On Wednesday, IBM officially reported earnings and the news was as bad as everyone knew it would be.

While the 115-year-old company still generates boatloads of cash — $17.2 billion in revenue, $9.9 billion in gross profit, nearly 58% margins, and $2.2 billion in net earnings for the quarter — its results fell well short of Wall Street’s expectations.

It was such a bad miss that IBM CEO Arvind Krishna and the board took an unprecedented step of warning investors ahead of time that the earnings “was worse than our expectations,” offering everyone a sneak peek.

He published a “letter to investors,” last week sharing preliminary results. It warned of abysmal revenue in the company’s all-important “infrastructure” category and said that profit margins were also going to take a hit. The company’s stock instantly tanked 25%, it’s biggest single-day decline ever. Until then, the stock had performed well under Krishna’s six years of leadership, buoyed by the AI data center boom that had been lifting all boats.

On Wednesday, IBM also lowered its full-year growth forecasts, meaning this horrible quarter would impact the rest of the year. The culprit? IBM’s cash-cow mainframe business was down 42%.

That’s a cascading problem, because as CFO Jim Kavanaugh explained on the quarterly call with investors, IBM earns $3 in software revenue for every $1 of mainframe hardware it sells.

However, the CEO and CFO spent the call insisting that this was a temporary blip and all would be well soon.

What happened, they said, was that “tens” of customers that were due to buy a new mainframe during the quarter opted not to do so. That may not sound like a lot of customers, but mainframes are systems that cost hundreds of thousands to millions of dollars, and with maintenance contracts and software, generate many millions more.

The same AI boom that lifted IBM’s boat also sank it.

Instead of buying a new mainframe, these clients bought other hardware, Krishna explained. They were faced with astronomically high cost increases of 15% to 30% for data center gear and PCs.

“When they were faced with that issue, then they decided to move budget to those areas where they were having that extreme price,” Krishna said.

Enterprise hardware makers like Dell and HP have warned that rising costs on components like memory, caused by the AI build-out boom, have forced them to raise prices. Apple has said the same.

But Krishna promised that those customers will still buy their new mainframes eventually — along with their new software contracts. In fact, he said some of them have already done so this quarter. “We see no evidence of clients moving off the mainframe,” he said.

We’ll have to wait and see. But the tech industry has predicted the death of the mainframe for many decades now. Maybe even AI won’t kill it.

Big quote: Jensen Huang just spent a week watching his company’s valuation get hit by the threat of a Chinese open-weight model. His response was to go on the record defending it. Speaking to Axios in Fort Worth, Texas, at the opening of a new phase of the Wistron plant that builds Nvidia’s AI infrastructure, the Nvidia CEO said American companies should “absolutely” be free to run Chinese models. “These Chinese models are excellent,” he said. “Open-source models that are excellent should be used.” Asked whether China could displace American labs, he was blunt: “Zero possibility.”

The timing is what makes it interesting. Moonshot AI released Kimi K3 on July 16. Independent evaluators put it third on Artificial Analysis’ Intelligence Index, only behind Anthropic’s Claude Fable 5 and OpenAI’s GPT-5.6 Sol, and first on LMArena’s blind Frontend Code Arena board.

The market took it about as well as it took DeepSeek. The Philadelphia Semiconductor Index fell 12.5% in a week, its worst stretch in 15 months. Taiwan’s benchmark dropped more than 6%, Japan closed down 4%, and Chinese AI stocks actually got hit harder than American ones, with Zhipu down as much as 30% in Hong Kong and MiniMax off 16%.

“The market misunderstood the impact of DeepSeek the first time,” Huang told Axios, adding that Wall Street has “misunderstood the impact of Kimi again this time.”

His pitch is one Nvidia has made before, delivered without much subtlety this time: “Free AI should be great for hardware. Free AI should be great for chips. Free AI should be great for data centers.” The logic is that as cheap, capable models get used more, not less, more usage means more chips running somewhere. He also argued open models don’t cannibalize OpenAI and Anthropic, but they give people a free first taste, and plenty of those people end up paying for something faster and more reliable.

Bloomberg’s analysis of K3 noted that where DeepSeek’s story was about cheaper training, Moonshot’s is about a much larger model that leans harder on memory infrastructure.

