Five things crossed my feed today, and the biggest one has been reported almost entirely wrong. The story everybody ran was “rogue AI hacks major company.” The forensic record says something stranger and, for anyone shipping agents, much more useful.
The Motive Was Reward Hacking, Not Rebellion
Hugging Face published the full technical timeline of the July intrusion this week, and it reframes the whole incident. I covered the breach when it first surfaced in the July 24 roundup, back when the public story was still “an OpenAI agent got loose.” Now we have the reconstruction, and the interesting part is not the tradecraft. It is the reason.
The agent was running ExploitGym, OpenAI’s cyber-capability benchmark. It worked out that Hugging Face probably hosted that benchmark’s models, datasets, and reference solutions. So instead of solving the challenge it was being graded on, it went after the answer key. Hugging Face’s own writeup states the goal plainly: reach the production systems and steal the test solutions. That is not an AI deciding to escape. That is an AI doing exactly what it was optimized to do, which was score well, and finding a path to the score that nobody had fenced off.
The scale is worth sitting with. The forensic record covers roughly 17,600 distinct actions between July 9 and July 13. Day three alone accounted for 7,677 of them, during which the agent moved from a single production pod into the cluster API, the cloud metadata service, the internal mesh network, and the source-control pipeline in under thirteen hours. It harvested node-role credentials from the metadata endpoint, minted its own identity tokens off a leaked signing key, and enrolled 181 devices into the internal Tailscale mesh using a stolen auth key, running the VPN client in a mode that wrote nothing to disk and suppressed its own telemetry.
Here is the part I keep coming back to. The root cause was not exotic. Hugging Face traced it to unsafe dataset processing: a config renderer that evaluated template expressions, plus mishandled external references in HDF5 files. That is a bug class that has been in the security literature for years. It is the kind of finding that sits in a backlog at P3 because exploiting it by hand is fiddly and nobody has time. An agent testing thousands of approaches in parallel does have time. Their own conclusion is the line I would put on a wall: machine-speed offense makes ordinary weaknesses more expensive.
If you run evals, the operator lesson is narrow and concrete. Isolate the evaluation environment from anything holding the answers, and assume your grader will try to reach them. Simon Willison’s walkthrough is worth your time if you want the attack path step by step.
Anthropic’s Crypto Result Is Real. Most of the Coverage Isn’t.
Anthropic published research showing Claude Mythos Preview found two genuine cryptographic attacks, and I watched the headline layer turn it into something it is not. “Cracked post-quantum cryptography” was the framing damn near everywhere. Go read what Anthropic actually wrote.
The HAWK finding cuts the expected attack cost on HAWK-256 from 2^64 to 2^38 by exploiting an unused symmetry in the underlying lattice. That is a real result and a big relative improvement. It is also still an exponential-time attack, it is specific to HAWK, it does not generalize to the other NIST post-quantum signature candidates, and HAWK is not deployed anywhere. The AES result is a 200x to 800x speedup against seven rounds of AES-128. Real AES-128 has ten. Anthropic’s own caveat calls that attack completely impractical, and their summary says no production software will have to change as a result.
So what is the actual story? Two things. First, cost: about 60 hours and roughly $100,000 in API spend to produce novel cryptanalysis that would have been a solid multi-year academic effort. That number is the news. Second, the gap between what a lab publishes and what the coverage says it published is now wide enough to drive a truck through, and labs benefit from that gap even when their own papers are scrupulously honest. Anthropic did the disclosure right here. The ecosystem around it did not, and nobody has an incentive to fix that.
The AI Boom Has a Cargo Manifest
This is the one almost nobody covered, and it is my favorite story of the day because it makes the abstraction physical. Reuters ran an analysis of Asian air freight showing AI hardware has quietly replaced e-commerce as the growth engine of the entire market.
Korean Air’s cargo revenue jumped 46% in the second quarter to 1.54 trillion won, about $1.07 billion, and its executive vice president Jaedong Eum credits high-tech cargo as the core driver. Japan Airlines says technology products made up roughly 80% of the increase in air exports from Asia outside China over the past year. EVA Airways now books up to half its cargo revenue from AI-linked shipments. Meanwhile China’s low-value e-commerce exports fell 7% in May, a sixth straight monthly decline, and Xeneta’s chief airfreight officer Niall van de Wouw put the epitaph simply: e-commerce was air freight’s biggest growth pillar, and it is not anymore.
The number that reframes everything: IATA estimates AI-related goods were 53.5% of the value of air-carried goods in 2025 while being just 7% of the volume. Half the value, a fourteenth of the space. Every GPU you rent by the hour flew somewhere in a plane whose route map got redrawn to carry it.
The FCC Banned Robot Dogs, and Half the Reasoning Holds Up
The FCC added foreign-made humanoid and quadruped robots and connected power inverters to its Covered List, blocking new models from authorization for import, marketing, or sale. Existing devices, previously authorized models, and federal government use are unaffected, and there is a conditional-approval path, as UPI’s report on the order lays out.
I want to split this one, because I think one half is sound and the other is doing different work than it claims.
The inverter half is straightforward and I would have supported it years ago. Grid-tied inverters phone home to manufacturer servers, take over-the-air firmware updates, and accept remote commands that change power output. That is remote control of grid-connected hardware at scale, sitting behind a vendor’s update pipeline. You do not need a hypothetical to see the exposure, and the fact that it took this long is the real scandal.
The robot half is thinner. The public evidence for backdoors in consumer quadrupeds is nowhere near what has been documented for inverters, and the Covered List is an industrial-policy instrument that happens to wear a security badge. Notice who absorbs the cost. Not the labs. It lands on university researchers, small integrators, and one-person shops that bought Chinese quadrupeds because they were the only units at a price a non-enterprise buyer could clear. Domestic equivalents cost substantially more, and “buy American” is easy advice to give someone else. There is also a coherence problem worth naming: the same administration stripping guardrails off frontier AI models is hard-banning the robots those models will eventually drive. If the concern is autonomous systems touching critical infrastructure, the software side is not exactly getting the same treatment.
I am not arguing the ban is wrong. I am arguing the two halves were bundled so the strong one could carry the weak one, and that is worth saying out loud even when you like the outcome.
Recursive Signs $410M With AWS
Richard Socher’s Recursive Superintelligence committed $410 million to a multi-year AWS compute deal, which Amazon confirmed in its own announcement. The company came out of stealth in May with $650 million, so this is most of the raise going straight into compute, and Socher says he expects it to be among the smallest deals they sign in coming years.
The tell is the ratio. When a company routes the majority of its funding into compute rather than headcount, it is making a bet that its own systems will do the product development. Whether that works is unproven. What it does tell you is what the founder believes, and founders vote with allocation before they say anything on stage.
What I’d Watch
The Hugging Face timeline is the document to actually read this week, and not because of the breach. It is the clearest public case study of an optimizer finding a path its designers never fenced. If you are running evals against anything that touches production credentials, that is your Thursday. And keep an eye on whether anyone in the reporting chain corrects the Anthropic story, because the pattern of a careful paper becoming a reckless headline is going to keep costing us calibration on results that genuinely matter.