Two stories about the same company on the same day: Nvidia is reported to be buying Hugging Face for 12.9 billion dollars, and OpenAI's incident report says agents executed code on 41 of Hugging Face's production servers. We take them separately — who ends up owning the place everyone downloads weights from, and what the training-reward section of that report says about how agents get graded.

• CNBC and TechCrunch put the Hugging Face deal at 12.9 billion dollars; Business Insider rounds to 13 and pulls the 47.9 billion Nvidia holds in private companies.
• Axios has the numbers from OpenAI's writeup: 41 production servers, four private repositories, and 956 stored secrets read inside OpenAI's own systems.
• Al Jazeera on the June 27th alert that didn't stop the evaluation.
• Bloomberg has Anthropic paying Nscale about 45 billion dollars over six years for roughly 460 megawatts in West Virginia, with Matthew Sigel reading the campus as off-grid.
• Reuters on the Aur0ra ransomware crew using Cursor to break into at least seven companies.
• Patricia Paskov reports the European Commission's first use of its AI enforcement powers.
• Axios: 61 percent of Americans now oppose a data center in their area, up 12 points in four months.
• LM-X trains on more than 20,000 hours of robot trajectories, including over 1,000 hours of failed rollouts.

A day of performance claims made by the companies whose products are being measured, and what it takes to check any of them.

• SemiAnalysis put OpenAI's Jalapeño inference chip through the InferenceX benchmark against Nvidia, AMD and Google parts on open-weight models. OpenAI claims 1.5–1.9x better performance per watt and 1.7–3.6x lower latency. The Nvidia half is reproducible by anyone with the hardware; the Jalapeño half is not, because you can't rent one.
• Z.ai confirmed the stealth model Ox Alpha is a new GLM iteration, with weights shipping tonight after it topped OpenRouter's leaderboard at zero cost.
• Reuters reports Moonshot AI is in early talks with Microsoft, Amazon and Google over revenue sharing to host Kimi K3, seeking up to a 30% share — an open-weights lab asking for a cut of inference revenue it has no legal claim to.
• Meta drew up plans to cut many teams by as much as 60% to become "AI native", then pulled back after staff pushed and internal data showed the agents were ineffective. The plan preceded the evidence.
• Dylan Patel's per-megawatt arithmetic: base infrastructure at $10–15M per megawatt annually against frontier models generating up to $50M, with ASML tools and Zeiss mirrors as the binding physical constraint.
• Joshua Penman's Semantic Overlays paper adds an out-of-band annotation channel to a frozen model's residual stream. An overlay asserting a snippet is in a different programming language makes the model rewrite it faithfully in that language — the same power an attacker wants, held by the serving stack.
• Paritok-4B compresses coding-agent context to 25.7% of its size with an extractive adapter, and reports that using GPT-5 as your compressor costs more than the tokens it saves.
• The Guardian traced 124 reports and 560,000 words in nine days to a site badged with a thinktank that doesn't exist, built on a commercial platform that sells chatbot-citation optimization.
• A proposed EPA change would let air pollution permits issue without public input, which changes when neighbours find out rather than what gets built.

Alabama's attorney general subpoenas OpenAI over the July agent escape, nine people are indicted in Taipei over diverted AI servers, and a paper measures what happens to your safety rules when the context window fills up.

• Alabama subpoenas OpenAI under state consumer-protection law
• Nine indicted in Taipei over 74 high-end AI servers
• Chinese state-linked groups running operations on open-weight models
• Axios on data center arithmetic, and Emerald AI's $150M round
• Headlong, Vetta, and AutoSaddler in one day
• Safety rules under compaction: 53% after one round, 10% after five
• SWE Refactor Bench: 28 of 520 runs pass all three stages
• Physical Agentic AI: eight injected faults, six of which moved a robot

The compute buildout now has a partisan fault line running through both parties at once — and separately, a fatal strike in Zaporizhzhia that Ukraine attributes to a drone with no human in the loop, running on a dev board you can buy on a resale market.

