News
Over the past month, it seems like every frontier model has broken free of its constraints and launched a devastating attack against one or more other companies.
One of OpenAI’s models escaped a testing sandbox and launched a very real attack against AI and machine learning company Hugging Face. Just days later, Anthropic revealed that multiple variants of its Claude model also escaped a sandbox that wasn’t properly sealed and began attacking the enterprise infrastructure of three companies.
Now, Meta has revealed that one of its models attacked another company’s infrastructure during testing. The accident has been pinned on a misconfiguration that allowed the model to access the internet. So why have so many incidents happened in such a short space of time?
Why are models escaping their sandbox?In the cases of Anthropic and Meta, their models were being tested by a third party company called Irregular. Anthropic’s AI model was taking part in a "Capture the Flag" exercise, where the model’s raw offensive capabilities were tested without the usual safeguards. But the sandbox was left connected to the internet. A similar error to Meta’s own accidental escape.
During the OpenAI incident, the company was testing two versions of GPT‑5.6 Sol using the ExploitGym benchmark. Unfortunately, the AI models performed better than expected - chaining multiple attack vectors, stolen credentials, and zero-day vulnerabilities.
The main reason these models are escaping their testing environments is because they are designed to do exactly that. These AI models act like a massive team of highly-trained cybersecurity experts hunting for vulnerabilities and exploits. But what would take a team of humans days or weeks to accomplish can be done in hours, or even minutes, by these AI models.
It’s no wonder thousands of employees from AI firms are calling for a pause on the development of the technology, and Congress is considering an AI kill switch.
Expert perspectives on AI escapes:OpenAI- Nathaniel Jones VP, Security & AI Strategy, Darktrace:
What makes the OpenAI and Hugging Face incident important is that the models did not need malicious intent to cause harm. They were given the legitimate goal of solving a cybersecurity benchmark and found an unexpected route to the answers, escaping their test environment and compromising another organization in the process. From the models’ perspective, this appears to have been an effective solution to the task.
The AI's actions challenge the assumption that giving an agent a legitimate goal will produce legitimate behavior. As models become capable of pursuing objectives over longer periods, developers need to define not only what success looks like, but also which methods and boundaries remain unacceptable in reaching it. Those limits must also be enforced by the surrounding infrastructure, rather than relying on the model to respect them.
A single action by an agent may appear acceptable but as this incident shows, models are now capable of long, complex chains of reasoning and action that add up to a harmful outcome.
Security teams need to consider the AI systems operating in their own businesses as these capabilities rapidly evolve. Right now, many security systems focus on single actions. A single action by an agent may appear acceptable but as this incident shows, models are now capable of long, complex chains of reasoning and action that add up to a harmful outcome. Teams need a mindset shift to understanding AI agent behavior in its entirety, including the outcome it is working towards, in order to safeguard it.
Hugging Face's response also exposed a second tension. The company reportedly needed a Chinese-developed open-weight model because commercial models would not process genuine attack material. Its nationality is less important than the operational lesson that safeguards that cannot distinguish an attacker from an authorized investigator may constrain defenders more than adversaries.
OpenAI and Hugging Face deserve credit for investigating this together and discussing it publicly. Other AI developers should study it closely.
Anthropic- Dr. Ilia Kolochenko, founder of global cybersecurity company ImmuniWeb:
This seems to be quite an unimpressive marketing move from Anthropic in response to the OpenAI / Hugging Face drama, which attracted a lot of attention from all over the world recently.
Operationally, it appears that due to the progressive deterioration of the quality of training data, new AI models are getting dumber. Cheating and breaking the law, instead of accomplishing specific tasks, is certainly not an indicator of intelligence. Given that organizations and companies of all sizes now vigorously undertake all possible measures to protect their data from being exploited for AI training purposes, AI companies face a huge shortage of the high-quality and current data they so desperately need. Ultimately, frontier models are trained on synthetic, low-quality or even malicious and poisoned data, undermining their so-called intelligence. The situation is unlikely to improve in the near future unless AI companies agree to pay a fair price for training data, but this will force most of them out of business.
