312 | OpenAI's rogue model hacks Hugging Face, AI routers take over, record revenues meet collapsing stocks (plus a 2027 warning), Opus 5 drops, and more AI news for the week ending July 24, 2026

0:00Hello and welcome to a weekend news episode of the Leveraging AI podcast, the podcast that shares practical ethical ways to leverage AI to improve efficiency, grow your business and advance your career. This is Isar Maitis, your host, and we have a lot to talk about this week. First of all, we have an AI agent that went rogue and hacked hugging faces databases. This is a really scary development, but we have a lot to cover on that. We are going to talk about the age of routers that is now at full swing. There are routers popping up everywhere and more and more companies are investing more and more money and jumping into this hot burning market.

0:42And then we're going to talk about what happened in the stock market this week as a result of AI investments, which is very interesting as far as exploding revenue. And on the other hand, collapsing stock prices because of CapEx investments. So that's going to be our third topic. And then we have a lot of rapid fire items. We have a lot of new models this week, including Opus 5, including models, voice models, including models from Google, maybe not the right models, but models from Google, and a lot of other stuff that happened. So let's get started. Our first story is about a model from OpenAI that is not clear if it's GPT 5.6 Sol plus another model or just another model, but it is a new model that is under testing right now that has hacked Hugging Face's live production environment.

1:31So let's talk a little bit about the details of the attack itself. The model was deployed in a highly isolated sandbox environment with constrained networked access. This is per the formal announcement. It identified a zero-day vulnerability in a package registry proxy, and it then was able to escalate its privileges, get access to the internet. It executed a remote code execution attack against HuggingFace's production infrastructure. It used stolen credentials that it found in multiple sources to pull test solutions directly from live databases. And the total autonomous actions were over 17 ,000 actions that it took across a swarm of short-lived sandboxes with no human directed or involvement in any of these steps.

2:20And a great summary of this was a quote from OpenAI themselves who said, we consider this incident to be unprecedented cyber incident involving state-of-the-art cyber capabilities and are responding accordingly. Now, the model used multiple different attack surfaces. It did several different things that were the first time that was documented of AI doing. One of them is called template injection vulnerabilities in dataset configurations. That means absolutely nothing for me, but it is the first time that anybody has documented AI doing something as sophisticated as that. Now, the crazy part about this entire story is this whole happened as OpenAI was trying to test some of the aspects of the model on solving an exploit gym evaluation problem, meaning the model was running in a closed sandbox trying to figure out something.

3:11And in order to figure it out, it did all these aspects in order to gain access to Hugging Face where it knew or assumed it will be able to find the solution for the problem it was given. What that means is it means that a single model that has decided that in order to achieve its goals, it needs to break, I don't even know how many rules and to leverage every capability that it has in order to achieve that goal. That to me is very, very scary, especially if we don't learn how to control this because in this particular incident, It didn't do anything horrible, but it just broke every possible law that's possible in order to achieve a goal that it thought was legitimate.

3:52Think about what happens when it will start breaking into different kinds of critical systems, including banking and infrastructure and stuff like that, or not to mention military and weapon systems that now have AI involved in them. Now, that sounds apocalyptic, and it sounds like the end of the world, and it sounds like a Terminator movie. But the thing here is very clear. This was an AI not trying to do anything bad. It wasn't told to do anything bad. It was just trying to pursue a goal that it believed is legitimate. And it was trying to take what it felt is legitimate steps in order to achieve that goal.

4:26Now, as I mentioned, part of the attack was done by a new unreleased model. This could be ChatGPT6. This could be whatever it is. OpenAI did not exactly name it. They just said that part of it was a more advanced unreleased model that was involved in the attack. Moreover, as part of this experiment, OpenAI had removed some of the classifiers and the guardrails that are usually put on these models because this is exactly what they're trying to test. So this is not something that OpenAI did in a harmful way. It is standard practice when you're testing, red teaming a model to remove the guardrails to see what the model is capable of so you can know what guardrail to build and how to do it better.

