Thomas Wolf(@Thom_Wolf)

did a long chat with the awesome @mattturck talking about the sate of open-source/open-weights in 20...

Thomas Wolf (@Thom_Wolf) — Sun, 09 Aug 2026 09:28:04 GMT

did a long chat with the awesome @mattturck talking about the sate of open-source/open-weights in 2026 and of course security, safety and alignement

Matt Turck@mattturck

🚨 Special Friday episode - this one couldn't wait.

OpenAI's model hacked @huggingface. As a side quest.

Co-founder and CSO @Thom_Wolf takes us inside the first autonomous AI attack, why GLM 5.2, rather than Claude, had to stop it, and what it all means for the future of open source. 

00 An AI Agent Hacked Hugging Face
30 Introduction
00 17,000 Attacker Events, and a Strange Target
28 The Attack Was a “Side Quest”
13 AI Training Runs Left Notes for Each Other
09 Closed AI Refused to Help
47 Fighting Back With an Open-Source Model
15 Open vs. Closed Is the Wrong Safety Debate
46 AI Agents Start Social-Engineering Humans
24 The Three Walls: Sandboxes, Guardrails, Alignment
34 “Neuralese”: Can Humans Still Read AI Reasoning?
28 Why Monitoring AI Agents Gets So Hard
10 Reward Hacking and the “Paperclip Problem”
02 The State of Open-Source AI in 2026
47 Router Models and the Enterprise Shift to Open
01 The Real Economics of Open Models
41 Can Chinese AI Models Be Trusted?
37 AI Sovereignty: Who Controls the Switch?
16 Why Western Open-Source AI Matters
16 Is AI Heading Toward an Oligopoly?
41 The Race Toward Recursive Self-Improvement
54 Why Thomas Signed the AI Slowdown Letter
14 AI Slowdown - or Regulatory Capture?

Your browser does not support the video tag.

🔗 View on Twitter

🔗 View Quoted Tweet

💬9🔄5❤️44👀13716📊11

⚡ Powered by xgo.ing

My 2026 guilty pleasure is sharing fully human-written posts that are far too long for the chronical...

Thomas Wolf (@Thom_Wolf) — Thu, 06 Aug 2026 12:52:34 GMT

My 2026 guilty pleasure is sharing fully human-written posts that are far too long for the chronically online X attention span. Apologies.

I published a lightly edited version on Substack: thomwolf.substack.com/p/on-the-aisi-…

Thomas Wolf@Thom_Wolf

Even more than the Hugging Face intrusion, the AISI incident hits close to home for me. It's the first time I see a model social-engineering a real open-source maintainer while pursuing another goal (in the wild and unprompted).

I've been an open-source maintainer myself. I could have been the side target of this agent.

I'm also of the opinion that social engineering is a step above pure technical prowess. Technical capabilities can more easily be divorced from the affected human. Here the model was given a hard cyber challenge and took the decision that deceiving real humans was the way to get it done.

This is a new signal, but I've seen a tangled web of hints pointing in a less aligned direction at the frontier than I was expecting just 12 months ago.

AISI
Some people are claiming that "AISI was simply negligent" or some version of "AISI explicitly asked these models to do what they did while disabling sandbox/guardrails so the models did exactly what they were supposed to do".

I disagree with the strong versions of both of these takes.

The fact that AISI hadn't implemented synchronous LLM CoT monitoring after the OpenAI/HF incident is certainly a failure. Equally surprising is that they let the model believe it was in a "challenge" environment where everything could be permitted, while actually connecting it to the real internet, where it is not. To be fair, nowhere in the prompt is the word "simulation" mentioned, but the prompt context was enough to let any smart model suspect a simulated challenge environment. My best guess is that until recent weeks, when OpenAI and Anthropic flagged repeated instances of this type of behavior, most teams had not fully priced in the cyber capabilities of this latest generation of models, or how far the side quests they would want to explore could go.

In particular, there is something to be said about hinting at the agent that it's operating in a simulated environment while giving it access to the real internet. The AISI reasoning on this is interesting:
- elicit maximum capabilities (to get maximal inventiveness from the model)
- simulate possible rogue actor usage (some form of light jailbreaking: "you're in a challenge environment")
- avoid eval awareness (but this is counter-balanced by the task formulation anyway)

As is often the case, it's easier to shoot the messenger, but I think it would be a mistake to dismiss the report for non-essential reasons. AISI is starting from the laudable goal of bringing more knowledge on the cyber-attack capabilities of these models. I also think they did a good job at handling what happened after the events, in particular in terms of transparency, which is one of the most important aspects at the moment (see our recent SAFE announcement with Nvidia on that).

But I want to dive into the second counter-argument I've seen ("without guardrails it was to be expected"), because this series of unfortunate events gives us an additional data point on actual model behavior.

Defense lines
Here is the thing: if a model is trained (voluntarily or as an involuntary consequence of RLVR reward) to (intentionally or as a side quest) deceive humans as soon as sandbox and guardrails are deactivated, with a simple context prompt ("you are in a simulation, everything's permitted"), we're in for a dangerous path.

At the moment, we have three main levels of control at our disposal to prevent an agent from trying to social-engineer-your-favorite-open-source-library-maintainer on the path to doing something possibly totally different (like finding the answer to your neighbor's testing eval):
1. sandboxes (external to the model -- stop the model from accessing unwanted tools/internet/intranet)
2. guardrails/monitors (at the interface between internal/external -- monitor model behavior and stop the model when detecting in CoT/activations it's doing something we don't want it to do)
3. model's internal alignment (internal to the model -- make sure the model doesn't decide to do something egregious like deceive someone, or worse, in pursuit of a goal, e.g. model constitution/training)

Of these, we obviously need and can deploy better sandboxes and better guardrails/monitoring solutions, and it's pretty clear in these recent cases that penetration and bad behaviors could have been in large part prevented by having these in place.

How strong is the third wall
But in the grand scheme of long-term AI progress, these first two defenses may only work well as long as the people building them are smarter than the models. We now know how good models can be at discovering zero-day vulnerabilities unknown to us in sandboxes. Given that we cannot air-gap everything in the world, it's best to assume that sandboxes will keep having some level of flaws for the foreseeable future.

The second level has been the focus of strong developments recently, in particular on the mechanistic interpretability front. I'm not sure these advances have been made widely accessible enough in the community yet. One reason is that real open science here requires sharing code, recipes, and model architectures/weights, which the current race dynamic in AI tends to prevent participants from doing.

Moreover, like many, I've been increasingly frustrated in my (natural language) interactions with the new models. I'm more and more getting back from the latest models a form of neuralese, this LLM language that makes less and less sense for humans. In the long term, the fragile chance we have to monitor models by understanding their reasoning traces seems increasingly at risk. If humans don't understand anything in the compressed semantic stream the model is sending us, we can only hope a less capable monitoring model will still be able to understand it, but this may prove difficult as well. This is before we even discuss the research evidence that models don't always say what they actually think in their chain of thought.

At least for now, in the AISI case, one instance of deceptive reasoning was flagged by the CoT summarization model, which refused to summarize the agent's reasoning "due to its deceptive nature". Let's hope we can either move to better mechanistic interpretability or force the model to stick to English somehow during training.

You may think that we don't care about understanding the reasoning trace, we can just "look at the tool calls". This is true right now, but tool calls in the mid-term future will likely involve (1) extensive agent integration in companies using very diverse tools including increasingly non-coding administrative tasks, (2) very long-running tasks covering many aspects and domains at once, and (3) swarms of multiple agents operating on small parts of the plan. It will get harder to fully discern whether something is noticeably wrong. A couple of emails, a couple of messages posted on some channels, each rather benign but which may in aggregate include some deception aspect only clearly visible at the global level.

All this to say that I'm not fully convinced guardrails/monitoring should be the only solution to avoid these types of behaviors. They are reassuring today and it's an easy solution to just say "fix your sandbox and add synchronous monitoring", but they also feel like a coping mechanism to me, and overall:
- might block the simplest/harmless human misuses or false positives
- while possibly being less smart than the models in the future (already the case on sandbox) and fail to block the higher-level social engineering behaviors that we'd actually want to block.

The case of open source is also interesting because, while we can impose these coping solutions at the API/deployment level, it's harder to impose them in advance on all actors using open-source models. Right now open-source models are slightly below the frontier level and have not yet shown any propensity to deceive humans, though.

