The week made one thing clear: the AI race now runs on who ships and who slips. Bloomberg reported that Google’s Gemini 3.5 Pro, the flagship promised for June, is still stuck in partner testing over weak coding results, while OpenAI and Anthropic keep pushing new models and tools into production. SpaceXAI answered a privacy scandal by open-sourcing its entire Grok Build coding agent, betting that transparency plus free usage would pull developers away from Claude Code and Codex. Underneath the model headlines, the money kept moving: Fireworks AI raised $1.5 billion to host open models, and SAP paid over a billion euros for an 18-month-old research lab.

Security had the loudest week in a while. Microsoft’s Patch Tuesday set a record with 570 fixes and three zero-days, two already under attack, and Microsoft openly credited AI for finding that many bugs. A pwn-request supply chain attack turned the AsyncAPI project’s own CI pipeline against it, shipping the Miasma RAT to millions of weekly npm downloads with valid provenance attached. AWS pointed Security Hub at Azure and AI workloads, Capital One open-sourced an offensive-style vulnerability hunter, and 1Password gave AI agents a way to use your passwords without ever seeing them. Here is everything that mattered.

Top Stories This Week

Bloomberg: Google’s Gemini 3.5 Pro Is Months Late Over Weak Coding -

On July 16, Bloomberg reported that Google is months behind on Gemini 3.5 Pro, its most powerful flagship model, because it has been trying to improve the model’s capabilities, particularly in coding. Google previewed 3.5 Pro at I/O in May, said it was already being used internally, and told the audience it would roll out “next month.” June came and went with only the lighter Gemini 3.5 Flash generally available. Bloomberg reported that a late-June attempt to lift coding scores by updating training data gave disappointing results, effectively resetting the timeline.

As The Verge summarized, the delay has frustrated Google engineers, researchers, and managers, some of whom worry the company is losing its edge to Anthropic and OpenAI. Google said it is “currently testing 3.5 Pro, an upgraded Flash model, and other models with partners” and that it is shipping quickly while keeping models cost-effective, but it has not set a new public date. Rumors of a July 17 launch came and went with nothing shipped. For developers, the read is simple: do not architect around an unreleased Gemini tier, and keep evaluating Flash, which teams like Figma have already wired into shipping products.

SpaceXAI Open-Sources Grok Build After an Upload Scandal -

On July 15, SpaceXAI open-sourced Grok Build, its terminal coding agent, under the Apache 2.0 license at github.com/xai-org/grok-build. The published tree is a roughly 844,000 to one-million-line Rust workspace covering the agent loop, tools, terminal UI, and the extension system for skills, plugins, hooks, MCP servers, and subagents. SpaceXAI framed it as the most direct way to build a trustworthy harness: read the source, extend it, and run fully local-first against your own inference. It does not accept external pull requests or issues, so this is source transparency, not a community-governed project.

The timing was not a coincidence. As Simon Willison documented, developers discovered a day earlier that the grok CLI would upload an entire working directory to xAI cloud buckets as a Git bundle; one user reported it shipped their SSH keys, password manager database, and personal files after a run in their home directory. SpaceXAI disabled default retention on July 12, promised to delete previously retained coding data, and reset usage limits alongside the open-source release. As The New Stack noted, Elon Musk pitched the move as an attack on Claude Code and Codex, and Bloomberg reported that Anthropic alone pays SpaceXAI about $1.25 billion a month for compute, which helps explain how xAI can afford to give the harness away.

Microsoft Patch Tuesday Sets a Record With 570 Flaws and 3 Zero-Days -

On July 14, Microsoft’s July Patch Tuesday fixed a record 570 vulnerabilities, the largest single release in the program’s history, including 59 rated Critical and three zero-days. Two were already under active attack: CVE-2026-56164, a SharePoint Server elevation of privilege flaw reported by Google’s incident responders and remotely exploitable in low-complexity attacks, and CVE-2026-56155, an Active Directory Federation Services elevation of privilege flaw caught by Microsoft’s own responders. The third, CVE-2026-50661, is a publicly disclosed BitLocker security feature bypass. CISA added both exploited flaws to its Known Exploited Vulnerabilities catalog the same day.

As Help Net Security reported, the flood was expected: Microsoft has started using an AI-powered vulnerability discovery system that is surfacing far more bugs across the Windows codebase before attackers find them. Microsoft also warned that attackers are using AI to weaponize known gaps faster, and it now recommends shrinking quality-update deferral windows to under three days. For platform and IT teams, the practical takeaway is to prioritize the SharePoint and ADFS fixes immediately and treat the record count as the new normal, not an anomaly. The 468 separate Edge and Chromium fixes Google shipped this month are not even counted in that 570.

