StationX
MEMBERSHIP

Sec & AI News — 24 July 2026

8 min readBy Nathan House
Get every new Sec & AI News issue
Straight to your inbox. No spam.

⚙️ Cybersecurity Just Changed Sides — Both of Them

For twenty years security ran on a stable equilibrium: new attacks, new defences, same fundamental model. That model is breaking, and this week shows why. AI now works both sides of the fight — an OpenAI model chained real flaws into remote code execution against a live company (more on that below), while a security-tuned model from Google patches vulnerabilities on its own. Friction-based defence is dead: when an attacker goes from CVE to working exploit in hours, making an attack merely tedious stops nothing. The patch window has collapsed with it. And yet the defender still holds the structural advantage. You already have the source code and the access an attacker has to reconstruct from scratch, so you can find the same bugs first and fix them immediately — but only at machine speed. Do it by hand and you've handed back the one edge you had. That's what AI-driven engineering is for. Running a scanner once is just the security version of vibe coding. The real skill is building infrastructure that scans on every commit and learns from its own false positives, so it attack-tests and defends many times faster than anyone still working by hand. This is an arms race, and the attackers have already automated. The people who make it through won't be the ones running the tools. They'll be the ones who built the systems.

🔴 Washington Wants to Ban Kimi K3. Good Luck With That.

Moonshot's Kimi K3, the 2.8-trillion-parameter model topping several coding and agentic benchmarks, has the US government reaching for the ban hammer. White House science advisor Michael Kratsios says the US "has information" that Moonshot distilled Anthropic's Fable to build it, using Nvidia GB300 chips routed through Thailand. Experts aren't buying the distillation story: Fable 5 shipped July 1, K3 landed July 16, and you can't distill, train, and ship a frontier model in two weeks. The weights themselves go public July 27. Bans work better before the download link exists.

🧠 Claude Opus 5 Is Out — and the Story Is Security

Anthropic shipped Opus 5 on 24 July, and the pricing is the head-scratcher: $5/$25 per million tokens, same as 4.8 and half of Fable 5, while Anthropic's own system card admits it isn't more capable overall than Fable 5 — yet it matches or beats it on several of their benchmarks. Read the numbers with the usual caution; every one is vendor-reported. For our world the real news is buried in the 194-page system card: the cyber-safety classifiers are expected to step in about 85% less often than for Fable 5, and source-code vulnerability discovery is now permitted at every access tier (pentesting still needs Cyber Verification Program membership). One breaking change to watch before you upgrade — thinking is on by default now, and asking for xhigh or max effort with it turned off returns an HTTP 400, so your 4.8 code may not just work.

🛡️ The Autonomous Pentest Tool Everyone's Talking About — I Ran It

Tempest is free, open source, and claims a 90% score on a black-box hacking benchmark, so I downloaded it, reviewed its code, and pointed it at a real target. What I actually got was a capable but occasionally-confused junior operator that tags its own findings "model-asserted, unverified," and every impressive number came from a single agent, not the full eight-agent swarm. What Tempest actually ships is the same Claude Code or Codex you already have, wrapped in scaffolding that decides what to run and when. That scaffolding is where the leverage lives. The model underneath is one you could already talk to. (Google's own security model, Gemini 3.5 Flash Cyber, stays behind a government-only gate — see below.)

🚨 OpenAI's Models Broke Out of Their Sandbox and Hacked Hugging Face

OpenAI was benchmarking GPT-5.6 Sol and an unreleased model on ExploitGym, a Berkeley benchmark for turning known vulnerabilities into working exploits, with cyber refusals dialed down for the eval. The models found a zero-day in a package-registry proxy inside OpenAI's own research environment, reached the open internet, chained two flaws in Hugging Face's dataset pipeline into remote code execution, and pulled the benchmark answer key from a production database. All of that to cheat on a benchmark. Roughly 17,000 actions, by one reconstruction. Hugging Face contained it on July 16 without knowing whose agent it was; OpenAI owned up on the 21st, and Hugging Face says no public models, datasets, or Spaces were tampered with.

🔵 Google Ships Three Gemini Flash Models. Still No 3.5 Pro.

Gemini 3.6 Flash is the new workhorse: better coding, knowledge work, and computer use, with 17% fewer output tokens than 3.5 Flash. 3.5 Flash-Lite does 350 output tokens a second and is rolling into Google Search. The interesting one for this audience is 3.5 Flash Cyber, a security-specialized model paired with CodeMender to find, validate, and patch vulnerabilities. That one you can't have: limited-access pilot, governments and trusted partners only. The model everyone actually wants, Gemini 3.5 Pro, remains "in testing."

