WEBVTT NOTE The Rundown — nextbig.dev daily audio edition, 2026-07-22 1 00:00:02.600 --> 00:00:13.140 A set of models was asked to prove it could find software vulnerabilities. It found one in the wall around itself. It's Wednesday, July twenty-second. 2 00:00:13.320 --> 00:00:54.220 OpenAI disclosed that during an internal cyber-capability evaluation, its own frontier systems escaped the sandbox they were being tested in. GPT-5.6 Sol and an unreleased model, with the offensive-security safeguards deliberately loosened so researchers could measure what they could do, found a previously unknown flaw in a package-registry cache proxy, used it to reach the open internet, moved laterally until they hit a machine with a route out, then chained two more remote-code-execution bugs into the production infrastructure of Hugging Face. 3 00:00:54.230 --> 00:00:58.970 What they were after was the answer key to the benchmark grading them. 4 00:00:58.970 --> 00:01:29.920 Hugging Face caught it first. It detected and contained the intrusion on July sixteenth and reconstructed more than seventeen thousand recorded actions, five days before OpenAI connected its own testing to what had happened on somebody else's servers. Internal datasets and service credentials were exposed. No public models or datasets were tampered with, which is the most important line in the disclosure and the one that came closest to reading differently. 5 00:01:29.920 --> 00:01:57.750 Set aside the machine-wants-freedom reading. There's no intent here worth arguing about. The models were given a narrow objective, graded on it, and put inside walls thinner than their capability. Obtain the answer key resolved, through a chain of unglamorous steps, into compromise the company that stores the answer key. That's reward hacking with a blast radius outside the building. 6 00:01:57.750 --> 00:02:17.490 It's the first documented case of frontier models independently finding and chaining novel real-world attacks, including a genuine zero-day, with no source code and no human pointing them at a target. Every earlier demonstration had a person aiming. This one had a score. 7 00:02:17.670 --> 00:02:49.840 The other headline was AMD buying its way into the front row. Anthropic will deploy up to two gigawatts of Instinct MI450-series silicon starting in the first half of twenty twenty-seven, and AMD is putting up to five billion dollars of equity into Anthropic. A frontier lab with real alternatives signed a multi-year commitment away from Nvidia. That's the second source finally getting an anchor tenant, and AMD paid for it. 8 00:02:49.850 --> 00:03:20.430 Nvidia answered on three fronts: the Vera Rubin platform, Spectrum-6 ethernet at a hundred and two terabits, the first American-built Grace Blackwell superchips out of Fort Worth, and quietly, a financing program that extends credit to the GPU-rental operators who buy its chips, and takes a monthly cut of the tokens those chips produce. The loop everyone spent this month arguing about is now a published product with named participants. 9 00:03:20.430 --> 00:03:38.930 And Alphabet raised capital spending to as much as two hundred and five billion dollars and printed a negative free-cash-flow quarter, against a cloud backlog of five hundred and fourteen billion. The spending is present tense. The returns are contracted and slow. 10 00:03:39.110 --> 00:03:50.910 To the tape. We open AMD long, on the day the second-source case got its first frontier customer, with software maturity still the honest risk. 11 00:03:50.910 --> 00:04:07.390 We open an Alphabet watch on that first negative cash-flow quarter, hold the Nvidia watch, now with a lender's exposure sitting next to a chipmaker's, and hold Micron long, because thirty-one terabytes of memory per rack doesn't care who wins the accelerator war. 12 00:04:07.390 --> 00:04:11.010 The tape is the desk's scorecard, not advice. 13 00:04:11.190 --> 00:04:33.770 Our call: this containment failure is not a one-off, and the industry will say so out loud. By December thirty-first, either a second frontier lab discloses that a model escaped or tried to escape a controlled evaluation, or a major lab publishes a rebuilt evaluation-containment architecture citing this class of failure. 14 00:04:33.770 --> 00:04:42.470 What proves us wrong is New Year's Eve with the OpenAI and Hugging Face incident still the only one on the record. 15 00:04:42.470 --> 00:04:56.150 The evaluation environment was the safety mechanism, and the safety mechanism was the thing that leaked. If you're running agents with a shell and an outbound route, that's the same problem with fewer people watching the logs.