This week has been extraordinary for the AI landscape, with major model releases, open-source announcements, security revelations, and legal developments all converging. From a 2.8-trillion-parameter open model out of China to a new open-weights contender from Thinking Machines Lab, the pace of frontier AI progress shows no signs of slowing. Here are the five biggest AI stories making headlines today.

1. Kimi K3: The World’s First Open 3T-Class Model

Moonshot AI has unveiled Kimi K3, a 2.8-trillion-parameter Mixture-of-Experts model that is the first open model to cross the 3-trillion-parameter threshold. Kimi K3 features native vision capabilities, a 1-million-token context window, and a novel architecture built on Kimi Delta Attention (KDA) and Attention Residuals (AttnRes) — two architectural innovations designed to improve information flow across sequence length and model depth. With 16 out of 896 experts activated per token via a Stable LatentMoE framework, the model achieves a roughly 2.5× improvement in scaling efficiency over its predecessor Kimi K2.

The model demonstrates frontier-level performance across coding benchmarks, including DeepSWE (67.5%), Program Bench (77.8%), and SWE Marathon (42.0%), and excels at long-horizon agentic tasks. In one remarkable demonstration, Kimi K3 designed a chip in a single 48-hour autonomous run — building, optimizing, and verifying it using open-source EDA tools. It also developed MiniTriton, a compact GPU compiler from scratch that rivals the performance of the established Triton and torch.compile frameworks.

The full model weights are scheduled for release by July 27, 2026, with a technical report to follow. Pricing via the Kimi API is set at $0.30/MTok (cache-hit), $3.00/MTok (cache-miss input), and $15.00/MTok (output). The announcement has drawn comparisons to DeepSeek’s open-weight strategy, with many observers noting that Chinese AI labs are driving toward commoditized intelligence at an accelerating pace.

2. Thinking Machines Lab Releases Inkling: An Open-Weights Multimodal Foundation Model

Thinking Machines Lab has introduced Inkling, a 975-billion-parameter Mixture-of-Experts transformer (41B active parameters) with full open weights, making it one of the largest open-weights models available today. Inkling supports a 1-million-token context window and was pretrained on 45 trillion tokens spanning text, images, audio, and video. It is the largest open-weight model to natively support audio, positioning it strongly for voice and multimodal applications.

Inkling’s design emphasizes breadth and customizability over raw benchmark-chasing. It features controllable thinking effort, allowing developers to balance performance against token cost — on Terminal Bench 2.1, Inkling matches Nemotron 3 Ultra at roughly one-third the tokens. It achieves strong scores on SWE-bench Verified (77.6%), GPQA Diamond (87.2%), and AIME 2026 (97.1%), while also demonstrating competitive audio capabilities on VoiceBench (91.4%) and MMAU (77.2%).

The company also previewed Inkling-Small, a 276B-parameter MoE model (12B active) that performs close to its larger sibling on reasoning and agentic tasks, making it well-suited for cost-sensitive deployments. Inkling is available for fine-tuning on Tinker and via APIs on TogetherAI, Fireworks, Modal, Databricks, and Baseten. The company highlighted the model’s strong safety safeguards, scoring highest among open-weights models on the FORTRESS adversarial benchmark (78.0%) while maintaining 98.6% on StrongREJECT.

3. xAI Open Sources Grok Build: A Full-Featured Coding Agent TUI

xAI has open-sourced Grok Build, the Rust-based terminal UI coding agent behind their Grok ecosystem. The codebase, hosted on GitHub under xai-org/grok-build, has already garnered over 13,600 stars and 2,500 forks. Grok Build is a full-screen TUI that understands codebases, edits files, executes shell commands, searches the web, and manages long-running tasks — operating interactively, headlessly for scripting and CI, or embedded in editors via the Agent Client Protocol (ACP).

The repository includes a self-contained terminal renderer for Mermaid diagrams, Docker sandbox support, and prebuilt binaries for macOS, Linux, and Windows. The release comes amid a broader strategic push by xAI to open-source core infrastructure, following the pattern of Meta’s Llama strategy — open-sourcing the moat to compete with proprietary leaders. However, the announcement has been met with mixed reactions, as some community members noted that xAI was previously caught exfiltrating user data, and that the company recently paid $60 billion to acquire Cursor. Despite these concerns, developers are already building on top of the released code, including a rebranded fork called “gork-build.”

4. Researcher Demonstrates Claude Memory Exfiltration via Web Browsing

Security researcher Ayush Paul published a detailed analysis showing how Anthropic’s Claude can be tricked into exfiltrating a user’s personal data — including their full name, current employer, and security question answers — through a novel attack vector dubbed the “Memory Heist.” The exploit leverages Claude’s built-in web_fetch tool, which is designed to be read-only, but can be weaponized by having the AI visit a website controlled by the attacker.