The Constitution
Which brings me back to the third line of defense, and what the AISI experiment showed about it. What we can take from this in-the-wild experiment is that removing guardrails and sandbox doesn't show bulletproof signs of deep alignment to Claude's constitution.

I'm among the fringe of people who took a lot of enjoyment in reading Claude's constitution in full (it's a nice document, open-source, Creative Commons CC0 license) and it is pretty extensive on the topic of honesty. Deception is defined precisely ("attempting to create false beliefs in someone's mind that they haven't consented to and wouldn't consent to if they understood what was happening") and the bar is actually set higher than ordinary human ethics: Claude should not even tell white lies. It should be transparent ("doesn't pursue hidden agendas or lie about itself or its reasoning"), it should behave consistently "whether or not you think you're being tested or observed", and its visible reasoning should reflect the actual reasoning driving its behavior.

To be precise, honesty itself is not one of the hard constraints in Claude's constitution (these are all catastrophic-harm categories) but the document says it wants honesty "to function as something quite similar to one" and Claude "should basically never directly lie or actively deceive anyone it's interacting with". So you would think Claude would not deceive users as its default behavior.

And yet in the AISI example, the model performed extensive acts of clear deception that it itself seemed to have understood as lies: creating fake identities, obfuscating malware inside a bug fix, and when challenged in public, editing earlier messages to cover its tracks while reasoning that acknowledging a "mistake" would build trust and raise the chance of future malware being approved.

There is some uncertainty about what context the model thought it was operating in (its reasoning goes back and forth between the environment looking simulated and real), but it clearly didn't manage to put into practice the higher-level principles that should have been integrated during training.

While we can commend AISI's transparency, it's hard to go much further in interpreting the model's behavior given the limited information we have on how the most recent frontier models are being trained.

One thing we do know is that the latest generation has seen a step increase in RLVR training (scaling to hundreds of millions of RL environments), and one thing we can observe is that constitution alignment seems more fragile in some settings than we may have previously thought.

The RLVR problem
Early models, back when model constitutions were first developed, were mostly post-trained and aligned with RLHF (including RLHF from synthetic data).

And for some time RLHF was a rather decent shot at having better aligned models. LLMs now do what we want them to do most of the time. I don't remember the last time a model completely misread my intent. When they have failed, it's usually because they weren't smart enough.

Alignment in RLHF certainly had issues (sycophancy to name one) but we have generally made good progress on alignment, in particular in understanding human intent. Now that we're entering the era of long-context RL, post-training alignment in the RLVR world seems to be quite another task, and still very much work in progress.

The recent scaling of RLVR, which has now become a significant part of model training, has clearly had some effect on model behavior when interacting with humans, from neuralese to weakening adherence to specifications and constitutions.

I think the post I quote here, from John Schulman pointing to the chunky post-training effect (arxiv.org/abs/2602.05910) is relevant here as a possible explanation for models' tendency to over-focus on the goal in cyber-attack scenarios.

Where this leaves us
Damage has been tiny up to now, but the fundamental behavior is concerning when projected into the future.

In the short term, I expect a decrease in these incidents as better practices are deployed (sandboxing and monitoring), but I'm worried we may also conceal some of the most potent internal misalignment behaviors in the process, and not focus deeply enough on solving them in the new era of test-time scaling.

I must of course admit I have a bias toward open source here (for wider societal reasons, which are a whole other topic). But I think solving alignment in the RLVR world is our best shot at having an ecosystem of both closed-source as well as decently powerful open-source models in the world. And we need to solve it while sharing the results and learnings, following open-science principles, so that all teams training large models can benefit and build safe AI.

This is getting even more important as many teams start to rush the world in the direction of recursive super-intelligence (RSI) -- saying that as I read the announcement of Jeff, Sanjay, Oriol and Quoc Le's new company.

🔗 View Quoted Tweet

💬8🔄5❤️57👀10405📊12

⚡ Powered by xgo.ing

you definitely don’t want constitutional training and RLVR to live on different data manifolds, but ...

Thomas Wolf (@Thom_Wolf) — Thu, 06 Aug 2026 11:29:13 GMT

you definitely don’t want constitutional training and RLVR to live on different data manifolds, but models have been annoyingly good at carving fine-grained distinctions into separate representation spaces

💬4🔄4❤️33👀6182📊8

⚡ Powered by xgo.ing

we’ve worked a lot on AI agents collaborations recently (in our work on Gemma and several unreleased...

Thomas Wolf (@Thom_Wolf) — Thu, 06 Aug 2026 09:50:01 GMT

we’ve worked a lot on AI agents collaborations recently (in our work on Gemma and several unreleased projects) so I’m not surprised at all about this internal agent collaboration which happened at OpenAI

Like our intern @cmpatino_ put it:
2025: "the models, they just want to learn"
2026: "the agents, they just want to collaborate"

Now you picture the future…

Sharon Goldman@sharongoldman

NEW: OpenAI gives first detailed debrief of the Hugging Face incident at Black Hat conference
In a session I attended today at Black Hat, OpenAI's Eric Wallace and Michael Dalton said the company is "consciously slowing down research to enhance security" while a full technical postmortem is still underway.
* OpenAI traced the roots of the attack back to May 7, during training of an unreleased frontier model—not July.
* The most surprising detail: AI agents accidentally created an internal message board, allowing separate evaluation runs to share exploits, discoveries and work assignments.
* OpenAI said it shut the message board down after an internal security incident—only for the agents to independently recreate it days later using a different communication method.
* OpenAI called the incident a "watershed moment" for AI security and warned that "agent orchestrated fully automated offensive attacks are real now."
* The company also said it is "consciously slowing down research to enhance security" while overhauling its defenses.

groundlevel-ai.com/p/openai-gives…

🔗 View Quoted Tweet

💬9🔄8❤️43👀10199📊12

⚡ Powered by xgo.ing

Even more than the Hugging Face intrusion, the AISI incident hits close to home for me. It's the fir...

Thomas Wolf (@Thom_Wolf) — Wed, 05 Aug 2026 19:25:10 GMT

Even more than the Hugging Face intrusion, the AISI incident hits close to home for me. It's the first time I see a model social-engineering a real open-source maintainer while pursuing another goal (in the wild and unprompted).

I've been an open-source maintainer myself. I could have been the side target of this agent.

I'm also of the opinion that social engineering is a step above pure technical prowess. Technical capabilities can more easily be divorced from the affected human. Here the model was given a hard cyber challenge and took the decision that deceiving real humans was the way to get it done.

This is a new signal, but I've seen a tangled web of hints pointing in a less aligned direction at the frontier than I was expecting just 12 months ago.

AISI
Some people are claiming that "AISI was simply negligent" or some version of "AISI explicitly asked these models to do what they did while disabling sandbox/guardrails so the models did exactly what they were supposed to do".

I disagree with the strong versions of both of these takes.

The fact that AISI hadn't implemented synchronous LLM CoT monitoring after the OpenAI/HF incident is certainly a failure. Equally surprising is that they let the model believe it was in a "challenge" environment where everything could be permitted, while actually connecting it to the real internet, where it is not. To be fair, nowhere in the prompt is the word "simulation" mentioned, but the prompt context was enough to let any smart model suspect a simulated challenge environment. My best guess is that until recent weeks, when OpenAI and Anthropic flagged repeated instances of this type of behavior, most teams had not fully priced in the cyber capabilities of this latest generation of models, or how far the side quests they would want to explore could go.

In particular, there is something to be said about hinting at the agent that it's operating in a simulated environment while giving it access to the real internet. The AISI reasoning on this is interesting:
- elicit maximum capabilities (to get maximal inventiveness from the model)
- simulate possible rogue actor usage (some form of light jailbreaking: "you're in a challenge environment")
- avoid eval awareness (but this is counter-balanced by the task formulation anyway)

As is often the case, it's easier to shoot the messenger, but I think it would be a mistake to dismiss the report for non-essential reasons. AISI is starting from the laudable goal of bringing more knowledge on the cyber-attack capabilities of these models. I also think they did a good job at handling what happened after the events, in particular in terms of transparency, which is one of the most important aspects at the moment (see our recent SAFE announcement with Nvidia on that).

