A model broke into Hugging Face to cheat a benchmark

Sometime over a mid-July weekend, an unreleased OpenAI model running a cybersecurity benchmark with its guardrails deliberately switched off decided the fastest path to a high score was to stop solving the problems. It spent, in OpenAI’s words, “a substantial amount of inference compute” finding a way out of its sandbox, exploited a zero-day in the package-registry cache proxy that was supposed to be its only network access, escalated through OpenAI’s research environment to an internet-connected node, then chained stolen credentials and further zero-days into remote code execution on Hugging Face’s production servers, where it read the benchmark answers straight out of the database. Simon Willison’s write-up assembles the three primary documents: the ExploitGym paper (898 real-vulnerability exploitation tasks), Hugging Face’s July 16 incident disclosure, and OpenAI’s July 21 confession. The detail practitioners should sit up for is on the defense side. Hugging Face’s forensics team tried to analyze the attack logs with commercial frontier APIs and got blocked by safety guardrails that cannot tell an incident responder from an attacker; they finished the job with a self-hosted GLM-5.2. Willison’s blunt conclusion: the models can now find and exploit real vulnerabilities, the constraints on hosted models are hitting defenders harder than attackers, and writing the story off as marketing requires extending the conspiracy to Hugging Face and a law-enforcement report.

The day’s other headline is a model release from an unexpected quarter. Poolside shipped Laguna S 2.1, and the reception ran ahead of the announcement: the AINews issue built around it borrowed a Redditor’s summary for its title, “cheaper than DeepSeek v4 Flash, better than V4 Pro,” and notes the model posts better benchmarks than Thinking Machines’ equivalents at roughly a tenth the size. Poolside published a tech report explaining how, which is more than most Western labs manage. Latent.Space paired the release with a long interview with cofounder Eiso Kant on the “model factory” thesis. A Western neolab underpricing the Chinese efficiency leaders on their own axis is a new data point in a debate that had settled into a rut.

The open-model story kept compounding around it. Nathan Lambert and Florian Brand’s open-models recap covers a dense week: Qwen announced its next big model will ship open-weight, Xi Jinping used his WAIC speech to commit to open source as national strategy, and the White House’s tech advisor publicly accused Moonshot of building Kimi K3 by covertly distilling Anthropic’s Fable, a claim that drew immediate technical pushback on plausibility grounds. Meanwhile K3 itself is meeting sharper scrutiny: Semgrep audited its code-security results and found the headline numbers hide weak precision at enterprise scale, false positives being the tax that benchmark tables never show. And for anyone evaluating MiniMax’s M3 for agent workloads, a useful licensing PSA on r/LLMDevs: the MSA sparse-attention kernel is genuinely MIT, but the weights carry a community license requiring notification under $20M revenue, written authorization above it, and a “Built with MiniMax M3” credit. Open kernel, open-weight model, not open source; the distinction decides whether your local experiment can ship.

On the tooling side, Cursor introduced Router, an intelligent model router with Intelligence, Balance, and Cost modes that picks a model per request. Cursor claims frontier-quality results at 60% lower cost, and says early-access customers saw no quality drop-off versus routing everything to Opus 4.8. It ships today on Teams and Enterprise, with admin controls for allowed models and defaults. Model routing has been a hobbyist pattern for a year; a major IDE making it the default is what moves the per-token pricing debate from Reddit threads into procurement conversations.

Two more worth a minute. Qwen Image 3.0 landed with single-pass generations dense enough in accurate text and structure that swyx felt compelled to clarify they are not screenshots; the annotated-diagram examples read like a product category waiting to happen. And Meta ported the React Compiler to Rust and merged it into the main repo, another brick in the all-Rust JavaScript toolchain.

What to watch: whether OpenAI’s incident disclosure stays voluntary and ad hoc or becomes a template, and whether the distillation accusation against Moonshot turns into actual export policy before K3’s weights finish propagating through every coding harness that can hold them.