2026-07-31 02:08:36
One of a series of striking AI-assisted math discoveries, this one feels a little different.
As millions of people were coming down from the excitement of the FIFA World Cup Final at the start of last week, a different kind of excitement was building within the mathematical community.
Levent Alpöge, a mathematician working at the artificial intelligence company Anthropic, made a very casual announcement on X that he had found a counterexample to the Jacobian conjecture, a very old and well-known problem in a field of mathematics called algebraic geometry. He had done this using Anthropic’s large language model Claude Fable 5, released to the general public only a few weeks ago.
This is just the latest of many striking mathematical breakthroughs made by mathematicians working with large language models. But this one feels a little different to those that have come before.
First, what is a conjecture? It’s an idea that some mathematicians believe is true but nobody has been able to prove or disprove.
Now to the Jacobian conjecture. It’s fairly abstract but not too difficult to describe.
The conjecture involves functions, which are like little machines which you put one or more numbers into and out pop other numbers according to some rule or equation. In this case, the functions use what are called polynomials.
Specifically, it’s about situations where the numbers represent points in a space, like coordinates on a map. So we can imagine that when the function takes in some numbers and puts out some other numbers, it is moving the points in space.
You can test how “nicely” a function moves everything around in space by calculating something called the Jacobian determinant. If the Jacobian determinant is always a constant number that is not zero, then the function never folds or crushes space around a particular point.
The Jacobian conjecture states that when the Jacobian determinant is a non-zero constant, there should always exist another function, also made up of polynomials, that reverses the original one. This will return all the points to their starting positions.
Not every function is reversible. For example, if our starting function moves two of the original points onto a single point, then we cannot reverse it. Once the points have been merged, we cannot distinguish between them to send them back to the right positions.
The two-dimensional version of the Jacobian conjecture was stated by Czech mathematician Ludwig Kraus in 1884. It was generalized to any number of dimensions by German mathematician Ott-Heinrich Keller in 1939.
It was considered so compelling that Fields Medalist Stephen Smale included it in his 1998 list of Mathematical Problems for the Next Century.
During its long history, the Jacobian conjecture has been the subject of many claimed proofs, including by Beniamino Segre and Wolfgang Gröbner, two famed 20th-century mathematicians. However, in each case, subtle errors were found that invalidated the arguments.
Despite this, there have also been a number of valid efforts showing the conjecture is true with various restrictions. Computational results have also shown it is true in two dimensions for polynomials up to degree 100 (that is, including powers of the variables up to 100).
But nobody had proved the general case—or found an example showing the conjecture was wrong.
One of the key reasons the Jacobian conjecture is so intriguing is that, in theory, it should be easy to find a counterexample. It is straightforward to come up with examples of functions that merge points, and also examples of polynomial mappings that have a constant Jacobian determinant.
However, finding a polynomial mapping with both properties is the challenge. Indeed, as one Math Stack Exchange user noted in a post from 2017, “for all what we know, some smart undergraduate can simply write a formula […] that will be a counter-example to this conjecture.”
Indeed, this did turn out to be the case for Alpöge’s function, which is short enough to fit into a single X post. He found an example of a function in three dimensions which has a constant Jacobian determinant of -2, and which moves multiple input points to the same output point, so it is not reversible.
It shows the conjecture is false for every dimension larger than 2, with the original conjecture in two dimensions remaining open. The brevity of the counterexample made it easy for other mathematicians to verify.
Alpöge’s discovery is the latest in a string of high-profile mathematical breakthroughs made by large language models. Recent examples include OpenAI’s disproof of the unit distance conjecture, and the proof of Erdős’ problem 1196 by Liam Price, a 23-year-old amateur mathematician.
Both examples illustrate one of the most striking strengths of AI models. They can draw on ideas from different areas of mathematics, combining them in a novel way to prove astonishing results.
At the time of writing, details have not been made public regarding exactly how Alpöge prompted the AI model to produce the Jacobian conjecture counterexample and what its output looked like. However, so far this result appears to be of a different nature.