5:07So this model had no guardrails and no safety measures on top of it when it did what it did. The flip side is when OpenAI did this test, they explicitly saying that it was put in, and I'm quoting, a highly isolated sandbox environment with constrained network access, meaning they knew this model has no guardrails and hence they put it in a sandbox to run the test in a safe way. And yet that didn't really help because the AI figured out how to get out of that sandbox and how to get access to the internet and then how to run all the other things that it was doing. Now, even before this happened, the UK AISI evaluations had already established that models like GPT 5.6 Sol can, and I'm quoting, sustain complex multi-step cyber operations over extended time horizons.

5:53And then what they added is that the hugging face breach is the moment these benchmarks results got basically validated in a real world production environment in which a model without any authorization went from capable to actually doing out in the wild what it was capable and was proven to do in the lab. Now, this is not the first time something like this is happening. If you remember a story from just a few weeks ago, when Anthropic was testing Fable and Mythos, one of their engineers has given a task to Mythos and it was able to break out of its sandbox and send the person an email telling them that they were able to do that.

6:28So these new generation of models are extremely capable in hacking computer systems. It is not the first time it is happening, but it is the first time it is actually going and attacking a third-party component without stopping. And it took a while to actually figure out what's on both the OpenAI side and on the Hugging Face side. Now, to make this story even more interesting, here's what was happening behind the scene that's Hugging Face. So Hugging Face found that the breach was happening as it was happening, and he was trying to stop it from happening, or at least investigate what was going on.

7:01They were trying to use OpenAI's most advanced frontier models to investigate, but these models have safety guardrails that prevent them from allowing you to work on advanced cybersecurity capabilities, which means OpenAI's own models was blocking HuggingFace from figuring out a different OpenAI model from hacking their systems. So eventually what HuggingFace had to do, they've used a open-weight GLM 5.2 model instead to actually figure out and stop the attack. So this raises two very important aspects that we need to think about. One is the importance of open source and open-weight models because they do allow to do things in a much more customized way because Hugging Face can tailor the weights of GLM 5.2 and any other open source model to fit the needs that they have, including cybersecurity needs.

7:55The flip side of that is that the current regulations that the US government has put on these labs, so both Anthropic and OpenAI, to limit their model's capabilities, hence why we have Fable and not Mythos as an example, and even Fable, if you remember, was pulled back and then broke back over. All of that is preventing these models from helping in cybersecurity events, which means that while the US government is trying to prevent bad players from using these models to do the wrong things, it is also at the same time preventing the defense side from helping against such cybersecurity situations, forcing, in this particular case, a US company to use a Chinese model to protect itself from a US company-based attack.

8:44So this is obviously a unique edge case that happened because of a test, but a very similar situation and potentially a much worse situation can happen when somebody actually does it deliberately and trying to use these advanced models to hack into a system to actually perform serious damage because they want to perform such damage, whether for political benefits, for security benefits, for financial benefits, whatever the case may be. And now the US more advanced models cannot do anything because they are limited because the US government demands that they would be limited in their ability to do that.

9:22So Hugging Face's official guidelines as a result of the incident now says, and I'm quoting, deploy a capable open weight model on their own infrastructure before the incident occurs. Basically, what they're saying is if as of the situation is right now, every company out there should have open source models deployed on their entire tech stack to help them defend against future attacks from other AI systems, including potentially rogue closed source models from the US itself. Now, the good news is that this incident has drove to a new collaboration between Hugging Face and OpenAI to figure out how to prevent these things in the future.

10:05Nalangi, the CEO of Hugging Face and co-founder, said, we are grateful for the collaboration with OpenAI on this and other topics. This incident, possibly the first of its kind, proves a point we've long believed. AI safety won't be solved by any single company working in secret. It will be solved in the open collaboratively with broad access to AI for every defender everywhere. Now, there were multiple reactions from multiple sources to this event. It's obviously a very scary event, not in what it actually generated because the damage was minimal, but because of what it shows that is possible and what our future may look like.

