Friday, June 26, 2026

Anthropic also went public accusing Alibaba of the largest known "distillationTraining a smaller model to copy a larger model's outputs, so it is cheaper to run.Hinton et al. 2015 ↗" attack on Claude. On the security front, the DifyTap flaws expose AI chats across tenants on a platform powering 1M+ apps. Fable 5 / Mythos 5 hit their Jun 26 Commerce deadline still at zero traffic.

TLDR

Google's AI brain drain deepens: ~5 senior researchers gone in a week, ~$270B off Alphabet, Gemini 3.5 Pro slips to July (Jun 22–26) Hiring Trending
Anthropic accuses Alibaba of the largest known distillation attack on Claude (Jun 24) — 28.8M exchanges via ~25,000 fake accounts, Apr 22–Jun 5 Security Trending
DifyTap: four authorization flaws expose cross-tenant AI chats on Dify (1M+ apps) (Jun 22) — critical CVE-2026-41947 (CVSSCommon Vulnerability Scoring SystemA standard 0 to 10 severity score: 0.1–3.9 low, 4.0–6.9 medium, 7.0–8.9 high, 9.0–10 critical.FIRST ↗ 9.1), patch to ≥1.14.2 Security
Fable 5 / Mythos 5 hit their Jun 26 Commerce deadline still offline (Jun 26) — Lutnick due to answer Congress today; zero traffic, "partial unban" reports were a UI bug Policy
AI funding stays hot: Scaled Cognition $100M, Runpod $100M (now a unicorn), Sail Research $80M (Jun 25) Business

Action Items

Things your engineering team should look at or do this week.

Patch self-hosted Dify to ≥1.14.2 now. The DifyTap flaws (notably CVE-2026-41947, CVSS 9.1) let unauthenticated attackers exfiltrate other tenants' AI chats by redirecting trace data. All but one CVECommon Vulnerabilities and ExposuresA public catalog that gives each known security vulnerability a unique ID, a short description and at least one reference.NIST ↗ are fixed in 1.14.2. (The Hacker News)
Re-plan anything that assumed Gemini 3.5 Pro GA in June — it's slipped to July. If a roadmap item depended on the June launch, adjust timelines and keep current Gemini/alternative routing in place. (TipRanks)
Keep Fable 5 / Mythos 5 fallbacks in place. Today's Commerce deadline doesn't change the operational reality: both models are at zero traffic with no confirmed restoration date. Don't unwind contingency routing. (explainx)

Models & Tools

GPT-5.6 imminent but not yet released (anticipated) Trending — OpenAI has published no model card, API string, or announcement, but chief scientist Jakub Pachocki called it a "meaningful improvement" over GPT-5.5 (The Information, Jun 10), and prediction markets had assigned ~83% to a Jun 22–28 launch before the window narrowed toward July. Rumored: larger context (1.5–2M tokensA small unit of data, such as part of a word, that AI models read and generate. Many AI services price by tokens in and out.NVIDIA ↗) and stronger agenticDescribes AI systems where a model uses tools and decides its own steps instead of following a fixed script.Anthropic ↗ behavior. Treat as expected, not shipped — don't build against it yet. (Tech Times)

Security

DifyTap: cross-tenant data exposure in Dify (1M+ apps, 146K+ GitHub stars) (Jun 22) Security — Zafran disclosed four authorization flaws in the open-source agentic-workflow platform. Two are critical and two need no authentication; three carry cross-tenant impact on Dify Cloud. The worst, CVE-2026-41947 (CVSS 9.1), lives in the tracing system — missing tenant-ownership checks let an attacker redirect all of a victim app's messages and model responses to an attacker-controlled LLMLarge language modelA neural network trained on huge amounts of text that generates text, answers questions and summarizes.Anthropic ↗ trace provider, a covert wiretap. Others allow traversing the internal Plugin Daemon API and previewing other tenants' uploaded files. Fixed in v1.14.2 (all except CVE-2026-41948). (The Hacker News | Zafran | SecurityWeek)

Industry & Business

Google's researcher exodus widens; Alphabet sheds ~$270B; Gemini 3.5 Pro slips to July (Jun 22–26) Hiring Trending — Update to the Jun 17 Jumper departure. The trickle became a stream: Noam Shazeer (Gemini co-lead, "Attention Is All You Need" co-author) left for OpenAI Jun 18, Nobel laureate John Jumper for Anthropic Jun 19, followed by AlphaFold/Gemini contributors Jonas Adler and Alexander Pritzel and safety/Gemini-2.5 engineer Arthur Conmy — roughly five senior exits in a week. Alphabet shares fell ~5% on Jun 22 and have lost ~$270B in market value, and Google quietly pushed Gemini 3.5 Pro GA from June to July ("quality refinements"). (24/7 Wall St | Crypto Briefing | TipRanks)
Anthropic accuses Alibaba of largest known distillation attack on Claude (Jun 24) Security Trending — In a letter to the Senate Banking Committee (dated Jun 10, surfaced Jun 24), Anthropic alleged operators tied to Alibaba's Qwen lab ran ~28.8M exchanges through ~25,000 fraudulent accounts between Apr 22 and Jun 5, specifically targeting Claude's software-engineering and agentic-reasoning capabilities to "distill" a cheaper rival. Alibaba has not substantively responded; the disclosure lands amid the same national-security backdrop as the Fable/Mythos export controls. (CNBC | Bloomberg | Tom's Hardware)
Funding stays hot: Scaled Cognition $100M, Runpod $100M (unicorn), Sail Research $80M (Jun 25) Business — Scaled Cognition raised a $100M Series A (Khosla, Genesys) for its policy-constrained agent model APT; GPU-cloud Runpod raised $100M Series A (Summit Partners) at a $1B valuation; Sail Research took $80M (Kleiner Perkins/Sequoia, $450M valuation) targeting agents that run for days, not seconds. Trase ($107M, ARCH/Red Cell) and several others also closed the same day. (Tech Startups)
2026 AI-attributed layoffs keep climbing (Jun 26) Hiring — Trackers now log ~267 layoff events affecting ~185,894 workers year-to-date, with 56% of events citing AI/automation; Oracle's ~30,000-job cut remains the year's largest. Independent studies (Gartner, MIT NANDA, METR) still find little evidence the cuts improved financial returns — a useful counter-signal when leadership pitches AI-for-headcount. (TechCrunch)

Policy & Safety

Fable 5 / Mythos 5: Jun 26 Commerce deadline arrives, models still dark (Jun 26) Policy — Update to an ongoing story. Today is the deadline for Commerce Secretary Lutnick to answer four bipartisan members of Congress (letter sent Jun 18) on whether Anthropic could remediate before the ban, whether the capability is unique to Anthropic, whether Commerce followed required process, and the factual basis for the "military intelligence end use" label. Operationally nothing has changed: Anthropic staff reiterated Jun 25 they serve "exactly 0 traffic" to Fable/Mythos, and viral reports of a partial unban were traced to a UI bug. (explainx | The Hill)

Talent is the story: Google's researcher exodus to Anthropic widened to ~5 names in a week, helping wipe ~$270B off Alphabet and pushing Gemini 3.5 Pro into July.