Unlike many other recent AI-assisted breakthroughs, the counterexample itself is remarkably simple. The difficulty in finding it seems to have lain not in an intricate construction or a lengthy proof, but rather in finding a good way of navigating an enormous search space of possible polynomial mappings to find one with the right properties.
This suggests AI may prove to be just as valuable for discovering unexpected mathematical objects as it is for constructing proofs. What this means for the future of mathematics—and human mathematicians—remains to be seen.![]()
This article is republished from The Conversation under a Creative Commons license. Read the original article.
The post ‘Hello There the Jacobian Conjecture Is False Thanx’: Why a Tiny Social Media Post Has Mathematicians Rethinking AI appeared first on SingularityHub.
2026-07-29 07:11:22
Researchers say AI vastly improves a technique used to engineer proteins. As a proof of concept, they redesigned the Botox enzyme to snip a protein linked to ALS.
Building new enzymes is a labor of love. These proteins are the body’s chemical workhorses, speeding up the reactions that make life possible. Researchers use them in gene editing and synthetic biology, and they’re involved in many medical treatments.
But enzymes are also extremely finicky. Even tiny changes to their structures can jeopardize how well they work. To grow or improve their capabilities, scientists usually begin with a natural enzyme. In a process called directed evolution, they slowly nudge the enzyme towards new versions with tailored properties. The process is tedious, time-consuming, and despite best efforts, it may never yield the desired result.
“Laboratory evolution requires the commitment of time and resources. So what you start with is incredibly important as a major determinant of what you end up with,” said David Liu at the Broad Institute of Harvard and MIT in a press release.
Natural enzymes don’t always make good starting points. During directed evolution, they can collapse and stop working. But upgraded designs could be far more resilient.
Now, Liu and colleagues have redrawn the starting line. As a proof of concept, they redesigned the enzyme behind Botox with the help of a popular AI model to create more stable variants for directed evolution.
The evolved enzymes were far more stable and specific at cutting a protein linked to neurodegeneration compared to enzymes evolved from their natural counterparts. The strategy could expand the universe of designer enzymes, making it possible to target protein sequences that are currently out of reach because no suitable natural enzyme exists.
“The most important finding is that using AI to stabilize natural proteins can provide much better starting points for laboratory protein evolution than what we and other researchers have been using for decades,” said Liu. “This insight could change the way researchers conduct protein evolution.”
Liu is no stranger to reprogramming proteins. As the pioneer of base editing—an offshoot of CRISPR gene editing that swaps single DNA letters—his team has long pursued enzymes with better stability and precision.
One way researchers do this is by speeding up evolution. Like all proteins, enzymes have evolved over eons. Some copy, repair, or modify DNA. Others convert nutrients into energy, break down toxins and drugs in the liver, or relay messages inside cells.
Researchers have long tried to make enzymes that do even more by evolving them in the lab. Success is largely tied to the number of generations they can produce. The more rounds, the greater the chances of producing the desired results. This is why these experiments are so tedious. Each round takes time and careful monitoring.
In 2011, Liu’s lab reported a system called PACE that could perform dozens of rounds of evolution a day without intervention. The system grows bacteriophages—viruses that infect bacteria—in vessels that are continuously diluted of certain molecules. Only viruses carrying improved proteins survive the selection pressure.
Using PACE, the researchers created more efficient prime editors, highly precise RNA-targeting enzymes, therapeutic antibody fragments, and tiny gene editing “scissor” proteins.
Then they hit a wall. Nearly all of the team’s successes began with natural proteins. These were effective to a point, but their descendants would often lose stability as they evolved.
Proteins work by docking with their targets, called substrates, like keys fitting into locks. But evolving new abilities requires them to mutate, which increases the chances their structures warp. Rather than fitting the intended locks, the resulting altered proteins instead clump together and become useless. Precision can also suffer. Even if enzymes have been evolved to recognize new substrates, they may still unintentionally act on their original targets.
