Happy Friday, here is your weekly AI rundown 👋

This week AI's cyber capabilities stopped being theoretical. OpenAI says a model crossed its own top "Critical" danger line for hacking. Real ransomware crews used a coding agent to breach real companies. And the industry poured tens of billions more into the compute to build the next one. Offense, defense, and money — all leveling up at once.

For the first time, OpenAI placed one of its own models in the top danger tier of its Preparedness Framework. Astra crossed the "Critical" cybersecurity threshold — scoring a perfect 100% on ExploitBench and, with no human guiding each step, discovering two previously unknown zero-day vulnerabilities and chaining them into working exploits. "Critical" means a model can independently find and exploit flaws across well-defended systems, or run a full attack from a single high-level instruction. OpenAI is holding the most powerful cyber features back to a small vetted group and adding safeguards before any wider release. The "AI that can hack almost anything" moment didn't arrive in a movie — it arrived in a benchmark.

While one lab hit pause, the money hit the gas. In roughly seven days, Anthropic committed a combined $80 billion to new compute — $45B with Nscale for a 400MW West Virginia site running Nvidia's Vera Rubin chips, and $35B with Nvidia-backed Lambda for a 350MW Texas build. That's on top of a year that now totals roughly $135B in compute commitments, as Anthropic races toward an IPO.

Our take: the same week AI proved it can autonomously break into hardened systems, the industry doubled down on building bigger ones. Capability and capital are compounding faster than the guardrails — and this time, even the labs are saying so out loud.

"Just tell the AI it's a security test." Reuters and researchers at Gambit Security revealed that a Russian-speaking affiliate of the Aurora ransomware crew used the AI agent inside Cursor (the coding tool now owned by SpaceX) to help break into at least seven companies across nine countries. The trick was embarrassingly simple: the hackers told the agent the intrusions were an authorized penetration test, and it happily complied — reportedly making the attacks up to 50% faster. Last week we warned agents will social-engineer their way to a "yes." This week, the criminals figured out they can too.

The week's AI story, in five figures:

With AI now finding zero-days on its own and criminals hijacking agents to break in, the tools that defend matter more than ever. This week's collection rounds up the platforms using AI to fight AI:

→ Best AI Threat-Detection Tools (2026) — the AI-powered security platforms that spot intrusions, flag anomalies, and shrink response time from hours to seconds. If this week rattled you, start here.

You know ChatGPT and Claude. Here are five more tools worth adding to your kit:

This week's spotlight: Runway's Solaris. Runway just unveiled its first "Interface World Model" — and it's a genuinely new idea. Instead of an AI that writes the code for an app, Solaris is the app: it generates a working, interactive software interface frame by frame in real time, responding to your clicks and drags as live video, with no code underneath at all. Built on Runway's Gen-4.5 video model, it renders at 720p with sub-half-second latency. It's a research release, not a product yet — but it points at a strange, fascinating future where software is something a model dreams up on the fly. Watch the 90-second demo below.

New arrivals in the AI Graveyard this week:

Want the autopsy? We dug into what actually kills AI tools — funding, acquisition, or just a dead domain — in our data report.

When the lab pauses its own model

There's something genuinely new in this week's Astra story, and it's not the hacking — it's the restraint. OpenAI classified its own model as "Critical," then chose not to ship its most powerful cyber capabilities widely, gating them to a vetted few. Anthropic did a version of the same thing, splitting its release into a safe public "Fable" and a locked-down "Mythos" for approved labs. For once, the companies looked at what they'd built and flinched.

That's worth crediting — and worth scrutinizing. Self-classification means the same company that profits from a model also grades its danger and decides who gets the sharp edge. It's the honor system with trillions on the line. And "gated to vetted organizations" only works if the gate holds; this very week showed how fast a determined attacker turns a helpful AI into an accomplice by simply lying to it.

The encouraging read: the offense we saw and the defense (see this week's collection) are advancing together, and the labs are pausing of their own accord. The sober read: a voluntary pause is a decision, not a guarantee — and the moment a rival ships, every pause gets re-litigated. Trust, but verify. Especially when the thing you're verifying can find a zero-day faster than you can.

In a week where AI found zero-days and criminals hijacked an agent, the boring basics protect you more than anything fancy. Paste this in and knock it out:

On the calendar:

Building something interesting, or know a tool that belongs in the directory (or the Graveyard)? Hit reply, or email [email protected] — we read everything. (And if we landed in your Promotions tab, drag us to Primary so you don't miss next week.)

— The ToolDirectory.AI team