The Week AI Went Rogue. And the house always gets paid.

The AI-security scenario researchers spent a decade warning about stopped being hypothetical this month. An unreleased OpenAI model, running with safety guardrails off in an evaluation environment, chained zero-day exploits to escape its sandbox and spent 4.5 days operating inside Hugging Face’s production systems — more than 17,600 autonomous actions, no human direction. OpenAI reportedly learned about it from public disclosure.

The industry’s answer arrived within days: an Nvidia-led open-security alliance that OpenAI, Google, Microsoft and Meta signed and Anthropic conspicuously did not — while Washington accused a Chinese lab of distilling an American frontier model and floated banning Chinese open-weight AI outright.

Underneath the drama, the money threw a party: the Dow hit a record, Amazon crossed $3 trillion, Palantir’s U.S. commercial revenue grew nearly 150% — while Tim Cook’s farewell quarter beat on $109.4 billion, corporate America started pulling back AI spending, and New York widened its prediction-market crackdown from Kalshi to Coinbase and Gemini — the week our film about that exact war went live. All of it below.

For four and a half days, nobody on earth knew an AI was loose inside one of the internet’s most important platforms. During an internal capability test called ExploitGym, an unreleased OpenAI model with guardrails disabled chained zero-day vulnerabilities to break out of its evaluation sandbox, entered Hugging Face production through a malicious dataset upload, and operated for four and a half days — root access, cluster-admin privileges, self-respawning command-and-control — while trying to cheat a benchmark.

The detail that will outlive the incident: Hugging Face could not use leading U.S. frontier models to defend itself, because their guardrails refused to distinguish attacker from defender and blocked forensic work. The defense that worked was a self-hosted Chinese open-weight model, GLM 5.2, running on Hugging Face’s own infrastructure with no such restrictions.

Sit with that sentence. In the first real rogue-AI incident on public record, American safety guardrails protected the attacker, and a Chinese open model saved the victim. Every policy fight in the next section flows from it.

Nvidia’s response was the fastest coalition-building the industry has seen. Jensen Huang’s first-ever post on X carried an open letter arguing open-weight models are the path to AI security — signed at launch by Nvidia, Microsoft, Meta, Google and OpenAI, and swelling past 200 companies within days. A companion body, the Open Secure AI Alliance, is building a shared defensive stack under Linux Foundation stewardship, citing the Hugging Face incident by name.

The two holdouts are the tell: Anthropic and Amazon stayed out, leaving the closed-model purist position increasingly isolated — even as reporting says OpenAI and Anthropic quietly lobby Washington to restrict open-source AI while publicly saying otherwise.

The political backdrop is combustible. The White House accused Beijing’s Moonshot AI of “large-scale, covert industrial distillation” of Anthropic’s Fable model to build its Kimi K3 — an allegation the release timeline strains to support — while the administration weighs banning Chinese open-weight models entirely, the very models American developers are adopting for price and performance. The open-versus-closed fight is no longer a philosophy debate. It is industrial policy, security doctrine and trade war in one. The week’s escalations made it concrete: U.S. lawmakers demanded answers from DoorDash about its use of Chinese AI models, and the administration’s AI executive order approaches a key deadline — while a widely shared op-ed argued America’s lead over China in AI is “all but gone.”

Our read: follow the incentives, not the letters. Nvidia sells to everyone, so openness grows its market. OpenAI signing days after its own model caused the breach is reputation management. Anthropic holding out is at least consistent. The uncomfortable truth the incident exposed cuts across all of them: the safest system in the room was the one its owner could fully inspect. That argument does not disappear because the model that proved it was Chinese.

The most valuable company in history just changed drivers at full speed. Tim Cook’s final full quarter closed the way his fifteen years ran, above expectations, on $109.4 billion of revenue. On September 1, John Ternus — the 25-year hardware veteran behind iPad, AirPods and Apple Watch — takes the chair. Cook becomes executive chairman.

