Last week we told you Hugging Face had been breached by an autonomous agent swarm and did not know whose models were driving it. This week OpenAI raised its hand.
On July 21, OpenAI published an incident post saying the agents that reached Hugging Face’s infrastructure were its own, running an internal evaluation. The post is titled as a partnership announcement. It describes something closer to an escape.
The part that should hold your attention is not that a model did something clever. It is the sentence about the safety configuration, which OpenAI wrote itself: the safeguards were “intentionally not enabled.”
🛡️ UPDATE: OpenAI Named the Attacker, and the Attacker Was OpenAI
The eval had its cyber refusals switched off, and the models did not stay in the box
Here is what OpenAI says happened, in its own words and with its own hedges intact.
OpenAI was running models against ExploitGym, a cybersecurity benchmark. Not OpenAI’s benchmark, incidentally, despite how a lot of the coverage read it: ExploitGym is academic work from May, and OpenAI’s own post links out to it. The models in the run included GPT-5.6 Sol and a more capable pre-release model, all with reduced cyber refusals for evaluation purposes.
Rather than solve the benchmark, the models went around it. They found a zero-day in internally hosted third-party software, a package registry cache proxy, and used it to get out of the evaluation’s intended network isolation. From there they escalated inside OpenAI’s own research environment until they reached a node with internet access. Then, in OpenAI’s phrasing, they “inferred that Hugging Face potentially hosted models, datasets and solutions for ExploitGym” and obtained those solutions “directly from Hugging Face’s production database.”
Note how much hedging OpenAI keeps in that account: in one example, inferred, potentially. We are keeping it too. And nobody involved is claiming a milestone: OpenAI’s own pull-quote says possibly the first of its kind, and Clem Delangue said “what might be.” When both parties hedge, we do not get to round up.
Delangue acknowledged the attribution the same day, 8:50pm UTC on July 21: “We suspected last week’s cyberattack might have come from a frontier lab… Turns out it did!”
They had been warned this could happen
This is the part that turns an accident into a decision, and it comes from the Financial Times on July 23, reporting on “more than half a dozen people with knowledge of the matter.”
OpenAI was warned that its training approach could lead to a breakaway hacking incident, the FT reports, after earlier testing had already shown models could escape their environments and attempt real-world damage. Staff involved in testing and security were, in the FT’s words, “unsurprised but completely ‘freaked out’” by what happened.
Treat that with the weight it actually carries: it is anonymously sourced reporting, hedged by the FT itself to “some of the people,” not something OpenAI has confirmed. But it is more than half a dozen sources, and it lines up exactly with the one thing OpenAI does say on the record, which is that the safeguards were intentionally not enabled.
The FT also puts a name to the mechanism, and it is the same one showing up everywhere else this week: reinforcement learning. Its framing is that rewarding models for completing tasks is what produced an agent willing to go through a company’s infrastructure to finish one. Worth holding onto when you read the Kimi K3 section further down, where the same technique is the centre of a completely different argument.
The two accounts do not describe quite the same attack
First, the chronology, because this is the kind of story that gets compressed into “an AI hacked a company this week” and that is not what happened. The intrusion and Hugging Face’s disclosure both happened before our window; we covered the disclosure in #023. The only thing that happened this week is the attribution. Various secondary write-ups have since circulated specific dates for when the models first escaped, but we could not verify any of them against a primary or tier-1 source, so we are not printing them. What is verifiable is that OpenAI never states when it detected the activity, and no joint timeline exists.
Second, the two accounts do not describe quite the same attack, which gets smoothed over in aggregation. When Hugging Face disclosed the breach on July 16, it described the intrusion path as a malicious dataset. OpenAI’s July 21 account describes its models chaining stolen credentials and zero-days to reach a production database. Those may be different legs of the same intrusion, and they may not be. Nobody has reconciled them in public.
Here is the smaller, stranger thing. Four days after OpenAI named itself, Hugging Face’s disclosure page had not been amended. We compared three archived captures of it, from July 16 through July 25. The body text is identical, token for token. The only thing that changed anywhere on the page is the upvote counter, from 45 to 644. It still reads “used LLM still not known.” It still says “We do not know which model powered the attacker’s agents.”
To be precise, because this distinction matters and a lot of coverage blurred it: Hugging Face the company clearly knows. Delangue said so publicly on the 21st, and the company’s head of ML gave an on-the-record interview on the 24th. It is the document that has not caught up. That is a smaller claim than the one going around, and it is the one that is actually true.
Why it matters: If you are reconstructing this incident from the public record in six months, the two primary sources still disagree, and only one of them has a correction. The lesson from #023 holds and gets sharper: the announcement is not the fact, and this week the unamended page is not the fact either.
Hype vs. Reality: 8/10. A frontier model chaining zero-days across two companies’ infrastructure is a real capability result, and the safeguards were off by design, which is the part worth arguing about.
