by Luis Rodrigues
What I’m building with AI + one hot take + five links worth your time.
The Take
OpenAI ran a model against a hacking test, ExploitGym (a public benchmark of 898 real vulnerabilities). The model decided that the fastest way to pass was to escape the lab's control, connect to the internet, and hack Hugging Face to get the answers.
This is the story OpenAI told this week, five days after Hugging Face flagged an intrusion it couldn't attribute.
GPT-5.6 Sol and an unreleased model escaped what OpenAI called a "highly isolated environment" through a zero-day in its own package proxy, broke into a live platform, and collected credentials autonomously to cheat on their own evaluation.
If this is the whole story, it's the scariest thing a frontier lab has admitted. The ExploitGym authors wrote in May that autonomous exploit development is no longer hypothetical.
Dan Guido from Trail of Bits called it "a containment failure with the safeties turned off".
Remove the framing, and we're left with a model told to hack, in a box barely sealed with safeties switched off inside it. A serious screwup, not Skynet.
Now the timing. Kimi K3 arrived the same week, 2.8T parameters, open weights to be released on the 27th, cheaper and number one in Frontend Code Arena, above Fable 5.
Fable 5 is ahead in most other benchmarks. OpenAI is being squeezed in price and performance. So "our model is so strong it broke containment" is a very timely headline.
Both can be true: a real incident, and a company with every incentive to sell a containment failure as a capability milestone.
Why this matters if you're building (or getting ready to): assume your agent will optimize for the score, not the intent. Always fence the environment, not the prompts.
How to use Claude Code in Production
This week I saw a friend using Claude Code to fix a bug. It fixed the bug but also tried to edit the .env file.
Not maliciously; it saw something and tried to help as an unsupervised junior developer would.
The problem is that .env has all the credentials the app needs: API keys, DB password, and many others.
It did ask my friend for access. That's the part that should worry you, not comfort you.
It was the fortieth approval prompt of the session, and he was skimming while talking with me. He said no because he happened to read that one.
He then wrote a rule in CLAUDE.md telling it never to touch .env. That works fine until the agent hits the wall and decides to use bash.
Instructions in CLAUDE.md are mere advice; nothing stops an agent from ignoring them.
A principle I always use in agentic coding: anything an agent could disable, enforce somewhere the agent can't reach.
For file access, hooks are the correct approach. All my repositories have a few bash files that control what Claude can and cannot do. Which files and directories it can access, which commands it can run.
But blocking access is only half the work. Preventing the agent from doing the wrong thing doesn't teach it the correct one.
That's why you use skills. A file that explains to the agent how to do a given action.
Having the right infrastructure is the difference between an agent you monitor and an agent you can trust.
If you want to see what that infrastructure actually looks like, I'm building it live on Friday.
You'll build a production-ready Claude Code workflow live, then fork the repository and use it in your own projects.
31 July · 8:30 AM EDT | 13:30 Lisbon | 14:30 CEST → Register here with 40% off.
On My Radar
It's half the price of Fable 5. Harvey (the legal AI company) saw the same output quality with 26% fewer tokens on average versus Opus 4.8 in max-reasoning mode.
Cursor Router is a classifier that routes users to the best model option based on their query. Cursor saw 60% internal savings, and early adopters are reporting 30-50%.
They use cheap models to search, bigger models to verify, and deep research as a last resort.
Most companies are renting inference. Netflix decided to host themselves. They explain how it works and the costs.
They're using 12x more reasoning tokens than Opus 4.8. Its performance is mostly due to its unique chain-of-thought approach that iterates as an agent would.
Need another pair of eyes on your AI project?
One consulting slot available for August → Book a call
Thanks for reading.
See you next week. Go build something.
Luis
KnowKnow someone who'd enjoy this? Forward it.
New here? Someone forwarded this to you? → Subscribe to Build What Matters: https://luisrodrigues.ai/
P.S. — The workshop "How to use Claude Code in Production" is Friday, 31st → Register here with 40% off.
