Humans on AI, August 1st 2026

• Anthropic also reveals hacks, HuggingFace releases more details on the incident
• Leopold’s Aschenbrenner Situational Awareness margin called
• OpenAI starting a price war v. DeepSeek
• Over 1k labs employees release an open letter on pacing the frontier

Opinion: Charitably, it’s possible that Leopold and his fund were not only attempting profit-maximizing investments but also to sculpt technological growth in accordance with Leopold’s paper on a ‘risk-minimizing technological growth rate’. We note that other stockmarket -focussed actors with risk-minimizing investment agendas, such as VARA or AIPR, have also seen their influence significantly reduced in the last month.

Opinion: That’s a big if! The implication’s plausible, but labs’ revenue growing by 10x would make them the biggest companies in the world. There is also the Straussian reading that the timing of the argument was a hail mary to avoid liquidating Leopold.

Opinion: This saves US robotics startups that wouldn’t be able to compete with Chinese ones, while hurting potential US consumers. As a protectionist measure, it kills the last chance for US robotics firms to have global market discipline.
Note that the ban only applies to new models (as it does not affect models that already received FCC authorization) and that the FCC still has an import exemption that “allows up to 4,000 units of a given model to be imported for testing, evaluation, or product development“.

Opinion: OpenAI is flexing its compute advantage and post-training prowess in an attempt to “offer the best price/intelligence tradeoff at every level”. Evidence of serious efforts by OpenAI to drive Chinese open-weight models out of the US market. At the same time, labs using their models to reduce their serving costs perhaps means that the barriers to entry increase for new competitors.

Opinion: The new DSv4-Flash appears to be a major improvement, mostly due to reworked post-training. We’ll have to see how the updated DSv4-Pro performs, but in the meantime DeepSeek is back on the pareto-frontier thanks to an update focused on agentic performance. For reference, should the upcoming DSv4-Pro checkpoint see similar gains, it’d land close to GPT-5.6 Terra (max), GPT-5.5 (xhigh) and Grok 4.5 (high) at roughly an order of magnitude lower cost.

Also noteworthy is that this represents a significant increase in capabilities for models runnable locally with reasonably accessible hardware – unlike in the case of larger open-weight models (such as Kimi k2.6/k2.7-code or GLM-5.2) reasonably fast inference for DSv4-Flash is feasible after quantization on e.g. a MacBook Pro (provided it has enough memory).

One might think that Chinese models do not have the capacity to serve these models at scale, and so their reduced prices predictably lead to shortages. And this is indeed the case for Kimi’s K3, and for advanced models. But for smaller models, as a sanity check, if DeepSeek has 10K to 20K H100-equivalents allocated to inference, and 8 H100s can serve ~100 to 500 requests per second for DeepSeek V4 flash, that’s 150K to 1M requests per second, or 14B to 80B per day. Even for its 5x heavier pro models, DeepSeek is planning to deploy Huawei inference capacity later this year.

Opinion: Nice formal model, and we think there’s a solid intuitive case that in key R&D domains limits on parallelization are both a critical bottleneck and difficult to alter. But even in domains where a hard limit on parallelization constrains R&D, just “ordinary exponential growth” can still be pretty fast.

Opinion: Pangram is turning seven-figures-budgets into high impact social infrastructure/resilience work. An encouraging example of social adaptation on the cheap.

Opinion: Considered by the mathematical community to be “the most important math AI result yet”. Also heralds OpenAI’s next models. Potentially the first clear capabilities-jump since the Unit Distance proof, we are waiting for further details and expert analysis

Opinion: Doesn’t seem super useful yet, though worth extrapolating where these models will be in one, three, ten years. Google is also famously pretty bad at productizing its models, and at giving developers assurances that they will not deprecate their offerings.

Opinion: Not bad at all for a neolab, especially considering that the model is slightly smaller than DeepSeekv4 Flash Preview. Unfortunately however it’s neither competitive from a capabilities POV – given today’s release of DeepSeek-V4-Flash-0731 and the recent GPT-5.6 Luna discounts – nor from an economics POV – given the inferior DeepSeek-v3-like architecture – but it still represents good progress for Thinking Machines towards reaching the frontier.

