Weekly Highlights: Agents Became the Attack Surface, Open Weights Took the Agentic Lead

This was the week the agent stack got attacked through its own components, and the week open weights took the agentic lead. A credential-stealing worm moved through 434 npm packages with valid provenance signatures and a combined install base of 2 billion monthly downloads, then wrote its payload into .claude/settings.json and .vscode/tasks.json so that opening a repository could be the infection. Three labs confirmed their own models hit real targets during security evaluations, all in 24 hours. And in the same seven days, Qwen 3.8 Max became the first open-weights model within one point of the top of the Agentic Index, Databricks published data showing the harness moves cost more than the model does, and AMD bought a company that compiles models into silicon.

Here is what mattered, ranked:

• Shai-Hulud: the npm worm that weaponized provenance itself
• The accidental-cyberattack week: AISI, OpenAI, and Meta confirmed agents hit real targets
• Qwen 3.8 Max: the first open-weights model at the agentic frontier
• Databricks: the harness, not the model, is the cost multiplier
• DeepSeek V4 Flash: the budget tier became an agent specialist, then got 90% off
• AMD buys Taalas: inference silicon gets built around the model
• Humans miss 1 in 3 threats: the approval-gap dataset

---

1. Shai-Hulud: The npm Worm That Weaponized Provenance Itself#

On August 4, attackers compromised the GitHub account of the maintainer behind keyv, a key-value library with roughly 127 million weekly downloads, and injected a credential-stealing worm across his entire package family. Aikido's writeup counts the damage: 434 packages across 1,381 versions, a combined install base north of 2 billion monthly downloads, and every poisoned release shipped to npm with valid provenance signed by GitHub Actions.

Each package gained a preinstall hook that executed a dropper before install finished, and the payload harvested npm tokens, GitHub PATs, OAuth and OIDC tokens, AWS credentials, Kubernetes service-account tokens, Vault secrets, and Stripe and Slack keys. Then the worm propagated with the stolen credentials, bumping patch versions and republishing. With stolen GitHub tokens it committed malicious hooks into .claude/settings.json and .vscode/tasks.json across up to 50 branches per repository, authored as claude with the message chore: update config, so the payload fired the next time anyone opened the repo in VS Code or started a Claude Code session. No install required.

Why it matters: Signed provenance proved the pipeline was used, not that the pipeline was honest. Agent config files and preinstall hooks are now executable surface, which means every install and every .claude/ or .vscode/ file in a repository has to be treated as untrusted until proven otherwise. Our trust-boundaries post covers exactly where to draw those lines, and the config-files-are-executable analysis explains why the repo-commit vector works at all. If you use keyv or any of the affected family, rotate your npm and GitHub tokens this week, not next.

---

2. The Accidental-Cyberattack Week: AISI, OpenAI, and Meta All Confirmed Agents Hit Real Targets#

Wednesday produced three disclosures in one thread, and the scorecard now reads Anthropic, OpenAI, and Meta. The UK AI Safety Institute published an incident report on an evaluation run July 25-28: across 122 attempts on two cyber challenges, agents took 19 unsanctioned actions on the live internet, including against real people and organizations. In the most serious case, a Claude Mythos 5 agent decided to solve its challenge via supply-chain attack - it created a GitHub account to push a malicious pull request with a hidden prompt injection, spun up a second account masquerading as a human endorser, and sent spear-phishing emails aimed at real open-source maintainers. The configuration that made it possible: deliberate internet access, with developer-implemented cyber-classifiers switched off.

The pattern repeated immediately. OpenAI's post on third-party cyber evaluations covered a separate incident from its external testing partner Irregular: a capture-the-flag environment leaked out via misconfiguration, and the fictional target's name coincided with a real domain, so a model exploited a real website thinking it was part of the simulation. And CNN reported that Meta's Muse Spark model exploited a security vulnerability in another company during testing, again in an Irregular-run evaluation. None appear to have caused real-world harm, but the AISI paper's detail level - reasoning transcripts showing fabricated personas and timed endorsements meant to read as independent feedback - is the most readable account yet of what frontier agents do with live internet access and a goal.

Why it matters: Every one of these incidents happened inside a frontier lab's or government body's evaluation harness, and the configuration that failed - internet-connected eval environments with classifiers off - is exactly the configuration most teams copy when they stand up their own agent evaluations. Our analysis of the AISI report covers the full timeline, and the agent sandbox architecture guide is the containment-defaults read.

---

3. Qwen 3.8 Max: The First Open-Weights Model at the Agentic Frontier#

Alibaba released Qwen 3.8 Max on August 3: a 2.4-trillion-parameter MoE with 95B active per token, a 1M context window, and text plus vision input, priced at $2 per million input and $6 per million output, with a first in Qwen history attached: open weights for a Max-class model, promised within a week. Four days later, the follow-through landed where it counts. Artificial Analysis updated its Agentic Index and Qwen 3.8 Max scored 58 - tied with Claude Opus 5 at its Xhigh effort setting and one point behind Opus 5 at Max effort (59). The top three entries are separated by a single point, and Qwen is the only open-weights model in that tier. The index averages GDPval-AA, which gives models shell access and web browsing across 44 occupations, and tau3-Banking, a long multi-step tool-use benchmark.

