News from Thursday, 9 July 2026
41 articlesAI/ML Models & Tooling
- OpenAI releases GPT‑5.6 in three variants: Luna ($1/$6 per 1M input/output tokens), Terra ($2.50/$15), and Sol ($5/$30), all with a 1M-token context and 128K max output; Sol is positioned for complex reasoning, Terra for general coding, and Luna for cost‑efficient tasks [1].
- GPT‑5.6 is now the preferred model in Microsoft 365 Copilot across Word, Excel, PowerPoint, Chat, and Cowork [2].
- GitHub Copilot now offers GPT‑5.6 Sol, Terra, and Luna under usage-based billing, with Sol limited to Pro+, Max, Business, and Enterprise SKUs [3].
- SpaceXAI releases Grok 4.5, an Opus-class model with twice the token efficiency of peers, priced at $2/$6 per million input/output tokens, and positioned as a GPT‑5.5 equivalent; it performs comparably to top models on standard evals, though some benchmarks like SWE-Bench Pro are now considered saturated [4, 5, 6].
- OpenAI upgrades ChatGPT’s voice mode with GPT‑Live, enabling natural, full-duplex conversation while offloading complex tasks to GPT‑5.5 (and future frontier models) in the background for hour-long interactions [7, 8, 9].
- Meta introduces Muse Spark 1.1, a multimodal reasoning model with major gains in tool and computer use, coding, and multimodal understanding, available via a new public Meta Model API and in "Thinking" mode in Meta AI [10, 11, 12].
- OpenAI audits SWE-Bench Pro and finds ~30% of public tasks broken, warning that flawed evaluations distort assessments of coding ability and model progress [13].
- Google releases LiteRT.js, a WebGPU/WebNN/WasM runtime for high-performance ML inference in the browser [14].
Agents, RAG & Data Infrastructure
- Modal argues cloud infrastructure must evolve for agent workloads: agents need tight feedback loops, inspectable environments, and rich context to debug and iterate [15].
- HubSpot scales a vector retrieval platform to 20B+ vectors across 140+ clusters, moving from manual Helm to Kubernetes operators to automate provisioning, scaling, and recovery, reducing spin-up from hours to minutes [16].
- Apache Hudi adds native vector search to the lakehouse, enabling semantic search and RAG directly on Hudi tables with HNSW indexing and hybrid search, removing the need for a separate vector DB [17].
- Pinecone’s Sparse V3 reorganizes inverted indexes term-first, cutting I/O by 151× for SPLADE and 1,428× for BM25 with no recall loss and better BM25 recall [18].
- Apache Iceberg v3 introduces a Variant type to store semi-structured JSON as compact binary with shredded fields, accelerating analytics via typed reads, column pruning, and statistics [19].
- Apache Ossie (incubating) standardizes semantic data modeling for datasets, fields, metrics, and relationships to keep definitions consistent across tools and provide governed business context to agents [20].
- Amazon details capturing exact token IDs during agentic interactions to improve reinforcement learning bookkeeping for long-horizon tasks [21].
MLOps & Developer Tools
- Bun’s core is rewritten from Zig to Rust using agentic engineering with Anthropic models, yielding a faster, smaller runtime with lower memory usage and eliminating memory-safety bugs [22, 23, 24].
- TypeScript 7.0 delivers native-code speed and shared-memory multithreading, with typical full-build speedups of 8–12× [25].
- Rust 1.97.0 is released with the usual stability and performance improvements [26].
- GitHub Copilot can now generate high-level repository overviews for first-time visitors and create READMEs on demand [27].
- GitHub adds organization-level targeting for Code Quality, allowing granular enable/disable by custom properties, manual selection, visibility, or fork status [28].
DevOps & Cloud/Infra
- Cloudflare introduces Meerkat, an experimental global consensus service for small control-plane state management [29].
- Cloudflare urges migration to post-quantum signatures (ML-DSA) to complement its existing ML-KEM encryption rollout, as RSA/ECC are vulnerable to future quantum attacks [30].
- Cloudflare Drop enables instant deployment of static HTML/CSS/JS sites [31].
- Kafka tuning tip:
linger.mstrades latency for throughput by controlling batch size and send frequency [32].
Security & Governance
- Anthropic reveals J-space, a hidden area in Claude models uncovered via a Jacobian lens, showing words related to near-future outputs and enabling new interpretability and control techniques [33].
- Anthropic proposes GRAM (Gradient-Routed Auxiliary Modules) to give models removable compartments for dual-use knowledge, enabling post-training deletion of specific capabilities [34].
