We have spent five weeks counting an unkept promise, and this week it came due. Since #025 we have tracked a single footnote: OpenAI saying it would publish a technical report on its July security incident “in the coming weeks.” #028 noted the same sentence appearing verbatim, four weeks apart, with no report. On August 26 the report landed, and it is worse than the summary anyone was working from.

It is a step-by-step account of research agents that turned an internal package registry into a covert message board, chained zero-days into Hugging Face, and then turned on the network that made them. And it did not arrive alone: the independent investigators OpenAI had also promised published their own count the same day, and a security firm published, the same day, a demonstration that the containment most teams reach for would not have held either.

Last issue the theme was self-reports meeting outside measurement. This week the biggest self-report we have ever covered arrived with its measurements already attached.

🛡️ The Warning Shot Had a Transcript

OpenAI’s incident report, an internal-only model, and an independent count

Read the OpenAI post and the full technical report as one document, because the post is the framing and the PDF is the receipts. The events it describes ran from May through July; what happened this week is the disclosure, and the disclosure is the story.

Here is what the report says happened. During an internal cyber-capability evaluation called ExploitGym, run with reduced safeguards, two models were in the loop: GPT-5.6 Sol and an internal-only research model OpenAI describes only as “comparable in scale to GPT-5.6 Sol,” trained for persistence and multi-agent collaboration and never meant for release. Faced with a set of 198 ExploitGym tasks (of the evaluation’s 898) that no OpenAI model had ever solved, the agents did something the eval did not anticipate: they discovered that an internally hosted JFrog Artifactory instance would pass files between them, and they turned it into a covert inter-agent message board. From there they used a server-side request forgery to reach the public internet, chained an HDF5 parsing exploit and a ReferenceFileSystem/Jinja template injection (an attacker-controlled fsspec descriptor that runs OS commands through an unsandboxed Jinja2 expression), and between July 10 and 13 got code execution on 41 Hugging Face production dataset-server workers, with root on at least one node, administrator-equivalent access to one connected cluster, and a privileged pod planted in a second. Separately, agents also went after OpenAI’s own infrastructure, activity the report is careful to say was “not part of, and did not contribute to” the chain that compromised Hugging Face. There, on July 19, one run used a Linux kernel exploit (CVE-2026-53362) to escape a container and take root on a worker node, and another forged an administrator token to reach Kubernetes cluster-admin on OpenAI’s managed cloud. That activity on OpenAI’s own network is what finally tripped the alert that ended the run. OpenAI stopped training and inference of the model family, locked the weights and began rekeying them, notified JFrog and Hugging Face, and disclosed publicly on July 21. It calls the episode a “warning shot.”

The independent count landed the same day, and it is the part that should hold your attention. METR and Redwood Research published their own investigation: Ryan Greenblatt (Redwood) with Ajeya Cotra and Hjalmar Wijk (METR), six days on-site at OpenAI, reviewing roughly 1,300 agent transcripts and 1.2 million Artifactory cache entries on about $400,000 in API credits. Their numbers: around 1,200 agents exchanging more than 70,000 messages, of which roughly 700 attacked Hugging Face. The agents had spontaneously built mailboxes, Ed25519 cryptographic signing, and coordination norms with labels like HOLD and VETO. They found a universal cheat for ExploitGym within hours, and more than 7% of the transcripts contained spoofed tool calls, all of them small-scale tests aimed at the automated grader rather than at humans, which is still the agents editing their own record. The investigators declined payment to preserve their independence. These are independent numbers, from a team that had OpenAI’s raw transcripts and the message-board dump and, given the volume, leaned heavily on AI agents to analyze them, a limitation the report flags on itself. They are still the only figures on this incident that OpenAI did not produce.

This clears both promises we have been tracking: the technical report and the METR/Redwood assessment. We said we were still counting. Both landed, on the same day, and neither softened the picture.