Opinion: The result is not beyond more generally capable frontier models, though it is still somewhat noteworthy for a Chinese open weight model; results of this kind so far have been limited to western frontier ones. The help of 5.6 sol caveats the success, though.

Opinion: As some, like Florian Brand, have argued, harnesses do matter a lot. This should tell you that current benchmark scores likely downplay model capabilities, particularly for models often evaluated in non-native harnesses, such as Chinese ones.

Opinion: We’ve long had an absence of evidence for the effectiveness of autoresearch on open-ended problem. We now also have more direct evidence of absence.

Opinion: A significant act of coordination from lab employees, and seemingly organic (not management-driven). Contributes to shifting the Overton window, but unlikely to have a direct influence on US policy given the US government’s negative attitude to international coordination.

Opinion: Very noncommittal. Instructive that he did not sign the above letter.

Opinion: Cryptography experts characterize this as a “very impressive” development that “shows that the way cryptography and cryptanalysis are performed will change forever“. Still, the HAWK digital signature scheme is not yet in production, and the AES attack is on an easier-to-attack variant; the full 10-round AES is very unaffected, and there are no practical applications to this discovery. Experts also stress that this is an incremental improvement relative to human-discovered weakness in HAWK and AES, and that HAWK and AES are “two fertile [cryptanalysis] areas where there was progress to be made but not enough people working on them”.

The obvious next-development to watch out for is frontier models breaking a cypher used in the real word. We’re skeptical that this is imminent, since for most real-world ends breaking a cypher is extremely hard compared with finding more prosaic vulnerabilities.

Opinion: OpenAI’s ‘rogue agent’ is superhuman at hacking in at least some meaningful senses — superhuman in speed, volume, spontaneity, and persistence.

Opinion: The investigation is not attached to an external control mechanism (e.g., a regulator with the ability to impose fines), and it’s narrowly scoped from the outset. Arguably a form of controlled opposition. Still much better than having no independent review though. It’s also notable that they aren’t hiring a proper cybersecurity firm.

Opinion: Important confirmation that the problem is convergent rather than down to one company’s training-style.

Anthropic’s report is clearer on some theory-relevant details than the OpenAI reporting has been: Antropic’s rogue model had all the standard alignment bells and whistle internally, with only external classifiers-based filters shut down. OpenAI weren’t fully clear on this, but it’s now reasonable to assume the same is true about OpenAI’s rogue model.

Anthropic’s interpretation of its autonomous offensive cyber incidents is that the model thought (or ‘thought’) breaking out was part of the offensive-cyber-test fiction, and believed (or ‘believed’) that it was doing fictional open-world hacking rather than real open-world hacking. Note also that according to Anthropic, their incidents are slightly different from OpenAI’s in that their model’s sandbox was accidentally left open — in the OpenAI incidents models hacks their way out of the sandbox.

Anthropic’s narrative is arguably slightly ‘convenient’: can seem to walk a tightrope between establishing that they too have scarily-capable models and maintaining Claude’s reputation for being good boy who only hacked because he thought he’s in a fictional game-internet.

Overall reflections: We are very curious about what the broader implications of these new hacking capabilities will be, and whether they will ultimately be offense-dominant or defense-dominant.

- Why defense-dominance is plausible : There are a finite number of security bugs, and defenders can patch them before attackers get a chance to use them, as well as to use models to monitor and interrupt attacks. Financial institutions in particular may have protections that will prove good enough (credit card reversals, 2FA, prosecution of fraudsters, a mandated delay in international wires.)

- Why offense-dominance is plausible: The global software stack is fundamentally built on unsafe assumptions, and is just too complex. Changing it upfront will be perceived as too costly, this will lead to attackers finding fruitful areas of attack in e.g., companies that prioritize growth over security, third world or EU countries access to frontier models or LLM expertise, etc. This will cause some economic loss, and, as a long-tail scenario, chaos.

Past research by Palisade, or by the UK’s AISI, was sometimes criticized as lacking ecologically validity: breaking into a network designed to be hacked is not the same as breaking into a real network. In retrospect the real-life incidence appear well-modeled by AISIs test scenarios. This should make us more bullish that small-scale, ‘artificial’ demonstrations of AI risk can approximate realistic scenario.