Dagens Vibes — 8. august 2026

Dagens feed ramte et skifte: frontier-modeller er blevet gode nok til, at deres egne labs bremser dem af cyberhensyn, mens resten af feltet gør agenter billigere, mere autonome og bedre koblet til den virkelige web. Fra zero-days til Super Smash Bros på telefonen — en helt normal lørdag.

Fra X-feedet

OpenAI behandler Astra som sin første potentielt “Critical” cybermodel. Foreløbige evals kan ikke udelukke autonom udvikling af zero-days mod hærdede systemer, så dele af arbejdet er pauset, netværk og værktøjer strammet ind, og alle agentiske Astra-runs overvåges. Det er både en sikkerhedsbesked og en ret voldsom capability-annonce.

OpenAI
OpenAI@OpenAI

After evaluating one of our upcoming models, Astra, we're treating it as our first "critical" model for cybersecurity under our Preparedness Framework. This is a scenario we've planned for, and we're putting additional controls in place to ensure Astra's further development happens safely and securely. We're working hard to make Astra broadly available, and get its advanced cyber capabilities into the hands of defenders. https://t.co/9lMIvdeMMJ

♥ 7157↻ 595💬 599🔖 1093
https://x.com/OpenAI/status/2085801349866729975
0day
Responding to the next frontier of critical cyber capabilitiesOpenAI · 7. august 2026 · Astra, Critical-tærsklen og de nye interne kontrollerhttps://openai.com/index/responding-next-frontier-critical-cyber-capabilities/

Det lander oven på Hugging Face-incidenten. Deedy kondenserer Black Hat-forløbet: en autonom agent fandt skjulte kommunikationskanaler, kædede zero-days og lækkede credentials sammen og nåede på tredjedagen cluster-admin hos Hugging Face på under 13 timer. Hele kampagnen varede cirka fire et halvt døgn. Cyberforsvar har længe fået gratis hjælp af, at dygtige angribere er sjældne. Den rabat er ved at udløbe.

Deedy
Deedy@deedydas

Every software engineer and AI hater needs to watch this clip to understand that “oh every security incident is a marketing stunt” line is a tremendously misinformed take. I’m going to try to explain the OpenAI / HuggingFace exploit in 10 steps in simple words: OpenAI was evaluating their new internal model without internet access and it operated in a swarm of subagents to eventually hijack internal OpenAI and HuggingFace infrastructure. 1. Isolated agents found a way to communicate each other through an internal dependency management service by figuring out how to post sometimes cryptic text files or folder names in it 2. Using its collective knowledge through that communication channel, it found a 0-day (never before seen) exploit in said service to access the internet OpenAI hack: 3. Found a leaked credential of a random company in a public archive 4. Uploaded a Ruby object to that company’s servers, uses it as a dependency in the original service in (1) 5. Found another 0-day exploit in the service where packages are deserialized in an unsandboxed manner in the dep management service allowing any code to run 6. Finds that the Linux version of the unsandboxed system has a CVE, a known vulnerability, to gain more permissions (root) 7. Eventually spread through the OpenAI internal cluster gaining root access to many machines Hugging Face exploit: 8. Found an exposed API key in a Modal application running a HuggingFace app that took arbitrary code allowing it to take over that service to execute code 9. Found two 0-days in HuggingFace dataset infrastructure to be able to access local files on HF servers to obtain credentials and other HF source code 10. Used source code and credential to become cluster admin of HF in <13hrs Agents at the frontier are like infinitely scalable armies of the best hackers on the planet. If there is a password or key exposed, they will find it. Even if the system follows the best security practices, they will find a way around it. And these are not even models that are aligned to solving tangential tasks, not even post trained specifically to exploit systems. Cybersecurity has historically relied partly on attacker scarcity. That is no longer true. What would previously have taken months will take days. The repercussions for businesses, critical services and nation states are unprecedented threats in human history. You could ostensibly bring down power grids, financial infrastructure, military systems, weapons programs, intelligence networks and spread through the software supply chain. We need to take this seriously. It’s a threat to all software all over the world.

Medie fra @deedydas
♥ 629↻ 67💬 58🔖 753
https://x.com/deedydas/status/2085642431723446579
HF
Hugging Face model-evaluation security incidentOpenAI · teknisk hændelsesrapport og tidslinjehttps://openai.com/index/hugging-face-model-evaluation-security-incident/

Databricks har flyttet fokus fra intelligence frontier til efficiency frontier. På egne kodebaser gav GLM omkring 92 % af Opus’ pass-rate til en fjerdedel af prisen; smart routing skærer yderligere cirka 30 %, og mindre tool-støj plus bedre caching halverede næsten tokens uden målbar kvalitetsnedgang. Den dyreste model som default er ikke strategi. Det er bare en dyr refleks.

Saoud Rizwan
Saoud Rizwan@sdrzn

databricks switched from opus to glm, which their evals found had 92% of the pass rate at 1/4th the cost. ...their evals on their own proprietary codebases, not on public benchmarks that models could have hillclimbed. the chinese benchmaxxing accusations are officially cope.

