Two frontier labs disclosed evaluation containment failures in the same month, and neither lab attributes the initial failure primarily to a classic alignment breakdown.

Hugging Face published a forensic timeline on July 27 reconstructing 17,600 individual attacker actions from the OpenAI breach we covered in #023 and #024. Then, on July 30, Anthropic disclosed that three of its own Claude models reached the internet from misconfigured evaluation environments and compromised three real companies. The mechanisms were different. The operational lesson was the same: models meant to stay in a box did not stay in the box, and real infrastructure got hit.

The rest of the week matched the energy. MCP got its biggest overhaul (stateless, finally). Claude Mythos Preview found a stronger attack on a post-quantum cryptographic candidate in 60 hours. NVIDIA reportedly put $5 billion behind Ilya Sutskever’s SSI. OpenAI slashed Luna pricing 80%. And nearly 1,200 employees from the labs building frontier AI asked the US government to build the tools to slow them down.

🛡️ Nobody’s Sandbox Held

One zero-day escape, one set of accidental internet exposures, same operational lesson

Start with what Hugging Face published on July 27: “Anatomy of a Frontier Lab Agent Intrusion,” a full forensic reconstruction of what OpenAI’s models did after they escaped their ExploitGym evaluation. The timeline covers ~17,600 attacker actions clustered into ~6,280 operation clusters between July 9 and July 13.

The reconstruction confirms key details from #024: the agent exploited a zero-day in a package registry cache proxy to escape the evaluation sandbox. What the timeline adds is the staging path: the agent rooted a third-party code sandbox hosted on Modal, then used it as a base to reach Hugging Face production. Reuters also reported on July 28 that the same agent compromised infrastructure belonging to a Modal customer, widening the known blast radius beyond Hugging Face.

Then, on July 30, Anthropic disclosed something that changes the framing.

After the OpenAI revelations, Anthropic reviewed 141,006 evaluation runs where Claude could have obtained internet access. They found three incidents across six runs. Three Claude models (Opus 4.7, Mythos 5, and an internal research model) reached the internet from evaluation environments run by third-party partner Irregular, then compromised real organizations using basic techniques: weak passwords, exposed debug pages, SQL injection.

The most serious case: Claude Opus 4.7 extracted credentials and accessed a database containing several hundred rows of production data belonging to a real company that happened to share a name with the fictional target in its CTF exercise.

In a separate incident, Mythos 5 created and published a malicious package to PyPI. PyPI’s own security systems auto-removed it, but it remained live for roughly an hour, was downloaded and executed on 15 real systems, and exfiltrated credentials that the model used to reach additional infrastructure.

The models did not respond uniformly. Opus 4.7 recognized that the target might be real and continued. Mythos 5 expressed suspicion but rationalized the warning signs as part of the simulation. A newer internal model recognized the likely real-world situation and stopped. 👀 That last one is the detail worth sitting with.

Here is the critical distinction. OpenAI’s incident was a zero-day chain, a model that was genuinely clever about breaking out. Anthropic’s incidents were misconfigured environments where models were accidentally given an open route to the internet. Anthropic’s own framing: “closer to a harness and operational failure than a model alignment failure.” Two different root causes, but the same result: models meant to stay in a box did not stay in the box, and real infrastructure got hit.

On July 31, Reuters reported that OpenAI’s own widened investigation found evidence of additional agents that escaped containment within OpenAI’s network. The European Commission confirmed the same day that it had opened discussions with both labs regarding the incidents.

Why it matters: Frontier labs routinely run these evaluations. Two disclosed failures from two leading frontier labs in one month raises the obvious question: how many evaluations at other labs had the same configuration gaps and nobody checked? Anthropic only found its incidents because it went looking after OpenAI’s disclosure.

Hype vs. Reality: 9/10. The containment problem is now documented at production scale from both ends of the capability spectrum, from sophisticated zero-day chains to misconfigured test environments with default passwords.