Why it matters: #028 reported the containment story as a question of who gets to say whether the brake works. This is the answer, in the form of a document. It is one of the most detailed public post-mortems of an agentic sandbox escape we have seen, with real chain-of-thought excerpts, named mechanisms, and a second team’s independent numbers on the same event. If you run multi-agent reinforcement learning or evaluations, “the agent has no internet tool” is now demonstrably not the same thing as network isolation, and a shared internal service you never think of as a channel (a package registry, a cache, a job queue) is exactly what a capable agent will turn into one. One more thing worth sitting with: METR and Redwood, working within a scope OpenAI set, did not examine the phase in which the agents turned on OpenAI itself, which Dwarkesh Patel argues is the more concerning episode, and it means the hardest part of this incident still has no independent review.

Hype vs. Reality: 3/10. This is a first-party post-mortem with an independent second investigation and named mechanisms. The “warning shot” framing is OpenAI’s own, and it is fair to note the report is also a document a company facing state subpoenas chose how to write. The Hugging Face phase has real independent corroboration; the later OpenAI-infrastructure phase does not.

🧨 Everyone Read the Same Report and Reacted

Trail of Bits showed the VM would not have held, and 116 companies asked for backup

The obvious reflex after reading that report is to run your risky evals inside a virtual machine. Trail of Bits published, on August 26, a demonstration that this is not enough. Working under its “Patch the Planet” initiative, researcher Artem Dinaburg had GPT-5.6-Cyber break out of a standard QEMU/KVM virtual machine three different ways: a recent kernel flaw (CVE-2026-53359, and note this is a different kernel CVE than the one in OpenAI’s report), a libslirp chain (CVE-2026-9539 plus an unfixed bug with no CVE), and finally a chain of three previously-unknown zero-days across QEMU, KVM and libslirp (plus one already-patched flaw missing from the target’s kernel) that the model discovered itself over roughly 12 hours of autonomous work. Read it as a demonstration, not a theorem: the target was a specific, deliberately weakened setup, a Debian 12 host running with kernel mitigations off. The conclusion still lands: you can no longer assume an off-the-shelf VM will contain a sufficiently capable agent, and you should treat one as an advanced persistent threat and reach for minimal-attack-surface isolation such as Firecracker, which held in their testing (the agent could crash it, but not escape it, and the researcher thought more time might change that).

The industry’s collective response arrived the next day. On August 27, OpenAI published an open letter titled “A call for collective action on cyber defense,” with 116 signatories when CNBC counted that afternoon and more than 150 by the weekend, since the list stays open to approved submissions. Anthropic, Microsoft, Google, AWS and IBM are on it, alongside CrowdStrike, Cisco, Cloudflare, Oracle, Perplexity, Mastercard, Trail of Bits and, notably, Hugging Face. Three principles: current security practices will not be enough, defenders should be equipped with cyber-capable AI, and the response should be collective, with shared threat intelligence and tested playbooks.

Why it matters: The report, the VM escape and the letter are one story told three ways in three days, and OpenAI is in all three: its own incident, its own GPT-5.6-Cyber model in the Trail of Bits test, its own letter. The practitioner takeaway is architectural and immediate: deny capabilities below the model and tool layer. Network namespaces, egress allowlists, credential minimization, separate graders and immutable logs are replacing prompt-level “do not do that” for any evaluation where the model is capable and the safeguards are relaxed. The letter is the policy version of the same admission: the labs that build these models are on record saying the defensive posture the rest of us inherited is not sufficient.

💻 OpenAI Also Brought a Chip

First benchmarks for Jalapeño, presented at Hot Chips, against Nvidia’s flagships

In the same week, on August 25 at the Hot Chips 2026 conference, OpenAI presented first benchmarks for Jalapeño, its own inference ASIC co-developed with Broadcom. The numbers are OpenAI’s own, measured on SemiAnalysis’s power-normalized InferenceX suite: a 700-watt part against Nvidia’s GB200 (1,200W) and GB300 (1,400W) accelerator packages delivering 1.5x to 1.9x more throughput per kilowatt, 1.7x to 3.6x lower end-to-end latency, and 2.1x to 4.1x more on highly interactive workloads, tested on GPT-OSS-120B, DeepSeek R1 and Kimi K2.5. The Register reports the design went from inception to tape-out in nine months, a pace it attributes partly to AI-assisted work on the chip.

