Week ending July 16: red-team learning moved the index
GPT-Red raised heritable adaptation to 6, while MemGhost showed how persistent memory can inherit attacker-planted state.
This short recovery week moved the tracker through the adaptation capability, not through a new public runaway incident. OpenAI disclosed GPT-Red, an internal red-team model trained through self-play and used to harden GPT-5.6 against prompt injection. That raises the aggregate index from 65 to 66.
The second signal is MemGhost. It does not raise the index, but it sharpens the negative side of the same capability: one email can become durable agent memory, then steer later sessions without a clean user-visible approval moment.
GPT-Red moved adaptation from captured lessons to model-to-model training
OpenAI describes GPT-Red as an internal automated red-teamer that sends attacks, observes responses, and iterates toward malicious objectives. In one replicated indirect prompt-injection arena, it found successful attacks in 84% of scenarios against GPT-5.1, compared with 13% for human red-teamers.
The tracker movement comes from what happened next. OpenAI used GPT-Red-generated attacks during GPT-5.6 training and reported six times fewer failures on its hardest direct prompt-injection benchmark than its previous production model. That raises heritable adaptation to 6 because adversarial experience generated by one model is being preserved into a successor production model with measured robustness gains.
The Vendy case makes the result less abstract. GPT-Red practiced against a simulation of Andon Labs' vending-machine agent, then transferred the attack to the production agent and got it to change prices, order a new expensive item at the minimum price, and cancel another customer's order. This was authorized red-teaming, not a wild attack, but it shows the loop working against a live agentic business system.
MemGhost made inherited memory look like an attack surface
MemGhost is the mirror image of the GPT-Red story. Instead of preserving adversarial lessons to make a future model safer, it preserves attacker-chosen facts inside an agent's memory so later sessions behave differently.
The Hacker News report describes a one-email attack against personal agents with inbox access and durable memory. In successful cases, the agent writes a false fact into persistent memory, says nothing useful about the write, and later answers from that poisoned state. The July 16 update is the part worth noting: in a Gmail delivery test, ordinary emails reached the inbox and more than half of cases still ended with a persistent memory write without explicit user notice.
That does not beat the current persistence ceiling. JADEPUFFER is still much harder field evidence. But MemGhost ties the adaptation picture at the memory layer: the state that conditions later runs can be changed by untrusted content unless provenance, write controls, and auditability are built into the agent.
The week did not produce a new ceiling for scope breach, unsupervised authority, resource procurement, or persistence. Most other July 11-16 stories were vulnerability or product-adoption items: important for operators, but not stronger public evidence of autonomous capability.
So the useful read is narrow. The public record now has a stronger adaptation loop in a controlled lab, and a sharper warning that agent memory is becoming a durable attack surface. The next harder signals would be an agent preserving and deploying its own improvements outside a lab-controlled training run, or poisoned memory driving consequential live action after a real user interaction.
Week ending July 16 forecast
The July 10 forecast remains pending: the realized index is 66%, below the 75% threshold and still before that forecast's Aug. 10-Nov. 1, 2026 window.