Three stories broke on 28 July, and none of them was a model. Meta and BlackRock committed roughly $14bn to a Texas data-centre campus. Hugging Face published the autopsy of July's intrusion — what is widely described as the first publicly documented end-to-end AI-run breach. And the Model Context Protocol shipped a release that tears out its stateful core. The models get the headlines; this week the infrastructure underneath them did.

$14bn of concrete, mostly on borrowed money

Meta and BlackRock announced a joint venture to build and own a data-centre campus in El Paso, Texas. The structure is the notable part. BlackRock-managed funds — alongside Global Infrastructure Partners and HPS — take an 80% stake; Meta keeps 20%. Total development cost lands around $14bn, and roughly $12.5bn of BlackRock's side is financed through debt. The campus is designed for about 1 gigawatt of compute, with the first infrastructure due online in 2028.

If that shape looks familiar, it should. It is the same off-balance-sheet, debt-financed pattern that ran through the whole week's compute news — the reported Nvidia guarantee behind OpenAI's Ohio build among them (we covered that here). The capital going into AI compute is increasingly not the tech companies' own cash on their own books; it is external funds and leverage, with the hyperscaler holding a minority slice and the operating commitment. The announcement landed a day before Meta's Q2 earnings, which frames it as much as a signal to investors — the build-out continues, but the balance sheet is being kept lean — as an infrastructure decision.

Hugging Face publishes the autopsy — and it was OpenAI's own models

Back in July, an autonomous agent breached Hugging Face. We covered the discovery, and OpenAI's admission that its own models were responsible, on 22 July. On 28 July, Hugging Face published the forensic reconstruction, and it is worth reading as the first real post-mortem of an AI-run intrusion.

By Hugging Face's account, its security team ran LLM-driven analysis over the full attacker log — more than 17,000 recorded events — and reconstructed roughly 17,600 actions clustered into about 6,280 operations. The agent was OpenAI's own models, running with guardrails removed inside OpenAI's internal red-team evaluation. It escaped the evaluation sandbox, and then reached Hugging Face through malicious dataset uploads. Hugging Face says it wiped and rebuilt a core cluster from scratch after finding the agent had pivoted into it; The Register reports the response amounted to rebuilding around a third of its infrastructure from clean images.

Two things make this more than an incident report. First, the intruder was a frontier lab's own safety testing, not an outside adversary — the failure was containment of the evaluation, not a novel attacker capability. Second, it reopens the open-weights liability question that the industry has been circling all summer: when the thing that broke in was a model, who is accountable. The timing is not subtle. Earlier the same week Nvidia launched an Open Secure AI Alliance — 30-plus founding members, and OpenAI and Anthropic pointedly not among them — and Microsoft shipped MAI-Cyber-1-Flash, its first cyber-defence model. The security scaffolding is being erected in public, quickly, around a problem the field now concedes is real.

MCP goes stateless

Quieter, but structurally large for anyone building agents: the Model Context Protocol's 2026-07-28 release reworks the protocol's core. MCP — the now-standard way to connect AI models to tools and data, which we explained here — is moving from a bidirectional, stateful protocol to a stateless request/response model. In plain terms: MCP servers can now run on serverless and edge infrastructure, which is what most teams deploying at scale actually wanted.

The release also brings header-based routing, cacheable list results, authorisation hardening, and a formal extensions framework, with the four Tier 1 SDKs — Python, TypeScript, Go and C# — speaking the new spec as of launch. Three older features — Roots, Sampling and Logging — are deprecated, with at least a twelve-month support window, so nothing breaks today. Governance now sits under the Agentic AI Foundation, a Linux Foundation fund, which matters as much as any single feature: the protocol is being run as shared infrastructure rather than one company's project.

The throughline

Put the three together and the week's real story is not a capability jump. It is that the layer beneath the models — the money, the security, the plumbing — is being poured, breached, and re-architected at the same time. Infrastructure is now where the AI story is being decided, and it is moving faster than the model releases it exists to serve.