Monday, July 6, 2026

The other through-line is the plumbing of AI economics: NVIDIA is now offering startups compute-for-revenue-share, and OpenAI is putting its flagship Sol model on Cerebras wafer-scale silicon at ~750 tok/s. Also: the Claude Fable 5 subscription cutoff lands tomorrow (Jul 7).

TLDR

"DuneSlide": two CVSSCommon Vulnerability Scoring SystemA standard 0 to 10 severity score: 0.1–3.9 low, 4.0–6.9 medium, 7.0–8.9 high, 9.0–10 critical.FIRST ↗ 9.8 Cursor IDE flaws let a zero-clickAn attack that compromises a device without the user clicking, opening or interacting with anything.F5 ↗ prompt injectionInput crafted to change an LLM's behavior or output in ways its builders didn't intend.OWASP ↗ escape the sandbox to OS-level RCERemote code executionA flaw that lets an attacker run malicious code on a target's computers or network.Cloudflare ↗ — fixed in Cursor 3.0 (disclosed Jul 1) Security
NVIDIA launches a revenue-sharing / vendor-financing compute model to get GPUsGraphics processing unitA highly parallel processor that does the large matrix math behind training and running models.NVIDIA ↗ into startups and neoclouds (Baseten, Fireworks, Together AI cited) (Jul 2) Infra Business
OpenAI to run GPT-5.6 Sol on Cerebras at up to ~750 tok/s "in July" — order-of-magnitude faster streaming for a frontier model (Jul 1) Infra
Anthropic deprecation reminder: fast mode for Claude Opus 4.7 is removed Jul 24 (no fallback) — migrate to Opus 4.8 (deadline Jul 24) Pricing

Action Items

Things your engineering team should look at or do this week.

Upgrade Cursor to 3.0+ now. The DuneSlide flaws (CVE-2026-50548 / CVE-2026-50549, CVSS 9.8) let a malicious repo, doc, or web page trigger arbitrary command execution on a developer's machine with no click. Fixes shipped in Cursor 3.0 (Apr 2), so the action is simply confirming every engineer is off pre-3.0 builds. (The Hacker News | Cato Networks)
Repoint Opus 4.7 fast-mode calls before Jul 24. Fast mode for Opus 4.7 is deprecated (since Jun 25) and gets removed Jul 24 — after that, fast-mode requests error out and do not fall back to standard Opus 4.7. If you use it for latency-sensitive paths, migrate to Opus 4.8 to keep the speedup. (Claude Platform Docs)

Models & Tools

OpenAI: GPT-5.6 Sol on Cerebras at ~750 tok/s (Jul 1) Infra — OpenAI confirmed its frontier Sol model (previewed Jun 26 under the White House voluntary pre-deployment review) will run on Cerebras wafer-scale hardware at up to ~750 tokensA small unit of data, such as part of a word, that AI models read and generate. Many AI services price by tokens in and out.NVIDIA ↗/sec "in July," roughly an order of magnitude above the ~40–120 tok/s typical of GPU streaming for a model this size. Access is initially limited as capacity scales; Sol's API tariff is $5 in / $30 out per M tokens, and this sits alongside a disclosed ~$20B multi-year Cerebras inferenceRunning a trained model on new input to get an output, as opposed to training it.NVIDIA ↗ contract. Worth watching if you have latency-bound frontier workloads. (OpenAI | Hacker News)

APIs & Pricing

Anthropic: fast mode for Claude Opus 4.7 removed Jul 24 (deprecated Jun 25; deadline Jul 24) Pricing — After removal, fast-mode requests on Opus 4.7 return an error with no fallback to standard Opus 4.7; Anthropic's guidance is to move to Opus 4.8 to retain the speedup. Small but easy to miss if it's buried in a latency-sensitive code path. (Claude Platform Docs)
Anthropic: Claude 3.5 Haiku reached end-of-life Jul 5 (shutdown Jul 5) Pricing — The retirement (announced back on Jan 5) has now taken effect, so any lingering claude-3-5-haiku calls will fail. If you haven't already, repoint to Haiku 4.5 or a current small model. (endoflife.date/claude)

Security

"DuneSlide": zero-click prompt-injection → RCE in Cursor IDE (disclosed Jul 1) Security Agents — Cato AI Labs disclosed two critical flaws (CVE-2026-50548 / CVE-2026-50549, CVSS 9.8) in which untrusted content processed by Cursor's agent can escape the editor sandbox — e.g., overwriting the cursorsandbox binary — and run unsandboxed commands on the host, no user click required. Reported to the vendor in Feb 2026 and fixed in Cursor 3.0 (Apr 2); the public write-ups landing this week make it a good prompt to verify your fleet is patched. A reminder that "sandboxed" AI editors are only as safe as the sandbox. (SecurityWeek | Cato Networks)

Industry & Business

NVIDIA opens a revenue-sharing compute model for startups and neoclouds (Jul 2) Infra Business — NVIDIA introduced a business model pairing vendor financing with revenue sharing so smaller AI clouds and model builders can secure GPU capacity without years-long procurement commitments — NVIDIA takes standard hardware revenue plus a cut of the cloud revenue on supported capacity. It explicitly targets the inference-provider / agent-platform / model-builder tier (Baseten, Fireworks AI, Together AI named as the archetype), with early partners Sharon AI (up to 40k GB300 GPUs) and Firmus (a 360MW Indonesia campus scaling to ~170k GPUs). Net effect for buyers: more elastic neocloud capacity, and NVIDIA deepening its equity-like grip on the supply chain. (CNBC | NVIDIA)

Still a quiet post-holiday stretch, and the freshest signal this morning is a security one: Cato's "DuneSlide" disclosure turns a Cursor prompt injection into zero-click OS-level RCE — patched in Cursor 3.0, but any team still on an older build should upgrade today.