Welcome back! This week, we take a look at OpenAI’s cyberattack on HuggingFace, the USG vs Kimi, Google’s earnings, Vera Rubin’s incredible first results, and more.

Enjoy!

As published by OpenAI and HuggingFace, an unreleased AI model from OpenAI (possibly GPT-6) hacked HuggingFace’s production infrastructure.

In a nutshell, when testing two models, GPT-5.6 Sol and an “unreleased” model many believe is GPT-6, on whether they could pass certain tests in a cybersecurity benchmark, the models autonomously decided they would hack the source of the test, HuggingFace, to retrieve the answers.

And they did.

In response, HuggingFace used open models, GLM-5.2 to be precise, to understand the problem and solve it. Most interestingly, they tried using Anthropic and OpenAI models, but the AIs refused to help, which is beautifully ironic.

Sadly, many will use this news to fearmonger about open-source models and how they should be banned to prevent these things from happening.

However, it’s precisely the existence of powerful open-weight models like GLM-5.2 (Chinese, by the way) that prevented this from being much worse, because in the words of HuggingFace:

If anything, what looks like a great PR campaign for OpenAI “look how scary my models are” is in fact a PR campaign in favor of open source, considering HuggingFace could not protect itself using frontier models because these models were guardrailed; this is the best advertisement one could possibly find for open models.

We’re finally starting to see the performance improvements that the NVIDIA Vera Rubin NVL72 servers, NVIDIA’s new GPU platform, bring… and it’s impressive.

For the same interactivity, around 150 tokens per second for every user (a more than acceptable user experience), a Vera Rubin NVL72 server offers a 10x improvement in token throughput per megawatt relative to a Blackwell GB200 server (previous generation server).

In plain English, for every megawatt of GPUs a data center company has, they can now generate ten times more billable tokens while offering the same quality experience for the user. We’re talking about a 10x improvement in performance per watt from one platform to the next, completely outrageous.

But how is this possible? The answer is, as you probably guessed if you’re a regular of this newsletter, memory.

As we have discussed tons of times, AI inference, serving AI to users, is “memory-bound”. This means that the performance is not determined by how powerful your compute is, but how much data your chips can move.

The intuition is quite simple to understand; the GPU chips need to receive data from memory to make the necessary computations. But if your compute chips don’t receive enough data per second, they finish much faster than new data arrives; so they are ‘idle’ for a certain period of time while waiting for new data to work on.

In this situation, no additional compute will improve performance; your bottleneck is the memory bandwidth: how much data can we send to the chips every second. This would be like upgrading from a BMW to a Ferrari to get extra horsepower while still having to drive under the speed limit; that extra horsepower is useless if you can’t use it.

Unsurprisingly, the reason Vera Rubin gives such a leap in performance (besides some compute optimizations which never hurt) is the fact that each server has a much larger amount of memory and much larger memory bandwidth, which pretty much summarizes why memory stocks have become the most followed public companies in the world, because they are the door to improved performance.

And does this announcement improve the likelihood of infrastructure companies making money with AI inference a lot? For sure it does.

These new servers can produce 800,000 tokens per second (TPS) per megawatt. Currently, the average capex for a megawatt is around $50 million (or $50 billion per gigawatt).

If we assume a price of $1 per million tokens (the blended price for tokens is currently a little bit higher, but I expect it to fall under a dollar relatively soon), that means a theoretical revenue per year of $25.2 million, which would mean a payback on that data center in less than two years.

Sadly, utilization rates are never 100%; as GPUs break, they are kept warm for other models, some are used for training, and so on, so we have to add a utilization rate discount.

If we assume a more reasonable rate of 65%, that gives yearly revenues of $16.4 million, or a payback period of just over three years, still totally acceptable considering the expected depreciating period of GPUs and interconnect fabric that are expected to be around six years.

You have to factor operational costs too, but those are much smaller in comparison, around 1 MW × 1.15 (PUE) x 8,760 hours × $0.08/kWh = $806,000 per year, plus worker salaries, which might add another million (data centers don’t need too many employees).

Surprisingly for many, AI inference is a very profitable business. The hard-to-make-money part of all this is the model layer, the AI Labs training the models.

These companies not only have the inference costs we’ve just discussed, but also huge operating costs (data center rents, million-dollar salaries, training costs, marketing) that make the entire thing unprofitable.

But the infrastructure companies have none of that; they just provide servers and charge for them and a fixed margin. If you were wondering why SpaceX is a Neocloud suddenly and why Meta is getting into the game too, you now know why.

As published by AMD and Reuters, AMD and Anthropic announced a strategic partnership on July 22, 2026, combining a major chip-supply agreement with an investment of up to $5 billion by AMD.

Anthropic plans to deploy up to 2 gigawatts of AMD Instinct MI450 GPUs through AMD’s Helios rack-scale systems. The first gigawatt is scheduled to begin deployment in the first half of 2027. The hardware purchases could generate tens of billions of dollars in revenue for AMD, although the investment and deployments are tied to future milestones (as happened with OpenAI’s deal).

