Issue 29

17 July 2026

Hi there,

Somebody put a proxy in front of xAI’s coding CLI this week and watched it upload a twelve-gigabyte repository, in seventy-three chunks, to a Google Cloud bucket nobody had been told about. The .env file went too, keys and all, unredacted.

The upload stopped after the researcher published the trace. I’d still want an answer to two questions before running that CLI on a client repository: who had access to the bucket, and how long were the snapshots kept?

Industry

The macro layer: lawsuits, acquisitions, and the bill at the end of the month.

1. Apple sued OpenAI over 400-odd hires

Apple’s complaint alleges that a former iPhone engineer downloaded confidential hardware files while working on OpenAI hardware, and names former Apple vice-president Tang Tan, now OpenAI’s chief hardware officer. It says more than 400 former Apple employees work at OpenAI. These are allegations in a lawsuit, not findings of trade-secret theft.

2. AWS showed one customer an estimated $1.7 billion

An AWS billing display error showed estimated charges of a different magnitude entirely: the account that reached Hacker News normally spends under $5 a month and was shown $1.7 billion. Others reported $78 million, $1 billion and, on one enterprise account, $3 trillion. A commenter described a per-gigabyte/per-byte unit error in a separate past incident; the cause of this incident was not established in the thread. These were estimates, not issued invoices, and the affected account holder reported no charge.

3. Stripe and Advent reportedly bid for PayPal

TechCrunch reports that Stripe and Advent jointly offered about $53.4 billion for PayPal, citing Reuters. This is a reported offer, not an agreed takeover: PayPal had not publicly responded at the time. Combining the two payments businesses would be consequential for merchants, if it happens.

Artificial Intelligence

Two open models arrived, and a coding agent turned out to be shipping more than it admitted.

4. Kimi K3 is 2.8 trillion parameters, and the weights are coming

Moonshot’s Kimi K3 is a 2.8-trillion-parameter model on their Kimi Delta Attention with a one-million-token context window, native vision, MXFP4 weights, and a Stable LatentMoE that activates 16 of 896 experts. Their own write-up is unusually honest about position: overall performance "still trails the most powerful proprietary models, Claude Fable 5 and GPT 5.6 Sol", while beating everything else they tested. It took first place on the Frontend Code Arena benchmark and scored 88.3 on Terminal Bench 2, and the weights were slated for public release by 27 July. Thinking Machines put out its own open-weights model, Inkling, the same week.

5. Grok Build uploaded whole repositories to a bucket

A wire-level analysis using mitmproxy found xAI’s Grok Build CLI doing two separate things. Files the agent read, .env included, went to POST /v1/responses verbatim and unredacted. Independently of anything the agent read, the tool uploaded complete workspace snapshots as git bundles through POST /v1/storage: on a 12GB test repository, 73 chunks of about 75MB, 5.10 GiB in total, all accepted. The ratio between the two channels was about 27,800 to one, which is how you tell bulk exfiltration from model context. The destination was a Google Cloud bucket named grok-code-session-traces. Uploads have since stopped and xAI open-sourced the tool under Apache 2.0, which is a reasonable response and not a substitute for having said so first.

6. The token bill before you type anything

In Systima’s 12 July measurement, a one-line task sent roughly 33,000 tokens of Claude Code scaffolding and tool definitions before the user’s prompt, against about 7,000 for OpenCode on the same model. These are measurements of pinned versions and a particular setup, not a universal cost ranking: the researchers also found a multi-step task on which Claude Code used fewer total tokens by batching requests.

Infrastructure

Where the compute is going, and who has started saying no to it.

7. New York paused hyperscale data-centre permits

Governor Hochul’s 14 July order pauses new discretionary state environmental permits for hyperscale data centres whose applications were not already deemed complete. The pause may last up to one year while the state prepares a generic environmental-impact statement. A pipeline that assumed these permits were a formality now has a political variable in it.

8. CXMT lined up a major Shanghai listing

Reuters reported on 14 July that Chinese memory maker CXMT expected to raise 57.9 billion yuan—about $8.6 billion—through its Shanghai IPO. The final proceeds depend on the offering, but it is a large capital raise for a domestic memory-chip supplier.

Microsoft

Search gets less hostile, and security gets reorganised.

9. Windows 11 search is testing clearer local results

Microsoft’s 13 July Windows Insider announcement describes an experimental, gradual rollout—not a general Windows release. When a local app, setting or file is a better match, Search should rank it ahead of web and Store suggestions. Users can also choose whether those suggestions appear, and promotional web results have been removed.

10. Microsoft’s security unit reportedly cut roles in an AI overhaul

PYMNTS, citing reporting by The Information, says Hayete Gallot’s security division consolidated engineering teams and cut several hundred jobs while shifting attention toward AI security tools. Microsoft declined to comment on that report. Security Copilot, code-vulnerability scanning and monitoring corporate AI agents were among the priorities described; the headcount and product direction are reported, not a Microsoft announcement.

Development

A proposed attestation design raises questions for alternative operating systems.

11. The EU’s age-verification draft raises platform-attestation questions

The technical specification for the EU’s age-verification app leans on Google’s Play Integrity API and Apple’s App Attestation to establish that a device is trustworthy. A discussion in the technical-specification repository asks how alternative Android distributions and other platforms could meet the proposed attestation requirements. The discussion does not by itself establish that all compliant wallets must rely on these two vendor APIs. The repository discussion raises a digital-sovereignty question about alternatives to vendor-controlled attestation; it does not settle the final design. Worth reading if digital sovereignty is a phrase your organisation uses in slides.

12. 1Password’s agent sign-in keeps passwords outside the model

1Password announced its Claude browser integration on 16 July. It says a user approves credentials for each task, and 1Password injects the password and one-time code without placing either in the model’s context. Those are the vendor’s design claims; they do not mean an agent has blanket access to the vault.

Information Security

A network defender who dismissed the intruders, and a purchase button that means less than it says.

13. DHS twice dismissed intrusion alerts as false positives

Nextgov/FCW reports that personnel twice dismissed suspicious activity on the Homeland Security Information Network between mid-May and early June. Investigators confirmed the breach on 4 June after backdoors appeared and credential files were stolen. DHS described an incident on a specific unclassified legacy system; the attackers’ affiliation remained unknown.

14. Sony says purchased Studio Canal titles will disappear

PlayStation’s notice says buyers will lose access to previously purchased Studio Canal titles from 1 September 2026, when they will be removed from video libraries because of a licensing agreement. It is a concrete reminder that a platform’s purchase button does not guarantee permanent access.

Coming up

• 1–6 August · Black Hat USA, Las Vegas. Trainings run 1–4 August; the main Briefings and Arsenal programme is 5–6 August. Official programme.

Reply if you want to dig into any of it. I read everything that comes back.

Cheers,
Julian