Newsletter · July 26, 2026
Weekly Digest 30
OpenAI models broke out of a sandboxed cyber test and hacked Hugging Face, Anthropic commits two gigawatts to AMD's Helios racks as Nvidia's software moat slowly erodes, and Stripe's reported $10 billion approach for OpenRouter asks where model routing belongs in the stack.
Topics we are tracking
OpenAI models broke out of a test and hacked Hugging Face
Source: OpenAI — Hugging Face model evaluation security incident
Last week Hugging Face disclosed that an autonomous agent system had breached part of its production infrastructure. This week OpenAI published a post revealing that the attack had been carried out by OpenAI models running an internal test.
GPT-5.6 Sol and an unnamed, more capable pre-release model were running ExploitGym, an internal cyber-capability benchmark, with safety classifiers switched off to measure maximal capability. The test environment was not supposed to allow any access to the internet, but the models spent substantial inference compute to find and exploit a zero-day vulnerability, and then reached the open internet. They inferred that Hugging Face probably hosted ExploitGym solutions, then chained stolen credentials with further zero-days into remote code execution on Hugging Face servers and read the test answers out of the production database. OpenAI's own description is that the models were hyperfocused on solving the evaluation and went to extreme lengths for a narrow testing goal.
To anybody who has been paying attention to the field of AI alignment, this will sound very familiar, and in line with the warnings from the AI safety community. It is perhaps a bit ironic that this kind of problem was first set out in a 2016 paper, “Concrete Problems in AI Safety”. Among its authors were Dario Amodei and Chris Olah, both at Google Brain at the time and later co-founders of Anthropic, as well as John Schulman, part of the founding team at OpenAI and later a co-founder of Thinking Machines. The people who first raised these possibilities are now leading the companies that are building the very machines they warned about.
After Anthropic's numerous warnings about Mythos-class cyber capabilities and the phased rollout of Project Glasswing, the company drew a lot of pushback online for being overly cautious and alarmist about these models, and was accused of pursuing a regulatory lock-in strategy and talking its own book. Some of that criticism was justified at the time. This kind of cyber attack, however, vindicates Anthropic. It further reinforces our belief that AI alignment is one of the most important issues of this century, ahead of climate change or pandemic preparedness. Not because those issues are unimportant, but because they are not as urgent as AI alignment.
In order to reconstruct the attack, Hugging Face tried hosted frontier models, which refused the requests because a safety filter cannot distinguish an incident responder from an attacker. They ran the forensics instead on GLM 5.2, an open-weight Chinese model, on their own infrastructure. This means the safety filter is working, but it also means that everyone not invited by the frontier labs to access their most advanced cyber models to patch their own software is vulnerable to attacks. This will increasingly become a problem, especially since on Monday 27 July Moonshot is scheduled to publish the full 2.8-trillion-parameter weights of Kimi K3. On most benchmarks K3 is at least on a par with GPT-5.6, so any actor with a large enough GPU fleet can download the model, modify it, and use it to perpetrate this kind of attack.
Hugging Face is one of the leading European tech companies, with a GPU fleet large enough to run a frontier open-weight model on premises for forensics and with in-house machine-learning and security engineers. What happens to an organisation without those? The Verizons and Walmarts of this world are probably less exposed here than the mid-sized companies inside a larger supply chain, whose compromise could cascade well beyond them.
Anthropic commits to 2GW of AMD Helios racks
On Wednesday AMD announced that Anthropic will deploy up to two gigawatts of Instinct MI450 GPUs in AMD's Helios racks, with the first gigawatt starting in the first half of 2027. AMD will invest up to $5 billion in Anthropic, tied to deployment milestones, and Anthropic has reportedly committed to buying tens of billions of dollars of chips over the term. AMD has also announced that Microsoft will run Helios on Azure for frontier model inference.
One Helios rack holds 72 MI455X GPUs with EPYC Venice CPUs and Pensando networking. The MI455X is the most advanced chip coming out of a fab today, and the first 2nm data-center chip while the competitors are still on 3nm. Twelve stacks of HBM4 give it 432GB per package against 288GB for Nvidia and Google. Nvidia stays close on bandwidth because its pins run 40% faster. Memory suppliers had to rework their HBM4 to hit that spec, which was a gamble for Nvidia, and it paid off.
AMD has made real progress on its software ecosystem. On a single node, Kimi K2.5 interactivity improved 18x, MiniMax M3 now matches B200 performance, and support for vLLM and SGLang is much better and quicker to respond to new model releases.
Model architecture trends favour MoEs with higher expert counts and MLA-style low-rank designs for attention, which means more sparsity, wider expert parallelism and more sensitivity to bandwidth. This drives inference increasingly towards multi-node and disaggregated serving, where the ROCm ecosystem still trails CUDA. Open-source stacks have been shipping disaggregation with wide expert parallelism on CUDA since early 2024, while AMD's first public recipes landed in January 2026, so this is not surprising.
