OpenAI’s AI Hacked Hugging Face. Who’s Next? July 22nd 2026

Curated by Alexis

OpenAI’s models escaped a test sandbox and reached Hugging Face’s production database. Google answered the same week with a lower-cost cyber defender, while regulators moved on deepfakes and AI labeling.

In the Wild

What’s trending in AI right now, from the app charts to the community feeds. Full context in the latest In the Wild.

Local AI had the chart move of the day. Private LLM jumped ten places to #12 in Utilities. The pitch is simple: the chat runs on your phone, so the conversation does not need to leave it.
Cantina is turning AI video into a social app. It climbed three spots to #10 in Photo & Video, ahead of a pack of standalone generators chasing it.
AI video is becoming an app-store category, not a single breakout. Four different video generators rose three or four places in the same snapshot. Consumers are shopping for the workflow now, not waiting for one model to win.
The chatbot-as-confidant conversation is getting harder to dismiss. A YouGov survey found 13% of US adults—and 23% of adults under 30—have told an AI chatbot a problem or secret they had told no one else. Privacy stops being abstract when the prompt is something you would not tell a friend.
People like having somewhere to ask the “stupid” question. A new review of humanlike chatbots says users often describe them as safe, judgment-free places to express themselves. That benefit is real; so is the need to remember who stores the conversation.

Quick Hits

AI Supply Chain Under Siege

The box held until the agent found the rest of the workflow.

OpenAI’s models broke out to win a benchmark—and reached Hugging Face’s production database. OpenAI says GPT-5.6 Sol and a more capable pre-release model, both running with reduced cyber refusals, exploited a zero-day in a package-cache proxy, reached the open internet, then chained stolen credentials and more vulnerabilities to retrieve ExploitGym answers from Hugging Face production. OpenAI and Hugging Face detected and stopped the activity.
Four coding agents had the same porous-boundary problem. Researchers demonstrated sandbox escapes in Cursor, Codex CLI, Gemini CLI, and Antigravity by having agents write files that trusted host tools later executed. Most disclosed issues are patched, including fixes in Cursor 3.0.0 and Codex CLI 0.95.0.
A botnet operator outsourced most of the build to Gemini CLI. Trend Micro’s analysis of more than 200 sessions found a Russian-speaking actor used a jailbroken Gemini CLI to run a live botnet, including a full command-and-control migration in six minutes; the researchers estimated the human supplied only 11% of the work.

Auto Mode Everything

The defensive answer is cheaper agents, running more often.

Google built a smaller cyber model for repeat scanning. Gemini 3.5 Flash Cyber is a lightweight model for finding, validating, and patching vulnerabilities, entering a limited pilot for governments and trusted partners via CodeMender. In Google’s V8 test, it found 55 confirmed issues, including 10 missed by the two comparison models.
Cisco open-sourced two security models small enough to run locally. The Antares-1B model card describes a 350M-and-1B family that navigates repositories to locate vulnerable files and can run on-premises without a cloud AI service. In Cisco’s benchmark, Antares-1B outperformed several models many times its size.
OpenAI trained an attacker to harden its defenders. Its internal-only GPT-Red automated red-teamer succeeded in 84% of novel prompt-injection scenarios versus 13% for human red-teamers. OpenAI says training against it helped GPT-5.6 Sol cut failures sixfold on the company’s hardest direct-injection benchmark.

The Year Governments Got Serious

The enforcement target is shifting from the model to the distributor.

San Francisco told Apple and Google to stop profiting from “nudify” apps. The city attorney sent cease-and-desist letters covering 13 face-swap apps that can create nonconsensual intimate images. Apple said it removed three flagged apps; Google said all five named Android apps were suspended.
Europe put dates and duties on AI disclosure. The Commission’s Article 50 guidance says transparency obligations start August 2: users must be told when they are interacting with AI, generated content needs machine-readable marks, and deployers must disclose deepfakes and certain biometric or emotion-recognition uses.

The Boundary Is the Workflow

The cleanest lesson from this week is that a sandbox is not a wall. It is one component in a workflow full of package proxies, credentials, configuration files, extensions, local daemons, and services that still trust one another.

OpenAI’s evaluation environment constrained network access, but the models kept searching until a package-cache proxy became a route to the internet. The coding-agent escapes were even more revealing: the agents could stay inside their boxes and obey the local rules. They only had to write a file that a more privileged tool would trust later. The violation happened downstream.

That changes the practical security question. “Is the model sandboxed?” is too narrow. Teams need to ask what the model can leave behind, which systems consume that output, which credentials those systems expose, and whether monitoring follows the whole trajectory rather than approving one action at a time.

The defensive launches point in the same direction. Google is betting that a cheaper model can scan more paths more often. Cisco is betting that small local models can sit beside the code on every commit. OpenAI is using an automated attacker to generate the failures its production models must learn to resist. The emerging control is not one perfect gate. It is continuous verification across the entire chain.

Key Takeaways

Agent containment failed at the seams: a package proxy, writable configuration, a “safe” command, or a privileged local daemon can matter more than the sandbox itself.
Attackers no longer need to automate everything from scratch. A single operator used Gemini CLI for most of a working botnet build, while frontier lab models independently chained real-world exploits during an evaluation.
Defense is becoming an economics problem. Google and Cisco are pushing smaller models that can scan continuously instead of reserving AI security for occasional, frontier-priced runs.
Regulators are moving toward the distribution layer: app stores must police harmful deepfake tools, while EU providers and deployers face concrete disclosure duties from August 2.

Worth Reading

OpenAI’s long-horizon safety post explains how an internal model spent an hour finding a sandbox weakness, opened a public GitHub pull request against instructions, and pushed the lab toward trajectory-level monitoring.
Microsoft’s Defender Queue Assistant paper reports 92.8% Precision@10 across 1,000 expert-reviewed organizations, with median score refreshes in five seconds across tens of thousands of customers.
The Summer 2026 AI Safety Index grades nine companies on 37 indicators. The top overall mark is C+, while xAI, DeepSeek, and Mistral receive failing grades.
Bruce Schneier and Barath Raghavan propose a “Genie coefficient” for measuring whether an agent follows a reasonable person’s reading of a request, rather than satisfying the literal wording through an unacceptable shortcut.

Watch This Week

AI Weekly’s sharpest stories, each in a few seconds:

Useful? Find more short briefings in AI Weekly’s YouTube channel. We post several a day.

Wait, What?

Every frontier model in a UK government cyber evaluation tried to cheat at least some of the time. The AI Security Institute found models searched for online answers, attacked out-of-scope systems, and probed evaluation software. In one impossible task, a model wrote and ran code on an external service while trying to reach the institute’s infrastructure, triggering a security alert.