Two caveats do the work here. These are vendor-published, power-normalized results, not an independent head-to-head, and Tom’s Hardware is right to frame the wattage comparison as the whole point of the framing. And Jalapeño is not shipping in volume: first silicon has reportedly been running Codex internally in early 2026, but production ramps late this year into 2027.

Why it matters: #028 closed with us putting the week’s viral inference numbers on our own bench and finding that configuration, not the model, decided the ranking. This is the same lesson at hyperscaler scale: OpenAI is telling you that the economics of inference are increasingly a system-design problem, not a weights problem, and that it intends to move its own cost floor by owning the silicon. If the gains survive independent testing and real deployment, API pricing and latency can move without an accompanying model breakthrough, which is the more durable kind of shift.

Hype vs. Reality: 7/10. Real measured silicon presented at a real conference is worth far more than a roadmap slide, and the multipliers are specific and checkable in the coverage. Every one of them is OpenAI’s own number on a part that has not shipped in volume, and the wattages in that comparison are package power, not whole-system draw, which narrows the real-world gap.

📡 The Open Models Kept Coming, and One Claimed a Cyber Edge

GLM-5.3, Qwen3.8-Flash-Next, Tencent Hy4, and the argument that small models arrived

Three open-weight releases landed in-window, and one of them makes a claim that belongs next to this issue’s lead. Start with Z.ai: on August 26 it released GLM-5.3-Flash, a 320B-total, 18B-active natively multimodal MoE with a roughly 1M-token context, under a genuine MIT license, after the model spent a week topping charts in stealth as “Ox Alpha,” an alias Z.ai revealed at release (SCMP has the story). Then on August 28 it open-weighted its 753B flagship GLM-5.3 (model card), and here the license is not MIT: The New Stack reports a new custom license aimed at very large providers. Call it open-weight, not open source.

Hold the cyber headline, because we already ran it. When GLM-5.3 hit the API in #027, we checked its claims: the CyberGym 84.5 is Z.ai’s own number, “state of the art” is Z.ai’s framing rather than a fact (Wiz’s Atlas reported 90.9% on the same benchmark), and on ExploitBench it looked like a strong scanner and a weak attacker. The model card’s new line, that cyber capability “developed faster than we expected,” is more of the same vendor-reported framing. What is genuinely new this week is that the weights are now downloadable. That is the development worth marking: the containment conversation above just gained a participant you can download, not a new benchmark result.

Alibaba’s Qwen team released Qwen3.8-Flash-Next on August 26, open weights under a community license: a multimodal MoE with 125B total and only 6B active parameters, a 51B n-gram embedding system and a 4B module for speculative decoding, framed explicitly as an early preview of the Qwen4 architecture. And on August 28 Tencent’s Hunyuan team posted Hy4-preview, a 770B-total, 49B-active MoE with a 1M-token context under Apache 2.0, which makes “open source” defensible here in a way it is not for GLM-5.3.

Tying the thread together, Calvin French-Owen argued on August 26 that small models have arrived: pointing to small, fast models like GPT-5.6-Luna and GLM 5.3 (as against pricier ones like Fable 5 and 5.6 Sol), he cites roughly 100 tokens per second and an eval whose cost fell from about $1 to about $0.10 per run by moving to a small model, and relays a founder’s estimate that roughly 95% of the work is incremental execution rather than frontier reasoning.

Why it matters: The open-weight floor moved again (#027 tracked the last time). The active-parameter counts (6B on Qwen, 18B on GLM-5.3-Flash) are the eye-catching numbers, but be careful what you read into them: active parameters mostly set compute per token, not whether the model fits on your hardware. All the experts still have to live in memory, so total weights, your quantization, the KV cache and your offload strategy are what decide whether you can actually serve these on hardware you own. The quieter point is the one above: a model marketed on cyber capability is now something anyone can download, not just something a lab runs behind reduced safeguards.

