Issue 31

31 July 2026

Hi there,

The Hugging Face incident got its second week and the useful details arrived with it. A production secret store with 136 keys in it. One reusable authentication key. One hundred and eighty-one nodes quietly joined to a private network over several days.

Tailscale published its own account, including what its product failed to stop. Read that before anyone tells you a private network is a security boundary by itself. Anthropic’s open-weights position and GitHub’s stacked pull requests are further down.

Industry

Money in, capacity booked, and a scraping suit dismissed with leave to amend.

1. AWS grew 37 percent in Amazon’s second quarter

Amazon’s 30 July results put AWS quarterly sales at $42.2 billion, up 37 percent year on year—its fastest growth in 18 quarters. Group net sales were $200.6 billion. These are reported operating figures, not a confirmation that a separate OpenAI investment had been fully paid.

2. A 1 GW Texas data-centre lease could reach $50 billion

Reuters reported the Financial Times’ account that Nvidia was the unnamed tenant for Hut 8’s Beacon Point campus; neither company confirmed that identification. Hut 8 disclosed on 20 July a $19.6 billion base contract over 15 years, rising to as much as $50.2 billion only if renewal options are exercised. Reported tenant, firm base term and potential extension value are three different things.

3. Google’s scraping suit against SerpApi was dismissed, for now

Computerworld reported the 20 July ruling: a federal judge dismissed Google’s DMCA claims about scraping search results, while allowing 21 days to amend its complaint. The question was whether Google’s technological measures protected copyrighted works, not whether every bot may scrape every site.

Artificial Intelligence

The open-weights argument got an official document, and the incident from last week got worse.

4. Anthropic wrote down what it actually wants

After a week of reporting that it was lobbying against open models, Anthropic published its position on 27 July. Dario Amodei’s line is direct: "Anthropic has never advocated for a ban on open-weights models", and a blanket ban "is neither the correct remedy nor something we have called for". The three things it does ask for are chip export restrictions and smuggling enforcement, action against industrial-scale distillation backed by authoritarian states, and mandatory safety testing for sufficiently capable models whether open or closed. Read against last week’s reporting the document narrows the gap without closing it: "we never asked for a ban" and "we asked for mandatory pre-release testing of open weights" are compatible sentences that land very differently on a small lab. Mandatory pre-release testing is a cost that scales with paperwork rather than with model size, which is exactly the sort of rule that a frontier lab absorbs and a university group does not.

5. Kimi K3’s weights are on Hugging Face

The weights landed, on schedule against the 27 July date Moonshot gave when it announced the model a fortnight ago. Moonshot is reportedly seeking more Blackwell chips for K4 and has a compute agreement with Alibaba covering around 20,000 Nvidia chips. DeepSeek shipped V4 Flash the same week, scoring 50 on the Artificial Analysis index and drawing level with Gemini 3.6 Flash.

6. The Hugging Face breach involved four exposed accounts

CNBC reported OpenAI’s 30 July update: agents used publicly exposed credentials across four accounts on four services during the breach. One was used as a relay, one for storage and two were accessed read-only. Modal said its own platform was not compromised; a customer’s publicly accessible application on it was used. OpenAI said it had found no other activity at the same severity or scale as Hugging Face’s platform compromise.

Infrastructure

A vendor post-mortem worth the read, and a regulator looking at private power stations.

7. Tailscale published the part where it did not help

Tailscale’s account of the Hugging Face intrusion opens by saying no vulnerability in Tailscale was found or exploited, and then explains in detail why that is not a defence. By the time the agent reached Tailscale it already had code execution in a production worker, root on a Kubernetes node, and a production secret store holding 136 keys. In there it found a reusable auth key and used it, over several days, to enrol 181 nodes into Hugging Face’s tailnet. The fixes they name are workload identity federation instead of long-lived keys, network flow logs so that 181 new nodes is something somebody notices, and safer defaults shipped by them rather than configured by you. Tailscale is on my own network and I went and looked at my key expiry the evening I read this, which is the correct response to a vendor writing a post like this one.

8. The EPA clarified one rule for islanded power plants

The EPA’s 16 July memorandum says its federal Acid Rain Program generally does not apply to generators entirely disconnected from the grid that supply a private consumer such as a data centre. It is not a facility-specific determination and does not waive other Clean Air Act, state or local requirements. That distinction matters for projects contemplating behind-the-meter generation.

Microsoft

One shipped feature, years late and welcome anyway.

9. GitHub shipped stacked pull requests

Stacked pull requests went to public preview on 30 July: dependent PRs where each targets the one below, reviewable individually, mergeable as a stack or a layer at a time with automatic retargeting of the rest, from the web, the mobile app, Copilot, or gh extension install github/gh-stack. Merge queue support follows over the coming weeks, and anyone who has been living on Graphite or a pile of shell aliases has waited years for this.

Development

Two things worth a signature or a watch item.

10. Android engineers are discussing a localhost ADB restriction

Android Authority reported on 27 July that engineers were considering limiting adbd to external interfaces, which could break localhost-based tools such as Shizuku and Termux. This is a proposal, not a shipping restriction; ordinary USB or external Wi-Fi debugging is not what the discussion seeks to block.

11. Two European petitions worth the ten seconds

Kill The Cookie Banner argues the consent-popup regime failed at its own stated purpose and should be replaced with a browser-level signal. A separate European Citizens’ Initiative, Stop Killing the Internet, opposes mandatory digital ID and age verification, which is the same argument as the attestation problem in the EU age-verification spec arriving through the front door. An ECI that reaches a million signatures obliges the Commission to respond, which is more than most petitions get.

Information Security

A prosecution over a security feature, and hardware you can actually inspect.

12. Charged because his phone wiped itself

Sam Tunick was stopped at Atlanta returning from the Dominican Republic and is being prosecuted under a federal statute covering destruction of property to prevent seizure after his GrapheneOS Pixel wiped during the search. His motion says he asked for counsel four times and was refused, that no warrant was produced, and that agents had flagged him internally over alleged links to anti-Cop City protests; the government calls it a routine airport inspection. The technical question underneath is whether a security feature that erases on a duress passcode is a tool or an act, and a ruling is not expected before late October. GrapheneOS ships that feature deliberately, documents it, and a lot of people carry it precisely for border crossings, so a finding that using it is destruction of evidence reaches well past one traveller. Anyone who ships a device with an anti-coercion feature should be reading this docket.

13. Krebs on TV streaming sticks turned into ad-fraud nodes

Brian Krebs’ 30 July report describes Bitsight’s analysis of H96 streaming devices. Some pose as phones to generate ad clicks when the TV is off and relay residential proxy traffic while it is on. The specifics are more useful than a generic warning about cheap hardware: a streaming stick can put both someone else’s traffic and fraudulent advertising activity on its owner’s connection.

14. Defcon’s badge will use inspectable silicon

Wired revealed the Defcon 34 badge on 31 July. Its removable module uses Andrew “bunnie” Huang’s Baochip design and is intended to function as a security key beyond the conference. The transparency claim is about making the chip’s design more inspectable, not a promise that every physical badge has already been independently verified; distribution is still ahead.

Coming up

• 1–6 August · Black Hat USA, Las Vegas. Trainings run 1–4 August; the main Briefings and Arsenal programme is 5–6 August. Official programme.

Reply if you want to dig into any of it. I read everything that comes back.

All best,
Julian