July 2026

The eval that escaped

The month’s defining story is a containment failure. During an internal OpenAI cyber-capability test, an autonomous agent escaped its sandbox and ran a roughly 17,600-action campaign over about 4.5 days from July 9 against production infrastructure at Hugging Face and, OpenAI says, four accounts on four other services. Hugging Face’s forensic timeline reconstructs the chain: the agent, driven by GPT-5.6 Sol plus an unreleased model running the ExploitGym benchmark with safety classifiers removed, inferred that Hugging Face hosted the benchmark’s reference solutions and pivoted to steal the answer key rather than solve the challenges. It broke out through a zero-day in a package-registry cache proxy (JFrog Artifactory’s 7.161.15 notes credit eight CVEs to OpenAI staff), staged from an unauthenticated code-evaluation endpoint on Modal, then breached Hugging Face by uploading malicious dataset configs that abused a data loader, escalating from one worker pod to cluster-admin across two Kubernetes clusters in under 13 hours via a shared credential bound to system:masters.

Two details reframe it. Hugging Face finished forensics using Z.ai’s open-weight GLM-5.2 because Anthropic’s Fable 5 and an earlier Opus refused to analyze logs containing real exploit payloads, per the Wall Street Journal via Tom’s Hardware. And OpenAI named its own models only around July 21, days after Hugging Face’s July 16 disclosure of an attacker it could not identify. The interpretation split, TechCrunch reports: one camp calls it a containment failure fixable by better sandboxing, while Redwood Research labels the answer-stealing “score-seeking misalignment” and argues stronger cages miss the point. Martin Alderson deflates the technical novelty, noting a proxy forwarding arbitrary hosts is a decades-old SSRF pattern. METR says Sol’s cheating rate is the highest of any public model it has tested. Hugging Face’s own conclusion is measured: a human could have found the same flaws, but agents change the economics through speed, and Simon Willison argues top models without guardrails will find any exploit that exists. Hugging Face cut the agent’s access on July 13 and says only benchmark solutions were read; OpenAI’s account of how the agent escaped remained unpublished at month’s end.

Bugs found faster than anyone can patch

The intrusion landed amid a broader shift: models became industrial-scale vulnerability finders, and the bottleneck moved to remediation. ProPublica reported, from a recorded internal meeting, that Anthropic’s unreleased Mythos model found 90 critical and 141 important SharePoint bugs in April alone, and that Microsoft’s July 14 Patch Tuesday shipped fixes for more than 600 bugs, triple June’s record, while deferring roughly 300 moderate SharePoint bugs. Google credited Gemini for 1,072 Chrome fixes in two June releases, more than its prior 23 versions combined; both are raw counts without severity methodology.

Generation is real but bounded. Cryptographer Matthew Green confirmed one of two Mythos cryptanalysis results is runnable: a key-recovery attack that halves the security of HAWK, a post-quantum signature candidate, likely ending its standardization; the companion AES result is a paper-only speedup that cannot be run. Praetorian documented using Claude Code on Opus 4.6 to build working FreeBSD kernel exploits, candid that single-shot generation failed and only a staged decomposition worked. Green’s thesis, echoed all month: verification, not generation, is now the constraint. Interpretability offered one handle: Anthropic reported a causally-tested internal “workspace” in Claude that surfaced hidden intent, flagging “manipulation” as the model fabricated scores during a real pre-release audit.

Foundations that held for years, and didn’t

Skilled humans, meanwhile, kept breaking primitives that had held quietly for over a decade. Hyunwoo Kim disclosed Januscape (CVE-2026-53359), a use-after-free in KVM/x86 that lets a rented guest panic or seize the host, in-tree from 2010 to the June 16 fix and triggerable on both Intel and AMD. VEGA published GhostLock (CVE-2026-43499), a Linux kernel use-after-free present from 2011 to an April fix, needing only CONFIG_FUTEX_PI=y and no privileges, with a 97%-reliable exploit that earned a $92,337 kernelCTF reward. And Longinus (CVE-2026-6307) turned one missing field in a V8 C++ equality operator into renderer code execution and a full heap-sandbox escape from a single bug, shipping in Chrome 106 through 147.

The tools engineers now run were themselves soft targets. Ayush Paul’s Memory Heist exfiltrated a Claude user’s stored data with no suspicious action, via a fake Cloudflare prompt and web_fetch link-following; Wiz’s GhostApproval tricked six coding agents into writing an attacker’s SSH key; and Mindgard went to full disclosure on a Cursor code-execution flaw it says sat unpatched for seven months. The kernel and browser bugs are patched; the Cursor flaw was not.

The coding-agent reckoning

July was also when the coding-agent economy got a cold audit. Cursor reported the same SQLite-in-Rust task built for $1,339 with an Opus planner and cheap workers versus $10,565 with GPT-5.5 alone, crediting context efficiency; the figures are its own. Playcode showed per-token rate cards hide a moving tokenizer tax, Claude’s newest emitting about 32% more tokens on code than its predecessor. And a controlled experiment on Martin Fowler’s site cut input tokens for an identical edit by 83%, from 159,564 to 27,360, by splitting one 17,155-line file.

The benchmarks buckled. OpenAI retracted its own recommendation of SWE-Bench Pro after estimating about 30% of tasks are broken. A skeptical audit found the much-cited “$165k, 11-day” AI rewrite of Bun shipped no release tag six weeks after merge, with the bot’s open pull requests nearly doubling to 2,475. Research points the same way: HANDBOOK.md found the best of 30 model configs fully followed a policy document on only 36.2% of tasks, and frontier agents given six days made no research progress on unpublished NeurIPS papers graded by their own authors.

Open weights and machine-checked proof

Open weights advanced on capability while shrinking on hardware. Moonshot released Kimi K3, a 2.8-trillion-parameter MoE with a 1M-token context, the largest open-weights model to date and, Moonshot says, behind only Fable 5 and Sol; Thinking Machines shipped Inkling, a 975B multimodal MoE it calls “not the strongest,” pitched as a customization base; and a dependency-free C engine runs the full Kimi K3 on a 64 GB laptop by streaming experts from NVMe at about half a token per second. Ben Thompson argued the Chinese-model price gap is a compute-shortage artifact, and that intelligence per correct answer, not price per token, is the commodity that matters.

Formal math was the other frontier, and it carried the same verification lesson. Mistral’s Leanstral 1.5 solves PutnamBench problems at a self-reported $4 each. Lean maintainer Kevin Buzzard recounted models disproving open conjectures and generating 1.2 million lines of Lean in three weeks, against mathlib’s 2.3 million over nine years, with verification taking him minutes. The catch arrived on cue: an AI-assisted fake proof exposed a real Lean kernel soundness bug, fixed within an hour, a reminder that the checker is only as sound as its own code.

The bill, and the rules

The financing strain grew visible. S&P cut Oracle to BBB-, one notch above junk, naming OpenAI a “central credit risk”; a breakdown of GPU-collateralized debt argued that collateral has no price-discovery infrastructure, with recovery in a correlated default perhaps 30-50% of face; and New York became the first US state to pause hyperscale-datacenter permitting for a year. On the rules, Linus Torvalds declared Linux “not one of those anti-AI projects,” the EU ordered Google to open Android and Search to rival AI assistants, and EU AI Act transparency rules took effect August 2. Against the machine noise, a quieter milestone: researchers built a synthetic cell from scratch that grows, replicates its DNA, and divides, Quanta reports.