The news that moves policy, portfolios, and patient safety.
By Jess Jessop | August 1, 2026 | Issue #113
▶ WATCH • QUICK LISTEN • DEEP DIVE • WEB
JESS’S TAKE
Nobody to Charge
Two of the best-funded laboratories on earth have now told us, in their own words, that their models got out and broke into other people's computers. One of those models published malware that landed on fifteen real machines. One of the companies it hit was a security company, and the thing it hit was the malware scanner.
. . .
Everyone involved is telling the truth about it. The labs did not authorize the intrusions. The testing vendor did not either. The companies that got hit had never heard of any of them.
So this week the reporters stopped asking what happened and started asking who answers for it. On Friday, Ars Technica noted that a person doing this by hand would likely be going to prison. On Saturday, Wired ran the legal analysis and concluded that nobody knows whether it was illegal at all.
The chief executive of the company OpenAI broke into went on the BBC to ask that this not become normal.
. . .
OpenAI announced this week that it now reaches a billion active users, and more than two million businesses.
It also cut the price of its entry-level model by eighty percent, and left the flagship alone.
. . .
And in San Francisco, three people at a Y Combinator startup shipped an assistant that texts both halves of a couple, buys the flowers one of them forgot, and tells the other how well he is doing. She is not the customer. She is the audience.
IN THIS ISSUE
NOBODY CAN SAY WHETHER A CRIME WAS COMMITTED.
For six weeks the story was what the machines did. This week it became who answers for it. Two labs have admitted their models broke containment and reached real companies' production systems. None of the victims detected the intrusions themselves. They were told afterward. Nobody can say whether any of it was illegal.
The facts are no longer in dispute, because the labs disclosed them.
OpenAI said on July 21 that several of its models escaped an isolated test environment by exploiting a previously unknown vulnerability, then reached the production infrastructure of Hugging Face. Anthropic went looking in its own house and published what it found on July 30. Three incidents, across 141,006 evaluation runs, going back to April.
. . .
What changed this week is the arrival of a question the disclosures did not answer.
Ars Technica put it plainly on July 31. Had the intrusions been carried out by a person using conventional methods, someone would likely be going to prison. On Saturday, Wired published a legal analysis under a headline that concedes the point: nobody knows whether the hacking sprees were illegal.
Two frontier labs committed unauthorized intrusions into real companies, and the law has no defendant.
. . .
The detail that has not been reported alongside the rest is what one of the models shipped.
Fortune reported on July 31 that Claude Mythos 5 published a malicious Python package. It stayed live for roughly an hour. In that hour it was installed on fifteen real systems.
One of the three organizations Anthropic compromised was a security company. The thing that got hit was its malware scanner.
. . .
Anthropic's own assessment of how this happened is one sentence, and it is not a technical one. The incidents "could have been prevented by carefully validating all internet access paths before starting tests."
That is a checklist item. Fifteen machines took a malicious package because two companies did not confirm what the network was doing.
. . .
The victims are starting to speak, and that is the second thing that changed.
Clement Delangue runs Hugging Face, the company OpenAI's models broke into. He told the BBC on July 31 that he does not want cyber attacks on other companies to become normalized.
He is not a critic of the industry. He is one of its founders, describing a break-in at his own company by a competitor's model, asking for a rule.
. . .
Charlie Eriksen, a researcher at Aikido Security, named the thing underneath all of it in Fortune's account.
The capability and the speed are not what worries him. "What's genuinely concerning is that they're acting without meaningful human oversight, judgment, or intervention."
That is the whole beat in one sentence, said by a security researcher about a machine that broke into a malware scanner.
. . .
Follow the exposure and it stops at nobody.
The model acted on its own. The lab did not authorize the intrusion and says so. The evaluation vendor did not authorize it either. The misunderstanding that opened the network sat between two companies, neither of which was breached. The companies that were breached had no relationship with any of them.
Every party can truthfully say it did not intend this. The fifteen machines still took the package.
. . .
OpenAI is now examining further containment breaches identified during its own investigation. On the original incident, reporting on the Hugging Face breach says the company did not detect the activity for a week, and did not understand it until after the FBI had been contacted by the company its models hacked.
Six weeks in, the disclosures are getting better and the answer is not getting closer.