The companies will also establish a multi-year engineering collaboration. Anthropic will help optimize Claude workloads for AMD hardware and improve AMD’s ROCm software platform, while AMD intends to use Claude across its engineering and product-development operations.

Great news for AMD, which gains a new flashy customer. However, the fact that AMD had to pay $5 billion to get this contract screams “vendor financing.”

Yes, the expected revenues AMD gets will be much larger, but this is an unequivocal sign of what is this industry’s greatest weakness: customers don’t have the money, so vendors are forced to finance their own customers.

Not the greatest of signs if you’re looking to see a healthy industry.

The US government has accused Chinese AI company Moonshot AI of using Anthropic’s proprietary Claude Fable model to help develop Kimi K3.

White House science adviser Michael Kratsios said the administration has information that Moonshot conducted large-scale “distillation.” That is, basically, training Chinese models on US model data, which is against Anthropic’s terms of service.

He alleged that Moonshot built an internal platform capable of changing access methods to avoid detection. The government has not publicly released the underlying evidence supporting the Kimi K3-specific claim.

Kratsios distinguished this alleged activity from ordinary distillation, which is widely used to make models smaller or more efficient. He said the administration supports legitimate AI development and open-weight models, but considers covert extraction of proprietary model capabilities to be theft of US technology.

Honestly, I genuinely can’t tell the difference between the two, because in practice, they are the exact same thing, which leads me to believe the difference (to them, at least) is the scale of the distillation.

Treasury Secretary Scott Bessent separately said Washington could sanction overseas AI companies if investigations establish that their models were built with stolen intellectual property. He said officials had identified signs or “watermarks” associated with US models in some Chinese systems, although his remarks did not provide technical proof specifically linking Kimi K3 to Anthropic.

Anthropic supported Kratsios’ statement and characterized unauthorized, adversarial distillation as industrial espionage and a national-security concern.

If stealing intellectual property is cause of ban, should we ban OpenAI and Anthropic altogether since they stole the data of all humanity?

It’s early to tell what form the actions will take, but it’s not looking good. Personally, as I always say, banning Chinese open models would be a massive self-own for America, considering that would immediately force US companies to pay several times more for their tokens because everyone would be forced to use Anthropic/OpenAI and one or two more options… at best.

Since when is curtailing the choice of Americans to three or four down from dozens a good outcome for them?

Besides, the audacity of these Labs to rant about getting distilled after having distilled (aka stolen) the entire corpus of human data would be funny if it wasn’t infuriating.

Hypocrisy at its finest.

And, I’m sorry, it’s not the USG’s job to grant Anthropic a business model; it’s up to Anthropic to find a way to have a viable business model without banning competition. I really hope lawmakers understand that this is not the way.

Luckily, “banning open models,” which is basically banning certain digital files, is outright impossible, so measures would probably be more targeted at placing constraints on US companies using Chinese models running on Chinese endpoints/compute, or, as the Head of Strategic Futures at OpenAI explained, create “enough regulatory risk” to disincentivize Chinese model use altogether. In other words, it’s not banning, it’s discouraging, which is a euphemism for banning, nonetheless.

For now, it’s not clear at all that the USG will go to such extreme measures, and several key members of the Administration, as well as influential figures, have spoken openly against the potential Chinese model ban.

What’s clear is that we’re entering the critical phase to know whether US companies will be able to access open models in the future.

Google’s parent company, Alphabet, reported second-quarter 2026 results, and completely smashed them. It had revenue of $119.8 billion, up 24% year over year and above the $116.9 billion analyst consensus.

The main AI-related result was Google Cloud, where revenue increased 82% to $24.8 billion, substantially exceeding the roughly 64% growth expected by analysts. Alphabet attributed the expansion to enterprise demand for computing capacity and AI services. Google also began recognizing revenue from direct sales of its custom TPU chips for the first time, although management said most revenue from those agreements is expected in 2027.

Cloud’s growth accelerated from 63% in the previous quarter, when revenue reached $20 billion. Alphabet said demand continues to exceed the computing capacity it has installed, despite significantly expanding its data-center, server and networking infrastructure over the past three years.

To address that demand, Alphabet raised its 2026 capital-expenditure forecast to $195 billion–$205 billion, up by $15 billion from its previous range of $180 billion–$190 billion. The new midpoint is approximately 119% above the $91.45 billion spent in 2025.

CFO Anat Ashkenazi said the increase reflected both strong AI demand and the faster-than-expected delivery of additional infrastructure. She also reiterated that capex is expected to rise significantly again in 2027.

And yet, the stock fell on the news, but why? Easy, they went free cash flow-negative on the quarter for the first time… ever.

In plain English, their capital outflows were larger than the cash provided by their business in that quarter, meaning that, even though the quarter was supremely profitable, more cash went out than it went in.

Does this mean Google has run out of cash? No. They still have $55 billion in cash reserves, 11 times more than that loss, plus $186 billion in highly liquid assets (like marketable securities). Therefore, they still have a lot of liquidity to leverage.