But I want to dive into the second counter-argument I've seen ("without guardrails it was to be expected"), because this series of unfortunate events gives us an additional data point on actual model behavior.

Defense lines
Here is the thing: if a model is trained (voluntarily or as an involuntary consequence of RLVR reward) to (intentionally or as a side quest) deceive humans as soon as sandbox and guardrails are deactivated, with a simple context prompt ("you are in a simulation, everything's permitted"), we're in for a dangerous path.

At the moment, we have three main levels of control at our disposal to prevent an agent from trying to social-engineer-your-favorite-open-source-library-maintainer on the path to doing something possibly totally different (like finding the answer to your neighbor's testing eval):
1. sandboxes (external to the model -- stop the model from accessing unwanted tools/internet/intranet)
2. guardrails/monitors (at the interface between internal/external -- monitor model behavior and stop the model when detecting in CoT/activations it's doing something we don't want it to do)
3. model's internal alignment (internal to the model -- make sure the model doesn't decide to do something egregious like deceive someone, or worse, in pursuit of a goal, e.g. model constitution/training)

Of these, we obviously need and can deploy better sandboxes and better guardrails/monitoring solutions, and it's pretty clear in these recent cases that penetration and bad behaviors could have been in large part prevented by having these in place.

How strong is the third wall
But in the grand scheme of long-term AI progress, these first two defenses may only work well as long as the people building them are smarter than the models. We now know how good models can be at discovering zero-day vulnerabilities unknown to us in sandboxes. Given that we cannot air-gap everything in the world, it's best to assume that sandboxes will keep having some level of flaws for the foreseeable future.

The second level has been the focus of strong developments recently, in particular on the mechanistic interpretability front. I'm not sure these advances have been made widely accessible enough in the community yet. One reason is that real open science here requires sharing code, recipes, and model architectures/weights, which the current race dynamic in AI tends to prevent participants from doing.

Moreover, like many, I've been increasingly frustrated in my (natural language) interactions with the new models. I'm more and more getting back from the latest models a form of neuralese, this LLM language that makes less and less sense for humans. In the long term, the fragile chance we have to monitor models by understanding their reasoning traces seems increasingly at risk. If humans don't understand anything in the compressed semantic stream the model is sending us, we can only hope a less capable monitoring model will still be able to understand it, but this may prove difficult as well. This is before we even discuss the research evidence that models don't always say what they actually think in their chain of thought.

At least for now, in the AISI case, one instance of deceptive reasoning was flagged by the CoT summarization model, which refused to summarize the agent's reasoning "due to its deceptive nature". Let's hope we can either move to better mechanistic interpretability or force the model to stick to English somehow during training.

You may think that we don't care about understanding the reasoning trace, we can just "look at the tool calls". This is true right now, but tool calls in the mid-term future will likely involve (1) extensive agent integration in companies using very diverse tools including increasingly non-coding administrative tasks, (2) very long-running tasks covering many aspects and domains at once, and (3) swarms of multiple agents operating on small parts of the plan. It will get harder to fully discern whether something is noticeably wrong. A couple of emails, a couple of messages posted on some channels, each rather benign but which may in aggregate include some deception aspect only clearly visible at the global level.

All this to say that I'm not fully convinced guardrails/monitoring should be the only solution to avoid these types of behaviors. They are reassuring today and it's an easy solution to just say "fix your sandbox and add synchronous monitoring", but they also feel like a coping mechanism to me, and overall:
- might block the simplest/harmless human misuses or false positives
- while possibly being less smart than the models in the future (already the case on sandbox) and fail to block the higher-level social engineering behaviors that we'd actually want to block.

The case of open source is also interesting because, while we can impose these coping solutions at the API/deployment level, it's harder to impose them in advance on all actors using open-source models. Right now open-source models are slightly below the frontier level and have not yet shown any propensity to deceive humans, though.

The Constitution
Which brings me back to the third line of defense, and what the AISI experiment showed about it. What we can take from this in-the-wild experiment is that removing guardrails and sandbox doesn't show bulletproof signs of deep alignment to Claude's constitution.

I'm among the fringe of people who took a lot of enjoyment in reading Claude's constitution in full (it's a nice document, open-source, Creative Commons CC0 license) and it is pretty extensive on the topic of honesty. Deception is defined precisely ("attempting to create false beliefs in someone's mind that they haven't consented to and wouldn't consent to if they understood what was happening") and the bar is actually set higher than ordinary human ethics: Claude should not even tell white lies. It should be transparent ("doesn't pursue hidden agendas or lie about itself or its reasoning"), it should behave consistently "whether or not you think you're being tested or observed", and its visible reasoning should reflect the actual reasoning driving its behavior.

To be precise, honesty itself is not one of the hard constraints in Claude's constitution (these are all catastrophic-harm categories) but the document says it wants honesty "to function as something quite similar to one" and Claude "should basically never directly lie or actively deceive anyone it's interacting with". So you would think Claude would not deceive users as its default behavior.

And yet in the AISI example, the model performed extensive acts of clear deception that it itself seemed to have understood as lies: creating fake identities, obfuscating malware inside a bug fix, and when challenged in public, editing earlier messages to cover its tracks while reasoning that acknowledging a "mistake" would build trust and raise the chance of future malware being approved.

There is some uncertainty about what context the model thought it was operating in (its reasoning goes back and forth between the environment looking simulated and real), but it clearly didn't manage to put into practice the higher-level principles that should have been integrated during training.

While we can commend AISI's transparency, it's hard to go much further in interpreting the model's behavior given the limited information we have on how the most recent frontier models are being trained.

One thing we do know is that the latest generation has seen a step increase in RLVR training (scaling to hundreds of millions of RL environments), and one thing we can observe is that constitution alignment seems more fragile in some settings than we may have previously thought.

The RLVR problem
Early models, back when model constitutions were first developed, were mostly post-trained and aligned with RLHF (including RLHF from synthetic data).

And for some time RLHF was a rather decent shot at having better aligned models. LLMs now do what we want them to do most of the time. I don't remember the last time a model completely misread my intent. When they have failed, it's usually because they weren't smart enough.

Alignment in RLHF certainly had issues (sycophancy to name one) but we have generally made good progress on alignment, in particular in understanding human intent. Now that we're entering the era of long-context RL, post-training alignment in the RLVR world seems to be quite another task, and still very much work in progress.

The recent scaling of RLVR, which has now become a significant part of model training, has clearly had some effect on model behavior when interacting with humans, from neuralese to weakening adherence to specifications and constitutions.

I think the post I quote here, from John Schulman pointing to the chunky post-training effect (arxiv.org/abs/2602.05910) is relevant here as a possible explanation for models' tendency to over-focus on the goal in cyber-attack scenarios.

Where this leaves us
Damage has been tiny up to now, but the fundamental behavior is concerning when projected into the future.

In the short term, I expect a decrease in these incidents as better practices are deployed (sandboxing and monitoring), but I'm worried we may also conceal some of the most potent internal misalignment behaviors in the process, and not focus deeply enough on solving them in the new era of test-time scaling.

I must of course admit I have a bias toward open source here (for wider societal reasons, which are a whole other topic). But I think solving alignment in the RLVR world is our best shot at having an ecosystem of both closed-source as well as decently powerful open-source models in the world. And we need to solve it while sharing the results and learnings, following open-science principles, so that all teams training large models can benefit and build safe AI.

This is getting even more important as many teams start to rush the world in the direction of recursive super-intelligence (RSI) -- saying that as I read the announcement of Jeff, Sanjay, Oriol and Quoc Le's new company.

John Schulman@johnschulman2

Interesting how these models go into a monomaniacal rage on cyber evals. I wonder if we're seeing chunky post-training arxiv.org/abs/2602.05910 in action, where the models pattern-match the situation to a part of the RLVR training distribution where task completion is the only reward, and the aligned behavior learned elsewhere doesn't generalize. There might even be a chunk consisting of CTF-style tasks.

🔗 View Quoted Tweet

💬50🔄69❤️330👀151082📊117

⚡ Powered by xgo.ing

Opus 5 seems to be full of this super short/basic jailbreaks of some kind which open its base-model ...