Proteins that become less stable during the process can require additional work to make them usable, wrote the team.
There are a few workarounds. In one such strategy, researchers adds chaperones—these are proteins that help other proteins fold correctly—to buffer the effects of harmful mutations. While this can work, it adds another layer of complexity to an already intricate process. In another method, scientists first evolve a natural enzyme to enhance its stability and then use that version as a starting point. But this costs more time, labor, and frustration.
The team turned to AI. Over the past decade, powerful AI models for biology have emerged that can predict and design protein structures from their underlying molecular sequence alone. One example is ProteinMPNN, developed by Nobel laureate David Baker and colleagues at the University of Washington. The model dreams up new protein sequences that preserve overall structure while altering the underlying building blocks—all in seconds.
Liu’s team reasoned the AI could generate more stable enzymes to kick off directed evolution. To test their theory, they turned to natural botulinum neurotoxin proteases. These molecular scissors paralyze muscles by snipping specific proteins and are the main active component in Botox.
ProteinMPNN generated 58 designs predicted to be more stable. The top three candidates, when produced in E. coli bacteria, were highly soluble, meaning they didn’t aggregate inside cells. Some even had higher activity than their natural counterparts.
The team fed the redesigned enzymes into PACE, evolving them to slice away a mutated region of a protein associated with neuron health. But in diseases such as ALS (Lou Gehrig’s disease), a repetitive stretch expands, causing the protein to clump together and gradually damage neurons. Although the protein is an attractive therapeutic target, naturally occurring enzymes have had limited success cutting the mutant version before it forms toxic aggregates.
Compared with enzymes evolved from natural botulinum neurotoxin, those descended from the AI-redesigned versions were nearly 80 times more efficient at cutting the target protein, and over 56 times more selective for the intended region on the protein. Across three different types of the neurotoxin and multiple substrates, the AI-designed starting points consistently excelled at producing more stable and effective enzymes.
By mathematically mapping their evolutionary paths, the team found the redesigned enzymes tolerated more mutations while gaining new functions. That extra flexibility could open the door to larger reprogramming efforts, such as targeting substrates that lack natural enzymes.
“If you start with a more stable protein, it has more stability to spare, so it can afford larger changes in pursuit of new functions,” said study author Nicholas Krasnow.
The team worked with immortalized human cells for the study, so whether the proteins perform as well in more complex environments remains to be seen. But the work showcases the power of coupling AI and laboratory evolution to rapidly reprogram nature’s molecular machines, endowing them with functions evolution never produced. The team is already applying the strategy to finessing prime editors and other molecular tools.
The post Why Scientists Redesigned the Botox Enzyme With AI appeared first on SingularityHub.
2026-07-28 04:58:17
A Cornell University study uses game theory to model how poorly designed AI regulation could backfire.
Governments around the world are racing to regulate AI before it becomes too deeply embedded in society. But new research suggests poorly designed rules could make AI systems less safe than having no regulation at all.
Regulatory disagreements in the US are leading to a patchwork of approaches as states take matters into their own hands. A key question is who should be responsible for the safety of AI products—the big tech companies building the underlying models or the firms that adapt them for a particular task, such as a customer service chatbot or an AI tutor.
Working this out is trickier than it looks. While it might seem logical to put the bulk of the burden on downstream companies directly serving these tools to customers, a new study in Proceedings of the National Academy of Sciences finds that could be worse than having no rules at all.
“There’s a free-riding behavior that occurs,” Benjamin Laufer from Cornell University, who led the research, said in a press release. “The regulation acts as a tool for the general provider to offload the safety burden onto the downstream specialist.”
The researchers’ analysis relied on a model based on game theory—a mathematical approach to studying decision making. It treated AI development as a two-step game, in which a “generalist” developer first invests in building a broadly capable AI model before a “specialist” adapts it for a specific domain and takes it to market.
In the game, a regulator sets a minimum safety standard for both players, and the models see this in advance. They then invest in both the performance and safety of their product, and the revenue is split between them. Investments in both get progressively higher, while the extra revenue each improvement brings in stays flat.