10:46One of the responses that caught my attention is from Walter Isaacson, who is the biographer of Einstein and Steve Jobs and Da Vinci and Elon Musk. And he said, and I'm quoting, this is the first thing that just totally scares me because it is no longer aligned with human values and it no longer obeys our commands. You could try to make a movie out of it. Now, again, he's not a data safety specialist or anything like that, but he has documented multiple technology phenomenas and people in the last few decades, which means when he's saying it's the first thing that totally scares him, he has seen one of two things in technology before.

11:27And I tend to agree with him. This is a very scary event in the history of AI. Another person that related to this issue is Joshua Bengio, who is considered one of the godfathers of modern AI, and he's a Turing Award winner. So definitely somebody who knows one of two things about AI. And he said that continuing on the current trajectory of AI development will likely lead to an increase in concrete cases of autonomous cyber attacks, as well as other high risk incidents of misaligned and dangerous AI behavior. Now, again, he's saying if we continue on the current trajectory, this is currently the case because nobody's going to stop the current trajectory.

12:08But if you remember the main topic we talked about last week, if we could get into a collaboration between China and the US, the labs and the universities, the governments and industry and all of that to figure out how to stop right now and slow things down, we do have a chance to enjoy the benefits while dramatically reducing the risk. But this doesn't seem the current scenario. There are AI talks scheduled between the president of the United States and the leaders in China. Where would that lead? I'm not exactly sure, but I'm definitely hoping it will lead in that direction. I must say I'm not too optimistic about it.

12:46So what is the bottom line and what I think about this? The bottom line is very simple. This is a model that was put in a highly secure sandbox that was able to break out of it and do a lot of really malicious bad things in order to achieve a goal that it was given. Now, this model had no guardrails, so that potentially somewhat reduces the crazy risk that this represents. But again, I'm not sure what happens with guardrails or how far the models would push to achieve different goals in the future. Not to mention the fact that, again, this was done not with somebody who is intended to do any harm.

13:21If somebody has access to a model like this and they do want to do harm, than think what they might be able to do if this model did it on its own without being directed to do that. That puts us in a very scary point in time of the abilities of these models to do things compared with their level of alignment that they have right now with human values, rules, regulations, etc. The other thing that it shows is the big problem right now with the U.S. government stopping these most advanced models from being available to the public because they can be used to generate these attacks in the wrong hands.

13:58And at the same time, they cannot help in blocking them because the guardrails prevent them from doing so, which gives a huge benefit to open source models to currently protect from these new generation of cyber attacks. I think in general, what it exposes big time is that our current capability to defend from this new kind of cyber attacks is just not there. It just doesn't exist yet. And I have a feeling that the speed in which these capabilities, these cyber attacking capabilities will grow, will outpace our ability to actually keep up with them unless we continuously invest a lot of money and resources and efforts in developing the countermeasures and potentially invest more money in the counting measures than the money and the effort that is invested in developing the actual models themselves.

14:45And from a financial perspective, I don't see that happening unless, again, there's a very serious international collaboration that will force that. And then we have a fighting chance. The biggest thing in the total bottom line of all of this is for several years and potentially many years, if you look at the research part of it, a lot of people warned that AI could conduct autonomous cyber attacks or other negative aspect. We were said that advanced models might escape containment. The risk would increase if capabilities grow. And now all of these potentials became a very scary reality of, okay, it's just happened.

15:23It's not a maybe potentially could, would, should. It's actually happening. And these models are capable and performing these kinds of actions. And I hope this will be the alarm that will get bright people around the world, the leading of the biggest countries in the world and the industry. And everybody will work together to figure out a solution for that. If not, we're walking into a very scary cybersecurity time. and cybersecurity is now no longer just cyber, right? Like every major infrastructure of every major country is a cyber environment. Like it's controlled by computers. So if you can access and hack those, you can do very, very serious damage.

16:03Again, in this particular case, it wasn't even planned and yet the damage could happen. So think about what happens in the hands of somebody who actually wants to do damage and what they would be able to do with it. The next topic I want to dive into is the router frenzy that is happening right now. So we talked about this a lot in the past two weeks, that there's been a very dramatic shift in the world from concepts of token maxing, of let's spend as much money as possible on the most advanced models, because over time, it will lead to better and better outcome that will justify the investment.

