Big quote: Jensen Huang just spent a week watching his company’s valuation get hit by the threat of a Chinese open-weight model. His response was to go on the record defending it. Speaking to Axios in Fort Worth, Texas, at the opening of a new phase of the Wistron plant that builds Nvidia’s AI infrastructure, the Nvidia CEO said American companies should “absolutely” be free to run Chinese models. “These Chinese models are excellent,” he said. “Open-source models that are excellent should be used.” Asked whether China could displace American labs, he was blunt: “Zero possibility.”

The timing is what makes it interesting. Moonshot AI released Kimi K3 on July 16. Independent evaluators put it third on Artificial Analysis’ Intelligence Index, only behind Anthropic’s Claude Fable 5 and OpenAI’s GPT-5.6 Sol, and first on LMArena’s blind Frontend Code Arena board.

The market took it about as well as it took DeepSeek. The Philadelphia Semiconductor Index fell 12.5% in a week, its worst stretch in 15 months. Taiwan’s benchmark dropped more than 6%, Japan closed down 4%, and Chinese AI stocks actually got hit harder than American ones, with Zhipu down as much as 30% in Hong Kong and MiniMax off 16%.

“The market misunderstood the impact of DeepSeek the first time,” Huang told Axios, adding that Wall Street has “misunderstood the impact of Kimi again this time.”

His pitch is one Nvidia has made before, delivered without much subtlety this time: “Free AI should be great for hardware. Free AI should be great for chips. Free AI should be great for data centers.” The logic is that as cheap, capable models get used more, not less, more usage means more chips running somewhere. He also argued open models don’t cannibalize OpenAI and Anthropic, but they give people a free first taste, and plenty of those people end up paying for something faster and more reliable.

Bloomberg’s analysis of K3 noted that where DeepSeek’s story was about cheaper training, Moonshot’s is about a much larger model that leans harder on memory infrastructure.

The security argument, flipped

Huang waved off the idea that a downloaded Chinese model is some kind of backdoor to Beijing, pointing out you can inspect the weights, tweak them, and run the whole thing sealed off from the internet if you want. His argument is that openness actually makes things safer, because more people are looking for problems. Lock everything into one closed system, he said, and “if everything just becomes one single model, one single point of attack, one single source of failure, I think the world is much, much more vulnerable.”

– Kimi.ai (@Kimi_Moonshot) July 16, 2026

Then he turned that same logic on an American company. Huang said Anthropic should open up Claude Mythos, its cybersecurity model that’s currently restricted to a vetted group of partners, calling it something that “should be available as a service” and arguing “holding Anthropic back is not in the benefit of the United States.” His framing: “Just because Mythos is not available, open models are available anyhow.”

It is worth noting that Nvidia is one of the partners with access to Mythos already, through Anthropic’s Project Glasswing program. Glasswing has grown from around 50 partners to roughly 200 across about 15 countries, and Anthropic has said models this capable will likely be widely available within 6 to 12 months regardless of what it decides.

Meanwhile, in Washington…

– Treasury Secretary Scott Bessent (@SecScottBessent) July 22, 2026

Huang’s comments landed hours after Treasury Secretary Scott Bessent told Fox Business the administration is looking into whether Chinese AI models were built on stolen US intellectual property.

“If we see … that overseas models are stealing from our great companies, we have the ability to sanction them because of this theft,” Bessent said, pointing to what he called “watermarks” of US models showing up inside Chinese ones, with action possible within days or weeks. He also floated whether US companies should have to disclose to customers when they’re running Chinese models.

– Director Michael Kratsios (@mkratsios47) July 22, 2026

Behind the scenes, Axios says this fight has been simmering for a while. US Commerce has been considering blacklisting Chinese AI labs since last year, and the White House had a draft executive order that would’ve made US companies liable for running Chinese models. All of it stalled, but Kimi’s release seems to have brought it back to life.

Jensen Huang split the difference on the “they stole our work” question: “Distillation, learning from AI, learning from other sources of knowledge, is fundamental to intelligence.”

Read the incentives

Granted, all this commentary is not coming from a neutral party. Nvidia’s China revenue is basically zero right now, down from a business Huang once said could be worth $50 billion a year. Huang has spent two years arguing against export controls, so of course he’s going to say demand for AI is elastic and that restrictions can backfire. That said, he has also endorsed keeping Blackwell and Rubin out of China’s hands.

Inside Wistron’s AI infrastructure manufacturing facility in Fort Worth, Texas.

The good news is that his core claim could soon be verified. Every number on Kimi K3 so far comes from Moonshot itself or from early API testing. The full weights go public on July 27, and at that point the benchmarks either hold up under independent testing or they don’t.

Anthropic has accused Moonshot of training on 3.4 million Claude conversations earlier this year, though analyst Nathan Lambert’s take is that even if some of that happened, it’s not enough to explain how good K3 actually is. Separately, Epoch AI estimates the gap between the best open and closed models is now down to around three months.

