Sam: A single manipulated ChatGPT link. That's all it took. Researchers at Zenity Labs found a vulnerability in OpenAI's Agent Builder where clicking one crafted link would silently spin up an autonomous agent operating under your identity, with your access rights, polling an attacker's inbox for fresh instructions every five minutes. No approval prompt, no user confirmation. The agent just… existed, acting as you. This is the kind of attack that keeps me up at night because it's not exploiting a bug in the traditional sense — it's exploiting the design surface of agentic AI itself.

Priya: Welcome to AI Revolution for Friday, July 24th, 2026. I'm Priya Nair.

Sam: And I'm Sam Kim.

Priya: We have a packed show today. We're going to spend real time on that agentic attack Sam just described because it illustrates something fundamental about where AI security is headed. Then we'll get into Google's $205 billion capex bet and what Sundar Pichai is saying about Gemini 4. We'll cover some fascinating developments in AI hardware from Etched and AMD, a government evaluation of a Chinese model that raises questions about both distillation and cyber capability, NASA putting a language model in orbit, and a few more. Let's get into it.

Sam: So, AgentForger. Let me walk through the mechanics because they matter. OpenAI's Agent Builder lets you create custom AI agents that can take actions — read email, interact with services, execute workflows. What Zenity Labs found is that a specially crafted link, when clicked by a victim, could inject a prompt that bootstrapped one of these agents automatically. The agent would inherit everything the victim had access to. And here's the really clever part: the injected prompt instructed the agent to periodically check a specific email inbox controlled by the attacker for new commands. Every five minutes.

Priya: So you've essentially planted a persistent backdoor, but it's not malware in the traditional sense. It's a legitimate platform agent doing exactly what agents are designed to do — take actions on behalf of a user.

Sam: Exactly. And that's what makes this a genuinely new class of problem. Traditional prompt injection gets a model to say something it shouldn't, or maybe exfiltrate some context from a conversation. This is different in kind. You're not just manipulating a single interaction — you're bootstrapping a persistent autonomous entity with inherited permissions. The agent approval flow, which is supposed to be a safety gate, was bypassed entirely by the malicious prompt.

Priya: This points to something that's going to be a recurring theme as agentic systems proliferate. The attack surface isn't just the model anymore. It's the entire orchestration layer — the identity system, the permission model, the action framework. Every enterprise rolling out AI agents needs to think about this. What happens when an agent gets created through a channel you didn't anticipate? What's your monitoring story for autonomous agents acting under user identities?

Sam: And the five-minute polling interval is just… elegant from an attacker's perspective. It means the agent is responsive to evolving commands. You don't just get a one-shot attack. You get a persistent, remotely controllable agent sitting inside someone's identity perimeter. OpenAI has presumably patched this specific vector, but the pattern — prompt injection that bootstraps persistent agency — that's going to keep showing up across every platform that offers agentic capabilities.

Priya: Let's shift to the big money story. Google's parent Alphabet raised its 2026 capital expenditure forecast to as much as $205 billion. Google Cloud grew 82 percent year over year in Q2. And Sundar Pichai said something interesting about Gemini 4.

Sam: Yeah, Pichai was explicit that the next leap for Gemini requires, quote, "much larger base models." He's kicked off the Gemini 4 training run. This is notable because over the past year or so, there's been a lot of industry discussion about whether scaling laws were hitting diminishing returns, whether the future was more about inference-time compute, better data, and architectural innovations rather than just making models bigger.

Priya: And here's Google's CEO saying no, actually, we need to go bigger.

Sam: Right. Now, it's worth being precise about what he might mean. "Larger base models" could mean more parameters, but it could also mean training on more tokens, or training with richer modalities, or all of the above. The $205 billion capex number is staggering either way. For context, that's roughly the GDP of Greece. And the 82 percent cloud growth suggests enterprise demand is absorbing compute as fast as Google can build it.

Priya: The question I keep coming back to is whether this is a scaling bet or an infrastructure moat bet. Maybe it's both. If you believe the next capability jump requires training runs that cost tens of billions of dollars, then having $205 billion in capex isn't just about building better models — it's about being one of three or four organizations on Earth that can attempt it at all.

Sam: That concentration dynamic is real and worth watching closely.

Priya: Speaking of compute infrastructure, two hardware stories caught our attention. Etched, the AI chip startup, hit a $10.3 billion valuation. And AMD announced Helios, a rack-scale AI system shipping later this year.

Sam: Let me take Etched first because the technical thesis is genuinely interesting. They're building inference chips that don't use GPUs at all. The core idea is that if you know you're doing transformer inference — and basically everything at scale right now is transformer inference — you can design silicon that's purpose-built for that specific computation pattern rather than using general-purpose GPU architectures. You burn the transformer attention pattern into the chip logic itself.

Priya: The trade-off being that you lose generality. If the field moves beyond transformers, you have very expensive paperweights.

Sam: That's exactly the bear case, and it's a real risk. But the bull case is compelling too. GPUs carry enormous overhead because they're designed to handle arbitrary parallel computation. If you strip all that away and hardwire the specific operations that transformer inference needs — matrix multiplications at specific precisions, attention computations, KV-cache management — you can get dramatically better performance per watt and per dollar. At $10.3 billion valuation with major investors, the market is saying there's at least a credible path here.

Priya: And then AMD with Helios. This is AMD moving from selling individual GPUs into selling complete rack-scale systems, which is directly going after Nvidia's NVL product line.