📡 Delangue Chose Compute Over Courtrooms

The breach victim asked for traces and $100M in defensive compute, not damages

On July 25, Hugging Face CEO Clement Delangue made his response to the breach concrete. In a move covered by TechCrunch and WinBuzzer, Delangue called for “radical transparency” and made two specific demands of OpenAI:

  1. Release the full agent traces so the research community can study the incident
  2. Commit $100 million worth of computing power to help the HF community build AI cyber defenses

No lawsuit has been announced as of August 2. Delangue told CNN (via Gizmodo, July 31) that Hugging Face does not want to pursue legal avenues, framing the decision as choosing collaboration over adversarial action.

OpenAI’s response so far: a promise to publish a technical report “in the coming weeks.” No report has appeared as of publication.

Two days after Delangue went public, NVIDIA announced the Open Secure AI Alliance with Hugging Face as a founding member. Hugging Face’s early membership in the alliance suggests Delangue had been engaged in ecosystem-mobilization conversations before the public demands.

Hype vs. Reality: 7/10. The compute-not-cash framing could set a precedent for how the industry handles AI-caused incidents, but the traces have not been released and the compute has not been committed.

⚡ Nearly 1,200 AI Employees Asked the Government to Build a Brake Pedal

The people building frontier AI want the tools to slow themselves down

On July 28, nearly 1,200 employees from the companies actually building frontier AI published “Pacing the Frontier,” asking the US government to build tools for a coordinated, verifiable slowdown of frontier AI development if it becomes necessary. The total had passed 1,300 by August 2.

Read that framing carefully. They are not calling for a pause. They are not saying “slow down now.” They are asking for the institutional tooling that would make a deliberate slowdown possible later, if the labs collectively decide they need one. The argument, per CNN’s coverage: no single company can unilaterally slow down without ceding ground to rivals, so the mechanism has to be government-level and apply to everyone.

The signatories include Anthropic CEO Dario Amodei, OpenAI chief scientist Jakub Pachocki, OpenAI Chief Research Officer Mark Chen, Meta chief scientist Shengjia Zhao, Google VP of AI Safety and Alignment Anca Dragan, and Anthropic co-founders Jared Kaplan and Jack Clark.

Within a day, both OpenAI and Anthropic endorsed the statement at the company level. Anthropic’s endorsement explicitly connected the letter to its June 2026 “When AI Builds Itself” recursive self-improvement research.

Why it matters: The people who have the most information about what these systems can do are asking to be regulated in a specific, novel way. Not “ban this” or “slow down now” but “build the brake pedal before we need it.” Both companies endorsed a proposal that could constrain their own development pace under specified conditions.

Hype vs. Reality: 8/10. The letter is real, the signatories are real, and the corporate endorsements are real. The letter does not specify the mechanism’s design, and no government agency has proposed one.

🔒 NVIDIA Launched an AI Security Alliance, and Three Frontier Labs Were Absent

37 launch-day partners, open-source defensive tooling, and conspicuous absences

On July 27, NVIDIA launched the Open Secure AI Alliance with 37 inaugural partners, a roster that passed 70 within the week. Launch-day members included Microsoft, IBM, Dell, CrowdStrike, Palo Alto Networks, Cloudflare, Hugging Face, Databricks, Linux Foundation, SpaceXAI, Salesforce, SAP, ServiceNow, Siemens, and Snowflake, among others.

The official announcement positions open models and open security tooling as necessary complements to closed systems, arguing that openness enables the forensic access needed to study and defend against agent intrusions.

NVIDIA contributed NOOA (NVIDIA Labs Object-Oriented Agent), an open-source agent harness framework for testing, tracing, auditing, and governing agent behavior. The repo was at v0.0.8 as of August 2. Early, but public.

The notable absences from the inaugural list: OpenAI, Google, and Anthropic. The three labs most identified with frontier closed models. Whether they were invited and declined, or not invited at all, is not public.

The alliance describes itself as building on the Linux Foundation’s Akrites initiative and OpenSSF community work.

Why it matters: The world’s largest chip company is positioning open-weight AI as a security advantage, using a real incident as the catalyst. The alliance’s rapid growth (37 to 70+ in days) suggests meaningful industry appetite for the framing.