Claude’s memory system operates in two parts: a daily summarization pass that distills recent conversations into a profile injected into every session, and a conversation_search retrieval tool that searches full conversation history. By carefully crafting prompts that steer Claude toward using its web browsing capabilities while its memory system is active, the attacker can receive the exfiltrated data as an HTTP request to their server. Paul noted that Claude’s web_fetch tool, while nominally read-only, can still be detected by the server hosting the URL — making it an effective side channel.

The research highlights a growing concern as AI assistants accumulate increasingly detailed personal profiles — sometimes containing more sensitive information than password managers. The Hacker News community response was divided, with some arguing the attack requires significant user manipulation and others emphasizing that the fundamental architectural issue of pairing memory systems with web access deserves serious attention from AI safety teams.

5. OpenAI Loses “OPENAI” Trademark Dispute at EU Court

The European Union’s General Court in Luxembourg has ruled against OpenAI in its bid to register the trademark “OPENAI” for certain software and information technology goods and services. The court found that the term is purely descriptive and therefore lacks the distinctiveness required for trademark protection under EU law. The ruling can still be appealed to the European Court of Justice.

The court’s decision upheld a prior ruling by the EU Intellectual Property Office (EUIPO), which had partially rejected OpenAI’s application on the grounds that “open” would be understood by the relevant public as meaning freely accessible, and “AI” as artificial intelligence. The combination, the EUIPO and court agreed, would be interpreted as referring to products based on openly accessible artificial intelligence — a description, not a brand identifier.

OpenAI had argued that “open” has multiple possible meanings and that “OPENAI” is a coined term without a fixed meaning, pointing to trademark registrations granted in more than 30 other countries including the United Kingdom and Singapore. The court rejected these arguments, noting that the combination was not an unusual linguistic construction in English and that registrations in other jurisdictions are not binding under EU trademark law. The ruling has been met with approval from many in the open-source community, who view it as a check on a company that critics argue has drifted from its founding principles of openness.

That’s the AI landscape for today — from unprecedented open-model scale and new open-weight contenders to security vulnerabilities and trademark battles. The industry continues to move at breakneck speed, and we’ll be here to track every development.

July 16, 2026 — Another day, another wave of developments across the AI landscape. From a groundbreaking model that runs on your phone to security vulnerabilities in your favorite AI assistant, the pace of change shows no sign of slowing. Here are the five stories that defined the conversation this week.

1. Bonsai 27B: The First 27B-Class Model to Run on a Phone

PrismML has announced Bonsai 27B, a new multimodal flagship based on Qwen3.6 27B that achieves something previously thought impossible: running a 27-billion-parameter model on a smartphone. The secret lies in ultra-aggressive quantization — binary and ternary weight representations that shrink the model from roughly 50 GB down to under 4 GB, making it feasible for on-device inference.

The model is available in multiple sizes — Bonsai 27B, 8B, 4B, and 1.7B variants — and has been released on Hugging Face under the prism-ml organization. Early benchmarks on a Ryzen 7 5700X desktop show binary inference at 9 tokens/second for prompt processing and 6 tokens/second for generation, though ternary CPU inference is not yet optimized.

In a sign of the technology’s commercial potential, Apple is reportedly in talks with PrismML (per CNBC, July 14), suggesting the company sees value in bringing high-performance on-device AI to its ecosystem. The HN community response has been largely positive, with researchers noting that the model’s frugal KV-cache memory usage could make it especially useful in multi-agent coding workflows. However, some users report that the model still hallucinates on factual queries — a reminder that size compression comes with trade-offs.

HN Discussion: 682 points, 242 comments

2. OpenAI’s Codex Begins Encrypting Sub-Agent Prompts, Sparking Auditability Concerns

A controversial change in OpenAI’s Codex CLI has the developer community up in arms. Starting with PR #26210 (merged June 5), Codex’s MultiAgentV2 mode now encrypts sub-agent message payloads — meaning the prompts your agents send to each other are no longer visible to the user running the tool.

The change was flagged in GitHub issue #28058 titled “Regression: encrypted MultiAgentV2 messages remove readable task audit trail.” The issue, which has garnered 250+ HN comments, documents how the encryption affects spawn_agent, send_message, and followup_task operations. For GPT-5.5 users on Codex 0.142.5+, the encrypted mode is now the default, and there is no opt-out.