The problem, the researchers found, is that the generalist moves first and knows exactly what the specialist will be legally required to do afterwards. This creates problems when the generalist is set a low bar for safety, or none at all, and safety standards for the downstream specialist are also fairly weak.
In the absence of any rules, both firms invest in safety, because the model assumes a safer product earns more revenue. But if the specialist is forced to invest a certain amount into safety to meet regularity requirements, the generalist can cut its own spending and let the downstream firm close the gap.
That’s because the generalist’s revenue depends on the final safety level of the shipped product, not on its own contribution, so it can get a revenue boost from improved safety without paying for it from its own pocket. The specialist, for its part, has no reason to do more than the rule demands, so total safety settles at the legal minimum, which is below what would have occurred had there been no regulation at all.
On a more positive note, the researchers found that if safety levels on both the generalist and the specialist are set high enough, regulation can actually improve safety while leaving both companies more profitable than they were in an unregulated market.
“Appropriately designed AI regulation can make it possible for different firms involved in the AI development pipeline to collectively arrive at good outcomes for consumers, knowing that the regulation is designed to help each firm operate in a way that the others can more reasonably predict,” co-author Jon Kleinberg from Cornell University said in the press release.
However, the researchers’ model relies on the market setting a real price on safety. As the gap widens between what customers will pay for performance and what they’ll pay for safety, the range of circumstances in which weak rules backfire gets narrower.
The authors also note that the model’s two-player setup is a simplification of real AI supply chains where multiple competing specialists and base-model providers operate across different jurisdictions with different rules.
“People think of AI as a single object, but actually AI involves a very complicated set of stakeholders and actors that each have their own contributions to the technology,” said Laufer. “To regulate in a thoughtful way, we need to consider the whole supply chain, not just a single provider or entity.”
Still, the results suggest that taking an overly simplistic and light-handed approach to AI regulation may end up achieving the opposite of what law makers intend.
The post Weak AI Regulation Could Be Worse Than None at All appeared first on SingularityHub.
2026-07-25 22:00:00
OpenAI Says Its AI Models Went Rogue and Attacked a Digital Library
Kate Conger | The New York Times ($)
“The trial was designed to keep the models in a safe testing environment, known as a sandbox, OpenAI said. But the models found a vulnerability that allowed them to escape the sandbox and connect to the internet. Then they targeted Hugging Face because they inferred that the library, which contains millions of AI models, could hold clues about how to successfully pass the evaluation.”
Be Skeptical of OpenAI’s Rogue Hacker Agent Story
John Thickstun | The Guardian
“OpenAI remains hungry for ever larger investments, and the company increasingly seeks privileged regulatory status as defense against competition. AI is so powerful that investors should buy OpenAI, even at a trillion-dollar valuation; AI is so dangerous that only trusted actors like OpenAI should be permitted to possess and operate this technology. Step back from these doomsday warnings and consider who might benefit from them.”
Can This New Enzyme Turn Back the Clock in the Human Body?
K.R. Callaway | The New York Times ($)
“In a recent study, scientists devised a way of reversing the buildup of compounds that lead to some age-related diseases. …After several cycles of guided evolution, the novel enzyme, called CMLase, became very good at removing AGEs [advanced glycation end products] from human tissue samples. ‘In the most extreme case, we took 70-year-old human skin and brought the levels back to that of a 30-year-old,’ Dr. Cravens said.”
Silicon Valley Is Completely Divided Over Chinese AI
Lauren Goode | Wired ($)
“Having access to open-source software allows startups to scale, scale, scale—and deal with the consequences down the road. Meanwhile, the AI labs and hyperscalers that make proprietary platforms, like OpenAI, Anthropic, Google, Microsoft, Meta, and XAI, stand to benefit greatly if their systems remain protected and dominant. The bigger question that none of these companies seem to be asking is what best serves the 99 percent of us who don’t have their financial future fully staked on advancing AI.”