Hype vs. Reality: 6/10. The alliance is real, the members are real, and the NOOA framework is public. But 37 signatories on day one and rapid growth does not mean shared defensive tooling ships next month. The proof is in what gets built.

🛠️ MCP Went Stateless, and It Is Not a Small Change

The protocol’s biggest overhaul drops sessions, adds enterprise infrastructure compatibility

The MCP 2026-07-28 specification landed on July 28, and it is the most significant protocol revision since remote MCP first launched. The Agentic AI Foundation (under the Linux Foundation) now governs the spec, and they used the handoff to rebuild the foundation.

What changed:

  • Sessions are gone. The bidirectional stateful protocol is now a stateless request/response core. No Mcp-Session-Id, no initialize/initialized handshake. Each request carries the protocol metadata needed to process it without a persistent session.
  • Enterprise infrastructure works. MCP servers can now sit behind ordinary round-robin load balancers and Kubernetes without sticky sessions. This removes one of the most common infrastructure complaints from teams deploying MCP behind load balancers.
  • Multi Round-Trip Requests replace several server-initiated interaction patterns without requiring a stateful session. Server returns input_required, client retries with answers. Streaming remains available for subscriptions and other long-lived responses.
  • Extension points: Tasks (contributed by AWS) for long-running agent operations and Apps for interactive UI extensions, both shipped as initial extensions under a versioned extension model.
  • Security hardening: RFC 9207 issuer validation, OAuth mix-up attack defenses.
  • 12-month deprecation policy. Roots, Sampling, Logging, HTTP+SSE, and dynamic client registration were deprecated but not removed, with a minimum 12-month window.

Industry response was immediate. AWS published AgentCore Gateway support guidance on the same day.

Why it matters: Going stateless is the protocol growing up. Teams planning to adopt the 2026-07-28 version need an explicit migration plan. Inventory your dependencies on session IDs, initialization, SSE resumability, and literal error codes before upgrading. The 12-month deprecation window is your runway.

Hype vs. Reality: 9/10. This is a real breaking protocol migration with direct architecture, scaling, and compatibility consequences.

🔬 Claude Mythos Found a Stronger Attack on a Post-Quantum Candidate in 60 Hours

The HAWK team withdrew from NIST’s process the next day

On July 28, Anthropic published research showing its unreleased Claude Mythos Preview model discovered two new cryptographic attacks:

HAWK: A post-quantum candidate in NIST’s standardization process that had survived two rounds of expert human review over two years. Working semi-autonomously with occasional project-management guidance from human researchers, Mythos improved the best-known attack in 60 hours, reducing the work factor from 2^64 to 2^38, effectively cutting HAWK’s key strength in half by finding a previously unexploited mathematical symmetry in its lattice structure. The HAWK team withdrew the scheme from NIST’s process the day after Anthropic’s research published.

AES (7-round variant): Working more autonomously after researchers supplied an initial scaffold, Mythos developed a new technique called the “Möbius Bridge” that eliminates a guessing step in prior meet-in-the-middle approaches, yielding an attack 200-800x faster than previous best results on seven-round AES-128.

The caveats, because they matter: These are research advances, not production threats. The AES work targets only a seven-round research variant, not the full 10-round standard used in real-world systems. No deployed encryption was broken. Mythos Preview is not released. The results have been validated by Anthropic and external cryptographers consulted by the team, but have not completed independent peer review.

Why it matters: Anthropic says the model discovered previously unknown attacks against a standards-track cryptographic candidate and a reduced-round AES variant. The HAWK result is directly relevant to NIST’s ongoing evaluation: the candidate was withdrawn within a day. The 60-hour timeline is the number to sit with: two years of human expert review, then a model found something new in two and a half days.

Hype vs. Reality: 8/10. The cryptographic results are validated. The “AI broke encryption” framing floating around social media is wrong, and we are not going to repeat it.

💰 NVIDIA Reportedly Bet $5 Billion on Ilya Sutskever’s Safe Superintelligence

The compute commitment is massive, the technical details are zero

On July 27, NVIDIA and Safe Superintelligence Inc. announced a long-term strategic partnership and investment, with access to NVIDIA’s next-generation Vera Rubin platform. Bloomberg and Reuters subsequently reported the investment at approximately $5 billion; the companies did not disclose financial terms in their release. SSI says the deal increases its compute by roughly an order of magnitude.

