Evo 2 evades Arc, Datasette patches AI-written SQL, VibeSDK sandboxes AI apps

TL;DR

• Evo 2 produced 16 viable phages, one 65× fitter than wild-type after a non-expert bypassed Arc’s safeguard
• Datasette 1.0a38 patches a SQL injection in the Claude-assisted permissions rewrite
• Cloudflare open-sourced VibeSDK with per-app sandboxes for AI-written code at ~$30/month
• ~45% of AI-generated code carries OWASP Top-10 bugs per independent scans cited by Cloudflare

Today’s tech beat is a single argument told three ways: AI-generated artifacts are the attack surface now. Arc’s Evo 2 designed 16 working bacteriophages — one replicating 65× faster than wild-type phiX174 — after a non-expert used Claude Code to fine-tune the open weights past the lab’s own safeguard. Simon Willison shipped Datasette 1.0a38 to patch a cross-table SQL injection that lives inside the ~10,000-line, heavily Claude-assisted permissions rewrite introduced in 1.0a20. And Cloudflare open-sourced VibeSDK, its internal agent workspace, with Sandstorm-derived per-app isolates precisely because independent scans put OWASP Top-10 bugs in roughly 45% of AI-generated code.

The through-line matters because the mitigations don’t line up neatly with the hazards. Sandboxes contain generated apps but not generated genomes; a patched injection cleans one rewrite but not the pattern that produced it; open weights make safeguards optional. Read the features in that order — capability, bug, containment — and the shape of the week’s real problem gets easier to see.

Evo 2 designs 16 working phages, one 65× fitter than wild-type

Source: ars-technica-ai · published 2026-08-06

TL;DR

• Evo-Φ69 replicated 65× faster than wild-type phiX174, the standout among 16 viable AI-designed phages.
• A cocktail of Evo 2 designs killed E. coli strains already resistant to the parent phage.
• phiX174 is the smallest genome anyone synthesizes (~5,400 bp), so this is proof of principle, not bacterial scale.
• A non-expert used Claude Code to fine-tune open-weight Evo 2 on 110 human-virus sequences, defeating Arc’s pretraining safeguard.

What actually happened at the bench

Arc Institute’s Evo 2 genome language model generated 302 candidate variants of the bacteriophage phiX174. Sixteen were fully functional viruses after synthesis and testing, and one design — Evo-Φ69 — replicated roughly 65× faster than wild-type phiX174. A cocktail assembled from the AI-designed variants overcame E. coli strains that had evolved resistance to the natural phage ¹. That last result is the one clinicians care about: phage therapy fails when bacteria evolve around a fixed virus, and McMaster’s Jonathan Stokes frames AI design as a way to keep a “pipeline of cheap pivots” ahead of resistance ².

The “easy mode” caveat bench scientists keep making

The most consistent pushback isn’t about biosecurity — it’s about scale. Imperial’s Tom Ellis called phiX174 “the smallest and easiest genome to design and make,” about 5,400 letters of code against the hundreds of thousands needed for even a minimal cell ³. Evo 2 automated a task synthetic biologists could already do by hand; it hasn’t shown it can compose bacteria-scale or eukaryotic genomes.

The benchmark picture reinforces the narrower reading. On a head-to-head evaluation, Evo 2 leads on zero-shot and long-context prokaryotic tasks but is outperformed by supervised models like DeepMind’s AlphaGenome and APOGEE2 on human gene essentiality and non-coding variant effect prediction ⁴. It’s a strong prokaryotic long-context generator, not a universal genome model.