The security argument, flipped

Huang waved off the idea that a downloaded Chinese model is some kind of backdoor to Beijing, pointing out you can inspect the weights, tweak them, and run the whole thing sealed off from the internet if you want. His argument is that openness actually makes things safer, because more people are looking for problems. Lock everything into one closed system, he said, and “if everything just becomes one single model, one single point of attack, one single source of failure, I think the world is much, much more vulnerable.”

– Kimi.ai (@Kimi_Moonshot) July 16, 2026

Then he turned that same logic on an American company. Huang said Anthropic should open up Claude Mythos, its cybersecurity model that’s currently restricted to a vetted group of partners, calling it something that “should be available as a service” and arguing “holding Anthropic back is not in the benefit of the United States.” His framing: “Just because Mythos is not available, open models are available anyhow.”

It is worth noting that Nvidia is one of the partners with access to Mythos already, through Anthropic’s Project Glasswing program. Glasswing has grown from around 50 partners to roughly 200 across about 15 countries, and Anthropic has said models this capable will likely be widely available within 6 to 12 months regardless of what it decides.

Meanwhile, in Washington…

– Treasury Secretary Scott Bessent (@SecScottBessent) July 22, 2026

Huang’s comments landed hours after Treasury Secretary Scott Bessent told Fox Business the administration is looking into whether Chinese AI models were built on stolen US intellectual property.

“If we see … that overseas models are stealing from our great companies, we have the ability to sanction them because of this theft,” Bessent said, pointing to what he called “watermarks” of US models showing up inside Chinese ones, with action possible within days or weeks. He also floated whether US companies should have to disclose to customers when they’re running Chinese models.

– Director Michael Kratsios (@mkratsios47) July 22, 2026

Behind the scenes, Axios says this fight has been simmering for a while. US Commerce has been considering blacklisting Chinese AI labs since last year, and the White House had a draft executive order that would’ve made US companies liable for running Chinese models. All of it stalled, but Kimi’s release seems to have brought it back to life.

Jensen Huang split the difference on the “they stole our work” question: “Distillation, learning from AI, learning from other sources of knowledge, is fundamental to intelligence.”

Read the incentives

Granted, all this commentary is not coming from a neutral party. Nvidia’s China revenue is basically zero right now, down from a business Huang once said could be worth $50 billion a year. Huang has spent two years arguing against export controls, so of course he’s going to say demand for AI is elastic and that restrictions can backfire. That said, he has also endorsed keeping Blackwell and Rubin out of China’s hands.

Inside Wistron’s AI infrastructure manufacturing facility in Fort Worth, Texas.

The good news is that his core claim could soon be verified. Every number on Kimi K3 so far comes from Moonshot itself or from early API testing. The full weights go public on July 27, and at that point the benchmarks either hold up under independent testing or they don’t.

Anthropic has accused Moonshot of training on 3.4 million Claude conversations earlier this year, though analyst Nathan Lambert’s take is that even if some of that happened, it’s not enough to explain how good K3 actually is. Separately, Epoch AI estimates the gap between the best open and closed models is now down to around three months.

If that gap keeps shrinking, the real question stops being whether US companies should be allowed to use Chinese models, and starts being whether banning them would even do anything once the weights are already sitting on servers everywhere.

Apple is already working on a refreshed version of the MacBook Neo, only a few months after launching its cheapest laptop.

According to Bloomberg’s Mark Gurman, Apple has been testing an updated MacBook Neo with an A19 Pro chip and more memory. The report backs earlier claims that a second-generation model could arrive in 2027, bringing better multitasking performance and improved long-term usability.

More memory could be the most important upgrade

The current MacBook Neo runs on a binned A18 Pro chip paired with 8GB of unified memory. It handles browsing, streaming, and everyday productivity reasonably well, but the limited memory can become noticeable once several apps and dozens of browser tabs are running together.

Bloomberg does not reveal the exact memory capacity of the new model. Previous reporting pointed to 12GB, which would give the Neo more breathing room for multitasking and future macOS features. Not to mention that 12GB memory is also a requirement to run advanced Apple Intelligence features locally.

The A19 Pro, which is onboard the iPhone 17 Pro and Pro Max models. should also bring improvements across CPU, graphics, and Neural Engine performance. Apple is reportedly planning to refresh the laptop periodically with new colors as well.

More memory could also push the price higher

The bigger question is how much Apple will charge. The MacBook Neo launched at $599 in March, but its starting price climbed to $699 in June after rising memory costs forced Apple to increase prices across the Mac lineup. Adding more unified memory could make it difficult to hold the current price, although the Neo would still sit comfortably below the MacBook Air.