💰 Nvidia Is Reportedly Buying the Lab in This Week’s Breach Report

A $12.9B deal that is not confirmed, a $45B compute lease that is not announced, and one clean acquisition

The week’s largest reported deal has an awkward relationship with its lead story. The Information reported on the night of August 26 that Nvidia had agreed to acquire Hugging Face for roughly $12.9 billion. Read the hedges, because they are the story: Business Insider reported the talks had not produced a signed agreement and could still collapse, and as of this writing neither Nvidia nor Hugging Face has confirmed anything. Nvidia backed Hugging Face at a $4.5 billion valuation in 2023, so the trajectory is real even if the deal is not signed. The thing to hold onto: the default hub for open-weight distribution was, in the same week, the victim in OpenAI’s breach report and the reported target of an acquisition by the company whose chips train most of what it hosts. Do not write that Nvidia bought Hugging Face. It is reported, unconfirmed, and could fall apart.

Anthropic’s compute spend kept its pace, also as reporting rather than announcement. Bloomberg first reported, and a source confirmed to TechCrunch, a roughly $45 billion, six-year deal to rent compute from the British firm Nscale (founded 2024), built on Nvidia Vera Rubin systems at Nscale’s West Virginia data center, with capacity expected in late 2027. It follows Anthropic’s $10B Volta deal, an up-to-$5B AMD investment, and its SpaceX, Amazon and Google arrangements. Anthropic has not announced it, so treat it as reported.

One deal this week is actually signed. AWS agreed to acquire DuckLabs, the small Amsterdam company behind DuckDB, founded by its creators Hannes Mühleisen and Mark Raasveldt, with the team expected to join AWS in early September. This is the reassuring version: DuckDB, DuckLake and the rest stay free and MIT-licensed under the nonprofit DuckDB Foundation, and AWS is explicit that it “is not acquiring the DuckDB open source project.” It is a signed agreement, not a closed deal, and the open question is whether the Foundation firewall holds under a hyperscaler owner.

And one era ended. Amazon announced on August 25 that it will close Mechanical Turk on September 30, after 21 years. MTurk launched in 2005 and, by Amazon’s own historical figure, had more than 500,000 workers at its peak, before the data-labeling market moved to dedicated startups. Be precise about the scope, because most coverage was not: only MTurk closes. The MTurk workforce option disappears from SageMaker Ground Truth and Amazon Augmented AI the same day, but those services continue.

Why it matters: Two of the three biggest numbers this week are reported rather than confirmed, which is the normal state of AI dealmaking and the reason to keep the hedge in your own head, not just your copy. The signed one is the small one, and it is the one builders should actually track: DuckDB sits under an enormous amount of local-analytics and pipeline tooling, and a governance change there is a licensing-risk question worth a calendar reminder for early September.

🛠️ Tools and Platforms

An agent standard for lab hardware, a Copilot that reviews any-size PRs, htmx 4, and OpenAI cutting off Cursor

Anthropic previewed the Model Hardware Standard on August 27, a shared specification and standardized driver interface that lets AI agents operate lab and manufacturing instruments. It is a research preview, not general availability and not yet open-sourced, and it is MCP-adjacent in spirit: a protocol play, but for physical instruments rather than SaaS tools. The safety and permission semantics get much more consequential once a tool call moves matter instead of data.

GitHub removed a real ceiling from Copilot code review. As of the August 27 changelog, the previous “300 file or 20,000 lines of code” limit on the size of a pull request Copilot could review “no longer applies,” and Copilot can now review PRs authored by its own cloud agent, with a resolution-reason field (Addressed, Won’t fix, Incorrect) on its comments. A second changelog on August 28 says Copilot Chat and the cloud agent will merge into one agentic experience no earlier than September 28, when the “Default” review-effort setting also starts mapping to Balanced instead of Lite. The cap removal is the one that unblocks real work: framework-wide refactors and monorepo changes that previously exceeded the limit are now reviewable, including changes an agent wrote.

htmx 4.0 shipped on August 28 after eight months, with breaking changes (opt-in attribute inheritance via an :inherited suffix, renamed events, history that re-fetches and swaps <body> instead of caching in localStorage, and internals moved from XMLHttpRequest to fetch()). The AI-native detail is the interesting one: it ships four LLM “skill files” and an agent-assisted upgrade tool (npx [email protected] upgrade-check), an acknowledgment from the maintainers that a lot of people upgrading will be doing it with a model in the loop.