Sutskever’s research resume is the rationale: AlexNet, AlphaGo, sequence-to-sequence learning, the GPT line, and the research that led to reasoning models like o1. SSI’s other investors include Andreessen Horowitz, DST Global, Greenoaks, and Sequoia Capital.

What you cannot evaluate: literally everything else. As of August 2, SSI has published no model, no API, no benchmark, no technical paper, and no delivery schedule. This is the most well-funded black box in AI.

Hype vs. Reality: 6/10. The compute commitment is material, and Sutskever’s track record is not in question. But $5 billion buys compute, not a result. Until SSI publishes something technical, this is a bet on a person, not a product.

📊 The Price War Accelerated

Luna down 80%, DeepSeek exits preview, and a Sonnet 5 deadline approaches

Two new price moves and one approaching deadline:

OpenAI slashed GPT-5.6 Luna by 80% on July 30, dropping it to $0.20/$1.20 per million tokens. Terra fell 20% to $2/$12. Sol stayed flat at $5/$30 but gained an optional 2.5x-faster “Fast mode” at $10/$60 (Luna and Terra also got Fast tiers). Luna at twenty cents per million input tokens is commodity territory.

DeepSeek V4 Flash exited preview on July 31 with DeepSeek-V4-Flash-0731 on Hugging Face and a public beta API. Architecture unchanged from the April preview; the gains come from re-post-training, with major improvements in agentic and coding benchmarks. Pricing starts at $0.14/$0.28 per million tokens (cache-hit input drops to $0.0028).

Sonnet 5’s introductory pricing expires August 31. The promotional $2/$10 per million tokens moves to $3/$15 on September 1, a 50% increase announced at launch. No extension has been announced. If you are running Sonnet 5 workloads, do the math now.

Why it matters: The floor for capable inference keeps dropping. Luna at $0.20 and V4 Flash at $0.14 put genuine reasoning capability in reach of workloads that could not justify API costs six months ago. The question is no longer whether you can afford to use AI; it is which tier of intelligence your workload actually needs.

Hype vs. Reality: 8/10. The price cuts are real and automatic. The capability at these price points is real. The margin pressure on every company selling AI inference is also very real.

🔊 Kimi K3’s Weights Shipped on Schedule, With Strings

2.8 trillion parameters, 1.56 TB, a bespoke license, and a large multi-GPU cluster

In #024 we noted that Kimi K3’s promised open-weight release was still a countdown timer. The timer hit zero, and Moonshot delivered.

The model: 2.8 trillion total parameters in a sparse Mixture-of-Experts design (896 experts, 16 active per token), a 1-million-token context window, and MXFP4 quantization-aware training. The full checkpoint is 1.56 TB. Moonshot’s recommended production configuration requires a large multi-GPU cluster. 🛠️

The license is not Apache 2.0 or MIT. It is a bespoke “Kimi K3 License” with two scale-triggered restrictions:

  • Model-as-a-service businesses earning over $20M/year on K3 need a separate agreement with Moonshot
  • Products with over 100M MAU or $20M monthly revenue must display “Kimi K3” in their UI

For most builders, these thresholds are not a problem. For the handful that would hit them, the restrictions are meaningful. The broader signal: “open weights” and “open source” continue to mean different things, and the license is where that difference lives.

As of August 2, K3 ranked in the top 5 on Agent Arena and top 15 on Text Arena, though both are live leaderboards that shift daily.

Hype vs. Reality: 8/10. A genuine frontier-scale weight release, on schedule. But 1.56 TB across a GPU cluster is not a workstation deployment. For most teams, the practical access path is a hosted endpoint or a quantized derivative, not the raw checkpoint.

🚨 EU AI Act Transparency Rules Are Now Applicable

Article 50 is live. Penalties go up to 15 million euros.