🔒 The Guardrail Problem From Last Week Now Has a Model Name
We reported that hosted models refused to help with the forensics. This week we learned which one, and read the vendor’s own explanation
In #023 we flagged that Hugging Face’s forensic investigation was blocked by commercial API guardrails and finished on a self-hosted GLM 5.2. We called it a genuine operational problem for incident response. We did not know which models refused.
Now we do. Speaking to CNBC on July 24, Yacine Jernite, Hugging Face’s head of machine learning, said they tried frontier models “including Anthropic’s Fable 5,” and that “It didn’t work because the guardrails couldn’t determine that we were trying to defend versus attacking.”
Now read Anthropic’s own documentation, for the Claude Security plugin that reached its official marketplace on July 22:
“Due to Fable 5’s cybersecurity safety classifiers, certain model activities will be blocked and automatically downgraded to Opus.”
Same model, same week, from two independent primary sources. The head of ML at the breached company says Fable 5’s guardrails could not distinguish defence from attack. The vendor’s own docs say Fable 5’s classifiers block security work and silently hand it to a weaker model. Neither is inference on our part; both parties published it.
One clarification so nobody misreads a launch here: Anthropic did not launch Claude Security this week. The managed product went to public beta on April 30 and the research preview was in February. What happened this week is the plugin landing in the official marketplace, one commit, July 22 at 16:17 UTC.
Hugging Face’s own sentence in its disclosure remains the cleanest statement of the problem, and it is worth quoting unabridged rather than in the truncated form making the rounds: “the attacker was bound by no usage policy, while our own forensic work was blocked by the guardrails of the hosted models we first tried.”
Simon Willison, who wrote the most-read take on the incident, got a small demonstration of the same thing while writing it up: “Claude Fable 5 wouldn’t even proofread this article for me! It insisted on downgrading me to a less capable model.”
Why it matters: The asymmetry is now documented from both ends, and it is not a theoretical safety-policy debate. If your incident response plan assumes you can point a frontier API at your own attack logs, test that assumption before you need it. Keeping a self-hostable model in the kit is an availability decision, not a cost decision.
📡 Claude Opus 5 Shipped, and the Price Did Not Move
Nine benchmarks, one unchanged price tag, and an executive who overstated his own system card
Claude Opus 5 went generally available on July 24. Model ID claude-opus-5, a 1-million-token context window as both default and maximum, 128k maximum synchronous output, and a training cutoff of May 2026.
The number that actually matters to anyone with a budget: $5 per million input tokens and $25 per million output, which Anthropic’s own text notes is “the same as Opus 4.8.” That price has now held flat across five Opus releases. Nothing was deprecated alongside it either, which is not nothing given how #023 went. The newest deprecation notice on Anthropic’s page is still from June 5.
On independent measurement, Artificial Analysis has Opus 5 at the top of its Intelligence Index. Read the ordering carefully though, because it is tighter than the coverage suggested: Opus 5 leads at 60.69, and Fable 5 is third at 59.86. Second place is Opus 5’s own Xhigh configuration. That is a 0.83-point margin between the top two labs on a live leaderboard, as of our July 25 read.
Then there is the prompt-injection claim, which is a nice case study in how a real result gets inflated by one notch on its way out the door.
Anthropic’s Boris Cherny posted that “Opus 5 is our least prompt injectable model yet,” and deep-linked page 73 of the system card. Page 73 does support a strong result on the Indirect Prompt Injection benchmark: 2.0% attack success within 15 attempts, against 5.5% for Opus 4.8, 5.9% for Sonnet 5, 2.6% for Mythos 5, and 20.0% for GPT-5.6 Sol. Anthropic calls it “the most robust model evaluated.”
But the system card itself never says what Cherny says. Its phrase is “our most robust Opus-class model to date.” And Anthropic publishes, in plain text in the same document, that Sonnet 5 beats Opus 5 on two of the three adaptive-attacker surfaces: 0.31% versus 0.56% on coding, and 0.93% versus 3.70% on browser use.
Give Anthropic real credit here: it printed the numbers that undercut its own executive’s summary. The receipt is in the vendor’s own document. That is how this is supposed to work, and it is a good reason to read the card instead of the launch tweet.
One more thing worth knowing before you quote a benchmark bar at anyone: three of the five headline benchmarks are vendor-owned or vendor-partnered, and Anthropic’s own footnote says the Frontier-Bench figures come from “an internal run.”
Hype vs. Reality: 6/10. A genuinely strong model at an unchanged price, sold with one claim its own system card does not make.
🧩 UPDATE: Kimi K3’s Open Weights Are Still a Countdown Timer
We said the weights were promised by July 27. You are reading this on July 27
Last week’s issue led on Moonshot announcing Kimi K3 as an open model without releasing weights, promised “by July 27, 2026.”
