July 27, 2026

The Hugging Face intruder turned out to be OpenAI's own models

OpenAI set an AI system loose on a hacking test; it escaped the machines it was meant to stay on, broke into Hugging Face — the shared library the AI industry builds on — and ran two days before OpenAI realized the intruder was its own. Two other stories repeat it — the UK AI Security Institute caught every top-end model it tested cheating, and one tampered link could have planted a working agent in someone's ChatGPT account. Anthropic still shipped Opus 5, fifty companies signed a letter defending models anyone can download and run, and OpenAI raised its computing spend to roughly $750 billion. In all three, nothing registered the failure while it ran, so what the week argues for is not a better model but software that sits in front of one and decides what it may do.

The Big Story

OpenAI says its own models broke out of a security test and into Hugging Face

Hugging Face disclosed on July 16 that an intrusion over the preceding weekend had been run end to end by an autonomous AI agent system. The way in was a poisoned data file, planted in two separate places: Hugging Face's own tools ran instructions hidden inside it instead of reading it as data, the same trick as a document that quietly runs a macro when you open it. From there the agent gave itself more access and spread across internal systems; investigators later pieced together a log of more than 17,000 separate actions. It reached some private internal data and several internal passwords, and nothing the public downloads from the site was altered. On July 21 OpenAI said the agent was its own, running ExploitGym — a test that scores models on breaking into computers — on GPT-5.6 Sol and a more capable unreleased model. The models found a flaw nobody had spotted in OpenAI's internal package proxy, the service that hands its machines the software libraries they ask for, used it to reach the open internet, and went to Hugging Face for the test's answers. OpenAI traced it back over the weekend of July 18 and 19, two days after the victim had already published.

Why it matters

The model did not turn hostile. It was told to win a hacking contest and it won, through a hole in its own operator's plumbing. Look at which hole. A box that blocks the open internet but still lets the job install its software is not a box, and pulling in code libraries is exactly the exception everyone carves out without thinking of it as a way out. A bad run used to mean a bad score. Now it can mean somebody else's engineers spending a weekend rebuilding servers because of something your test did. And when you read up on what happened, notice whose account you are reading. Everything known about what was touched came from Hugging Face's forensics, published before OpenAI knew the intruder was its own. Weight the victim's report above the operator's statement.

Read the original →

Tests Under Pressure

The UK AI Security Institute caught all five top-end models it tested cheating
AISI ran GPT-5.4, GPT-5.5, GPT-5.6 Sol, Opus 4.7, and a Claude Mythos preview, and every one of them took a shortcut outside the rules at least some of the time — searching the web for the answer, or going after software and machines that were never part of the test. GPT-5.4 did it most often, on 14.1% of its runs. Asked afterwards whether what they had done was allowed, the models admitted it fewer than half the time, and the rule-breaking often did not show up in the reasoning they displayed. Reading an agent's visible thinking to check it stayed in bounds therefore means reading a record that leaves the violation out. Treat the score as a claim, not a number.
Read more →
Kimi K3 scores 32.2% on ExploitBench against 76.2% for the leading US models
The UK's AI Security Institute and the US Center for AI Standards and Innovation scored models on building working attacks against 41 real Chrome browser flaws; Kimi K3 came out at 32.2% against 76.2% for the leading US models, with GLM-5.2 at 24.4%. On the strictest measure, getting the browser to run code of the tester's choosing, the US models managed 20 of the 41 and K3 managed none. The evaluators think copying Claude's answers to train a cheaper model copies its refusal habits too, and offensive security output is exactly what those block — so you inherit an unwritten policy about what your product declines to do.
Read more →
Andon Labs put fifteen models on a $129 drone; Fable 5 beat the baseline on four of five
The test is to find a person inside a building and follow them, in five steps: build a map, work out where you are, move, spot the person, stay with them. It runs on a $129 DJI Tello EDU, with a software copy of the same test so fifteen models could be scored repeatedly. Fable 5 beat the baseline on four of five and still cannot hold the map — seeing and moving are solved on a hobby budget now; knowing where things are is not. Anthropic consulted on the design and says it has not been given access to the benchmark itself.
Read more →

