The most interesting AI stories this week weren’t about what models can do — they were about what happens when the worst case shows up, or gets imagined in advance. Start with the one that already happened. Australian police charged two Western Australian men with 14 offenses over TeamPCP, the crew behind March’s compromise of the open-source scanners Trivy and Checkmarx KICS and, through them, the AI gateway LiteLLM. The mechanics were almost elegant in their nastiness: credentials stolen from the Trivy hack got turned on Checkmarx days later, and LiteLLM’s own build pipeline — which installed Trivy without pinning it to a verified version — handed the attackers a publishing token for the project’s own releases. The AFP puts the damage at over 1,000 organizations, 500,000 stolen credentials, and 300 gigabytes exfiltrated. It’s a clean case study in how a single unpinned dependency in an AI tool’s CI pipeline cascades into a multinational breach, and a reminder that “supply chain” now includes the tooling that AI infrastructure itself runs on.
Then there’s the worst case a lab decided not to ship. Z.ai finally released the full weights for GLM-5.3, months after previewing the model and days after shipping the smaller Flash variant under an MIT license. The full model — 744 billion parameters, roughly 40 billion active — comes under a custom license rather than MIT, and the delay reportedly traces to the model’s unusually strong performance at finding software vulnerabilities. That’s a genuinely new kind of release calculus: not “is this model good enough to ship” but “is this model good enough at offense that shipping it needs a harder license.” Expect more labs to face the same choice as open-weight models keep closing the gap with frontier ones on security-relevant tasks.
MIT took the opposite approach: teaching a model to imagine catastrophes rather than wait for one. Researchers published a technique called η-learning in Nature Communications that generates plausible, unprecedented extreme events — storms worse than any on record — without training on any disaster data at all. Instead of extrapolating from the worst thing that’s happened, it learns the underlying structure of ordinary weather data well enough to describe worse things that haven’t. It’s a neat inversion of how most risk models work, and it’s easy to imagine the same idea eventually pointed at things other than weather.
None of this happens without somewhere to run it, and this week’s silicon reveals made clear how much has to be built. At Hot Chips 2026, AMD detailed Helios, a rack-scale system built around its MI455X GPUs that packs 2.9 exaflops, 31 terabytes of HBM4, and 260 terabytes per second of scale-up bandwidth into a single rack — a direct shot at Nvidia’s rack-scale dominance. Meta used the same stage to lay out four generations of its own MTIA chip, arriving on a six-month cadence through 2027, aimed at getting the company off commodity GPUs entirely. Between the two, the message is the same one Google and Nvidia have been sending all year: nobody wants to keep renting someone else’s compute forever.
Taken together, it’s a week that argued AI’s frontier isn’t just about capability anymore. It’s about who controls the supply chain underneath it, who decides what’s too dangerous to release, who can picture the disaster before it lands — and who owns the silicon that makes any of it possible.