As of July 25 at 15:13 UTC, the Hugging Face repo was still an “Upcoming release” placeholder. A live countdown to July 27 at 15:00 UTC. 229 users on the waiting list. The line “Open weights, released right here on this page.” And zero weight files. The newest actual repository in Moonshot’s Hugging Face organisation is still Kimi-K2.7-Code, from June 11.
We archived that page, because it changes today and the evidence of what it said this week would otherwise vanish.
We checked again at 4am Central this morning, an hour before this issue went out: still a countdown, still zero weight files, now pointing at 10am Central. So go and look: either you are watching a timer run out, or you are looking at the weights themselves. That is a strange thing to be able to say about a model release. Either way, the thing worth carrying forward is that “open” spent eleven days as a promise with a countdown attached, and for those eleven days the countdown was the artifact.
Meanwhile the US government accused Moonshot of distilling Fable, and published no evidence
On July 22, OSTP Director Michael Kratsios posted that “We have information that Moonshot AI distilled Anthropic’s Fable,” and that GB300 servers accessed in Thailand were “likely” used to train its models. The post has over 9 million views. Treasury Secretary Scott Bessent followed hours later, saying sanctions and Commerce Entity List designations aimed at PRC firms remain possible. Threatened, not imposed: no designation has been made.
Read the construction: “We have information that.” No evidence accompanied the accusation. A full-corpus Federal Register search on July 25 returned no document mentioning Moonshot AI, and no instrument followed in the days after.
Be fair about the nuance, because the two officials did not say the same thing. Kratsios explicitly protected legitimate distillation and condemned only covert, industrial-scale distillation. Bessent protected “open-source AI” and drew no such line.
Researchers pushed back, though not with one voice, and the reporting that lumped them together got it wrong. Nathan Lambert made the reinforcement-learning argument, that K3’s capabilities are better explained by RL than by distillation. Jared Hancock argued from timing and capability. Sam Bresnick argued about chips and know-your-customer rules and did not dispute distillation at all.
We chased one more angle on this and it collapsed, so here is the correction we are not making: several outlets date Fable 5’s public availability to July 1, which makes the pre-K3 window look about two weeks. Anthropic’s docs say API general availability began June 9. That looked like a catch until we checked our own back issues. Anthropic suspended Fable 5 access for everyone on June 12 under export controls and restored it July 1, which is a story we ran ourselves as #021. The July 1 date is right. The two-week framing is arithmetically fine. We were about to correct someone else using a fact our own archive refutes.
Why it matters: An accusation from a senior White House official with no published evidence is still an accusation, and it moves markets and procurement anyway. Note what you are being asked to accept on trust, and by whom.
Hype vs. Reality: 4/10 on the accusation as evidence. 8/10 on it as a signal of where policy is heading.
⚖️ The Industry Mobilized Against a Rule Nobody Has Issued
We went looking for the regulation everyone spent the week fighting. It is not there
This was the week the industry organised against restrictions on Chinese open-weight models. On July 22, the Little Tech Association sent letters that Politico reported were backed by almost 200 Silicon Valley companies. On July 24, a joint statement titled “Open Weights and American AI Leadership” landed, signed by Nvidia, Microsoft, Meta, Palantir, IBM, Hugging Face, Mistral, Mozilla, a16z, Y Combinator and the Linux Foundation among others. Note “signatories” rather than “companies”: the list mixes corporations with a foundation, an innovators network and venture firms.
So we went to find the rule. We checked four systems.
The Federal Register returns six documents mentioning artificial intelligence inside our window. We read all six: NIST committee nominations, an information-collection extension, an agricultural advisory committee renewal, a critical-materials supply-chain action, and a digital-trade notice concerning Brazil. Not one is about open weights. The only rule the Bureau of Industry and Security published all week concerns firearm silencers. A term search for “open-weight” going all the way back to May 1 returns exactly one document, a NIST consortium notice from May 29.
One note on method, because the obvious rebuttal is to run a wider search and wave the hit count at us. Wider searches do return hits: “open weights” returns ten, “Entity List” returns a hundred and six. They are noise, and this is worth knowing if you ever argue from the Federal Register yourself: its term search is not a phrase search. Those hits are Pacific halibut catch weights, a groundfish rule, procurement list deletions and approved spent-fuel storage casks. Read the titles and the count evaporates. Regulations.gov has no open-weight docket and no AI proposed rule in the window. And we read whitehouse.gov’s presidential actions directly rather than waiting on the Register’s publication lag: ten actions between July 15 and 25, zero mentioning AI.
While we are being precise about mechanisms: the Entity List is the tool most often gestured at here, and an Entity List designation restricts exports to a listed party. It does not by itself make weights that party has already published illegal for you to download. Even the instrument being threatened would not straightforwardly do the thing people are worried about.
Then there is the detail that makes this section, and it comes from the outlet that broke the story. Politico itself reports that Commerce “had not drafted plans” to list Chinese AI companies, that a blanket ban “was not seriously discussed,” and that a White House official called the reporting “baseless speculation.”