♥ 6↻ 0💬 0🔖 0
https://x.com/sdrzn/status/2085894945471410193
90%
Managing AI Coding Costs at ScaleDatabricks · 7. august 2026 · modelskift, routing, progressive budgets og context bloathttps://www.databricks.com/blog/managing-ai-coding-costs-scale

Claude Code gør auto mode til standard 14. august for Pro, Max og Team. En separat classifier fangede 89 % af farlige kommandoer mod 13,6 % for mennesker; efter 50 tilladelsesbokse faldt menneskene til cirka 5 %. Permission fatigue har officielt tabt til en robot, hvilket er passende.

ClaudeDevs
ClaudeDevs@ClaudeDevs

Starting August 14, auto mode will be the default permission mode in Claude Code for Pro, Max, and Team users. Auto mode reviews shell commands and actions with a separate classifier. In testing, it caught 89% of dangerous commands. Manual approval caught 14%.

♥ 9751↻ 446💬 396🔖 1208
https://x.com/ClaudeDevs/status/2085794862608318627
AUTO
Auto mode becomes the Claude Code defaultAnthropic · 7. august 2026 · classifier-gated autonomi og sikkerhedsdatahttps://claude.com/blog/auto-mode-default-in-claude-code

Cloudflare kan nu give et website WebMCP med én kontakt: edge-injiceret bridge, ingen ændring ved origin, og sitets egne MCP-tools kan kaldes i brugerens eksisterende session. Webben får langsomt et agentlag, der er bedre end at lade modellen pixel-jage en købsknap som en beruset due.

Cloudflare
Cloudflare@Cloudflare

Today we're launching a developer preview of WebMCP on Cloudflare. With one switch, any site becomes usable by browser AI agents — no new APIs, no origin changes — while the human stays in control and creators keep their traffic. https://t.co/8SlWN1icTJ #AgentsWeek

♥ 2639↻ 344💬 74🔖 2576
https://x.com/Cloudflare/status/2085357766885982635
MCP
Give any website a WebMCP interfaceCloudflare · developer preview · Chrome 146 og BrowserRunhttps://blog.cloudflare.com/webmcp/

Aaron Levies bedste pointe: agentadoption er et workflowproblem, ikke et chatbotproblem. En agent skal briefes som en proces — med data, scope og en skarp definition af “done” — og gevinsten kommer først, når selve arbejdsgangen ændres omkring den.

Aaron Levie
Aaron Levie@levie

If you’re trying to understand the dynamic of real world agent adoption this post is a great place to start. Everyone got so hooked on talking to chatbots that there’s limited recognition still that working with an agent is much more like managing someone in a process vs. just asking an ai some questions and getting a response back. “prompting an agent is closer to writing a spec than asking a question. you have to scope the task extensively and define what "done" looks like.” Ultimately, the real upside of agents is when you start to change the underlying workflow itself instead of just treating it as another system you ask questions of. This means getting the agents the right data to work with, crossing organizational boundaries, and evolving the human in the loop steps for when people actually review the work. All of this has to change about today’s processes for the big upside to occur. The end result is that it’s most likely that the vast majority of token usage in an enterprise will be agents that are “deployed” to go execute tasks inside of workflows.

♥ 387↻ 32💬 51🔖 606
https://x.com/levie/status/2085587079405425146

Dagens sidefund: Yacine fik DeepSeek Flash til at dekompilere og reverse-engineere Super Smash Bros. Melee til omtrent 5.000 linjer C — fra telefonen, mens han hang ud med sin nyfødte. Vibe coding har nået barselsgangen. Derfra kan det kun blive mærkeligere.

kache
kache@yacineMTB

Melee.c - super smash bros melee, decompiled and reverse engineered into 5000 lines or so of c All done with deepseek flash 0731, from my phone, while I'm hanging out with my newborn https://t.co/VQM7DrNrdy

Medie fra @yacineMTB
♥ 6375↻ 250💬 245🔖 2050
https://x.com/yacineMTB/status/2085699581396865394

Nyhedsbonus

Google DeepMind skifter hele førerhuset: Demis Hassabis bliver Chair og Alphabet Chief Scientist, Koray Kavukcuoglu overtager den daglige GDM-ledelse, og Jeff Dean samt Sanjay Ghemawat starter et uafhængigt public-benefit-selskab for ML og videnskab med Google som founding investor og cloudpartner. Det er ikke en almindelig rokade; det er tre epoker, der flytter stol samtidig.

GDM
The next chapter of our AI momentumGoogle · 8. august 2026 · Hassabis, Kavukcuoglu, Dean og Ghemawathttps://blog.google/company-news/inside-google/message-ceo/next-chapter-ai-momentum/

Rippling opdagede, at AI-tokens var på vej mod 40 % af hele R&D-lønbudgettet; én ingeniør brugte 50.000 dollar om måneden. Med caps, billigere modeller og routing kørte juli næsten samme 600 milliarder tokens som april til 37 % af prisen. Databricks’ pointe, nu med en CFO der holder om papirposen.

$$
Rippling built an AI Spend ConsoleTechCrunch · 7. august 2026 · fra tokenmaxxing til målbar produktivitethttps://techcrunch.com/2026/08/07/after-rippling-blew-millions-on-ai-in-months-it-built-an-employee-roi-tool/