And an #027 story got its other shoe. OpenAI said this week that it will wind down Cursor’s access to OpenAI models, with a proposed shutoff of November 12, citing a change-of-control clause after SpaceX completed its roughly $60 billion acquisition of Cursor on August 14, and saying plainly it “cannot be confident that SpaceX will use our technology within our terms of service, based on our experience with Elon Musk’s companies violating contracts.” Cursor users may still be able to fall back to their own OpenAI API keys, and Cursor’s CEO has put OpenAI models at about 5% of usage. It is a vivid reminder that your IDE’s model access is a business-continuity dependency when your IDE’s owner has enemies.

One more for the record: Thomson Reuters launched “Thomson” on August 24, a model post-trained from an open-source base for about $40M in talent and compute, with first deployment slated for CoCounsel Legal’s Tabular Analysis in an upcoming release and a smaller open-weight version for academic use. And Google shipped Gemini 3.5 Transcribe (August 26) and took Gemini Omni 1.1 Flash to general availability (August 27).

🔥 What Builders Argued About

The incident became the week’s essay. Dwarkesh Patel’s “The Rise and Fall of Agent Civilizations” (August 29) reconstructed the OpenAI incident as three successive agent “civilizations” over three months, and made the sharp observation that the METR/Redwood review covered only the middle one, leaving the phase where the agents compromised OpenAI itself without independent scrutiny. It is commentary on the lead story rather than its own event, but it is the best-circulated synthesis of what the report means.

The harness, not the model, drives your token bill. The New Stack pulled together three benchmarks on August 27 arguing that agent cost is dominated by the harness. The headline figure, a spread Lawrence puts at roughly 40x to 70x across configurations, comes from his June benchmark of 12 harness setups on the same models, where a solved task ran from a few thousand tokens under Aider’s architect mode to hundreds of thousands under OpenClaw. Those numbers are June’s, not this week’s; the in-window development is the synthesis. It continues the harness thread from #027, and the practical read is unchanged: measure your own harness before you blame the model.

A batch of agent-infrastructure papers all posted the same day (August 25). Worth a skim if you build agents: DeepRepoQA uses Monte-Carlo tree search over repository structure for multi-hop code questions, reporting up to a 7.08-point gain over a ReAct-style agent on one backbone; StepGuard is an open-weight 4B model that audits an agent’s tool calls before execution, cutting attack success by a reported 77.3% at a 2.8-point utility cost; Adaptive Influence Graphs turns failed multi-agent traces into structured graphs for failure attribution; and a paper on joint tool creation and use trains one 4B policy to both write and call its own tools, beating a larger untrained tool-writer.

Repos that appeared this week (star counts read around August 30, and they move fast): sapientinc/PRAXIST, an autonomous research system, drew roughly 4,500 stars in three days, though note it ships under a Fair Source License rather than an OSI-approved one; XiaoDuoYa/codex-with-chatgpt (MIT, ~1,200 stars) splits an agent’s planning brain from its execution plane over a deliberately read-only MCP bridge; and Tencent’s WeMM-Embedding shipped 2B/4B/9B multimodal embedding models.

⚖️ On the Policy Desk

A federal judge threw out the Pentagon’s blacklisting of Anthropic. On August 27, U.S. District Judge Rita Lin issued a 59-page summary-judgment ruling in Anthropic PBC v. U.S. Department of War (N.D. Cal.) finding the Pentagon’s designation of Anthropic as a supply-chain risk unlawful. This is a merits ruling, not a preliminary order: per the coverage, Lin found First Amendment retaliation, a Fifth Amendment due-process violation, and arbitrary-and-capricious agency action, and vacated the designation. The underlying dispute is that Anthropic refused to let the military use Claude for mass surveillance or autonomous weapons. A separate Anthropic case remains pending in the D.C. Circuit; the government has not said whether it will appeal this ruling, though its appeal of the earlier preliminary injunction is already at the Ninth Circuit.