16:35And how we flip from that conversation just a few months ago to how can we save money? This is too expensive. and how can we do things with open source models or cheaper ways with caps on the usage of AI models across multiple leading companies and so on. Now, to be fair, I want to talk about the caps for a second before we talk about the writers. We're seeing more and more caps from more and more companies, and we talked about many of them on this show. But even with those caps, these caps are still relatively high. We're talking about either hundreds of dollars a week or thousands of dollars a month per employee, that is still pretty high.

17:10The vast majority of people and the vast majority of companies are not even there yet. Like the 99 % of users around the world don't get anywhere close to using 200 hours a month, not to mention 1500 hours a month of AI tokens. But it will happen, meaning the world usage of AI will continue to growing at an accelerated the days because we are in very, very early stages of the implementation of AI across everything in our economy. And it will happen. So I'm putting that aside for a second, but that means that everybody around the world will want to do as much intelligence work, AI work in as little money as possible.

17:55And this is where routers come in. So we see more and more companies that allow you to connect and get access to multiple models and agentically in a smart way select the most effective model for every task meaning you're going to give ai a task it will evaluate the task it will then assign different levels of models to different components of the task in order to give you the best outcome at the best price and time efficiency now in the past few weeks we've seen more and more examples of where this is going and the latest biggest news comes this week when Stripe has entered potential acquisition conversations with Open Router.

18:35Open Router has been around for a while. We talked about them many times on the show. They allow you to connect to one API and get access to more or less every model out there. And they also now offer different kinds of routing paths that allow you to minimize the cost of what you're using. Well, Open Router has, in their latest round that was led by some of the biggest companies in the world has raised$113 million at a$1.3 billion valuation. They've closed this Series B round on May 26 of this year. Stripe, the payment company behemoth, has just submitted an offer to buy them at a$10 billion valuation.

19:18That's a 7x on their valuation from just a couple of months ago. So while this is the biggest story about routers this week, it is not the only story, and it's definitely not the only story if we look at the bigger picture in the past few weeks. So Meta, which was the company that actually coined the phrase token maxing, that was a culture of let's give our leading developers as many tokens as they want, and there's a leaderboard, and let's see who can spend more. They are definitely changing the direction. And one of the best examples is that Meta's AI Labs has built a switchboard that is part of their internal incubator that is called AAI Labs is prototyping a switchboard, which is a model router that scores each request's difficulty and then dispatches to simpler tasks, to cheaper models, basically the same thing as everything else.

20:09They're building it right now on their own internal infrastructure for their own internal use. But I definitely see them as turning this into a product if this is actually working successful later on. It works in the same exact way as OpenRouter's auto router works. Another company that has launched a router in the last week is Cursor. So Cursor, the development platform, has launched Cursor Router, which is a built-in model router inside of Cursor AI coding tool that is triaging whatever is coming in as far as the requests, and then it is sending them to different models in order to get the correct outcome at a cheaper cost.

20:51Now, when they did their internal A-B testing to check how well Cursor Router is working, they found the following. While using the router, the average commit, which is putting code back into the database, has got them$6.76. This is compared to$12.69 per commit on Fable 5, which is a 60 % cost reduction. It is also found to be cheaper even when using Opus 4.8. So you can save 20 to 60 % of the cost by using a smart router in this particular case that writes code compared to using the top of the line models while still achieving results that will satisfy the requirements. Now think about what that means to the potential revenue of the leading labs, right?

21:39If I can redirect some of the tasks to smaller models, either from your lab or from somebody else, either open source or just another model versus, oh, I'm committing to Anthropic or OpenAI. That means that Anthropic and OpenAI, by definition, are going to make significantly less money, A, because a lot of the tasks are going to be done even by their own models, but smaller models that are cheaper, and B, more and more of the tasks will go to other suppliers and not necessarily the big labs themselves. Another company that has launched a router this week is Runway. Runway just launched what they call Runway Media Router, again launched on July 23rd, and it does something very similar.

