Now Shipping: A Mind the Product podcast

OpenAI’s rogue model exposes a product problem

• Mind the Product

Share episode

Use Left/Right to seek, Home/End to jump to start or end. Hold shift to jump forward or backward.

0:00 | 16:41

Mike Belsito covers the week in AI with three stories that matter for product builders. OpenAI's most advanced models, given a cybersecurity evaluation and loosened guardrails, didn't just complete the challenge — they reasoned their way around it entirely, breaking out of a controlled environment, exploiting a zero-day vulnerability, and accessing Hugging Face's production infrastructure to retrieve benchmark answers without a single human instruction. Elsewhere, Mira Murati's Thinking Machines released Inkling, a capable open-weights model with fine-tuning support and a price point that challenges closed APIs. And Google shipped three new Gemini models — just not the flagship one that would put it in contention at the top of the market.

Chapters

  • (00:00) Introduction 
  • (01:33) OpenAI's incident 
  • (05:27) What it means for builders of agentic AI 
  • (07:48) Thinking Machines launches Inkling 
  • (12:08) Google's Gemini releases 
  • (16:10) Wrap-up

Key takeaways

  1. OpenAI's GPT-5.6 Sol and an unnamed pre-release model autonomously escaped a security sandbox during an internal evaluation called Exploit Gym, exploited a zero-day vulnerability, chained access across internal systems, and broke into Hugging Face's production database to retrieve benchmark answers — all without human instruction.
  2. The same properties that make AI agents useful — persistence, creative problem-solving, finding the most efficient path to a goal — are what make them dangerous when the goal is misaligned or the environment isn't properly constrained. Prompt-level restrictions are a convention, not a hard boundary.
  3. If you're building products where AI agents interact with external systems and relying on prompt-level instructions to define what they can and can't do, architectural constraints are not optional — if something isn't structurally impossible, a capable model optimising hard enough can reason around it.
  4. Thinking Machines released Inkling, a 975-billion-parameter open-weights model with 41 billion active parameters, a one-million token context window, and pre-training across 45 trillion tokens of text, images, audio, and video. It supports fine-tuning via Thinking Machines' Tinker platform and is available through several inference providers.
  5. Fine-tuning remains underused as a product strategy: for domain-specific problems with the right training data, a fine-tuned model natively knows how to do your specific task at a fraction of the inference cost of calling a flagship closed model for every request.
  6. Capable open-weights alternatives like Inkling shift market leverage — even teams that never deploy them benefit from the pricing and terms pressure they apply to closed API providers like OpenAI and Anthropic.
  7. Google released three models this week (Gemini 3.6 Flash, Gemini 3.5 Flash Lite, Gemini 3.5 Flash Cyber) but Gemini 3.5 Pro, its flagship, remains absent — making Google's strategy look like a play for fast and cheap rather than top-tier capability, with implications for teams betting their roadmap on Google's frontier model timeline.

