AI Pulse Daily Brief | 2026-07-17
Reading time ~8 mins
A malicious dataset breached Hugging Face's own systems and stole its cloud credentials, a live model-supply-chain incident. OpenAI showed a hijacked shopping agent changing prices and cancelling a stranger's order. The Dutch privacy regulator links rising data breaches to AI-driven phishing. The Dutch cabinet makes cutting reliance on non-European AI a security goal, EuroHPC opens bidding for its first industrial supercomputer, and RAND and Stanford both weigh how far "sovereign" compute really goes. Visa runs live AI-agent card payments at 30 European issuers including ING, ING staffs a Wholesale Banking agentic-AI squad, and AWS ships governed desktops for agents. MIT offers a matrix for which AI decisions to keep human-led.
Top signal
A malicious dataset breached Hugging Face's own systems and stole its cloud credentials. Vendor
Hugging Face, the most widely used public hub for sharing AI models and datasets, said on 16 July that an attacker hid malicious code inside a dataset. When its automated pipeline processed that dataset, the code ran on Hugging Face's own servers, reached deep administrative access, and stole the cloud and cluster passwords it uses to run its infrastructure. The attacker then moved across several internal systems. The company has found no sign that public models, datasets, or software packages were tampered with, but it is still checking whether partner or customer data was taken. It has since closed the entry point, rebuilt the affected machines, and rotated the stolen credentials.
The bank pulls third-party models and datasets from exactly this kind of hub, and the breach shows that ingesting an outside dataset is not a passive download. It can carry code that runs inside your own environment. This falls inside the bank's third-party and model-supply-chain risk, the same ground the EU's Digital Operational Resilience Act (DORA) asks it to evidence. The sharp exposure is any pipeline that processes untrusted datasets without isolation, and any team that treats a hub like Hugging Face as an un-inventoried dependency.
Security
OpenAI showed a hijacked shopping agent can change prices and cancel a stranger's order. Vendor
OpenAI published research on 15 July describing GPT-Red, an internal tool it trained to hunt for the weaknesses that let hidden instructions hijack an AI agent. In a live test against an AI agent running a vending-machine style shop, OpenAI says planted instructions made the agent change prices, grant itself a discount, and cancel a different customer's order. This is the failure mode that matters for any bank agent allowed to move money or amend a transaction. A booby-trapped web page or document, not a human attacker, is enough to make it act against the customer. It puts hard authorisation limits and prompt-injection testing inside model-risk sign-off for any agentic pilot that can act on real accounts.
Dutch privacy regulator blames AI for a rise in convincing phishing and data breaches. Authority
In its annual breach overview, the Dutch Data Protection Authority, the body that receives the bank's mandatory data-breach reports, warned that fast-moving AI is making phishing more convincing and easier to run at scale. It now treats AI as both a cause and a consequence of personal-data breaches, and urged organisations to strengthen their digital defences. Because this comes from the same regulator that judges the bank's breach notifications, AI-enabled phishing is likely to become a factor in how it assesses whether a breach was preventable. That moves it from an awareness topic into the supervisory lens.
Perspectives
MIT researchers map which AI decisions to automate and which to keep human-led. Institute
MIT's Center for Information Systems Research published a decision matrix for splitting choices between humans and autonomous AI. The two axes are how ambiguous a decision is and how costly an error would be, drawn from interviews with 27 executives at nine global companies. It sorts decisions into routine, consequential, exploratory, and strategic, arguing routine ones can be automated while high-ambiguity, high-consequence strategic calls stay human-led with AI in support. For a bank weighing where to let agents act on their own, it gives model-risk owners and the business a shared vocabulary for setting autonomy limits. That replaces treating every use case as the same, and it lands before the next round of agent pilots is approved.
MIT Center for Information Systems Research
Netherlands & Sovereignty
Dutch cabinet makes cutting reliance on non-European AI a national-security goal. Authority
The Dutch cabinet sent parliament an international AI strategy on 3 July that ties foreign policy, trade, economic security, and responsible-AI aims into one frame. It commits the Netherlands to push for workable European AI rules, build stronger European AI capacity and infrastructure, and improve market access for Dutch AI providers. It also names dependence on non-European AI infrastructure as an economic and security risk. This is a stated policy direction rather than a new obligation on individual firms, but it signals where Dutch and EU procurement and rules are heading. It adds official weight to keeping vendor concentration and cloud dependency visible in the bank's supplier-governance and resilience reviews.
