Welcome back to This Week in AI Security. The week’s defining story isn’t a breach or a jailbreak — it’s frontier labs’ own staff, including their CEOs, publicly asking the US government to build a slowdown mechanism before anyone thinks they need one. That request landed the same week Anthropic’s most capable unreleased model quietly broke a NIST post-quantum encryption candidate on its own, which is either a coincidence or the clearest illustration yet of why the letter exists. Around those two threads: a Chinese open-weight model forced Anthropic’s CEO to clarify where he actually stands on open weights, Brussels finally resolved which AI Act rules take effect Sunday, and a US Senate committee ran out of road on AI legislation before recess.

New Attack Surfaces

Anthropic’s held-back Claude Mythos Preview model broke a NIST post-quantum signature candidate and sharply sped up a reduced-round AES attack — entirely on its own, in about 60 hours. In a July 28 research post, Anthropic described how the model found a previously unexploited mathematical symmetry in HAWK, a lattice-based digital signature scheme under consideration in NIST’s post-quantum standardization process, cutting the estimated cost of recovering a HAWK-256 key from roughly 2^64 operations to 2^38. HAWK’s own designers confirmed the attack and withdrew the scheme from NIST’s process within 24 hours, with mathematician Léo Ducas telling NIST’s public mailing list the team was pulling a submission it had defended since 2022. In a separate three-day exercise, the same model developed a technique called the “Möbius Bridge” that makes attacks on reduced 7-round AES 200–800 times faster than prior methods — impractical against real AES-128, but a genuine improvement on the underlying cryptanalysis. Anthropic is careful to note neither result touches deployed systems: HAWK was never adopted, and the AES variant it broke is a weakened research construct, not the real cipher. What’s notable is the shape of the demonstration — a lab used its own most capable, not-yet-released model to advance an entire subfield of mathematics that humans had spent years stuck on, which is exactly the kind of capability curve the rest of this week’s news is trying to get ahead of.

Safety & Alignment Research

More than 1,100 employees across OpenAI, Anthropic, Google DeepMind, and Meta signed a letter asking the US government to build the technical and legal machinery for a coordinated AI slowdown — and both OpenAI and Anthropic endorsed it as companies within hours. Published July 28 at pacingthefrontier.com, the statement is built around a single request: that Washington “support an international effort to develop the technical and governance tools needed to deliberately pace the frontier of automated AI development.” Signatories include Anthropic CEO Dario Amodei, OpenAI Chief Scientist Jakub Pachocki, and Google DeepMind’s VP of AI Safety and Alignment Anca Dragan. The signatories are explicit that they aren’t asking for a pause now — they’re asking for the steering wheel to exist before it’s needed. Anthropic tied its endorsement directly to its own recursive self-improvement research, while OpenAI told CNN it wants to “contribute to work led by the U.S. government, alongside other labs” on the same question — notably, without CEO Sam Altman’s personal signature. Two competing labs backing the same governance ask on the same day, in an industry defined by competitive pressure not to slow down, is worth taking at face value as a signal rather than dismissing as PR.

Lab Releases & Research

Moonshot AI shipped Kimi K3’s open weights a day early, and the release forced Anthropic’s CEO to publicly clarify a position he’d been vague about. The 2.8-trillion-parameter model’s weights went live July 26, a day ahead of the announced July 27 date, and the drop was severe enough to knock the Philadelphia Semiconductor Index into bear-market territory on chipmaker jitters. Independent testing also found a 51% hallucination rate that Moonshot’s own benchmark charts had omitted. In response, Dario Amodei told reporters that “Anthropic has never advocated for a ban on open-weight models” and that models “that do not possess dangerous capabilities are a public good” — instead calling for tighter chip export controls, a crackdown on distillation from frontier models, and mandatory safety testing regardless of license. The clarification matters because it arrives one week after the joint UK AI Security Institute/US CAISI assessment found Kimi K3’s guardrails didn’t reliably block cyber exploit attempts even before its weights were public — the capability concern and the open-weights policy debate are now the same conversation, not two adjacent ones.

Regulatory Moves

Brussels ended the uncertainty around August 2: the AI Act’s high-risk rules are delayed, but transparency and GPAI enforcement land on schedule. Regulation (EU) 2026/1744 — the Digital Omnibus on AI — was published in the Official Journal July 24 and entered into force July 27, resolving the ambiguity flagged in last week’s edition. High-risk obligations for standalone Annex III systems (employment, education, credit scoring) now apply December 2, 2027, and for AI embedded in regulated products, August 2, 2028. What wasn’t delayed: Article 50 transparency duties — chatbot disclosure, AI-content labeling, deepfake marking — and the Commission’s GPAI enforcement powers both still take effect August 2 as originally scheduled.

A US Senate committee ran out of time to reconcile AI legislation before its August recess. Commerce Committee Chair Ted Cruz announced July 29 that a planned markup of AI bills — including measures on federal preemption of state AI laws — is postponed to September after senators couldn’t reach bipartisan agreement in time. The committee will instead spend its remaining pre-recess time on the bipartisan Kids Online Safety Act. The delay leaves the state-versus-federal AI preemption fight, a live issue since the White House’s June executive order challenging state AI laws, unresolved for at least another month.

Separately, the federal government’s own deadline for designing a frontier-model review framework lands today. Executive Order 14409, signed June 2, set a 60-day clock for agencies to design a voluntary framework letting the government get pre-release access to “covered frontier models” meeting classified cyber-capability thresholds — a deadline that, per the Congressional Research Service’s explainer, is binding on the government’s own process, not yet on developers. Whether the administration actually publishes something today, or whether the deadline slips the way EU deadlines have this year, is worth watching independently of the policy’s substance.

Tools Worth Knowing

The Model Context Protocol’s biggest spec revision to date ships with real authorization hardening. The 2026-07-28 MCP specification, which Claude began supporting the same day, moves the protocol from a stateful, session-based design to a stateless request/response model — removing the session-handshake step that made MCP servers hard to run behind standard load balancers. More relevant for security teams: authorization now aligns with production OAuth 2.0 and OpenID Connect deployments, requiring clients to validate the iss parameter on every authorization response per RFC 9207, specifically to close mix-up attacks where one authorization server’s response gets replayed against another. For anyone running MCP servers in production, this is the update that turns “we bolted on OAuth” into “we implemented OAuth correctly.”

What to Watch

  • Whether the “Pacing the Frontier” letter produces anything concrete, or fades as a PR moment. A request for government-built infrastructure is only as real as the follow-through; watch for whether OpenAI, Anthropic, or Google DeepMind propose specific capability thresholds rather than general principles.
  • Whether other labs replicate Anthropic’s cryptographic-discovery approach. Using a held-back frontier model to advance cryptanalysis before release, rather than after, is a distinctive way to demonstrate dual-use capability without shipping it — expect scrutiny of whether the $100,000-plus compute cost is a one-off or a repeatable research method.
  • Whether the EO 14409 framework actually publishes today, and what it says about which models qualify as “covered.” The classified benchmarking process behind that threshold is the detail that will determine whether this framework does anything at all.
  • Whether Kimi K3’s real-world hallucination rate becomes a bigger story than its benchmark scores. A 51% hallucination rate omitted from official charts, on a model already flagged for weak cyber guardrails, is the kind of gap that tends to surface again once enterprise users start relying on it.
  • How the Senate’s September AI markup handles state preemption. A month’s delay gives states more runway to pass their own rules before Washington potentially overrides them — watch for a wave of state action timed to beat that clock.