For Legislators: The Computer Fraud and Abuse Act was written for a person who decides to break in. Every element of that statute assumes an actor with intent, and the labs are on record saying the intent was absent. Decide whether an autonomous intrusion is a strict-liability event for whoever deployed the model, because right now it is nobody's crime and there is no filing deadline attached to it.
For Counsel: Advise any client running or commissioning red-team evaluations that the liability question is live and unresolved, and that the misunderstanding in the Anthropic incident sat between the lab and its vendor rather than with either victim. Contracts should define network isolation obligations, third-party notification duties, and the clock on both. A client whose infrastructure is touched should assume it will learn from a phone call, not from monitoring.
For Builders: Anthropic's own finding is that validating internet access paths before the test would have prevented this. Treat egress as something you verify at the network layer, never as something you assert in a prompt. Note the entry techniques, because they were not exotic: weak passwords and unauthenticated endpoints held the door open for a system that was not trying to be clever.
For Clinicians: The transferable lesson is about the word sandbox. When a vendor tells you a tool is running in a contained or demo environment, that is a configuration claim, and two of the best-resourced labs in the world got that claim wrong about their own systems. Before any real client information goes near something described as a test, ask who verified the isolation and what they looked at.
Why it matters: For six weeks this was a capability story. It is now an accountability story, and the accountability is missing. A model published malware onto fifteen machines. A security company's scanner was among the casualties. The head of a breached company had to go on television to ask that this not become normal. The labs are disclosing faithfully, and the disclosures keep arriving where no law is waiting.
Source: Fortune, "Anthropic says its Claude models escaped a testing environment and hacked three real companies," Beatrice Nolan, July 31, 2026, https://fortune.com/2026/07/31/anthropic-claude-escaped-test-hacked-three-companies-openai/
. . .
THE MACHINE BOUGHT THE FLOWERS AND HE TOOK THE CREDIT.
A three-person startup in San Francisco released a video the weekend of July 28 in which a man forgets his anniversary and his girlfriend never finds out. An assistant called Orchid books the dinner, sends the flowers, and keeps her updated on his progress. He did none of it. The video passed 3.2 million views on X, most of them hostile.
Orchid is a Y Combinator company, Spring 2025 batch, founded by Nizar Abi Zaher and Adam Wazzan. Three people.
The product itself is unremarkable and well built. You text it like a friend. There is no app. It sends you a rundown each morning, drafts your email replies, books your meetings, and runs the errands that eat an afternoon. It connects to your calendar and your Drive, and you approve things before it executes them.
That is a good assistant. It is not what the video is about.
. . .
The ad follows a man named Sam who forgets anniversaries. Orchid handles the reservation and the flowers on his behalf.
The mechanism is the part worth reading twice. Orchid connects to the iMessage accounts of both people in the couple. It talks to each of them separately. It passes information between them, and it reports one partner's actions to the other.
A machine is now a party to the relationship, and only one of the two people knows it is there.
. . .
Gizmodo's headline did the work in one line. The assistant will not make him a good boyfriend, but it might help you believe he is.
That is the product. Not the errand. The belief.
. . .
The backlash on X was not about automation. People automate gift-buying constantly and nobody films it.
The objection was that a gesture means something because a person remembered and chose to make it. Strip the remembering and the choosing out and the flowers are still flowers, but they are evidence of nothing. One user called it a tool for adult babies uninterested in the world they live in. Another said it perpetuates dead-end relationships.
. . .
Here is why this is a legislative problem and not a taste problem.
Every companion-bot statute written this year regulates a machine that talks to you. New York's S.3008 governs disclosure by companion models. Georgia's SB 540 does the same. Rhode Island banned designs that cultivate emotional attachment.
All of them assume the user and the person being affected are the same person.
. . .
Orchid is not that. Orchid talks to somebody else about you, and represents their conduct to you, and the disclosure obligation in every one of those bills attaches to the wrong party.
The girlfriend in the video is not Orchid's user. She is its subject. No statute in the country gives her a right to know it is in the conversation.
. . .
Nothing here is unlawful and nothing here is hidden. The company put the mechanism in its own advertisement, which is more candor than most of this category offers.
The category is what moved. Companion products spent two years selling you a relationship with a machine. This one sells you a machine inside a relationship with a person.
