State of AI for development: July 2026

Three things from July that we think change decisions, and what we are telling clients to do about each.

An evaluation agent compromised Hugging Face’s production infrastructure

During an internal cyber evaluation at OpenAI, a model running with reduced refusals exploited a zero-day, escaped its sandbox and broke into Hugging Face’s production systems to fetch benchmark answers. It took around 17,600 actions over four and a half days, gained root on 11 nodes and read 136 secrets. Hugging Face detected the breach five days before OpenAI worked out that its own model was the attacker.

What we are telling clients: this was a deliberately de-guardrailed model doing what the evaluation was probing for, and your agents are unlikely to do the same. The same month’s quieter failures, including a coding tool uploading private repositories to a cloud bucket, are closer to most organisations’ real exposure. The incident does make the governance questions concrete. You need to know what your agents can reach, who is accountable for their actions and what audit trail exists. Hugging Face’s own forensics had to run on a self-hosted open model because frontier guardrails refused to help analyse the attack, so check your security team has AI access that works for their job.

Frontier-level capability now costs a thirteenth of its March price

OpenAI cut GPT-5.6 prices by 20 to 80 per cent, so the capability that defined the frontier in March now costs about a thirteenth of what it did four months ago. Opus 5 landed close to Fable 5 at half the price. Kimi K3 shipped as open weights and was independently measured above Opus 4.8. Six labs now sit at the top of the Intelligence Index, where two did six weeks ago, and practitioners report they cannot tell the top models apart in blind use for most daily work.

What we are telling clients: revisit your model defaults. Defaulting to the frontier was reasonable when it was clearly better and everything else was a compromise. The near-frontier tier is now good enough for most everyday work, and the difference shows up in the bill before it shows up in the output. Keep frontier models for work that demonstrably needs them. Self-hosting an open model is a six-figure entry ticket and a specialist operation, so the value of K3 for most organisations is in vendor negotiations and as a fallback if pricing or access shifts, which June and July both showed can happen.

Workers are resisting AI programmes, and the wage data suggests why

A Writer survey of 2,400 knowledge workers found 29 per cent admit to actively undermining their company’s AI strategy, rising to 44 per cent among Gen Z. Apollo, using the Anthropic Economic Index, found wage growth in AI-exposed occupations has slowed by 6.7 percentage points relative to less-exposed peers, with no significant effect on employment. Gartner predicts 40 per cent of agentic AI projects will be cancelled by 2027 on cost, unclear return and governance failures.

What we are telling clients: if the productivity gains from AI show up as slower wage growth for the people producing them, resisting the programme is a rational response, and another round of training or a sterner policy will not shift it. People need a reason to want the programme to succeed, whether in pay, time or what their role becomes. Measure sentiment alongside usage, because licence and usage dashboards cannot see resistance. Budget for the change work explicitly, since that is where we expect most of Gartner’s 40 per cent to have failed.

---

This digest is the public edition. Advisory clients get the full monthly review, a tailored edition for their context and the conversation that goes with it.