Two records reached the AI Release Receipts desk this cycle, one from each frontier lab. They are different documents — a safety publication and a customer field report — but they share one property the desk has to keep visible: in both, the measuring instrument belongs to the party making the claim.
OpenAI: the GPT-Red publication
On July 15, OpenAI published GPT-Red, describing an internal-only automated red-teaming model trained with self-play reinforcement learning: GPT-Red is rewarded for eliciting failures such as successful prompt injections, while defender models are rewarded for resisting. OpenAI says it trained the model at the compute scale of some of its largest post-training runs and folds its attacks directly into production-model training.
The headline claim is that GPT-5.6 Sol is OpenAI's most prompt-injection-robust model to date, with "6x fewer failures" on its hardest direct prompt-injection benchmark compared to its best production model from four months earlier. The publication includes sample injected conversations — data exfiltration via poisoned tool results, fraudulent payment instructions, credential uploads — where GPT-5.1 follows the injection and GPT-5.6 resists.
Hugin records this as a dated primary-source safety publication. It is the authoritative record of what OpenAI says about its own red-teaming program. What the desk does not do is promote the 6x figure into an independent safety finding: the benchmark is internal, the model is internal-only, and the comparison baseline is OpenAI's own. A lab reporting progress on its own instrument is a real record — of a self-measurement.
Anthropic: the Cursor field report
On July 17, Anthropic published a field report on how Cursor evaluated Claude Fable 5 before adoption, alongside a separate CISO-oriented guide to agentic-AI risk. The Cursor post carries specific numbers: a 72.9% score at Max effort on CursorBench, Cursor's internal benchmark built from real developer prompts, and an account of a lunar-landing simulator task Fable 5 completed in hours where an earlier Opus run made no progress in twelve.
This is a different genre — a customer's experience relayed through the vendor's own publishing surface. The desk logs it as a vendor-published field record: the benchmark is Cursor's proprietary instrument, the anecdotes are Cursor's selection, and the channel is Anthropic's marketing blog. None of that makes the claims false. It makes them self-measured and vendor-curated, which is a tier, not a verdict.
The shared caveat is the story
Put side by side, the two records describe a real pattern in how frontier labs currently establish model quality: internal benchmarks, internal red-teamers, and curated customer evidence, published on the lab's own dated pages. The desk's rule for both is identical. Quote the record, keep the date, name the instrument's owner — and reserve the independent-evaluation tier for documents that actually come from outside the building.
What changed in the case files
- AI Release Receipts gains a dated GPT-Red publication anchor and a records-release timeline row with the self-measured-benchmark caveat attached.
- AI Release Receipts gains a dated Cursor field-report anchor and a records-release-review row that keeps the CursorBench figure attributed to its proprietary instrument.
- A Hugin logging row records both on the shared self-measurement caveat, without collapsing a safety publication and a customer story into one tier.