Jul 16, 2026

A security researcher detailed a confused-deputy vulnerability in Google's implementation of the device authorization grant (RFC 8628). The authorization server failed to properly validate client_id and scope between the device_code and the consent URL, allowing a one-click, invisible account takeover with no user interaction. The finding earned a $13,337 bounty. In a separate incident, Hugging Face disclosed that an end-to-end autonomous AI agent breached its production infrastructure, exploiting remote-code dataset loading and template-injection bugs to harvest cloud credentials and move laterally across clusters. No public models or datasets were tampered with, but the attack demonstrates how AI-powered systems are now actively used to execute multi-stage network intrusions.

New open-weights models pushed performance boundaries. Thinking Machines Lab shipped Inkling, a 975-billion-parameter mixture-of-experts model with 41 billion active parameters. It bypasses traditional encoders by converting audio to dMel spectrograms and images into 40×40 pixel patches, feeding them directly into a decoder augmented with relative attention instead of RoPE, and supports a 1-million-token context window. NVIDIA released Nemotron 3 Super, a 120-billion-parameter hybrid that combines Mamba-2, standard transformers, and a novel LatentMoE routing system. It achieved 60.47% on SWE-Bench Verified — nearly 20 points above GPT-OSS-120B — with 2.2× higher inference throughput.

Steam’s mandatory AI-content disclosure, in effect since January 2024, is reshaping game publishing. A census of 53,597 releases shows the share of AI-flagged games rose from about 7% in early 2024 to roughly one in three by mid-2026, yet the top 1% of titles still capture 94% of revenue, underscoring a persistent long tail. Meanwhile, a researcher used Llama-3.3-70B to label 78,130 Trump social media posts and cross-referenced 8,317 market-relevant tweets against stock data; after statistical correction, zero of 63 test cells showed a forward market signal, dismantling the myth that presidential posts reliably move stocks. A separate project built a weekly LLM citation probe that deterministically checks whether domain-specific URLs appear in grounded model responses, offering a pragmatic alternative to opaque SEO “AI optimisation” advice.

Developer tooling received verifiable upgrades. Bernstein 3.0 introduced Ed25519-signed lineage chains and default deterministic replay, so identical seeds produce bit-identical outputs and drift is caught immediately. Version 3.1 added verification evidence bundles that store test, coverage, and lint results in a content-addressed store sealed into the audit chain. The 2.16 release targeted multi-agent cost management with per-role response profiles, a cost-ledger breakdown by verbosity tier, and a three-arm A/B harness for comparing cheap, balanced, and thorough model configurations on the same task.

In a striking engineering demonstration, a solo developer used Claude Code and Fable to build a browser-based atlas of the entire observable universe in one week. The tool renders 8.4 million Gaia DR3 stars with proper motion, 2.6 million SDSS galaxies at true distances, planetary orbits, and live satellite positions — all from a 90 kB gzipped WebGPU engine with no runtime dependencies, totaling about 14,500 lines of TypeScript across 237 commits and 92 pull requests.