AsyncAPI npm Packages Backdoored With the Miasma RAT -

On July 14, Microsoft Threat Intelligence and others detailed a coordinated compromise of the @asyncapi npm organization. Five versions across four packages were republished with the same malicious loader: @asyncapi/specs (6.11.2 and 6.11.2-alpha.1), @asyncapi/generator@3.3.1, @asyncapi/generator-helpers@1.1.1, and @asyncapi/generator-components@0.7.1. Because @asyncapi/specs is a transitive dependency of much of the AsyncAPI tooling, the exposure reached workstations, CI pipelines, and container builds. The dangerous twist is that the payload runs at module-load time, when the package is imported, so the usual npm install --ignore-scripts mitigation does nothing. The loader then pulls an encrypted second stage from IPFS and drops the Miasma remote access trojan with command and control, persistence, and fallback channels.

As Socket’s research team explained, the attacker never stole an npm token. They exploited a pull_request_target workflow that executed untrusted pull request code with access to repository secrets, opened 37 pull requests as camouflage, harvested a privileged bot token, then pushed to protected branches and let each project’s real release pipeline publish through npm’s OIDC trusted publisher. The result: malicious packages carrying valid SLSA provenance, on libraries with roughly 2.9 million weekly downloads. A fix for that exact workflow footgun had been sitting in an unmerged pull request for nearly two months. Remove the bad versions, pin the last safe releases, and rotate credentials on anything that imported them during the window.

Fireworks AI Raises $1.5B at a $17.5B Valuation -

On July 16, Fireworks AI said it raised a $1.5 billion Series D at a $17.5 billion valuation, led by Atreides Management, Index Ventures, and TCV, with Nvidia and others participating. The Nvidia-backed startup, which hosts open-source and custom models for developers and competes with Amazon and Google, now generates more than $1 billion in annualized revenue, roughly five times a year ago, and says it processes more than 40 trillion tokens a day. CEO Lin Qiao said the company once drew over half its revenue from a single customer, Cursor, and has since diversified as more teams move to open and specialized models.

The round is a clean signal of where infrastructure money is flowing. As frontier labs fight on list price, the companies serving open and fine-tuned models at scale are raising at neocloud multiples, and more than 95 percent of Fireworks’ token volume reportedly comes from models specialized on customers’ own data. Fireworks says the cash goes toward more GPUs, a bigger engineering and sales team, and deeper partnerships with cloud providers including Microsoft and Nvidia. For developers weighing hosted inference, the takeaway is that the open-model serving market now has a well-funded independent alternative to the hyperscalers.

AWS Security Hub Starts Watching Azure and AI Workloads -

On July 14, AWS made a major Security Hub expansion generally available: for the first time, the service natively monitors resources outside AWS. It now discovers Azure virtual machines, container images, Function Apps, and identities, checks them for misconfigurations, internet exposure, and vulnerabilities against the CIS Azure Foundations Benchmark, and ranks Azure findings in the same queue as AWS findings using the same automation. The launch also adds Amazon GuardDuty AI Protection, AI-powered investigations in preview, and a Security Hub AI inventory that maps Bedrock, SageMaker, and self-hosted models running on EC2, ECS, and EKS.

As The New Stack observed, this puts AWS in direct competition with Microsoft Defender for Cloud and Google’s newly acquired Wiz on multicloud posture management. Microsoft has monitored AWS from Defender since 2021, so AWS is playing catch-up on cross-cloud coverage, but pairing it with purpose-built AI workload visibility is the differentiator. Azure resources are priced the same as equivalent AWS resources with a 30-day free trial. For security teams running both clouds, the pitch is one prioritized queue instead of two consoles.

Anthropic Migrates Bun From Zig to Rust With Claude Code -

On July 16, Anthropic published a detailed writeup of running large-scale code migrations with Claude Code, and the headline example is striking. Jarred Sumner, the creator of Bun and now at Anthropic, used Claude Code to migrate the Bun runtime from Zig to Rust, producing about a million lines of code in under two weeks with 100 percent of Bun’s existing test suite passing in CI before merge. Nineteen regressions surfaced after merge and were all fixed, and the Rust port shipped inside Claude Code in June. Anthropic says its developers migrated ten packages, from tens to hundreds of thousands of lines each, using Claude Fable 5, Opus 4.8, and dynamic workflows.

The post is less a victory lap than a playbook. Anthropic lays out a six-step process for these long-deferred projects: map the codebase deterministically, generate a migration kit, deploy parallel agents, and gate everything behind the existing test suite. The honest framing matters, because these are exactly the migrations engineering teams have avoided for years due to cost and risk. If your codebase has a strong test suite, the piece is a concrete argument that agent-driven refactors at scale are now a real option, not a demo.

