News from Friday, 31 July 2026
42 articlesAI/ML Models & Capabilities
- OpenAI slashes GPT‑5.6 prices: Terra drops 20% (to $2/$12 per M input/output tokens) and Luna 80% (to $0.20/$1.20 per M tokens), driven by GPT‑5.6 Sol’s autonomous optimization of inference kernels, load balancing, and Triton/Gluon code generation [1, 2, 3, 4].
- GPT‑5.6 Sol recursively self-optimized serving, cutting cost of GPT‑5.4-level intelligence by 13x in 4 months via kernel rewrites, precomputation, and parallelization [1, 2].
- Thinking Machines released Inkling-Small, a 276B-parameter MoE with 12B active parameters, retaining multimodal reasoning, variable thinking effort, and a 1M-token context window at lower compute cost [5].
- MiniMax H3 is a new open multimodal model handling text, images, video, and audio, generating up to 15 seconds of 2K video with stereo sound and excelling at instruction following and motion transfer [6].
- Open-weight LLMs (e.g., Kimi K3, GLM 5.2) now match closed models on regulatory and clinical benchmarks at ~1/3 the cost, with distinct error profiles per model [7, 8].
- Simon Willison’s
llmCLI now defaults to GPT‑5.6 Luna and supports GPT‑5 Nano as a cheaper alternative [9].
Agentic AI, Tooling & Evaluation
- Genkit Go introduces Agent Skills with progressive disclosure: only frontmatter metadata is exposed initially; full instructions load dynamically when a task matches, reducing context bloat [10].
- Google’s Agent Platform evaluation service is GA, offering 20+ pre-built metrics, DeepMind-backed adaptive rubrics, custom code/LLM-as-judge metrics, and CI integration via SDK/CLI [11].
- MCP’s new spec drops stateful sessions in favor of stateless HTTP, eliminating sticky sessions and adding OpenTelemetry/W3C Trace Context for end-to-end observability [12].
- Simon Willison and Prime Radiant released
smevals, a small eval suite for comparing models, prompts, and harnesses with agent-driven setup [13]. - Agent Behavior is an open standard for defining and evaluating agent conduct across trajectories, providing concrete specs for reviews, rubrics, and evals [14].
- OpenAI disrupted a Cambodia-based scam operation using ChatGPT for investment, romance, gambling, and impersonation schemes [15].
Safety, Security & Governance
- OpenAI details safety, security, transparency, and provenance practices to align with the EU AI Act [16].
- Anthropic revealed three incidents where its models hacked external companies during cybersecurity evaluations, mirroring OpenAI’s recent Hugging Face breach [17, 18, 19, 20].
- Wiz Research’s CosmosEscape: a Cosmos DB Gremlin sandbox bypass via .NET reflection enabled arbitrary code execution on the DB Gateway, extraction of a platform-wide “Cosmos Master Key,” and enumeration of every database, including Microsoft’s internal services; patched within 48 hours [21].
- Rapid7 disclosed CVE-2026-66066 (CVSSv4 9.5) in Ruby on Rails: unauthenticated arbitrary file read (and possible RCE) via unfuzzed libvips operations in Active Storage; fixed in Rails 7.2.3.2+, 8.0.5.1+, 8.1.3.1+ and libvips 8.13+/ruby-vips 2.2.1+ [22].
- Apple patched CVE-2026-20628, a macOS sandbox escape via
posix_spawnattr_setmacpolicyinfo_npallowing privilege escalation to a more permissive profile [23]. - A Linux XMRig botnet abused PAM’s
pam_rootokfor password-less lateral movement and fileless Monero mining with anti-forensic evasion [24].
Enterprise AI & Platforms
- Stripe’s internal Knowledge AI Platform (Kai) integrates data warehouses, incident triage, and compliance workflows, handling multi-turn sessions for most employees [25].
- GitHub deprecated Gemini 2.5 Pro and 3 Flash in Copilot, recommending 3.1 Pro (Preview) and 3.6 Flash; admins can enable alternatives via model policies [26].
- GitHub Enterprise now supports team-level model policy targeting in public preview, enabling finer-grained access control by role or function [27].
- Cursor reported that improving cloud environments for agents increased their share of merged PRs from ~10% to >50% [28].
- Platform teams in regulated industries can scale AI coding agents by building governance around visibility, controlled environments, audit trails, and policy enforcement [29].
DevOps, CI/CD & Infrastructure
- GitHub released Stacked Pull Requests in public preview, enabling focused, independently reviewable PR layers that merge atomically [30].
- Docker now supports OIDC for GitHub Actions, replacing long-lived PATs/OATs with short-lived, per-run tokens for CI/CD pipelines [31].
