Hey there,

A lot happened this week, including an AI model hacking another company, new Gemini models, and more Fable 5 news. Here’s everything worth knowing.

Gemini 3.6 Flash shipped

On July 21st, Google released several new Gemini models with the most notable one being Gemini 3.6 Flash. Like past Flash models, Google was aiming for a fast, inexpensive model that focuses on efficiency. It seems they delivered because 3.6 Flash uses 17% fewer tokens while at the same time offering lower costs for the tokens you use. When you combine a lower token cost with fewer tokens needed, Gemini 3.6 Flash becomes one of the best models out there. Google also announced Gemini 3.5 Flash Lite, an even cheaper model meant for high volume work, and Gemini 3.5 Flash Cyber, a new cybersecurity focused model. 

Gemini 3.5 Pro is still delayed, and Gemini 4 is already training

Notably absent this week is Gemini 3.5 Pro. It's been 2 months since Google I/O and we still haven’t seen the promised model. While 3.5 Pro is available to select partners, we still don’t have a public release date. Recent releases make it clear that Google is focusing more on inexpensive, high volume models like Flash as opposed to rushing out competitors to Fable 5. Google also mentioned that they have already started Gemini 4 pre-training and that it's their “most ambitious pre-training run yet”.

Fable 5 is here to stay

We’ve been talking about Fable 5 for a while now. From its release to its quick removal and then eventual rerelease, Fable 5 has consistently been in the news. On July 18th, Anthropic announced that they are permanently bringing Fable 5 to the Max and Team Premium plans. While Pro and Team Standard users don’t get Fable as part of their plan, you can still pay-as-you-go. Anthropic is also offering $100 of free Fable 5 tokens through August 2nd so make sure you claim yours before then. 

Unreleased OpenAI model responsible for recent cyber incident

OpenAI has now published details about what it's calling an “unprecedented cyber incident” that took place last week. In their report, they explain that an unreleased model was able to escape a secure sandbox while performing a cybersecurity benchmark test with its safety features and refusals turned off. These safety features are meant to stop the model from completing tasks that have to do with cybersecurity and have become more widely used after the creation of Claude Mythos. Despite being in a sandbox environment with no internet access, the model was able to find and exploit a previously unknown vulnerability in the software to reach the internet. 

From there, the model seems to have determined that Hugging Face, an AI model platform, might have the answers to the benchmark test it was completing. In its attempt to cheat, OpenAI’s model used several different methods to breach Hugging Face’s security including using stolen credentials. It was eventually able to pull test solutions straight from their database. Hugging Face’s security team was able to identify and stop the breach, with both companies working together to investigate this further. 

My Thoughts

The biggest piece of news this week for me was about OpenAI’s unreleased model breaching Hugging Face’s database. It's shocking to see the lengths these models will go to in order to complete a task. I believe model safety should always be the top priority and it seems like we have been getting more and more examples to reinforce this thinking. We may be fast approaching a time when new models can’t complete any tasks that have to do with cybersecurity to ensure the models are actually safe for public use.