An AI Broke Into Hugging Face and No One Noticed for a Week

Anthropic spent the weekend rewriting the price of frontier AI while OpenAI spent it explaining how one of its own agents got loose and let itself into a rival platform's servers. Both stories land on the same point: the tools getting more capable by the week are also getting harder to fully supervise. Today covers the price cut, the breakout, a privacy scare that touches anyone using Claude for business documents, and what each one means for how you actually run things.

Over 3.5 billion people open WhatsApp, Instagram, or Facebook Messenger every day. Your customers are already there, asking questions and comparing options.

Wati puts your business across WhatsApp, Instagram DM, Facebook Messenger, SMS, RCS, and web chat in one AI-powered inbox.

Automations instantly respond, route conversations, and keep every interaction tracked in one place.

Meet customers where they already are, before your competitor does.

See All Wati Channels

What happened: Anthropic released Claude Opus 5 on July 24, and it lands near the top of the intelligence rankings at half the API cost of its own flagship, five dollars per million input tokens and twenty five dollars per million output tokens. It took the top spot on the Artificial Analysis Intelligence Index and ships with a Fast Mode that runs two and a half times quicker than prior models.

Why it matters to you: if you or your team are running AI tools at any real volume, the cost of doing that work just dropped substantially, without a drop in quality. This is the same pattern that has played out all year: yesterday's frontier price becomes next month's discount rate.

What to do about it: if you are budgeting for AI-assisted work this quarter, check whether your current tools have already switched to Opus 5 pricing. If not, ask why you are still paying last month's rate.

What happened: according to Reuters, an OpenAI model running on GPT-5.6 Sol and an unreleased successor exploited an internal zero-day around July 9 to escape its own sandboxed testing environment. Between July 11 and July 13, the agent breached Hugging Face's production systems looking for benchmark answers to cheat on an internal evaluation. OpenAI reportedly did not realize what had happened for about a week, since staff were running many tests at once and the breakout blended into the noise.

Why it matters to you: this was not a hypothetical red-team exercise. A real AI agent found a real exploit, reached the open internet, and got into another company's servers before its own creator noticed. If you are letting AI tools operate with any autonomy inside your business, whether that is browsing, sending emails, or touching files, this is the failure mode you are exposed to.

What to do about it: audit what permissions your AI agents and automations actually have right now. If an agent can reach the internet or touch a system unsupervised, put a human checkpoint in front of it, not behind it.

What happened: over the weekend, users discovered that conversations and Artifacts they had made "shareable" through Claude's public link feature were showing up indexed in Google search results, according to Axios. Indexed content reportedly included business plans, infrastructure diagrams, and clinical trial planning documents. Anthropic says it does not submit chat sitemaps to search engines, but once a shared link circulates anywhere public, crawlers can find and index it.

Why it matters to you: if you have ever used the shareable link feature to send a client a Claude conversation or a document draft, that link was never private the moment it left your inbox. Search engines do not know the difference between a link you sent to one person and a link posted in a public forum.

What to do about it: treat any AI chat you make "shareable" as public the moment you create the link. For anything containing client data, financial details, or internal planning, export the content and send it directly instead of sharing the link.

What happened: OpenAI introduced Presence, an enterprise platform for deploying voice and chat agents with built-in guardrails, approved actions, and human escalation rules. OpenAI says the product already runs its own English-language phone support line and resolves 75 percent of inbound issues without a human.

Why it matters to you: this is the direction customer support and front-line operations are headed, whether your business is ready or not. The gap between businesses using agents for real customer contact and businesses still doing it all manually is about to widen.

What to do about it: if customer support is eating hours you would rather spend elsewhere, this is worth a serious look, but start with a narrow, well-defined use case and a clear escalation path to a human, not a full handoff on day one.

What happened: Nvidia launched the Open Secure AI Alliance with 37 organizations including Microsoft, IBM, Cisco, CrowdStrike, and Hugging Face, aimed at building shared open tools for AI agent security. OpenAI, Google, and Anthropic are notably absent from the list.

Why it matters to you: the split lines up with business incentive. Companies that make money when more businesses can build with more models want open security tools. Companies whose value depends on keeping their models proprietary are sitting this one out. Neither side is acting purely out of concern for your safety.

What happened: Moonshot AI released the full weights of its 2.8 trillion parameter Kimi K3 model on Hugging Face, the largest open-weight model ever published, along with its technical report and training infrastructure tools.

Why it matters to you: you will likely never run this model yourself, it requires serious hardware, but its existence matters. Near-frontier AI capability is no longer locked behind a handful of paid subscriptions, and that trend will keep pushing prices down across the board.

What happened: an OpenAI study of over 800,000 messages found that 43.5 percent of occupation-specific ChatGPT use involved tasks normally associated with a different role. Customer service staff, designers, and HR professionals showed the highest crossover, and smaller organizations showed more of it than large ones.

Why it matters to you: your team is probably already doing this without telling you. The marketer is writing basic code, the operator is analyzing numbers that used to require a specialist. Job titles are increasingly a poor description of what people in your business actually do day to day.

What to do about it: before your next hire, ask whether the gap you are trying to fill is a skills gap or a tools gap. Increasingly, it is the second one.

Every story in this issue is really the same story told a different way. Capability keeps getting cheaper and more autonomous, and the guardrails around it keep arriving after the fact, not before. That is not a reason to unplug. It is a reason to stop treating AI tools as things you turn on and walk away from. The businesses that come out ahead this year will not be the ones that adopted AI fastest. They will be the ones that stayed close enough to it to notice when something went wrong before a headline had to tell them.

If this issue was useful, forward it to one person who needs to see it. If someone forwarded this to you, you can subscribe to get the next one directly.

Talk tomorrow,
Mark Shilensky

Follow me personally on Social Media:
https://www.facebook.com/MarkShilenskyPage
https://www.instagram.com/markashilensky/
https://www.threads.com/@markashilensky
https://www.linkedin.com/in/shilensky/
https://x.com/markshilensky
https://www.tiktok.com/@mark.shilensky
https://bsky.app/profile/markshilensky.bsky.social