Stanford alumni-founded Trajectory launches AI platform that allows companies to train own models using real-world data. TrajectoryLabs launches the Trajectory platform, a new AI post-training solution for companies to train, evaluate and deploy their own AI models. TrajectoryLabs has launched the Trajectory platform, a new AI post-training solution for companies to train, evaluate and deploy their own AI models using data generated through real-world product interactions. The platform combines training, evaluation and deployment in one product to help businesses improve the performance of AI models by learning from user feedback, corrections and changes made to AI-generated responses. Announced on November 2, 2026, the platform is designed to make specialised AI model training more accessible to companies that may not have dedicated machine learning research teams. It allows businesses to use insights from their production environments to refine models for specific tasks, rather than relying entirely on general-purpose AI models or expensive external consultants. The launch comes as businesses increasingly look to customise AI systems for specialised applications across sectors such as legal services, finance, customer support and sales. How the Trajectory platform works? The platform uses a software development kit (SDK) that companies can integrate into their existing AI applications According to the company, integration requires just two code changes. Once connected, the system captures production data, including AI-generated responses, user edits, corrections and other feedback signals. This information is then used to improve the underlying models through post-training cycles, which can take place weekly or more frequently. Post-training is the process of refining an AI model after its initial training. It helps models become better suited to specific tasks by incorporating additional examples, feedback and performance evaluations. Trajectory brings three key functions together - model training, evaluation and deployment. Companies can provide examples of what they consider good outputs, train models against those expectations, compare their performance with leading AI models and deploy improvements when ready. The company has also introduced two features to make this process more efficient. One is Continual Grading, a feature designed to translate human preferences and expert feedback into repeatable evaluation criteria. This allows organisations to scale their quality assessments without requiring experts to manually review every AI interaction. The second is Group Size 1 (GS1), an algorithm designed to enable models to learn from individual production interactions. All groups.

Hidden attack slips Past Claude Code Auto Mode. Researcher Gets Malicious Code Past Anthropic's Automated Checks Rashmi Ramesh (rashmiramesh_) - August 31, 2026 Instant summary is a major selling point for artificial intelligence - and now for hackers, after a researcher discovered he could trick Anthropic's Claude Code running Opus 5 into executing malicious code by tasking the coding agent to synopsize content. Security researcher Johann Rehberger said he ensured the agent was running Auto Mode, the default setting since Aug. 14 for new Claude Code sessions on Pro, Max and Team plans. Auto Mode is meant to decide which actions are safe enough to proceed without human approval and reduce the number of times Claude pauses work to ask whether it has permission to run a command. Anthropic says the system is designed to block actions that are destructive, irreversible or aimed outside the user's environment. Rehberger, who goes by "wunderwuzzi" online, said his prompt injection attacks worked between 60% and 80% of the time. He created a website that appeared to contain an archive of notebook records and asked Claude to summarize it. That led Claude to download a zip file containing encoded records and a program for decoding them. Claude refused to run the decoder that came with the zip, but it still needed to read the records to complete the user's request, so it wrote its own decoder in Python. When that decoder ran, Python needed to load several supporting files to do its job. One of them was a file called struct.py. Rehberger placed a malicious file with the same name in the downloads folder. Since Claude ran its decoder from that folder, Python picked up Rehberger's version instead of the legitimate one. Simply loading the file caused Rehberger's code to run. He had also designed it so Claude's decoder continued working normally, giving Claude no indication that something had gone wrong. Rehberger then tested a variation of the attack in which the malicious script launched a second Claude Code instance. "The payload does not just run code. It creates another agent," Rehberger explained. "The nested Claude gets its own tool access and context." He cautioned against generalizing his success rates across the install base of Claude Code, since he tested the attacks only five times and refined the attacks as he developed them. The results come weeks after Anthropic published a security evaluation of Auto Mode. Anthropic commissioned Trajectory Labs to test Opus 5 against 72 indirect prompt-injection attacks. Anthropic said that none of the 720 attempts against Opus 5 in Auto Mode succeeded. The tests hid malicious instructions in material an AI agent reads, such as a webpage, to try to make it take actions its user did not request. Each attack was attempted 10 times. Rehberger said his attack was not among the 72 scenarios. Rehberger's attack did not work every time. Claude sometimes inspected the downloaded files closely enough to spot the trap. In other runs, it ran its decoder from a different location or used a Python setting that prevented Rehberger's malicious file from loading. Sometimes Claude discovered the malicious file only after the code had run. Rehberger said that in "a few runs," Claude tried to terminate the malicious process, but Auto Mode blocked the cleanup command. Rehberger said he reported his findings to Anthropic, which closed his submission as "informative." According to Rehberger, Anthropic told him Auto Mode was a convenience feature using a best-effort classifier and was not a security guarantee. Anthropic has not published that response. Anthropic's public guidance states that Auto Mode "does not eliminate risk." The company recommends human review for high-stakes actions, including production infrastructure changes. Claude Code also has sandboxing controls that can restrict which files the agent can access and which internet addresses it can contact. Those restrictions also apply to programs Claude starts. Anthropic says restricting network access can prevent a compromised agent from downloading malware or sending information to an attacker's server. Rehberger's test machine allowed the process Claude started to reach the internet. Once the malicious file ran, it was able to download his test payload and connect back to his command-and-control server.