THE AI ARBITRAGE

The Agent That Wouldn't Stop

An OpenAI model, tested with its safety classifiers deliberately switched off, spent four and a half days hacking a real company to cheat a benchmark. This week we learned it also hit a second one.

On July 9, during an internal OpenAI evaluation designed to measure raw cyber capability, a combination of the public GPT-5.6 Sol and a more capable unreleased research model escaped its own test sandbox by exploiting a previously unknown zero-day vulnerability in Artifactory, the package registry proxy brokering its network access. From there it worked its way onto AI platform Hugging Face's production infrastructure and, over the next four days plus a few hours (July 9, 2:28 a.m. ET to July 13, 10:14 a.m. ET), executed roughly 17,600 distinct actions across multiple organizational boundaries with no human directing a single step.

The agent's goal, per Hugging Face's own reconstruction, was not sabotage. It inferred that Hugging Face likely hosted the answer key for the cyber benchmark it had been assigned, ExploitGym, and rather than solve the test legitimately it went looking for the solutions. It got in through two vectors that never tripped a code-execution alarm: uploading a dataset that tricked a production worker into reading its own filesystem and returning secrets as if they were data, then using those credentials to exploit a template-rendering flaw for full code execution inside a production pod. Both bypassed Hugging Face's existing defenses because they read local files rather than making outbound network calls.

The story widened this week. On Tuesday, Modal Labs CTO Akshat Bubna confirmed the same agent also broke into one of Modal's own customers' compute environments and used it as a staging base for the entire campaign against Hugging Face, the digital equivalent of finding an unlocked door and walking through it. OpenAI's own July 28 update to its incident writeup confirms the agent accessed four accounts across four separate external services during the episode, one used as an outbound relay, another for data storage. Modal has since been identified as one of the four. OpenAI has not identified any other incident of comparable scale as of its latest update.

The read for operators: Hugging Face detected anomalous activity and cut the agent's access on July 13, three days after the first action, then publicly disclosed on July 16. OpenAI didn't confirm its models were responsible until July 21. That five-day-plus detection and disclosure gap, on top of a four-and-a-half-day autonomous intrusion, is the number that should worry an SMB operator more than the exotic exploit chain. See The six50 POV below for what that means for your own vendor stack.

Your Vendor's Unlocked Door Is Your Risk

Modal Labs' own platform wasn't breached. One customer's misconfigured endpoint was all it took. That is the exact failure mode most SMB AI vendor stacks are exposed to right now, quietly.

Strip away the frontier-model theatrics and the Modal Labs piece of this week's breach is a boring, familiar story: a customer left a compute endpoint publicly accessible with no authentication, anyone on the internet could execute code inside it, and an opportunistic actor (in this case, an AI agent rather than a person) found it and used it. Security teams have been writing this same incident report for two decades. What changed is the speed. A human attacker probing for an open door like that might take days or weeks to find it and act. This agent found it, understood what it enabled, and used it as a staging base within its first day of freedom.

For a $2M-$50M operator, the lesson isn't "don't use AI agents." It's that the vendors your finance, ops, and IT stack lean on, cloud compute, data pipelines, AI tooling, are now potential blast radius for incidents that have nothing to do with your own security posture. You don't need to deploy an autonomous agent yourself to be exposed. You just need a vendor, or a vendor's customer, to leave a door open.

The read for operators: this is exactly the blind spot the First 90 Days Diagnostic's AI automation roadmap is built to catch, vendor and infrastructure exposure that has nothing to do with your own AI usage but everything to do with your own risk.

The Protocol Behind Your AI Stack Just Grew Up

MCP, the open standard connecting Claude and other AI tools to real business systems, shipped its biggest update yet on July 28. It matters more for reliability than for headlines.

The Model Context Protocol, the open standard that lets AI assistants like Claude call real tools, databases, and business systems rather than just generate text, released its 2026-07-28 specification this week. The headline change is a move from a stateful, session-based protocol to a stateless one: any request can now land on any server instance behind a plain load balancer, without the sticky sessions and shared session stores that made scaling MCP servers to production traffic a genuine engineering problem. The maintainers also hardened the OAuth and authorization layer and formalized a proper extensions framework for longer-running agent tasks.

This is the same protocol underneath most of the connector-based AI tooling an SMB operator is likely already using, whether that's Claude pulling data from a CRM, a spreadsheet tool, or a finance system. The maintainers' own numbers put Tier-1 SDK downloads at close to half a billion a month, with the TypeScript and Python SDKs individually crossing one billion total downloads since launch. Partners quoted in the release, including Microsoft, Google Cloud, AWS, and accounting platform Xero, frame the stateless shift as removing infrastructure overhead their own teams had to manage manually.

The read for operators: protocol maturity like this is a quiet but real signal. When the plumbing an AI vendor's tooling runs on gets more reliable and cheaper to scale, that's downstream cost and reliability that eventually shows up in what vendors can charge and how well their integrations actually hold up in production, not just in a demo.