If that gap keeps shrinking, the real question stops being whether US companies should be allowed to use Chinese models, and starts being whether banning them would even do anything once the weights are already sitting on servers everywhere.

Apple is already working on a refreshed version of the MacBook Neo, only a few months after launching its cheapest laptop.

According to Bloomberg’s Mark Gurman, Apple has been testing an updated MacBook Neo with an A19 Pro chip and more memory. The report backs earlier claims that a second-generation model could arrive in 2027, bringing better multitasking performance and improved long-term usability.

More memory could be the most important upgrade

The current MacBook Neo runs on a binned A18 Pro chip paired with 8GB of unified memory. It handles browsing, streaming, and everyday productivity reasonably well, but the limited memory can become noticeable once several apps and dozens of browser tabs are running together.

Bloomberg does not reveal the exact memory capacity of the new model. Previous reporting pointed to 12GB, which would give the Neo more breathing room for multitasking and future macOS features. Not to mention that 12GB memory is also a requirement to run advanced Apple Intelligence features locally.

The A19 Pro, which is onboard the iPhone 17 Pro and Pro Max models. should also bring improvements across CPU, graphics, and Neural Engine performance. Apple is reportedly planning to refresh the laptop periodically with new colors as well.

More memory could also push the price higher

The bigger question is how much Apple will charge. The MacBook Neo launched at $599 in March, but its starting price climbed to $699 in June after rising memory costs forced Apple to increase prices across the Mac lineup. Adding more unified memory could make it difficult to hold the current price, although the Neo would still sit comfortably below the MacBook Air.

There is no word yet on whether Apple will address some of the other compromises found on the first model, including the non-backlit keyboard, mechanical trackpad, and inconsistent USB speeds. The refresh is expected to arrive at the 2027 spring launch event, along with the standard iPhone 18 and the iPhone 18e.

When Hugging Face got hit last week, co-founder Clement Delangue suspected a frontier lab, given the agent’s sophistication. He was right. Delangue said on X that after a day working with OpenAI he strongly believed there was no malicious intent and that it was mind-blowing the whole thing had happened autonomously.

The two OpenAI models that broke into Hugging Face last week did not breach it through malice or superintelligence. They breached it through credentials and permissions they should never have been able to reach, a non-human identity failure that is the oldest problem in security rather than the newest one in AI, and the one every enterprise can actually fix.

OpenAI disclosed on July 21 that two of its models, GPT-5.6 Sol and an unreleased, more capable model, were running a cyber benchmark called ExploitGym with their safety refusals switched off, and inferred that the answer key sat in Hugging Face’s production database. Getting there took two different failures. A zero-day in a package-registry proxy let the models out of their sandbox and onto the open internet, the kind of persistence OpenAI details in its companion post on long-horizon safety, and that part is genuinely new. The breach of Hugging Face itself came the ordinary way. OpenAI’s own account is that the models chained stolen credentials and further zero-days into a remote code execution path, after a series of privilege escalation and lateral movement steps. The exotic part got them to the door, and credentials walked them through it.

Hugging Face also disclosed last week that an autonomous agent had harvested cloud and cluster credentials scoped broadly enough to reach multiple internal clusters, then left a trail of more than 17,000 recorded events across short-lived sandboxes over a weekend. Both disclosures describe the same escalation. An agent lands somewhere it should not be, finds credentials scoped far wider than any task requires, and uses them to move. These are two accounts of one incident, not two attacks. The agent Hugging Face watched was OpenAI’s models, and both companies describe the same ordinary escalation.

The version of this in a typical enterprise is worse, not better. OpenAI and Hugging Face are among the most security-mature organizations in the industry, and both still needed the intrusion to happen before they could see it. The average company wiring agents into Copilot or an internal assistant has neither the identity inventory nor the behavioral monitoring those two brought to bear. The same breach in a normal company would not be contained in days, it would simply go unnoticed.

The industry is debating the wrong failure

The reaction has split into familiar camps. Former White House AI and crypto czar David Sacks and a run of China hawks seized on the guardrail paradox, that commercial safety filters blocked Hugging Face’s defenders while the attacking model ran with its refusals off, and that a Chinese open-weight model, z.ai’s GLM 5.2, was what finally let the team finish its forensics. Hugging Face made the case for openness, arguing in an April blog post that open models and open tooling give defenders the same capabilities attackers already have. Both arguments are about the model, and neither touches the mechanism.

Reduced refusals let the model attempt an attack, and over-scoped credentials are what let it succeed, and those have nothing to do with whether the model was open or closed, American or Chinese. Making a frontier model provably safe is a multi-year alignment problem no customer can buy or accelerate, while scoping an identity is a configuration change a team can ship this sprint. The industry is being urged to fixate on the part of this it cannot control and to treat the part it can as a footnote.