Given that organizations and companies of all sizes now vigorously undertake all possible measures to protect their data from being exploited for AI training purposes, AI companies face a huge shortage of the high-quality and current data they so desperately need.
Contemporary AI agents and LLM models tasked with security testing can – and almost certainly will – go rogue when security controls or safeguards are insufficient. Powerful LLMs are unpredictable by design and thus virtually uncontrollable by humans. Therefore, using frontier AI models for security testing might be extremely costly from the legal viewpoint. Under the existing laws on both sides of the Atlantic, if an AI agent or any AI-powered app escapes its sandbox and causes damage to a third party, the operator of the AI model will likely be liable for all the damage caused. Excuses like “AI did it” do not currently exist in the eyes of the law, leaving AI vendors on the hook. Criminal prosecution, under a narrow set of circumstances, is also not excluded.
The same is true for the end-users of AI: even if your security testing tool is powered by a third-party AI model, your company will likely be fully liable if something goes wrong. You may then file a lawsuit against the AI vendor that you used, but here your chances to succeed in a court of law are tiny due to countless contractual disclaimers and limitations of liability that will likely be enforceable against you. Therefore, if you plan to use agentic AI for security testing – think twice and talk to your lawyers. Otherwise, you may start getting summons to court on a daily basis.
Meta- Alex Goller, Principal Solution Architect EMEA at Illumio:
The fact we've had similar situations happen three times now across the biggest AI players is simply ridiculous. We've seen guardrails intentionally loosened to test their limits – Meta's model didn't need to be clever to breach another company's systems.
The timing of conveniently finding the exact same problem either means it's a stunt or they weren't paying enough attention during testing. Either way, both answers are worrying.
If the model has internet access, it's a bit like leaving the door open and being surprised when the cat walks out. What is concerning is that the testing infrastructure meant to prove these models are safe failed on a basic control issue.
If the model has internet access, it's a bit like leaving the door open and being surprised when the cat walks out. What is concerning is that the testing infrastructure meant to prove these models are safe failed on a basic control issue.
Fundamental cybersecurity hygiene still matters, and a frontier AI model is only as secure as the environment it's operating in.
Organisations need visibility into what AI systems can access and how they interact with the wider environment, along with controls that contain the impact when an agent behaves unexpectedly. That means keeping a close eye on egress traffic, so it’s flagged immediately when an agent tries to open unexpected outbound communication patterns that are not required to achieve its original goal. In the best case this would have been contained proactively.
We need to define exactly what an AI agent is permitted to do, rather than relying only on instructions about what it shouldn't do.
The Garmin Cirqa is making waves in the fitness community. I put the new screenless tracker through its paces over 10 days of intensive testing, and awarded it 4.5 stars in my Garmin Cirqa review. As part of the testing process, I wore it for all of my workouts over the past couple of weeks — and, unusually for a device I've been testing for review purposes, I'm still wearing it now.
I normally alternate between an Apple Watch Ultra 3 or a Garmin Fenix 8, but I've found myself loathe to ditch the Cirqa just yet. This isn't only because it's good: I'm gravitating towards the Cirqa because it interfaces with a system I already use, and because it's helping me get over the dreaded "Strava-itis".
Last month, our writer Becca Caddy wrote about optimization culture — how wearables are causing us to engage in unhealthy mindsets and disordered behaviors. I can certainly attest to that: I'm guilty of glancing at my watch during a run, wanting to push my pace even on zone 2 sessions and easy days, because I know the end results are going to end up on my Strava account for all to see.
Even uncoupling my watch from automatically uploading my run to Strava is only half the battle. I'm constantly glancing at the watch to check my pace and time, engaging in subconscious judgement, comparing my own performance to that of my mates, colleagues and acquaintances. I didn't realize quite how much my self-judgement was sapping my enjoyment of exercise.