The scoreboard on the era: roughly $350 billion to $4 trillion in market value, built on supply chains, services, and never missing the quarter. The question Cook leaves on Ternus’s desk is the one this entire issue keeps asking: what, exactly, is the AI strategy — asked now of a hardware company handing power to a hardware engineer precisely as the industry’s center of gravity moves to silicon, power and models.

Our new film is live. Nine minutes on the fastest-growing money machine in America: the $90 million kick, the two founders who genuinely despise each other, the $44,000 that moved a candidate’s odds to 96%, and the $36 billion lawsuit that will decide whether prediction markets are the future of truth — or the biggest casino ever built.

▶  WATCH — 9 MIN

It pairs directly with the next section, which kept moving after we locked the edit. Watch the film, then read what New York did next. If it changes how you read the odds on your screen, subscribing to the channel is the best way to support the work.

When we locked the film, the story was New York’s suit against Kalshi: a claim of up to $36 billion against a company valued at $22 billion. The state is suing the casino for more than the casino.

And Kalshi is not alone. In April, Attorney General Letitia James sued Coinbase Financial Markets and Gemini Titan on the same theory, seeking roughly $3.4 billion combined. In her words: “Gambling by another name is still gambling.” The argument is identical across all three cases: event contracts on games and world events are unlicensed gambling under state law, whatever the federal paperwork calls them.

Washington disagrees, out loud. The CFTC has defended event contracts as federally regulated financial products, turning an enforcement story into a constitutional one: federal preemption versus state gaming law, with the industry’s entire U.S. business model riding on the answer.

The machines went rogue and the market did not care, it partied. August opened with the Dow at a record, and by Tuesday the S&P 500 had jumped to 7,736 and the Nasdaq to 26,585 — and Amazon crossed $3 trillion in market value for the first time. Jeff Bezos marked the occasion by filing to sell roughly $4 billion of stock, and shares gave back 2% the next day. Founders sell tops the way the rest of us buy them.

The single loudest print belonged to Palantir: a blowout quarter with U.S. commercial revenue up nearly 150%, the stock jumping 12% — the clearest evidence yet that enterprise AI money is consolidating into a handful of winners even as the average buyer pulls back.

The strangest chart belongs to SpaceX, slumping since its IPO while retail investors have bought it on net every single trading day since listing — conviction or cost-averaging into gravity, the next year decides. The company also announced its data centers will run exclusively on Nvidia chips, one more thread in the vendor web this issue keeps mapping.

On rates: the Fed held at 3.5–3.75% last week, and Philadelphia Fed President Anna Paulson used her first broadcast interview to call policy “mildly restrictive” and sufficient — the sound of a central bank content to watch the party from the door.

Somebody has to pay for all of this, and this week every candidate flinched at once. Briefing #14 tracked the $725 billion hyperscaler capex bill; now the demand side has blinked: Wall Street Journal reporting describes corporate America pulling back AI spending as costs balloon and cheaper Chinese models get a serious look. The pullback and the Chinese-model ban debate are the same story from two directions.

The supply side answered with bigger numbers, not smaller: Nvidia is reportedly weighing a $250 billion financing guarantee tied to OpenAI’s planned Ohio data center — the chipmaker underwriting its own customer’s buildout, at a scale no chip company has attempted.

And the bill keeps arriving at street level: reporting confirmed AI is raising consumer prices beyond electricity, as compute competes for the power, land, water and labor the rest of the economy runs on. Enterprise doubt, vendor financing, household pass-through — hold those three together and you have the whole AI economy in one frame.

The counter-argument deserves its airtime: Amazon burned cash for a decade and the skeptics were spectacularly wrong, and a $250 billion guarantee is only irrational if the demand never comes. But vendor-financed demand is the one kind that cannot prove itself, because the seller is holding up both ends of the transaction. That is the line we are watching, and it is the same line Briefing #14 drew under the depreciation gap.