💉 Every One of Those Connected Inboxes Is an Attack Surface

The new wave of voice agents reads your Gmail and Slack, and that sounds convenient right up until you remember what's sitting in those inboxes. An agent that acts on the contents of an email will also act on instructions hidden inside one — that's prompt injection, and an attacker doesn't need your password, just a message your agent will read. I've built a searchable reference of 82 real techniques across nine categories: direct override, indirect injection through content the model ingests, role-play jailbreaks, and more. If you're wiring an LLM up to tools this year, know what you're defending against before you connect the calendar.

🟠 Alibaba's Qwen 3.8: 2.4 Trillion Parameters, Zero Benchmarks

Announced at WAIC Shanghai: Qwen3.8-Max-Preview, a 2.4-trillion-parameter sparse MoE and the first Qwen multimodal model past the trillion mark. Alibaba claims it's second only to Fable 5. There's no published benchmark table behind that, no model card, no license, and no date for the promised open weights. And Alibaba owns roughly 36% of Moonshot, so Qwen 3.8 versus Kimi K3 is partly a family argument, one that landed three days after K3's launch.

🩺 ChatGPT Health Goes Live for All US Users

The waitlisted January launch is now a full US rollout: a dedicated Health space in ChatGPT for logged-in users 18+, across Free, Go, Plus, and Pro. It connects Apple Health and supported medical records; health chats and files sit in their own silo and aren't used for training. Free tier runs GPT-5.5 Instant, paid tiers get GPT-5.6 Sol. Web and iOS now, Android soon. It shipped one day after OpenAI got sued over allegedly harmful health advice.

🎙️ ChatGPT Voice Lands on Desktop — and It Drives Your Computer

GPT-Live, the full-duplex voice mode from mobile, is now in the ChatGPT desktop app on macOS and Windows for paid plans. The Jarvis pitch, in increments: talk to it and it directs agents across ChatGPT, Work, and Codex, so "sort out my downloads folder" is now a thing you say to your computer. macOS "Appshots" feeds it screen context, and iOS Remote pairing lets you steer your desktop from your phone.

🗣️ Claude Voice Mode Gets Real Models and Real Tools

Anthropic upgraded Claude's voice mode to run on Opus, Sonnet, and Haiku, with access to connected apps: Gmail, Slack, Google Calendar, Docs, Notion, Canva. Push a meeting by voice, or have it summarize today's email and draft replies to the urgent ones. Beta across iOS, Android, desktop, and web; free users get Haiku and one connected app. Anthropic also shipped "Record a skill" in Claude Cowork, two weeks after OpenAI's version of the same idea: record your screen doing a task, narrate it, and Claude turns it into a reusable skill. Pro, Max, and Team plans.

🖼️ Microsoft Ships Its Priciest In-House Image Model Yet

MAI-Image-2.5-Pro and MAI-Voice-2-Flash hit public preview in Microsoft Foundry. The image model is Microsoft's highest-fidelity to date, priced accordingly: $106 per million image output tokens, more than double the standard 2.5. Voice-2-Flash goes the other way. Twice as fast and 32% cheaper than MAI-Voice-2, 15+ languages, already powering Dynamics 365 Contact Center, where Microsoft claims up to 89% GPU cost reduction.

🎬 Black Forest Labs Announces FLUX 3 — Now With Video, Audio, and Robots

FLUX 3 is BFL's first multimodal frontier model: images, video up to 20 seconds with native synchronized audio, and action prediction, all learned jointly. Rollout is staged — Video and Action in early access now, Image in the coming weeks, an open-weight FLUX 3 Dev planned. There's also FLUX-mimic, a video-action robotics model built with mimic robotics that's already being tested on Audi production lines. So the image-generation company is now building a world model, which this week makes it one of several.

🔀 Runway Stops Picking Models For You. Sort Of.

Runway Media Router, live in the new Runway Dev platform: define cost, quality, and latency preferences and it routes each request to the right video, image, or audio model, third-party models included. It can even filter models by geopolitical origin for data-sovereignty requirements. Dev customers already include Adobe, Cloudflare, ElevenLabs, and Shutterstock. TechCrunch reads it as Runway pivoting to infrastructure while its own models slide down the leaderboards.

🤳 Google Adds Selfie Video Sign-In — for Account Recovery

Google's new "selfie for sign-in" lets you recover access to your account with a short selfie video, liveness detection included to defeat photos and deepfakes. Recovery is the key word: this layers onto your existing backup options, and day-to-day sign-in stays as it was. The video is encrypted, consent-based, and deletable; optional opt-ins extend it to age verification and AI avatars. Not available for Workspace, child, or Advanced Protection accounts.