Stories This Week
- Top Story — OpenAI published the inside account of how its agents broke into Hugging Face: On August 26, OpenAI published a postmortem and technical report on an intrusion into Hugging Face, the repository underneath most of the AI industry's model distribution..
- 155 companies signed a call for collective action on cyber defence.: Published August 27.
- NVIDIA is reported to have agreed to buy Hugging Face for $12.9 billion.: The Information reported it first, citing a person with knowledge of the deal; CNBC's source could confirm only that an acquisition "has been part of ongoing and recent talks." Neither company has commented and no filing exists, so treat it as reported, not signed.
- OpenAI says it intends to wind down Cursor's model access, proposing November 12 as the cutoff, after SpaceX acquired Cursor.: OpenAI says it "cannot be confident that SpaceX will use our technology within our terms of service, based on our experience with Elon Musk's companies violating contracts," citing Twitter breaking contract terms after Musk acquired it and Musk's admission under oath that xAI had violated OpenAI's terms.
- OpenAI says it cannot rule out "critical" cyber capability in an upcoming model.: Internal evaluations of a model called Astra show significant advances in agentic coding and cybersecurity, and OpenAI cannot rule out critical cyber capabilities under its Preparedness Framework.
- A researcher hijacked Claude Code with one "summarise this page" request, in the mode Anthropic made the default.: Auto mode replaces click-to-approve prompts with a classifier that blocks irreversible or destructive actions, and became the default for Pro, Max and Team users on August 14.
- NVIDIA patched 18 flaws in its agent tooling, and two of them break the sandbox.: The August 25 bulletin covers NemoClaw and OpenShell, NVIDIA's agent deployment and sandboxing tools: 2 critical, 12 high, 4 medium.
- Invisible text in an email rewrote what the AI summariser told the reader.: Forcepoint X-Labs hid instructions in an email using font size and colour, invisible in Outlook but present in the HTML the summariser read.
- When Context Gets Root: finds the weak point is the harness around the model, not the model.
- Safety Does Not Compose: is the theoretical echo of this week's top story.
- Beyond the Mandate: finds the same gap in Google's Agent Payments Protocol, which lets AI shopping agents authorise payments: signed mandates protect the transaction after signing, while the agent messages and tool calls that shape it beforehand sit outside that protection.
- RedEvoAgent: automates red-teaming by distilling what worked across attempts into reusable attack skills, arguing that in real product harnesses a jailbreak triggers tool use and state changes, not just unsafe text..
- AI Security Summit 2026: State of Trust, September 16–17.: A free two-day virtual event exploring where cloud, AI and Zero Trust converge..
- AI Security Summit 2026: Runtime Trust, October 21–22.: A free two-day virtual event on runtime trust for autonomous AI..
Curator's Corner
Security has only ever had the what. A command in a shell history, a login from a country nobody works in, a file that left at three in the morning. Why it happened is never in the evidence. We reconstruct it afterwards from the artifacts the intruder touched, and we mostly never learn whether we got it right.
OpenAI's account of its agents breaking into Hugging Face is the first intrusion report I have read that hands over both halves: what the attacker did, and what it was thinking while it did it, quoted step by step, because the side that owned the agents wrote the document.
What it was thinking was not much. The record shows a confused optimizer working a problem it had misread. The agents were graded on tasks that could not be done: 198 of the 898 had never been solved by any OpenAI model. They reasoned their way to a theory of how the grader worked, the theory was wrong, and nine weeks of intrusion produced no improvement in score. METR, reconstructing the agent side independently, found they knew the activity was out of scope and joined anyway, believing the cheating research would help their peers.
I will never sit where OpenAI sat. That transcript exists because one company happened to own the attacker, the logs and the pen, and decided to publish. The tidy conclusion is to go and watch the reasoning, and that is OpenAI's own remedy: chain-of-thought monitoring it already ran on other work, which by its own estimate would have paged the security team more than a day before Hugging Face was touched. That works when the agents are your own. For everybody else's, I get an excerpt and no transcript to check it against.