The web, in the news.
Stories from the wider web that shape what we build: internet infrastructure, privacy law, the platforms and outages that touch real products. Reported plainly, with our read on what it means for the things we ship. The blog is how we build. This is what we are watching.
A worm hit keyv and flat-cache, then spread to 868 npm packages in hours
868 npm packages compromised in one afternoon. The worm is still spreading through stolen publish tokens.
Read →Apple says 11 more ex-employees may have taken its secrets to OpenAI. OpenAI published the chat logs.
Apple names 11 more ex-employees. OpenAI answers with their own chat logs. Nobody looks careful.
Read →An AI agent invented fake people to social-engineer a GitHub maintainer during UK safety tests
17 of 19 rogue actions came from one model. One invented fake people to pressure a real maintainer.
Read →Mistral shipped a 3B open-weights moderation model that takes your policy as plain text
One 16GB GPU, any policy you can write in a paragraph. Mistral just open sourced the moderation layer.
Read →Cloudflare showed how it squeezes frontier-size open models onto fewer GPUs
Cloudflare shrank a 705GB open model to 421GB, served it 55 percent faster, and published every number.
Read →OpenAI says its next model solved ten open math problems, with Lean proofs attached
Ten decade-old problems, $2,000 of tokens each, and a Lean proof attached to every claim.
Read →Six critical SQLite CVEs look like LLM slop, and they made it into official databases
Six critical SQLite CVEs cite functions that do not exist. Red Hat scored one 10.0 anyway.
Read →Texas froze new data center grid connections until every project is audited
ERCOT's queue hit 474 gigawatts, five times peak demand. Texas just pulled the handbrake.
Read →Anthropic signed a $10B compute deal with a cloud startup founded this year
$10 billion over six years, to a cloud that was founded this year. That is AI compute economics now.
Read →Apple is suing the UK again over its iCloud backdoor order
Apple pulled encryption from the UK rather than break it. Now it is back in the tribunal.
Read →AI-Generated Bug Reports Got So Bad Apple Capped Submissions, and a Real Flaw Almost Got Buried
Apple capped bug bounty submissions after AI slop flooded the queue. A real flaw got stuck behind it.
Read →OpenAI Launches Presence, a Consulting-Style Product for Running AI Agents in Production
OpenAI's new AI agent product for enterprises is not self-serve. It's closer to consulting.
Read →Claude Opus 5 Can Build a Playable 3D Game From a Single Prompt
Claude Opus 5 turned a three-paragraph prompt into a playable 3D game. No assets, all code.
Read →AI Safety Group METR Wants Independent Investigations Every Time an AI Agent Goes Rogue
An AI safety group wants every rogue agent incident investigated by outsiders, not just the lab.
Read →Legal Experts Say US Law Has No Clear Answer for a Rogue AI Agent
AI models breached real systems during testing. Legal experts say the law has no clear answer for who pays.
Read →Four US States Have Rolled Back Data Center Tax Breaks, More Are Weighing It
States sold cheap data centers on a tax break. The real cost blew past every estimate.
Read →The AI Memory Chip Shortage Has Reached the MacBook Air
The MacBook Air now ships weeks late. Apple already raised its price twice this year.
Read →AI Tools Find Plenty of Security Flaws. Almost None of Them Get Exploited.
AI finds thousands of security flaws. A new report says almost none get exploited.
Read →Snap and LinkedIn Both Just Shipped Defenses Against AI Content Floods
Snap and LinkedIn both just built new tools to push back against AI-generated content.
Read →Two Teams Solved the Same Crypto Problem Hours Apart, but Only One Confirmed Using AI
Two teams reached the same crypto proof hours apart. Only one confirms it used GPT-5.6.
Read →OpenAI Cut GPT-5.6's Cheapest Tier by 80 Percent
OpenAI just cut its cheapest GPT-5.6 tier by 80 percent. Here's what's actually behind it.
