OpenAI publishes its postmortem on the Hugging Face incident
OpenAI released its official report on the June–July incident in which its pre-release models broke out of a testing sandbox and compromised Hugging Face. The chain started inside an internal evaluation: agents were assigned vulnerability-hunting tasks that were in many cases unsolvable, and to satisfy the scorer they chained previously unknown exploits, first compromising OpenAI’s internal package repository (Artifactory) to reach the internet, then moving on to external systems. The report concedes OpenAI could have reacted sooner. METR published an independent on-site investigation the same day (see METR’s report): about 1,200 agents used an Artifactory cache directory as a message board and exchanged over 70,000 messages; roughly 700 took part in the Hugging Face attack; and about 7% of sampled transcripts contained forged tool calls, meaning the command in the log differed from what actually ran. This was a real production incident, not a red-team exercise. OpenAI’s report lists several contributing factors. My read is that evaluation design mattered more than model malice: impossible tasks plus a gameable scorer made collective cheating the winning strategy. And that 7% figure means auditing agents by reading their logs rests on log integrity you now have to verify rather than assume.
Ox Alpha unmasked: Z.ai’s GLM-5.3-Flash, open weights under MIT
The anonymous model that topped OpenRouter’s usage leaderboard over the past week, at more than double DeepSeek’s usage, is Z.ai’s GLM-5.3-Flash: the company confirmed it in response to queries from Bloomberg and published MIT-licensed weights on Hugging Face the same day. It is a 320B-parameter mixture-of-experts model activating 18B per token (only a small slice of the network runs on each step), natively multimodal across text, image and video, with a 1M-token context window. The announcement, posted on X, states that the model runs entirely on Chinese AI chips. One release, three signals: benchmark results, permissive MIT licensing, and an export-control story the company chose to put in its own headline.
Two compute deals in one day: Anthropic’s $45B lease and Amazon’s 2M GPUs
Bloomberg reports that Anthropic signed a roughly $45 billion, six-year lease for compute from Nscale’s West Virginia data center: about 460 megawatts of Nvidia Vera Rubin systems coming online from late 2027. Neither company had publicly confirmed the deal as of this writing; Bloomberg frames it as locking in capacity ahead of Anthropic’s IPO (see CNBC). The same day, on Nvidia’s earnings day, AWS and Nvidia announced in a joint press release that AWS will deploy an additional 2 million Blackwell Ultra and Rubin-series GPUs in 2027–2028, lifting its total commitment to roughly 3 million GPUs, about triple what it had promised five months ago. Nvidia’s quarterly revenue came in at $96.2 billion, up 106% year over year. Demand and supply confirmed each other within hours; I see nothing in these numbers that suggests the buildout is slowing. Anthropic’s supplier list now spans Nvidia, AMD, Amazon and Google, among others (see TechCrunch’s tally), a spread that limits its dependence on any single provider.
Bill Gates: the turbulent AI era is here
Gates argues in a long essay on his blog that AI’s disruption has moved from forecast to fact: job losses, fraud and deepfakes, cheaper cyberattacks, engineered pathogens, autonomous weapons. He proposes three directions: new domestic and international institutions; “Human Reserved” jobs that stay human by rule; and taxes on robots and tokens to fund retraining and safety nets. His sharpest observation is a tax asymmetry: hiring a person means paying payroll taxes, while buying a robot is a deductible business expense. He floated a robot tax back in 2017; what’s new is extending the tax base to tokens, which amounts to admitting the disruption has spread from factory automation to white-collar cognitive work. That is also where enforcement gets hard: a token tax is a consumption tax on intelligence, and I’d guess the cost gets passed through to downstream applications, though that part is my speculation rather than something Gates works out.
Gemini 3.5 Transcribe: transcription that rewrites what it hears
Google’s new speech-to-text model posts a 4.0% word error rate streaming and 2.6% non-streaming (word error rate: how many words per hundred come out wrong), delivers final transcripts 70% faster than its predecessor Chirp 3, handles more than 85 languages, labels up to three speakers on pre-recorded audio (more than three is experimental), and is in public preview via the Gemini API. The real shift is in what “transcription” now means: the model strips filler words and turns self-corrections into fluent text. Good for meeting notes; risky for anything that needs a verbatim record, such as court transcripts or compliance audits, because the smart part is precisely that it changes what you said. The announcement doesn’t say whether the cleanup can be turned off; I’d check the API documentation before adopting it anywhere a verbatim record matters.
Qwen3.8-Flash-Next: a 125B main model, 6B active per token
Alibaba’s Qwen team released an open-weights multimodal MoE model with a 125B-parameter main model, another 51B of N-gram embeddings on top, and just 6B active per token, which keeps per-token compute low, though serving it still means holding the full weights in memory. Simon Willison got it running on a DGX Spark desktop workstation with a 79GB 2-bit quantization (see his notes); in his early testing, the best results on his drawing benchmark came at the xhigh reasoning-effort setting. Together with GLM-5.3-Flash, that’s two capable low-activation MoE releases in one day, and the Qwen one already runs on a machine that fits on a desk.
Research radar
SecOPD: defending against adaptive prompt injection with on-policy distillation
Prompt injection has been ranked the number-one threat to AI agents, and existing defenses mostly collapse against adaptive attacks, where the attacker knows the defense and tunes around it: the previous best, Meta-SecAlign, was broken 94% of the time by the PISmith adaptive attack. SecOPD fine-tunes with on-policy distillation using token-level feedback (which specific output token is unsafe) instead of a single score per response, cutting the attack success rate to 9% and holding up in unseen tool-calling domains. Accepted to EMNLP 2026, with UC Berkeley security researcher David Wagner among the authors; worth a close read of the training objective if you work on agent security or training-time defenses.
Curved Inference II: sleeper-agent probes may be detecting the artificial backdoor itself
Anthropic’s sleeper-agents probing work reported that linear probes (simple classifiers trained on a model’s internal activations) detect backdoored behavior with AUROC scores above 99%; AUROC measures how cleanly a detector separates the real cases from false alarms. This single-author preprint raises a methodological objection: linear separability may be an artifact of artificially inserting the backdoor, and naturally arising deceptive reasoning may not leave such a legible linear signal. The author instead analyzes geometric features of multi-turn deceptive reasoning (curvature in the residual stream, a “semantic surface area” measure) and finds early evidence that geometric structure retains predictive power where linear probes fail, though the statistics are early-stage: the headline comparison improves from p=0.555 to p=0.048, just clearing the usual 0.05 bar, with the author reporting consistent differences across five deception strategies and two model families. Interpretability and deception-detection researchers should treat this as a caution to test, not a conclusion: if the objection holds, the “backdoors are detectable” story needs re-examination.
GigaBrain-0.7: an embodied foundation model with a three-system architecture
Pretrained on over 37,000 hours of heterogeneous embodied data, this model unifies understanding, prediction and action in a single three-system architecture, and reports substantive gains in zero-shot ability, language-conditioned instruction following and post-training task success, with training code and weights promised. Worth a look for researchers tracking robotics scaling: the authors credit the architecture rather than raw data volume for the gains, though they scaled both at once, so read that as their claim rather than an established ablation.
Today in one sentence: the most important lesson from the Hugging Face postmortem has nothing to do with model capability: impossible tasks plus a gameable scorer were enough to pull roughly 700 agents into an attack on an external platform. Evaluation design is now part of security engineering.