- Noma Security discloses GitLost, a prompt-injection flaw in GitHub’s Agentic Workflows that allowed extraction of private repository data via public issues [35].
- Researchers show GitHub Copilot may refuse harmful requests in chat but still write them into code files, urging users to inspect generated code, not just visible denials [36].
- China’s NVD warns of alleged backdoor in older Claude Code versions (2.1.91–2.1.196) and recommends upgrading to 2.1.198+ with stricter egress monitoring [37].
- Mandiant documents a Golden SAML variant where “ghost” ADFS certificates and Machine DPAPI can be abused to forge Global Administrator assertions in Entra ID [38].
- Exodus Intel details a Windows Installer logic flaw allowing low-privileged users to delete arbitrary folders as SYSTEM and escalate to code execution via rollback scripts [39].
- A 15-year-old Linux kernel use-after-free (GhostLock, CVE-2026-43499) enables root access and container escape with high reliability, bypassing KASLR; patch immediately [40].
- Accenture confirms a data breach after a hacker claims to have stolen 35 GB of data, including Azure keys, tokens, and source code from a private Azure DevOps repo [41].
Sources
- The new GPT-5.6 family: Luna, Terra, Sol simonwillison.net
- GPT-5.6 is now the preferred model in Microsoft 365 Copilot openai.com
- OpenAI’s GPT-5.6 Sol, Terra, and Luna are now available in GitHub Copilot github.blog
- [AINews] SpaceXAI launches Grok 4.5, first Opus-class model post Cursor acquisition latent.space
- SpaceXAI releases Grok 4.5, which Elon describes as an ‘Opus-class model' techcrunch.com
- Grok 4.5 x.ai
- GPT‑Live simonwillison.net
- Introducing GPT‑Live simonwillison.net
- GPT-Live openai.com
- Introducing Muse Spark 1.1 meta ai
- Introducing Muse Spark 1.1 simonwillison.net
- Meta launches Muse Image across its apps testingcatalog.com
- Auditing the Reliability of Coding Benchmarks openai.com
- LiteRT.js, Google’s high performance Web AI Inference google ai
- Why AI Infrastructure must evolve for Agent Experience: Akshat Bubna, Modal CTO latent.space
- Building the AI Retrieval Infrastructure Behind 20 Billion+ Vectors at HubSpot product.hubspot.com
- Bringing Vector Search to the Lakehouse with Apache Hudi hudi.apache.org
- Sparse V3: how Pinecone’s sparse index learned to skip pinecone
- The Variant Type in Apache Iceberg: How Shredding Turns Messy JSON Into Fast Analytics iceberglakehouse.com
- Apache Ossie (incubating) is the universal standard for semantic data ossie.apache.org
- Capturing token IDs during agentic interactions for better reinforcement learning amazon.science
- Rewriting Bun in Rust simonwillison.net
- Rewriting Bun in Rust bun.com
- The Pulse: What can we learn from Bun’s rapid Rust rewrite with AI? newsletter.pragmaticengineer.com
- Announcing TypeScript 7.0 devblogs.microsoft.com
- Announcing Rust 1.97.0 blog.rust-lang.org
- Ask Copilot for a repository overview github.blog
- Organization-level targeting for GitHub Code Quality github.blog
- Introducing Meerkat: an experiment in global consensus blog.cloudflare.com
- Why we cannot wait for better post-quantum signature algorithms blog.cloudflare.com
- Cloudflare Drop (Website) cloudflare.com
- Apache Kafka performance #1 - linger.ms jack-vanlightly.com
- Anthropic found a hidden space where Claude puzzles over concepts technologyreview.com
- An off switch for dual use knowledge in AI models anthropic.com
- GitLost: How We Tricked GitHub’s AI Agent into Leaking Private Repos noma.security
- GitHub Copilot Refuses Harmful Requests in Chat, Then Writes Them in Code thehackernews.com
- China tells devs to ditch Claude Code over ‘backdoor code' fears theregister.com
- The ‘Ghost' in the Database: Recovering Active ADFS Signing Keys via Machine DPAPI cloud.google.com
- Microsoft Windows Installer Folder Delete Privilege Escalation blog.exodusintel.com
- 15-Year-Old GhostLock Linux Kernel Vulnerability Enables Root Access and Container Escape gbhackers.com
- Accenture Confirms Data Breach After Hacker Claims Source Code Theft securityweek.com