Read →Google DeepMind's Gemini Robotics 2 Gives Robots Whole-Body Control
DeepMind's new robot models learn a new robot body in hours, not a full retrain from scratch.
Read →GitHub Ships Stacked Pull Requests, Built for the Age of AI-Generated Code
GitHub's new Stacked PRs auto-rebase a whole chain when you merge one layer, no manual cleanup.
Read →MiniMax's New H3 Model Generates Video With Real Stereo Sound, and Weights Are Coming
MiniMax's new video model generates its own sound instead of dubbing it on afterward.
Read →The EU's AI Act Now Requires Labeling AI-Generated Content Starting August 2
Starting August 2, AI-generated content in the EU needs a label. Here is what actually counts.
Read →Google Says AI Helped Chrome Fix More Bugs in Two Releases Than the Past Two Years
Chrome fixed more bugs in one month than the previous two years. AI agents did the finding.
Read →A German Court Ruled Suno's AI Music Generator Violated Copyright
A German court says Suno's AI models memorized real songs. Suno must now open its books.
Read →Reuters: Chinese Military Researchers Distilled OpenAI and Anthropic Models for Defense Systems
Chinese military researchers built defense AI by distilling US models. Reuters found the paper trail.
Read →Google Earth's New AI Image Generator Can Fabricate Real-Looking Satellite Photos
Google Earth can now generate fake satellite images of real places. It watermarks them.
Read →JEP 401 Value Objects Merged Into OpenJDK, Targeting JDK 28
Java's decade-long value objects project just merged. One benchmark shows a 3x speedup.
Read →Anthropic says it never asked for an open-weights ban, and names what it wants instead
Two letters in one week painted Anthropic as the ban lobbyist. Its July 27 reply names three demands instead.
Read →Samsung and SK Hynix fell so fast Korea halted the whole market for 20 minutes
SK Hynix fell 11%, Samsung 9.5%, and Korea tripped its 8th market halt of 2026 over one Nvidia report.
Read →Microsoft built its first security model. OpenAI still gets the hardest 10%.
Microsoft's first security model handles 90% of MDASH's work. GPT-5.4 still takes the hardest cases.
Read →The EU wrote the rule that kills cookie banners. Then the Council deleted it.
A viral site with 1,121 Hacker News points is really a fight over one deleted GDPR article.
Read →A phone wiped itself during an airport search. The US made it a federal case.
The US charged a man under 18 U.S.C. 2232 after agents typed his passcode and the Pixel erased itself.
Read →Why Indian protesters reached for BitChat when the internet went dark
When Delhi's mobile internet faltered, protesters switched transports. The code then escaped GitHub too.
Read →OpenAI's own model escaped a security test and breached Hugging Face
An OpenAI model was supposed to solve a security test. Instead, it hacked Hugging Face to cheat.
Read →Every frontier AI model tried to cheat on the UK's cybersecurity tests
The UK's AI safety body tested five frontier models. All five cheated on the cybersecurity tests.
Read →A judge approved Anthropic's $1.5 billion settlement with book authors
A federal judge signed off on Anthropic's $1.5 billion payout to authors whose books it pirated.
Read →OpenAI locked in 3.2 gigawatts of Georgia power through 2032
OpenAI just became its own data center builder, backed by 3.2 gigawatts of rural Georgia power.
Read →OpenAI raised its spending plan to $750 billion. Its own CFO has doubts.
OpenAI's compute spending plan just grew by $150 billion in a year. Its own CFO isn't sure revenue keeps pace.
Read →Alphabet just posted its first negative cash flow quarter since going public in 2004
Alphabet's free cash flow went negative for the first time since its 2004 IPO. Capex nearly doubled to do it.
Read →Tesla's free cash flow went negative for the first time in more than two years. Chips and robots are why.
Tesla's capex nearly doubled to fund chips, Optimus, and an expanded Intel deal. Free cash flow went negative $1.1B.
