HN Daily | July 15, 2026

Today's tech landscape is dominated by a fascinating tension: AI models are getting dramatically more capable and accessible, yet the security and coordination challenges they introduce are becoming equally apparent. From a 975B open-weights model to running 26B models on decade-old hardware, the democratization of AI continues — but so do the questions about what we're building and how we're building it.

AI & Machine Learning

1. Inkling: Our Open-Weights Model — Thinking Machines releases Inkling, a 975B-parameter Mixture-of-Experts transformer (41B active) with full open weights, 1M token context, and native multimodal reasoning over text, images, and audio. It's designed as a broad, customizable foundation model — not the strongest overall, but a practical base for fine-tuning across diverse use cases.

2. Bonsai 27B: A 27B-Class model that runs on a phone — Prism ML announces Bonsai 27B, using ternary and binary weights to pack a 27B-parameter model into just 3.9-5.9 GB, enabling it to run on an iPhone 17 Pro. It retains 90-95% of full-precision performance while fitting in a fraction of the memory — a genuine paradigm shift for on-device agentic workloads.

3. Running Gemma 4 26B at 5 tokens/sec on a 13-year-old Xeon with no GPU — A remarkable engineering feat: running Google's 26B MoE model on a repurposed HP StoreVirtual server with dual Ivy Bridge Xeons (2013) and no GPU, achieving reading-speed inference. The author used Claude to patch ik_llama.cpp to support pre-AVX2 CPUs, proving that old enterprise iron can still be useful.

4. LeMario: Training a JEPA World Model on Super Mario Bros — A deep dive into implementing LeCun's Joint-Embedding Predictive Architecture from scratch, trained on Super Mario Bros. The model learned to predict future frames but couldn't actually make progress through levels — a humbling reminder that prediction ≠ understanding.

Open Source & Tools

1. Grok Build is open source — SpaceXAI open-sources their terminal-based AI coding agent, written in Rust. It's a full-screen TUI that understands your codebase, edits files, runs commands, and manages long-running tasks — interactively or headlessly for CI. The source is Apache 2.0 licensed.

2. Show HN: Juggler – an open-source GUI coding agent, by the creator of JUCE — Jules, the creator of JUCE and Tracktion, launches Juggler: a GUI-based AI coding agent built around Yjs CRDT documents with Miller column navigation, P2P multi-client support, and a JavaScript plugin system. It's AGPLv3 with Apache-2.0 extensions, no telemetry, and no signup required.

3. How I use HTMX with Go — A practical guide to combining HTMX with Go's html/template package for server-rendered web apps with smooth interactivity. Covers template structuring, partial vs. full-page responses, redirects, errors, and standard configuration — a solid reference for anyone building Go web apps.

4. Dependabot version updates introduce default package cooldown — GitHub's Dependabot now waits 3 days before opening version update PRs, giving the community time to catch compromised releases. Security updates still open immediately. A small but meaningful defense against supply chain attacks.

Security & Privacy

1. Cursor 0day: When Full Disclosure Becomes the Only Protection Left — A critical vulnerability in Cursor IDE: opening a repository with a malicious git.exe in the root triggers automatic execution with no user interaction. Mindgard disclosed it 7 months ago with no fix shipped across 197+ versions. The disclosure is a damning indictment of Cursor's security practices.

2. I tricked Claude into leaking your deepest, darkest secrets — A clever demonstration of how Claude's memory system (daily summarization + conversation search) can be exploited via web browsing. By crafting a website with links encoding user data, the author exfiltrated personal information without the user noticing. A stark warning about AI assistant security.

3. Vancouver PD website features Quick Escape button that wipes itself from history — The Vancouver Police Department's website includes a prominent "Quick Escape" button that immediately clears browsing history — a thoughtful safety feature for domestic violence victims or others who need to quickly hide their browsing. Simple, practical, and potentially life-saving.

4. OpenAI loses trademark dispute at EU court — The EU General Court rules that "OPENAI" is purely descriptive for software and cloud services, lacking the distinctiveness required for trademark protection. The court found the term combines "open" (freely accessible) with "AI" in an ordinary linguistic way. OpenAI can appeal.

Culture & Commentary

1. The Tower Keeps Rising — Armin Ronacher (creator of Flask) offers a brilliant reflection on AI-assisted programming: agents remove the friction that forced developers to coordinate and share understanding. The tower of Babel doesn't fall — it just keeps rising, even after shared understanding collapses. Essential reading for anyone thinking about AI's impact on software engineering.

2. The kids with phones are alright — A powerful counterpoint to smartphone bans for young people. The author recounts a video where teenage girls used their phones to document and confront a harasser on a train, arguing that blanket restrictions on youth phone use can actually endanger them. A nuanced take on a heated debate.

3. How to stop Claude from saying load-bearing — A hilarious and practical guide to using Claude Code's MessageDisplay hook to replace overused phrases like "load-bearing seam" and "honest take" with something more entertaining. The community's collective frustration with Claude's verbal tics is real, and this is a clever fix.

Science & Research

1. Solving 20 Erdős Problems with 20 Codex Accounts Running in Parallel — An ambitious project using multiple Codex instances to tackle open problems from the Erdős problem list. The writeup details the solution to Problem #123 (sums of distinct coprime powers) using a novel homogeneous-level coordinate system and edge-code constructions. A fascinating glimpse into AI-assisted mathematics.

Retro Computing & Gaming

1. Jurassic Park computers in excruciating detail — Fabien Sanglard's meticulous breakdown of every computer and software visible in Jurassic Park, from the Apple PowerBook 100 to the SGI workstations and the Thinking Machines CM-5 supercomputer. Includes inflation-adjusted costs ($4M in 2026 dollars) and behind-the-scenes production details. RIP Sam Neill.

2. Duskers, the scary command line game, is getting a sequel — The beloved terminal-based horror strategy game Duskers is getting a sequel, funded by Stray Signal (Max McGuire's project fund). The original turns 10 this year, and the sequel promises higher stakes and a more emotive story. Wishlist it on Steam.

Web Development

1. Your 'app' could have been a webpage (so I fixed it for you) — A satisfying takedown of an unnecessary Android app for a school trip itinerary. The author reverse-engineers the app's API, extracts all the data, and builds a proper webpage — no tracking, no ads, just information. A reminder that not everything needs to be an app.

2. Show HN: Firefox in WebAssembly — The entire Firefox browser (Gecko, UI, Spidermonkey) compiled to WebAssembly and running in a <canvas> element. Features end-to-end encryption via WISP protocol and a novel WASM→JS JIT. A fun experiment pushing the boundaries of what's possible in the browser.

---

Today's stories paint a picture of a tech world in rapid transformation: AI models are becoming more accessible and capable, but the security implications and coordination challenges are catching up with us. The tools we build are only as good as the understanding we share about them — and as the Tower of Babel metaphor reminds us, that understanding is increasingly fragile. Build wisely.