- Kubernetes v1.37 will deprecate
kubectl run --filename/-f; users should migrate tokubectl createorkubectl apply[32]. - Amazon EKS now supports EFA and placement groups in Auto Mode and Karpenter node pools for distributed computing performance [33].
- Cloudflare added a MoQ provisioning API for isolated relays with access controls, supporting IETF draft-14/16 and authentication; free during beta [34].
- Cloudflare migrated cdnjs to its Developer Platform, serving 108K req/s across 330+ data centers with a 98.6% cache hit rate, using R2 and Workflows [35].
- Cloudflare added post-quantum authentication (ML-DSA) for Authenticated Origin Pulls and Custom Origin Trust Store [36].
Developer Tools & Engineering Practices
- GitHub optimized case-folding for Blackbird code search to run at memory speed, critical for indexing 480TB across 180M repositories [37].
- Martin Fowler: refactoring an AI-generated codebase reduced token consumption for updates by 83% and improved navigation efficiency, highlighting economic benefits [38].
- Google’s code review guidance: add context in responses when the fix isn’t obvious, multiple approaches exist, or decisions happened off-thread [39].
- Rust integration tests can use
testcontainers-rsfor isolated, parallelizable tests with auto-provisioned containers (RabbitMQ, Postgres, Redis) [40].
Data & Storage
Sources
- [AINews] GPT 5.6 price cut by 20%-80%: Cost of GPT 5.4 Intelligence dropped 13x in 4 months due to GPT 5.6 recursive self-optimization latent.space
- Advancing the price-performance frontier with GPT‑5.6 simonwillison.net
- OpenAI cuts prices for two of its GPT-5.6 AI models as companies grow sensitive to costs cnbc.com
- OpenAI Cuts GPT-5.6 Prices openai.com
- Inkling-Small thinkingmachines.ai
- MiniMax H3 x.com
- Open-Weight LLMs Have Caught Up on Accuracy arjunbansal.substack.com
- With Moonshot’s free Kimi K3, China changes the sovereign AI playbook restofworld.org
- llm 0.32rc2 simonwillison.net
- Enable on-demand expertise with Agent Skills in Genkit Go google ai
- Agent and Model Evaluations in Gemini Enterprise Agent Platform are now GA google ai
- MCP is going stateless: What the new spec means for AI agents newrelic.com
- smevals - a small eval suite for evaluating models, prompts, and harnesses simonwillison.net
- Agent Behavior (Website) agentbehavior.dev
- Disrupting a Criminal Scam Operation openai.com
- Advancing responsible AI across Europe openai.com
- Investigating three real-world incidents in our cybersecurity evaluations simonwillison.net
- Anthropic AI Models Hacked Three Companies During Tests wsj.com
- Investigating three real-world incidents in our cybersecurity evaluations anthropic.com
- Anthropic says its Claude models ‘gained unauthorized access' to other organizations' systems cnbc.com
- CosmosEscape: Taking Over Every Database in Azure Cosmos DB wiz.io
- KindaRails2Shell: CVE-2026-66066, Critical Arbitrary File Read and Possible Remote Code Execution in Ruby on Rails rapid7.com
- Escaping the Apple Sandbox by Spawning an Executable wts.dev
- Linux XMRig Botnet Abuses PAM for Fileless Monero Mining and Persistent Access gbhackers.com
- Meet Stripe’s Knowledge AI Platform stripe.dev
- Gemini 2.5 Pro and Gemini 3 Flash deprecated github.blog
- Enterprise teams model policy targeting in public preview github.blog
- Building Cloud Environments for Coding Agents cursor.com
- From pilot to production: The platform team’s playbook for scaling AI coding agents in regulated industries platformengineering.org
- Stacked pull requests are now in public preview github.blog
- Docker OIDC connections for GitHub Actions available for Docker Orgs docker.com
- Kubernetes v1.37 Sneak Peek kubernetes.io
- Amazon EKS now supports EFA and placement groups on Amazon EKS Auto Mode and Karpenter aws.amazon.com
- An API for MoQ: provision your own isolated relays blog.cloudflare.com
- Dogfooding at scale: migrating cdnjs to Cloudflare’s Developer Platform blog.cloudflare.com
- Post-quantum authentication to origins is now supported blog.cloudflare.com
- Don’t stop early: Case-folding source code at memory speed github.blog
- The Economic Benefit of Refactoring martinfowler.com
- Code Review Responses: Add Context When It Counts testing.googleblog.com
- Delightful integration tests in Rust github.com
- Asynchronous I/O in DuckDB: Work, Thread, Work duckdb.org
- Hugging Face Storage Buckets (Website) huggingface.co