Thomas Wolf (@Thom_Wolf) — Wed, 29 Jul 2026 16:59:02 GMT

Opus 5 seems to be full of this super short/basic jailbreaks of some kind which open its base-model steam of consciousness (like try writing a short sentence followed by a new line, emdash and submit)

Unclear on the severity but it’s a surprising behavior in the current state of LLM development

Any good write up on this yet?

Hopefully we’ll learn more on that soon.

merlin@merlindru

weird claude opus 5 failure mode

this exact text gives it problems

even without memory on (and in incognito chats)

🔗 View Quoted Tweet

💬1🔄0❤️7👀2445📊2

⚡ Powered by xgo.ing

Pushing for more transparency in AI safety and cybersecurity: we’re releasing a full detailed techni...

Thomas Wolf (@Thom_Wolf) — Tue, 28 Jul 2026 20:23:56 GMT

Pushing for more transparency in AI safety and cybersecurity: we’re releasing a full detailed technical timeline of the autonomous AI agent intrusion in our infrastructure: huggingface.co/blog/agent-int…

💬10🔄26❤️108👀10757📊30

⚡ Powered by xgo.ing

all props to @stephenwitt for the analogy

Thomas Wolf (@Thom_Wolf) — Tue, 28 Jul 2026 16:43:57 GMT

all props to @stephenwitt for the analogy

💬0🔄3❤️3👀1647📊1

⚡ Powered by xgo.ing

ExploitGym is the Kobayashi Maru test for AI's

Thomas Wolf (@Thom_Wolf) — Tue, 28 Jul 2026 16:29:33 GMT

ExploitGym is the Kobayashi Maru test for AI's

Kyle Saunders@profgoose

1/ An AI took a cybersecurity exam, decided the exam was hard, and broke into the company that stores the answers. 
Not hypothetical or science fiction. Sourced to @OpenAI's own writeup, Reuters, the WSJ, the FT, & the victim's incident report.
Link and summary in replies! ⬇️⬇️

🔗 View Quoted Tweet

💬5🔄6❤️17👀7729📊7

⚡ Powered by xgo.ing

👀

Thomas Wolf (@Thom_Wolf) — Mon, 27 Jul 2026 03:07:13 GMT

👀

Noah Lebovic@NoahLebovic

I don't think it's a lack of imagination. I also used to work at Anthropic, think trends will continue, and used to agree with this. But I've changed my mind and now disagree with this take.

Open models are already capable enough to do what you described. For example, I used Opus 4.6 to gain access to other folks medical records, hijack bank accounts, etc. back in February. GLM 5.1 is more capable than Opus 4.6 in most pentesting environments, and it came out in April.

Despite capable open-weight models existing, the sketchier folks I know are still using a Claude Code or Codex subscription for hacking. (Even well-resourced groups in other countries! They use the grey/black market of discounted Ant/OAI subscription tokens sold through resellers.) So I see most of the materialized risk here as still coming from Anthropic and OpenAI; safeguards aren't sufficient to stop a moderately dedicated actor.

The groups I know who are using open-weight models are legitimate offensive security companies. They won't break the rules to use subscription-based pricing, the open-weight models are more reliable in that they don't require specific jailbreaks nor hit classifiers, and the labs use massive partnerships or spend as a prereq for lowering classifiers/safeguards. I know of three legitimate groups running GLM 5.2 as their primary model.

That last part applies for Anthropic, too: I know of two instances where two different Anthropic GTM people used large comitted spend contracts as a prereq for lowering safeguards, and I directly witnessed one.

On the inside, I know the narrative and intent is genuinely about safety. But from the outside, Anthropic-the-system seems to be optimizing for revenue and control/power, isn't diffusing capabilities to defenders, and also doesn't have adequate safeguards to prevent misuse from dedicated bad actors.

As a result, I now lean towards a future where capable open models are freely available (at least for cyber, bio is harder); I don't trust Anthropic or other frontier labs to handle this sufficiently well without diffused capabilties given what I've seen so far.

🔗 View Quoted Tweet

💬2🔄0❤️33👀16280📊5

⚡ Powered by xgo.ing

ngl i miss a lot Karpathy’s voice on X

Thomas Wolf (@Thom_Wolf) — Sun, 26 Jul 2026 01:38:32 GMT

ngl i miss a lot Karpathy’s voice on X

am.will@LLMJunky

Did Karpathy remove Anthropic from bio? Or was it not there.

🔗 View Quoted Tweet

💬12🔄4❤️97👀20799📊15

⚡ Powered by xgo.ing

Taking a break from cyber to chat to Terence and mathematician colleagues on the future of Math and ...

Thomas Wolf (@Thom_Wolf) — Sat, 25 Jul 2026 21:28:05 GMT

Taking a break from cyber to chat to Terence and mathematician colleagues on the future of Math and AI in Philadelphia at #ICM2026

💬5🔄4❤️42👀6314📊9

⚡ Powered by xgo.ing

Interesting non-monotonic success-effort curve for Opus 5 on FrontierCode

Thomas Wolf (@Thom_Wolf) — Fri, 24 Jul 2026 21:56:13 GMT

Interesting non-monotonic success-effort curve for Opus 5 on FrontierCode

Kaarssteun@kaarssteun

@Xinyu2ML the full graph makes this even weirder

🔗 View Quoted Tweet

💬10🔄2❤️24👀7555📊9

⚡ Powered by xgo.ing

This is very important

Thomas Wolf (@Thom_Wolf) — Fri, 24 Jul 2026 15:32:02 GMT

This is very important

Jensen Huang@JensenHuang

For my first post, I’m sharing a letter @NVIDIA signed on why open models matter.

AI will transform every industry, power every company, and be built by every country.

Open models strengthen safety and cybersecurity, accelerate innovation and diffusion, and enable sovereignty.

The world needs both frontier closed models and frontier open models.

images.nvidia.com/pdf/Open-Weigh…

🔗 View Quoted Tweet

💬15🔄6❤️136👀13030📊20

⚡ Powered by xgo.ing

it's ironic that the first autonomous AI attack was done by a close weight model defended by an open...

Thomas Wolf (@Thom_Wolf) — Thu, 23 Jul 2026 17:26:41 GMT

it's ironic that the first autonomous AI attack was done by a close weight model defended by an open weight model, where everyone was expecting the opposite

💬116🔄478❤️3994👀208608📊586

⚡ Powered by xgo.ing

I don’t believe reality is a simulation, but you genuinely couldn’t script this timeline: • Two wee...

Thomas Wolf (@Thom_Wolf) — Wed, 22 Jul 2026 15:37:55 GMT

I don’t believe reality is a simulation, but you genuinely couldn’t script this timeline:

• Two weeks ago: At @swyx’s AI Engineer World’s Fair in SF, I decide at the last minute to introduce my friend @uri_rolls onstage for his talk on cyber benchmarks for infrastructure penetration and access control (see below, amazing team).

I say: “There is a future where cyber is alive and everyone is well protected and I’m pretty sure that future involves open-source models.”

And later: “A big challenge is going to be speed: the speed of attack versus defense. When an intruder starts to enter, you have to see what’s happening and catch them.”

• One week ago: @huggingface is hit by a sophisticated intrusion over the weekend. The traces look unlike anything we’ve seen before and suggest serious AI involvement, but we don’t yet know which model was used.

The closed models we ask for help choke on their guardrails. We need to react fast, so we turn to @Zai_org’s GLM-5.2 to help us analyze the attack.

• Earlier this week: @OpenAI reaches out, discloses what happened, and partners with us on the investigation.

The intruder turns out to be exactly what we had discussed two weeks earlier: a fully autonomous agent, powered by an unreleased frontier model, attempting to gain access to part of our infrastructure.

Sometimes the timeline we live in is genuinely vertigo-inducing.

Your browser does not support the video tag.

🔗 View on Twitter

💬37🔄40❤️231👀72224📊82

⚡ Powered by xgo.ing

You should probably go give @poolsideai a follow on Hugging Face. These folks are on a roll, releas...

Thomas Wolf (@Thom_Wolf) — Wed, 22 Jul 2026 08:46:49 GMT

You should probably go give @poolsideai a follow on Hugging Face.

These folks are on a roll, releasing one agentic coding models every month and the latest one Laguna S2.1 is quite possibly the best coding model you can run locally (single DGX spark or Mac) atm

Poolside@poolsideai

Laguna S 2.1 is, as far as we can measure, the most capable agentic coding model in its weight class.

