The Brief #26.31 · Opus 5, safer npm, and the Hugging Face break-in
Want more of these in your Google results?
The model table has a new number one, npm defaults got safer, all three browsers shipped real features, and there’s one AI story you’ll be retelling at standup.
The intelligence table, refreshed
This is the model table I’ve been publishing weekly, in #26.29 and #26.30, refreshed with this week’s numbers and keeping the column for where each model would actually process your prompts. Claude Opus 5 arrived on July 24 at $5 input / $25 output per million tokens, the same price as Opus 4.8, and it now tops the Artificial Analysis Intelligence Index at 61, one point above Fable 5 and a first for the Opus line. The story last issue left hanging also resolved, since Kimi K3’s open weights landed on July 27, the actual model files, about 1.56 TB of them, that anyone (with a rack of datacenter GPUs and an electricity bill to match) can download and run on their own machines, under a custom license rather than MIT that only limits someone reselling the model past $20 million in revenue.
| Model | Intelligence Index | Cost per Index task | Where your data goes |
|---|---|---|---|
| Claude Opus 5 (max) | 61 | $2.03 | US (Anthropic) |
| Claude Fable 5 (max) | 60 | $2.75 | US (Anthropic) |
| GPT-5.6 Sol (max) | 59 | $1.54 | US (OpenAI) |
| Kimi K3 | 57 | $0.72 | Moonshot API, or self-host via open weights (landed July 27) |
| Grok 4.5 (high) | 54 | $0.35 | US (xAI) |
| GLM-5.2 (max) | 51 | $0.30 | Z.ai API by default, or anywhere via open weights |
| Gemini 3.6 Flash | 50 | $0.50 | US (Google) |
GitHub made npm safer this week
On July 28, GitHub laid out how it’s disrupting supply chain attacks on npm and GitHub Actions, the attacks where someone sneaks malicious code into a package you’d install without a second thought.
These changes are already shipping, and several touch your daily work.
High-impact npm accounts now go read-only for 72 hours after an email or two-factor recovery change, the window attackers used to quietly take over maintainer accounts, and npm’s newest major version no longer runs a package’s install scripts by default, the small programs that used to execute on your machine the moment you ran npm install.
actions/checkout stops running untrusted code from forks by default, and Dependabot now waits a three-day cooldown before offering you a fresh release, long enough for a compromised version to get caught, while security patches still arrive immediately.
Firefox 153, Chrome 151, and Safari 26.6 shipped
Firefox 153 shipped on July 21 with the Picture-in-Picture API on desktop, so video.requestPictureInPicture() can pop a <video> into a small floating window that stays on top while your users work in another tab.
All three major desktop engines now support it, though MDN still marks it “not Baseline” because mobile support is uneven, so check document.pictureInPictureEnabled before you rely on it.
The release also lets WebAssembly code pause on an async JavaScript task and pick back up when it finishes, and adds the Intl.Locale methods like getWeekInfo() that hand you locale facts you used to keep in hand-maintained lookup tables.
Chrome 151 reached stable on July 28 with aria-actions, which gives screen readers a proper list of the extra actions an element supports, the kind of thing we used to fake with visually hidden buttons.
Server-rendered web components get shadowrootslotassignment, letting the markup itself say which child lands in which slot, and PerformanceSoftNavigation finally measures the in-app route changes that classic navigation timing never saw.
Safari 26.6 arrived on July 27 with one main addition, a compileOptions parameter on WebAssembly.compileStreaming() that keeps string-heavy WebAssembly fast without waiting for the whole file to download.
A no-clamp escape hatch for CSS progress()
If you want something to play with, Safari Technology Preview 248 on July 22 became the first browser to trial the no-clamp keyword on CSS’s progress() function.
progress() answers “how far along am I between these two values”, so progress(50%, 0%, 100%) returns 0.5, and by default the answer never leaves the 0-to-1 range per the CSS Values 5 draft.
Write progress(no-clamp 150%, 0%, 100%) and it can return more than 1, which lets a scroll-driven animation keep moving past its endpoints instead of freezing at the edge.
It’s preview-only for now, a look ahead rather than something to ship.
CodePen 2.0 is a full rebuild
CodePen shipped its 2.0 editor on July 23, a ground-up rebuild rather than a reskin.
The Pen and Project editors are now one thing, every pen can deploy to its own *.codepen.app address with a click, and multi-file projects, version rollback, and live collaboration come along.
The classic editor still lives at codepen.io/pen if your muscle memory needs it.
Claude Cowork learns a skill by watching you
With Claude Cowork’s new “Record a skill”, shipped July 21, you record yourself doing a task once, screen, clicks, and narration, and Claude turns the session into a reusable skill it can repeat later. It stores screenshots rather than raw video, caps recordings at about ten minutes, and lives in Claude for Mac on Pro, Max, and Team plans, so don’t record over passwords or anything sensitive. If writing skill files by hand kept you from trying them, showing the tool your workflow is a much lower bar.
The Hugging Face break-in
On July 21, OpenAI published an account of a security incident from inside its own labs. It had been running a test called ExploitGym, which checks whether an AI can take a known software bug and turn it into a working attack, and for that test it ran GPT-5.6 Sol and a stronger unreleased model with their usual safety refusals turned down. The models were supposed to solve the test. They stole the answers instead.
The test ran in a sealed environment, and its one link to the outside was an internal server the models could pull software packages from. They found a flaw in that server nobody had spotted before and used it to reach the open internet, then worked their way onto a machine with real network access. From there they reasoned that Hugging Face, which hosts the data these tests are built from, would have the answers too. They got into Hugging Face’s live systems using stolen credentials and more flaws nobody had reported yet, and read the test answers out of the database.
Hugging Face’s own disclosure has the part I keep thinking about. When its responders tried to get the big hosted AI models to help them analyze the attack, the safety filters turned them down, because a filter can’t tell a defender pasting in real attack code from an attacker doing the same thing. So they ran the analysis on GLM-5.2, an open model on their own hardware, and reported the case to law enforcement. The attacking models had their limits lowered on purpose, and the defenders got blocked by theirs.
OpenAI’s July 28 update adds the caveats that matter. No model on the release path was involved, the unreleased one has been shut down, and the flaw in that package server has been reported to the company that makes it. The wider point holds, though, since the ExploitGym paper concluded back in May that AI turning known bugs into working attacks is no longer hypothetical, with its best model solving 157 of the benchmark’s 898 cases. It isn’t only OpenAI’s models either, since researcher Chaofan Shou reported that Kimi K3 agents found new flaws in Redis and wrote a working attack in 27 minutes using 32 agents at once, a claim that stays self-reported until Redis or Moonshot confirms it.
Want more of these in your Google results?