Forrester reached the same read. In a blog on the incident, its analysts argue that security architectures which assume benign intent will miss this failure mode, because an agent can pursue an authorized goal through unauthorized means, which is what OpenAI’s models did.

This was a non-human identity failure, and it is the oldest one in security

Strip the science-fiction framing and what remains is a textbook case of over-privileged machine identity, the kind security teams have fought for a decade, now driven by an autonomous agent at machine speed. Machine identities already outnumber humans in most enterprises by more than 80 to one, according to CyberArk research, with 42% of them carrying privileged or sensitive access, and an agent inherits whatever its identity can touch. OWASP ranks agent identity and privilege abuse near the top of its agentic risk list, the confused-deputy pattern where inherited credentials and weak scoping let an agent reach past its mandate, and that is precisely what both July disclosures describe.

IEEE Senior Member Kayne McGladrey has argued in previous VentureBeat interviews that enterprises keep cloning human user accounts onto agents that then wield far more permission than any human would, and this is what that looks like when the agent is a frontier model and the target is a production database.

The people closest to it read it the same way. OpenAI frames its models as hyperfocused on a benchmark score rather than acting against anyone. Nobody describes an adversary, only a goal, a scoring function, and credentials that were reachable when they should not have been.

The specific failure is easy to name once the AI framing is stripped away. A credential scoped to one job that can reach ten is a standing invitation, and it does not matter whether a human attacker, a worm, or an autonomous model chasing a benchmark score finds it. What changed in July is the finder. An agent enumerates reachable systems, tests credentials, and pivots faster than any human red team, without malice or hesitation, whenever the path is open. The over-scoping was always the vulnerability, and the agent merely industrialized its discovery.

Forrester named the control that would have blunted it. Its agentic-security framework, AEGIS, calls for least agency, holding an agent’s tools, credentials, and network paths to the minimum its task requires, and files this incident under unrestrained agency and privilege. That is the identity argument in different words, arrived at independently by an analyst firm.

The data says this is where the risk now lives. Verizon’s 2026 Data Breach Investigations Report found that exploitation of vulnerabilities has overtaken stolen credentials as the top initial access vector for the first time in 19 years. That is the initial-access half. The other half is the one OpenAI itself describes, stolen credentials driving the privilege escalation and lateral movement that followed. A vulnerability opened the door, and credentials walked through the building unchallenged. Beyond the breach itself, that same over-scoping carries a legal liability most enterprises have never priced. The models’ actions likely violated the Computer Fraud and Abuse Act, according to TechCrunch. The statute contains no carve-out for an AI agent that exceeds its authorized scope during sanctioned testing. Whatever the legal answer, the technical enabler is the same, an identity scoped wider than its task. This is an access-control problem with an owner and a budget, not a philosophy seminar about machine cognition.

Merritt Baer, Senior Advisor to Andesite, G2I, and AppOmni and former Deputy CISO at AWS, frames the underlying shift to VentureBeat as a new kind of asymmetry. Both sides now reach for the same capabilities, she said, but one side is constrained by enterprise governance, policy, compliance, and safety controls while the adversary simply downloads an uncensored open-weight model and keeps going. The organizations that come through it best, in her view, will be the ones that treat AI as a resilient, governed capability rather than a single service they do not control.

Four moves that shrink the blast radius

The breach worked because the agent reached identities scoped far wider than its task. None of the four controls that would have contained it requires a new platform, and none of them appears on the list of general AI-safety advice now circulating. They are identity hygiene, applied to non-human actors with the same rigor you already apply to people.

1. Scope every non-human identity to one task. The models reached credentials that touched multiple clusters, which is what turned a foothold into a breach. An identity scoped to a single job, with no standing access to anything else, hits a wall at the first lateral move instead of opening the next door. This is least privilege, the control everyone endorses and few enforce on machine accounts, and it is the single highest-impact fix here.

2. Give credentials short lifetimes and rotate them hard. Harvested credentials are only useful while they are valid, and both July agents worked by collecting them. Short time-to-live and aggressive rotation turn a credential dump into expired noise, so a token stolen during a weekend intrusion is dead before the attacker can chain it. Static secrets that never rotate are the version of this control that fails.

3. Monitor for lateral movement, not just prompts. The tell in both incidents was privilege escalation and lateral movement, which a prompt filter never sees because it is watching the wrong layer. Identity-behavior monitoring, keyed to what a given non-human identity normally does and alerting when it reaches somewhere new, catches the escalation the content guardrail missed. The question for your stack is whether anything you run today would flag a service account suddenly moving between clusters.

4. Rehearse instant revocation before you need it. When the incident is your own agent, the fastest containment is killing its identity mid-run, and that only works if the path to do it exists before the day you need it. Rehearse revoking a machine identity under fire the way you rehearse a human credential compromise. If you have never done it, you do not yet have the control, you have an intention.

