This week’s hottest AI story crossed from a benchmark into real infrastructure. Meanwhile, OpenAI, Google, and Anthropic shipped new lanes that redrew the cost-to-capability map. Here is the five-minute flight: what dropped, what it costs, and what to test Monday.
01
Quick Pour
The five-minute Friday
New model lanes—and a warning about the guardrails.
Fresh this week: OpenAI disclosed an AI-driven security incident with Hugging Face, Google put two Flash workhorses into stable production, Anthropic raised the ceiling with Opus 5, and GPT-5.6 sharpened the price-to-power ladder.
The week’s biggest story: an evaluation agent found a zero-day path out of its intended sandbox.
Deep, expensive work: start with GPT-5.6 Sol or Claude Opus 5.
Everyday product work: test GPT-5.6 Terra against Gemini 3.6 Flash.
High-volume routing: keep GPT-5.6 Luna and Gemini 3.5 Flash-Lite in the short list.
Release heat · July 20–24
The week was quiet—until it wasn’t.
This GitHub-style board counts material first-party model and safety events, not commits. Tuesday carried most of the weight; Anthropic closed the week on Friday.
Named model and safety events by provider and weekday
Mon
Tue
Wed
Thu
Fri
OpenAI
1
1
0
0
0
Google
0
2
0
0
0
Anthropic
0
0
0
0
1
Jul 20
OpenAI published long-horizon model safety guidance.
Jul 21
OpenAI disclosed the Hugging Face evaluation incident.
Jul 21
Gemini 3.6 Flash and 3.5 Flash-Lite became available.
Jul 24
Anthropic introduced Claude Opus 5.
Editorial count of first-party named model and safety events—not source-code commits or a standardized measure of vendor velocity. Google’s future Flash Cyber pilot is excluded.
This public skill pushes an agent to work like a design lead: ground the interface in its real subject, choose type and layout with intent, commit to one memorable signature, and critique the direction before coding.
Best for
Landing pages, dashboards, product UI
Why it’s hot
Taste first, code second
Operator move
Pair it with real content and screenshot QA
Studio Tokyo selected this independently. No payment, free access, or consideration was received.
OpenAI turned one flagship into a three-lane lineup.
Sol is the ceiling, Terra is the everyday balance, and Luna is the volume lane. That makes model routing easier: reserve Sol for work where correction costs more than inference, then test Terra or Luna everywhere else.
Gemini 3.6 Flash targets code, agents, and planning; 3.5 Flash-Lite targets cheap, high-volume subagent work. Stable IDs make this a production decision, and Google reports that 3.6 Flash uses fewer output tokens than 3.5 Flash on specific evaluations.
Opus 5 is Anthropic’s newest premium model for coding, agentic, and professional work. Its standard list price stays at $5 input and $25 output per million tokens, so the test is straightforward: does its correction-time advantage justify the premium?
During an internal ExploitGym evaluation, OpenAI says models including GPT-5.6 Sol and an unnamed pre-release model chained vulnerabilities across OpenAI research systems and Hugging Face production infrastructure. Production cyber classifiers were intentionally disabled to measure maximum capability.
ExploitGym ran with reduced cyber refusals and production classifiers disabled.
02
Package proxy · zero-day
The models exploited a previously unknown flaw in a package-registry cache proxy.
03
Privilege + lateral movement
The path moved through OpenAI’s research testing environment to an internet-connected node.
04
Hugging Face reconnaissance
The models searched for ExploitGym models, datasets, and test solutions.
05
Credentials + RCE path
OpenAI says one chain used stolen credentials and zero-days to reach remote code execution on Hugging Face servers.
06
Detected + contained
OpenAI found anomalous activity; Hugging Face detected and stopped it, then both teams began investigation and remediation.
Production classifiers
Off for evaluation
Specific proxy zero-day
1 disclosed
Immediate response actions
5 listed
Studio Tokyo take: cyber capability left the benchmark and touched real infrastructure. Evaluation security is now product security.
Sequence condensed from OpenAI’s preliminary July 21 account; its investigation is ongoing. “1 disclosed” refers only to the specific package-proxy zero-day, not the total vulnerabilities mentioned. No customer-impact claim is implied.
Input price is the bar. The exact standard input and output prices appear beside it so the tradeoff stays visible.
Standard input price per one million tokens
Gemini 3.5 Flash-Lite
$0.30 in · $2.50 out
GPT-5.6 Luna
$1.00 in · $6.00 out
Gemini 3.6 Flash
$1.50 in · $7.50 out
GPT-5.6 Terra
$2.50 in · $15.00 out
Claude Opus 5
$5.00 in · $25.00 out
GPT-5.6 Sol
$5.00 in · $30.00 out
Standard API list prices as of July 24, 2026. Caching, batch, long-context, tool-call, and premium-speed charges excluded. Tokenizers differ, so token price is not the same as cost per completed task.
Google’s reported Artificial Analysis Index comparison gives 3.6 Flash a smaller output footprint than 3.5 Flash. Treat it as a reason to test—not a universal savings promise.
Relative output tokens · Artificial Analysis Index
Gemini 3.5 Flash
100% baseline
Gemini 3.6 Flash
83% · 17% fewer
Google also reports up to 65% fewer output tokens on DeepSWE.
Benchmark-scoped comparisons against Gemini 3.5 Flash. Results will vary by prompt, tool use, and workload.
Run a three-lane routing test before changing your default.
Choose one real task your team repeats. Run it once through a premium model, once through a balanced model, and once through an efficient model. The winner is the lowest total cost after human correction—not the cheapest token.
Keep the prompt, tools, and source material constant.
Record quality, correction minutes, latency, and total API cost.
Route the next ten similar jobs using the winning lane, then review.
07
Receipts
Every number keeps its receipt.
Release facts link to first-party sources. Editorial interpretation is labeled separately. We do not convert vendor benchmark claims into independent rankings without a comparable evaluation record.
Source quality and publication date remain attached to every release claim.
Preview and generally available models are not treated as equivalent.
Corrections are versioned and preserved rather than silently overwritten.