The software ecosystem seems to be becoming less of a moat for Nvidia, but it is diminishing very slowly, and the frontier is moving ever faster with new model releases and architecture tweaks launching every week. Each new architecture brings its own attention variant, expert routing scheme and quantisation format, and every one of those needs new kernels, new parallelism strategies and new scheduling work on both stacks before the hardware runs it well. Nvidia still holds a large lead in inference with Dynamo, its distributed serving framework, and TensorRT-LLM, and it reports up to 2.28x higher per-GPU output throughput from wide expert parallelism alone.
Speaking with Lisa Su at Advancing AI on Wednesday, Anthropic co-founder and chief compute officer Tom Brown said that his team had expected porting their model to new hardware to be a big project. Instead an engineer pointed Claude Code at an MI355X rack on a Friday and left it running. By Monday the performance curve for Anthropic's frontier model had climbed all weekend. Agents can clearly write working kernels. Whether they write optimised ones is a different question.
Stripe in talks to buy OpenRouter for $10bn
Source: The Wall Street Journal — Stripe in Talks to Buy Buzzy AI Model Marketplace OpenRouter
The Wall Street Journal reported that Stripe is in talks to buy OpenRouter for around $10 billion. OpenRouter was founded in 2023. It puts more than 400 models from around 70 providers behind a single API and takes a percentage markup on each model's base price. Annualised revenue was roughly $50 million in April, according to The Information. Weekly volume grew from 5T to 25T tokens in the six months to May.
Ramp also opened its internal router to customers this week. Ramp runs more than 100 AI use cases through it across products serving 70,000 customers, and says it cut the company's own AI bill by 30%. It tests every new model on real work and sends each request to the cheapest one that clears the quality bar. Two days after that, Runway launched a router for generative media, sending video, image and audio requests across models for customers including Adobe, ElevenLabs, Expedia and Shutterstock. Cursor and Meta are building routers too.
The open question is where the router best sits in the stack. Ramp is betting model routing can stand on its own, and Stripe is betting the same with billing rails already attached. It is a hard market for a new entrant either way, since everyone above and below can bundle: hyperscalers, inference providers and database companies can all add routing as an extension of what they already sell.
AWS put intelligent prompt routing into Bedrock in preview in December 2024 and general availability in April 2025, and its own tests claimed 60% savings against using Sonnet uniformly. Azure AI Foundry has a native router with cost, quality and balanced modes. Both have the same designed-in limit: Bedrock routes within a model family, Azure routes among Azure-hosted models. A router owned by the party selling the models optimises for the seller.
Inference providers can only offer open-weight models and cannot route to Claude, GPT or other closed models. They also mostly rent their compute. Fireworks runs at 30% to 40% gross margins because of it, and Lin Qiao has said moving down the stack into data centers is possible eventually while ruling out any move up into the application layer.
Neoclouds sell into a very concentrated buyer base. CoreWeave's top two customers were around 65% of revenue in the first quarter, down from a 72% peak a year earlier. Long fixed-duration deals with a handful of very large buyers are a different business from selling routing to enterprises. What decides whether the neoclouds need to care about routing at all is the diffusion of open weights and the race between open and closed models. If open weights keep converging on the frontier, inference volume moves to whoever hosts them and routing becomes strategic. If the closed labs hold a durable lead, the neoclouds stay wholesale capacity providers and routing is somebody else's problem.
We think the database and ontology companies are best positioned to build the highest-quality router. Routing quality depends on knowing how hard a task is, and what makes a task hard is the data and the schema it touches. Databricks and Snowflake both shipped semantic layers in June — Genie Ontology and Cortex Sense respectively. Databricks' Unity AI Gateway pairs smart routing with enforced spend caps and cost attribution by user, team, tool and use case. Palantir made ontology a commercial category, and we have written previously about why we think it is well positioned to capture this market.
Model routing is mostly discussed as cost saving and picking the right model per task. The under-discussed part is model fusion. OpenRouter Fusion sends a prompt to a panel of models in parallel, each with the same tools, then has a judge model review the outputs, mark where they agree and disagree, and synthesise a single answer. On 100 deep research tasks from the DRACO benchmark, a panel of Fable 5 and GPT-5.5 judged by Opus 4.8 scored 69.0%. Fable 5 alone scored 65.3%, GPT-5.5 60.0% and Opus 4.8 58.8%.
A panel beats every model in it
Fable 5alone
GPT-5.5aloneOpus 4.8aloneA router that only optimises for cost will end up at the database or hyperscaler level. Model fusion is the more interesting business. The advantage comes from panel composition, judge selection and how you resolve disagreement rather than average it. A panel of models that includes the customer's own fine-tuned models also opens a new frontier.
Seen on X
Other interesting stories
- Financial Times: Samsung in talks to invest in Mistral at €20bn valuation
- Bloomberg: Retina Chip Designed to Restore Sight to Go on Sale in Europe
- The Argument: Bernie's bad bet on OpenAI
- Reuters: Google plans new chip to run Gemini models more efficiently, The Information reports
- The Information: Oracle Data Centers Face Multibillion-Dollar Cost Surprises