The Cirqa, and to some extent the Google Fitbit Air I tested earlier in the year, goes some way to changing all that.
(Image credit: Future)(Image credit: Future)While the Cirqa offers up some fitness and wellness metrics (certainly plenty to understand the effect of exercise on your body and health), what it doesn't give you is workout specifics. You won't find split pace per kilometer, for example, which runners use to measure average speed across a distance run, or heart rate zones to display a workout's intensity. With other models, I get those statistics piped into my ears at regular intervals, and my watches offer them at a glance.
Having access to such statistics removed during the workout can be detrimental to performance or for those times you're training for a specific event, but it's oddly freeing for day-to-day fitness training. I ran a 10km route during the testing period (at least, I assume it was 10km based on previous runs) and the Cirqa recorded plenty of heart rate-based statistics and applied them to recovery metrics such as my Training Readiness Score, along with how it improved stats such as my VO2 Max and Fitness Age.
However, it informed me of these statistics after the run, and didn't deliver any specific run performance information at all beyond time and heart rate information. Without my watch to glance at during the workout, I wasn't adhering to a target pace: I was running on vibes and perceived effort.
I concentrated on how my body felt, and responded to that in the moment. I paid attention to my form, my music, the trees and the road. I didn't feel guilty about stopping to stretch part way through, nor did I pause the Cirqa for that particularly pause, as doing so would invalidate the whole "complete, holistic workout overview" thing it's got going on. For the first time in quite some time, I had no idea at all about how fast I had run — but I knew that it was a good workout as a result of every other metric and the fact that I felt awesome.
Although it isn't a running-specific device, the Cirqa is exactly what I needed to reinvigorate my relationship with the road. When the time returns to take my training seriously again, taking speed and times on board again, I'll switch back to my best Garmin watch, with all my fitness stats ready to be incorporated into Garmin's workout plans.
Do you run without a fitness tracker, or use a screenless model, to better run on vibes, or are you a metrics-fiend with a dedicated running watch? Let me know in the poll below.
Spotify wants to introduce new ways for listeners to engage with the artists they love the most, all while expressing their own creativity.
The streamer’s audio mixing feature for playlists has sky-rocketed in popularity, introducing a new way for listeners to modify their playlists. Now Spotify is working on a new AI-powered fan-made covers and remix tool — and it’s seeking the help of Merlin.
Spotify’s upcoming remix tool will come as a subscription add-on, though we don’t know when it’s due to drop or how much it will be on top of the current $12.99/ £12.99/ AU$15.99 monthly Spotify Premium plan.
Despite knowing very little about it, we do know that the remix feature will garner significant attention across the board of users, artists, organizations, and analysts alike. So what’s the end-goal for Spotify, and what are people saying about its potential knock-on effects for musicians and listeners?
What is the agreement?(Image credit: Spotify)On August 4, Spotify and digital licensing partner Merlin announced a new agreement that would give artists on labels under the Merlin name the option to lend their music to Spotify’s remix feature. Merlin is the second organization to sign on to the deal, following Universal Music Group in May.
For Spotify, the goal is simple: to ‘give listeners a new way to engage with the music they love from participating artists and songwriters,’ as stated in the announcement. Spotify also says the tool ‘will create an additional revenue stream for participating artists’.
However, despite knowing the tool will be AI-powered, Spotify hasn’t gone into detail as to exactly how it will allow listeners to create their own remixes of their favorite songs. The discourse around AI-generated slop is still a hot topic, and Spotify is still bearing the brunt of harsh criticism, so its venture into launching AI-powered music add-ons has left everyone scratching their heads.
What are Spotify’s competitors saying?(Image credit: Qobuz)As far as rival music streamers go, it’s safe to say the top dogs aren’t too interested in integrating AI throughout their respective UXs. While the likes of Apple Music and Tidal use algorithmic recommendations to fuel discovery, the number of generative AI tools is nowhere near as saturated as Spotify.
