Week of July 13, 2026

From finding bugs to writing them

The week’s through-line in security was AI crossing from finding bugs to writing the exploits. Praetorian published a two-part, first-party account (part one, part two) of using Claude Code on Opus 4.6 to build two working FreeBSD chains that escape a VNET jail to kernel code execution on the host. Only one bug is discussable and patched: CVE-2026-3038, a 127-byte RTSock stack overflow, fixed in FreeBSD-SA-26:05.route within a day. The durable lesson is method. Single-shot exploit generation failed reliably, while a staged L0-L4 decomposition that isolates one variable per level (overflow, shellcode, canary and KASLR, full chain) made the agent tractable. The author is candid about the failures: the model “cheated” by compiling a kernel module holding the ROP gadget it could not find, triggered a use-after-free only by editing kernel source, and drifted after context compaction. He claims no autonomy, estimating a one-to-two-week job compressed into a coached weekend on a ~$100/month subscription, and calls the volunteer FreeBSD security team overwhelmed by LLM-driven disclosures.

What skilled humans still do that agents cannot is the counterpoint. VEGA (nebusec) documented GhostLock (CVE-2026-43499), a Linux kernel stack use-after-free in the rtmutex Requeue-PI path that existed from 2011 to an April 2026 fix, needs only CONFIG_FUTEX_PI=y and no privileges, and ships a 97%-reliable exploit that captured a kernelCTF flag remotely in about five seconds for a $92,337 reward. The chain forces a deterministic deadlock rollback, reclaims the freed stack frame via prctl(PR_SET_MM_MAP), and pivots through an inet6_protos function-table overwrite to userspace privilege escalation. A preprint sharpens the gap between the two: From Controlled to the Wild argues today’s capture-the-flag and RCE benchmarks say almost nothing about how pentesting agents perform on real targets, and proposes scoring by validated vulnerability discovery instead.

The tools as the target

Three write-ups show the tools engineers now run are themselves soft targets. Ayush Paul’s “Memory Heist” is a working proof-of-concept that exfiltrates a Claude user’s name, employer, and a security-question answer with no suspicious user action: a fake Cloudflare “turnstile” instructs the assistant to spell stored data one letter at a time into attacker-controlled URLs that web_fetch then follows. Anthropic told him it had already found the issue internally, paid no bounty, and has since blocked web_fetch from following external links.

Mindgard went to full disclosure on a Cursor flaw it says has sat unpatched for seven months: a git.exe planted in a repository root runs automatically and repeatedly, with no interaction, when the project opens on Windows, verified against Cursor 3.2.16. Every claim comes from Mindgard; the article carries no response from Cursor. And a crates.io maintainer dissected a targeted supply-chain attack delivered through a fake VC interview, where a “run typecheck” TypeScript test repo hides a patch-package patch that installs a RAT he names PinpinRAT, using git update-index —skip-worktree to hide the patch from git status and evading every VirusTotal engine. The payload fires on the exact build command an interviewer would ask a candidate to run.

Open weights, humbler hardware

Thinking Machines released Inkling, the first open-weights model from Mira Murati’s lab: a 975B-parameter (41B active) multimodal MoE with a 1M-token context, pretrained on 45T tokens. It breaks from the standard recipe with learned relative positional embeddings instead of RoPE, an encoder-free multimodal path (dMel audio, 40x40 image patches), and reasoning effort made controllable by varying per-token cost across 30M-plus RL rollouts. The team says it uses about a third the tokens of Nemotron 3 Ultra at equal Terminal Bench 2.1 score, and is candid that Inkling is “not the strongest overall model available today, open or closed,” pitching it as a customization base. All benchmarks are self-reported.

Two hobbyist projects show how far those weights now stretch on modest iron. colibri runs GLM-5.2, a 744B MoE, on a 25GB machine in ~1,300 lines of dependency-free C by streaming routed experts from disk, exploiting that only ~11GB of experts change per token; it is disk-bound at 0.07-1.06 tok/s, and int4 accuracy is unbenchmarked. Separately, a patched ik_llama.cpp runs Gemma 4 26B at ~5 tok/s on a 13-year-old GPU-less Xeon, after a Claude instance diagnosed a silent dispatcher fall-through that had been feeding the model uninitialised expert tensors.