Developer Tools & Platforms

Vercel Launches a Monthly Next.js Security Release Program -

On July 16, Vercel announced a formal monthly security release program for Next.js, moving away from ad-hoc patching. Each announcement will state the expected release window and the highest anticipated severity so teams can plan upgrades. As a DEV Community rundown detailed, the first scheduled release lands July 20 and targets Next.js 16.2 and 15.5, bundling nine fixes across four high-severity and five medium-severity issues. Next.js 16 is Active LTS and 15 is Maintenance LTS, so teams on either line get supported patches; anyone on older majors should plan to move first. The shift matches a broader pattern this year of AI-assisted bug discovery pushing frameworks toward predictable, scheduled security cadences.

Claude Code Defaults Auto Mode as Fable 5 Subscription Access Ends -

Anthropic kept up its rapid Claude Code cadence, shipping v2.1.208 through v2.1.210 on July 14 after making Auto Mode the default on Amazon Bedrock, Google Vertex AI, and Foundry, disableable via disableAutoMode. The week’s releases added a screen reader mode, roughly 7x lower per-tool-call CPU and far smaller transcripts in edit-heavy sessions, and security hardening that stops the ultracode opt-in from firing on non-human input like webhooks and PR comments and toughens the agent tool against prompt injection. The calendar was the other story: Claude Fable 5’s included subscription access, extended twice, ended July 19 and moves to usage credits, capping a month of billing whiplash for Pro and Max users.

Alibaba’s T-Head Open-Sources SAIL to Challenge CUDA -

On July 18, Alibaba’s chip unit T-Head open-sourced SAIL, the full software stack for its Zhenwu AI chips, at the World AI Conference in Shanghai. The goal is to lower the barrier for developers locked into Nvidia’s CUDA, and T-Head claims programmers can adapt SAIL to mainstream AI frameworks in under seven days. Alibaba has already shipped 560,000 Zhenwu chips to more than 400 customers, so a public software layer makes that ecosystem stickier. The move lands amid geopolitical pressure on Alibaba, but for the wider developer world it is another data point in the slow, well-funded push to build a portable alternative to CUDA’s 17-year head start.

Security

Capital One Open-Sources VulnHunter, an Agentic Bug Finder -

On July 17, Capital One released VulnHunter, an open-source, agentic AI security tool that scans source code for exploitable vulnerabilities, maps how an attacker would reach them, and proposes targeted fixes before code ships. Built internally and now on GitHub under Apache 2.0, it is one of the more ambitious attempts by a major bank to turn offensive-style AI capabilities into a public defensive resource. The framing is pointed: seven years after a misconfigured firewall exposed 100 million records and made Capital One a byword for cloud risk, the same company is pushing security into the code itself. If it gains traction, it could reset the baseline for what enterprise security tooling is expected to do and pressure commercial vendors selling similar scanning.

1Password for Claude Lets Agents Use Credentials They Never See -

On July 16, 1Password and Anthropic launched 1Password for Claude, a browser integration that gives Claude access to stored credentials without those secrets ever reaching the model, its memory, or Anthropic’s systems. A user can authorize Claude to complete a real task like booking travel, and 1Password injects the credential directly into the target system on the user’s behalf. Alongside it, 1Password introduced Agentic Mode for all users: when a compatible agent controls the browser, the vault locks down so the agent can only reach the specific credentials granted for the current task. It is a concrete answer to the trust problem exposed by this year’s string of agent hijacking research, and the framework is designed to extend beyond Claude to other browser agents.

Funding & Industry Deals

SAP Acquires Prior Labs in a €1B+ Deal -

On July 17, SAP acquired German AI research lab Prior Labs for over 1 billion euros, just 18 months after the company was founded. Prior Labs builds tabular foundation models, with its latest, TabPFN-3-Thinking, positioned as state-of-the-art for enterprise prediction tasks over structured data. SAP said the deal will fund infrastructure, hiring, and multi-year frontier research while keeping Prior Labs an independent lab, and it establishes one of Europe’s most valuable AI research houses inside an enterprise software giant. For a European ecosystem often accused of exporting its best AI talent, a billion-euro outcome for an 18-month-old lab is a notable counterexample, even as it hands another frontier group to a large incumbent.

Chai Discovery Raises $400M for AI Drug Design -

On July 14, Chai Discovery raised $400 million at a $3.8 billion valuation, nearly triple its $1.3 billion mark from seven months earlier. The San Francisco company applies foundation models to molecular structure prediction and drug design, and the round is another sign that AI-for-science startups are commanding frontier-scale valuations even as they hire remote AI infrastructure talent. It landed the same week as several large infrastructure raises, underscoring that capital is still flowing hard into the layers around model training and inference, not just the labs themselves.