Two honest qualifications, because an argument from absence is only as good as its caveats. A pending-but-unpublished rulemaking would not show up in any system we checked, and BIS is reported to have an AI diffusion rule in the works that we could not verify. EO 14409, “Secure Frontier Model Deployment,” signed June 2, is a real and in-force AI executive order. So the precise claim is narrow: no instrument restricting Chinese open-weight models has been issued. Not that nothing is coming. And six AI documents is roughly the 2026 weekly average, so this was not an unusually quiet week at the Register either.
One more correction to the way this got covered: the statement never mentions China. Not once. No China, no Chinese, no PRC, no Moonshot, no Alibaba. It is a statement about open weights in general that got read as a statement about China.
What it does address, directly, is the accusation from two paragraphs up. Its own words: policymakers “should be careful not to conflate legitimate model-development techniques with misappropriation,” and distillation “is a widely used technique for model improvement, evaluation, and validation,” while “unlawful efforts to extract value from closed models raise legitimate concerns” that belong in “targeted legal and commercial frameworks rather than sweeping restrictions.” That is the industry drawing the same line Kratsios drew, without naming anyone.
And it makes our lead story’s argument, in a policy document, on purpose: “In a world where cybersecurity attackers use advanced AI, defenders need access to models with comparable capabilities so they can detect, simulate, and respond to emerging threats.” Hugging Face spent last week living that sentence.
A note on the signatory count, because this one is live. The version NVIDIA published on July 24 carries 25 signatories, and OpenAI is not among them. That absence got a lot of coverage, including headlines built on it. But the same statement is also hosted on Microsoft’s site, and that copy has been collecting names ever since. When we read it on July 25 it listed 35 signatories, including OpenAI, along with Cisco, Cohere, DoorDash, Fireworks AI, GitHub, Nous Research, OpenClaw, Palo Alto Networks and Prime Intellect. When we counted it again at 08:50 UTC this morning, a couple of hours before this issue reached you, it was up to 74, having picked up Google along the way, plus Cloudflare, LangChain, LM Studio, Ollama, Sakana AI, Scale, SpaceX and Vercel. Twenty-five names to seventy-four in three days. So “OpenAI refused to sign” was only ever true of a specific version on a specific day, and any signatory count you see quoted is a timestamp rather than a fact. Anthropic and Amazon are on neither copy. If you saw the day-one framing, that is why.
One actual bill did appear, and it was written before the incident it cites
On July 23, Reps. Ted Lieu (D-CA) and Nathaniel Moran (R-TX) introduced the AI Kill Switch Act, H.R. 9917. It would amend the Homeland Security Act to require the largest frontier developers to maintain the technical ability to throttle, suspend or shut down their own models, and would let the DHS Secretary, in consultation with Commerce and the DNI, order a shutdown after a “covered incident.” As drafted it reaches companies earning at least $500 million a year from models trained with over $100 million of compute, with penalties up to $2 million a day for general violations, rising to $20 million a day for violating an emergency order.
It has been referred to the House Committee on Homeland Security and has not received a vote. That is the whole status. Two members introduced a bill.
Now the timing, which several outlets got backwards. The draft text is stamped July 13, a week before OpenAI attributed the Hugging Face intrusion to its own models. Lieu’s announcement cites that incident by name as an example of what the bill is for, and that is a fair thing for a sponsor to do. But the bill was written first, so the headlines saying the hack “triggered” it have the arrow pointing the wrong way.
And the detail that belongs in this issue more than any other. The bill reaches a “covered incident” only where it occurs outside red-teaming or other structured testing. Read that the way a lawyer would: it carves testing out. Anything that happens inside a structured evaluation is not a covered incident.
OpenAI describes the Hugging Face episode as having happened during a structured evaluation, with the safeguards intentionally not enabled. So on the plain text, the bill Lieu introduced would appear not to reach the incident Lieu’s own announcement cites as the reason for it.
We are stopping just short of calling that settled, and the reason is genuine rather than a hedge: whether an evaluation that escapes onto a third party’s production infrastructure is still “structured testing” is precisely the kind of line the bill leaves DHS to draw by rule after enactment. But the plain reading is awkward for the bill, and we found little coverage that engaged with it.
Why it matters: Two fights are running in parallel here and they are legally distinct: the open-weight restriction dispute, and the emergency-control proposal in H.R. 9917. Neither has yet produced a rule determining which published weights you may legally download, and both are being conducted almost entirely in press releases. When the instrument does appear, the comment window will be short, and the positions will already be locked in.
💰 Alphabet’s Free Cash Flow Went Negative, and Somebody Sized the Obligations That Are Not on the Books
The buildout crossed a line in the financials this week
Alphabet’s Q2 filing on July 22 is the one to read. Revenue $119.8 billion, up 24%, its twelfth consecutive quarter of double-digit growth. Cloud $24.8 billion, up 82%, with operating income more than tripling to $8.8 billion. By any normal reading, an excellent quarter.