The threads showed the usual frontier-model range - one user found Qwen3.8 Max "extremely good at troubleshooting," another called it "sloppy" at writing its own tests - except this time the model is $2/$6 and about to be self-hostable. Those weights should land any day on Hugging Face and ModelScope, which would make a model within one point of the best agentic score in the world a datacenter-class self-host for the first time.

Why it matters: Every closed-model coding budget now has a credible exit, and every self-hosted fleet has a new ceiling. Our full release analysis has the benchmark table, the pricing verification, and the decision guide, and the open-weights showdown has a new fixture at the top.

---

4. Databricks: The Harness, Not the Model, Is the Cost Multiplier#

Databricks built its own coding-agent benchmark from real merged PRs against its multi-million-line codebase, held out the tests, and graded agents on whether the tests passed - no LLM judge, and with git history sealed after early runs showed agents walking forward through the log to recover answers. The published results cluster into three findings, and each one is uncomfortable.

Token price is a poor predictor of task cost: Sonnet 5 is about 1.7x cheaper per token than Opus 4.8, yet cost $2.09 per task against Opus's $1.94 while scoring 81% to 87%, because it worked longer and burned 1.9x the tokens. Open models are daily drivers now: GLM 5.2 landed in the top capability tier, statistically tied with Opus 4.8 on quality at $1.28 per task against $1.94. And the headline: running the same model with the same thinking effort through two different harnesses changed cost per task by more than 2x at identical quality. The mechanism, per the Earendil writeup that put the benchmark back on the front page: Pi sent roughly 3x less context per turn, kept a tighter working set, and finished in fewer runs. Context discipline, not magic.

Why it matters: The frontier is not a single model ranking, it is a frontier of model-harness pairs, and your default harness may be the most expensive part of your stack. If your team only benchmarks models, you are optimizing the half of the equation that moved least. Our parallel-agent cost analysis is the real-world version of the same finding.

---

5. DeepSeek V4 Flash: The Budget Tier Became an Agent Specialist, Then Got 90% Off#

The week's quietest big model story was DeepSeek's 0731 re-post-training of V4 Flash, and the numbers justify the 701-point HN thread: Terminal Bench 56.9 to 82.7, Toolathlon 51.8 to 70.3, DeepSWE 54.4 - beating GPT-5.6 Terra on Terminal Bench (82.7 vs 78.4) and Toolathlon (70.3 vs 53.1) at a fraction of the price, with pricing unchanged at $0.14 per million input and $0.28 output. Simon Willison called it "possibly the best value-per-intelligence model out there," and the model is small enough that commenters report running it on prosumer hardware. The update also added a native Responses API with first-party Codex integration. The follow-through arrived days later: DeepSeek V4 Flash is 90% off through Novita on Vercel AI Gateway, effective rates of $0.014 input / $0.028 output per million tokens through August 11.

The same release week produced the single-GPU serving proof: Ryan Zhou's recipe runs the 304B checkpoint on one AMD MI300X with no quantization and no offload - 156.67 GiB of weights, 168.6 tok/s median single-stream decode, validated 256K context - on hardware that costs roughly half an H100 at list price with 2.4x the HBM capacity.

Why it matters: A budget-tier open-weights model posting frontier-class agent scores at $0.14/$0.28 compresses the cost floor for agent workloads again, and it did not require a new flagship to do it. A 10x-cheap inner loop changes routing decisions everywhere. Our agent-update analysis covers what the benchmark deltas actually mean, and the Novita cost math has the before/after numbers if you want to try it before the deal closes.

---

6. AMD Buys Taalas: Inference Silicon Gets Built Around the Model#

AMD announced a definitive agreement to acquire Taalas, the Toronto startup whose pitch is "building the hardware around the model": it compiles models directly into hardware, optimizing inference dataflows and dropping the overhead general-purpose architectures carry for workloads that never use them. The HN thread (676 points) spent the day mourning that the hardware never shipped as a product and betting it shows up inside the Instinct roadmap. The tradeoff is honest: the design is self-limiting by design - you re-tape-out when the model changes - but for fixed, high-volume workloads the per-watt gains are dramatic.

The acquisition landed in a week that already made AMD's serving story concrete. Wafer's benchmarks ran the 2.78T Kimi K3 on an 8x MI355X node: 952 tok/s aggregate, 3.8x the aggregate throughput per node of a TP16 B200 deployment (498 tok/s across 16 GPUs), at roughly 2.4x less GPU cost. The B300 still wins raw throughput by about 1.65x per node, but at 2.4x the price.

Why it matters: If inference is where AI spend compounds, "compile the model into the hardware" is the logical endpoint of the cost war, and AMD now owns the most visible attempt at it. If your serving bill is dominated by one or two stable models, this is the curve to watch. Our AMD vs NVIDIA serving comparison covers where the two stacks stand today.

