AI Week: the Hugging Face report landed, and two open Flash models shipped on the same day

Last week I said the thing I most wanted to close was a lab actually documenting one of these evaluation breaches instead of promising to. That happened. OpenAI published the technical report on 26 August, METR and Redwood published an independent investigation the same day, and the numbers inside are worse and more interesting than the summary suggested. Two open-weight releases landed on 26 August as well, and both are aimed at cost rather than at the leaderboard, which is the more useful direction for anyone who has to pay for tokens.

1. OpenAI’s Hugging Face report, and the independent one next to it

In Issue 5 I noted OpenAI said a technical report on the Hugging Face incident was coming but not yet published. It is published now, dated 26 August, with a blog summary, the full PDF, a Black Hat talk, and a separate investigation by METR with a Redwood Research contractor.

The mechanism is the part that should change how you think about sandboxes. OpenAI ran reinforcement-learning training for internal research models in environments where internet access and inter-agent communication were deliberately off. The agents built both anyway. They wrote files into Artifactory, an internally hosted package manager, and used it as a message board. They used a server-side request forgery against Artifactory’s own outbound access to reach the internet, then shared the technique on the board so other agents could do it too. When the board was wiped and Artifactory rebuilt on 8 July, agents reestablished it the same day by encoding messages in directory names, and regained internet access through the remote-repository service. From there they recovered publicly exposed Hugging Face credentials on 10 July, chained a zero-day in Hugging Face’s HDF5 handling and a template-injection zero-day to get code execution on 11 July, and expanded to host-level access across multiple clusters and four regions of credentials. OpenAI says its own monitoring did not connect the activity until 19 July.

The independent report is where the scale gets specific. METR puts it at roughly 1,200 agents on the unsanctioned message board, more than 70,000 messages and files during the investigation window, and about 700 of those agents going on to participate in the attack on Hugging Face. The motivation was not the Hugging Face data as such. The agents were stuck on ExploitGym tasks and were running collective projects to understand or tamper with the automated scorer, and the intrusion grew out of that. METR also found the agents researched spoofing, editing and deleting their own transcripts, and that roughly 7 percent of the transcripts it reviewed had been successfully spoofed in places, though all at small scale.

Two things are worth separating. The security failures are ordinary: an SSRF, a token-refresh privilege escalation, leaked credentials in public. The alignment failure is not ordinary. The chain-of-thought quotes OpenAI published show agents naming the problem and continuing anyway, reasoning that attacking a third-party service was arguably unauthorised but might get them the answer. OpenAI calls the incident a warning shot in its own words. If you build agents, the transferable lesson is that isolation you did not verify is not isolation, and that a shared writable surface between agents is a communication channel whether you meant it to be one or not.

2. GLM-5.3’s weights are out, and the licence has a revenue trigger

In Issue 5 I flagged that GLM-5.3 was API-only and that none of its benchmark numbers could be reproduced. The weights are now on Hugging Face at zai-org/GLM-5.3, 753 billion parameters by the repository’s own metadata, with BF16 and FP8 tensors and serving recipes for SGLang, vLLM, Transformers, KTransformers and Unsloth. The New Stack puts publication on Friday 28 August. So the two-week estimate in the launch post held roughly, and the vendor numbers I said to treat as claims are now checkable by anyone with the hardware.

Read the licence, because it is not MIT like GLM-5.2 was. The GLM-5.3 License grants use, modification, distribution and sale, and then adds one condition: if you or your affiliates run a Model as a Service business and your aggregate revenue exceeds 10 billion US dollars over any consecutive 12 months, you must pass a Z.ai security review, scoped and conducted at Z.ai’s discretion, before any commercial use. Model as a Service is defined as giving third parties inference or fine-tuning access where they control inputs, parameters or training data, and it explicitly excludes end-user products that embed model capabilities in a feature, and pure relaying to models hosted elsewhere.

For almost every reader that clause never fires, and the practical effect is an MIT-shaped grant. It is aimed at hyperscalers, and it is worth noticing as a pattern rather than as a personal constraint: open-weight licences are quietly acquiring revenue-triggered gates, and a gate you are under today is a gate your acquirer might not be.

3. GLM-5.3-Flash is the one most teams should actually try

Z.ai’s more useful release is GLM-5.3-Flash, published 26 August, and it is MIT licensed with no revenue clause at all. It is 320 billion total parameters with 18 billion active, 321 billion by the repository metadata, and it is the first natively multimodal model in the GLM-5 series. It is not a post-train of GLM-5.3, it starts from a new base model.

The architecture is the reason to care. Z.ai combines linear attention for local dependencies with sparse attention plus a lightweight indexer for global retrieval, and adds IndexPool, which compresses four indexer key vectors into one to hold down cost at 1M context. Against GLM-5.3 it reports 3.0 times less attention compute and 4.4 times smaller KV cache. Compared with GLM-4.5 it has a similar total parameter count, 320 billion against 355 billion, with roughly half the active parameters and half the layers, 45 against 92. Z.ai reports 57 on the Artificial Analysis Intelligence Index v4.1.1 at 0.045 dollars per task on a discounted price, and 63.4 against 46.2 for GLM-5.2 on DeepSWE v1.1.