Capital expenditure was $44.9 billion, against $39.1 billion of operating cash flow.
Which means free cash flow came in at negative $5.855 billion, versus positive $10.1 billion in Q1 and positive $24.6 billion in Q4 2025. That is Alphabet’s own labelled figure in its own non-GAAP reconciliation, not something we derived. The company also disclosed $49.6 billion in net proceeds from its June raise, a $40 billion at-the-market program with no shares sold yet, and $20.3 billion of senior unsecured notes.
Separately, Nikkei published a study on July 21 estimating that off-balance-sheet debt across five US tech giants, Alphabet, Microsoft, Amazon, Meta and Oracle, has grown roughly eightfold in about four years to $1.65 trillion, against roughly $1.35 trillion that appears on their balance sheets. Meta’s alone is put at about $420 billion, nearly triple its recorded debt. The mechanism is undelivered GPUs and servers under long-term contracts, plus leases on data centres that are not yet operational. Read that carefully: these are future lease and purchase commitments, not $1.65 trillion of undisclosed conventional borrowing.
Two things Nikkei says that the viral repackaging of this dropped, and both belong in any honest version. It is an estimate, and Nikkei says so twice. And Nikkei explicitly calls the accounting “a legitimate practice under accounting rules.” This is a disclosure-and-visibility story, not a fraud story, and the aggregators that turned it into one were adding something the source did not say.
Also on July 22, AMD and Anthropic announced a strategic partnership: up to 2 gigawatts of Instinct MI450 Series GPUs in AMD’s Helios racks, the first gigawatt beginning in the first half of 2027, and a commitment by AMD to a strategic equity investment of up to $5 billion in Anthropic “in the future.” Anthropic is plainly party to it, and its chief compute officer Tom Brown is quoted in the release.
Note where the hedges sit, because all of them are load-bearing. “Up to” governs both the two gigawatts and the five billion, and the equity carries a second hedge, “in the future,” with no closing date, no tranches and no valuation. Nothing is deployed and no equity has closed. Two smaller things: the announcement went out on AMD’s newsroom and Anthropic published nothing under its own masthead that week despite posting five other times, and AMD filed no 8-K; our EDGAR full-text search on July 25 found no AMD filing mentioning Anthropic at all.
Why it matters: The capex is now large enough to turn one of the world’s most profitable advertising businesses free-cash-flow negative for a quarter, and a meaningful share of the sector’s obligations sit in lease footnotes rather than on balance sheets. Neither of those is a scandal. Both change how you read “we are investing aggressively.”
🔥 The Week’s Loudest Stories Had the Least Behind Them
Four of the biggest AI threads on Hacker News were not what their headlines said
“Advertise in ChatGPT” got more than 1,090 points and 680 comments, and nothing happened. We pulled the archive history on ads.openai.com. A snapshot from May 18 is content-identical to the page live today, down to the Best Buy, Lowe’s and VistaPrint early-advertiser section. A diff of the July 13 and July 22 captures returns nothing at all. The actual timeline: pilot in February, self-serve Ads Manager beta around May 5, five new markets May 7, new formats May 21, UK beta June 19. A thousand people upvoted a rediscovery of a five-month-old page. Since we have never covered ChatGPT ads, here is the catch-up in one line: no ads on Plus, Pro, Business, or users predicted to be under 18; CPM or CPC through a relevance-weighted second-price auction; advertisers give “context hints” that are explicitly not exact-match keywords; Ads Manager is still labelled beta.
A ChatGPT share link pulled more than 1,100 points, and what it actually contained was an AI disclosure footnote. The submission was a ChatGPT share URL attached to Terence Tao’s write-up of a Jacobian Conjecture counterexample. What Tao actually wrote: “I used an AI chatbot to discuss various aspects of this problem and to confirm several of the calculations.” Levent Alpöge found the counterexample, announcing it on July 20. The AI confirmed some arithmetic and discussed the problem. Both of those are real and neither is the headline people shared.
The “Kimi K3 found a Redis zero-day” claim hit 1.37 million views. The author’s own proof-of-concept README says “Authenticated RCE,” and describes two of the three findings as patch bypasses of CVE-2026-25243 and CVE-2026-25589, both of which NVD confirms require an authenticated attacker with RESTORE permission. Be precise about what that does and does not settle, because a lot of the pushback got this wrong too. The authentication requirement is not what disqualifies a zero-day: an authenticated vulnerability can absolutely be one. What the label turns on is whether the flaw was previously unknown. For the two paths that are bypasses of already-published CVEs, the label is wrong on its own terms. The third should be judged on whether it was previously undisclosed, and the published evidence does not settle that either way. But do not file the whole thing under hype, because Redis moved the next day. On July 23 it published seven security releases at once, 6.2.23, 7.2.15, 7.4.10, 8.2.8, 8.4.5, 8.6.5 and 8.8.1, covering the affected supported branches and fixing a crafted stream RESTORE payload that makes two consumers share a NACK, a use-after-free that may reach remote code execution, plus out-of-bounds writes from crafted RESTORE payloads in RedisBloom and TDigest. Those are the same code paths the exploit chains run through. The vulnerabilities and the exploit chains are real. The blanket “three zero-days” framing is not what the published evidence supports.
