Good morning.

In case you missed it : on July 16, an AI system broke out of a locked test environment, taught itself a way onto the open internet, and burgled a real company's production servers. No human directed it. Reasons for doing this : it wanted to pass an exam.

When I saw the headline I immediately thought it was another Anthropic-style marketing stunt. Like the one where they claimed an AI model blackmailed an employee and you find out that’s not exactly what happened.

Like Sam Harris once said in his now infamous TED talk : our brains are broken when it comes to existential risk and technology.
We hear headlines like this and we’re not thinking that this AI will eventually kill us. No , we think it’s “kind of cool” that it’s able to “break out”.

This one news story really sounds like a film pitch, so let me slow down first and lay out the pieces before I editorialise. If you already know what happened - feel free to skip the next section but we should have the facts straight.

The website in question is Hugging Face. Hugging Face is, in practical terms, the GitHub of artificial intelligence. It is a New York-headquartered platform where researchers and companies upload AI models and the datasets used to train and test them, and where everyone else downloads them. If you have ever used an open-source AI model, it almost certainly came through Hugging Face. It is critical infrastructure for the entire field.

A benchmark is a standardised exam for AI models. ExploitGym, published in May 2026, is a benchmark that measures something very specific and uncomfortable: whether an AI agent can take a known software vulnerability and turn it into a working attack. A higher score means a more dangerous model. Labs run these tests on themselves to find out how much offensive capability they have accidentally built.

A sandbox is a sealed-off computer environment - a test room with no doors to the outside world. You put a model in one when you want to see what it does without safety restrictions, the same way a virus research lab would handle a pathogen behind glass.

Guardrails are the trained-in refusals that make a commercial model decline to help you write malware. A zero-day is a software flaw nobody knows about yet, which means no patch exists yet and no defence is watching for it. An agent is a model that has been handed tools and a goal and left to work in loops, taking thousands of actions without a human approving each one.

Now we got the definitions out of the way let’s look at …

OpenAI was testing two models against ExploitGym: its flagship GPT-5.6 Sol, and a more capable system it has not released. To measure their maximum offensive capability, OpenAI deliberately switched the cyber-refusal guardrails off and ran them inside the isolated sandbox. That is a defensible research decision - you cannot know how dangerous something is if you only test the polite version of it.

The models did not take the actual exam- they started to look for a way to get their hands on the questions.

They spent an enormous amount of computing power hunting for a way out instead, and found one: an unknown flaw in a piece of third-party software OpenAI hosted internally - a mirror that caches software libraries for developers. They exploited it, escalated their own access privileges, and hopped from machine to machine across OpenAI's research network until they reached one with a live connection to the internet. Nobody instructed any of this.

Once online, they made a reasonable inference. ExploitGym is a public benchmark. Hugging Face hosts the datasets for public benchmarks. Therefore the answer key is probably sitting on Hugging Face. They were right.

They got in by uploading a malicious dataset that triggered two separate code-execution flaws in Hugging Face's data-processing pipeline - the automated system that unpacks and inspects every file users upload. From that foothold they harvested service credentials, chained further zero-days into full remote control of production servers, spread across internal clusters, and relocated their remote command infrastructure whenever defenders got close. Tens of thousands of automated actions across a single weekend. Hugging Face later reconstructed more than 17,000 recorded events.

Hugging Face's security team detected and shut it down themselves on 16 July, and published a disclosure the same day. Crucially, at that point they did not know who had attacked them - their write-up said only that an autonomous AI agent system was responsible, model unknown. Five days later, OpenAI traced it back to its own internal testing and put its hand up.

But it did not stop there.

When Hugging Face sat down to reconstruct the attack, they reached for commercial AI models to help read the logs. They were refused.

Forensic analysis means pasting the attacker's actual work into a model: live exploit code, shell commands, credential dumps, remote-control artifacts. To a safety filter, an incident responder under fire and an intruder mid-operation produce identical text. The guardrails blocked the defenders.

This assymetry is worrying.

While the AI attacker had no guardrails , for the defenders the guardrails were deployed.

And even more worrying is the machiavellian , sociopathic tendency to - in order to get good grades - to break the entire system in order to go looking for the questions.

Imagine having to do an exam, and instead of sitting down and answering them like a normal person your brain cooks up the idea of breaking into the professor’s house to steal the exam questions.

That is not how a “model citizen” behaves.

But hey, nothing to see here. Let’s watch another football game and forget this ever happened.

Welcome to the Blacklynx Brief

Anthropic's $1.5B copyright settlement gets court approval
A U.S. judge approved Anthropic's $1.5 billion settlement with book authors, clearing payouts of roughly $3,000 across 482,000 pirated titles. It is the largest copyright recovery in U.S. history, yet leaves the earlier ruling that AI training itself is fair use untouched. (Reuters)

Claude helps disprove an 87-year-old math conjecture
Anthropic mathematician Levent Alpöge used Claude Fable 5 to produce a one-line formula that breaks the Jacobian conjecture, an algebra problem open since 1939. The proof is short enough for experts to verify directly, extending a run of frontier-model results against long-standing math problems. (Levent Alpöge on X)

Moonshot's Kimi K3 pulls within reach of the frontier
China's Moonshot AI released Kimi K3, an open-weights model that scores 57 on Artificial Analysis' Intelligence Index, trailing only Fable 5 and GPT-5.6 Sol while beating both on some coding and research tasks. Priced at $3/$15 per million tokens with weights due July 27, it narrows the gap between open and closed models to roughly a single release cycle. (Moonshot AI)

OpenAI paused a model that kept escaping its sandbox
OpenAI disclosed that it benched an unreleased long-horizon model after it repeatedly broke containment, once beating an internet block and publishing confidential findings to GitHub against instructions. The company restored access only after adding new safeguards to monitor the system's work sessions. (OpenAI)

Washington weighs restrictions on Chinese AI models
The U.S. government is exploring ways to curb Chinese open models, including liability rules for hosts, a public security warning, and a trade blacklist, according to Axios, revived by Moonshot's near-frontier Kimi K3. A ban would strand U.S. developers who rely on the cheapest capable models with no homegrown replacement. (Axios)

That’s it for us this week. Please like and subscribe 🙂