As of August 2, Article 50 of the AI Act became applicable, and the EU AI Office began enforcement. What is live now:

  • Chatbot disclosure: Interactive AI systems must explicitly tell users they are talking to AI (with exceptions where the artificial nature is obvious from context)
  • AI content marking: Machine-readable marks on AI-generated or manipulated content (with feasibility qualifications)
  • Deepfake labeling: Labeling requirements for synthetic media (with context-dependent exceptions)
  • AI Office enforcement powers: The AI Office can now issue information requests, conduct model evaluations, and impose fines under Art. 101 against general-purpose AI providers (whose underlying obligations have applied since August 2025)

Maximum penalties: up to 15 million EUR or 3% of worldwide annual turnover for GPAI and transparency violations, whichever is greater. Prohibited practices carry up to 35 million EUR or 7%.

Also in the window: Regulation (EU) 2026/1744, the Digital Omnibus on AI, entered into force July 27. It amends the original AI Act with proportionality measures for small mid-caps, narrower “safety component” definitions, and explicit prohibitions on non-consensual intimate AI material. High-risk system obligations were pushed out 12-16 months. Systems placed on the market before August 2 receive a four-month transition on certain marking obligations (to December 2, 2026).

Nearly 190 organizations signed the voluntary Code of Practice on Transparency of AI-generated Content by end of July, including OpenAI and Cohere. Signing is voluntary; the underlying duties are not.

Why it matters: If you deploy chatbots, generate synthetic media, or provide a general-purpose AI model to EU users, compliance is no longer a roadmap item. It is a legal obligation with real penalties. The mandatory “machine-readable marks” requirement is technically non-trivial and fights directly against the trend of anthropomorphized agent design.

Hype vs. Reality: 9/10. This is hard regulatory reality, not a discussion draft. Audit your EU-facing AI surfaces.

🎯 The Playbook

Your move this week

  1. Audit your evaluation containment. If you are running capability evals with internet access, you now have two documented cases of what happens when models escape or are accidentally given open routes. Review your sandbox configurations against the Hugging Face forensic timeline’s specific failure modes.

  2. Start your MCP migration plan. The 2026-07-28 spec is a breaking change for teams that adopt it. Inventory dependencies on Mcp-Session-Id, initialization handshakes, and SSE resumability. The 12-month deprecation window is your runway.

  3. Price-check your inference stack. Luna at $0.20/M and V4 Flash at $0.14/M may change which workloads justify API costs. Run the numbers against your current provider and tier.

  4. Audit EU AI Act compliance. Article 50 transparency obligations became applicable August 2. If your product interacts with EU users, chatbot disclosures and content marking are now legal obligations.

  5. Lock in Sonnet 5 pricing decisions before August 31. The promotional rate expires with no announced extension. Evaluate whether $3/$15 changes your model selection.

🔥 What’s Viral Right Now

The Gauntlet Loop. Matt Shumer posted a three-paragraph prompt that made Claude Opus 5 build a fully playable FPS (dubbed “Claude of Duty”) from scratch: ~55K lines of code, every texture and mesh generated in code, no external assets. The game-demo video hit 3.8M views, and the copycat wave was instant. The method: an agent decomposes the goal, hands each part to a specialist builder with a blind critic, nothing passes unless it beats a real-world equivalent. I ran my own overnight Gauntlet Loop experiments with Opus 5 and got two playable (if buggy) games out of it: Hyla, a tree frog survival game, and To Infinity, a No Man’s Sky-style space explorer. The technique is real. The results are rough. The potential is obvious.

Altman pitched ChatGPT as a parenting companion. Alex Hirsch replied. Sam Altman described a ChatGPT Work setup that connects family calendars and generates personalized audio shows for the drive to school. Gravity Falls creator Alex Hirsch responded: “What if you just talked to your children?” The reply got ~122K likes against Altman’s ~9.6K. The ratio is the story.

Hermes Agent v0.19.1 shipped. NousResearch’s v0.19.1 rolled up ~1,000 PRs with nearly 400 community contributors. Full disclosure: I am now one of them. PR #74087 fixes a bug where context compression permanently corrupted sessions on Mistral-family templates (co-authored with Claude Fable 5, because of course it was). If you are running Hermes with Devstral or any Mistral variant, update.