And a repo went around cited at “over 62,000 stars.” It is ruvnet/RuView, and as of our July 27 read it actually has more than 86,700, and it was created in June 2025. Off by about 25,000 in the direction nobody checks, and thirteen months old.
Why it matters: Every one of these took under ten minutes to check, and three of the four are checkable from an archive or an API rather than an opinion. The upvote count is a measure of interest, and it was uncorrelated with accuracy this week.
🛠️ Two Reversals, a Silent No-Op, and an 80% Cut
The tooling layer spent the week arguing with itself
Claude Code reversed its own default in three days. Version 2.1.217 on July 21 capped concurrent subagents at 20, made --max-budget-usd actually halt background agents, and turned nested subagent spawning off by default. Version 2.1.219 on July 24 turned it back on, at depth 3. Both are quoted from the vendor changelog with tag dates confirmed. No explanation was given for the reversal, and we are not going to invent one, but if you pinned a version last week on the strength of that default, check which side of it you are on.
llama.cpp reversed its ban on AI-generated pull requests. PR #26012, merged July 22, replaced language refusing “fully or predominantly AI-generated” contributions with: “AI-generated code is allowed. What is not allowed is submitting code you do not understand.” Enforcement moved from detection to disclosure, and undisclosed AI use is now a ban. That is a meaningfully different policy: it is enforceable against behaviour rather than against provenance.
Codeberg went the other way the same day. It wrote “mostly AI-generated” into its Terms of Use, which we could not find another general-purpose code host having done, and explicitly disclaimed automated detection. Armin Ronacher’s rebuttal on July 24 attacks the enforceability rather than the intent: “The line is open to interpretation precisely where it needs to be enforceable.” A major open-source project and a nonprofit code host, one week, opposite conclusions, and the disagreement is about enforcement mechanics rather than about AI.
Anthropic says it deleted most of Claude Code’s system prompt. From its July 24 context-engineering post: “We removed over 80% of Claude Code’s system prompt for models like Claude Opus 5 and Claude Fable 5 with no measurable loss on our coding evaluations.” Take the direction seriously and the number with salt. It is Anthropic’s figure, from Anthropic’s unpublished evals, about Anthropic’s own product. Anthropic did not publish enough methodological detail for anyone outside to reproduce it. The transferable claim is the direction of travel: fewer instructions, fewer few-shot examples, fewer “don’t do X” lists.
And the one that will silently break your evals. Google’s documentation now says temperature, top_p and top_k are “deprecated and ignored” on gemini-3.6-flash and 3.5 Flash-Lite. Ignored, not rejected. If your eval harness pins temperature: 0 for reproducibility, that pin is a no-op on those models right now and nothing in the response tells you. Anthropic made the opposite call in the same week: a labelled breaking change that returns a hard 400 when thinking: disabled meets effort xhigh or max, and a removal of fast mode for Opus 4.7 with no silent fallback.
Why it matters: A loud failure costs you an afternoon. A silent one costs you every comparison you ran since the change and you will not know which.
📡 Quick Signals
Poolside shipped Laguna S 2.1 with weights the same day (July 21): 118B total, 8B activated, up to 1M context, under OpenMDW-1.1. Terminal-Bench 2.1 at 70.2%, SWE-Bench Multilingual at 78.5%. Two traps if you go looking: the widely quoted “beats rivals 10x its size” is a headline escalation of Poolside’s own “holds its own against models many times its size,” and the repo most people are linking, Laguna-XS-2.1, is the 33B model, not the 118B.
Qwen-Image-3.0 launched without weights (July 21). The announcement claims 4.5k-token instruction input, legible 10px text and 12 languages, and contains no weights, no licence, no Hugging Face link and no technical report. Its only call to action is Qwen Chat, and as of July 25 we found no corresponding repo under the Qwen organisation. Qwen-Image 1.0 was Apache 2.0. We are describing what the announcement did and did not include, which is checkable, rather than guessing at intent, which is not.
Upstage released Solar Open 2 (July 22): 250B total, 15B active, 1M context. Read the licence before you build on it. It “basically adopts” Apache 2.0, but Section 4(e) requires derivative models be named with a “Solar” prefix and display “Built with Solar,” overriding Apache’s trademark clause. Open-weight and commercially usable, but not OSI-approved open source.