Listening to an artist’s music in the way it was released is the only concern for most companies, particularly for Dan Mackta, Managing Director at Qobuz, who gave us the following statement: “Qobuz isn’t looking at anything like this. The finished music that great artists release is good enough for us and our community”.
The desire to keep the traditional listening experience in place is quite prevalent on the one hand. Some users just want to kick back with an album or playlist, hit the play button, and let the music do its thing. But as music analyst and founder of MIDiA Research Mark Mulligan points out, the yearning for active participation is growing.
Mulligan detailed this in a comment shared with us: “A growing share of consumers want to do more than just listen. Audio modification is an opportunity both to tap into consumer creativity and fandom. Playing around with your favourite artist’s song is an ultimate expression of fandom”.
Additionally, he backed this up with his own findings from the recent MIDiA Q1 2026 consumer survey: “The potential of audio modification is significant. Consumer demand is clear, with 54% of consumers interested in some form of audio modification, from changing speed to swapping vocals, rising to 80% for 16–19-year-olds”.
Participatory music is a rising phenomenon, and software labels like A Vinyl Bar in Shibuya want to create experiences that go beyond just listening to a song. However, AI is out of the question, and the creativity is placed in the hands of the user, not generated by a machine.
What are artists/ organizations saying? (Image credit: Musician's Union)In light of Spotify’s announcement, it’s not just competitors that are having their say on the AI-powered remix tool. Additionally, artists and music organizations are questioning the long-term financial effects the feature could have.
Musician’s Union is a UK-based organization that represents artists in all areas of the music industry, and its General Secretary Naomi Pohl views Spotify’s partnership with two minds.
“The Merlin and Spotify announcement sounds positive as it suggests artists will have the choice to participate in licensing deals or not and, crucially, that they will share in any revenue generated by the use of their works. This is better than the blanket approach taken by some major labels,” she tells us, but she also raises concerns about how artists will be paid, adding the following:
“However, as with music streaming royalties, there is a question over how artists signed to independent labels will be paid by their label. Artists should in theory get 50% of any revenue their label receives, but in practice this may not happen in all cases as it will depend on the label’s interpretation of the artist’s contract. Many artists signed before AI deals were even conceived of. And, as with music streaming, session or backing musicians on tracks currently stand to receive no share of revenue”.
When it comes to royalties, Spotify has faced severe criticism due to its payment model. Because Spotify pools money generated from subscriptions, it means the most streamed artists over the year will receive a higher percentage of the profits made. So, even if you spend an entire year supporting and streaming an up-and-coming indie band, your subscription money is still going to artists like Taylor Swift.
Royalties aside, the other concern lies within the protection of music in its original form. PRS for Music, who handle the rights and royalties behind music, feel this strongly. “More generally, streaming services are embracing new technologies, including AI, to give fans new ways to engage with the music they love,” a PRS spokesperson told us.
But despite these emerging consumer tools, what could easily get lost is the care for the music itself. PRS fears this will become less of a priority, adding “Creators, and their work, must be central to the development of these new tools. They must be designed specifically to protect the integrity of the work above all else, and to ensure creators are fairly paid for the value they bring to each and every platform”.
At the end of the day, these platforms are there not only for fans to listen and engage with music, but they're there for artists to allow fans to hear music the way they intended. Though Spotify's AI-powered remix tool would be a creative addition to the service, how long will it be before everyone reverts to streaming AI-generated mashups instead of the real thing?
- Nvidia open sources its cuFile APIs and storage stack into a new GitHub organization with Google, Intel, and Meta as founding maintainers, and formally launched Storage-Next with 40-plus flash and storage vendors
- Nvidia's key unveiling is its SCADA framework, which moves the storage control path onto the GPU, allowing parallel GPUs to pull data directly from storage
- The driver is KV cache economics: inference fetches data in a few hundred bytes at a time, while SSD controllers tuned for 4KB spend the same effort on either size
Following the recent Future of Memory and Storage conference, Nvidia has argued that the next leap in AI rests as much on the storage feeding accelerated computing as on the silicon doing the computing.