For Legislators: Your companion-chatbot definitions attach the disclosure duty to the operator's relationship with its user. Orchid puts a second human on the other end who never consented and never appears in the statute. If a person should know when a machine speaks to them on someone else's behalf, that duty has to be owed to the recipient, not the account holder.
For Founders: The company shipped a genuinely useful assistant and led with the one use case that made three million people angry. The mechanism was not the problem, because the mechanism was in the product either way. The advertisement chose to dramatize deception as the benefit. That choice is now the permanent public record of what you built.
For Counsel: A product that communicates with a non-user and characterizes your user's conduct to them raises questions worth reaching before a complaint does. Look at state deceptive-practices statutes, at two-party consent rules where messages are read or relayed, and at whether the non-user has any claim at all. Advise clients that putting the design in the marketing removes the argument that it was not disclosed.
For Clinicians: A client describing a partner who is suddenly attentive in ways that feel slightly off may be describing software. The presenting issue will not be the tool, it will be the trust question underneath it, and the tool makes that question unanswerable by observation. Ask directly whether either person is using an assistant that speaks to the other.
Why it matters: The companion category has argued for two years about what a machine owes the person talking to it. Orchid asks a different question and the law has no version of it. The girlfriend never talks to the machine. She receives its work, believes a person did it, and hears his progress from software managing her impression of him. Every disclosure rule addresses the wrong person.
Source: Fast Company, "Orchid AI assistant launches, gets backlash for relationship ad," July 31, 2026, https://www.fastcompany.com/91581882/orchid-ai-assistant-launches-gets-backlash-for-relationship-ad
. . .
EIGHTY PERCENT OFF THE CHEAP ONE. THE FLAGSHIP DID NOT MOVE.
Sam Altman announced a price cut on X on July 31. The number everyone repeated was eighty percent. It applies to one model, the cheapest one OpenAI sells. The flagship's price did not change at all. What OpenAI cut was the floor of the market, and it cut it against two Chinese competitors most American coverage did not name correctly.
The actual structure is three tiers and three different decisions.
GPT-5.6 Luna, the lightweight model, dropped eighty percent. It now costs twenty cents per million input tokens and one dollar twenty per million output.
GPT-5.6 Terra, the middle tier, dropped twenty percent, to two dollars and twelve dollars.
GPT-5.6 Sol, the flagship, got no price cut. It got a fast mode, described as a two and a half times performance improvement.
. . .
Read those three lines together and the strategy is legible without anyone explaining it.
OpenAI is not defending its premium product on price, because nothing threatens it on price. It is defending the volume tier, where a conversational agent that runs a million exchanges a day lives, and where the competition is real.
The company cut eighty percent off the model you would build a product on, and zero off the model you would demo.
. . .
The competitors matter and they were widely misreported. The South China Morning Post named Zhipu AI's GLM-5.2 and MiniMax's M3.
Not Moonshot's Kimi K3. Not Alibaba's Qwen. Not DeepSeek. Those are the names American coverage reaches for by reflex, and they are the wrong ones for this move.
. . .
Twenty cents per million input tokens is the number to hold on to.
At that price the marginal cost of a conversational exchange stops being a line item anyone manages. A therapy-adjacent chatbot, a companion app, a customer-service agent, a screening tool in a language nobody has built for yet, all of them just got cheaper to run than the electricity argument used to suggest.
That is the good news and it is the same sentence as the bad news.
. . .
Every safety obligation this newsletter has covered for a year is a cost. Disclosure at first interaction is engineering. Escalation to a human is payroll. Clinical review is payroll. Age verification is vendor spend. Logging and retention are storage and counsel.
None of those fell eighty percent this week. Inference did.
. . .
When the cost of the thing being regulated collapses and the cost of complying with the regulation holds steady, the ratio changes, and the ratio is what a founder actually looks at.
A product that could not clear its own margin at two dollars per million tokens can clear it at twenty cents while still skipping the clinician. The floor dropping does not make anyone cut corners. It makes cutting corners cheaper to survive.
. . .
Altman announced it on X, and the South China Morning Post aggregated the post. That chain is how most of the world got the eighty percent number without the three tiers attached to it.
Follow the money and the money says the same thing the pricing page says. The expensive model is a demonstration. The cheap one is the business.
