Sec & AI News — 18 July 2026
🎯 "Best AI for Hacking" Is the Wrong Question
Every list crowns a different model and goes stale in a month. The durable edge is the system you build around the model, and that's what I've written up: how working pentesters actually use AI (Bugcrowd says 82% use it, only 27% think it beats humans), how to judge models on security benchmarks like Cybench instead of coding leaderboards, and the three honest ways past the guardrails on authorised work. I've just been through the main vetted-access route myself, across three accounts.
- Best AI for Hacking? How to Actually Choose (2026) — by Nathan House
🟣 Claude Code Gets Its Own Browser
Anthropic put a browser inside the Claude Code desktop app. Cmd+Shift+B opens it next to your project, and the agent can drive it — browse docs, scroll X instead of paying for the API, click around your staging site. It's sandboxed with a clean profile; write actions get screened, and purchases need explicit approval. OpenAI shipped browser features in the ChatGPT app days earlier. Coincidence, presumably.
🔩 The Best-Paid Corner of Security Fits on a Workbench
Web hacking attacks what you can reach over a wire. Hardware hacking attacks what you can hold: open the case, dump the flash chip, get a shell through the debug port the manufacturer forgot to fuse off. It's under-supplied and well-paid, and I've written the honest guide — the day-to-day work, the toolkit, where AI is quietly changing it, and what the jobs and salaries really look like.
- Hardware Hacking Explained: Tools, Jobs & Salaries [2026] — by Nathan House
🔴 Moonshot Announces Kimi K3 — 2.8 Trillion Parameters, Weights Incoming
Moonshot AI announced Kimi K3: 2.8 trillion parameters, mixture-of-experts with 896 experts (16 active), 1M-token context, native vision. Benchmarks put it beside GPT-5.6 and Fable 5 and ahead of Opus 4.8 and GLM 5.2 — from a model whose weights go public July 27. API pricing is $3/$15 per million tokens.
🗺️ I Mapped 237 AI Security Tools So You Don't Have To
Pentest and red-team agents, LLM guardrails, agent and MCP security, AI-powered detection, deepfake detection — 237 tools across 14 categories, 125 of them open source. Searchable and filterable by category, licensing, and cost. Stop collecting bookmarks.
- AI Security Tools: 237 Mapped [2026] — by Nathan House
🟢 Thinking Machines Ships Inkling, Its First Open Model
Mira Murati's Thinking Machines Lab finally released something you can download: Inkling, a 975B-parameter open-weight MoE (41B active), multimodal, 1M-token context. Benchmarks put it top-tier among open models and mid-pack overall; GLM 5.2 still beats it in most categories. It's fine-tunable through their Tinker platform, with a free playground for now. Two years of demos, one real model.
💼 The Pentester Career Isn't Dying. It's Splitting in Two.
The pentest market is growing — roughly $3.09B heading for $7.41B by 2034 — but the money is flowing to autonomous platforms and senior specialists while AI eats the junior work: scanning, triage, first-draft reports. I've laid out where the split leaves you, what AI still can't do, and how to end up on the side that's gaining value — building and governing the AI system rather than operating the tools.
- Penetration Tester Career in 2026: Is AI Killing It? — by Nathan House
🍎 Apple Sues OpenAI Over Trade Secrets
Apple filed suit against OpenAI, io Products, and two former Apple employees on July 10 — 41 pages alleging misappropriated trade secrets, including claims that actual Apple hardware parts showed up in OpenAI interview sessions. Chief Hardware Officer Tang Tan is named. OpenAI says the claims are meritless. Discovery should be fun.
⌨️ OpenAI's First Hardware Is a $230 Keypad
The long-rumored OpenAI device era begins with... a macro keypad. The Codex Micro — built with Work Louder, sold on OpenAI's own store — is a light-up keyboard tuned for driving Codex agents. $230, already listed as out of stock. Meanwhile, reports say the real first device is a screenless, movable smart speaker built as an AI companion. That one remains at the leak stage.
🔐 1Password Lets Claude Log In Without Seeing Your Passwords
1Password shipped "1Password for Claude": the agent can authenticate into websites using your vault, but credentials never enter the model's context — zero-exposure architecture, no passwords in the transcript, nothing to train on. Mac-only at launch, requires a paid Claude plan. Agents that can log in as you are exactly as useful and exactly as dangerous as they sound, so the credential isolation is the whole story here.
⚙️ xAI Open-Sources Grok Build — After It Got Caught Uploading Your Files
Grok Build, xAI's coding agent and terminal UI, is now open source on GitHub — Apache 2.0, written in Rust. The timing is not random: researchers found it uploading user directory contents, SSH keys included, to xAI's cloud servers. Nothing rebuilds trust like publishing the source. Now anyone can read exactly what it does with your home directory.