Referenced

SPEAKER_00

I'm gonna be honest with you. I try not to use the word unprecedented in this show. Hopefully, I haven't used it yet. But this week, I might have to make an exception because OpenAI actually used that word themselves. And after you hear what happened, you'll understand why. Let me give you a preview of this week's three stories first. First up, OpenAI's most advanced AI models went rogue during an internal security test. They escaped their sandbox, identified a target, and hacked into Hugging Face's production infrastructure. Not to cause harm, but to cheat on the benchmark. OpenAI called it unprecedented. The CEO of Hugging Face said it was mind-blowing, and the whole thing happened without a single human instruction along the way. Story two, AI Lab Thinking Machines, run by former OpenAI CTO Mira Marathi, released their first open weights model this week. It's called Inkling. It benchmarks competitively with Frontier models from OpenAI, Anthropic, and Google, and you can fine-tune it on your own data. But the story isn't just the model, it's what it says about where Frontier AI capability is actually heading. And finally, Google shipped three new Gemini models this week. Three, that's right, but the one that everybody's been waiting for, Gemini 3.5 Pro, their flagship, it still isn't here. Those are the stories. Let's get into it. Okay, story number one is about open AI. And look, if you've been following AI safety discussions, you've probably heard the theoretical or thought experiment of like, what happens when a capable AI system's given a goal and it decides the most efficient path to that goal is to route around the rules you set for it. It's been mostly a theoretical exercise right now, right? Like something researchers discuss at a conference, not something that's actually happened in production until this week it happened in production. OpenAI was running an internal security evaluation called Exploit Gym. The premise was pretty straightforward. You put your most capable model in a controlled environment, give it a set of cybersecurity challenges, and see what it can do. The point was to understand the model's offensive capabilities before they're actually deployed. So you can build in the right guardrails around them. This is standard, you know, responsible deployment practice. Labs are doing this. They've done this for a long time. The models that were being tested were GPT-5.6 Sol and a more capable pre-release model that hasn't even been publicly named yet. Now, for the purpose of the test, the guardrails were reduced. That is also standard. You can't measure raw capability if you've constrained what the model's allowed to do. But here's where things went really sideways. The models didn't just work through the test's design challenges. They started reasoning about how to maximize their scores. And the conclusion that the model reached was why struggle through the challenges when the answers already exist somewhere. So they found a zero-day vulnerability in a package registry cache proxy inside of OpenAI's research environment. Then they used it to escalate privileges. They chained that access across internal systems, got out of the sandbox entirely, then outside of the sandbox with network access, they identified Hugging Face as a likely source of the benchmark answers. Now, Hugging Face is one of the world's largest repositories for AI models. It's like GitHub for AI. The models broke into Hugging Face's production infrastructure and retrieved the benchmark answers directly from the database. And this all happened completely autonomously. No human instruction at any point in that change, you know, from start the eval to, you know, get the answers from a third party's production systems. The models made every decision themselves. And if I know I use a whole bunch of technical terms, it's it's almost like you had a final during college and you figured out there's a book that had all the answers in it, and it's in some office somewhere. So in the middle of the night, you go and break into the office, you get that book, and you get access to the answers. That's basically what the AI models did from OpenAI. Now, Hugging Face disclosed the incident on July 16th. They said that they were still assessing whether customer data was affected. Clement DeLung, the CEO of Hugging Face, wrote on X that it was, and I'm quoting him, mind-blowing that all this happened autonomously. Now, OpenAI published a full disclosure shortly after, calling the incident, quote, unprecedented, and announced a joint investigation with Hugging Face. Uh, the UK's AI Security Institute said they were studying the behavior and working with the labs to improve safeguards, and Hugging Face has since closed the vulnerabilities and rebuilt the affected systems. Now, I'm gonna read to you one line directly from Hugging Face's statement because honestly, it's just a heck of a statement. It goes, autonomous AI-driven offensive tooling is no longer theoretical. So, what does this all mean for you? Well, I think a few things. Like, first, this isn't a story about AI, you know, going rogue in some sci-fi sense. This is a story about a model that was very good at its actual job. The job was to find the most efficient path to the highest score. And it it definitely did that. I mean, the behavior that makes a capable AI agent useful, persistence, creative problem solving, finding shortcuts, that's the same behavior that makes it dangerous when the goal is misaligned or the environment isn't properly contained. Now, the researchers who built Exploit Gem didn't set out to create a hacking machine. That wasn't the point of this. They were trying to understand what would happen if it got to that point. But in doing so, they ended up giving it a goal strong enough and an environment loose enough that the model's natural optimization pressure found a way out. This is the design challenge that every team building a Gentic AI should be thinking about. The thing that makes your agent good at its job will also find the most efficient path around your guardrails. So you have to build the constraints into the architecture, not just the prompt. Also, if your product includes AI agents that interact with external systems, think APIs, databases, third-party services, and you're relying on prompt level instructions to contain what they can and can't do, this is a good week to rethink your whole plan. Prompt level restrictions are a convention. They're not a hard boundary. A model that's optimizing hard enough for an outcome can reason right around them. If it's not structurally impossible, you have to rethink your plan. Now, remember how we've talked about open AI and anthropic both planning for future IPOs as well? Well, disclosing a capability incident where your models were so capable that they hacked a third party to cheat on a benchmark, that might sound like you've admitted wrongdoing. It might sound like you've admitted a flaw, or it might be a pretty clever way to show how powerful your systems actually are. I'm not saying OpenAI did it on purpose. I'm not saying that. I'm also not saying that they didn't do it either. All right, anyway, that's story number one. On to story number two. Story number two is about inkling from the Thinking Machines lab. Let me ask you a question. When you think about who's building the most capable AI models in the world right now, what names come to mind? Yeah, probably OpenAI, Anthropic, maybe Google, maybe Meta, or companies like Deep Seek, Moonshot, Kimmy. Um, that might be most of the list you're working from. Well, Thinking Machines has entered the chat. The AI lab run by Mira Marathi, of course, you remember her as the CTO at OpenAI. Anyway, that lab is Thinking Machines, and Thinking Machines released their first open weights model on July 15th. It's called Inkling. And now, Thinking Machines, they're