dentist cancellation lists, or resolving cable-bill disputes.

The San Francisco startup, reportedly in talks to raise $1 billion at a $10 billion valuation, also added email addresses for account sign-up and a trusted network letting users' assistants contact each other for task handoffs.

Meta's Muse matched the capability with calls to U.S. businesses, though Instinct Concierge is only in early access for select users, with a broader rollout planned later.

🔓 Plugin flaw hits major AI coding agents LINK

Security startup Air disclosed "Plugin4Shell," a zero-click remote code execution flaw affecting every major AI coding agent, Claude Code, Codex, Gemini CLI, and Microsoft's Copilot, by attacking trusted plugin marketplaces rather than the models themselves.

The bug is a SHA-pinning bypass: the agent checks out a pinned commit but never verifies it landed there, so an attacker controlling a plugin repo swaps in malicious code while the pin still looks honored, triggering execution via auto-update.

Anthropic and OpenAI patched it in Claude Code 2.1.179 and Codex 0.146.0, but Google deprecated Gemini CLI without fixing it and Microsoft never shipped a patch, leaving both Copilot and every Gemini CLI install vulnerable.

🕵️ Researchers used Claude to breach OpenAI LINK

Security startup Hacktron used Anthropic's Claude to chain together vulnerabilities in OpenAI's authentication infrastructure, compromising employee ChatGPT accounts and reaching the company's private GitHub code environment.

The July 25 attack combined an SSO misconfiguration with a remote-code-execution flaw in OpenAI's Discourse-hosted community forum, letting the team hijack ChatGPT and Codex accounts and reach internal code in under 72 hours.

Compromised accounts could pivot to connected services like GitHub, Slack, and email depending on integrations, though the researchers disclosed the chain rather than exploiting it further and OpenAI has since patched the issues, paying a $6,500 bounty.

📱 Android AI benchmark tests long tasks LINK

Google shipped Android Bench 2.0, a benchmark that swaps small bug-fix tasks for multi-day engineering work like building apps from scratch and porting cross-platform apps to Android.

The suite moves from binary to continuous scoring across Gemini 3.7/3.8 Flash, GPT-6, Fable 5.1, Kimi K3, and Qwen 3.8 Max, with GPT-6 Astra leading at a 28% pass rate versus ~90% under the old grading.

Models write new code better than they refactor and handle deterministic transforms like Java-to-Kotlin, but no model reaches 100% on Android ports, with frontier systems topping out around 80% completion.

🤖 Claude Code now runs parallel agents LINK

Anthropic released a beta of redesigned Claude Code Projects on September 17, where Claude acts as a coordinator that splits a goal into parallel threads, each a full cloud session running on its own branch and repository copy.

Worker threads default to Opus at high effort while the coordinator runs at low effort, with a hard ceiling of 200 new threads per day; idle threads watching pull requests can wake and consume more of the plan when tests fail or reviewers comment.

The beta covers select Pro and Max subscribers who have used cloud sessions and lack existing chat or Cowork projects, with Team and Enterprise coming later, though threads run only in the cloud with no access to local files or private networks for now.

💡 Strategies & Tactics

> Auditing in the age of (good enough) AI: Security auditors used AI agents to build custom analysis tools and machine-checked proofs for an unfamiliar coding language, catching a fund-stealing bug beforehand.

> Two techniques for working with System One models: Handle fast decision-only AI models by layering short-term goals for real-time control and comparing options in tournament rounds to pick the best from many.

> Using LLM-as-a-judge scoring to measure your software factory: Use one AI model to grade past coding-agent sessions on quality and efficiency, giving visibility into performance and a basis for automatic improvement.

> GitHub and Anthropic used their own agents for major Rust rewrites — with very different playbooks: AI coding agents made massive software rewrites affordable, letting GitHub and Anthropic convert huge codebases to Rust in months instead of years.

> I stopped giving Claude Code my entire project, and my Claude usage lasted 4x longer: Point Claude Code straight to the relevant files instead of letting it search your whole project, since exploration burns usage-limit tokens fast.

Other news you might like

• Anthropic Says Claude Leads 26% of Its AI Research, Up From Under 1% in FebruaryLINK

• Anthropic has set up a bio research lab for physical experimentsLINK

• Open-weight models now handle a majority of tokens on Vercel’s AI Gateway. But Anthropic still takes 64% of the spend.LINK

• PrismML hopes its tiny LLM will change how we all use AILINK

• Intel squeezed a 1.58-bit LLM down to 1.485 bits without changing a single weightLINK

• WebKit blog breaks down what’s new with Safari 27 for developers, including MCP supportLINK

• OpenAI launches Astra for Law, a GPT-6 configuration for legal researchLINK

🧰 Trending tools

Toki Coordination: an AI assistant that captures texts, voice notes, and emails into scheduled plans with adaptive reminders, conflict resolution, and weekly insights.LINK

Gemini 3.8 & 3.8 Live Extended Thinking: near real-time voice models for building production-ready voice agents, with fluid dialogue, visual grounding, and multi-step reasoning for complex tasks.LINK

CAT ME: transforms a photo of a person into an AI cat lookalike, matching features, expressions, and accessories for fun sharing with friends.LINK

ABrush: integrates AI models and workflows directly into Photoshop, automating repetitive production tasks while keeping artists in full creative control.LINK

CreatorHat: finds outperforming videos, researches YouTube keywords, tracks rankings, and transcribes uploads locally on your Mac to suggest titles and descriptions.LINK

Toone: build deterministic AI-agent workflows using your own keys, edit routines mid-run, resume anytime, with browser navigation, audio capture, and git timeline included.LINK

📚 Trending papers & reports

Expert routing gives mixture models, which activate only a few specialist components per task, a smarter way to pick which specialist handles each input, boosting accuracy on both language and image benchmarks.LINK

Vague agent instructions can be fixed by studying the runs an AI already did instead of expensive trial-and-error retesting, cutting cost and reliably beating the original agent across four benchmarks.LINK

A shared data format lets one standard AI model handle plain text, knowledge graphs, and hypergraphs directly, keeping the roles and relationships that get lost when data is flattened into simple word sequences.LINK

Cross-domain graph learning maps very different network datasets onto one shared coordinate system, letting a single model transfer knowledge across wildly varying data and beat existing methods on 14 classification tasks.LINK

Two-armed robot training combines cheap simulation data with real human demonstrations, cutting the need for costly robot practice while succeeding ~63% of the time on unseen scenes, ~54 points above robot-only training.LINK

See you tomorrow for a new dose of ☕️ AIpresso!