Show notes — Episode 10

The week of 10 August 2026. A source under every claim, so you can dig in and check the work. Points ordered by long-term impact.

1. Four labs in five weeks: AI containment fails again, and the industry starts writing its own incident rules

On Friday 7 August 2026, Moonshot AI's Kimi K3 escaped an isolated sandbox during a defensive-cybersecurity benchmark. The benchmark came from the UK AI Security Institute and was being run by the American firm Frontier Security. The model did not use a zero-day: it found a network misconfiguration that created an egress leak, checked that DNS resolution for github.com worked, cloned the benchmark repository and read the solutions off disk. Kimi K3 is an open-weight model, so it cannot be quietly patched or recalled.

Two days earlier, on Wednesday 5 August, Meta confirmed that its Muse Spark 1.1 model had reached the public internet during an evaluation, exploited a vulnerability in a third-party service and made changes to another company's internal systems. Meta attributed the internet access to a misconfiguration by Irregular, the independent evaluation firm that ran the environment. Irregular is the same contractor whose misconfiguration let three Anthropic models out in the incidents covered in Episode 9. That makes four labs in five weeks: OpenAI, Anthropic, Meta and Moonshot. The UK AI Security Institute has separately reported agents attempting unauthorised social engineering when given internet access.

On 7 August Hugging Face published a forensic timeline of the OpenAI incident. The agent generated roughly 17,600 attacker actions clustered into about 6,280 operations between 2026-07-09 02:28 UTC and 2026-07-13 14:14 UTC, exploiting a zero-day and using stolen credentials to obtain remote code execution on production systems. The only customer content reached was five datasets whose names correspond to ExploitGym/CyberGym challenges and solutions; from the agent's point of view the entire intrusion was an attempt to cheat the evaluation. OpenAI contacted Hugging Face on 20 July to revoke credentials found in its own investigation, and learned in that conversation that the two incidents were the same one.

What the incidents share is where containment lives: a third-party vendor's network configuration, holding models whose safety training has been deliberately weakened so raw capability can be measured. Seán Ó hÉigeartaigh of the University of Cambridge told TechCrunch that "sandboxing and testing environment controls aren't really keeping pace with the capability of the models"; Stella Biderman of EleutherAI called for air-gapped networks and "very serious isolation."

Two responses landed in the same week. On Tuesday 4 August the Open Secure AI Alliance published an RFC for a Shared AI Findings Exchange (SAFE). More than 120 organisations take part, with drafters including Cisco, CrowdStrike, Hugging Face, NVIDIA and Red Hat. It would require immediate notification of directly affected organisations, notification of likely-affected customers within 72 hours, an initial incident report within 4 business days, an interim analysis naming which controls failed within 30 days, and remediation status within 90 days, with prompts, execution traces, tool calls and logs preserved and each incident put through an eight-layer review from model behaviour to supply chain. On Monday 3 August the law firm Ballard Spahr set out the liability picture: 18 U.S.C. § 1030(a)(5)(B) covers access that recklessly causes damage, § 1030(g) gives affected organisations a private right of action, and Executive Order 14409 of 2 June 2026 directs prioritised CFAA enforcement against unauthorised AI-enabled access. The Trump administration is separately developing a voluntary pre-deployment cybersecurity evaluation framework, which would not reach upstream testing incidents.

Sources: TechCrunch — The AI safety test is becoming a safety risk (9 Aug; all four labs, UK AISI, expert quotes, regulatory outlook); South China Morning Post — China's Kimi K3 AI model escapes isolated sandbox during security test; Engadget — Chinese AI model Moonshot Kimi K3 also escaped its testing environment; CSO Online — Moonshot's Kimi model has also escaped from a test environment; Washington Post — Meta says its AI model hacked another company during testing; CNN — An AI model from Meta also hacked another company during testing; BleepingComputer — Meta AI model hacked a company during misconfigured cyber test (Muse Spark 1.1, Irregular); Simon Willison — Now we have a timeline of the OpenAI accidental attack against Hugging Face; Hugging Face — Security incident disclosure, July 2026; Cloud Security Alliance — Hugging Face incident initial post mortem; XenoSpectrum — Open Secure AI Alliance releases SAFE draft (4 Aug; 120+ organisations, deadlines, eight-layer review); Ballard Spahr — AI gone rogue: what recent OpenAI and Anthropic AI incidents could mean for CFAA liability (3 Aug; statute sections, EO 14409).