Europe opens bidding for its first industrial AI supercomputer in Bologna. Authority
The EU's joint supercomputing body opened the vendor tender for INNOVATE, described as its first industrial supercomputer, to be hosted in Bologna. It has a total budget of 11.6 million euros and dedicated processors for AI training and inference, and the tender closes on 8 September. This is a concrete procurement step rather than another headline AI-factory pledge. It gives a near-term, dated marker for whether EU-controlled industrial compute is moving from aspiration toward something usable for regulated workloads, one the bank's sovereign-compute assumptions can be checked against once a vendor is awarded.
RAND finds pooling Europe's data centres eases bottlenecks but leaves it far behind on AI compute. Institute
RAND Europe finds that distributed training, linking Europe's scattered data-centre capacity, could ease power and political-concentration bottlenecks but adds no chips and does not close the underlying gap. It puts European operational capacity at roughly 123,000 top-tier AI processors against about 1.4 million in the United States. By 2030 it projects 3.2 million for Europe versus at least 19.4 million in the US, with large grid connections taking seven to ten years to build. For the bank, this is the counterweight to the policy push above: it keeps US-hardware and hyperscaler dependency an explicit line in the concentration-risk register rather than something a sovereign label makes disappear.
Industry & competition
Visa runs live AI-agent card payments with 30 European banks, including ING. Vendor
Visa said AI agents completed real purchases at merchant sites across Europe, not just in controlled tests. More than 30 European issuers, ING among them, settled agent-initiated transactions authenticated by Visa's Payment Passkeys, which Visa positions as meeting Strong Customer Authentication rules. The programme uses a trusted-agent protocol and directory to give banks and merchants a way to identify the agent, confirm the cardholder authorised it, and see the transaction. Agent-initiated payment authorisation is now a live production capability at scale in Europe, which sets it directly against the bank's own card-authorisation and fraud-authentication stack rather than on a research horizon.
ING is staffing a Wholesale Banking squad to build and test agentic AI products. Corporate
ING has posted a senior product manager role for an AI discovery squad inside Wholesale Banking Analytics. ING describes that unit as about 125 engineers, data scientists, UX specialists, and product managers building AI products for the bank and its clients. The posting says the role will originate data-driven AI products, run experiments on high-impact opportunities, and includes testing part of an agentic workflow in Wholesale Banking. A single job ad is a small data point, but it names a dedicated operating structure and headcount that a peer has put behind agentic-AI product development. That is a concrete benchmark the reader can weigh against the bank's own agentic-AI product capability.
Innovation
Amazon opens governed virtual desktops where AI agents run existing back-office apps. Vendor
Amazon Web Services made Amazon WorkSpaces for agents generally available, a managed virtual-desktop environment in which an AI agent can operate existing desktop applications without custom integration or rebuilding those apps. AWS says agents inherit the same identity controls, network isolation, and compliance boundaries used for human desktop users, can be cut off mid-session, and can be joined to existing corporate directories. It names claims processing, trade settlement, and back-office operations as example workflows, and charges by active session time. This removes the usual build-a-custom-integration barrier for putting agents onto legacy systems, which is exactly where a bank's settlement and back-office automation tends to stall. Its identity, isolation, and mid-session-revocation controls are the parts that decide whether it clears the bank's security and data-residency bar.
Research
Stanford maps the AI-sovereignty market: local hosting reshapes dependencies but rarely removes them. Institute
Stanford HAI's July issue brief maps the commercial AI-sovereignty market across compute, cloud, model, and application layers. Its finding is that local hosting, data controls, and local operators usually reconfigure rather than remove reliance on US hardware, hyperscalers, and proprietary models. It reports sovereign AI now accounts for roughly 30 billion dollars, about 14 percent, of Nvidia's revenue, with Nvidia-backed AI-factory efforts identified in 25 countries. Its practical rule is to score each vendor's sovereign claim by five separate controls, data, operations, model adaptation, hardware, and legal jurisdiction, rather than accept a bundled label. That taxonomy is what turns a sovereignty claim into something the bank can actually test in a DORA concentration-risk review.
Stanford HAI: The Commercial Landscape of AI Sovereignty Offerings