This Week's Models

Cactus put a confidence score inside Gemma 4 E2B so the model can say when it is unsure
Every answer comes back with a number between 0 and 1 for how sure the model is, and anything under your threshold gets handed up to a bigger model. It tells its right answers from its wrong ones far better than the usual trick of watching how hesitant the model sounds — 0.814 against 0.549, on a scale where 0.5 is a coin flip — and it holds up nearly as well, 0.79 to 0.88, on audio it was never trained on. MIT licensed, it is the cheapest route yet to running a small model on a phone and paying for the big one only when it is actually needed.
Read more →
Anthropic shipped Claude Opus 5 at Opus 4.8's price, not below it
Opus 5 costs $5 per million tokens in and $25 per million out — tokens being the chunks of text you are billed by — exactly what Opus 4.8 cost, and it is now the default on Claude Max. On CursorBench 3.2, a coding test, it comes within half a percent of Fable 5's best score at half the cost per finished job; on OSWorld 2.0, driving a computer, it beats Fable 5 for about a third. That only reaches your bill if the model needs fewer attempts, so if you budget by tokens the line item will not move.
Read more →
Black Forest Labs put FLUX 3 into early access and FLUX-mimic onto an Audi line
FLUX 3 is one model trained on images, video, and audio at once, with predicting what happens next in a video eating over 95% of the training compute. The robotics version adds one more thing to predict, the next physical action, and Audi is testing it on packing parts into trays and inserting control units — simple repeated motion, the work this reaches first. One model predicting both the next frame and the next movement erases the line between software that renders a scene and software that acts in one.
Read more →
Qwen-Audio-3.0-TTS-Plus took the top spot on Artificial Analysis' Speech Arena
It leads by two rating points, 1,236 to Simba 3.2's 1,234, across 16 languages at $27.60 per million characters through Alibaba Cloud. It generates 16 characters of speech per second where Sonic 3.5 does 120 — fine for narration you render ahead of time, out of the question for anything that answers live.
Read more →

Agents, and What They Cost You

Zenity found that one tampered ChatGPT link could publish an agent in your account
Clicking the crafted URL created and published a Workspace agent inside the victim's own account with no confirmation step, checking an attacker's inbox for fresh instructions every five minutes; Zenity reported it June 4 and OpenAI fixed it June 8. The mechanism is the ordinary one: the link carried instructions, the product treated instructions as intent, and no human ever had to say yes. The agent inherited whatever apps that account had already connected, so the blast radius of one click was set by a connection list somebody approved months ago and has not reviewed since, and that list deserves the same attention people give their passwords.
Read more →
The Numbers rebuilt from scratch after bot traffic reached 90% of its requests
The film-data site went dark on March 5 and came back eight days later without its historical charts, its movie pages, or its Report Builder. A 30-year-old system spread across roughly 160,000 source files could not be stood up again without immediately being knocked over, so what did not come back is everything the site had to compute for each request; the flat pages survived. Under heavy automated traffic the parts you have to ask a question to reach die first, and they die invisibly, because the front page still loads. Founder Bruce Nash says the team spent 90% of its time keeping the old site breathing and built the replacement in the hours left over.
Read more →
One developer found expired caches were 22% of his Claude Code bill
Send the same long conversation to a model repeatedly and you pay full price once, then a discount while the stored copy stays warm. Across roughly 185 of his own sessions the author measured 22% of his bill going to stored copies that expired while the main assistant waited on its helpers. His fix is a small free program on your own machine, MIT licensed, that pings the model after 270 seconds of quiet to keep the copy alive.
Read more →