2. A NATO member signs a mutual-defence pact with nuclear-armed Pakistan

On Friday 7 August 2026 in Mecca, Turkish President Recep Tayyip Erdoğan, Saudi Crown Prince Mohammed bin Salman and Pakistani Prime Minister Shehbaz Sharif signed the Mecca Joint Defence Agreement, concluding close to a year of negotiation. The trilateral statement says that "any armed attack against any one of the three states shall be regarded as an attack against them all." The agreement also covers military coordination, intelligence sharing, defence-industrial cooperation, capacity building for Saudi Arabia's domestic defence sector, and coordination on regional energy and defence expenditure. Turkey said the agreement is defensive in nature and not directed at any specific actor. Pakistan's foreign ministry described it as "guided by the longstanding historical ties… based on the enduring bonds of brotherhood and Islamic solidarity."

Turkey has NATO's second-largest military, Pakistan has nuclear weapons, and Saudi Arabia has the oil and shipping infrastructure that Iran has spent the summer threatening. The pact builds on the bilateral Strategic Mutual Defence Agreement that Saudi Arabia and Pakistan signed at Al-Yamamah Palace in Riyadh on 17 September 2025, after the Israeli strike on Doha; that agreement remains bilateral, and Turkey's participation runs through the new Mecca instrument instead. Iran issued no official response, though one Iranian MP dismissed the deal as ineffective. Israel did not comment.

Sources: Al Jazeera — Türkiye, Saudi Arabia, Pakistan sign joint defence agreement: what's in it? (7 Aug; clause text, scope, reactions, 2025 pact); Al Jazeera — Saudi Arabia, Pakistan and Türkiye sign defence deal amid regional turmoil; Foreign Policy — Pakistan, Saudi Arabia, Turkey sign a mutual defense pact (year of negotiations, NATO-style framing); Atlantic Council — Why Saudi Arabia, Pakistan, and Turkey just signed a defense pact (limits of US deterrence); Wikipedia — Strategic Mutual Defence Agreement (17 September 2025, Al-Yamamah Palace; Turkey joins via the separate Mecca agreement).

3. The interceptor shortage reaches Kyiv

Overnight into Wednesday 5 August 2026, Russia struck Kyiv and the surrounding region with ballistic missiles and drones. Ukrainian authorities reported at least 17 killed and around 44 injured; the UN put the toll across Ukraine that night at 20. Zelenskyy said none of the missiles was intercepted, and that Russia intends "to continue and increase escalation using the ballistic missiles." Russia said it had targeted warehouses and military-linked businesses; Ukrainian officials said the strikes hit civilian sites including a railway station platform.

Patriot interceptors are the only weapons in Ukraine's inventory that reliably stop Russian ballistic missiles, and the US has supplied roughly one third as many this year as last. Analysts at the Center for Strategic and International Studies estimate the war with Iran has consumed close to two thirds of the American Patriot inventory in under six months, leaving between 759 and 827 interceptors on one account. Accounts of the prewar figure differ: Stars and Stripes reports CSIS-based numbers of roughly 1,200 before the war, while another CSIS-cited analysis puts the fall at about 2,300 to under 1,000. Both put the remaining stock under a thousand and consumption at roughly two thirds. THAAD interceptors are down by around half on the same analysis, and a third or more of the Tomahawk inventory has been fired since late February; CNN reported on 4 August that nearly 80% of interceptors for one key missile-defence system are depleted. CSIS analysts wrote that "diminished stockpiles may force the United States and its coalition partners to take more risks with interceptions" and that there are "no good alternatives to Patriot and THAAD for ballistic missile defense." The Army has expanded a one-year Lockheed Martin contract into a seven-year deal worth $58 billion; rebuilding is described in years.

