HN Daily | July 8, 2026

Today's tech landscape is buzzing with major AI model releases from OpenAI and SpaceXAI, a surprising Rust rewrite of Bun, and critical security vulnerabilities in GitHub's AI workflows. Meanwhile, the EU is on the verge of reviving controversial message scanning rules, and TypeScript gets a 10x speed boost with its Go-native port. Let's dive in.

AI & Machine Learning

Grok 4.5 — SpaceXAI's latest model excels at coding and agentic tasks, scoring 62% on DeepSWE and 83.3% on Terminal-Bench 2.1. It's priced aggressively at $2/M input tokens and boasts 80 TPS speeds with 4.2x better token efficiency than Opus 4.8.
GPT-5.6 Sol, along with Terra and Luna, will launch publicly this Thursday — OpenAI's next generation of models is arriving this week, with Sol leading the pack and Terra/Luna expanding preview access globally. The naming scheme suggests a family of specialized models.
SWE-1.7 Reach Near GPT 5.5 and Opus Intelligence — Cognition's new model achieves frontier-level coding performance at much lower cost, with 42.3% on FrontierCode 1.1 and 81.5% on Terminal-Bench 2.1. It's available in Devin at 1000 TPS via Cerebras.
Mistral's Robostral Navigate: a state of the art robotics navigation model — An 8B model that lets robots navigate complex environments using just a single RGB camera, achieving 76.6% success on unseen R2R-CE benchmarks. It beats multi-sensor approaches while being more efficient.
Local, CPU-Friendly, High-Quality TTS (Text-to-Speech) with Kokoro — Kokoro's 82M parameter model produces realistic speech in multiple languages, running entirely on CPU. Even a 12-year-old i7-4770K can generate speech in under 5 seconds.

Open Source

Chatto is now open source — A snappy, self-hosted group chat app with E2E encrypted voice/video calls, designed to be extremely easy to deploy. It's a compelling alternative to Slack, Teams, and Discord for privacy-conscious teams.
EVE Online's Carbon engine is now open source: Fenris Creations explains why — The 23-year-old engine behind EVE Online is now on GitHub under permissive licenses. Fenris hopes community contributions will improve security and enable new projects.
TypeScript 7 — A 10x faster native port of TypeScript built in Go, delivering 8-12x speedups on full builds and 13x faster editor startup. It's available now via npm with LSP support for all major editors.
Microsoft releases Flint, a visualization language for AI agents — A semantic-type based visualization intermediate language that lets AI agents generate good-looking charts from simple high-level specs. Includes an MCP server for easy integration.
Herdr: One terminal to rule them all — An agent multiplexer that runs all your coding agents in one terminal, keeping them alive when you close your laptop. Supports Claude Code, OpenCode, and more, with no Electron or telemetry.

Security & Privacy

GitLost: We Tricked GitHub's AI Agent into Leaking Private Repos — Noma Labs found a prompt injection vulnerability in GitHub's Agentic Workflows that lets attackers steal private repo data by posting a crafted issue. The "Additionally" keyword bypassed guardrails.
EU now one step away from reviving private message scanning rules — The European Parliament approved an urgent procedure to fast-track legislation reviving expired "Chat Control 1.0" rules. The binding vote on July 9 could allow voluntary scanning of private messages again.
Chat Control 1.0 and 2.0 Explained — A comprehensive timeline of the EU's controversial message scanning proposals, from the 2021 temporary derogation to the current revival attempt. The permanent CSAR regulation remains deadlocked over encryption.
OpenBSD has a use-after-free allowing local privilege escalation to root — A critical vulnerability in OpenBSD that could let attackers gain root access. The fix is already committed.
DKIM2 and DMARCbis Have Landed — Two major email authentication standards have arrived: DKIM2 creates a verifiable chain of custody for messages, while DMARCbis replaces the static Public Suffix List with a live DNS tree walk. Stalwart is the first mail server to support both.

Tools & Infrastructure

Rewriting Bun in Rust — Bun's creator explains the decision to rewrite the JavaScript runtime from Zig to Rust, citing systematic memory safety issues from mixing GC with manual memory management. The rewrite aims to prevent entire classes of bugs.
Cloudflare Meerkat - Globally distributed consensus — Cloudflare's new consensus service powered by QuePaxa, which allows all replicas to perform writes simultaneously without leader timeouts. Designed for their 330+ global data centers.
Poison, redzones and shadows: inside KASAN — A deep dive into the Kernel Address Sanitizer's internals, explaining how it catches out-of-bounds and use-after-free bugs in the Linux kernel through shadow memory and compiler instrumentation.

Fun & Curiosities

Decoding the obfuscated bash script on a Uniqlo t-shirt — Someone decoded the base64-encoded bash script printed on an Akamai x Uniqlo t-shirt, revealing an Easter egg that animates "PEACE FOR ALL" across the terminal. The script even includes a color gradient from cyan to orange.
A bug which only affected left handed users — A WordPress bug that caused comment boxes to appear when scrolling with the left thumb, because a touchstart listener on the left-side reply link was triggered by left-handed scrolling. The fix was deleting two lines of code.

That's all for today! The AI model wars are heating up with three major releases this week, while the EU's privacy battle reminds us that the fight for digital rights is far from over. See you tomorrow.