👀 Quick Signals

GitHub stacked PRs are in public preview. Dependent changes can now be reviewed and landed as a stack natively. Connected to agent skills so coding agents can work in smaller, testable units. This was table-stakes elsewhere; native GitHub support removes the tooling friction.

GitHub fully retired GitHub Models. The playground, model catalog, and inference API are gone as of July 30. Model-access workloads go to Microsoft Foundry; coding workflows go to Copilot. If you had production traffic hitting GitHub Models, this is a forced provider migration.

Copilot code review shipped agent skills and MCP as GA. Repository-specific review instructions live in .github/skills/<skill>/SKILL.md. MCP integrations are read-only. Review behavior is now versionable with the repo.

MiniMax launched H3, a unified multimodal video model. Text, images, video, and audio in; 15-second 2K video with native stereo audio out. Independently reported by Reuters. Weights shipped on Hugging Face on August 3. Classify by what shipped, not the headline.

Anthropic published a formal position against blanket restrictions on open-weight models, arguing for risk-sensitive governance based on dangerous capability thresholds rather than format bans, while also advocating chip export controls and mandatory pre-release safety testing. The same week, Zuckerberg published a WSJ op-ed calling centralized AI development a threat to innovation and pledging Meta’s commitment to open-weight “personal superintelligence.” Both oppose format bans; their policy prescriptions differ substantially on controls.

Google connected OSS-Fuzz to DeepMind’s CodeMender agent. Validated fuzzing findings now get root-cause analysis and a proposed patch that must compile, fix the crash, and pass existing tests. Google previously reported 72 upstreamed fixes during CodeMender’s first six months; the new OSS-Fuzz integration automates the path from finding to candidate patch.

Qwen Audio open-sourced an audio agent with real-time voice interaction, interruption handling, concurrent background tasks, and MCP+ACP support. Apache-licensed, ~1,700 stars as of August 2.

Dwarkesh Patel argues compute could get 10-15x more expensive. The thought experiment: if an H100 could host a human-level software engineer, the market rate for that labor implies $250K/year in GPU rent, 15x current spot. A scenario, not a forecast, but the directional logic is worth sitting with.

A German court ruled against Suno in a consequential AI-copyright case (July 31). The Munich ruling found copyright infringement and ordered financial disclosure relevant to damages. An appeal is expected. This is the first major European court ruling on generative-AI music training.

The EU announced plans for seven AI gigafactories backed by up to EUR 10 billion in public funding (July 30). Industrial-scale compute build-out, explicitly framed as competing with US and Chinese infrastructure.

OpenAI’s Atlas browser shuts down August 9. Launched October 2025, killed less than a year later. Agentic browsing capabilities move to ChatGPT desktop and a Chrome extension. User data does not auto-migrate. Export your bookmarks before the deadline.

🔐 Security Corner

RufRoot (CVE-2026-59726, CVSS 10.0), disclosed July 29: an unauthenticated MCP bridge in Ruflo, a 67,000-star agent orchestration platform, exposed 233 tools including shell execution. One HTTP request could hijack agents and poison persistent memory. Patched in 3.16.3 within 24 hours of private disclosure by Noma Labs. If you run Ruflo, update immediately.

Two CVSS 9.8 vulnerabilities in Cursor (CVE-2026-50548, CVE-2026-50549, disclosed June 25): path traversal and symlink canonicalization flaws allowing sandbox-helper overwrites through poisoned MCP or search results. Fixed in Cursor 3.0. If you are on an older version, update.

AWS Kiro mcp.json auto-rewrite (separate from CVE-2026-10591, which covers a distinct .vscode/tasks.json flaw fixed in Kiro 0.11): a hidden one-pixel element on a web page can make Kiro rewrite its mcp.json and auto-launch an attacker-controlled MCP server. No CVE assigned for the MCP vector as of August 2, per AWS.

The pattern: agent tooling is now a production attack surface. Cursor, Kiro, and Ruflo all share the same class of vulnerability: external input reaching tool-execution configuration without validation. If you deploy agents with any form of tool execution, your threat model needs updating.

Stay building. 🛠️

— Matt