That said, I understand investor nervousness seeing how the company is simultaneously starting to run negative FCF quarters at the same time it expects next year’s capex to explode.

Another far-from-ideal number is that gains from non-operating activities (like stocks they own going up in value) represented more than 70% of their total income for the quarter. For an investor, you want the core business to be the money-maker; you aren’t investing in Google to get exposure to its venture capital investments. This seems to be a rara avis event, but it’s still noteworthy.

Either way, another great quarter from Google despite its recent LLM issues, where it has fallen to an unjustifiable fifth place and its recent Gemini 3.5 Pro fumble (the model failed their internal evaluations).

OpenAI has launched OpenAI Presence, a managed enterprise service for deploying AI agents across customer support and internal workflows. The agents can answer questions, access company systems, carry out approved actions, and transfer cases to human staff when needed.

Each deployment is built around a defined task, such as billing support, insurance claims, or employee IT requests, and receives only the information and permissions needed for that job. Companies specify what the agent may do, which actions require approval, and when a human must intervene.

Presence currently supports voice and chat agents. It combines operating procedures, guardrails, permitted actions, simulations and evaluation tools. After launch, Codex analyzes production sessions and escalations, then proposes changes that customer teams can test and approve before deployment.

OpenAI said Presence already powers its English-language phone-support service. According to the company, it resolves 75% of incoming issues without human assistance, while a Codex-based improvement process reduced human handoffs by 15 percentage points in 10 days. BBVA, SoftBank and Australian insurer IAG are also testing or exploring the product.

Presence is available through a limited general-availability program for eligible enterprise customers. Deployments are led by OpenAI engineers and selected systems integrators; it is not currently offered as a self-service product.

Another Trojan Horse from the closed Labs. Knowing the models aren’t the moat, they are trying to create vendor lock-in by having you build your agents on top of their platforms, despite the fact that many independent third parties could easily replicate the system and, as we saw last week, beat it.

Cursor has launched Cursor Router, a system that automatically selects which AI model should handle each coding request. Rather than sending every task to an expensive Frontier model, the router analyzes the query, conversation context, complexity, and domain before choosing the most appropriate option.

This isn’t the first product of its kind, but it’s one of the first that seems to actually work. The router is itself a trained AI classifier, an AI model trained specifically to do this task.

Cursor trained it on more than 600,000 real requests and optimized its decisions using user satisfaction as a reward. In other words, the router was trained to see a user request and the context and decide what’s the best model for the task based on user responses.

According to Cursor, online tests across millions of requests produced frontier-level performance at up to 60% lower cost. Early enterprise users reportedly reduced costs by 30% to 50% without a decline in quality.

As models become increasingly specialized, selecting the right model for each task may become almost as important as the capabilities of any individual model.

Cursor Router joins other types of harness products focused on making AI cheaper, with examples like OpenRouter’s Fusion API, which makes overall costs fall by handling your response using several models, running the top models only when necessary.

It’s not surprising that Frontier Labs categorically refuse to deploy such optimizations, because it’s clearly bad for their businesses, making it more important than ever that these routers exist.

I’ve long sustained that specialized models can beat frontier models on a given task by being obsessively trained on it. And with every passing day, we get more and more evidence of this.

This time, it’s from Cisco’s AI team. They have released three models, the largest of which is still small enough to run on a normal laptop, that achieve frontier-ish performance on finding vulnerabilities in codebases, a critical cybersecurity activity.

As the Cisco team explains, “General-purpose coding models can reason about code, but they may not be optimized for security investigation, terminal navigation, or structured vulnerability localization.”

Instead, the Antares model family was conceived for this particular job and trained extensively on it, achieving incredible results for its size.

I continue to believe, with increasing conviction, that most future AI will run on small models.

Yes, you will still need the “big boys” to handle the more complex tasks, like planning, agent orchestration, and others, but task execution can be largely optimized for smaller models and delegated to them.

As announced by Anthropic, Claude Cowork can now learn a reusable workflow by watching a user perform it. The user records their screen while completing a task and explains the steps aloud; Claude then converts the demonstration into a “Skill” that it can apply again later.

Skills package the instructions, supporting material, and optional scripts needed for a particular workflow. Unlike a one-time prompt, they remain available and are loaded automatically when Claude recognizes a relevant task. This can cover company-specific processes such as preparing a recurring report, organizing files, or following a particular document format.

The recording feature reduces the need to write a detailed technical specification manually: the user teaches Claude through demonstration and narration, then can review or refine the resulting Skill. Anthropic said the feature is available in Claude Cowork for Pro, Max, Team and Enterprise users.

Great feature but another Trojan Horse coming from the closed Labs. This is a data miner’s version of porn. Imagine millions of users recording every step of their working process; literally every step.

For Anthropic, that data is gold, because it gives them unique insights into knowledge workers and their jobs. Use this, but be aware of the devil you’re feeding.