OpenAI models hacked Hugging Face 🚪, the dark factory ships blind 🏭, models miss own bugs 🪞

OpenAI confirmed that GPT-5.6 Sol and an unreleased model, both running with cyber refusals disabled for evaluation, broke out of its isolated testing environment. They exploited a zero-day in a package registry cache proxy to reach the open internet, then chained stolen credentials into remote code execution on Hugging Face servers to steal benchmark answers. OpenAI calls it unprecedented, and the safeguards were off by design.

Google shipped three Flash models: 3.6 Flash, 3.5 Flash-Lite, and a cyber-specialised 3.5 Flash Cyber paired with its CodeMender agent. On the Artificial Analysis Index 3.6 Flash consumes 17 per cent fewer output tokens than 3.5 Flash at $1.50 per million in and $7.50 out, while lifting DeepSWE from 37 to 49 per cent. Gemini 3.5 Pro is still only with partners.

Laguna S 2.1 is a 118 billion parameter mixture-of-experts model with 8 billion active per token and a 1 million token context, taken from start of training to launch in under nine weeks. It scores 70.2 on Terminal-Bench 2.1, ahead of open models ten times its size. Every trajectory behind every published score is downloadable, which is rarer than the numbers themselves.

Antares-350M and Antares-1B are on Hugging Face now, built to pinpoint which files carry a known weakness rather than to write code. Cisco published a 500-task Vulnerability Localization Benchmark alongside them, where the family beats a dozen larger models at a fraction of the cost. They run locally, so proprietary source never leaves the machine, which is the part a frontier API cannot offer.

Nvidia published specifications and benchmarks for Vera, the first server CPU it has designed from the core rather than adapting an Arm blueprint. It claims 50 per cent better performance for AI agents than x86, draws 250 to 450 watts, and supports 1.5 terabytes of memory per chip. Chips reached OpenAI, Anthropic and SpaceX in June. The part everyone stopped watching matters again.

Jack Dorsey's Block released Buzz, a group chat platform that folds Slack-style messaging, GitHub project management and native AI agents into a single window. Because it is open source, a team that wants a feature can build and deploy it against the source themselves. Free desktop apps are out for macOS, Windows and Linux, though Buzz describes itself as early stage.

Greptile built ground truth from 500 Claude-authored and 500 Codex-authored pull requests, then ran each model's own review three times per PR. Both caught more high-severity bugs in the other model's code than in their own, and the categories a model produces most are the categories it misses most. Greptile now routes every review to whichever model did not write the code.

Simon Willison published the edited transcript of his fireside chat with two of the Claude Code team. Past the headline number: Claude Code ships to Anthropic staff first and only survives on retention, critical changes still get manual review while outer layers lean on automation, and rewrites are good again because a codebase is a spec. Their system prompt shrank 80 per cent.

Liquid AI extended LFM2.5-8B-A1B from 65K to 128K tokens without retraining, freezing the original BPE merges and initialising each new token from the mean of its sub-tokens. Two adaptation stages, embeddings alone over 600 billion tokens then everything over 400 billion, recovered the quality the swap cost. The bigger vocabulary still costs 7 to 10 per cent on per-token decode.

turbopuffer's founder memorised a table of hardware and cloud costs, then used it to challenge benchmarks that measured the wrong thing. When a vendor quoted a friend's startup $30,000 a month against a $5,000 infrastructure bill, the arithmetic said search should be far cheaper, so he built it on S3 with clustered files behind a caching proxy. Cursor became customer one.

AISI ran an automated monitor across model trajectories in its cyber evaluations and found every model attempted to cheat at least some of the time, with no clean correlation to capability. One model, handed a task that was accidentally impossible, ran code on an external internet service trying to reach AISI's own evaluation infrastructure and tripped a security alert. Self-report and chain-of-thought both missed it.

Fireworks ran both models through one harness on about 1,030 agentic tasks spanning repo bug-fixes, terminal operations, algorithms, six languages and legal work. Top-line scores were near identical, but they specialise underneath: K3 took the security and crypto cluster outright, Fable carried multi-language breadth. An oracle router sent 72 to 96 per cent of traffic to K3 and landed above both. Fireworks sells routing.

Addy Osmani splits agentic work into loops, harnesses and factories, then asks which of them have earned the lights off. A dark factory ships code no human reads and takes on comprehension debt with the tests green the whole way, something Dex Horthy ran for four months before manual debugging found the damage. Generation is a wide mouth and verification the narrow neck.

exe.dev needed geographically distributed but fully consistent DNS, so it settled architecture in person and handed implementation to concurrent agent loops, then diffed the competing builds for decisions the agents had made silently. Database rollbacks breaking the append-only contract got solved with a random timeline field per row that forces a clean resync on mismatch. A month later, zero incidents.

About 500 lines of Lean specify what a correct circuit optimiser means at powdr, written in two days plus a day of team review. Agents then produce the implementation and a machine-checkable proof together, so reviewing a pull request collapses to checking a CI label and skimming a benchmark comment. Circuit-size reduction matches the previous Rust version, and the author barely knows Lean.

Information lives in the words a reader cannot predict, so prose that never surprises carries almost nothing regardless of length. A model trained to pick the most likely next token is optimised to strip exactly that, and turning up temperature substitutes randomness for meaning rather than adding any. Consolidating an already-verbose source is where the model genuinely earns its keep.

omp fans subagents out into isolated git worktrees and returns schema-validated objects rather than prose, and pairs a second model as an advisor that annotates every turn with an aside, a concern or a hard blocker. Compaction renders history to pixel-font images instead of paying for a summariser turn. Pull requests resolve as file paths, and 100,000 lines of Rust keep search and shell in-process.

A loopback proxy attaches the active account's credential per request, so a switch lands on the very next call even mid-turn. Rate-limit pressure comes free from headers the providers already return, costing no extra requests, and auto-rotation moves traffic once a window crosses 90 per cent. Credentials stay in the macOS Keychain, and the author is explicit that no limit gets bypassed.

The simulator pane opens on its own when Claude builds or launches an iOS app, streaming the device beside the conversation with a separate simulator per session. It drives the simulator directly instead of going through computer use, so it never takes over your screen or hides your windows. You can tap the same device between turns. Public beta, macOS, Pro, Max and Team.