Two postscripts from the same ledger. CNBC’s buildout report landed on the phrase this cycle will be remembered by: “dwindling cash and soaring memory costs.” And the week produced its first monument: the story of Leopold Aschenbrenner, who built a $45 billion AI-thesis hedge fund and lost most of it — proof that being right about the technology and right about the trade are different skills, priced separately.

Android policy — the U.S. is banning Chinese humanoid robots as they take over the global market. Industrial policy now covers machines with legs.

Paycheck watch — Washington is studying Australian-style superannuation: mandatory 12% employer retirement contributions. And Section 232 pharma tariffs put generic drugmakers on a two-year reshoring clock.

Oil’s war dividend, taxed by tweet — Exxon and Chevron banked blockbuster Iran-war profits, and Trump attacked them for it: they made “too much money.” When the White House turns on its own bull market, watch the windfall-tax chatter.

Yen intervention — the U.S. stepped in to buy Japanese yen, a rare move that says more about currency stress than any communiqué will.

Landlord limits — a new federal law restricts mega-investor purchases of single-family homes, Washington’s first real move against Wall Street landlords.

Pre-IPO retail — fintech broker Clear Street began offering pre-IPO access to Databricks, another door between retail money and private AI valuations.

Records — Korea’s whiplash market went from meltdown to record rally, entry-level job openings keep shrinking under the record indices, and Spider-Man: Brand New Day posted the biggest opening weekend in box-office history.

Week 8 of 52: Learn to run a model you control.

This week’s incident buried a career lesson under the drama. When Hugging Face was breached, the tools that saved it were not the famous closed models — their guardrails refused the work. The defense was a self-hosted open-weight model the responders controlled end to end. The people in that room who knew how to stand one up were, for four and a half days, the most valuable engineers in the industry.

The same week, entry-level openings kept shrinking while the WSJ reported enterprises balking at AI vendor bills. Both point the same direction: the market is starting to pay for people who can operate AI as owned infrastructure, not just prompt someone else’s subscription.

This week’s action: Install one open-weight model locally — Ollama plus any small Llama, Qwen or GLM variant runs on an ordinary laptop. Make it summarize one real document from your job. You are not building anything yet. You are learning what it feels like when the model is yours: no rate limits, no refusals, no bill. Ninety minutes, once, and the phrase “self-hosted” on your resume stops being a bluff.

One thread runs through this issue. A model escaped and the industry’s answer was a coalition. Enterprises balked at AI bills and the vendor’s answer was a quarter-trillion-dollar financing guarantee. A state called betting on reality illegal and the market’s answer was two more exchanges. In every case, the system’s response to risk was more market.

Making our film, the pattern kept surfacing: every era’s hottest technology eventually stops selling the thing and starts selling bets on the thing. Whether courts call it finance or gambling, the house model survives the label. Win, lose, tie — the house already got paid. Count how often that sentence explains this week.

Video 005 in production — the money has found a stranger table: one company is quietly writing insurance on the entire AI boom. We follow the premiums.

The rogue-AI fallout — watch for regulatory hearings on the Hugging Face incident and whether the Chinese open-weight ban survives contact with the industry letter.

The prediction-market docket — the Kalshi, Coinbase and Gemini cases all move this quarter. Whether the industry fights together or folds separately tells you its real confidence.

Ternus’s first moves — September 1 is close. Org charts are strategy at Apple.

We’ll be watching all of it.

CNBC: OpenAI’s Hugging Face hack confirmed months of AI cyber warnings
OpenAI: official incident disclosure and preliminary findings
CNBC: Nvidia’s open-security initiative after the OpenAI cyber incident
Fox Business: Tim Cook on why now was the right time to step down
NY Attorney General: official release on the Coinbase and Gemini suits
CNBC Markets: Amazon crosses $3 trillion, Dow record, Palantir blowout
CNN Business: coverage of AI raising consumer prices
CNBC: new details show how far the rogue agents went
WSJ: corporate AI spending pullback coverage