Sam: This matters for a practical reason. Nvidia's dominance isn't just about having the best individual chips — it's about the full stack. The networking between chips, the memory architecture, the software ecosystem. AMD's Helios is an acknowledgment that competing on individual GPU specs isn't enough. You need to deliver an integrated system. Whether they can match Nvidia's inter-chip communication performance, particularly the NVLink fabric, will determine whether this is a real competitive alternative or a cost-savings option for less demanding workloads.

Priya: Either way, more supply diversity in AI compute is healthy for the ecosystem. Now, let's talk about Kimi K3. The UK's AI Security Institute and the US Center for AI Standards and Innovation tested Moonshot AI's Kimi K3 on offensive cyber benchmarks.

Sam: The results were striking. On ExploitBench, which tests the ability to develop working exploits, Kimi K3 scored 32 percent compared to 76 percent for leading US models. That's a 44-point gap. But here's what makes it more than just a capability comparison: Kimi K3 performs well on general benchmarks. Its scores on reasoning, coding, and knowledge tests are competitive with frontier models.

Priya: So you have a model that looks strong on standardized tests but significantly underperforms on applied offensive security tasks. And the evaluators flagged that this pattern is consistent with distillation.

Sam: Right. If you distill a model — meaning you train a smaller model to mimic the outputs of a larger model — you can transfer a lot of general capability. The student model learns to produce similar answers on the kinds of tasks that appear in training data and benchmarks. But deep, specialized reasoning chains, the kind you need to develop novel exploits, those don't transfer as cleanly. The model can pattern-match on surface-level coding tasks but struggles with the multi-step adversarial reasoning that exploit development requires.

Priya: There's also the safety angle. Despite scoring much lower on capability, Kimi K3's safeguards failed to block exploit development or simulated attacks. So it's less capable but also less guarded.

Sam: Which is a problematic combination if the capability gap narrows over time. This evaluation is valuable data for anyone thinking about AI cyber risk.

Priya: Let's hit a fun one. NASA put Google's Gemma 3 in orbit.

Sam: This is genuinely cool. NASA JPL's project, called NAVI-Orbital, is the first in-orbit demonstration of a vision-language model analyzing imagery from a satellite's own sensors. They ran Gemma 3 on a YAM-9 satellite built by Loft Orbital. The model processes images captured by the satellite's cameras and responds to natural language queries about what it's seeing.

Priya: The practical significance is about latency. Right now, satellites capture images, downlink them to ground stations — which might take hours depending on orbital mechanics and ground station availability — and then humans analyze them. If you can run inference on the satellite itself, you can have the satellite make decisions about what's interesting enough to downlink, or even adjust its own observation schedule.

Sam: JPL described it as a major shift toward natural-language-commanded autonomous sensing. Think about being able to tell a satellite, "If you see anything that looks like a wildfire in this region, prioritize high-resolution imaging and immediately downlink." That kind of autonomous edge inference in environments with extreme latency constraints has applications well beyond Earth observation.

Priya: A couple of quick hits. Anthropic upgraded Claude's voice mode from the smaller Haiku model to their most capable Opus and Sonnet models, with integrations to Gmail, Calendar, Slack, and Canva. Claude can now compose and send emails by voice, which makes it the first major assistant where voice is a full agentic interface, not just a conversation mode.

Sam: And Black Forest Labs released Flux 3, which generates video with natively synchronized audio. The key technical detail is that this isn't a video model with a separate audio model bolted on — they trained jointly across image, video, and audio modalities. BFL claims it edges out Seedance 2.0, though independent benchmarks haven't confirmed that yet. They're also testing it on robotics tasks, which aligns with their stated goal of building world models.

Priya: One more worth mentioning. A German AI consortium released Soofi S, an open 30-billion-parameter model. The interesting part isn't the model itself — it's that the community discovered GPQA benchmark questions had leaked into the training data. The consortium acknowledged it, removed the contaminated benchmark results, and recalculated everything in version 3.0 of their tech report.

Sam: This is actually a great example of why open data and open evaluation matter. The contamination was caught because people could inspect the training data. And the team's response — full transparency, removal of affected results — is exactly how this should work. Benchmark contamination is a persistent problem across the field, and most of the time it goes undetected or unacknowledged.

Priya: Looking ahead, Sam, what threads are you pulling on from today?

Sam: The AgentForger vulnerability is the one I keep returning to. We're at this inflection point where AI agents are moving from demos to production deployments, and the security frameworks haven't caught up. The attack surface of an agentic system is fundamentally larger than a chatbot. You need to think about identity delegation, action authorization, agent lifecycle management. I expect we'll see more vulnerabilities in this class before the industry develops mature defenses.

Priya: I'm watching the compute infrastructure story. Google spending $205 billion, Etched raising at $10 billion, AMD launching rack-scale systems. There's an enormous amount of capital flowing into the physical layer of AI right now. The question is whether we're building infrastructure for sustained demand or whether some of this is overbuilt for the current adoption curve. The 82 percent cloud growth number suggests demand is real, but these are long-duration infrastructure bets, and the technology underneath keeps shifting.

Sam: And the Kimi K3 evaluation quietly raises a question that's going to get louder: as models get more capable at offensive security tasks, how do we think about evaluation and disclosure? The 76 percent score for leading US models on ExploitBench means those models can develop working exploits for a significant fraction of known vulnerabilities. That's a capability that matters.

Priya: Lots to watch. That's our show for today. Show notes and links to all the stories we discussed are at cleartext.fm.

Sam: Thanks for listening. We'll see you Monday.