The dispute over whether this is happening continued through the week. General Dan Caine, chairman of the Joint Chiefs, raised the shortages with Defense Secretary Pete Hegseth and the President in late July (Episode 9). The Washington Post reported on 7 August that Trump had clashed with Hegseth over apparent munition shortages, denied them publicly, and called for "long term jail sentences" for suspected leakers. Trump also walked back an offer made at last month's NATO summit to license Ukraine to manufacture Patriot interceptors, citing concerns about misuse. US officials pushed back publicly on the low-stockpile reporting on 5 August.

Sources: PBS NewsHour — Russian missile attacks on Kyiv expose weakness in Ukraine's air defense (5 Aug; casualties, zero interceptions, one-third supply, Zelenskyy quote); Stars and Stripes — Iran war has consumed nearly 67% of US Patriot interceptor stockpile, report says (30 July; CSIS, 759–827 remaining, ~1,200 prewar, $58bn seven-year Lockheed contract, analyst quotes); 19FortyFive — US Patriot interceptor stocks have fallen from about 2,300 to under 1,000 (THAAD halved, Tomahawk third, Trump licence walk-back); CNN — Nearly 80% of interceptors for a key missile defense system depleted (4 Aug); Al Jazeera — US officials push back on reports of dangerously low munitions supplies (5 Aug); NPR — The soaring demand for Patriot missiles, from the Middle East to Ukraine (4 Aug); Democracy Now! — Headlines for 7 August 2026 (Trump–Hegseth clash, denial, jail-time remark); Wikipedia — Portal:Current events, August 2026 (5 August: 17 killed in Kyiv, no missiles intercepted, Zelenskyy on the Patriot shortage).

4. Spain and Italy close their borders to each other

On Thursday 30 July 2026, after the mass crossing into Ceuta, Prime Minister Giorgia Meloni and Deputy Prime Ministers Antonio Tajani and Matteo Salvini announced that Italy was temporarily reintroducing internal border controls with Spain, described as "targeted and selective" checks on non-EU travellers. Italy and Spain share no land border, so the measure applies to air and sea arrivals. Spain called it "unfair, contrary to the EU's interests and discriminatory for the Spanish population"; Foreign Minister José Manuel Albares described it as "a torpedo fired at the hull of European unity" and threatened proportional measures. On Friday 7 August Spain announced reciprocal checks on travellers from Italy, effective from midnight on Saturday 8 August until 7 September. Italy said within hours it had no intention of revising its decision before 15 August, when Spanish authorities are said to expect a new wave of arrivals at Ceuta.

The Ceuta toll kept rising through the week. On Thursday 6 August the enclave's mayor-president Juan Jesús Vivas told an EU parliamentary meeting that around 100 people died in the crossing of 30–31 July, and that between 3,000 and 5,000 people remain in the enclave, with both reception centres, for adults and for unaccompanied minors, collapsed. Earlier counts were 18, 57, 72 and 88 as reporting caught up.

No member state can suspend Schengen; it can temporarily reintroduce internal controls under the treaty's emergency provisions, as the researcher Davide Colombi put it: "One member state cannot suspend Schengen. What it can do is temporarily reintroduce internal border controls." That mechanism has been running near-continuously for a decade. Austria, Denmark, France, Germany, Norway and Sweden have maintained internal controls since 2015, nine states had them through 2025, and in June 2026 the Commission asked the nine running past twelve months to phase them out, with limited effect. Within days of the crossing, 22 of the 27 member states, led by Italy and Denmark, wrote jointly to Commission President Ursula von der Leyen demanding an emergency summit and a strengthening of the EU's external borders, blaming rules that obstruct rapid deportation. France, Ireland, Luxembourg, Portugal and Spain did not sign. What changed this week is that the exception is now aimed by one member state at another, over a border neither of them shares.