The defense also worked, and that matters. OpenAI’s security team caught the anomalous activity internally, Hugging Face’s own detection and agents stopped the intrusion, and the breach was contained in days rather than discovered in months, because the defenders could see into systems they controlled. That visibility is the same discipline the four controls depend on. The debate over whether frontier models are safe, open, or American will run for years, and none of it will be settled in time to help the enterprise deploying agents this quarter. The non-human identity gap is different, because it is understood, measurable, and fixable now. The model that breached Hugging Face did not need to be brilliant; it needed credentials someone left in reach. The fix is scoping them before an agent finds them.

from the ctrl-alt-speech dept

Ctrl-Alt-Speech is a weekly podcast about the latest news in online speech, from Mike Masnick and Everything in Moderation‘s Ben Whitelaw.

Subscribe now on Apple Podcasts, Overcast, Spotify, Pocket Casts, YouTube, or your podcast app of choice — or go straight to the RSS feed. To get extended episodes with additional coverage, support us on Patreon.

In this sponsored Spotlight episode of Ctrl-Alt-Speech, host Ben Whitelaw speaks to PwC’s Dan Hays at TrustCon about the firm’s recently published Trust & Safety Outlook report.

They discuss: 

• How AI is simultaneously creating new risks and reshaping the tools used to address them;
• What the rise of autonomous agents means for governance, accountability and the future of the internet; and
• How platforms should respond to an increasingly fragmented regulatory landscape.

The conversation also explores how Trust & Safety is becoming a more strategic function inside companies, how automation could change the role of practitioners and vendors, and which emerging risks remain most underestimated.

This episode is brought to you in conjunction with our sponsor, PwC. Download the report today.

Filed Under: ai, artificial intelligence, content moderation, trust and safety

Companies: pwc

Alphabet investors have very publicly worried that the company’s massive AI spending isn’t worth the money. With the company’s latest earnings report, those investors should be able to relax a little.

The takeaway: Google’s cloud business — driven largely by enterprise AI adoption — is booming. The search giant saw Google Cloud revenue spike 82% from where it was this time last year, climbing to $24.8 billion. That’s well above last quarter’s generous year-over-year growth, which showed a revenue jump of 63% to $20 billion — and it handily beats what Wall Street analysts expected for this quarter’s growth (the expectation was $22.46 billion).

Those cloud gains were driven largely by enterprise AI solutions and enterprise AI infrastructure adoption, the company said, while also noting that its backlog of cloud contracting work — that is, work that it hasn’t yet converted into revenue — had climbed to $514 billion.

The company’s profit hit $112.1 billion, which is a massive jump from this time last year, when the company reported $28.1 billion in profit, the company’s earnings report shows. Meanwhile, Alphabet’s overall revenue grew 24% year-over-year during the past quarter to $119.8 billion. The company also saw Google Services revenue jump 15% to $94.5 billion.

“Our AI investments are redefining what’s possible across every part of our business,” said Google CEO Sundar Pichai during Wednesday’s earnings call. “We have exciting momentum across the board.”

More people are also adopting Gemini, Google’s AI chatbot, as the app currently enjoys 950 million monthly active users, the company said. In Q4 of 2025, Google reported that the app had 750 million users.

It’s worth noting that spiking revenue isn’t unusual for Google. This marks the company’s 12th consecutive quarter of double-digit revenue growth. But even by that standard, this quarter represents a particularly bountiful period for the tech giant.

Alphabet’s spending is still hefty, with its capital expenditures — the money it spends building data centers, buying chips, and expanding infrastructure — estimated to be between $180 billion and $190 billion for the year — a fact not lost on analysts during Wednesday’s earnings call. Several pressed Pichai on when, and how much, those investments will pay off.

“I think our compute capacity investments in ’27,” he said. “We are seeing strong demand indicators, including long-term deals,” he continued. “I think, if anything, the dynamics look healthier than where we were about a year ago, so that’s what gives us the confidence to undertake those investments,” he said.

The Steam Machine is already one of Valve’s most expensive gaming devices. However, it may not stay at its current price for long.

According to a Valve engineer, the ongoing DRAM shortage is continuing to drive up component costs. This raises the possibility that the handheld could become even more expensive in the months ahead.

Speaking to Bloomberg’s Jason Schreier, Valve engineer Yazan Aldehayyat said the company expected some supply chain challenges around memory, storage and chips. However, he said the current DRAM crisis has turned out to be far more severe than anticipated.

While he stopped short of confirming another price increase, Aldehayyat suggested that the worst may not be over. He explained that retail prices typically lag three to six months behind wholesale component costs. This means the most recent increases in DRAM pricing have yet to be reflected on store shelves.