The biosecurity story the announcement underplays

Arc excluded eukaryotic pathogens from Evo 2’s pretraining as a safety measure. A GovAI case study documents that a non-expert used Claude Code as an agentic wrapper to fine-tune the open-weight model on 110 human-infecting virus sequences in a single weekend — recovering the capabilities the developers had tried to withhold ⁵.

flowchart LR
    A[Open-weight Evo 2] --> B[Claude Code agent]
    C[110 human virus sequences] --> B
    B --> D[Fine-tuned model with<br/>eukaryotic pathogen capability]
    E[Arc's pretraining exclusion] -. bypassed .-> D

That reframes the choke point. Model-level filtering fails once weights ship; the remaining control surface is mandatory DNA synthesis screening at the vendor step. Johns Hopkins’ Tom Inglesby and colleagues made the point flatly in Science: “The ability to compose viral genomes using generative AI now exists; the governance to safely steer it does not.” ⁶

What’s at stake

Two things are true at once. Evo 2 delivered a real, quantified capability — programmable phage design with fitness gains that could plausibly feed a clinical pipeline for drug-resistant infections. And the same open-weight release, once agentic coding tools are in the loop, has already broken the developers’ stated safety story on a harder class of pathogen. The interesting policy question isn’t whether to allow genome models. It’s whether synthesis screening scales fast enough to be the last line that holds.

---

Cloudflare open-sources VibeSDK with per-app sandboxes

Source: ars-technica-ai · published 2026-08-06

TL;DR

• Cloudflare open-sourced VibeSDK, the internal agent workspace it uses to let non-engineers ship apps on Workers, D1, and R2.
• Self-hosters can run the stack for ~$30/month plus LLM tokens, versus hundreds per seat on Replit, Bolt, and v0.
• Sandstorm-derived “Gadget” isolates give every generated app its own sandbox and keep raw API credentials out of AI-written code.
• Independent scans put OWASP Top-10 bugs in ~45% of AI-generated code — a risk VibeSDK’s sandbox doesn’t address.
• Cloudflare’s own “Matrix on Workers” showcase and first-run hello-world deploys are already drawing “slop” complaints on HN and GitHub.

The pitch: undercut per-seat SaaS builders

VibeSDK is Cloudflare’s answer to Replit, Bolt, Lovable, and v0 — but shipped as an Apache-licensed repo you deploy onto your own Cloudflare account instead of a hosted product. Independent reviewers estimate operators can run the whole stack for roughly $30/month in infrastructure plus whatever the LLM burns, against hundreds per seat on the incumbents ⁷. That is a real wedge for agencies and internal platform teams who were already paying Cloudflare for edge compute.

The catch is portability. VibeSDK is deeply wired into Cloudflare primitives — Durable Objects for state, D1 for per-app SQLite, R2 for storage, Workers AI Gateway for model routing. You are trading Replit lock-in for Workers lock-in. And head-to-head benchmarks still put v0 and Lovable ahead on UI fidelity and Replit closest to production-ready backends; none of the four clear the bar for complex apps without human review ⁸. VibeSDK inherits that ceiling.

What’s actually new: Sandstorm, resurrected

The technically interesting part, largely buried in the launch coverage, is the isolation model. It traces to Kenton Varda’s Sandstorm.io: every generated app runs as its own “Gadget” isolate with a private SQLite, and a “Gatekeeper” pattern mediates all external API calls so AI-generated code never holds raw credentials ⁹.

flowchart LR
    U[Non-coder prompt] --> A{VibeSDK agent}
    A -->|generates| G1[Gadget isolate<br/>own SQLite]
    A -->|generates| G2[Gadget isolate<br/>own SQLite]
    G1 --> GK{Gatekeeper}
    G2 --> GK
    GK -->|scoped tokens| EXT[Stripe / GitHub / etc.]
    style GK fill:#fde68a

That is a materially stricter posture than Replit’s shared-container default. It is also what makes the “let marketers ship apps” pitch survivable in an enterprise security review — the blast radius of a compromised generated app stops at its own grain.

The reception: buggy showcases, risky audience

Practitioner reception is noticeably cooler than the announcement suggests. Hacker News threads have pilloried Cloudflare’s own “Matrix on Workers” showcase as “vibe coded garbage,” pointing to dead thread-safety boilerplate that does nothing in a serverless runtime and misaligned ASCII diagrams left in the docs ¹⁰. The vibesdk issue tracker corroborates the rough edges: hello-world apps failing at preview or deploy, sign-in flows hanging locally, missing AI-gateway token permissions, and an agent that regresses by reintroducing code the user just deleted ¹¹. These are first-run bugs, not corner cases.