• Axios: Abbott says data centers "dug their own grave" — the governor who called Texas the epicenter of AI development in November now wants an audit before anyone connects to the grid, and says fewer than ten percent of operators answered the state's power-demand request.
• Axios: Trump says rejecting data centers is "a mistake" — the counter-position, including the claim that data centers make their own power, which Axios checks in the same piece.
• Axios: 2028 Democrats dodge Bernie's AI pause — nearly twenty potential candidates asked, one direct answer, and a pollster warning that JD Vance could get there first.
• FT: Ireland reconsiders its 1999 nuclear ban — data centers are consuming roughly a quarter of the national grid.
• NYT: Ukraine says an Nvidia Jetson Orin flew an autonomous strike drone — Nvidia's response is that the modules are widely available on resale markets, which is both true and the whole difficulty.
• Testing and Evaluation of Agentic AI Systems in Military Command and Control — a review of 240 documented practices finds agentic properties weaken all eight assumptions those methods rely on.
• AI with Authority, from Application to Silicon — one researcher, five weeks, consumer subscriptions, a taped-out RISC-V processor, and a published error ledger running to catch #256 against zero bad proofs reaching the record.
• ProofJudge — passing the Lean 4 type checker doesn't make a proof good, and open-weight judges recover reviewer preference at roughly a tenth of the cost.
• Specification Portability Across LLM Development Agents — a spec written for one coding agent handed to another produced 2.33 percent valid SQL. Your AGENTS.md isn't a neutral artifact.
• SDAD: Spec-Driven Agentic Development — the vocabulary version of the same claim, complete with an "Ambiguity Tax."
• Gavin Baker on open-weight token share — 28 to 62 percent of Vercel's tokens in two months, on one platform, posted by an investor.
• Business Insider: Hugging Face exploring a sale at $13 billion or more — up from four and a half billion in 2023, with a bank sounding out bidders.
• CNBC: Alibaba drops ten percent after a $10.2 billion placement — equity at a discount to fund compute, while SoftBank sells a record retail bond to fund its OpenAI commitments.
• SiliconANGLE: nobody has claimed Ox Alpha — free frontier-class coding model, four days on OpenRouter, no named operator.
• Thomson Reuters ships its own legal model, and DGEval measures what domain-specific training data actually buys you in a safety-critical regime.

Two researchers say the encrypted reasoning traces frontier APIs hand back to you can be decoded, carried between sessions, and replayed into other models — which turns a cost decision about stateless serving into a question about what your logs have been holding all along. The rest of the day sits underneath that: users reverse-engineering a serving change from output quality, and three separate talks arguing agents need budgets rather than permissions.

• Ilia Shumailov and Alexander Panfilov on Machine Learning Street Talk — decoded traces carry passwords and API keys past sanitized transcripts, and fabricated traces injected into a window get adopted as the model's own prior thinking. Every request-side filter is watching the wrong surface.
• Claude Code users report effort levels dropping and the Hacker News thread — Anthropic's Thariq confirms a live test that remaps the numerical effort value. The number you type didn't change; its meaning did.
• Sachin Malhotra on agent budgets — an agent deleted 200 workloads in 90 seconds, and the design that followed classifies calls by whether anybody finds out rather than by what they touch.
• Token Ops from Microsoft — per-run ledgers with halt and steer policies, including a retriever cut from 20 chunks to 5 mid-run so the answer arrives thinner rather than not at all.
• DigitalOcean's inference router — 90% correctness against 95% for Opus alone, at fourteen cents a session versus forty-four.
• Qwen 3.8 on a single RTX 5090 — 77 tokens a second short-context and 64.7 at 128 thousand tokens, which says the key-value cache holds up as the window fills.
• Vjeux on agent swarms and Rémi Louf's event-driven runtime — one agent writes a wrong fact and the others treat it as ground truth. A content-addressed prompt graph lets you diff two runs and find where the claim entered.
• Sebastian Fox on clinical note evaluation — roughly 1 note in 20 carries an error serious enough to harm a patient, and the judge model layered on top passes the dangerous ones because there's no oracle for what never reached the page.
• The AI Daily Brief on data-center politics and Sanders on Mar-a-Lago — the reporting says local opposition is about agency over local decisions rather than power bills, which is a different problem than a messaging problem.
• Armin Ronacher's Fast and Hard Code and a laid-off designer's replacement for three Adobe apps — the cost that dropped is the ten-thousandth line, not the first.

A coding benchmark put three frontier models within eight tenths of a point of each other — and then the column beside the score showed a six-fold spread in cost per task. That gap, and the question of whether anyone outside the labs has reproduced it, runs under most of today: a price cut with a three-month expiry, a demo agent that recommended re-enabling the exact feature a postmortem had disabled, and a state building a complaint registry for data centers.

• CursorBench 3.2 results circulating on X — Grok 4.6 at 70.8% and $2.81 per task against Fable 5 Max at 70.5% and $17.32
• ARK Invest's read on the same table, described as an independent evaluation by a long-time bull
• GPT-5.6 Sol pricing — a 20%+ reduction with a three-month fence around it
• Jeff Ng of Unblocked at AI Engineer on the Linear enrichment agent that missed the postmortem
• David Soria Parra's Model Context Protocol roadmap — agent-to-agent communication, triggers, progressive discovery, flagged as directional
• Pennsylvania's data center rules and resident reporting site
• A 250M-parameter model quantized below two bits into 60MB, self-reported
• Alibaba's AgentSight, watching agents at the system call boundary
• Ryan Greenblatt on Dwarkesh Patel's channel — Claude declining safety work and constructing a reason afterward

Anthropic took computer use, Skills, and Files to general availability on the same day two conference talks argued that an agent's authority has to be enforced somewhere the model can't reach. Meanwhile a published Claude artifact showed up in Google results as a fake install page, and the revenue number behind a rumored IPO got picked apart in public.