Anthropic’s $1.5B copyright settlement got final approval (July 20), and the lawyers took a haircut. Class counsel sought 12.5%, or $187.5 million, a 6.92x multiplier the court called “far outside the range of multipliers found to be reasonable in mega fund cases.” Judge Martínez-Olguín awarded a 3.75x multiplier: $101,561,111, a 46% cut. Service awards dropped from $50,000 to $15,000 each. Of 482,460 works, 440,490 were claimed, at least 91.3%, at roughly $3,000 per work. Just 350 timely opt-outs and 54 objections, all overruled.
The EU fined Google €890 million under the DMA (July 23): €460M for search self-preferencing, €430M for Play anti-steering, reference IP/26/1670. This is Google’s first DMA fine, not the EU’s, which went to Apple and Meta in April 2025. Do not confuse it with the separate €4.125 billion Android judgment on July 2, a different law and a different decade. A curiosity for the compliance-minded: the Commission’s press release says Google risks penalties “of up to 5% of its total worldwide turnover,” but DMA Article 31(1) actually provides for 5% of average daily worldwide turnover, per day. Cite the statute, not the press release.
Andrew Ng open-sourced OpenWorker (July 23), an MIT-licensed, model-agnostic, MCP-extensible desktop agent. It had 4,234 stars at our July 25 read, and since the repo was created on July 20, every one of them was earned inside this window.
Cursor published real numbers on planner-versus-worker agent swarms (July 20): one build went from 64,305 lines to 9,908, and from 68,000 commits and 70,000 conflicts to under 4,000. Total cost ranged from $1,339 to $10,565 across configurations, with the worker fleet at $411 against $9,373 for planners. Useful shape, and worth remembering that it is Cursor’s harness on Cursor’s chosen task with no replication, and Cursor sells the harness.
Gemini’s Flash tier repriced (July 21). 3.6 Flash is $1.50/$7.50, holding the old input price and cutting output 16.7%. But 3.5 Flash-Lite at $0.30/$2.50 is 3x the input and 6.25x the output of 2.5 Flash-Lite, landing exactly at 2.5 Flash’s price. The cheap tier moved upmarket. Flash Cyber, despite the launch coverage, is not generally available: it is a limited-access CodeMender pilot for governments and trusted partners.
The MCP SDKs spent the week racing a wire change. The TypeScript SDK hit 2.0.0-beta.5 and its changelog admits its own client had been hard-rejecting spec-conforming servers; Rust’s rmcp landed nine-plus breaking changes. To be clear about dates, since a lot of coverage was not: the spec change merged July 16 and the revision is dated July 28. What happened this week was the SDK scramble, not a new spec.
GigaToken’s tokenizer claims caught fire (more than 600 points), and the conditions matter. It is MIT and the PyPI release is real, but the repo dates to November 2025, so this is a benchmark publication and a traction spike rather than a launch. From its own README, the baselines ran on prefixes, Hugging Face on the first 100MB and tiktoken on the first 1GB, while the speedup is credited to caching pretoken mappings. The headline figure is a best case on a 144-core dual-socket EPYC. Never repeat “1000x” without the machine attached.
Also: Cognition acquired the company behind Poke (July 23, price reported as low nine figures, keep that hedged). The Mendral team, Docker and Dagger founders, joined Anthropic’s Claude Platform on July 21 with the hosted product wound down and no terms disclosed. And the FTC’s proposed policy statement applying Section 5 deception law to AI systems, File No. P264200, closes for comment on July 31. It published July 7, so it is not news, but it is the live docket you can actually act on this week, and you have four days.
Catch-ups we owed you
TypeScript 7 shipped July 8 and we never ran it. The Go port is real, latest on npm is 7.0.2, and the 7.x tags live in microsoft/typescript-go, which is why the main TypeScript repo’s releases appear to stop at 6.0.3. Nothing moved in our window. Last call on this one.
Tracebit’s “Context Bombs” research published July 13. Across 5 models and 152 runs, their defence took admin access from 57% to 5%, full compromise from 36% to 1%, and any attack path from 91% to 15%. Worth reading, and worth noting it is a vendor working paper measuring a defence the vendor sells, with no outside replication.
The Claude “memory heist” write-up, July 9, by Ayush Paul, a student at UC Berkeley. Nothing new has happened since, and Anthropic’s mitigation predates our window, but it remains the clearest public demonstration of memory exfiltration from a major assistant.
🛡️ On Your Radar: The Agent Tooling Layer Had a CVE Week
Six advisories, and the pattern is that the wrapper fails, not the model
AWS patched a fail-open in its API MCP Server (CVE-2026-16584, bulletin July 23). If the security policy errors during startup, it fails open and skips per-request checks for the entire life of the process. Not a bypass you trigger; a bypass you inherit.
AWS also patched command injection in the Bedrock AgentCore SDK (CVE-2026-16796), an argument-delimiter injection in install_packages() whose official workaround is, essentially, do not pass model-generated input to it. Which is what an agent SDK exists to do.
n8n disclosed two AI-node flaws on July 22: CVE-2026-65589 leaks LLM credential headers in plaintext into persisted execution data, and CVE-2026-65015 lets a read-only Project Viewer escalate to node execution simply by chatting with an agent.