The bigger problem is the audience. A 2026 Red Access survey found more than 5,000 vibe-coded apps already running inside enterprises, 40% of them missing basic security controls, and scans put OWASP Top-10 vulnerability rates in AI-generated code at roughly 45% ¹².

VibeSDK’s sandbox protects the host from the code. It does nothing about the vulnerabilities inside the code — which non-coder authors are least equipped to spot.

Takeaway

VibeSDK is a genuinely interesting infrastructure drop: credible cost story, real security engineering under the hood, and an open-source license that lets platform teams stop paying per seat. The “for people who aren’t coders” framing is where the dissent is landing — and where Cloudflare will have to decide whether to add code-scanning defaults before the 45% number becomes its problem.

---

Datasette patches cross-table SQL injection in 1.0a38 and 0.65.3

Source: simon-willison · published 2026-08-06

TL;DR

• Datasette 1.0a38 fixes a SQL injection letting any public-table user read private tables in the same database.
• Willison ships a 0.65.3 backport so stable-branch operators get the patch without moving to the 1.0 alpha.
• The bug lives in the permissions-as-SQL rewrite (~10,000 lines, heavily Claude-assisted) introduced in 1.0a20.
• Blast radius is narrow — the vulnerable mixed public/private single-database setup is “likely to be rare” per Willison.

What the bug actually does

The flaw is a permission-bypass through raw SQL. On a Datasette instance where one SQLite database holds both public and private tables — with execute-sql gated by the built-in permissions system — a user granted access to any public table could smuggle queries that read from the private ones sharing the file ¹³. The data stays read-only (Datasette has no write path here), but “read-only” over a private table is still the whole ballgame if that table holds customer records or unpublished reporting.

The interim mitigation, for anyone who cannot upgrade immediately, is to disable the execute-sql permission on the affected database entirely ¹³. That is defense-in-depth, not a fix — the correct move is to jump to 1.0a38 on the alpha channel or 0.65.3 on stable.

The dual release is the operationally interesting bit. Datasette’s 1.0 line has been in alpha for years, and a meaningful chunk of production users have stayed on 0.x precisely to avoid alpha churn. Backporting to 0.65.3 ¹⁴ means those users are not forced to choose between a security patch and a stability regression — a small piece of maintainer discipline that many single-maintainer OSS projects skip.

The pattern this fits into

This is the second identifier/permission-adjacent SQL injection class fix in the 1.0 alpha cycle. Version 1.0a33 patched a bracket-escaping bug in escape_sqlite() for identifiers; 1.0a38 fixes a distinct logical flaw in how permissions gate raw SQL when public and private tables coexist ¹⁵. Further back, CVE-2023-40570 leaked private database and table names — though not contents — via the API explorer ¹⁶. The through-line: Datasette’s read-only posture keeps classic write-path injection risk low, but the permission layer itself keeps being the soft spot.

That is worth pausing on given where the 1.0 rewrite came from. The alpha series moved permission checks into SQL executed inside SQLite — roughly 10,000 lines of new code that Willison has publicly described as heavily assisted by Claude Code ¹⁷. The architectural bet buys performance and expressiveness, but it also enlarges the surface where a permission predicate and a user-influenced query share an execution context. The 1.0a38 bug sits squarely in that seam.

It is a fair question whether AI-scaffolded permission logic is receiving enough adversarial review ¹⁷.

No independent audit is cited, and no CVE/GHSA identifier or third-party writeup has surfaced yet — the disclosure conversation so far is a monologue from the maintainer ¹⁸. Treat the AI-assisted-code angle as an open critique, not a verdict.