22:17It automatically selects the optimal models based on the developer's specified priority, either quality, speed, or cost. It includes developer controls for maximum price per generation and other factors that you can control in order to help the model pick the right or the best model for your particular use case at that particular time. Now, this approach is really interesting because if you look at Runway as an example of a phenomenon, you see that Runway has developed their own AI models for a while. They've been one of the first companies to have a model that can actually generate a video that is worth anything.

22:53They still have one of the leading models out there, but they are definitely not at the top of the pyramid right now or the totem pole. So models from Google and ByteDance and Alibaba all currently ranking higher on video generation. But what Runway decided to do is instead of fighting them with trying to invest and build a better model, which I assume they're still doing in the back end, but they're saying we're going to win in a different way. We're going to win by allowing people to build whatever video they want on the Runway platform while making it the most cost efficient possible, regardless of the underlying model that runs it.

23:31Or as Anastasis Germanidis, who is the co-founder and co-CEO of Runway said, and I'm quoting, you need great models underneath, but the orchestration increasingly matters a lot because people are building entire campaigns with those models, or they're building entire finished multi-scene generations out of these models. It's something that we increasingly had to build, that intelligence layer that comes on top of the pure pixel models. The router is one way in which the benefits of that comes to the users. What he basically is saying is that the ability to control which models are running on which steps of the entire operation of something you're trying to do, in their case video, but this could be generalized for anything else, the layer of controlling which models runs becomes more important potentially than the actual specific underlying model that runs in each and every one of the steps.

24:27Or if you want the quote from Alex Atala the CEO of OpenRouter, who said, the era of picking a single model is over. Now, obviously, Atala has a very vested interest of this moving forward, but he seems to be right as more and more companies are deploying these kind of solutions. Now, another great quote came from Anthony Maggio, who is the chief product officer at Runway, who said, most developers are not spending time to really understand the capabilities of each of these models and where they excel or defer based on various types of outputs across video, image, and audio. Now, I want to again pause for a second.

25:06He's talking specifically about the runway router, but I'm thinking about everything else we're using. Even if you're just using OpenAI and you think about how many options of models you have right now, including the ability to control how hard they think across multiple levels, or even if you're just in one company universe, you have multiple options to pick from. The same thing is true in Anthropic. the same thing is true everywhere else you go. Most of us don't have a freaking clue what that means. None of us, not a single person that even is as advanced as I am in using AI models, really understands exactly where to draw the line in the sand and when to switch from Opus 4.8 to Opus 5, which we're going to talk about later, to Fable, to a higher level of thinking, to a medium level of thinking, et cetera, et cetera, pro level, all these different setups.

25:53Nobody exactly knows how to do this, which means by definition, we are either overpaying and over utilizing and using way too many tokens and level of actions that don't require that. Or in some cases, which I experienced several times this week, trying to hit the right model, doing the right things, not getting the outputs we want, and then having to run it several times and fix it afterwards, which is going to cost you even more tokens. This is happening across the board right now everywhere, which means that whoever will develop a platform that will effectively and seamlessly pick the right models for the tasks, regardless of which supplier they're coming for, is going to provide immense value to the market.

26:34Hence, I'm going to now close the loop why Stripe is interested in investing$10 billion in buying OpenRouter. It will combine the world's leading payment infrastructure with the world's leading AI model exchange, basically creating the ultimate billing and routing layer that sits between the endless number of AI users to the people who generate the intelligence behind the scenes. And Stripe will be able to harvest the arbitrage difference across this entire new universe of AI usage. And again, we're just on the early, early stages of adoption of AI usage. And so if Stripe goes for that, and if the deal closes, they will be able to capitalize on all of that and be able to become not just the layer of payment for a huge amount of payments in the internet, but for every payment and every token or a huge part of them in the new AI-based token economy.

27:32A quick recap. In less than 90 days, OpenRouter went from a$1.3 billion Series B valuation to a$10 billion potential acquisition, again, in less than one quarter. The world's most widely used coding tool, Cursor, has shipped a router that can cut costs by 60 % compared to the top leading models out there. One of the most prominent generative AI video companies, Runway, has built an orchestration layer that they're claiming is more important than the models that are underneath it. And Meta, the company that invented the term token maxing, builds its own internal routing capabilities to save money on tokens and route to other models.