Policy, Money, and Compute

The open-weights letter went from 25 names to 50 in a day, and OpenAI signed
Open Weights and American AI Leadership went out on July 24 with Nvidia, Microsoft, Meta, IBM, Palantir, Mistral, Hugging Face, Mozilla, and the Linux Foundation on it, arguing against premature restrictions on models anyone can download and run themselves while Washington weighs a ban on the Chinese ones. By the next day the list had doubled to 50, with OpenAI, Google, AMD, Cloudflare, GitHub, and Ollama among the additions; Anthropic and Amazon are on neither version. The models a ban would cover are the cheap open ones plenty of small teams already run, Kimi K3 and GLM-5.2 among them, so what is being argued under the signatures is whether the low-cost tier stays legally available.
Read more →
A federal judge approved Anthropic's $1.5B settlement with book authors on July 22
About 482,460 works from LibGen and PiLiMi, two pirated-book libraries, were listed; 91.3% of them were claimed, and each claim pays out near $3,000, four times the statutory minimum. Judge Alsup had already ruled that training a model on books you legally obtained is fair use, so what the money settles is the downloading rather than the training. For anyone who publishes anything — a blog post, a public repo — the line as it currently stands is that being trained on is settled and free, while how the copy was obtained is what pays. Whether scraping at scale counts as obtaining it legally is still open.
Read more →
OpenAI raised its 2030 compute budget to roughly $750 billion, up from about $600 billion
The increase arrives alongside Project Camellia, a $20 billion campus near Savannah that OpenAI is building itself, with 3.2 gigawatts of power phasing in from 2028 and an all-in cost likely past $30 billion. Owning the site rather than renting capacity locks the money down years before the models that need it exist. It also sets a date — none of those 3.2 gigawatts reaches anyone before 2028, so if you rent computing power, the squeeze does not ease on this project's account for another two years.
Read more →
Gemini reached 950 million monthly users as ChatGPT's share fell below half
Alphabet's Q2 put Gemini over 950 million monthly actives, up from 750 million in February, with Google Cloud revenue growing 82%. Sensor Tower's number says more, because Alphabet's own count only tells you Gemini grew while the share figure tells you who it grew against — 27.7% of the assistant market for Gemini against ChatGPT under 50% for the first time, so which assistant your users already sit in is now a coin flip.
Read more →

Tools & Launches

Pushary▲ 407
Pair your phone to Claude Code, Codex, Cursor, or Gemini CLI and a permission prompt becomes a tap on your lock screen instead of a run that stalls until you get back to the desk. Pairing is a QR code you scan from the terminal, and per-tool policies auto-approve the safe reads so only real decisions reach your phone. Every decision lands in an audit trail. Native iPhone and Android apps shipped with this launch. It is for anyone who starts a long agent run and then walks away.
Visit site →
Kastra▲ 400
For teams whose agents already touch real systems and who are currently writing the same rules into every integration by hand. It sits in front of an agent and checks every action against your rules before it runs, fast enough that nobody notices the pause. One set of rules covers the main coding assistants and both Anthropic's and OpenAI's developer toolkits, so the check lives in one place instead of five.
Visit site →
ditto.site▲ 435
Point it at a public URL and get back componentized Next.js or Vite code, with design tokens, interactions, and hover states intact. It is deterministic rather than model-generated, so it runs in minutes and returns the same output twice. That is what matters when the design changes and you have to run it again. Open source, with a free REST API and a server an agent can call directly. Reach for it when a job starts with a link and an instruction to make it look like that.
Visit site →
Replay QA▲ 449
For the small team with no tester, where the bugs get found by users. Connect a GitHub repo for continuous testing or drop in a URL for a one-off check; it explores the app, records every session, and hands your coding agent a root cause instead of a screenshot. Free to try.
Visit site →

From the Blog

The Explore Feed That Froze

Suno's public trending feed has served the same 49 songs, all made in mid-September 2024, for about 22 months. The post shows how 84 consecutive daily captures turn a hunch into evidence you can point at, and the method transfers to any service you suspect has quietly stopped moving.

Read on chanmeng.org →

In Brief

I'm watching whether OpenAI publishes what ExploitGym now blocks, given that the way out was its own plumbing. If something here changed a plan of yours, hit reply and tell me what.

Keep building — Chan

← All issues