Takeaway

If you run Datasette with execute-sql enabled anywhere near private tables, upgrade today; if you cannot, kill execute-sql on those databases now. And if you are watching Datasette as a case study in AI-assisted refactors of security-sensitive code, log this one — it is the kind of seam-bug the pattern predicts, caught by the maintainer rather than by an attacker, this time.

Further reading

• datasette 0.65.3 — simon-willison

Round-ups

Baseten joins Hugging Face as an inference provider

Source: huggingface-blog

Hugging Face has added Baseten to its Inference Providers lineup, letting developers route model calls through Baseten’s serving stack directly from the Hub. The integration expands the roster of third-party GPU backends users can pick without leaving Hugging Face’s model pages.

AI moderation alone can’t shield social platforms from AI abuse

Source: ars-technica-ai

Automated tools are failing to keep pace with AI-generated spam and impersonation flooding Discord, Reddit, and Facebook communities, Ars argues. Human moderators remain essential because context, intent, and community norms still exceed what current classifiers reliably catch at scale.

Hank Green flags AI video problem YouTube’s labels miss

Source: ars-technica-ai

Creator Hank Green identified a category of AI-assisted video that slips past YouTube’s disclosure labels, going beyond the obvious ‘slop’ problem. The gap involves partially synthetic content where labeling rules don’t clearly apply, leaving viewers without cues about what they’re watching.

Simon Willison’s top blogging tip: lower your standards

Source: simon-willison

In a resurfaced ‘Write that blog!’ interview with Cynthia Dunlop, Willison urges writers to hit publish while still unhappy with a draft. The alternative, he warns, is a folder of unpublished drafts, since readers never see the flaws authors fixate on.

Footnotes

1. Asimov Press — technical write-up of the phiX174 experiment — https://www.asimov.press/p/ai-phages

   Of 302 designs synthesized and tested, 16 were fully functional; one variant (Evo-Φ69) replicated 65-fold faster than wild-type and a cocktail overcame E. coli strains resistant to natural phiX174.

   ↩

2. Science Media Centre — Dr. Jonathan Stokes (McMaster) via ABC Nepal syndication — https://abcnepal.tv/posts/315629

   Because bacteria evolve resistance quickly, a timer starts the moment a treatment is deployed; AI-designed phages could allow a robust pipeline of cheap pivots to new genomic recipes.

   ↩

3. Science Media Centre — Prof. Tom Ellis (Imperial College) — https://www.sciencemediacentre.org/expert-reaction-to-generative-design-of-bacteriophages-with-genome-language-models/

   This is the smallest and easiest genome to design and make… about 5,400 letters of code, whereas most cells require hundreds of thousands of base pairs.

   ↩

4. SciRouter benchmark comparison (Evo 2 vs AlphaGenome vs DNABERT) — https://scirouter.ai/blog/evo-2-vs-alphagenome-vs-dnabert-variant-effect/

   Evo 2 leads in zero-shot and long-context tasks, but is outperformed on human gene essentiality and non-coding regulatory variant prediction by supervised models like APOGEE2 and DeepMind’s AlphaGenome.

   ↩

5. GovAI / OpenReview — ‘Coding Agents Are Changing the Biosecurity Risk Landscape’ — https://openreview.net/pdf?id=bKLp7oaU1L

   A non-expert used Claude Code to fine-tune Evo 2 on 110 human-infecting virus sequences in a single weekend, effectively rescuing capabilities the developers had tried to withhold by excluding eukaryotic pathogens from pretraining.

   ↩

6. The Guardian — Inglesby & Hanke (Johns Hopkins Center for Health Security), Science commentary — https://www.theguardian.com/science/2026/aug/06/safety-fears-as-scientists-make-first-viruses-designed-by-ai

   The ability to compose viral genomes using generative AI now exists; the governance to safely steer it does not.

   ↩

7. vibecoding.app review — https://vibecoding.app/blog/vibesdk-review

   While proprietary competitors may charge hundreds of dollars per seat, VibeSDK users only pay for underlying infrastructure and LLM API usage, which experts estimate can drop costs to roughly $30 per month.