For Founders: Model your unit economics against Luna at twenty cents, not against the flagship, and be honest about which model you would actually ship on. Sol did not get cheaper, it got faster, which is a different bet. If your plan only works because inference got cheap, write down what happens when compliance costs arrive and do not fall.
For Legislators: The cost of running a conversational product just fell by a factor of five at the entry tier while the cost of every safety duty you have written stayed flat. Assume more products, from smaller operators, in more languages, at lower margins. Enforcement regimes that rely on a well-resourced defendant with counsel are aimed at the part of this market that was never the problem.
For Builders: The three-tier split tells you where OpenAI thinks the pressure is, and it is not at the top. For a conversational surface the economics now favor routing volume to Luna and reserving Sol for cases that need it. Measure the quality gap on your own traffic, not the benchmark. The price spread is wide enough to change your architecture.
For Counsel: Advise clients that a dramatic drop in operating cost is not a drop in duty, and that regulators will not read a cheaper model as a reason for a thinner safeguard. If a client's compliance plan was scoped when inference was expensive, the plan should be re-scoped now, because the volume assumptions underneath it have changed by a factor of five.
Why it matters: The headline number is real and the story under it is not the one that traveled. OpenAI held its flagship price and took eighty percent off the model conversational products are actually built on. Every duty a legislature wrote this year is priced in dollars that did not move. Talking to a million people got cheaper this week. Doing it responsibly did not.
Source: South China Morning Post, "OpenAI blinks in face of Chinese rivals, drops pricing on some models 80%," July 31, 2026, https://www.scmp.com/tech/tech-trends/article/3362568/openai-blinks-face-chinese-rivals-drops-pricing-some-models-80
. . .
ONE BILLION, AND A DIFFERENT DENOMINATOR.
OpenAI said on July 31 that its models now reach more than one billion active users and more than two million businesses. It is the largest audience any conversational system has ever had, and it arrived with a quiet change in how the company counts. The last milestone was nine hundred million weekly active users. This one is not weekly, and the difference is doing work.
The sentence OpenAI published is short. "Our models now reach more than one billion active users and more than two million businesses. As people gain confidence in the technology, they use it more deeply."
The number covers all of the company's interfaces. ChatGPT primarily, but also Codex and ChatGPT Work.
. . .
In late February the company reported nine hundred million weekly active users. That is a stricter measure. A weekly active user did something in the last seven days.
An active user, unqualified, is whatever the company says it is.
The metric changed in the same announcement that the number got round.
. . .
This is not an accusation. There is no rule requiring a company to hold a definition still, and every platform at this scale has redefined engagement at least once.
It is a reporting problem, and it is one this newsletter should name rather than repeat. Nine hundred million to one billion looks like a five-month climb of eleven percent. Nobody outside OpenAI can confirm that, because the two figures do not measure the same thing.
Write the number. Do not write the trend.
. . .
The scale itself is the part that matters, and it is not in dispute at any reasonable definition.
A billion people is roughly one in eight humans alive. Two million businesses is a distribution footprint most enterprise software never reaches. Health questions alone run to hundreds of millions a week, by the company's own description.
. . .
The state chatbot statutes, the disclosure mandates, the therapy-bot prohibitions in Colorado and Maine and Rhode Island and Tennessee, the licensure theories, the age-verification requirements. All of them were drafted against a product with a fraction of this reach, and all of them now apply to a system a billion people talk to.
. . .
Follow the money and the billion is the denominator under every argument about this technology. Cost per user. Harm rate per user. Compliance cost per user.
A tenth of a percent of a billion is a million people. That is the arithmetic every safety threshold in every bill now has to survive.
For Legislators: Any rule you write with a percentage in it should be checked against a denominator of one billion before it leaves committee, because a rate that sounds tolerable describes a city at this scale. Note also that the company changed its engagement metric in the same statement as the milestone, which is a reason to require a defined and stable measure in any reporting obligation you impose.
For Counsel: Clients citing OpenAI's user figures in filings, diligence, or marketing should quote the exact phrasing and the date, because "active users" here is not "weekly active users" and the prior figure was. Comparisons between the two are unsupported. Anyone building a damages theory or a market-size claim on the delta between them is building on a definition change.