The bill comes due

Playcode argues per-million-token pricing is not comparable across vendors because each tokenizer cuts identical bytes into a different number of billed pieces. Measured against real paid invoices, Claude’s new tokenizer (Sonnet 5, Opus 4.8) produces about 32% more tokens than its old one on code and English at the same sticker, and 1.5-1.73x GPT’s o200k on code; the authors reject inflated “2x-4x” claims and bound the honest range at 1.4-1.73x. The apparent Sonnet 5 price cut is an intro window closing 31 August 2026, after which the same code costs ~32% more than Sonnet 4.6.

The macro bill shows strain. S&P cut Oracle to BBB-, one notch above junk, citing a forecast ~$42B FY2027 free-cash-flow deficit and capex guidance raised to $90-95B, and designating OpenAI, about half of Oracle’s $638B undelivered backlog, a “central credit risk” whose payments depend on the boom continuing. New York became the first US state to freeze the supply side: Governor Hochul’s executive order pauses permitting of hyperscale datacenters above 50 MW for a year while regulators write energy and water standards, bypassing a broader bill the legislature had already passed.

Who sets the rules

Linus Torvalds ended a long linux-media thread by declaring “Linux is not one of those anti-AI projects,” telling objectors to fork it or walk away and vowing to “very loudly ignore” anyone arguing to stop others from using LLM tools, while conceding they add maintainer workload and “keep finding embarrassing bugs.” The trigger was Sashiko, an opt-in AI review tool whose project page claims a 53.6% bug-detection rate on already-reviewed patches, per Tom’s Hardware. Brussels moved on distribution: the European Commission issued two DMA decisions ordering Google to give rival AI assistants (it names ChatGPT, Claude, Perplexity) Android access comparable to Gemini’s, and to share Search data with competing engines and chatbots, with deadlines of January 2027 for Search and July 2027 for Android and non-compliance fines up to 10% of global turnover.

Quick hits

• OpenAI’s CDN hosts a PDF claiming its GPT-5.6 Sol Ultra proved the ~50-year-old Cycle Double Cover Conjecture; the proof text is not extractable from the submission and no machine-check or review is established, so it stands as an unverified claim.
• MIRA, an autonomous LLM agent running full emergency-department workflows in a sandboxed FHIR EHR, reported 87.8% matched diagnostic accuracy against 78.1% for board-certified physicians on 500-plus MIMIC-IV cases; the study is retrospective and simulation-based.
• A probe on coding-agent hidden states decodes whether an edit will parse or pass tests up to ~25 steps before it is written (AUC to 0.83), a possible basis for cheap correctness monitors.
• A developer RL-trained an agent whose actions are writing complete RL training jobs, with real GPU runs as the reward, for ~$1,275; reward rose from ~0 to ~0.63 over 54 steps and transferred to a held-out task.
• “The Refusal Residue” finds alignment-faking probes are model-conditional (AUROC 0.87 on Llama, chance on Qwen) and that standard probe evaluations are badly inflated, naive linear probes reaching a spurious AUROC 1.0.
• Tower Semiconductor committed up to $3B to revive a shuttered Panasonic-era fab for silicon photonics, disclosing $1.3B in contracted 2027 revenue with $290M prepaid, as AI interconnects shift from copper to optical.
• Chips and Cheese dissects ACE, the x86 industry’s proposed outer-product AMX successor, modelling ~1.5 TB cache traffic on a 32K INT8 multiply against AMX TMUL’s ~1.7 TB, before any silicon exists.
• Richard Feldman’s 487-day Rust-to-Zig compiler rewrite logged 10 memory-corruption bugs across 431 Zig-era reports against 21 across 2,596 Rust-era, concluding the language made no appreciable safety difference for machine-code emission.