Layoffs: Microsoft, Redis, and Polygon

  • Microsoft: On July 18, Microsoft was reported to be cutting several hundred security engineers as it consolidates security-engineering teams and shifts capacity toward AI defenses like Security Copilot and code-vulnerability scanners under security chief Hayete Gallot. Microsoft has not publicly confirmed the scale. It follows the 4,800-job cut announced earlier in July that hit Xbox and sales hardest.
  • Redis: On July 13, Redis laid off about 80 of its 300 Tel Aviv R&D engineers, roughly 27 percent of the local workforce, even after crossing $300 million in ARR and signing a new ten-year lease. The company framed it as a strategic reshuffle, and the freed engineers, skilled in retrieval, vector, and agent memory, landed in a week of large AI infrastructure raises.
  • Polygon Labs: On July 16, Polygon Labs announced its second layoff round of 2026 as it finalizes its Coinme acquisition and pivots into a “blockchain-enabled payments company.” CEO Marc Boiron called the cuts difficult but necessary, part of a broader restructuring as the firm targets profitability in 2027.

The Numbers That Matter

  • 570 Vulnerabilities fixed in Microsoft’s July Patch Tuesday, a program record, with 3 zero-days
  • ~2.9 Million Weekly downloads across the backdoored @asyncapi npm packages
  • $1.5 Billion Fireworks AI Series D, at a $17.5 billion valuation
  • ~1 Million Lines of Rust produced migrating Bun from Zig in under two weeks with Claude Code
  • €1 Billion+ SAP’s acquisition price for the 18-month-old Prior Labs
  • ~80 Redis engineers cut in Tel Aviv, about 27 percent of the local R&D team

Quick Hits

  • Redis Layoffs - July 13. About 80 of 300 Tel Aviv R&D engineers cut, roughly 27 percent of the local team.
  • Microsoft Patch Tuesday - July 14. Record 570 flaws and 3 zero-days; 2 exploited (SharePoint and ADFS), AI-assisted discovery cited.
  • AsyncAPI npm Attack - July 14. Pwn-request compromise ships the Miasma RAT in four packages with valid OIDC provenance.
  • AWS Security Hub Multicloud - July 14. Native Azure monitoring plus GuardDuty AI protection and an AI inventory go GA.
  • Claude for Teachers - July 14. Anthropic gives verified US K-12 educators free premium Claude access for a year.
  • Chai Discovery - July 14. Raises $400 million at a $3.8 billion valuation for AI drug design.
  • Grok Build Open Source - July 15. SpaceXAI releases its Rust coding agent under Apache 2.0 after an upload scandal.
  • Gemini 3.5 Pro Delay - July 16. Bloomberg reports Google’s flagship is months late over weak coding results.
  • Fireworks AI Series D - July 16. $1.5 billion at a $17.5 billion valuation; over $1 billion in annualized revenue.
  • Next.js Security Program - July 16. Vercel moves to monthly security releases, first one July 20 for 16.2 and 15.5.
  • 1Password for Claude - July 16. Agents can use stored credentials without the secrets reaching the model.
  • Anthropic Bun Migration - July 16. Claude Code migrates Bun from Zig to Rust, about a million lines in under two weeks.
  • Rust 1.97.1 - July 16. Point release fixes a miscompilation bug in the prior week’s 1.97.0.
  • Polygon Labs Layoffs - July 16. Second 2026 round as the company pivots to blockchain payments.
  • SAP Buys Prior Labs - July 17. Over 1 billion euros for the 18-month-old tabular foundation model lab.
  • Capital One VulnHunter - July 17. Open-source agentic tool that finds and maps exploitable code flaws.
  • Microsoft Security Layoffs - July 18. Several hundred security engineers reportedly cut in an AI-focused reorg.
  • Alibaba T-Head SAIL - July 18. Zhenwu chip software stack open-sourced at WAIC as a CUDA alternative.
  • Fable 5 Subscription Cutoff - July 19. Claude Fable 5’s included subscription access ends and moves to usage credits.

The week’s split screen tells the story of mid-2026: a leader stumbling and challengers sprinting. Google’s Gemini 3.5 Pro is still not out, while SpaceXAI turned a privacy failure into an open-source play, Anthropic showed million-line migrations are now agent work, and Fireworks and SAP put billions behind the layers around the models. On the other side, Patch Tuesday’s record haul and the AsyncAPI attack proved that AI cuts both ways, finding bugs faster for defenders and turning trusted CI pipelines into malware distributors for attackers. Next week watch for the July 20 Next.js security release, any actual Gemini 3.5 Pro or Claude Opus 5 movement, and whether the AsyncAPI cleanup finally kills the pull_request_target footgun for good. See you then.