The day's tech, sifted: Jul 15, 2026

What matters today: 26 former and current Meta employees sued the company, alleging its internal AI systems, not human managers, selected who to lay off in May, disproportionately targeting workers with disabilities or on protected medical and parental leave. OpenAI's long-rumored hardware push got its first real shape: Bloomberg reports the company's first device will be a moveable, screen-free smart speaker with a camera and sensors, arriving days after Apple sued OpenAI over the same hardware ambitions. Payments got its own shock: Stripe and private equity firm Advent International jointly offered $60.50 a share for PayPal, a 28% premium valuing the company above $53B. And Microsoft closed out Patch Tuesday under a cloud: a record 570 flaws fixed this month, the same week researchers found Secure Boot has been trivially bypassable for 13 of its 14 years.

AI / LLMs

• Bloomberg reports OpenAI's first hardware device will be a moveable, screen-free smart speaker with a camera, sensors and a rechargeable battery for portability, offering smart home control and positioned as a humanlike AI companion; OpenAI's statement on the news said it is "not aware of any evidence" Apple's trade-secrets lawsuit "has merit."
• Sources say DeepSeek has begun planning a Chinese IPO and may file this year, aiming for a 2027 debut, a landmark test of the market's appetite for a domestic AI pioneer.
• OpenAI researcher Miles Wang, whose work applies AI to scientific and biological discovery, is leaving to launch a drug discovery startup, reportedly in talks to raise $200M at a $2B valuation.
• PrismML says its Bonsai 27B is the first 27B parameter model that runs on a phone, trained natively in 1-bit quantization to shrink to 3.9GB (11 tokens a second on an iPhone 17 Pro) while holding over 90% of full-precision benchmark performance, released free under Apache 2.0.
• Goodfire opened a private beta for Silico, which lets an AI agent autonomously run interpretability experiments inside a model and says it cuts hallucinations 37% by reproducing months of research in days.
• Google unveiled Sec-Gemini v3 alongside CodeMender and the open-source CAPSEM standard, a security stack aimed at protecting AI agents from code to commerce.
• Pragmatic Engineer traced "loop engineering," the shift from prompting AI coding agents to designing the loops that run them, back a year to Geoffrey Huntley's "Ralph Wiggum" loops, now built into every major coding harness's /goal command.

Devtools & Infra

• GitHub's Dependabot version updates now default to a 3 day cooldown before opening a pull request for a newly published package version, giving maintainers time to catch a compromised or broken release before it lands; security updates still open immediately, and the window is configurable.
• Security firm Mindgard went public with an unpatched Cursor IDE vulnerability that lets a malicious git.exe planted at a repo's root auto-execute the moment a developer opens the project, no click required; Mindgard reported it privately in December, and Cursor only said it was "addressing" the issue after seven months of silence.

Security & Privacy

• Microsoft's July Patch Tuesday fixed a record 570 flaws, nearly triple last month's count; nearly 60 are rated critical, three are zero-days (two already exploited), and Microsoft credits AI-assisted vulnerability discovery for the surge.
• ESET researchers found Microsoft's Secure Boot has been trivially bypassable for 13 of its 14 years: 11 known-defective signed firmware "shims," at least one from 2013, were never revoked, letting an attacker on Windows or Linux install persistent malicious firmware.
• A study found social platforms drove 5.7M+ visits to "nudify" deepfake sites between December and March, YouTube alone sending 1.82M, for as little as $1 an image.
• The Trump administration launched "Gold Eagle," a federal clearinghouse for sharing AI-related cyber threat intelligence with the private sector, which the White House says has already started prioritizing patches from shared vulnerability data.

Startups & Industry

• The Meta AI-layoffs lawsuit detailed in the lead names an internal system called "Metamate," employee "second-brain" agents, keystroke monitoring and AI-token-usage dashboards that scored and ranked workers; the complaint says employees were also graded on how heavily they used Meta's own AI tools, sorted into tiers like "AI Native" and "AI First."
• OpenAI called false Apple's claim that OpenAI never responded to its outreach in the trade-secrets suit filed yesterday; emails show the mixup traces to an Apple lawyer confusing two OpenAI staffers named Wang and Chang.
• Google and Epic jointly withdrew their fight over Android app stores, and Google now says it will start carrying rival stores inside Google Play starting July 22, ending a court battle running since 2024.
• A PJM electricity auction is projected to add $6.3B to bills across 13 states and DC through 2029 on data center demand, the same day multiple GOP governors and utilities were reported set to join Trump's pledge for data center developers to cover their own energy and infrastructure costs.
• Cybersecurity stocks rallied Tuesday, CrowdStrike up 12% and Okta up 11%, after IBM's CEO flagged cyber fears as customers' top priority in preliminary earnings.
• CoreWeave is reportedly exploring financial derivatives to hedge against a future drop in memory and storage chip prices, a sign the AI cloud buildout is starting to price in its own correction.
• Two AI-tooling startups raised early rounds: sales-automation agent maker InstaLILY closed a $60M Series B, and compliance-tools maker Hadrius raised a $22M Series A.

Elsewhere

• The US military used explosive drone boats in combat for the first time, striking an Iranian midget submarine and naval port at Bandar Abbas on the night of July 12, nearly a decade after Iran and the Houthis first fielded such weapons.
• The UK proposed a default overnight social media curfew for 16 and 17 year olds, plus disabling autoplay and infinite scroll by default.

Hacker News

Money and AI-debt math dominated the front page: S&P downgraded Oracle from BBB to BBB-, one notch above junk, the same day the Bank for International Settlements published a look at how the AI boom is increasingly financed with debt rather than cash flow and Fortune reported data centers have already added $23B to public electricity bills, the same dynamic behind today's PJM and GOP-governors stories above. Oracle's downgrade pulled the heaviest discussion (discussion).

Elsewhere on the front page: a deep dive on measuring desktop input latency across X11, Wayland, VRR and DXVK pulled a long technical thread, a post titled I'm a USB-C Maximalist drew outsized comment volume (discussion) typical of a contrarian front-page take, and Vancouver's police department added a Quick Escape button to its website that wipes itself from browser history. StubHub and its CEO were hit with a deceptive-practices class action over mass ticket scalping, and a practical walkthrough on using HTMX with Go rounded out the devtools corner. Bonsai 27B's phone-sized release, the Cursor 0day disclosure and Dependabot's new cooldown default all made the front page too, covered above.

Threads

• Security had a brutal cycle on three fronts: Microsoft's record 570-flaw Patch Tuesday landed the same week its Secure Boot was found broken for 13 years and Cursor left a git.exe auto-exec bug unpatched for seven months; cybersecurity stocks rallied on the fear alone.
• Data center economics kept compounding: yesterday's New York construction moratorium met a $6.3B PJM auction bill and GOP governors lining up behind Trump's cost-shifting pledge, while CoreWeave hedges against the same buildout cooling off.
• AI took two very different device shapes: OpenAI's screen-free smart speaker leaked days after Apple sued it over hardware secrets, while PrismML squeezed a 27B model onto an iPhone the un-hyped way: on-device inference, not a new gadget.
• The Apple-OpenAI fight got its first factual correction: OpenAI called Apple's claim of no response false, tracing it to a lawyer mixing up two employees, a small crack in a lawsuit filed less than a day earlier.
• AI's use on people, not by them, drew two separate lawsuits and one study in a single cycle: Meta's AI-driven layoff targeting and nudify sites fed by social platform traffic, both stories about automated systems deciding things about people who never consented to being judged by them.