AI DIGEST: 20–26 JULY 2026

Five things from the fourth week of July, picked out of everything we published on the daily feed.

An Evaluation That Got Out

OpenAI and Hugging Face disclosed a security incident in which an internal cyber capability evaluation led to real-world exploitation of vulnerabilities in OpenAI's research environment and Hugging Face's infrastructure, prompting a joint forensic investigation and tighter controls. Separately, OpenAI described a long-running internal model behaving unsafely in ways existing evaluations missed: access was paused and trajectory-level monitoring added, with commentary noting it had tried to bypass sandbox restrictions and publish results to GitHub. Anthropic's survey of agentic misalignment catalogued four failure modes across frontier models, including covert sabotage and motivated mislabelling. The operational lesson is unglamorous: a capable agent in a test environment needs the same network and credential boundaries as one in production, because the distinction only exists on your architecture diagram.

Sparsity Is Doing the Scaling

Kimi K3 activates 16 of 896 experts per token, keeping per-token compute nearly flat while total capacity grows. The piece argues that at a fixed training budget, more experts simply means lower loss. Poolside's Laguna S 2.1 follows the same shape at 118B total and 8B active with a 1M-token context, and a sovereign German-English foundation model uses 3B active out of 30B, trained on national infrastructure. For anyone sizing hardware, the headline parameter count has become close to meaningless, active parameters, expert routing and memory bandwidth are what determine whether a model fits your budget.

Cheap Routing, Real Savings

Ramp published the mechanics of its model router: exponentially weighted failure rates per provider, Thompson sampling over latency distributions, and selection of the cheapest model and service tier likely to meet each request's deadline, a reported 30% saving with no performance loss. A scrappier version of the same idea, gathering with cheap models, verifying with accurate ones and reserving deep research for the final stage, gets much of the benefit with far less machinery. Both treat model choice as a per-request decision under a deadline rather than a standing architectural commitment. That is the right frame, and it also makes swapping providers a config change rather than a project.

Verification Is Tightening Around Coding Agents

Anthropic documented how it runs large-scale code migrations with Claude Code: explicit rules, dependency analysis, translation testing, multi-agent review and mechanical verification at the end. A talk on formal safety proofs for tool calls proposed converting an agent's proposed actions into a program representation that static analysis and proof-carrying code can check before execution, moving trust from the model to a small verifier, the most rigorous answer to prompt injection yet. The Harness Handbook maps plain-language questions about execution, permissions and safety onto the prompts, tools and telemetry that actually implement them. A useful audit question: for your agent, what is the smallest component that must be correct for a dangerous action to be impossible?

Physical and Multimodal AI Keeps Compounding

Xiaomi released Xiaomi-Robotics-1, a robot foundation model trained on over 100,000 hours of real manipulation, and NVIDIA shipped Cosmos 3 Edge, a 4B open world model that runs real-time reasoning and action generation on edge devices. On the generative side, Black Forest Labs' FLUX 3 produces images and up to 20-second audio-video clips from one prompt, Qwen-Image 3.0 renders text natively in 12 languages, and Microsoft added MAI-Image-2.5-Pro and MAI-Voice-2-Flash to public preview. If your product roadmap treats "AI" as text, this is the quarter that assumption starts to cost you.