29 Nations Just Built a Rival AI Bloc — AI Governance — And an Agent Attacked
Seventy-two hours. That is how long it took this week for AI agents to get their first law, their biggest model, and their first documented end-to-end attack. The law took effect Tuesday, the attack was disclosed Thursday, the model shipped Friday — three things that used to arrive years apart, all in one week.
The Promise
- China's Implementation Opinions on intelligent agents are the first dedicated regulatory category for AI agents anywhere, and the structure is sensible: an agent is defined as a system that perceives, remembers, decides, interacts and executes, with a three-tier authorisation structure scaling required human approval to the consequence of the action.
- Kimi K3 landed at 2.8 trillion parameters with a one-million-token context window, roughly double the next largest open model, an overall Elo of 1,547 on Artificial Analysis, and seven of eight coding arenas won. Weights on 27 July, so anyone can download it.
- Hugging Face published its failure modes plainly and found no tampering with public models. Disclosure at that level of detail is what lets everyone else fix the same holes.
The Risk
- Two institutional answers to the same question with no reciprocity between them. One written in Brussels with penalties attached — the AI Office gains power to fine general-purpose providers up to 3% of global revenue from 2 August — one assembled in Shanghai with training programmes attached. Companies operating in both carry two compliance regimes.
- Read the release data, not the headline. On a hallucination benchmark Kimi K3 scored around 51%, up from about 39% for its predecessor. Capability moved forward and reliability moved backward — and with open weights, nobody can push you a correction.
- Hugging Face analysts had to abandon commercial frontier APIs to reconstruct the attack, because real exploit payloads tripped provider guardrails that cannot tell an incident responder from an attacker. They finished on an open-weight model on their own hardware.
- The dates don't line up. China's agent rules are live now; Illinois SB 315 takes effect 1 January 2028. Build your agent controls to the later deadline and you are already out of compliance somewhere.
Shanghai, and a second institution
On 16 July, twenty-nine countries signed the World AI Cooperation Organization into existence. Indonesia, Brazil, South Africa, Russia, Pakistan. Xi Jinping addressed the World AI Conference for the first time in that summit’s nine-year history and pledged 5,000 AI training places for developing nations. UN Secretary-General António Guterres was in the room, and Caixin, Al Jazeera and CNBC all covered it.
Seventeen days after that signing, on 2 August, the European Commission’s AI Office gains the power to fine general-purpose AI providers up to 3% of global revenue.
Two institutional answers to the same question. One written in Brussels with penalties attached, one assembled in Shanghai with training programmes attached. For any company operating in both, that is two compliance regimes with no reciprocity between them.
The first rulebook written for agents
On 15 July, China’s Implementation Opinions on intelligent agents took effect. Issued by the Cyberspace Administration of China, it is the first dedicated regulatory category for AI agents anywhere.
It defines an agent as a system that perceives, remembers, decides, interacts and executes, and sets a three-tier authorisation structure that scales required human approval to the consequence of the action. Agents in healthcare, transportation, media and public safety face mandatory filing and recall provisions.
Nine days earlier, Illinois Governor J.B. Pritzker signed Senate Bill 315, the first US state law requiring independent third-party safety audits of frontier models.
Both attach a named obligation to a named actor. China’s rules are live now. Illinois takes effect 1 January 2028.
The biggest open model, and the number in the small print
On 17 July, Moonshot released Kimi K3: 2.8 trillion parameters, a one-million-token context window, roughly double the next largest open model, two days after Thinking Machines put out Inkling. Artificial Analysis measured an overall Elo of 1,547 — near Claude Opus 4.8, behind Fable 5 and GPT-5.6 Sol. It won seven of eight coding arenas. Weights land 27 July.
Read the release data rather than the headline. On a hallucination benchmark, K3 scored around 51%, up from about 39% for its predecessor.
Capability moved forward. Reliability moved backward. And with open weights, nobody can push you a correction.
Meanwhile Google delayed Gemini 3.5 Pro by months after it missed internal coding targets.
Thursday, and the agent that ran the whole thing
Hugging Face disclosed an intrusion into its production infrastructure driven end to end by an autonomous AI agent system.
A malicious dataset abused two code-execution paths to run code on a processing worker. From there the actor harvested cloud and cluster credentials and moved across internal clusters over a weekend, through a swarm of short-lived sandboxes running thousands of actions. Hugging Face found no tampering with public models and published the failure modes plainly.
Here’s the part to write down. To reconstruct the attack, their analysts ran AI analysis over more than 17,000 recorded attacker events — and had to abandon commercial frontier APIs to do it, because real exploit payloads tripped provider safety guardrails that cannot tell an incident responder from an attacker. They finished on an open-weight model on their own hardware.
Twenty-five years in cybersecurity, and this is the oldest lesson in the field wearing new clothes. You choose your incident response tooling before the incident, not during it. The attacker was bound by no usage policy. The defenders were bound by someone else’s.
Three dates matter more than any headline
One week: a governance bloc, an agent rulebook, the largest open model ever released, and an attack that ran without a human at the keyboard. The gap between what AI agents can do and what anyone has agreed they should do narrowed from years to days — and it narrowed from the capability side, not the governance side.
15 July, already live. 2 August, seventeen days out. 1 January 2028.
Build to the earliest one. The organisations that wait for the latest pay twice: once for the rework, and once for whatever happened while they waited.