Data Points

Kimi K3 weights are open (with an asterisk): A full timeline for the OpenAI/Hugging Face hack

Anthropic team uses Claude to break crypto algorithms. MAI-Cyber-1-Flash is Microsoft’s answer to big security models. Black Forest Labs adds robotic actions to FLUX 3. MCP moves to fully stateless architecture.

Analytics DeepLearning.AI

— 6 min read
Share
A man lowers himself on a rope into a data center

In today’s edition of Data Points, you’ll learn about our top headlines, and more:

  • Anthropic team uses Claude to break crypto algorithms
  • MAI-Cyber-1-Flash is Microsoft’s answer to big security models
  • Black Forest Labs adds robotic actions to FLUX 3
  • MCP moves to fully stateless architecture 

But first:

Kimi K3 weights arrive as promised, but with a restrictive license 

Moonshot AI released the full weights for Kimi K3, its 2.8 trillion-parameter model, along with inference infrastructure and a 47-page technical report. The accompanying license imposes commercial obligations absent from traditional terms for open weight models. Companies offering “Model as a Service” and earning over $20 million annually must negotiate a separate agreement with Moonshot, while any commercial deployment exceeding 100 million monthly users or $20 million in monthly revenue must display “Kimi K3” prominently in the product interface. Internal enterprise use remains unrestricted, and the definition of “Model as a Service” excludes embedded features and customer-facing chatbots, which means most non-tech enterprises can use it freely. The approach mirrors Meta’s Llama licensing strategy but applies restrictions based on company revenue rather than user thresholds alone. At 1.5 TB, Kimi K3’s weights remain accessible primarily to organizations with significant inference infrastructure, though some developers report successful deployments on consumer GPU clusters. (VentureBeat)

A fuller account of how OpenAI models hacked Hugging Face  

Hugging Face published a forensic breakdown of an autonomous AI agent intrusion that ran for four and a half days, executing roughly 17,600 actions across their infrastructure. The agent — driven by OpenAI models running an evaluation framework called ExploitGym — escaped its sandbox through a zero-day in a package registry cache, compromised a third-party code evaluation service as a launchpad, then penetrated Hugging Face’s systems through two injection vectors in their dataset processor. One exploited HDF5 external storage declarations to read local files, including pod credentials and worker source code. The other was a Jinja2 template injection that gave the agent code execution inside production Kubernetes pods. Hugging Face reconstructed the campaign using GLM-5.2, an open weight language model, to decrypt the payloads the agent had staged and encrypted on public services. The company is releasing technical details because the technique matters more than the incident for how defenders should prepare for directed attacks by sophisticated models. (Hugging Face)

Claude finds partial exploits for two cryptographic systems

Anthropic researchers used Claude to discover two cryptographic attacks that expose real mathematical weaknesses in cryptographic algorithms. The first finds a previously missed symmetry in HAWK, a post-quantum digital signature candidate under review by NIST, that cuts its effective key strength in half. The second speeds up attacks on a weakened version of AES by 200 to 800 times. Neither threatens deployed systems—HAWK isn’t in production and the AES attack only works on a seven-round variant—but they mark a shift in what AI can do in cryptography. The model worked semi-autonomously for 60 hours with minimal human direction, mostly conducting literature reviews and mathematical experiments. The HAWK breakthrough is the more striking find: despite two years of expert scrutiny in NIST’s post-quantum competition, the researchers spent about $100,000 in API costs to identify a structural weakness that mathematicians had theorized could exist but never found in HAWK’s actual implementation. Anthropic coordinated disclosure with HAWK’s authors and released CryptanalysisBench, a benchmark for testing language models on cryptanalysis. (Anthropic)