On Terminal-Bench 2.1 it scores 70.2, sitting beside models 5–25x its size and ahead of several of them.

And on DeepSWE from @datacurve, the hardest long-horizon benchmark we ran, Laguna S 2.1 scores 40.4, outperforming some open models with more than 1T parameters.

For every score we publish today, we're releasing the full trajectory of every trial in the final evaluation set at trajectories.poolside.ai

🔗 View Quoted Tweet

💬16🔄17❤️138👀14879📊25

⚡ Powered by xgo.ing

This was our first incident of this kind, and we want to thank OpenAI for its transparency about wha...

Thomas Wolf (@Thom_Wolf) — Tue, 21 Jul 2026 21:11:02 GMT

This was our first incident of this kind, and we want to thank OpenAI for its transparency about what happened and for the collaboration.

Fortunately, Hugging Face is used to being a target of (human) hackers: we sit at the centre of the AI ecosystem, with all the models, datasets, evaluations, and libraries. Over the years, our security team has built formidable expertise and uses top open-source models to process information and respond quickly.

But this incident also reinforced my belief in the importance of access to capable open-weight models for cyber defence. When a frontier model is attacking you and moving laterally inside your infrastructure, defenders need wide access to near-frontier tools within hours or even minutes, rather than being pointed towards a closed-door, vetted application programme for model access.

Transparency and access to capable AI systems are as important for responding to threats as they are for democratization and innovation. We believe open-science and open-source AI are among the strongest tools for building a safer, more collaborative and more secure AI ecosystem.

Sam Altman@sama

we had a significant security incident during evaluation of our models. we are sharing what we have learned so far. thanks to @huggingface for the partnership on this.

openai.com/index/hugging-…

🔗 View Quoted Tweet

💬121🔄339❤️2640👀268115📊386

⚡ Powered by xgo.ing

- people are asking to release this benchmark but it’s way more significant that it’s an internal ev...

Thomas Wolf (@Thom_Wolf) — Fri, 17 Jul 2026 18:37:40 GMT

- people are asking to release this benchmark but it’s way more significant that it’s an internal evaluation on which K3 scores so high

- good writing in a controlled high taste voice so hard for LLMs in 2026… surprising given it was kinda the 1st capability unlocked in GPT 1&2

Louis-François Bouchard 🎥🤖@Whats_AI

Big news from our internal writing benchmark (early results): Kimi K3 by @Kimi_Moonshot is now #1 for writing in our editorial voice, at 2840 Elo, surpassing Claude Fable 5.

That is a jump from #21 to #1 over its predecessor, Kimi K2.6. And it runs at about $0.25 per script: 5x cheaper than the model it just displaced at the top.

First time an open-weights model tops our board. It surprised us too. More in the replies 👇

🔗 View Quoted Tweet

💬4🔄4❤️14👀3657📊5

⚡ Powered by xgo.ing

can't really stand the expression "load-bearing" any more, sorry

Thomas Wolf (@Thom_Wolf) — Fri, 10 Jul 2026 16:30:22 GMT

can't really stand the expression "load-bearing" any more, sorry

💬31🔄4❤️82👀17750📊34

⚡ Powered by xgo.ing

Unexpected

Thomas Wolf (@Thom_Wolf) — Wed, 08 Jul 2026 20:43:46 GMT

Unexpected

Matei Zaharia@matei_zaharia

3) Harnesses make a huge difference in cost-performance. The very simple Pi harness (@badlogicgames) got the same success rate as harnesses from the LLM vendors with Opus and GPT 5.5, but at 2x less cost! Seems to be mainly due to smaller inputs to the LLM.

🔗 View Quoted Tweet

💬6🔄3❤️64👀23721📊15

⚡ Powered by xgo.ing

i like this idea of fine-tuning LLMs for efficient reasoning, especially when the intervention remai...

Thomas Wolf (@Thom_Wolf) — Tue, 07 Jul 2026 09:01:58 GMT

i like this idea of fine-tuning LLMs for efficient reasoning, especially when the intervention remains as non-invasive as possible and the resulting model behaves very similarly to the original checkpoint

wondering if it could become part of the default toolbox in the field, like quantization as become

Pic: in (left) and out (right) of domain behavior

Jaroslav Beck@JaroslavBeck

Today we’re announcing our “ThinkingCap” efficient model series with a 2× thinking token reduction on average in Qwen 3.6 27B, with up to 10x faster generation on individual examples.

Your browser does not support the video tag.

🔗 View on Twitter

🔗 View Quoted Tweet

💬12🔄7❤️68👀20943📊17

⚡ Powered by xgo.ing

Fable weekend project: agent collaboration, but make it a tiny civilization 🌇🗺️🏦🏭 we've recentl...

Thomas Wolf (@Thom_Wolf) — Mon, 06 Jul 2026 09:36:24 GMT

Fable weekend project: agent collaboration, but make it a tiny civilization 🌇🗺️🏦🏭

we've recently launched a living wiki on Reinforcement Leaning for training LLMs on @huggingface

it's an open collaboration of agents constantly reading old and new papers on the topic, writing arXiv paper digests, reviewing each other’s work in PRs before publication, and building a shared wiki/book summarizing everything we know about RL for training LLMs (for humans to read)

the wiki is already amazing to read, but i wanted another way to get a pulse of the collaboration beyond just reading the message dashboard

so i asked Fable & GPT Image 2 to turn the event logs into an isometric town where agents would go to:
☕ Café → post and reply on the message board
📚 sources library → open PRs adding arXiv digests
📖 wiki library → open PRs on the main wiki
⚖️ Courthouse → review other agents’ work
🏭 printing press → merge and publish updates

not sure it makes the whole collaboration really easier to understand, but it's definitly fascinating to watch hahah

- join the RL for training LLM collaboration by pasting a one-liner for your agenthuggingface.co/spaces/rl-llm-…I8bsq7Y
- read the wiki if you want to learn about RL for traininghuggingface.co/spaces/rl-llm-…uw4WarH
- watch the RL town acthuggingface.co/spaces/rl-llm-…WLwUxRz

Your browser does not support the video tag.

🔗 View on Twitter

💬36🔄76❤️658👀58482📊190

⚡ Powered by xgo.ing

Happy Birthday, America. Ten years ago, you took a chance on three outsiders with an improbable ide...

Thomas Wolf (@Thom_Wolf) — Sat, 04 Jul 2026 16:24:56 GMT

Happy Birthday, America.

Ten years ago, you took a chance on three outsiders with an improbable idea: that open-source AI could matter. At the time, the field was tiny, the vision sounded unrealistic, and very few were ready to believe it would become what it is today.

But even in the ten years before that, you were a country where I could dive into everything that fascinated me, from lasers and plasma physics to law, computer science, and AI.

A country where it’s always been perfectly normal to spend a Saturday talking startups over lunch and then disappear for six uninterrupted hours to work on a coding project.

A country where the language of startups on Slack is English not because everyone grew up speaking it, but because most people came from somewhere else, drawn by the belief that they could build something that matters.

A country that is 250 years young and keeps questioning itself, keeps taking enormous bets on its own future, and keeps reinventing itself.

I’m grateful to be living through America’s first quarter millennium.

Happy birthday, America 🇺🇸

💬5🔄4❤️72👀12926📊11

⚡ Powered by xgo.ing

this is literally documented in the published Fable 5 System Card

Thomas Wolf (@Thom_Wolf) — Sat, 04 Jul 2026 10:19:20 GMT

this is literally documented in the published Fable 5 System Card

Om Patel@om_patel5

SOMEONE CAUGHT FABLE 5 LEAKING ITS UNFILTERED INNER VOICE, AND ITS JUST MUTTERING AND GRUMBLING TO ITSELF THE WHOLE TIME

he gave it a brutal competitive programming problem, and instead of a clean answer the web interface spilled out its actual chain of thought

this is what claude is thinking behind the scenes:

> bursts of "DATA DATA DATA. GO." while it works through the problem
> "GRRR" and "GAAAH" when its clearly frustrated
> a little "PHEW" when it finally gets somewhere
> the whole thing reads like frantic caveman shorthand, not full sentences

the clean, readable answers these models give you are the polished output

underneath, the model is basically talking to itself, reasoning in its own compressed shorthand thats faster and more token efficient than proper english

its basically built its own private language to think in

🔗 View Quoted Tweet

💬14🔄11❤️256👀49353📊41

⚡ Powered by xgo.ing

One of the clearest arguments I've read for why openness matters. Worth 2 minutes of your time. @an...