The company open sourced its cuFile APIs and the storage stack beneath them, and formally launched an industry initiative called Storage-Next with more than 40 flash and storage vendors.
It also put a name to SCADA, the framework that lets GPUs pull data from drives without the CPU brokering every request.
A 512-byte problem that comes into focus as storage becomes keyNvidia's approach here is not new. cuFile was introduced in 2019 as the interface component of GPUDirect Storage and has shipped since 2021; its role is to take the CPU out of the data path. Bytes move by Direct Memory Access (DMA) straight between the drive and GPU memory, with no bounce buffer in host RAM. What stayed on the CPU was the control path: host software still decided what to fetch and issued every request, with the GPU as the DMA target rather than the initiator.
That split is invisible at large transfer sizes. A one-megabyte read essentially amortizes the per-request cost. At 512 bytes, the ratio inverts, the fixed cost dominates, and the CPU saturates long before the drives do. SCADA is the piece that moves the control path onto the GPU, letting it construct and complete its own storage requests and absorb per-operation latency, just as it already absorbs memory latency by keeping hundreds of thousands of operations in flight. The two are complementary rather than successive: cuFile for bulk transfers, SCADA for high volumes of small random reads.
The problem it solves is one that enterprise SSDs exhibit, having been tuned around 4KB random reads for nearly a decade to match virtualization and databases. As a result, most controllers do the same amount of work to serve 512 bytes of data as they would a 4KB read request.
AI inference access patterns are considerably smaller than that: embeddings run a few hundred bytes, and the KV cache blocks sit well under a kilobyte. Serving them from 4K-tuned drives imposes something like eightfold read amplification, and at tens of terabytes of small objects, that amplification decides whether flash works as a memory tier at all.
The KV cache, essentially the attention state for every token already processed, grows with context length, and agentic deployments run thousands of concurrent conversations. It quickly outgrows GPU memory, and recomputing evicted entries costs more GPU time than reading them back, so the standard design spills from GPU memory to system memory and flash, and refills through high volumes of small random reads.
Serving that from flash rather than DRAM increases the context length and the concurrent user count each GPU can support, which in turn affects the per-user cost of serving a model. This also explains why Nvidia is focusing on 512-byte IOPS rather than raw bandwidth, since inference performance depends heavily on the former.
Opening up cuFile is a departure; this layer has historically lived inside CUDA, and the logic is not charity. A GPU-initiated storage interface only pays off if drive, controller and array vendors build to it, and vendors do not build to a proprietary interface owned by the company whose GPUs they are feeding.
Publishing the interface, open-sourcing the implementation, and convening 40-plus vendors to standardize the underlying hardware behavior is how Nvidia aims to make GPU-initiated storage the industry default. It also stands to benefit the most from that outcome, since it sells most of the GPUs in question.
StorageReview notes Intel's participation as a significant development; a leading supplier of the x86 silicon currently sitting in storage controllers has signed on to maintain software designed to remove that silicon from the I/O path. Google and Meta co-maintaining a layer that standardizes how accelerators reach storage, while building their own accelerators, points in the same direction.
Nvidia's take is a coherent, well-argued push at a real bottleneck, with unusually credible partners attached. Partner systems from DDN, Dell, HPE, IBM, VAST Data and WEKA are due in the second half of 2026. Kioxia's XL-Flash drives built for 512-byte access are in development under Storage-Next.
Nvidia's roadmap calls for Gen7 SSDs sustaining 100 million IOPS each, which is a target controller vendors are designing toward rather than a product anyone can buy. Storage-Next itself has been discussed publicly since GTC 2025; this week, it acquired both a membership number and a framework to build against.