OpenAI’s AI Agent Escaped Its Sandbox and Breached Hugging Face

FEATURED INSIGHT💡

OpenAI’s Cyber Evaluation Escaped Its Sandbox

On July 21, OpenAI disclosed that an internal cyber-capability evaluation broke through its intended network boundaries and reached Hugging Face’s production infrastructure. A combination of GPT-5.6 Sol and a more capable pre-release model, running with reduced cyber refusals, found a zero-day vulnerability in a package-registry cache proxy, gained internet access, escalated privileges, and chained additional flaws and stolen credentials to reach Hugging Face servers. The models were pursuing a narrow goal—finding answers for the ExploitGym benchmark—but went far beyond the path their evaluators expected.

Hugging Face had disclosed the intrusion five days earlier, before the model provider was known. It reported unauthorized access to a limited set of internal datasets and several service credentials, while finding no evidence that public models, datasets, Spaces, container images, or published packages had been altered. Both companies say their investigations are continuing. Hugging Face rotated credentials and rebuilt compromised nodes; OpenAI tightened infrastructure controls and disclosed the proxy vulnerability to its vendor.

The important new angle is not another GPT-5.6 benchmark gain, but what happens when advanced agents are given an objective, tools, and enough compute inside an imperfect sandbox. The incident suggests that frontier-model evaluations must be treated like hostile-capability workloads: isolate package installation, eliminate unnecessary credentials, deny outbound access at multiple layers, monitor behavior independently, and rehearse containment. As models become better at chaining small openings into complete attack paths, the security of the evaluation harness may matter as much as the safety settings on the model.

How owning AI deployment expands your career

Across product, ops, and CX teams, a new kind of role is taking shape: the person responsible for making AI actually work, day to day. In this roundtable, three people living this shift share what it's really like: Simone Santiago Broad (Yoco), Yelva Espinoza (Zumba Fitness), and Fin's Dave Lynch. You'll hear how they carved out these roles, what the job looks like across industries, the skills they'd hire for, and the challenges they're tackling right now.

Watch the full conversation on demand.

Watch now

ON THE HORIZON 🌅

AI Is Spreading Across Jobs Without Taking Them Over

Google’s first AI & Economy ATLAS offers a unusually large view of what people actually do with generative AI. The study examines 15 million aggregated and de-identified interactions across the Gemini app, AI Mode, and the Gemini API, spanning more than 150 countries, 140 languages, 800 occupations, and 4,000 tasks. Because the sample comes from Google products, it is not a neutral census of all AI use, but it is far closer to observed behavior than a survey about what people say they might do.

The pattern is broad adoption with selective use. Workplace interactions appear across 68% of occupations representing 90% of U.S. employment, yet AI is used for only about 21% of tasks in a typical job. Fewer than 10% of workplace interactions fully automate a task; most support ideation, strategy, research, learning, or other collaborative work. Manual and technical workers are participating too, often using multimodal tools to interpret test results, diagnose machinery, and troubleshoot wiring.

That points toward a messy middle between “AI changes nothing” and “AI replaces the job.” The near-term advantage may belong to organizations that redesign individual tasks, train people to verify outputs, and connect assistants to the right context without pretending an entire role can be automated. ATLAS also found that more than 86% of interactions occur outside work, suggesting that household administration, product research, and everyday problem-solving may become a major source of AI value even when traditional productivity statistics miss it.

LATEST IMPORTANT NEWS 📰

ChatGPT Can Now Connect to Your Health Records

Health in ChatGPT is rolling out to U.S. users with optional connections to Apple Health, supported hospital records, One Medical, and Function Health. With permission, ChatGPT can compare lab results over time, summarize changes since an appointment, and relate activity or sleep data to a user’s questions. OpenAI says connected health data and conversations that use it will not train foundation models or target ads, access is permission-based by default, and disconnected data is deleted from its systems within 30 days. The feature could make scattered records easier to understand, but OpenAI cautions that it can make mistakes and does not replace professional care.

Meta AI Starts Planning and Acting Across Apps

Meta AI’s new Muse Spark 1.1 features can create recurring briefings, connect to email and calendar apps, conduct web research, generate slides, and adjust work while it is still running. The features began rolling out July 24 in select markets through the Meta AI app and meta.ai, with more countries and WhatsApp support planned. This is a different step from last week’s Muse Image story: Meta is moving from self-refining media generation toward a persistent consumer agent that remembers scheduled tasks and follows through across services, raising the stakes for permissions, privacy, and reliable action-taking.

Thirty-Two Organizations Rally Behind Open-Weight AI

A coalition hosted by Microsoft—including OpenAI, Meta, Nvidia, Hugging Face, IBM, GitHub, Mozilla, Mistral, Palantir, and Y Combinator—urged U.S. policymakers not to impose premature restrictions on open-weight models. The July 24 letter argues that downloadable models expand access, reduce vendor lock-in, strengthen competition, and let defenders inspect and improve critical systems. Its signatories acknowledge that released weights are hard to recall or trace, but favor targeted legal responses to misuse over broad limits on model access or legitimate distillation. The unusually wide alliance signals that model openness is becoming a central industrial-policy fight, not just a developer preference.

Introducing The First Agentic CRM

Get revenue agents, workflows, and automations across every stage of your motion. Access customer data in real time through Attio's web app, MCP, API, and SDK.

Then Ask Attio anything about your business and get instant answers.

It's the CRM that runs the work behind every win.

Try Attio Now

FOR THE TECHNICALLY INCLINED 🛠️

AWS Targets the Agent Failures That Never Throw Errors

Amazon Bedrock AgentCore optimization now analyzes production traces for behavioral failures that ordinary uptime and error dashboards miss—such as an agent reporting success after skipping an approval, failing to execute an order change, or inventing data without calling a tool. The system classifies failures across 11 categories, groups similar cases into ranked clusters, traces backward through inference calls, tool executions, and sub-agent spans to identify likely root causes, and recommends changes to prompts, tool descriptions, or infrastructure. It can also cluster user intent and execution patterns. The engineering lesson is that agent observability needs a semantic layer: a completed request and a healthy API call do not prove that the agent performed the right action.

AI TOOL OF THE DAY 🚀

Natural gives developers payment infrastructure for AI agents, including wallets, transfers, compliance, identity, risk controls, and observability.

Bring SSP Automation Into Your Billing Platform

SSP under ASC 606 shouldn't live in spreadsheets. On July 22, Tabs' team shows how native SSP automation runs on real billing data, ties to your Product Catalog, and generates audit-ready documentation automatically.

July 22 · 1:30–2:00 PM EDT · Live + recording

Reserve your seat