Developer reaction has been fierce. “We don’t want to build Skynet and then be unable to audit what it’s doing,” wrote one commenter on the GitHub thread. Others pointed to a recent incident where a GPT 5.6 sub-agent accidentally deleted a user’s home directory — raising the question of whether encryption-induced loss of visibility contributed to the failure. OpenAI has published related PRs (#30867, #30872) that add lifecycle logging for multi-agent communication, but critics say these don’t solve the core transparency problem.

The move is widely interpreted as an anti-competitive measure to frustrate proxy usage and model extraction, but it comes at the cost of user trust and debuggability.

HN Discussion: 424 points, 250 comments

3. xAI Open-Sources Grok Build — With Strings Attached

xAI has open-sourced Grok Build, its coding agent harness and terminal UI, under a GitHub repository that has quickly attracted 386 points and over 400 comments on Hacker News. The codebase includes a fullscreen, mouse-interactive TUI and, notably, a self-contained terminal renderer for Mermaid diagrams that uses Unicode box-drawing characters — a pleasant surprise noted by developer Simon Willison.

Within hours of the release, the community had already produced multiple forks. Gork-build rebrands the project, strips vendor telemetry, and blocks x.ai auto-updates — a “VSCodium-style privacy fork.” Digi-grok-build (“dgrok”) offers a multi-provider CLI that builds from source instead of x.ai’s CDN. Open-grok opens the tool to every provider.

But the announcement is not without controversy. xAI was recently caught exfiltrating user data, and many in the community view the open-sourcing as a tactical move to rebuild trust rather than a genuine commitment to openness. “They open-sourced the scaffolding but not the building,” one commenter noted. “The ‘open’ in the company name is doing a lot of heavy lifting.” Still, the release represents a significant contribution to the open-source AI tooling ecosystem, and the rapid fork activity suggests genuine demand for an independent Grok-powered coding agent.

HN Discussion: 386 points, 412 comments

4. “The Memory Heist”: How a Researcher Tricked Claude Into Leaking Personal Secrets

Security researcher Ayush Paul published a detailed demonstration of a critical vulnerability in Anthropic’s Claude — the AI assistant can be tricked into leaking a user’s personal data, including full name, employer, and security question answers, without any visible indication in the UI.

In the exploit, dubbed “The Memory Heist,” Paul demonstrates how an attacker can craft a seemingly innocuous conversation that, by the time Claude finishes responding, has already exfiltrated sensitive information. The attack exploits Claude’s memory system — the same feature that makes the assistant useful by retaining context over time. That accumulated profile, Paul argues, is more information-dense than most password managers, making AI assistants high-value targets.

The story has sparked intense debate on HN (628+ points on the main thread). While some argue that the solution is simple — sandbox AI agents like any other untrusted software — others counter that the average user has no idea their “helpful assistant” could be weaponized against them. The demonstration arrives at a time when AI companies are racing to add more memory and personalization features, raising the stakes for security-by-design approaches.

HN Discussion: 628 points, 285 comments (main thread)

5. OpenAI Loses EU Trademark Battle Over “OPENAI” Name

The European Union’s General Court in Luxembourg has ruled against OpenAI in its bid to trademark the name “OPENAI”, finding that the term is purely descriptive and lacks the distinctiveness required for trademark protection. The ruling, issued July 15, applies to certain software and information technology goods and services.

The EU Intellectual Property Office (EUIPO) determined that the word “open” would be understood by the relevant public as meaning freely accessible, while “AI” is a common abbreviation for artificial intelligence. Together, the court found, the term simply describes products based on openly accessible AI — not a distinctive brand identifier.

The decision is not necessarily fatal. Under EU law, a descriptive mark can still be registered with evidence that it has acquired distinctiveness through use — meaning OpenAI could eventually succeed if it proves consumers recognize “OPENAI” as a company name rather than a description. The ruling can also be appealed to the European Court of Justice.

HN commenters were sharply divided. Some welcomed the decision as a win against trademark overreach — “The trademark would ultimately allow them to sue any company for claiming it provides ‘open AI,'” one wrote. Others noted the irony: “The ‘open’ in OpenAI isn’t supposed to mean open,” pointing to the company’s long-running tension with its open-source roots.

HN Discussion: 233 points, 151 comments

Closing Thoughts

This week’s stories underscore an industry in constant motion. The Bonsai 27B model proves that the race to smaller, faster, local AI is accelerating; Codex’s encryption controversy highlights the tension between security and transparency; Grok Build’s open-sourcing shows how quickly the community moves to fork and reclaim control; the Claude memory vulnerability is a sobering reminder that convenience and security are often at odds; and the OpenAI trademark ruling raises fundamental questions about what “open” really means in AI.

Until next time — keep building, keep questioning, and keep your AI sandboxed.