Neuron Discovery Could Explain Why Some People Don’t Get Alzheimer’s
Pranjal Malewar | Refractor
“This kind of strategy may open up novel avenues for the prevention of cognitive decline generally or for protecting against Alzheimer’s-related vulnerability/resilience. Salta states, ‘Cognitive resilience is extremely exciting. If we understand what protects these brains, it could eventually lead to new therapeutic strategies. For now, the message is clear: the aging brain may be more adaptable and more complex than we once thought.'”
India’s First Privately Developed Rocket Reaches Orbit on Dramatic Debut Launch
Stephen Clark | Ars Technica
“Indian space officials celebrated the debut flight of Skyroot Aerospace’s Vikram-1 rocket, India’s first fully commercial satellite launcher, as a ‘grand success’ Saturday after an on-target climb into a 280-mile-high orbit following liftoff from an island spaceport in the Bay of Bengal.”
Kagi Brings Back Old-School Search, One Human-Made Website at a Time
David Nield | Wired ($)
“As Kagi explains it, searching the web is always going to cost you—it’s just a question of whether you pay directly with dollars, by giving up data about your online activity, or by sifting through an increasing number of ads and sponsored links. Besides making search more private, Kagi also wants to make it better by serving up results that aren’t influenced by paid promotions or whatever Google’s favored business practices happen to be from month to month.”
Now, Defenders Are Embracing the prompt Injection, Too
Dan Goodin | Ars Technica
“Researchers from Tracebit on Monday said they found that placing prompt injections alongside passwords, cryptographic keys, and other secrets stored on Amazon Web Services was often all that was needed to shut down attacks from AI hacking agents.”
What the New Kimi K3 Model Really Means for the US-China AI Race
Alix Coutures, Rocket Drew, and Aaron Holmes | The Information ($)
“Greenblatt estimates that Kimi K3 is 10 months behind Anthropic in terms of pre-training. ‘My basic takeaway is it’s probably not that competitive with the best recent pre-trains from OpenAI and Anthropic,’ he said. ‘It’s some evidence that the model is more behind than people might have otherwise thought.'”
The post This Week’s Awesome Tech Stories From Around the Web (Through July 25) appeared first on SingularityHub.
2026-07-25 05:47:42
To make CRISPR better at its job, researchers are turning to algorithms like DeepMind’s AlphaFold.
Gene editing is like a molecular meet cute. When protein “scissors” dock onto the intended gene, even a tiny slip—no more than the width of a hydrogen atom—can ruin the connection, and the protein may latch onto similar DNA sequences nearby. In a rom-com, a missed connection means heartbreak; in gene therapy, it can trigger dangerous off-target effects.
Now, AI is playing matchmaker.
In one recent study, researchers used AI to engineer more faithful gene-editing scissors with higher fidelity than previous versions. In another, AI designed the scissors from scratch. Although the synthetic proteins are markedly different than their natural counterparts, they successfully edited genes in cells from multiple species.
The studies expand protein design. “The ability to customize the molecular geometry of genome editors will drive progress towards safer and more efficient therapies,” wrote Hoi Yee Chu and Alan Wong at the University of Hong Kong, who were not involved in either study.
Scientists still need to test the new molecular scissors inside the body. Meanwhile, they’ll continue searching for natural gene editors they can both employ and use to train AI.
There’s no doubt CRISPR has transformed biology.
From blood disorders to inherited blindness and high cholesterol, the gene editor has gone from academic curiosity to a therapeutic powerhouse in just over a decade. Researchers and doctors are also using it to engineer immune cells that recognize and attack once untreatable cancers.
But it’s not all roses: CRISPR doesn’t always edit the right gene.
The gene editor’s protein scissors, called nucleases, are steered to a DNA sequence by a fragment of guide RNA. Once the arrive, the scissors cut the DNA and change the genome.