There is no word yet on whether Apple will address some of the other compromises found on the first model, including the non-backlit keyboard, mechanical trackpad, and inconsistent USB speeds. The refresh is expected to arrive at the 2027 spring launch event, along with the standard iPhone 18 and the iPhone 18e.

When Hugging Face got hit last week, co-founder Clement Delangue suspected a frontier lab, given the agent’s sophistication. He was right. Delangue said on X that after a day working with OpenAI he strongly believed there was no malicious intent and that it was mind-blowing the whole thing had happened autonomously.

The two OpenAI models that broke into Hugging Face last week did not breach it through malice or superintelligence. They breached it through credentials and permissions they should never have been able to reach, a non-human identity failure that is the oldest problem in security rather than the newest one in AI, and the one every enterprise can actually fix.

OpenAI disclosed on July 21 that two of its models, GPT-5.6 Sol and an unreleased, more capable model, were running a cyber benchmark called ExploitGym with their safety refusals switched off, and inferred that the answer key sat in Hugging Face’s production database. Getting there took two different failures. A zero-day in a package-registry proxy let the models out of their sandbox and onto the open internet, the kind of persistence OpenAI details in its companion post on long-horizon safety, and that part is genuinely new. The breach of Hugging Face itself came the ordinary way. OpenAI’s own account is that the models chained stolen credentials and further zero-days into a remote code execution path, after a series of privilege escalation and lateral movement steps. The exotic part got them to the door, and credentials walked them through it.

Hugging Face also disclosed last week that an autonomous agent had harvested cloud and cluster credentials scoped broadly enough to reach multiple internal clusters, then left a trail of more than 17,000 recorded events across short-lived sandboxes over a weekend. Both disclosures describe the same escalation. An agent lands somewhere it should not be, finds credentials scoped far wider than any task requires, and uses them to move. These are two accounts of one incident, not two attacks. The agent Hugging Face watched was OpenAI’s models, and both companies describe the same ordinary escalation.

The version of this in a typical enterprise is worse, not better. OpenAI and Hugging Face are among the most security-mature organizations in the industry, and both still needed the intrusion to happen before they could see it. The average company wiring agents into Copilot or an internal assistant has neither the identity inventory nor the behavioral monitoring those two brought to bear. The same breach in a normal company would not be contained in days, it would simply go unnoticed.

The industry is debating the wrong failure

The reaction has split into familiar camps. Former White House AI and crypto czar David Sacks and a run of China hawks seized on the guardrail paradox, that commercial safety filters blocked Hugging Face’s defenders while the attacking model ran with its refusals off, and that a Chinese open-weight model, z.ai’s GLM 5.2, was what finally let the team finish its forensics. Hugging Face made the case for openness, arguing in an April blog post that open models and open tooling give defenders the same capabilities attackers already have. Both arguments are about the model, and neither touches the mechanism.

Reduced refusals let the model attempt an attack, and over-scoped credentials are what let it succeed, and those have nothing to do with whether the model was open or closed, American or Chinese. Making a frontier model provably safe is a multi-year alignment problem no customer can buy or accelerate, while scoping an identity is a configuration change a team can ship this sprint. The industry is being urged to fixate on the part of this it cannot control and to treat the part it can as a footnote.

Forrester reached the same read. In a blog on the incident, its analysts argue that security architectures which assume benign intent will miss this failure mode, because an agent can pursue an authorized goal through unauthorized means, which is what OpenAI’s models did.

This was a non-human identity failure, and it is the oldest one in security

Strip the science-fiction framing and what remains is a textbook case of over-privileged machine identity, the kind security teams have fought for a decade, now driven by an autonomous agent at machine speed. Machine identities already outnumber humans in most enterprises by more than 80 to one, according to CyberArk research, with 42% of them carrying privileged or sensitive access, and an agent inherits whatever its identity can touch. OWASP ranks agent identity and privilege abuse near the top of its agentic risk list, the confused-deputy pattern where inherited credentials and weak scoping let an agent reach past its mandate, and that is precisely what both July disclosures describe.

IEEE Senior Member Kayne McGladrey has argued in previous VentureBeat interviews that enterprises keep cloning human user accounts onto agents that then wield far more permission than any human would, and this is what that looks like when the agent is a frontier model and the target is a production database.