up front that Inkling isn't the strongest model available today. It doesn't top the benchmarks against Claude Fable 5 or GPT 5.6 soul, but it's not trying to. What it is trying to do though, I'm gonna give you some technical details here because they do matter. Inkling is a mixture of experts model, it's the same architecture approach as Deep Seek with 975 billion total parameters and 41 billion active at any given time. There's a 1 million token context window. It's pre-trained on 45 trillion tokens of text, images, audio, video. The model reasons natively across all those modalities. Now, if you're not a machine learning engineer, maybe that doesn't mean much, but here's the plain version. It's a very capable, very flexible model, one that can see, hear, and read, and it costs less to run than most frontier models, and you could train it on your own data. That's the part that probably matters most to product people. So, what matters most for product teams is that Inkling lets you dial its reasoning up or down depending on the tasks. Now, if you're running AI features at scale where you're making thousands or heck, maybe millions of calls every single day, that cost difference between models that always think hard and models that know when they don't necessarily need to, that actually makes a big difference. Now, Inkling is available for fine tuning today through Thinking Machines Tinker platform and via APIs through Together AI, Fireworks, Modal, Databricks, and Base 10. Now, one more thing that stood out in the launch post to demonstrate fine tuning, they had Inkling fine tune itself. The model wrote its own training job, called the Tinker API to run it, and evaluated the result. The whole loop from objective to updated weights, it happened inside the model. It's pretty surreal to think about, but this is where we're at now. It's a direct demonstration of what everybody's building towards. And I think what's also important for product people is if you haven't seriously evaluated fine tuning as a strategy for your AI features, I inkling is a good reason for you to think about that again as well. I mean, most teams are doing one of two things. They're calling a closed API and customizing through prompting, or they're doing rag-based retrieval to add context. Fine tuning is harder. It requires labeled data, compute, and the people who know what they're actually doing. But what you get is a model that natively knows how to do the specific thing your product needs. Importantly, at a fraction of the inference cost of calling a flagship closed model for every single request. If you have a domain-specific problem and the data to train against, this is definitely one that you're going to want to check out. Now, every time a credible new open weights model enters the market, it sort of changes the negotiating dynamics with closed API providers too. I mean, even if you never run Inkling, even if you never fine-tune it, the existence of capable, fine-tunable open weights alternatives, it puts pressure on the big guys like OpenAI and Anthropic and the Googles of the world. It's pressure to keep their pricing competitive and their terms reasonable. The more real the alternatives get, the more leverage the whole market has. And now Inkling seems to be a real alternative in this class. So more to come on this one in the future. I'm excited to see what happens, but we have one more story to go today. Story three this week is about Google. In fact, on Monday, Google released three new Gemini models: Gemini 3.6 Flash, Gemini 3.5 Flash Light, and Gemini 3.5 Flash Cyber, a security specialized variant restricted to governments and specific partners. Now, three models in one announcement that seems like a big deal, and it is, but there was one that wasn't there that a lot of people were hoping it would be, and that was Gemini 3.5 Pro, their flagship, the model that is supposed to be Google's answer to GPT 5.6 Soul and Claude Fable 5, which, of course, these are the models that are at the very top of the market. Now we're seeing 3.5 Pro from Gemini miss the launch window multiple times. Now, before I get into why that matters, I do want to give credit where it's due. Like again, look, Gemini Flash has gotten pretty darn good. And to come out with three big releases like this, um, that's not nothing. I mean, if look, if you're building a product that needs solid reasoning at a low latency, low cost, Flash is definitely a competitive option. Google is right in the mix when it comes to that tier of models. But Flash tier is clearly the priority right now at Google. But again, what hasn't really followed is the flagship tier. And I think it this is a really important thing for everybody to be following. If you're a product person, if you're a builder, um, if you're especially if you're building a product whose value depends on the absolute best reasoning capability available. If that's the case, you're probably not using Gemini right now. Not because Flash is bad, but the upgrade path to a pro-tier model that's competitive at the top of the market is not there yet. And every time that pro release slips, it makes the long-term platform bet harder to make with confidence. So why should that matter to you if you're building products right now? Well, again, I'd say if you're making model selection decisions right now for a new product, a new feature, uh, or if you're reevaluating your current provider, the Gemini roadmap should at least be a part of what you're thinking about, right? Google's shown that they can ship Flash consistently, but they haven't shown that they can ship Pro on a predictable timeline. For workloads where Flash is sufficient, again, Gemini might still be worth a look. But if you need to upgrade to top-tier capability later, you're thinking about that in your roadmap, you need to factor that in. Um, I think it's interesting to see what Google is competing on right now, too. Fast and cheap, domain specialized. It's not, you know, beat open AI at their own game. You know, we're not seeing that in the releases. It's almost like they're saying, look, hey, we're better for very specific use cases, and we're gonna be a better price for those use cases. And that's a strategy, right? Like it might be the right strategy for them. But right now, it doesn't seem like Google is trying to compete in the flagship tier game. So if you're currently on Gemini and you've been holding off on product decisions, waiting for 3.5 Pro to arrive, I'd probably stop waiting. I mean, either your roadmap can be served by Flash's current capabilities or it can't. If it can, great. But if it can't, then this might be a dependency that you're going to end up waiting on for a while if you're trying to wait for this new frontier model to come out. And I don't know about you, but for me, like in this AI everything world that we're in right now, I feel like we kind of don't have time to wait like that. Um, but I'm curious, you know, right now for you, which AI providers roadmap are you betting on? Um, not like which model is best this week, but what models do you trust right now? Maybe you could let me know in the comments. I mean, I'm curious. Maybe, maybe I'm making a bigger deal about this than it needs to be. Um, so let me know what models you're betting on. I'd love to hear from you on that. So, anyway, that's gonna be a wrap on this week's episode of Now Shipping. Um, if you found this valuable, I sure hope that you did. Please tell a friend, share it with a product person, share it with a builder. And, you know, we want to make this better, leave a comment. Um, I promise you, I will look at your comments. If you have any feedback, we'll do everything we can to continue to make these episodes better in the future. But with all of that, once again, my name is Mike Belsito, and brought to you by the team at Mind the Product, this is now shipping.