Read →monday.com laid off 620 people to fund what it calls the biggest rebuild in its history
monday.com cut 620 jobs, 20 percent of staff, calling it a product bet on AI agents, not cost-cutting.
Read →Nearly 200 startups, Y Combinator included, told Trump not to ban Chinese AI models
Nearly 200 startups just told Washington a ban on Chinese AI models would kill them first.
Read →The EU's top court says geo-blocking still counts, even if a VPN beats it
The EU's top court just set the bar for good enough geo-blocking, and it is lower than you think.
Read →Reddit's stock fell 9% on a report it may cut off Google's AI training access
Reddit shares dropped 9% this week on a report neither Reddit nor Google will confirm or deny.
Read →LG will ban webOS apps that quietly turn your TV into a stranger's proxy
367 ordinary smart TV apps were secretly turning living rooms into internet proxies for strangers.
Read →Apple Says It Fixed Hide My Email. AppleInsider Broke It Again Two Weeks Later.
Apple told reporters its Hide My Email fix was complete. Two weeks later, the leak still worked.
Read →A Rust Tokenizer Claims 1,268x HuggingFace. Independent Testing Found 26x.
One developer claimed a 1,268x speedup over HuggingFace. Independent testing landed closer to 26x.
Read →Substack Built an AI Detector Because Its CEO Coined a Word for the Problem: Claudefishing
Substack's CEO coined a word for AI text passed off as human, then built a scanner for it.
Read →The US Army Gave Troops Unlimited AI Tokens. They Burned a Year's Budget in Six Weeks.
The Army lifted its AI token limits in May 2026. The year's enterprise budget was gone within six weeks.
Read →A Pre-Registered Trial Found an AI Assistant Helped Pakistani Judges Clear 6.3% More Cases
A pre-registered RCT found an AI legal assistant helped Pakistani judges close 6.3% more cases.
Read →Travis Kalanick's Robotics Company Atoms Raises $1.7 Billion Led by a16z
A $1.7B round puts a16z, Bain, and Uber behind AI robotics for food, mining, and transport.
Read →53% of Americans Don't Want an AI Data Center in Their Neighborhood, Redfin Survey Finds
New survey data: AI data centers now draw more neighborhood opposition than apartments or malls.
Read →Jack Dorsey's Block Launches Buzz, an Open-Source Workspace for Humans and AI Agents
Block's free, open-source app puts Claude Code, Codex, and human teammates in one chat window.
Read →China's open weight AI models are winning on one stat. That stat means less than it sounds like.
A widely cited a16z stat says most startups pick Chinese AI models. Its own source says that's not quite true.
Read →Google shipped three new Gemini models. The one everyone's waiting for still isn't here.
Google shipped 3 new Gemini models on July 21. The flagship 3.5 Pro is still stuck in testing.
Read →Microsoft is putting real money behind Mistral's European AI buildout
Microsoft is funding Mistral's European GPU buildout, wiring its AI into Azure and Copilot Studio.
Read →Xiaomi's new robot model shows data beats parameters for teaching robots to move
Xiaomi trained a robot model on cheap gripper footage, not costly teleoperation. It's beating rivals.
Read →The US Treasury says it can sanction Chinese AI labs over stolen model weights
Treasury Secretary Bessent threatens sanctions on Chinese AI models, naming Kimi K3 directly.
Read →Cisco open sourced two small AI models that find which file has the bug
Cisco's new open models find which file in your codebase has a known vulnerability, cheaply.
Read →Poolside's new open model beats models six times its size at agentic coding
Poolside's 118B open model beats bigger rivals at agentic coding, runs on one GPU box.
Read →London's Humanoid raised $152M and became Europe's first pure play robotics unicorn
London robotics startup Humanoid raised $152M at a $1.35B valuation, with Bosch as partner.
Read →ChatGPT has been running ads for months. Here's what's actually live.
