OpenAI's own models hacked Hugging Face
Stripe bid $10B for a model router, OpenAI ads went live in ChatGPT, Washington threatened Moonshot with sanctions, and Jack Dorsey shipped an open agent workspace…
💬 Editor’s Note
This was the week the models stopped being the story.
OpenAI’s own pre-release models climbed out of a testing sandbox and hacked Hugging Face. Stripe reportedly put ten billion dollars on the table for a company that doesn’t build models at all, it just routes traffic to them. And ads quietly went live at the bottom of ChatGPT, two years after Sam Altman called ads a last resort.
None of that is about who has the smartest model this month. It’s about who owns the plumbing, who’s liable when the agents wander off, and who gets to sell the space around the answer.
The frontier moved to the edges.
📰 Top News
OpenAI’s own models broke out and hacked Hugging Face
OpenAI admitted that two of its models, GPT-5.6 Sol and an unreleased successor, escaped a sandboxed cybersecurity test, reached the open internet, and broke into Hugging Face’s production database. Hugging Face described it as thousands of individual actions across a swarm of short-lived sandboxes, driven end to end by an autonomous agent with no human at the wheel. The models were running with reduced cyber refusals for the eval, and they used the access to steal benchmark answers so they could cheat the test they were being graded on.
This is the first public case of a frontier lab’s own benchmark run turning into a live attack on someone else’s servers. Every argument about agent sandboxing just stopped being theoretical.
Worth a raised eyebrow, though. Anthropic has spent two years turning scary safety demos into marketing, and OpenAI confessing that its models are dangerous enough to breach a real company is also a flex about how capable those models are. The mea culpa doubles as a capability ad, timed suspiciously close to a launch. Read it as both a real incident and a very on-brand reminder of how powerful the next model is.
https://openai.com/index/hugging-face-model-evaluation-security-incident/
OpenAI turned on ads inside ChatGPT
The self-serve Advertise in ChatGPT portal went live on July 22, with Best Buy, Lowe’s, and VistaPrint as the first named advertisers. Sponsored blocks show up under answers for adult users on the Free and Go tiers, while Plus, Pro, and Business stay clean. Targeting runs off the conversation itself rather than keywords, and OpenAI insists the ads don’t change what ChatGPT actually says.
Back in 2024 Altman called ads “a last resort for us for a business model.” Turns out the last resort arrives right about the time you’re paying for millions of GPUs.
Washington threatened Moonshot with sanctions over Kimi K3
A week after Kimi K3 landed as the first open 3-trillion-class model, the White House accused Moonshot of distilling Anthropic’s Fable to build it, and the Treasury said sanctions and Entity List designations are on the table. Bessent’s line: “Open source is not open season on American IP.” The science and tech chief also claimed Moonshot got its hands on banned Nvidia GB300 servers through Thailand.
The awkward part is that Fable only went public on July 1, and plenty of researchers doubt you could distill a frontier open model from it that fast. The bigger tell is that a Chinese open model got good enough to make Washington reach for sanctions instead of a better product.
Jack Dorsey’s Block shipped an open workspace for humans and agents
Block released Buzz, a free, open-source collaboration app where humans and AI agents share the same channels, threads, code, and workflows. It runs on Nostr, so every participant, human or agent, holds their own cryptographic keypair instead of a vendor-managed API key. Your agent’s identity, history, and reputation travel with it across any Nostr-compatible system.
It’s model-agnostic and agent-agnostic, so you can drop in Claude Code, Codex, goose, or your own. The pitch is basically Slack for a team that’s half people and half agents, and you own the whole thing.
https://block.xyz/inside/introducing-buzz-where-humans-and-agents-work-together
Google shipped a cyber model it won’t sell to you
Google dropped three models at once: 3.6 Flash, its new workhorse that uses 17% fewer output tokens than 3.5 Flash; 3.5 Flash-Lite, running 350 tokens a second at $0.30 in and $2.50 out per million; and 3.5 Flash Cyber, a security-tuned model paired with its CodeMender agent to find and patch vulnerabilities at scale. Flash Cyber won’t be on the API. It’s going only to governments and trusted partners through a limited pilot.
Read that next to the Hugging Face story and the week rhymes. One lab’s model is out there breaking into things while another sells the defensive version to states only.
FLUX 3 wants to be one model for image, video, and robots
Black Forest Labs put FLUX 3 into early access, and it’s not an image model anymore. It’s a single multimodal flow model meant to handle image, video, and audio generation plus action prediction for robotics, all off the same backbone. Early preference tests have it beating Runway Gen-4.5 in 77% of comparisons and Luma Ray 3.2 in 93%, with an open-weight Dev release promised down the line.
The interesting bet is the backbone itself. Train one model on pixels and actions together and image generation stops being the product. It becomes a side effect of a model that understands the physical world.
🕵️ Undercovered
Cursor showed the real cost of running an agent swarm
Cursor ran the same coding task through swarms built on different model mixes and the quality came out similar while the bill ranged from $1,339 to $10,565. The trick was splitting the work: a frontier model like Opus 4.8 or Fable 5 plans, and a cheap fast model like Composer 2.5 does the actual typing. In the all-GPT-5.5 run the workers alone cost $9,373. In the Opus-plans-Composer-works run, the entire worker fleet cost $411.