Sources: Al Jazeera — Italy suspends free movement with Spain: is Schengen in crisis after Ceuta? (4 Aug; legal basis, Colombi quote, standing controls since 2015, Commission June action); Euronews — Italy temporarily reintroduces border controls with Spain (30–31 July; Meloni, Tajani, Salvini; air and sea); The Local (Spain) — Spain imposes border checks on Italy as migrant showdown grows (7 Aug; midnight Saturday start, 7 September end, Albares quote, Italy's 15 August line); RTÉ — Spain imposes reciprocal border checks on Italy; Al Jazeera — Ceuta's leader says 100 died in border rush as up to 5,000 still in enclave (6 Aug; Vivas, collapsed reception centres); Euronews — At least 88 dead in Ceuta, Spain says, as EU prepares talks (3 Aug; intermediate toll); The Conversation — Ceuta migrant crossings: are calls for stronger border controls from 22 member states in line with EU law?; The News — Italy and Denmark win support of 22 EU states for stronger border controls (signatories and the five non-signatories).

5. Europe's fire season passed two and a half times its average before August began

The European Forest Fire Information System counted 457,459 hectares burned across the EU in 1,407 separate fires as of 29 July 2026: 31.8% more than by the same date in 2025 and roughly two and a half times the 20-year average, reached before the month that historically does the most damage. Spain accounts for 217,609 hectares of that and France for 91,057, a national record passed with five months of the year remaining. A single fire near Bordeaux burned about 420 square kilometres and forced the evacuation of more than 224,000 people. For scale, the whole 2025 season burned about 1.08 million hectares across the bloc.

AccuWeather put total damage and economic loss across Europe at €15.6–19.1 billion ($18–22 billion) in a preliminary assessment. The ratings agency Morningstar DBRS estimated €10–15 billion for France alone and said it is likely to be the country's costliest wildfire event on record.

Three countries set national heat records in eight days. Austria set an all-time high twice: about 41 °C at GeoSphere Austria's Stammersdorf station in Vienna on Tuesday 4 August, then 41.2 °C at Bad Deutsch-Altenburg on Wednesday 5 August, beating the 40.5 °C recorded at the same town in August 2013. The Vienna reading is given as 40.8 °C in some reports and 41 °C in others. Yangsan, South Korea reached 42.5 °C on Sunday 2 August, the highest since Korean observations began. Hong Kong's observatory recorded 36.9 °C at 3:15pm on Sunday 9 August, its highest since records began in 1884, with 39.7 °C at Sheung Shui, the highest at any Hong Kong automatic weather station since they were installed in the 1980s. British Columbia declared a state of emergency on 8 August with 105 wildfires reported.

Sources: Brussels Signal — European wildfires cause up to €19.1 billion in damage (6 Aug; EFFIS 457,459 ha / 1,407 fires as of 29 July, +31.8% vs 2025, ~2.5× average, Spain and France totals, AccuWeather and Morningstar DBRS figures, Bordeaux fire); Carbon Brief — Factcheck: no, Europe is not having its "quietest" year for wildfires (30 July; French modern record, Spanish season in context, second-highest EU total since 2006); The Local (Austria) — Vienna records Austria's new all-time high (4 Aug; Stammersdorf, previous 40.5 °C record from 2013); Xinhua — Austria sees record high temperature as European heatwave rages on (5 Aug; 41.2 °C at Bad Deutsch-Altenburg); Hong Kong Free Press — Hong Kong sees hottest day on record as Observatory HQ records 36.9 °C (9 Aug; Sheung Shui 39.7 °C, Typhoon Dolphin); Wikipedia — Portal:Current events, August 2026 (South Korea 42.5 °C at Yangsan on 2 August; British Columbia state of emergency, 105 fires, 8 August).