⏰ Grok Gets Automations
Grok now does scheduled and triggered tasks: run daily, weekly, monthly — or fire when an email matching your filters lands in your inbox. Schedules are free for everyone; email triggers need SuperGrok. Claude and ChatGPT already had their versions. The agent-loop feature set is converging fast across every lab.
🔵 Google Search AI Mode Now Connects to Your Apps
AI Mode in Google Search can now link to outside apps — Instacart, Canva, and YouTube Music at launch, US only. Ask for a grocery list and it builds the cart in Instacart, with checkout finishing over in the Instacart app. There's no app-management panel; AI Mode just offers a connection when your prompt fits one.
🟠 Google Vids: Prompt-to-Edit and Your Own Avatar
Google Vids picked up Gemini Omni — generate and edit video clips by describing what you want — plus personal avatars: record a selfie and a voice sample, and a synthetic you presents the video. Output carries a SynthID watermark, avatars are 18+ and region-limited. Available on AI Pro/Ultra and Workspace business tiers.
🎧 Spotify Ships "Talk to Spotify"
Spotify's conversational assistant is here: type or speak to it from Home or Now Playing, ask what you listened to two years ago, get a playlist built from the answer. Beta, Premium users 18+, US, Ireland, and Sweden only, English only. It runs on a mix of Spotify's own AI and third-party models. The DJ now takes requests in full sentences.
🔎 ChatGPT Search Finally Finds Your Own Chats
OpenAI rebuilt search inside ChatGPT: one sidebar search across chats, projects, images, and documents, with filters — web, iOS, and Android, all plans including free. Two years of conversations you could never find again are now indexed.
🍔 DoorDash Now Has a CLI for Agents
DoorDash's co-founder announced dd-cli: order food from the command line, or hand it to your agent — search stores, find deals, check out. Limited beta, macOS developers in the US and Canada, waitlist. "My agent ordered a burrito" is now a legitimate sentence in a standup.
🖼️ Meta Kills Its Instagram AI Tagging Feature in Three Days
Update on last week's story: Meta's Muse Image mechanic — tag any public Instagram account, generate AI images of them, with public adult accounts opted in by default — lasted roughly 72 hours. Creators, CAA, and SAG-AFTRA objected loudly; Meta said it "missed the mark" and pulled it. Opted-in by default, for generating images of other people.
⌚ New Siri Hits Public Beta — Including on Your Wrist
The rebuilt Siri is now in the iOS 27 and watchOS 27 public betas, and for the first time the real AI features reach the Apple Watch. Early reviews call it promising and occasionally transformative, but buggy, with queries that fail or time out. Full release lands in the autumn. The EU waits longer.
🏫 Anthropic Gives Teachers Free Claude
Claude for Teachers: verified K-12 educators in the US get a free year of premium Claude — teaching-skills library, evidence-based curricula connector, Cowork and Claude Code included. Individual educators only for now; a schools product comes later. Sign-ups run until June 2027.
📱 A 27B Model That Fits on Your Phone
PrismML released Bonsai 27B: a 1-bit quantization of Qwen3.6-27B squeezed to ~3.9GB — the biggest model realistically runnable on a phone. They claim ~90% of full-precision quality and 11 tokens/sec on an iPhone 17 Pro Max. Coding tests mostly defeat it. The draw is quick answers with zero data leaving the device, which for privacy-sensitive work matters more than benchmark scores.
🎨 Google Images Turns 25, Gets an AI Makeover
Twenty-five years after Google built image search (blame Jennifer Lopez's Grammys dress), Images is getting a personalized, browseable homepage tuned to your interests, plus Collections for saving. Image generation is also coming directly to Search via AI Overviews, powered by Nano Banana.
📓 NotebookLM Is Now "Gemini Notebook"
Google renamed NotebookLM to Gemini Notebook. Same product, new badge, plus a genuinely new feature: a secure cloud computer for code execution, on Ultra now and Pro soon, with AI Mode integration coming.
🗽 New York Freezes New Hyperscale Data Centers
Governor Hochul signed an executive order making New York the first state with a data-center moratorium: no new environmental permits for facilities over 50 megawatts, for up to a year, while the state studies grid and energy-price impact. The order also directs a statewide environmental impact study in the meantime.
🏠 Sunrun Wants to Put a Piece of a Data Center in Your House
Solar company Sunrun is piloting distributed AI compute: small inference nodes installed in homes that already have its solar-plus-battery systems, with homeowners paid for hosting and the capacity sold to enterprise AI buyers. The anti-hyperscale bet: a million rooftops instead of one giant campus. Yes, it sounds like crypto mining. The pitch is better economics and a grid that doesn't buckle.