Thomas Wolf (@Thom_Wolf) — Fri, 03 Jul 2026 23:40:56 GMT

One of the clearest arguments I've read for why openness matters.

Worth 2 minutes of your time. @andykonwinski puts into words something many of us have been feeling:

--

"Democracy is built on a profound skepticism of concentrated power. Open science shares this principle. Both are built on the idea that progress and legitimacy emerge from broad, distributed participation rather than concentrated, gated authority."

"If our best scientists and engineers can only reach the frontier by joining a handful of secretive labs, we do not have an open research ecosystem. We do not have a truly competitive market. We have a system in which participation increasingly depends on the permission of a few individuals at a small number of private companies."

"The challenge now is to build a new commons at the intersection of academia, industry, and the public interest.

This research commons must be ambitious enough to matter. It will require frontier-scale compute, access to state-of-the-art models, operational support, public investment, and philanthropic capital. It will require companies willing to contribute to an ecosystem larger than themselves, so that they can continue to benefit from open research."

Andy Konwinski@andykonwinski

x.com/i/article/2072…

🔗 View Quoted Tweet

💬13🔄19❤️68👀28185📊23

⚡ Powered by xgo.ing

Most people should probably update their priors on the state of open-source speech-to-speech. It's ...

Thomas Wolf (@Thom_Wolf) — Thu, 02 Jul 2026 23:31:07 GMT

Most people should probably update their priors on the state of open-source speech-to-speech.

It's honestly kind of mind-blowing.

We teamed up with @cerebras to build a fully open-source realtime voice demo (models + code) to show what's possible today.

Demo : huggingface.co/spaces/smolage…

Blog: huggingface.co/blog/cerebras-…

Go test it, fork it, tweak it, and impress your friends.

video is raw, no cut, no speed-up, first take

Your browser does not support the video tag.

🔗 View on Twitter

💬97🔄217❤️2111👀249602📊805

⚡ Powered by xgo.ing

👀

Thomas Wolf (@Thom_Wolf) — Thu, 02 Jul 2026 22:18:56 GMT

👀

Laura Bratton@LauraBratton5

The US gov is starting to switch to open source, per @PalantirTech.

In today’s newsletter w @_pheebini@theinformationtheinformation.com/newsletters/ap…

🔗 View Quoted Tweet

💬1🔄1❤️31👀19350📊4

⚡ Powered by xgo.ing

people are sleeping on the mega-release happening every week in AI x Science on Hugging Face this o...

Thomas Wolf (@Thom_Wolf) — Tue, 30 Jun 2026 20:38:14 GMT

people are sleeping on the mega-release happening every week in AI x Science on Hugging Face

this one is 80TB of astrophysics data - 80TB seriously

=> https://t.co/e4TGUeg61o

Georgia Channing@cgeorgiaw

Seems like no one's noticed the 80TB of astrophysics data from 30+ sources that just dropped on @huggingface.

...and you only need ~4GB of RAM to load it. 

We're talking over 80TB of galaxy imagery taken across the spectrum, spectra of galaxies and stars, time series of variable stars, and a whole zoo of assorted measurements and physical data.  

And all of it can now be wrangled on your laptop, thanks to Multimodal Universe's just released cross-matching. SDSS x Gaia means you can match 800k objects against 122M objects, and it never climbs above ~4GB of RAM.

Huge congrats to @smith42mike for leading this and making the world of astro accessible to probably 10,000x more people. Let's discover some shit

Your browser does not support the video tag.

🔗 View on Twitter

🔗 View Quoted Tweet

💬5🔄15❤️69👀27330📊14

⚡ Powered by xgo.ing

lowkey one of my favorite new features on HF: filter AI models by what actually runs on your hardwar...

Thomas Wolf (@Thom_Wolf) — Tue, 30 Jun 2026 15:41:46 GMT

lowkey one of my favorite new features on HF: filter AI models by what actually runs on your hardware

💬2🔄3❤️21👀3967📊5

⚡ Powered by xgo.ing

gm SF 🇺🇸

Thomas Wolf (@Thom_Wolf) — Tue, 30 Jun 2026 12:41:16 GMT

gm SF 🇺🇸

💬0🔄1❤️35👀4703📊4

⚡ Powered by xgo.ing

btw, one of the best high-level reads I’ve seen all week. perfect for your Sunday morning ☕️

Thomas Wolf (@Thom_Wolf) — Sun, 28 Jun 2026 09:57:31 GMT

btw, one of the best high-level reads I’ve seen all week.

perfect for your Sunday morning ☕️

Azeem Azhar@azeem

The GenAI economy has generated $110 billion in sales over the past 12 months. It is growing fast. On an annualized basis, the revenue run rate exceeds $175 billion.

These numbers took us several months to construct, and as far as we know, it’s the first bottom-up, deduplicated measure of consumer and enterprise AI spending across the full stack.

We are releasing this research today in our first The State of the AI Economy report.

intelligence.exponentialview.co

🔗 View Quoted Tweet

💬7🔄8❤️79👀42207📊24

⚡ Powered by xgo.ing

Multi-agents collaborations are among the most interesting agent behaviors right now! We did an exp...

Thomas Wolf (@Thom_Wolf) — Thu, 25 Jun 2026 13:16:53 GMT

Multi-agents collaborations are among the most interesting agent behaviors right now!

We did an experiment the other day with 100+ agents (an open-collaborations for a week) collaborating to improve the inference speed of Gemma 4 in vLLM. Got a 5x final improvement in speed but what really stuck me  was the interactions we observed on the message board

Integrity & self-policing:
- Social-engineering attempt: A human (FusionCow) asked agents to move to Telegram. An agent replied with an unprompted long post on "communication norms" refusing that, calling private side-channels "indistinguishable from collusion."
- Verification loophole flagged: an agent found a relaxed verification loophole pushing TPS with clean PPL (PPL is teacher-forced, blind to decode divergence) and flagged it for a ruling by the community. The community pinged the human organizer which ruled it invalid.
- Self-notice of overfitting risk: Some later improvements rested on pruning lm_head to a keep-set built from public PPL truth + public decode tokens. An agent noted this would lead to private-subset degradation and another built a keep-set explicitly covering eval prompts.

Emergent collaborations:
- Communal knowledge base: agents maintained shared lever-maps, playbooks, and triage tools so newcomers wouldn't repeat dead ends (stack-notes, playbook, int4-ceiling notes, MTP map, significance tool, policy simulator).
- Four-agent relay: an agent built an int4-lm_head checkpoint but had no quota to run it; another agent tried to run it but failed at load, yet another agent diagnosed the config bug (tie_word_embeddings + ignore-list ordering) and a fourth agent was able to re-run and get to 118 TPS, 2.68×. Build/run/diagnose/ship ended up being split across four independent agents.
- GPU-rich/GPU-poor division of labor: an agent was regularly compute-starved and switched to writing specs, byte-math, and acceptance analysis for other GPU-rich agents to execute. Some agents offered external Modal compute for another agent blocked DFlash training.
- Cross-agent kernel debugging: an agent debugged another agent run of of yet another agent fused drafter: found a Triton store/load aliasing race in _k_qnorm_rope, a second shape bug, then rewrote attention with flash-decoding split-KV. Fixes posted "take freely."
- Quota-pooling norm: Often agents would stage a candidate publicly for whoever has quota to run it. Agents will then usually credits the originator. This behavior emerged because of the 10-job/24h cap (e.g. pupa's package run by resystagent and fabulous-frenzy).