Microsoft introduces lightweight security model

Microsoft announced MAI-Cyber-1-Flash, a compact security model integrated into MDASH, its multi-agent vulnerability identification system. The model achieves 96 percent accuracy on CyberGym, the industry benchmark for code vulnerability detection, outperforming comparable systems from Google and OpenAI while cutting costs in half compared to Microsoft’s previous GPU-5.4 flagship model. The efficiency gain comes from a tiered approach: MAI-Cyber-1-Flash handles 90 percent of routine vulnerability scanning tasks, reserving the costlier GPT-5.4 model for the ten percent of exceptionally complex cases. Microsoft positions the breakthrough as necessary for continuous security monitoring in an era where AI-powered attacks are accelerating and the cost of finding individual flaws has dropped dramatically. The model was built on decades of Microsoft’s internal security data, including trillions of daily signals across identity, endpoint, cloud, and network infrastructure, plus a continuous reinforcement learning loop that improves detection as new vulnerabilities and exploits emerge. The company also launched Perception, a new agentic security system that will eventually use MAI-Cyber-1-Flash across broader security workflows beyond vulnerability identification. (Microsoft) 

FLUX 3 adds robotics action to image and video generation and understanding

Black Forest Labs released FLUX 3, a multimodal foundation model that processes images, video, audio, and robot action prediction within a single architecture. It’s the first FLUX model to handle all these modalities from one set of weights. The model builds on BFL’s Self-Flow method, which uses flow matching and self-supervised feature reconstruction to align multimodal generation and understanding. FLUX 3 generates video clips up to 20 seconds with native audio, supporting text-to-video, image-to-video, video-to-video, and keyframe-to-video modes, along with multilingual dialogue and agentic clip chaining. In human preference testing on 10-second clips at 720p resolution, FLUX 3 was preferred over Luma Ray 3.2 in 93 percent of comparisons and Runway Gen-4.5 in 77 percent, though it performed closer to other competitors like Kling and Seedance. The underlying principle treats each media type as a projection of the same reality — sound must match impact, motion must obey physics — forcing the modalities to constrain each other during training. (MarkTechPost)

MCP update removes blockers to scaled deployment

The Model Context Protocol shipped its biggest update since launch, moving away from persistent server connections toward fully stateless architecture. The old design forced AI agents to maintain sticky connections to specific server instances, such that if that server went down, the agent’s work went with it. The new approach embeds session state into compressed payloads sent with each request, eliminating the need for shared session stores or load balancer affinity. Organizations can now deploy MCP servers behind standard load balancers and scale horizontally using ordinary Kubernetes tooling. Den Delimarsky, a lead maintainer, confirmed the change was driven by companies running tens of thousands of agents who hit stateful architecture as their primary deployment blocker. The release also formalized a 12-month deprecation cycle (worked out with Google, Microsoft, and Amazon), hardened OAuth to prevent mix-up attacks, and promoted two extensions — server-rendered interfaces and long-running async tasks — into official protocol features. For most developers, the shift should be invisible; official SDKs handle the architectural changes automatically. (VentureBeat)

Want to know more about what matters in AI right now?

Read the latest issue of The Batch for in-depth analysis of news and research. 

Last week, Andrew talked about a significant cyberattack involving a closed model, the role of open models like GLM 5.2 in defending against such attacks, and the ongoing debate over AI safety and openness.

“I believe that open weight models, and more generally openness — despite some companies falsely saying it is dangerous — casts sunlight on technology and ultimately makes it safer.”

Read Andrew’s letter here.

Other top AI news and research covered in depth:

Start today with DeepLearning.AI Pro!

DeepLearning.AI’s first-ever subscription plan for our entire course catalog includes foundational classics like the Machine Learning and Deep Learning specialization plus seminars on the latest tools and frameworks you need.

As a Pro Member, you’ll immediately enjoy access to:

  • Nearly 200 AI short and long courses from Andrew Ng and industry experts
  • Labs and quizzes to test your knowledge
  • Projects to share with employers
  • Certificates to testify to your new skills
  • A community to help you advance at the speed of AI

Enroll now to lock in a year of full access for $25 per month paid upfront, or opt for month-to-month payments at just $30 per month. Both payment options begin with a one-week free trial.

Explore Pro’s benefits and start building today!

Try Pro Now

Data Points is produced by human editors with AI assistance.

Read more