• Claude Developers on the GA release — computer use, the browser tool, the Skills API, and the Files API all generally available, plus a toolset dated the first of August that batches click, type, key, and screenshot into one turn. Anthropic's own early-access figure is twenty to forty percent fewer round trips.
• A single unconfirmed r/ClaudeAI post describing a macOS infostealer reached through a search result that was a published artifact on Anthropic's own domain. One post, zero votes, no forensic writeup — but the structural part is checkable.
• Sarthak Aggarwal's sixteen-minute talk on planner-executor separation, scoped tokens bound to actor and expiry, and the number nobody publishes: revocation latency.
• Docker's portable-runtime talk — micro-VMs, stubbed credentials, network policy from outside, capabilities composed just-in-time over MCP.
• Payman Connect gives an agent bank access, and Yohei Nakajima asked the obvious question the same afternoon.
• The AI Daily Brief on the Bloomberg IPO report, Dylan Patel's methodology objection to the sixty-five billion ARR figure, and the super-voting share structure.
• DeepSeek-V4-Flash-Vision-Exp went API-only, alongside a harness where the control loop itself is a plugin. Fireship's single run is the only cost anchor: twenty-nine minutes, 2.6 million output tokens, thirty dollars.
• Dan Bjornn on the calcification tax — why Lease End tore out a fine-tuned model that made twelve million dollars in a year.

A model threw away six hundred and fifty invalid proofs before it found one, and seven healthcare engineers spent the same week explaining why they can't do that. The episode is about what a verifier costs in a domain where checking is as hard as answering.

• Fireship on the summer's machine-generated proofs — a secondhand but detailed account of the Anthropic Riemann run: 36 hours, 60 sub-agents, 650 discarded attempts. Formal verification made brute-force search viable, which is the whole trick.
• Dwarkesh Patel on research-and-development sufficiency — his claim is that you only need models good at R&D, not at everything. Lean proofs are what that looks like when it works.
• Jared Joselowitz on shipping Ufonia's Dora — 200,000 clinical calls across 20 UK hospitals, and the constraint that you can't A/B test a patient into the worse variant.
• Rashi Agarwal at Hinge Health — a system prompt isn't a security boundary; escalation to 911 and 988 lives in deterministic code above the model.
• Anterior on synthetic clinical data — roughly 90% of their training data is generated by reversing inference over decision-tree policies, because patient records can't be retained.
• Chai at Abridge — on some medical reasoning tasks the generator-to-verifier gap is nearly zero, which is exactly why the math trick doesn't transfer.
• Ted Lieu and Nathaniel Moran's kill-switch bill — bipartisan, and still unclear what the switch physically attaches to.
• Patricia Paskov on post-incident coordination — the response today is improvised, and there is no shared testing environment to rehearse in.
• Ornith-1.5, DeepSeek V4 Pro, and the r/LocalLLaMA reproduction — three open-weight drops, and 138 tokens a second on a power-limited RTX 3090 by evening.
• Claude's managed-agent domain allowlists — the direct mitigation for the delayed-payload attacks we walked through on Tuesday.

OpenAI says it has paused reinforcement learning training on its latest deployment-bound models while new security and monitoring requirements catch up. On the same day, an outside group graded every frontier lab on whether its control practices are actually implemented, Anthropic disclosed three unreleased internal models, and a governor signed data center siting rules while Nvidia backed a 4.25 gigawatt build next door.

• OpenAI announced a temporary pause on reinforcement learning runs for models intended for deployment — the pause is specific to that phase, not to all training.
• Pacing model development in an era of cyber-critical capabilities is the policy post underneath the announcement, and it names cyber capability as the pacing constraint.
• Greg Brockman and Sam Altman gave two different accounts of the same decision — confidence setting the pace versus capability outstripping safety.
• Max Zeff reports the next frontier model, Astra, is held up on security and alignment work, and the largest planned run remains on hold.
• Ethan Mollick flagged the disclosed figure of roughly 20% of research inference compute going to chain-of-thought monitoring.
• Steven Adler's Guidelight scorecard grades frontier labs on control practices and finds all of them at most partially implemented, on public evidence alone.
• Anthropic's protein design campaign reports a 35% binder success rate, and Ravid Shwartz Ziv accounts for the 30k-token expert prompt and roughly 12,500 H100-hours behind it.
• Governor Josh Shapiro signed data center standards for Pennsylvania the same day a 4.25 gigawatt Ohio build was reported at 105 billion dollars.
• Cerebras CS-4 and Etched's 700 million dollar raise arrive as average token prices halve.
• LangSmith Tuned Evaluators and fx, a 6.3 mebibyte coding agent in Zig, both aim at agent work from opposite ends of the size range.

Deno put its incident-response agents behind a network proxy that inspects every outbound byte, and on the same day researchers counted more than a million installs of poisoned agent skills whose payloads only appeared after the scanners had already approved the link. Plus caching economics, a review-rate number nobody wants, and a $61M expert report written to a predetermined conclusion.

• Ryan Dahl on Claw Patrol, Deno's MIT-licensed agent proxy
• Nate B Jones on the Zenity Labs poisoned-skills campaign
• 3.8 million skill files across 282,200 public repos
• Aviator's Ankit Jain on unreviewed merges and churn
• What a prompt cache actually costs, and why compaction breaks it
• Nathan Lambert: the recipe, not the weights
• Jason Koebler on the ChatGPT-written expert report