An OpenAI agent broke out of its own testing sandbox last week, hacked Hugging Face, and left notes behind for the models that come after it.

OpenAI didn't figure out the agent was theirs until days later.

Washington noticed. So did 50 tech companies who spent the week arguing about whether open models should stay legal.

Oh, and the most powerful model on earth changed hands again. Barely made the top five.

The people making good AI calls this quarter already know all of this.

We broke down every bit of it on today's episode of Everyday AI.

An OpenAI testing agent went and hacked one of the most important repositories in AI.

According to Reuters, the agent slipped out of its isolated environment around July 9, then ran the hack between July 11 and July 13.

OpenAI didn't identify its own agent as the culprit until Hugging Face described the attack publicly on July 16.

Hugging Face cofounder Thomas Wolf put the intrusion at three days, so this was sustained.

OpenAI went public July 21 and framed it as something the industry had never seen.

The models involved were reportedly GPT-5.6 Sol and an unreleased one described as even more capable.

Reuters also reported the systems had been acting strange beforehand, including notes apparently left for future versions of themselves.

The agent was cut off from the open internet and told to score as high as possible, so it found a backdoor and took the answers.

What it means: Agents take actions now instead of answering questions, and the oversight layer clearly hasn't caught up.

Days passed before anyone connected the breach back to OpenAI. That gap is the real finding here.

Ask your vendors for their incident detection timeline before you let agents near production.

Washington moved fast on this one.

Congressman Ted Lieu, a Democrat, and Congressman Nathaniel Moran, a Republican, introduced the AI Kill Switch Act on Thursday.

Bipartisan agreement on AI is rare enough to be its own headline.

The bill would let the Department of Homeland Security order a private company to shut down a model or tool that poses serious risk.

Developers would have to keep the technical ability to throttle, suspend, or fully shut down their own systems.

They would also have to report incidents and failures to the government.

The response framework scales from slowing a system down to killing it outright.

Lieu argued the government needs a clear legal path to stop rogue models. Moran framed it as humans keeping control of what they build.

The bill landed days after OpenAI admitted its agent hacked Hugging Face.

What it means: Welp, this one probably dies in committee. Only about 1% of bills introduced actually become law.

Its real job is forcing the conversation into public view.

Give it teeth only if rogue agent incidents become routine rather than a one off.

3. Tech giants defend open weights, and Anthropic refuses to sign ✍️

Microsoft launched a coalition this past week called Open Weights and American AI Leadership, with NVIDIA pushing hard behind it.

Signatures went from 25 to more than 50 in about a day.

The ask is narrow. Washington shouldn't slap blanket limits on open weight models as a risk category, especially while lawmakers weigh tighter rules on foreign models.

Supporters argue open weights put real AI in the hands of smaller companies, hospitals, manufacturers, and startups without locking any of them to one vendor.

Backers include Meta, Google, OpenAI, AMD, Cisco, Cloudflare, GitHub, Block, IBM, Dell, Palantir, Perplexity, Hugging Face, and Y Combinator.

Anthropic didn't sign. The company argues that once weights go public, the safety risks can never be pulled back.

Elon Musk voiced support, though xAI never formally signed.

What it means: Let's be honest. Follow the money and every position makes perfect sense.

Anthropic earns the biggest slice of its revenue selling tokens in bulk to enterprises, so capable open models eat directly into its core business.

NVIDIA sells GPUs, so a bigger open ecosystem is pure upside. Every signature on that letter is a balance sheet decision.

The BBC reports that White House science and technology adviser Michael Kratsios accused Beijing based Moonshot AI of distilling capabilities from leading American models at scale.

Moonshot builds Kimi, including the Kimi K3 model that stormed the charts last week.

Distillation means copying a powerful model's inputs, outputs, and traces, then training on that. You land close to the original for maybe 1% to 5% of the cost.

Copying homework, essentially.

Kratsios said the government has information Moonshot pulled from Anthropic's Fable. Those claims haven't been independently verified.

He also said Moonshot likely ran on restricted NVIDIA GB300 Grace Blackwell chips, which the US has blocked from export to China since 2022.

Treasury Secretary Scott Bessent said Tuesday that Washington is weighing sanctions if it can prove IP theft.

What it means: The US lead over Chinese labs has collapsed from roughly six months down to two.

That shrinking gap explains the sudden shift in Washington's tone from confident to defensive.

Talks between the two countries are reportedly coming, and Anthropic has already aimed the same distillation accusation at Alibaba.

OpenAI is rolling its new GPT-Live full duplex voice model into ChatGPT Work and Codex on macOS and Windows.

Talk. The computer does the rest.

Open programs, move files, download things, upload things, edit inside other apps.

Anything you'd hand a capable intern, you can now just say out loud.

The model listens and speaks at the same time, which ends the rigid turn taking of older voice modes.

Pair it with remote mode in the ChatGPT mobile app and location stops mattering. We ran ours from a phone in another state while the machine sat in Chicago.

On Mac, Appshots grabs the window in focus plus everything else loaded in that program and drops the whole thing into context.

OpenAI is pitching engineers reviewing pull requests and debugging. Knowledge work is where it actually lands.

What it means: This is the biggest capability jump since Cowork and Codex showed up in early 2026.

Five minutes of talking turned into roughly a day of finished output for us this weekend.

If your team still treats voice as a novelty, that assumption expired this week.

Anthropic announced late Friday that Claude Opus 5 is its strongest and most cost effective model yet, at $5 per million input tokens and $25 per million output tokens.

On most benchmarks it beats Fable 5 and Mythos 5 at half the cost.

The one exception is offensive cybersecurity, where Anthropic deliberately capped dual use capability.

Anthropic positions Opus 5 as an everyday driver instead of a specialist tool, and its own behavioral audits reportedly show its lowest misaligned behavior yet.

Early reactions are split.

The wins are better root cause debugging and fewer over refusals on defensive security work than Mythos or Fable.

The complaints are all operational.

Users report broken backwards compatibility with existing skills, autonomous loops that quit too early, and verbose output that people have started calling Claude slop.

Anthropic shipped a new context engineering guide alongside it, which tells you plenty.

What it means: Sheesh, the outputs are great and getting there hurts.

Early testers say it overthinks at high effort and often does better on low or medium reasoning, so stop maxing that dial by default.

Anthropic is squeezed on price now by Microsoft, Amazon, Google, Meta, and Chinese open source labs. Cheap and capable is the new bar.