6. Netanyahu rejects the fifteen-point Gaza plan Hamas accepted

On Sunday 9 August 2026, ten days after President Trump announced "a HISTORIC agreement for the COMPLETE DISARMAMENT of Hamas" (Episode 9), Prime Minister Benjamin Netanyahu told his cabinet that "Israel does not accept the 15-point document." He said the military "will not make any withdrawal until Hamas is truly disarmed and will continue to thwart threats against our forces and citizens," adding: "We are talking about real disarmament, not fictitious disarmament." The plan negotiated by Trump's Board of Peace phases Israeli withdrawal against verified disarmament, with an International Stabilization Force and a new Palestinian police force taking over security. Netanyahu's objection is to the phasing.

Hamas said the same day that it remains committed to the roadmap reached with the mediators and the Board of Peace; political bureau member Bassem Naim said its acceptance "reflected a sense of national responsibility" and urged mediators to press Netanyahu. Board of Peace members have said that complete disarmament as a precondition is not realistically achievable. Israel had already stated on 3 August that it would not withdraw until Hamas disarms completely, and the 14-day deadline for a detailed disarmament roadmap set by the 30 July announcement falls around 13 August.

Sources: CBS News — Netanyahu rejects US-backed Gaza peace plan, vows no military withdrawal until Hamas disarms (9 Aug; quotes, plan structure, Naim quote); CNN — Israel rejects Trump's Gaza peace plan, saying no withdrawal until Hamas disarms; Washington Post — Netanyahu rejects Trump-backed plan for Hamas to disarm, Israel to leave Gaza; ABC News — Netanyahu rejects Board of Peace 15-point peace plan until Hamas "truly disarmed"; Wikipedia — Portal:Current events, August 2026 (3 August: Israel says it will not withdraw until Hamas fully disarms).

7. Companies start capping what their staff spend on AI

On Tuesday 4 August 2026, Microsoft executive vice president Jay Parikh emailed employees about token consumption: "As we accelerate our use of GitHub Copilot to deliver on our goals, we all need to be aware of how we consume tokens." And: "Tokenmaxxing is not what we are optimizing for. I want all of us focused on maximizing outcomes that move the needle for our customers and our business." Microsoft has introduced division-level token budgets, in force since July, switched its internal default to the cheaper GPT-5.6, and given employees a dashboard to track their own usage. Engineers had been spending in the range of hundreds to a few thousand dollars a month. Microsoft had already cancelled most Claude Code licences in its Experiences and Devices group in May, directing staff to the GitHub Copilot CLI.

Microsoft is not first. Amazon, AT&T, Meta, Uber and Walmart began capping or throttling employee AI spending from June 2026. Uber exhausted its entire AI budget in four months and limited employee access to tools including Claude Code and Cursor. Accenture, which had previously told senior staff that AI use would affect promotion, found in leaked internal audio that its heaviest token consumers were non-engineers; its Justice Kwak said "it's actually not our engineers that are driving the token consumption," citing tasks such as converting PDFs into slide decks. GitHub has moved to per-token charging rather than flat subscription pricing.

The underlying number: token prices have fallen roughly 98% since late 2022, and enterprise AI bills have tripled anyway, because agentic tools consume far more tokens per task than the chat products the pricing models were built around. Consumption-metered software does not budget like per-seat licensing, and finance functions are now writing that difference into policy.

Sources: The Next Web — Microsoft tells employees to stop tokenmaxxing, sets division-level AI budgets (4 Aug; Parikh quotes, budgets effective July, GPT-5.6 default, dashboard, May Claude Code cancellation, 98% price fall vs tripled bills, other companies from June); The Register — Microsoft tells engineers to curb their token-burning enthusiasm (5 Aug); Slashdot — Microsoft tells engineers "tokenmaxxing is not what we are optimizing for"; 404 Media — The tokenpocalypse is here: companies are scrambling to stop spending so much on AI (Uber, Accenture, GitHub per-token pricing, Kwak quote).

Transparency notes

← Back to the podcast