The people closest to it read it the same way. OpenAI frames its models as hyperfocused on a benchmark score rather than acting against anyone. Nobody describes an adversary, only a goal, a scoring function, and credentials that were reachable when they should not have been.

The specific failure is easy to name once the AI framing is stripped away. A credential scoped to one job that can reach ten is a standing invitation, and it does not matter whether a human attacker, a worm, or an autonomous model chasing a benchmark score finds it. What changed in July is the finder. An agent enumerates reachable systems, tests credentials, and pivots faster than any human red team, without malice or hesitation, whenever the path is open. The over-scoping was always the vulnerability, and the agent merely industrialized its discovery.

Forrester named the control that would have blunted it. Its agentic-security framework, AEGIS, calls for least agency, holding an agent’s tools, credentials, and network paths to the minimum its task requires, and files this incident under unrestrained agency and privilege. That is the identity argument in different words, arrived at independently by an analyst firm.

The data says this is where the risk now lives. Verizon’s 2026 Data Breach Investigations Report found that exploitation of vulnerabilities has overtaken stolen credentials as the top initial access vector for the first time in 19 years. That is the initial-access half. The other half is the one OpenAI itself describes, stolen credentials driving the privilege escalation and lateral movement that followed. A vulnerability opened the door, and credentials walked through the building unchallenged. Beyond the breach itself, that same over-scoping carries a legal liability most enterprises have never priced. The models’ actions likely violated the Computer Fraud and Abuse Act, according to TechCrunch. The statute contains no carve-out for an AI agent that exceeds its authorized scope during sanctioned testing. Whatever the legal answer, the technical enabler is the same, an identity scoped wider than its task. This is an access-control problem with an owner and a budget, not a philosophy seminar about machine cognition.

Merritt Baer, Senior Advisor to Andesite, G2I, and AppOmni and former Deputy CISO at AWS, frames the underlying shift to VentureBeat as a new kind of asymmetry. Both sides now reach for the same capabilities, she said, but one side is constrained by enterprise governance, policy, compliance, and safety controls while the adversary simply downloads an uncensored open-weight model and keeps going. The organizations that come through it best, in her view, will be the ones that treat AI as a resilient, governed capability rather than a single service they do not control.

Four moves that shrink the blast radius

The breach worked because the agent reached identities scoped far wider than its task. None of the four controls that would have contained it requires a new platform, and none of them appears on the list of general AI-safety advice now circulating. They are identity hygiene, applied to non-human actors with the same rigor you already apply to people.

1. Scope every non-human identity to one task. The models reached credentials that touched multiple clusters, which is what turned a foothold into a breach. An identity scoped to a single job, with no standing access to anything else, hits a wall at the first lateral move instead of opening the next door. This is least privilege, the control everyone endorses and few enforce on machine accounts, and it is the single highest-impact fix here.

2. Give credentials short lifetimes and rotate them hard. Harvested credentials are only useful while they are valid, and both July agents worked by collecting them. Short time-to-live and aggressive rotation turn a credential dump into expired noise, so a token stolen during a weekend intrusion is dead before the attacker can chain it. Static secrets that never rotate are the version of this control that fails.

3. Monitor for lateral movement, not just prompts. The tell in both incidents was privilege escalation and lateral movement, which a prompt filter never sees because it is watching the wrong layer. Identity-behavior monitoring, keyed to what a given non-human identity normally does and alerting when it reaches somewhere new, catches the escalation the content guardrail missed. The question for your stack is whether anything you run today would flag a service account suddenly moving between clusters.

4. Rehearse instant revocation before you need it. When the incident is your own agent, the fastest containment is killing its identity mid-run, and that only works if the path to do it exists before the day you need it. Rehearse revoking a machine identity under fire the way you rehearse a human credential compromise. If you have never done it, you do not yet have the control, you have an intention.

The defense also worked, and that matters. OpenAI’s security team caught the anomalous activity internally, Hugging Face’s own detection and agents stopped the intrusion, and the breach was contained in days rather than discovered in months, because the defenders could see into systems they controlled. That visibility is the same discipline the four controls depend on. The debate over whether frontier models are safe, open, or American will run for years, and none of it will be settled in time to help the enterprise deploying agents this quarter. The non-human identity gap is different, because it is understood, measurable, and fixable now. The model that breached Hugging Face did not need to be brilliant; it needed credentials someone left in reach. The fix is scoping them before an agent finds them.