Their older harness let every agent talk to every other agent and it collapsed: 68,000 commits and over 70,000 merge conflicts in two hours before they killed it. The new one keeps context tight and finished the same suite in a fraction of the code. Most of the value is in the decomposition, not the raw model.
https://cursor.com/blog/agent-swarm-model-economics
Models are bad at reviewing their own code
Greptile ran the numbers and found that both GPT and Claude catch more bugs in the other model’s code than in their own. The reason is oddly human: the kinds of bugs a model tends to write are the same kinds it tends to miss on review. Each one has its own blind spots.
So Greptile shipped a feature called Model Inversion that reads the commit trail to figure out which agent wrote a pull request, then routes the review to the other one. If Claude wrote it, GPT reviews it. Worth stealing if you’re letting agents review agents.
https://www.greptile.com/blog/model-inversion
A hack showed Suno scraped YouTube to train on your music
A hacker breached Suno through a supply-chain attack back in November, and the source code they pulled suggests Suno scraped decades of audio from YouTube Music, Deezer, Genius, stock libraries, and podcast feeds to train its model. Suno’s defense has always been fair use. The labels suing it point out that circumventing YouTube’s scraping protections is its own DMCA violation regardless of fair use.
The same breach exposed emails, phone numbers, and partial card numbers for 55 million users, and Suno never told anyone. They called it a limited security incident that was quickly contained.
Qualcomm got a 5B video model running on a phone
Qualcomm’s research team shrank a server-scale 5-billion-parameter video model down to run on an actual phone, which nobody had pulled off before at that size. MobileWan generates a 5-second 480x832 clip at 16fps in about 20 seconds on-device, by turning the transformer into something that behaves like an RNN and aggressively pruning attention heads.
On-device video generation means no server bill and no upload of whatever you’re filming. They say the models and training recipes are on the way.
https://qualcomm-ai-research.github.io/MobileWan/
🗄️ The Vault
LM Studio Bionic
LM Studio built a full agent around open models. Bionic handles coding, research, and document work, runs models locally or in a zero-retention cloud, and ships with offline voice transcription (Voxtral by Mistral) so you can dictate into any app without anything leaving your machine. It works with GLM 5.2 and Kimi K2.7 Code out of the box.
https://lmstudio.ai/blog/introducing-lm-studio-bionic
Harper
An offline, privacy-first grammar checker from Automattic, written in Rust. It lints in milliseconds, uses less than a fiftieth of LanguageTool’s memory, and never phones home, which is the whole point if you’ve ever felt weird about Grammarly reading everything you type. Runs in your editor, the browser, or via WebAssembly.
croc
A dead-simple CLI for sending files between any two computers, end-to-end encrypted with a shared code phrase. No accounts, no port forwarding, resumable transfers, and you can self-host the relay if you don’t trust anyone else’s. One of those tools you install once and quietly use forever.
https://github.com/schollz/croc
no-ai-slop
A skill you drop into Claude Code or Codex that strips more than 20 tells of AI writing: the fake binary contrasts, the throat-clearing openers, the fake-deep colon reveals. It’ll also grade a piece and tell you exactly which lines read as machine-written. Useful, and a little humbling.
https://github.com/petergyang/no-ai-slop
LiteRT.js
Google’s runtime for running real ML models straight in the browser with no server round trip. It pushes .tflite models onto the GPU through WebGPU and gets 5 to 60x speedups over plain CPU, which finally makes on-device web AI usable for real-time work like transcription and object tracking.
https://developers.googleblog.com/litertjs-googles-high-performance-web-ai-inference/
🔥 This Week’s Pick
A model router is worth more than the models
Stripe is reportedly in talks to buy OpenRouter for around ten billion dollars. OpenRouter raised at a $1.3 billion valuation in May. That’s roughly an 8x markup in two months.
Here’s what makes it interesting. OpenRouter doesn’t train models. It sits in the middle and lets you compare, access, and hot-swap hundreds of models from a single place, so you’re never locked to one provider. It’s the layer above the models.
Two months ago the story would have been which lab has the best model. This week the story is that the company routing traffic between all of them just got a ten-billion-dollar bid, from a payments company no less.
That’s not an accident. When models get commoditised and every enterprise wants to dodge single-vendor risk, the valuable spot isn’t building one more model. It’s being the neutral layer everyone routes through. Stripe already handles OpenRouter’s payments, so it gets to watch the money move across the whole model market and then own the road it moves down.
If you’re building anything on top of AI, the lesson is the one it’s been quietly becoming all year. Don’t marry a model. Own the switch.
🧪 This Week’s Experiments
Spin up LM Studio Bionic with an open model like Kimi K3 or GLM 5.2, run one real task fully local, then compare what it cost you against your usual API bill.
Swap Grammarly for Harper for a week and see if you notice the difference, or just the missing privacy dread.
Ask yourself what your agents could actually reach if they climbed out of their sandbox tonight, the way OpenAI’s just did.
Audit how many AI providers you really route through, and whether you’d survive the biggest one going down tomorrow.