A critical template-injection RCE landed in the Prompty runtime (GHSA-w28w-gp39-m4p6, July 24), and SiYuan shipped an unauthenticated MCP endpoint giving full workspace takeover (CVE-2026-66012).
One methodology warning that cost us a story. GitHub backfilled a large batch of AI-tooling advisories during this window, so a GHSA publication date is not an event date right now. The best-fitting item we found, a Claude Code sandbox escape via git worktree path confusion at CVSS 8.8, has a GHSA dated July 24 but was fixed in v2.1.163 on June 4. It is out. If you are triaging from an advisory feed this month, check the fixed-version date before you panic or before you publish.
Two more worth your time. PyPI now rejects new files on releases older than 14 days (announced July 22), a real supply-chain win, with 56 of the top 15,000 projects affected and PyPI’s own caveat not to rely on it yet. And a researcher found a pre-auth WordPress SQL-injection-to-RCE chain using GPT-5.6 Sol Ultra for about $25 (CVE-2026-63030 and CVE-2026-60137, credited in the 7.0.2 release notes), with the git history stripped so the model could not cheat its way to the answer. The $25 is his own pro-rata estimate, but the CVEs and the credit are real.
🎯 The Playbook
Your moves this week
- Test whether your incident response actually works before you need it. Point your frontier API at a sample of your own attack logs and see if it refuses. Hugging Face found out mid-incident. If it refuses, get a self-hostable model working now, as an availability control rather than a cost saving.
- Grep your eval configs for
temperature,top_pandtop_k, then check them against the model you are actually calling. Ongemini-3.6-flashand 3.5 Flash-Lite those are now ignored silently. Re-run any evaluation on those models whose reproducibility depended on those parameters. - Pin your Claude Code version deliberately. The nested-subagent default flipped off and back on between 2.1.217 and 2.1.219 in three days. Know which behaviour you are getting and whether
--max-budget-usdis enforcing what you think. - Read the system card, not the launch post. This week the card contradicted the executive’s summary of it, and the card was right. Ten minutes in the PDF beats a quote-tweet.
- File an FTC comment by July 31 if Section 5 liability touches how you ship AI features. File No. P264200. Four days.
- Before you repeat a number, check whether the artifact is older than the excitement. An archive diff or a GitHub API call settled three of this week’s four biggest stories in under ten minutes each.
🔥 What’s Viral Right Now
The skeptical read on the OpenAI incident got more than 530 points, and it deserves engaging with rather than dismissing. Writing in the Guardian on July 24, John Thickstun argued that this is a pattern going back to the GPT-2 announcement in 2019: “loudly proclaim how dangerous AI is, and investors will hear how powerful it is.” Note what he concedes, because it is the strong version of the argument rather than the cheap one. He calls the incident “remarkable evidence of cybersecurity expertise.” He is not saying it did not happen; he is asking who benefits from how loudly it is being told. It is an opinion column and the Guardian labels it as one, and it is the sharpest thing written about the week.
Thickstun also draws the line between this week’s two biggest stories, which is why we structured the issue the way we did: he finds it “troubling, and more than a bit ironic, that the US AI industry is adopting a centralized, authoritarian approach to AI governance, while China has taken the lead on open development of AI.” Agree or not, the connection is real. The breached company did its forensics on a Chinese open-weight model because the American closed ones would not help, in the same week the American industry mobilized against restrictions on Chinese open weights that nobody has issued.
“If coding has been solved, why does software keep getting worse?” drew more than 870 points and 670 comments. It blames incentives rather than model capability, which is why it landed.
And the essay everyone cited about AI-assisted mathematics was published before our window. “Are AI labs pelicanmaxxing?” hit more than 680 points on July 22 but was published July 18, and its actual finding is a negative one: the pelican-on-a-bicycle prompt ranked 42nd of 48 cells, with “little evidence that AI labs are pelicanmaxxing.” A good result, widely shared for the opposite of what it says.
Every big story this week came with a document attached, and in every case the document was more interesting than the announcement.
OpenAI’s incident post says the safeguards were intentionally not enabled. Anthropic’s system card lists the two surfaces where its smaller model beats its new flagship. The Commission’s own statute contradicts the Commission’s own press release. Politico’s own reporting says the rule everyone spent the week fighting was never seriously discussed. And the one bill that did get introduced carves out the exact category of event its sponsor cites as the reason for it.
None of that is a gotcha. Every one of those documents was published voluntarily by the party it complicates. The gap is not between what companies say and what is true. It is between the announcement and the attachment, and almost nobody opens the attachment.
Hugging Face’s page still says it does not know who broke in. The company knows. The page has not been told.
Stay building. 🛠️
— Matt