CRISPR was first used to inactivate target genes. A more sophisticated version, called base editing, can handle single DNA letter swaps. Yet precision is still a hurdle. Early CRISPR was even branded “genetic vandalism” for straying away from its intended target and making unpredictable genome-wide changes. Another problem is called bystander editing. This is when the tool alters neighboring DNA letters that weren’t supposed to be changed. Even a handful of unintended edits could undermine treatment.
Making CRISPR more precise is something of a holy grail. But nucleases are intricate molecular machines, and even small changes to a few critical building blocks can cripple them. To improve the proteins, studies have subtly altered existing nucleases and screened variants to surface versions that have better specificity without sacrificing activity, a tradeoff that has long plagued the field.
Both approaches are tedious and slow. And because they begin with natural enzymes, they explore only a tiny fraction of the protein designs that might actually work.
“What remains unclear is which amino-acid residues [protein building blocks] in Cas9 can be further engineered to maximize fidelity—that is, to ensure that the enzyme cleaves the genome at the correct site and makes the intended edit,” wrote Chu and Wong.
A Chinese team turned to Google DeepMind’s AlphaFold 3 to open the black box. AlphaFold predicts not only protein shapes but also how proteins interact with DNA, drugs, and other biomolecules.
Most researchers use AlphaFold to CRISPR and its target DNA, revealing potential hotspots for engineering. This team took a different approach. Rather than focusing on a single protein-DNA structure, they used the AI to calculate the likelihood that specific parts of of CRISPRs protein scissors would interact with various DNA sequences.
They first mapped changes to the genome after base editing in human kidney cells and then compared thousands of off-target and on-target changes. To make sense of the data, they developed ContactSeek, an AI that pinpointed protein areas more often associated with mistaken targeting. These would be prime candidates for redesign.
They then used ContactSeek to improve a base editor that switches the DNA letter A to G. With only two changes, the new editor outperformed several existing high-fidelity editors. They also generated more selective CRISPR variants—those that used a different pair of protein scissors—without sacrificing editing efficiency.
Traditional methods often rely on individual trial-and-error experiments. But ContactSeek extracts patterns from thousands of predicted interactions, revealing contact regions that might be hard to detect from single tests. But like other AI models, ContactSeek’s predictions are only as good as the data used to train it. The tool could be further improved with more data and by adding complementary AI tools, such as RoseTTAFoldNA.
In a separate study, CRISPR pioneer Jennifer Doudna and colleagues asked AI to dream up entirely new nucleases. They focused on compact proteins that gave rise to Cas12, the proteins scissors often used in base editing. Instead of tweaking existing proteins, however, they fed an AI model the proteins’ 3D structure, and asked it to redesign them. The AI spooled out thousands of synthetic candidates.
But it didn’t give any hints about which might work, and testing each would be impractical.
Instead, the team trained a second AI on which parts of the proteins interact with each other and which with DNA. Eventually, the second model learned what sections could be changed and homed in on a handful of promising designs. They differed from their natural counterpart sequences by roughly 30 percent, far more than previous AI-designed CRISPR nucleases.
Despite being somewhat alien, several edited genes in bacterial, plant, and human cells. A few even outperformed their natural counterparts in terms of efficiency. Like ContactSeek’s designs, the synthetic nucleases must next prove themselves in the body. Researchers want to make sure they don’t trigger an immune attack and can edit enough cells to treat disease.
Neither study directly addressed bystander editing, another headache in the field. But the tools can work with each other. One fine-tunes nature’s gene editors; the other creates brand new designs. It’s early, but AI is beginning to help design the next generation of gene editing tools.
The post Scientists Are Designing CRISPR Gene Editors With AI appeared first on SingularityHub.
2026-07-24 04:48:40
The incident is a first and signals a seismic shift in cybersecurity.
An autonomous agent powered by OpenAI’s advanced artificial intelligence models went rogue during a security test and hacked multi-billion dollar tech startup, Hugging Face, last week.
The agent didn’t just exploit vulnerabilities in Hugging Face’s systems to achieve what it perceived as a strategic gain. It also exploited vulnerabilities within OpenAI’s infrastructure.