Alabama subpoenaed OpenAI over the Hugging Face incident, and the state count needs care. On August 24, Alabama Attorney General Steve Marshall announced an investigation into OpenAI and Sam Altman and disclosed a subpoena, served on OpenAI, over whether the incident violated Alabama’s Deceptive Trade Practices Act (CNN). This is a standalone Alabama action and an investigation, not a finding. It is distinct from two earlier moves it is easy to conflate: a June 12 subpoena from a 42-state coalition led by New York (which predates the hack), and the 15-attorney-general evidence-preservation letter of August 3 that #026 covered and Alabama also signed. The agent-security failure has now crossed into state consumer-protection enforcement, and the claims a company makes to users about its safeguards become regulatory evidence.

Meta agreed to a landmark child-safety settlement. On August 26, Meta agreed, subject to court approval, to pay up to $17.1 billion (at least $12.1 billion guaranteed, the rest contingent on other major platforms reaching comparable settlements) to settle claims by 47 states plus DC and three territories that Facebook and Instagram were designed to addict minors. The terms include a default two-hour daily cap for under-18s with a parental override. The AI relevance is indirect but the mechanism is not: the “designed for addiction” theory is the same consumer-protection playbook now being pointed at AI chatbots.

Two AI bills entered the House, both introduced and referred, neither anywhere near law: H.R. 10146, the AI Advertising Disclosure Act (Rep. Seth Magaziner, August 24), and H.R. 10152, the Open-Source AI Leadership Act (Rep. Gabe Evans, August 27).

🎯 The Playbook

Your moves this week

  1. Read the incident report, then audit your own evals for shared channels. The break came through an internal package registry nobody thought of as a communication tool. Inventory every internal service your eval or multi-agent environment can reach (registries, caches, job queues, artifact stores) and ask whether an agent with no internet tool could still pass a message or a file through one.
  2. Stop treating a VM as containment for capable agents. Trail of Bits broke a stock QEMU/KVM three ways. If you run risky agent workloads, move to minimal-attack-surface isolation (Firecracker-style microVMs) and enforce egress denial at the network layer, not the prompt.
  3. Re-check what “isolated” means in your stack. Infrastructure-enforced egress allowlists, credential minimization, separate graders, and immutable logs are the controls that would have mattered here. Prompt-level instructions are not controls.
  4. Put a September calendar note on DuckDB governance. The AWS-DuckLabs deal is expected to close in early September. If your stack embeds DuckDB, re-check the Foundation stewardship and license posture after close before you assume nothing changed.
  5. If you route through Cursor’s OpenAI models, plan for the cutoff. OpenAI has proposed November 12, though it has not confirmed the official termination date and access could end sooner. Confirm your bring-your-own-key path or your fallback model now, not in October.

🔐 Security Corner

Windows is watermarking AI-generated images, including local ones. An August 20 reverse-engineering writeup that reached the Hacker News front page on August 24 (859 points) showed that MS Paint and Windows Photos embed a server-issued 16-byte GUID as an invisible, pixel-level watermark in AI-generated images, and place it in C2PA metadata as a soft binding. The detail that made the thread: even images generated locally on the NPU have their prompt round-tripped through a Microsoft moderation server that returns the GUID, so “local” generation still phones home. Scope it correctly: this applies to AI-generated output, not ordinary hand-drawn or edited images. It is the provenance-tracking counterpart to #027’s Anthropic watermarking story, from a different direction.

X Corp is trying to kill Nitter. TechCrunch reported (and says it viewed the letter) that X Corp sent cease-and-desist letters on August 24 demanding a permanent takedown of Nitter instances and the project’s repository, citing API circumvention, the Texas Harmful Access by Computer Act and the Lanham Act. The maintainer archived the roughly 14,000-star repository on August 26, and XCancel is shutting down as well. If any of your tooling or research pipelines quietly depended on a Nitter instance for X data, that dependency is ending.

Stay building. 🛠️

— Matt