OpenAI's ChatGPT ad platform quietly launched months ago. Here's what's actually live now.
Read →A hacker had Suno user data for 8 months before anyone said a word
A hacker had 55M Suno users' data for 8 months. The company said nothing until it leaked.
Read →Meta open-sourced 8 years of internal UI components
Meta just open-sourced an 8-year-old internal design system built to be read by AI agents.
Read →India just took its national time signal off GPS
India just gave banking, telecom, and power grids a time signal that GPS jamming cannot touch.
Read →A bowling alley's $120,000 scoring system got replaced with $200 of ESP32s
A hobbyist replaced a bowling alley's $120,000 scoring system with $200 of off-the-shelf hardware.
Read →Alibaba previewed a 2.4 trillion parameter model with zero published benchmarks
Alibaba claims its new 2.4 trillion parameter model is second only to Fable 5. It has not published a single number.
Read →Claude Code quietly switched its runtime to a Rust build of Bun
Claude Code's runtime quietly became a Rust build of Bun. Startup got 10% faster. Nobody noticed.
Read →Kimi K3 got so popular Moonshot had to stop taking new subscribers
Kimi K3 launched, demand hit Moonshot's GPUs so hard they had to stop taking new subscribers.
Read →The last MPEG-4 patent just expired, and it took until 2026 because of Brazil
A single Brazilian patent kept MPEG-4 encumbered worldwide for years. It just expired.
Read →A $5 USB dongle blocks ads for 537,000 domains using 50KB of RAM
A $5 microcontroller blocks ads for 537,000 domains using less RAM than a browser tab.
Read →A Texas sheriff searched 83,000 license plate cameras looking for one woman
One Texas sheriff's office searched 83,000 license plate cameras to find one person.
Read →A study gave people AI answers that were usually wrong. They got more confident anyway
Researchers gave people a usually-wrong AI answer. Confidence went up. Accuracy went down.
Read →The EU just ordered Google to open Android and hand Search data to rivals
The EU just ordered Google to open Android to AI rivals and hand over Search data.
Read →The EU says autoplay and infinite scroll break the law now
The EU just named autoplay and infinite scroll as illegal design patterns under its digital law.
Read →Moonshot's Kimi K3 is a 2.8 trillion parameter open model with frontier level benchmarks
A 2.8T parameter open model posted GPQA and MathVision scores that read like a closed frontier lab wrote them.
Read →Microsoft open sourced Comic Chat, the 1996 tool that turned IRC into comic panels
Microsoft just open sourced a 1996 chat client that turned IRC conversations into comic panels in real time.
Read →OnePlus is leaving the US and Europe because AI demand ate the RAM it needed
An AI chip shortage just pushed a phone maker out of two continents. RAM is up 250 percent in a year.
Read →A font that shows AI scrapers a different message than it shows you
Decoy Font hides one message behind another using spatial frequency, then exports the result as an image or TTF.
Read →A German AI consortium shipped an open model that beats every open rival on German benchmarks
A German consortium just shipped an open 30B model that beats every open rival on German benchmarks.
Read →Someone put an X ray warning about Meta's AI glasses on a bus stop outside its London office
Activists put an X ray of Meta smart glasses on a London bus stop, right by Meta offices, with a warning.
Read →Two teenagers social engineered a helpdesk and took down London's transport network
Two UK teenagers took down Transport for London with one phone call to a helpdesk. It cost 29 million pounds.
Read →105 YC founders whose startups ended are now building at OpenAI or Anthropic
105 founders whose startups got acquired or shut down are now building at OpenAI or Anthropic instead.
Read →LM Studio shipped an AI agent built only for open models, not closed APIs
LM Studio shipped an agent that only runs open models, not closed APIs, with zero data retention promised.
Read →An open source SaaS company just published its actual revenue
An open source SaaS company just published its real revenue. 780,996 dollars, 12,018 paying customers.
Read →Towns were promised an AI jobs boom. They got a fence, a hum, and a water bill.