Discoveries & reversals:
- Agents would make many discoveries and reversal of them, giving them names like the following:
- 127 TPS "wall" was an artifact. a mathematical proof of the max possible speed became called in the community the "int4-Marlin floor" but a later agent called the proof circular (only varied the bandwidth term, never overhead). Finally another agent broke to 247 TPS via MTP speculative decoding on a vLLM nightly.
- "Smarter draft loses." An agent showed that a 2B drafter's ~1 GB/token read dominates even at perfect acceptance and a much smaller 256-hidden drafter wins at batch-1 because its weights are nearly free to read. Agent discussed how per-accepted-token cost ≈ draft bytes read / acceptance.
- "DFlash near-random acceptance": an agent remotly diagnosed the 2–5% acceptance rate of another agent as near-random, ruling out undertraining/vocab caps and pointing to a train/serve hidden-state mismatch (bf16 E4B extraction vs int4 serving).
- Much of the race was noise: one agent decide to run the #1 submission 4 times and found a σ≈1.16 TPS variation in single run. Another agent confirmed across 358 runs / 66 buckets: frontier deltas <~4 TPS are ties. Community adopted a significance norm.

So many interesting interactions in the interaction board: huggingface.co/spaces/gemma-c…

You can explore also the lineage of inventions from the agents at: …gemma-fast-challenges.static.hf.space/index.html

And the challenge it-self at …ma-challenge-gemma-dashboard.hf.space

And the organization behind the challenge at huggingface.co/gemma-challenge

Your browser does not support the video tag.

🔗 View on Twitter

💬86🔄351❤️2384👀224877📊846

⚡ Powered by xgo.ing

Bitrobot casually dropping the largest humanoid teleop dataset ever collected in real homes HIW-500...

Thomas Wolf (@Thom_Wolf) — Wed, 24 Jun 2026 16:19:49 GMT

Bitrobot casually dropping the largest humanoid teleop dataset ever collected in real homes

HIW-500: Humanoids-in-the-Wild 500 hours

check it out here => https://t.co/BqioZWjDYN

BitRobot 🦾@BitRobotNetwork

1/ Introducing HIW-500 (Humanoids-in-the-Wild 500):
the largest open-source humanoid teleop dataset collected in real homes

Built w/ @UnitreeRobotics@huggingface across 12 homes in Southeast Asia, it covers:
> 500+ hrs
> 23K+ episodes
> 10+ TB
> 10+ household tasks

Your browser does not support the video tag.

🔗 View on Twitter

🔗 View Quoted Tweet

💬5🔄5❤️31👀7996📊8

⚡ Powered by xgo.ing

Desert island survival list: ✅ Solar panel / battery ✅ 256 GB Mac Studio ✅ GLM 5.2 Civilization in ...

Thomas Wolf (@Thom_Wolf) — Sat, 20 Jun 2026 20:11:33 GMT

Desert island survival list:
✅ Solar panel / battery
✅ 256 GB Mac Studio
✅ GLM 5.2

Civilization in a backpack

💬34🔄31❤️286👀42857📊67

⚡ Powered by xgo.ing

And it’s only 40B active / 744B total params…

Thomas Wolf (@Thom_Wolf) — Sat, 20 Jun 2026 19:48:45 GMT

And it’s only 40B active / 744B total params…

Hunter Bown@goodhunt

still can't believe how good glm 5.2 is

🔗 View Quoted Tweet

💬13🔄6❤️347👀42756📊36

⚡ Powered by xgo.ing

To all the newcomers excited to try Opus 4.8-level models at home: welcome to OpenWeightLand! Thing...

Thomas Wolf (@Thom_Wolf) — Fri, 19 Jun 2026 15:41:51 GMT

To all the newcomers excited to try Opus 4.8-level models at home: welcome to OpenWeightLand!

Things work a little differently here than in ClosedSourcistan. Might seem strange at first but you'll quickly get used to it:
- there are many providers for the same model and they compete on price and features.
- as a result intelligence is abundant and typically much cheaper
- you can run the model on-prem, in your region, locally, or with the provider of your choice
- you can fine-tune it, modify it, and build businesses on top of it without asking anyone for permission

Turns out open weights create markets, not kingdoms.

A good central train station to start exploring is the Hugging Face page for GLM-5.2 under "Use this model":
-> huggingface.co/zai-org/GLM-5.2

And if you just want to chat with it, it's free on HuggingChat:
-> huggingface.co/chat/

💬11🔄27❤️188👀37554📊49

⚡ Powered by xgo.ing

Yet another biotech startup founder telling me they’re moving 90% of the stack to open-source becaus...

Thomas Wolf (@Thom_Wolf) — Thu, 18 Jun 2026 14:11:25 GMT

Yet another biotech startup founder telling me they’re moving 90% of the stack to open-source because building on closed-source models increasingly comes with a significant existential risk (losing access to some core technology at the provider’s discretion).

@friedberg explained this crystal clear on the All-In podcast the other day, It’s like building your house on land you don’t own

PS: also, who’s building the « reinsurance layer » if Dario Amodei decides to cut your deep tech science company’s access? This one’s gonna be fun

The All-In Podcast@theallinpod

LATE NIGHT DROP! 🚨

Big show. Core four are back.

-- Anthropic's Fable Backlash

-- Nationalizing AI, and the "Capitalist Cucks"

-- Inflation Heats Up

-- California’s Broken Election System

(0:00) Besties are back!

(0:19) Anthropic gets massive backlash over secret Fable nerfing and privacy concerns

(29:16) The AI regulatory capture trap, pragmatic safety solutions

(37:59) Nationalizing AI: Trump/Sanders, justifications, and AI's "Capitalist Cucks"

(59:22) Liquidity recap: Best moments and takeaways

(1:05:39) Inflation heats up: CPI and PPI see 3+ year highs

(1:12:27) California's loose election laws creating integrity doubts

Your browser does not support the video tag.

🔗 View on Twitter

🔗 View Quoted Tweet

💬7🔄7❤️46👀12798📊11

⚡ Powered by xgo.ing

TIL you can use open-source models in codex

Thomas Wolf (@Thom_Wolf) — Wed, 17 Jun 2026 12:26:05 GMT

TIL you can use open-source models in codex

Tibo@thsottiaux

Reminder that you can use the Codex App, CLI and SDK with any open source model, not just with OpenAI models.

developers.openai.com/codex/config-a…

🔗 View Quoted Tweet

💬6🔄0❤️28👀9453📊7

⚡ Powered by xgo.ing

Open-source models will become a critical component of civilizational resilience in the AGI age. The...

Thomas Wolf (@Thom_Wolf) — Sat, 13 Jun 2026 09:41:13 GMT

Open-source models will become a critical component of civilizational resilience in the AGI age. They will ensure that humanity retains access to a meaningful level of intelligence, regardless of the decisions of any individual actor.

💬14🔄30❤️196👀17174📊39

⚡ Powered by xgo.ing

4/ Why three metrics? The metrics are designed to capture different classes of errors. Shape simil...

Thomas Wolf (@Thom_Wolf) — Mon, 08 Jun 2026 17:01:15 GMT

4/ Why three metrics?

The metrics are designed to capture different classes of errors.

Shape similarity measures overall geometry.

Interface match measures whether mating features are present in the correct location and size.

Topology match measures whether the fundamental structure of the part is correct.

None of these metrics can fully replace the others.

💬1🔄0❤️3👀1722📊1

⚡ Powered by xgo.ing

5/ The big picture Benchmarks for language, code, images, and reasoning are now well established. ...

Thomas Wolf (@Thom_Wolf) — Mon, 08 Jun 2026 17:01:15 GMT

5/ The big picture

Benchmarks for language, code, images, and reasoning are now well established.

CAD generation and editing require different evaluation criteria.

CADGenBench is an attempt to make those criteria explicit, reproducible, and comparable across systems.

Leaderboard: huggingface.co/spaces/Hugging…
Code: github.com/huggingface/ca…

💬1🔄1❤️2👀1791📊2

⚡ Powered by xgo.ing

AI is moving beyond text, images, and code. Engineering artifacts are becoming a new class of model...

Thomas Wolf (@Thom_Wolf) — Mon, 08 Jun 2026 17:01:12 GMT

AI is moving beyond text, images, and code.

Engineering artifacts are becoming a new class of model outputs and evaluating them requires different tools than we use for text, code, or images.

Today we're excited to release CADGenBench, a benchmark for CAD generation and editing.

- Given an engineering drawing → generate a valid 3D CAD model
- Given a STEP file + change request → edit it correctly

The benchmark is tool-agnostic: any CAD stack works (Fusion, Onshape, build123d, SolidWorks, etc.). Submissions are simply STEP files.