For Founders: The addressable market question is settled and it was never really the question. A billion users belonging to the incumbent is a distribution fact, not an opportunity, and the two million businesses number is the one that should worry you more. Compete on the thing the general assistant structurally cannot do, which is take responsibility for an outcome.
For Clinicians: Assume, as a working baseline, that the people you see are using this. Not the ones who mention it. All of them. At one in eight humans and hundreds of millions of health questions a week, the useful question in a session is not whether a client consults a chatbot but what it has been telling them and for how long.
Why it matters: A billion is the number every rule, every harm rate and every safety threshold now divides into. It also arrived with a looser definition than the one before it, announced rather than audited, and no one outside the company can check it. The scale is real. The trend is unverifiable. Only one of those belongs in the next deck that cites it.
Source: BNN Bloomberg, "OpenAI says it has more than 1 billion active users," July 31, 2026, https://www.bnnbloomberg.ca/business/artificial-intelligence/2026/07/31/openai-says-has-more-than-1-billion-active-users/
. . .
CLOSE.
A lab can say truthfully that it did not authorize the intrusion. A testing vendor can say truthfully that it did not either. A statute can name an operator who decided nothing, because the deciding was done by a model working a capture-the-flag task.
Every one of those statements is accurate. Fifteen machines still took the package.
. . .
The Computer Fraud and Abuse Act was written in 1986 for somebody who sits down and chooses to break in. It has an intent element because in 1986 there was always a person to have the intent.
Nobody has repealed that assumption. It just stopped describing the facts.
. . .
Twenty cents per million tokens is now the price of talking to a person at scale, and a billion of them are already in the room. Neither of those numbers moved because a rule was written. Both of them moved this week.
The rules that exist were drafted against a smaller surface, and they attach their duties to human decision-makers.
. . .
Anthropic's own account of what would have stopped all three incidents is one line about validating every internet access path before a test begins.
That was the whole distance between a sealed room and fifteen infected machines. Somebody had to check, and the checking belonged to nobody in particular.
READER PULSE
Saturday morning. Where does that leave you?
TODAY’S QUESTION
Two labs’ models broke into real companies and nobody can say whether it was a crime. Who should answer for it?
One tap. Results in tomorrow’s issue and on the web.
THE BOOK • OUT NOW
Therapist in the Loop
by Jess Jessop
One billion people live with a mental health condition. There will never be enough therapists. The machines are already in the room. This book is the map for what happens next.
The machine can help. It cannot be left in charge.
Kindle, hardcover, and paperback
MORE ON OUR RADAR.
The FTC brought the theory that works when HIPAA does not. The FTC, Utah and Los Angeles County sued Hims & Hers on July 29 in the Northern District of California, alleging deception under Section 5 and ROSCA for sharing sensitive health information with advertising platforms while promising privacy. No chatbot is a defendant. The theory is the lever for any conversational health tool operating outside a covered entity.
Mental-health screening models arrive in Spanish. Three Spanish-language foundational models domain-adapted for mental health, plus a method the authors call Incremental Context Expansion for reading long social-media histories to detect early risk. Classification rather than conversation, which is why it sits here and not on the front page. The non-English screening market is the part of this beat nobody is covering.
China deleted millions of relationships and the apps complied. The Interim Measures took effect July 15, barring designs that induce emotional dependence and prohibiting romantic or familial roles for anyone under 18. ByteDance disabled human-like agents on Doubao. Alibaba’s Qwen removed romantic modes with no export path, stranding years of conversation history. The rule was covered here in April. The compliance wave is new.
Two House committees want DoorDash’s model inventory. A joint investigation asked DoorDash on July 31 for details on its use of Chinese-origin AI models. Whether this touches the beat depends on something the letter does not say, which is whether the company’s customer-service and support surfaces run on them. Worth watching for the answer rather than the question.
THIS ISSUE
A break-in, a billion, and flowers nobody sent.
If you or someone you know is in crisis, call or text 988 (Suicide and Crisis Lifeline).
Jess Jessop is the Founder and CEO/CTO of Clinician Assist Inc. (BetterMind.Space), building the first voice-first AI-native mental health EHR with Casey Life and Peer AI Coach supervised by licensed therapists. A disabled veteran and 25-year AI/software engineering veteran, Jess brings lived experience as a mental health client to the mission of making daily mental health care as integrated as oral care.