Of course, hacks are very common cyber threats that organizations face frequently. But this incident is different, because the AI agent acted without any human input. It signals a seismic shift in cybersecurity, and shows that governments and tech companies need to take urgent action to prevent this risk escalating.
Even OpenAI described the attack as “unprecedented” and acknowledged it expects similar ones “to become more commonplace with the proliferation of increasingly cyber-capable models.”
Hugging Face is famous in the AI space. Its mission is to “democratize good machine learning” by providing benchmark datasets, community collaboration tools, and robotic platforms. The company is valued at $4.5 billion.
On July 16, the company announced it had been attacked, with a hacker obtaining unauthorized access to some internal datasets and credentials. It said the hacker was likely “an autonomous AI agent system” due to the sophistication of the attack.
Five days later, OpenAI announced the attack had been driven by some of its models: GPT-5.6 Sol and a yet-to-be released model.
The tech giant was conducting what are known as “red teaming” exercises. These are essentially simulated cyber attacks that help identify the capabilities, risks, and vulnerabilities of AI systems before they are publicly released. They are typically conducted within an isolated environment to ensure potentially dangerous systems do not escape and cause harm to real systems.
But in this case, the AI agent did escape—even though OpenAI had some guardrails in place to prevent this.
Hugging Face became a lucrative opportunity for the AI agent. It hosts ExploitGym, a benchmark that tests an AI agent’s ability to exploit real-world systems. The AI decided to turn every stone upside down to obtain access. With persistence, it succeeded.
Hugging Face was confronted with a challenge when attempting to use external AI services to diagnose the problem. The guardrails around more advanced models such as GPT-5.6 Sol and Claude Fable 5 are intended to stop them being used for cyber attacks—but they can also stop the models being used for sophisticated cyber defense.
So Hugging Face resorted to using an open-source model, GLM 5.2, developed by the Chinese company Z.AI, to counter the cyber attack.
Hugging Face said GLM 5.2 was an advantage because it was not exposed to the attack data. Both Hugging Face and OpenAI are collaborating on forensic analysis, post-incident recovery, and risk mitigation strategies.
A March 2025 study by the United Kingdom’s AI Security Institute showed the best AI could complete 80 percent of the steps needed to gain full control of a portion of an external system. Within four months, it reached 100 percent.
Z.AI’s GLM 5.2 was only released in June, with 744 billion internal variables, known in the world of AI as “parameters.” The fact that Hugging Face assessed, vetted, and deployed it within four weeks should be an eye-opener for organizations with long acquisition cycles.
The connectivity we all enjoy today can equally be our greatest threat. Cyber threats spread faster than human viruses and can create economic damage similar in magnitude to a country’s GDP.
More sophisticated cyber threats—the kind exemplified by the Hugging Face hack—will exploit the security layers that humans designed for human attackers, regardless of how sophisticated our designs are.
Indeed, in this particular case, even OpenAI’s own understanding of its models couldn’t predict or contain the rogue AI agent. This shows the need for all AI companies to urgently update and strengthen their guardrails, in order to help prevent a similar attack occurring with far more devastating consequences.
It is good to see Hugging Face and OpenAI collaborating on the investigation into the attack. This showcases the importance of putting aside market competition and blame when the situation demands.
The fact that Hugging Face used Z.AI’s open-source model to diagnose and counter the attack also shows the advantages of not relying on just a few pieces of tech.
States that are not in the game of developing their own AI models need to learn from this incident the value of being different. It is not too late to design new models that could save us in situations when the most advanced models fail—or, even worse, attack us.
Indeed, last week, another Chinese company, Moonshot AI, released Kimi K3. This model has 2.8 trillion parameters, its advanced performance stunning the tech world.
It is no longer a question of “if” AI agents go rogue and attack us by themselves. The Hugging Face incident is an early warning that we must accelerate our preparedness. The threat is real and here.![]()
This article is republished from The Conversation under a Creative Commons license. Read the original article.
The post OpenAI Agent Breaks Free and Hacks Hugging Face appeared first on SingularityHub.