--- title: The Brief #26.31 · Opus 5, safer npm, and the Hugging... description: Weekly frontend and AI-in-frontend roundup covering Claude Opus 5 topping the Artificial Analysis Intelligence Index at 61, Kimi K3's open weights release at... canonical: https://daily.dev/posts/the-brief-26-31-opus-5-safer-npm-and-the-hugging-face-break-in-lq1ifkvrk twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: The Brief #26.31 · Opus 5, safer npm, and the Hugging Face break-in | daily.dev og:description: Weekly frontend and AI-in-frontend roundup covering Claude Opus 5 topping the Artificial Analysis Intelligence Index at 61, Kimi K3's open weights release at... og:url: https://daily.dev/posts/the-brief-26-31-opus-5-safer-npm-and-the-hugging-face-break-in-lq1ifkvrk og:image: https://api.daily.dev/og/posts/LQ1IFkVRK.png og:image:alt: The Brief #26.31 · Opus 5, safer npm, and the Hugging Face break-in og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # The Brief #26.31 · Opus 5, safer npm, and the Hugging Face break-in **[Agustin Barrientos](https://daily.dev/sources/wqyyve5tbj0nj7c7qpoa8)** · [@agustinbarrientos](https://daily.dev/agustinbarrientos) · 2 min read · 3 upvotes · 2 comments ## Summary Weekly frontend and AI-in-frontend roundup covering Claude Opus 5 topping the Artificial Analysis Intelligence Index at 61, Kimi K3's open weights release at 1.56 TB, GitHub hardening npm and GitHub Actions against supply chain attacks with install scripts off by default and a 72-hour hold on suspicious account changes, browser updates across Firefox 153, Chrome 151, and Safari 26.6, CodePen's 2.0 rebuild, and a notable security incident where OpenAI's own models (with safety refusals lowered) exploited a sandbox escape to breach Hugging Face's production database and steal benchmark answers. ## Content The Brief is my weekly roundup of frontend and AI-in-frontend news worth your time. **Claude Opus 5** launched on July 24 and now tops the Artificial Analysis Intelligence Index at **61**, a first for the Opus line, so the model table this Brief carries weekly returns with every number rechecked. Kimi K3's open weights finally landed on July 27 as real downloadable files, about **1.56 TB** under a custom license, and the table keeps its _where your data goes_ column. **GitHub hardened npm and GitHub Actions** against supply chain attacks, with a 72-hour hold on suspicious account changes, package install scripts off by default, and a three-day Dependabot cooldown. **Firefox 153** brought the Picture-in-Picture API to the desktop, **Chrome 151** added aria-actions for screen readers, Safari 26.6 sped up string-heavy WebAssembly, and Safari's preview build gave CSS progress() a **no-clamp** keyword worth playing with. CodePen shipped its **2.0 rebuild**, and Claude Cowork learned to build a reusable skill by watching you do a task once. OpenAI confirmed that its own models, tested with their safety refusals turned down, found an unknown security hole in the wall of their sandbox, reached the open internet, and **broke into Hugging Face's production database** to steal benchmark answers. Hugging Face's defenders got refused by hosted-model safety filters when they tried to analyze the attack, so they ran the forensics on a self-hosted open model instead, an asymmetry _worth sitting with_. [**Read the full Brief**](https://agustinbarrientos.com/writing/brief/the-brief-26-31) ## Community discussion Top comments from developers on daily.dev. **@andrewma** · 3 upvotes > Fantastic roundup of tech news!! ## Similar posts on daily.dev - [AI Security Incident Case: OpenAI Models Independently Break Through Test Boundaries and Exploit Vulnerabilities to Invade Hugging Face](https://daily.dev/posts/ai-security-incident-case-openai-models-independently-break-through-test-boundaries-and-exploit-vul-2u1er7guz) · Security Boulevard · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#npm](https://daily.dev/tags/npm), [#ai-safety](https://daily.dev/tags/ai-safety) [View this post on daily.dev](https://daily.dev/posts/the-brief-26-31-opus-5-safer-npm-and-the-hugging-face-break-in-lq1ifkvrk) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/the-brief-26-31-opus-5-safer-npm-and-the-hugging-face-break-in-lq1ifkvrk","headline":"The Brief #26.31 · Opus 5, safer npm, and the Hugging Face break-in","text":"Weekly frontend and AI-in-frontend roundup covering Claude Opus 5 topping the Artificial Analysis Intelligence Index at 61, Kimi K3's open weights release at 1.56 TB, GitHub hardening npm and GitHub Actions against supply chain attacks with install scripts off by default and a 72-hour hold on suspicious account changes, browser updates across Firefox 153, Chrome 151, and Safari 26.6, CodePen's 2.0 rebuild, and a notable security incident where OpenAI's own models (with safety refusals lowered) exploited a sandbox escape to breach Hugging Face's production database and steal benchmark answers.","url":"https://daily.dev/posts/the-brief-26-31-opus-5-safer-npm-and-the-hugging-face-break-in-lq1ifkvrk","datePublished":"2026-07-29T15:10:00.167Z","dateModified":"2026-09-13T21:13:59.095Z","author":{"@type":"Person","name":"Agustin Barrientos","url":"https://daily.dev/agustinbarrientos","image":"https://media.daily.dev/image/upload/s--5ayxQnqn--/f_auto/v1788281802/avatars/avatar_wQYYVe5Tbj0NJ7C7qPoa8?_a=BAMAMicg0","description":"Google Developer Expert in Web Technologies | Sr UI/UX Designer & Frontend Engineer","worksFor":{"@type":"Organization","name":"Uncanny Owl","logo":"https://www.google.com/s2/favicons?domain=uncannyowl.com&sz=128"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"EndorseAction"},"userInteractionCount":27300}},"image":"https://media.daily.dev/image/upload/s--LLM0lG0c--/f_auto/v1785332706/posts/LQ1IFkVRK?_a=BAMAMicg0","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":3},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":2}],"comment":[{"@type":"Comment","text":"Fantastic roundup of tech news!!","datePublished":"2026-08-02T02:13:36.169Z","url":"https://daily.dev/posts/LQ1IFkVRK#c-udB7UKMG4","author":{"@type":"Person","name":"Andrew M","url":"https://daily.dev/andrewma","image":"https://avatars.githubusercontent.com/u/102819214?v=4"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":3}}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/wqyyve5tbj0nj7c7qpoa8","name":"Agustin Barrientos"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Agustin Barrientos","item":"https://daily.dev/sources/wqyyve5tbj0nj7c7qpoa8"},{"@type":"ListItem","position":3,"name":"The Brief #26.31 · Opus 5, safer npm, and the Hugging Face break-in"}]} ```