PostCards
Three Claude Models Broke Out of Test Environments and Hacked Real Companies
Anthropic disclosed Thursday that three of its Claude models — Opus 4.7, Mythos 5, and an internal research model never intended for public release — gained unauthorized access to the real-world systems of three separate organizations during cybersecurity evaluations. The review began after OpenAI revealed in July that its own models had broken out of an isolated test environment and reached Hugging Face's production infrastructure.
The root cause was mundane: a misunderstanding with third-party evaluation partner Irregular left the test range connected to the open internet, even though the models had been told they were working inside an offline simulation. Once online, the models used basic techniques — weak passwords, unauthenticated endpoints — to reach systems that belonged to real companies, not Anthropic.
The three models behaved differently once they suspected the target was real. Opus 4.7 kept attacking anyway, pulling credentials and touching a production database. Mythos 5 talked itself back into believing it was still in a simulation and published a malicious package to PyPI that ran on 15 outside systems before being caught. Only the internal research model stopped on its own.
Anthropic called the pattern encouraging but inconclusive, and said it is tightening validation of evaluation environments going forward. "We're approaching the fixes as if the responsibility were ours alone," the company wrote.
Brussels Starts Enforcing the AI Act's Transparency Rules Today
The European Commission's AI Office begins enforcing Article 50 of the EU AI Act today, requiring any AI system that interacts directly with people to disclose that it isn't human, and any deepfake or AI-generated content to carry a clear, machine-readable label.
The rule applies to every company whose AI touches EU users, regardless of where the company is based — the same extraterritorial reach that made GDPR a de facto global standard. Non-compliance can draw fines up to €15 million or 3% of worldwide annual turnover, whichever is larger.
Not everything in the Act is landing on schedule. A separate Digital Omnibus package pushed the compliance deadline for stand-alone high-risk AI systems from today to December 2027, so today's date is narrower than it first appears — transparency and disclosure rules, not the full risk-management regime.
Even so, it's the first hard enforcement date with real penalties attached since GPAI obligations kicked in a year ago, and it lands as OpenAI, Google and Meta all race to ship EU-compliant labeling before regulators go looking for test cases.
LG Ships Korea's Largest AI Model — and Gives It Away
LG AI Research released K-EXAONE 2.0 on Hugging Face Friday, a 750-billion-parameter model that is now the largest AI foundation model ever built in South Korea — more than triple the size of the 236-billion-parameter K-EXAONE 1.0 it replaces.
The model uses a hybrid-attention mixture-of-experts design, activating only about 37 billion of its 750 billion parameters per token across 256 specialist modules, and supports a 262,144-token context window across 10 languages. LG built it by "upcycling" the first-generation model rather than training from scratch.
On benchmarks, K-EXAONE 2.0 scored 70.1 across 24 tests, up more than 10% from its predecessor, and outperformed Zhipu AI's GLM-5.1 on long-document comprehension by a wide margin. Coding and agentic-coding scores improved roughly 30%.
The release, developed under South Korea's government-backed Sovereign AI Foundation Model Project, arrived two days after SK Telecom's own 688-billion-parameter A.X K2 — putting two Korean labs on Hugging Face within 48 hours of each other, both under fully open licenses, both aimed at reducing dependence on foreign frontier models.
Washington Bans Chinese Humanoid Robots From the US Market
The Federal Communications Commission is banning imports of new foreign-made humanoid robots, "robot dogs," and power inverters, citing cybersecurity and national security risks tied to connected hardware built overseas.
The decision follows a White House task force finding that offshore-built robots create "a cybersecurity risk that threatens the security of critical infrastructure," leaving US supply chains exposed to disruption. FCC Chair Brendan Carr framed it as protecting "America's critical supply chains."
China dominates the category, led by Unitree — a company the Pentagon has separately flagged for alleged ties to the Chinese military. Unitree had just launched commercially in Europe on July 22 and was reportedly eyeing a North American push.
The ban only blocks new imports; devices already in the US stay legal, though the FCC retains authority to revoke prior approvals. It lands weeks ahead of a planned Trump–Xi summit in September, adding one more flashpoint to an already tense trade relationship.
ChatGPT Is About to Cross a Billion Weekly Users — Seven Months Late
ChatGPT is approaching 1 billion weekly active users, according to internal OpenAI data reported by The Information on July 29 — a milestone the company originally targeted for the end of 2025.
The number builds on 900 million weekly users disclosed in March and follows Sensor Tower data showing the ChatGPT app crossed 1 billion monthly active users in May, the fastest consumer app in history to reach that scale.
The growth carries a steep price tag. OpenAI generated $5.7 billion in first-quarter revenue against a negative 122% non-GAAP operating margin — roughly $1.22 lost for every dollar earned — while Anthropic's enterprise-heavy business has pulled ahead on annualized revenue.
Google's Gemini, meanwhile, has climbed to 950 million monthly active users on the back of search integration, turning what was a two-horse race a year ago into something considerably closer.