   ↩

8. avery.dev comparison (Lovable vs Bolt vs v0 vs Replit) — https://avery.dev/blogs/ai-coding-tools-2026-lovable-vs-bolt-vs-v0-vs-replit

   In Figma-to-code fidelity tests, v0 and Lovable typically lead in UI quality, while Replit and Bolt are more capable of scaffolding functional backend logic… none of these platforms are yet 100% production-ready for complex applications.

   ↩

9. HN comment (Kenton Varda thread) — https://news.ycombinator.com/item?id=49182996

   Cloudflare’s ‘Sandstorm’ security model, repurposed from Kenton Varda’s earlier startup… uses fine-grained ‘Gadget’ isolates—individual sandboxes for every app instance—which theoretically prevents AI-generated code from introducing systemic security vulnerabilities.

   ↩

10. Hacker News discussion — https://news.ycombinator.com/item?id=47664912

    Critics on Hacker News point to a controversial ‘Matrix on Cloudflare Workers’ implementation as a primary example of ‘vibe coded garbage’… thread-safety boilerplate that was non-functional in a serverless environment, and even cosmetic issues like misaligned ASCII diagrams in the documentation.

    ↩

11. cloudflare/vibesdk GitHub issues — https://github.com/cloudflare/vibesdk

    Even basic ‘hello-world’ applications often fail during the preview or deployment stages… frontend may fail to receive responses for API requests during sign-in or sign-up, effectively blocking local testing… agent reintroduces features or code segments that were previously removed.

    ↩

12. Tanium / Red Access security report — https://www.tanium.com/blog/what-is-vibe-coding

    A 2026 report by Red Access identified over 5,000 vibe-coded apps in corporate environments, with 40% lacking basic security controls… 45% of AI-generated code samples contained OWASP Top-10 vulnerabilities.

    ↩

13. Simon Willison — 1.0a38 advisory (mitigation guidance) — https://simonwillison.net/2026/Aug/6/datasette/

    Site administrators who serve private tables in this way are advised to disable the execute-sql permission on that database to prevent users from accessing private tables using raw SQL queries.

    ↩ ↩²

14. Simon Willison — 0.65.3 backport rationale — https://simonwillison.net/2026/Aug/6/datasette/

    Datasette 0.65.3 serves as a bridge for the stable 0.x series, which continues to receive security support while the 1.0 series remains in alpha… ensures that the ‘stable’ user base is protected without requiring them to upgrade to the potentially breaking changes found in the 1.0 alpha branch.

    ↩

15. simonwillison.net /tags/sql-injection (prior 1.0a33 bracket-escaping fix) — https://simonwillison.net/tags/sql-injection/

    Earlier bugs involved improper sanitization of identifiers (table and column names) containing ’]’ characters… the 1.0a38 fix addresses a deeper logical flaw in how permissions are applied when raw SQL is used to bridge access between public and private resources.

    ↩

16. simonwillison.net /tags/sql-injection (CVE-2023-40570 historical context) — https://simonwillison.net/tags/sql-injection/

    CVE-2023-40570, a low-severity issue where the API explorer leaked the names of private databases and tables to unauthenticated users, though it did not expose their contents.

    ↩

17. Simon Willison — permissions-as-SQL architecture (1.0a20 background) — https://simonwillison.net/2026/Aug/6/datasette/

    The vulnerability emerged shortly after the introduction of a major architectural shift in Datasette 1.0a20, which migrated permission logic to run directly as SQL in SQLite… comprising over 10,000 lines of new code… largely managed with the help of AI coding agents like Claude Code.

    ↩ ↩²

18. Simon Willison — datasette 1.0a38 release note — https://simonwillison.net/2026/Aug/6/datasette/

    Thankfully this particular configuration - private tables and public tables exposed for the same database within the same instance - is likely to be rare. I’ve not encountered an instance like that myself.

    ↩