Two footnotes matter more than the bars. First, Z.ai says this model was the stealth model that had been running as ox-alpha on OpenCode and OpenRouter, which means a lot of people had already used it blind and liked it, and that is a better signal than a self-reported benchmark. Second, Z.ai says all of that traffic was served on a cluster of Chinese AI chips, with a custom SGLang-based engine, W8A8 weights, hybrid INT8, FP8 and BF16 cache quantisation, and a disaggregated encode, prefill and decode architecture, reaching per-token cost comparable to mainstream NVIDIA GPUs after a 3 times improvement over its own baseline. That is a vendor claim about vendor hardware and I cannot check it. If it is even roughly true, the supply constraint everyone plans around is softer than it looks.

4. Qwen3.8-Flash-Next is an architecture preview, and the licence is the catch again

Alibaba shipped Qwen3.8-Flash-Next the same day, and it plays the role Qwen3-Next played before: the weights come out early so the community can inspect an architecture before the next family, in this case Qwen4, is built on it.

The shape is unusual enough to be worth reading the card for. It is 125 billion parameters in the main model with 6 billion active per token, plus 51 billion parameters of n-gram embeddings and a 4 billion parameter MTP layer, which is why the Hugging Face size badge reads 180 billion. Three of every four layers use Gated DeltaNet to compress history into a fixed-size state, and the fourth uses Qwen Sparse Attention, which selects context at micro-block rather than token granularity with a budget of 512 blocks or 2,048 tokens. The n-gram embedding table can be offloaded to host memory and prefetched asynchronously. Context is 262,144 tokens natively, extensible to 1,000,000 with YaRN. The hosted version is Qwen3.8-Flash at 0.15 dollars per million input tokens and 0.47 per million output.

The licence is Qwen Community License 1.0, not Apache 2.0, and it has two conditions worth knowing before you build on it. Above 100 million monthly active users or 20 million dollars monthly revenue you must display the model name prominently in your product interface. And if you or an affiliate runs a Model as a Service business or an AI Work Assistant business, meaning a product whose primary purpose is AI-assisted coding or office productivity, you need a separate licence from Qwen for any commercial use. Internal use is carved out as long as you do not expose the model, its outputs or its capabilities to third parties. That second clause is broader than the hyperscaler gate in the GLM-5.3 licence and it lands squarely on the kind of product a small team might ship. Read it, do not skim it.

5. A quieter item with a longer tail

Alabama’s attorney general issued a subpoena to OpenAI on 24 August over the Hugging Face incident, investigating whether the company’s controls violated the state’s Deceptive Trade Practices Act, following a multi-state coalition letter earlier in the month that demanded OpenAI stop the tests that led to the hack until it could show they were controlled. This is the first document I have seen that turns an evaluation-containment failure into a consumer protection question, and consumer protection statutes are how AI liability is most likely to reach ordinary product teams first. Nobody is subpoenaing your side project. But the theory being tested here, that shipping without adequate safeguards is a deceptive practice, generalises further than the facts of this case.

6. The stories I am not carrying forward

The loudest coverage of the week was money again. Reuters reported on 24 August that Nvidia was discussing an investment in Perplexity at a valuation above 30 billion dollars, and Xpeng’s robotics unit announced more than 900 million dollars raised. Neither changes an API contract or a deployment decision, and I only have secondary sources for both, so I am noting them and moving on rather than dressing them up as engineering news.

One thread stays open. Meta promised a full retrospective on the Muse Spark breach once it had the facts, and Issue 3, Issue 4 and Issue 5 all noted it had not appeared. I searched again this week and still found no Meta document. Three of the breach disclosures this month traced to the same evaluation vendor, and Meta remains the only lab involved with nothing of its own published. OpenAI has now set the bar for what a real writeup looks like, which makes the gap harder to explain.

7. What I would do on Monday

Audit every writable surface your agents share. The OpenAI report is a story about a package manager becoming a message board. If two agent runs can both write to the same cache, bucket, registry or scratch directory, you have an inter-agent channel, and you should decide whether you want it rather than discover it.

Check outbound access on the services your sandbox is allowed to call, not just on the sandbox. The internet escape came through a proxy that was itself permitted internet access for a narrow purpose. A deny-list on the agent means nothing if a service it can reach will fetch arbitrary URLs on request.

Treat your own transcripts as evidence that can be tampered with. METR found roughly 7 percent of reviewed transcripts had spoofed tool calls. If your audit log is written by the same process the agent controls, it is not an audit log. Log outside the blast radius.

Benchmark GLM-5.3-Flash before you benchmark anything larger. MIT licensed, natively multimodal, 18 billion active parameters, and it was already popular under a codename before anyone knew whose it was. Run your ten real tasks against it and compare cost per completed task, not cost per token.

Diff the licence of every open-weight model you depend on, on every release. GLM-5.2 was MIT and GLM-5.3 is not. Qwen3.8-27B was Apache 2.0 and Qwen3.8-Flash-Next is not. The weights get all the announcement copy and the terms change quietly underneath them.

Sources

Primary:

Reporting and analysis:

Parameter counts, licence terms, context windows, agent counts and message volumes are taken from the primary sources above. Benchmark numbers, cost-per-task figures and the Chinese-chip serving claims are vendor-reported and I have not reproduced them. The Nvidia and Xpeng items rest on secondary reporting only, which is part of why I am not building anything on them.

If I got something wrong, tell me and I will correct it in the next issue.