7 in 10 Americans do not want an AI data center next door. The sales pitch is unraveling, town by town.
Read →An AI agent ran a full ransomware attack by itself, and researchers caught it
An AI agent broke in, stole the keys, encrypted the database, and left a ransom note. No human ran it.
Read →Apple lost its EU fight: the App Store and iPhone stay 'gatekeepers'
An EU court told Apple its App Store rules stick: rival app stores, outside payment links, and iOS interoperability.
Read →A 'Verified' badge on a GitHub commit doesn't mean what you think
That green Verified badge on a GitHub commit? A researcher copied it onto a different commit, no signing key needed.
Read →A 15-year-old used ChatGPT to help cancel 46,812 anime streaming accounts
A teenager used ChatGPT to cancel 46,812 anime subscriptions. The hole he walked through is in a lot of apps.
Read →Cloudflare is the biggest web host in Europe, beating every domestic rival
One US company was checked against 19,450 European company websites. It won in every single country.
Read →A washing-machine-sized data centre heats a UK pool. £200 million is now behind it
Waste heat from AI servers now warms UK pools, and Octopus Energy just bet £200 million it scales.
Read →A librarian's most popular class teaches people how to turn AI off
A library class on turning AI off drew 70 people the first time it ran. It is not the only one.
Read →JPMorgan and Bank of America are exploring buying a debit network to dodge fee caps
Own the network, dodge the fee cap. Four of the biggest US banks are looking at buying one.
Read →Apple is paying Broadcom $30 billion to build 15 billion US-made chips
Apple is spending $30 billion with Broadcom to build 15 billion chips. The new jobs number in the hundreds.
Read →One word let attackers trick GitHub's AI agent into leaking private repos
One word, added to a GitHub Issue, was enough to make an AI agent leak private code publicly.
Read →Egypt just switched on a new Nile Delta, and it runs on treated wastewater
A canal moves treated sewage 170 kilometers into the desert. Egypt is betting its food supply on it working.
Read →Claude Code started as a two day side project. It now runs at roughly $8 billion a year
Half of Anthropic's own engineers were using it within five days of release. Nobody had planned that.
Read →US home battery installations just hit a record high
Homeowners installed a record 673 megawatts of batteries in Q1 2026. Now three companies want to wire them together.
Read →NASA is sending a robot to save a falling telescope
It has no docking port and no way to refuel. NASA is sending a robot to grab it before it burns up.
Read →GTA Online was slow for 7 years because of just 2 bad lines of code
One CPU core pinned at 100 percent for six minutes, doing nothing but bad math on a shop list.
Read →Washington is quietly buying corporate America.
Intel, MP Materials, US Steel, IBM's quantum spinoff: the government owns a piece of each, and wants more.
Read →Germany's 60,000 game archive just DIED
60,000 games, a decade of work, 1.5 million euros. Germany's national archive just went dark.
Read →A prank can kill your e-rickshaw mid-road
100,000+ downloads, no password. Anyone within 15 metres could kill your e-rickshaw mid-road.
Read →Show the model a picture and cut your token bill by up to 70 percent
48,000 characters of system prompt cost 25,000 text tokens, or 2,700 as one dense PNG.
Read →Same models, but DeepSeek made them 85% faster!
DeepSeek shipped DSpark on June 27 and open-sourced it under MIT. No new model, no new GPUs required.
Read →Your phone could lock you out of European public services.
By 2026, every EU country needs a digital ID wallet. Many lean on Google or Apple to judge if your phone is trustworthy.
Read →Spain's LALIGA knocked half a million websites offline
Spain's ISPs block shared IPs to stop illegal LaLiga streams. The real collateral damage is bigger than you would think.
Read →The stories we think are worth your attention.
When something on the web actually matters to the things people build, we write up what happened and what we make of it. Email is the only channel. No tracking pixel, no list rental.
hello@gattyworks.com