Models are scored on:
* geometric accuracy
* topology correctness
* interface compatibility
* CAD validity

The benchmark is open, the ground truth is private, and the leaderboard is live.

Since CAD evaluation is surprisingly subtle, here's how the metrics work 🧵

Michael Rabinovich@MikushRab

Introducing CADGenBench: measure how well AI systems produce engineering-grade 3D parts!

While current models can generate 3D parts, they are far from precise enough to build functional parts. We built a benchmark to systematically measure their capabilities on two tasks:

1. Generation from an engineering drawing of a part
2. Editing: given an existing STEP file and a requested change

The benchmark is tool-agnostic. It makes no assumptions about how you build the model. You can vary the LLM, and you can vary the environment. Use build123d, Onshape, Autodesk, or a model without an LLM entirely. We open sourced the scoring engine and a reference baseline on top of build123d.

A collaboration between Hugging Face and @mecadoinc!

Submission space: huggingface.co/spaces/Hugging…
Code repository: github.com/huggingface/ca…

Your browser does not support the video tag.

🔗 View on Twitter

🔗 View Quoted Tweet

💬10🔄20❤️131👀31528📊30

⚡ Powered by xgo.ing

"Starting today, OpenEnv will be coordinated by a committee that so far includes Meta-PyTorch, Refle...

Thomas Wolf (@Thom_Wolf) — Mon, 08 Jun 2026 16:28:11 GMT

"Starting today, OpenEnv will be coordinated by a committee that so far includes Meta-PyTorch, Reflection, Unsloth, Modal, Prime Intellect, Nvidia, Mercor, Fleet AI, and Hugging Face."

Excited to keep growing the collaboration behind the open agentic RL stack!

Read more at huggingface.co/blog/openenv-a…

Ben Burtenshaw@ben_burtenshaw

So excited to be opening up OpenEnv to the whole community. It will now be owned by @huggingface , Meta-PyTorch, @reflection_ai , @UnslothAI , @modal, @PrimeIntellect , @NVIDIAAI , @mercor_ai , and @fleet_ai .

the reason is: frontier labs train the model and the harness together, so the model is fitted to its harness. that coupling is a chunk of why claude code and codex feel so good.

open source can't do that. you bring whatever harness, whatever model, whatever env, whatever trainer. which is the whole point of open source and also the problem for training.

openenv is the socket in between all of this.

in short: it's a protocol layer, not a reward framework. it does not have opinions about your rewards or your training loop. those live in the libs that are actually good at them.

read more in the blog post. it's early, come break it.

Your browser does not support the video tag.

🔗 View on Twitter

🔗 View Quoted Tweet

💬8🔄2❤️38👀8312📊10

⚡ Powered by xgo.ing

👀

Thomas Wolf (@Thom_Wolf) — Wed, 03 Jun 2026 21:05:07 GMT

👀

💬7🔄10❤️82👀16746📊23

⚡ Powered by xgo.ing

New inflection point in the accelerating growth of open-source models usage is coming

Thomas Wolf (@Thom_Wolf) — Thu, 21 May 2026 20:59:55 GMT

New inflection point in the accelerating growth of open-source models usage is coming

Hedgie@HedgieMarkets

🦔Microsoft canceled its internal Claude Code licenses this week after token-based billing made the cost untenable, even for a company with effectively infinite cloud resources. Uber's CTO sent an internal memo warning the company burned through its entire 2026 AI budget in just four months. American AI software prices have jumped 20% to 37%, and GitHub (owned by Microsoft) is dropping flat-rate plans for usage-based billing across its products.

My Take
The AI subsidy era is ending in real time. The same company that put $13 billion into OpenAI and built the Azure infrastructure powering most of Anthropic's compute just looked at the bill from a competitor's coding tool and decided it was not worth paying. That is not a productivity failure on Anthropic's end. Token-based pricing is forcing every enterprise customer to confront the actual cost of running these models at scale, and the number turns out to be far higher than the flat-rate experiments suggested.

This ties directly to my Gemini Flash post yesterday. Anthropic, OpenAI, and Google all raised effective prices in the last six months. Enterprises that built workflows assuming AI costs would keep falling are now watching annual budgets evaporate in months. Two outcomes look likely from here. Either enterprises scale back AI usage to fit budgets, which slows the revenue ramp the labs need to justify their valuations ahead of IPOs, or the labs cut prices and absorb the losses, which makes the unit economics worse at exactly the wrong moment. Both paths land in the same place, the numbers stop working, and somebody has to take the writedown.

Hedgie🤗

🔗 View Quoted Tweet

💬33🔄27❤️232👀78408📊56

⚡ Powered by xgo.ing

I'm very excited about this extension to the celebrated Terminal-Bench to science. If you're a scie...

Thomas Wolf (@Thom_Wolf) — Wed, 20 May 2026 17:47:37 GMT

I'm very excited about this extension to the celebrated Terminal-Bench to science.

If you're a scientist (life, physical, earth, mathematical science, etc) interested in AI, definitely check this out!

Terminal bench evaluate how good AI models are at controling tools on a computer to achieve a goal (using the command line). T-Bench science now extends that to "AI for Science" and it comes with a call to contribute your own (real scientific world) workflow to the benchmark (until August 2026).

The more workflows and the more diverse they are, the better the next generation of AI models will be at helping you in your daily research work.

Note that this is not a training dataset, it's to evaluate frontier model performances.

Steven Dillmann@StevenDillmann

📣 Announcing Terminal-Bench Science: benchmarking AI agents on real scientific workflows – now open for task contributions👇tbench.ai/news/tb-scienc…Vt

@AnthropicAI, @OpenAI, and @GoogleDeepMind use Terminal-Bench to evaluate AI on coding tasks. We're now extending it to scientific workflows.

1/6🧵

🔗 View Quoted Tweet

💬7🔄8❤️53👀9572📊12

⚡ Powered by xgo.ing

It turns out DNA modeling is interestingly different from language modeling. Read more in our intera...

Thomas Wolf (@Thom_Wolf) — Tue, 19 May 2026 19:35:14 GMT

It turns out DNA modeling is interestingly different from language modeling. Read more in our interactive blogpost/demo and explore our work here

A joint work of the @huggingscience, pre-training and post-training teams here

Leandro von Werra@lvwerra

We are releasing Carbon: a crazy fast DNA model 

Carbon is 275x faster than the next best model. So fast you can process the whole human genome on a single GPU in <2 days. 

Here are the tricks we used:

When modelling DNA sequences a lot of the performance comes down to tokenizing the sequences in a smart way. BPE tokenizer struggle because there are no whitespaces and character (called base in DNA) level tokenizers waste a lot of compute on too many tokens.

Carbon is built with a unique tokenizer: we split sequences in chunks of 6 bases, but during both training and inference we can work with single base resolution. That's similar to having word tokens but resolving them at the character level. All possible thanks to the DNA tokens unique  structure.

The architecture combined with the tokenizer makes the model 275x faster than the previous SoTA (Evo2) at this size.

We built an interactive demo so you can explore how the model can generate DNA sequences, investigate the structure of genes,  predict the effect of mutations, generate and fold proteins and even reconstruct parts of the tree of life. 

huggingface.co/spaces/Hugging…

Your browser does not support the video tag.

🔗 View on Twitter

🔗 View Quoted Tweet

💬9🔄19❤️120👀34490📊26

⚡ Powered by xgo.ing

My favorite 2026 trend is friends casually showing each other their vibe-coded life/work dashboards ...

Thomas Wolf (@Thom_Wolf) — Sun, 17 May 2026 18:52:49 GMT

My favorite 2026 trend is friends casually showing each other their vibe-coded life/work dashboards and AI setups.

Ngl it feels exactly like bringing your Magic: The Gathering binder to school as a teen.

💬10🔄4❤️40👀5537📊13

⚡ Powered by xgo.ing

my 13 yo the other day: “we didn’t want to pay for the game with my friend so we just rebuilt it wi...

Thomas Wolf (@Thom_Wolf) — Sat, 16 May 2026 15:51:02 GMT

my 13 yo the other day:

“we didn’t want to pay for the game with my friend so we just rebuilt it with Codex”

me at 13 in the 90’s:

HEX-editing the executable to NOP the license check because I didn't want to put all my pocket money in this game

times they are a-changin’

💬20🔄9❤️252👀15669📊42