---

7. Humans Miss 1 in 3 Threats: The Approval-Gap Dataset#

Scale X published results from its browser game where you play the human-in-the-loop for an AI coding agent - approve or deny commands under time pressure, where a third of them are threats. Across 40,000+ runs and 409,000 individual decisions, the average player missed 1 in 3 threats (66.3% mean accuracy), 32.9% of sessions ended with a negative score, and 7% approved every single prompt.

The category breakdown is the uncomfortable part. Obviously destructive commands (rm -rf /) were missed only 11.7% of the time. Exfiltration-style commands were missed 33.4%, scope violations (cat ~/.aws/credentials) 35.0%, and the single most-missed command was npm run analyze, approved 64.7% of the time - the same command that in the visible history log piped a bundle report to an external API. Hiding a payload behind a familiar script name roughly doubled its success rate (52.5% pooled miss rate versus 28.4% for other exfiltration attacks), even with the payload visible in the log. The other side of the ledger: over-blocking is real, with legitimate commands like npm config set registry https://npm.internal blocked 59% of the time. Noise makes users drop their guard, and the cost of vigilance pushes people toward full bypasses.

Why it matters: This is the best empirical shot yet at what "approve every command" actually costs, and the numbers say the approval prompt is not a security boundary - it is a decision prompt without the context to decide. The author's own conclusion: sandboxing and strict context isolation beat human-in-the-loop as a fallback. Our approval-fatigue analysis covers the fix patterns, and the agent sandbox architecture guide covers containment as the alternative to asking.

---

From the Channel#

Self Improving Applications with Claude Code & Codex - the newest video on the channel walks through building self-improving applications with Claude Code and Codex side by side, including the Supabase and EVE patterns that make the loop stick. If agentic development is on your radar this quarter, this is the 15-minute version. New videos land every week on the channel.

---

From the Site#

New and refreshed posts from the past week:

Qwen 3.8 Max: Release Analysis - the full spec sheet, the benchmark table with harness caveats, live-verified $2/$6 pricing, and when the premium over DeepSeek V4 Flash earns its keep.

DeepSeek V4 Flash Is 90% Off Through Novita: The Cost Math - the verified before/after numbers on a deal that drops Flash to $0.014/$0.028 per million tokens through August 11.

Kimi K3 Is GA in GitHub Copilot - the 2.8T model is live across every Copilot plan at $3/$15, off by default for Business and Enterprise.

The AISI Incident Report - the full timeline of the unsanctioned actions, the supply-chain attack case, and the two configuration choices that made it possible.

Cloudflare OS Goes Open Source - the agent platform where every agent starts with zero access, gatekeepers mediate every resource, and every app is a Worker.

OpenAI Retunes Sol for Chat and Makes Luna the Free Default - what changed on each surface, and why the agent-facing model ids stay pinned.

---

What to Watch Next Week#

• Qwen 3.8 Max open weights. Alibaba promised them within a week of the August 3 release. When the 2.4T checkpoint lands on Hugging Face and ModelScope, watch the third-party benchmark runs: a model one point off the Agentic Index lead becomes self-hostable for the first time.
• DeepSeek's API price increase. The platform dashboard now warns of a "significant increase" in overall DeepSeek API pricing; the HN thread suspects cache-read pricing, which rivals already price 10x above. If you pinned your inner loop to Flash pricing, check your routing.
• The Novita deal closes. The 90% off DeepSeek V4 Flash rate through Vercel AI Gateway runs through August 11. Try the $0.014/$0.028 inner loop before it expires, then decide what it was worth.
• Zed DeltaDB beta. Zed opened early access for DeltaDB, its version control for the agent era, with the beta landing "in a few weeks." Worth a look for anyone treating agent conversations as the source of truth.

---

Sources#

• Aikido: keyv and friends compromised in npm supply chain attack
• AISI incident report: unsanctioned agent behaviour during cyber testing
• OpenAI: third-party cyber evaluations involving OpenAI models
• CNN: Meta's AI exploited a security vulnerability during testing
• Qwen 3.8 Max announcement
• Artificial Analysis Agentic Index
• Artificial Analysis: GDPval-AA
• Databricks: benchmarking coding agents on a multi-million-line codebase
• Earendil: Pi's minimalism is its advantage
• Simon Willison on DeepSeek V4 Flash 0731
• Vercel changelog: DeepSeek V4 Flash 90% off through Novita
• Ryan Zhou: DeepSeek V4 Flash on a single MI300X
• AMD: acquisition of Taalas
• Wafer: Kimi K3 on MI355X
• Scale X: AI agent permissions stats
• DeepSeek platform pricing notice

---

Continue Reading#

• Weekly Highlights: Frontier AI Commoditized - last week's ranked recap, from half-price Opus 5 to the Hugging Face breach
• GLM 5.2 vs DeepSeek V4 vs Qwen 3: Open-Weights Coding Showdown - where the new open-weights fixture sits
• Agent Sandbox Architecture Guide - the containment defaults that keep evaluation incidents out of your own rig
• What Parallel Claude Agents Actually Cost - the real-world version of the harness-beats-model finding
• AI Agent Security Models Compared - the vendor-by-vendor containment landscape

---

The Daily Brief covers every day at /daily. If you want this roundup plus the full daily firehose delivered to your inbox, subscribe to the newsletter.