July 2026 in the IT world: models land, infrastructure burns cash, and a record-breaking Patch Tuesday

Tech news roundup for July 2026 — updated to 29/07/2026

1. A wave of models: seven launches in four weeks

The month began with Anthropic bringing Claude Fable 5 back online on 1 July, after the US government lifted export controls imposed on 12 June — restrictions that had kept the company's Mythos-class model offline for nearly three weeks.

8 and 9 July saw four consecutive launches:

GPT-5.6 went through an unusual process: the US Department of Commerce vetted each customer, limiting the preview to around 20 organisations before expanding. On benchmarks, GPT-5.6 Sol leads LiveBench Mathematics (96.2), LiveBench Reasoning (91.7) and ARC-AGI-2 (93%).

Kimi K3: open-weight reaches the 3T class for the first time

On 16 July, Moonshot AI (Beijing) released Kimi K3 via web app and API; weights were made publicly available for free on 26 July, a day earlier than scheduled, with day-0 hosting from Together AI and Modal.

The scale is 2.8 trillion parameters — the first open-weight model in the 3T class. The architecture is based on Kimi Delta Attention and Attention Residuals, along with the Stable LatentMoE framework, which activates only 16 out of 896 experts per token (~1.8% of the pool), achieving roughly 2.5× scaling efficiency compared to Kimi K2. Context is 1 million tokens, with native vision.

The most striking result: within hours of launch, K3 jumped from rank #18 to #1 on Frontend Code Arena with 1679 points, surpassing Claude Fable 5. Moonshot acknowledges that K3 trails Fable 5 and GPT-5.6 Sol overall, though it reports BrowseComp 91.2, Terminal Bench 2.1 88.3 and GPQA-Diamond 93.5.

API pricing is a practical strength: $0.30/1M input tokens on cache hit, $3 on cache miss, $15 output. Moonshot uses Mooncake infrastructure to separate prefill and decode, reporting a 90% cache hit rate on coding workloads — the basis for that cached price.

Two caveats are worth noting. At launch, there were no independent third-party benchmarks, so all figures — including the label "largest open-weight model ever" — remain unverified claims. And 2.8T does not equate to quality: with MoE, inference cost tracks active parameters, not total parameters. For self-hosting, even with MXFP4 quantisation, K3 still requires a huge amount of GPU and cost — open weights here matter for teams with clusters, not for individual machines.

The month closed with Claude Opus 5 on 24 July — Anthropic's fourth model in under two months, after Mythos 5, Fable 5 and Sonnet 5. On the Artificial Analysis v4.1 leaderboard, Opus 5 tops both the Intelligence Index (61) and Agentic Index (55.3), ahead of Fable 5 (60/52.8) and GPT-5.6 Sol (59/54.0), with API pricing of $5/$25 per 1M tokens — half that of Fable 5.

General view among observers: the focus is shifting from "best model wins" to "best fit wins". Price, latency, accessibility and suitability for specific tasks now matter as much as raw benchmark scores.

---

2. Infrastructure: where the real money flows

A recurring theme throughout the month is that competition is no longer about models but about the chips, data centres, power, memory and security systems needed to run them at global scale.

Notable figures:

• Nvidia is reportedly considering financial guarantees of around $250 billion tied to OpenAI's data centre in Ohio, alongside investment in Ilya Sutskever's Safe Superintelligence.
• Alphabet reported negative free cash flow for the quarter, driven by infrastructure spending; Google's data centre power consumption rose a record 37%.
• Intel raised its 2026 capex plan from $18 billion to $20 billion, driven by recovering AI server demand.
• CXMT, China's largest DRAM maker, raised approximately $8.6 billion in its Shanghai listing — Asia's largest IPO of 2026. The company is now the world's fourth-largest DRAM manufacturer, after Samsung, SK Hynix and Micron.
• Tesla reported lower-than-expected profits; management insisted 2026 remains a "huge capex year" for long-term AI infrastructure. Impact on end users: the demand for memory chips for AI is pushing RAM prices up, directly affecting the prices of phones and PCs sold this year. Anyone planning to upgrade their machine — especially with a high-RAM configuration to run local LLMs — should factor this in.

---

3. Security: The biggest Patch Tuesday ever

Microsoft's July patch set a record for volume. Counts vary by scope: 622 vulnerabilities according to Rapid7 and CrowdStrike, 570 according to BleepingComputer (excluding those patched before release). Windows alone accounts for 413–416 vulnerabilities. Breakdown by exploitation technique: privilege escalation 255 (41%), remote code execution 166 (27%), information disclosure 109 (18%).

Notable from a process standpoint: Microsoft's Security Update Guide no longer lists each CVE in detail, replacing it with a summary table by product line and a shorter "Notable CVEs" section.

Three vulnerabilities to patch first

CVE-2026-56155 — AD FS Elevation of Privilege (CVSS 7.8) An insufficient granularity of access control flaw (CWE-1220), allowing a low-privilege local attacker to escalate to administrator rights without user interaction. Exploited in the wild and listed on the CISA KEV. AD FS is exactly the kind of identity infrastructure attackers like to use as a pivot point, and is often paired with an RCE vulnerability in ransomware attacks. Test and deploy early.

CVE-2026-57092 — Windows VMSwitch (CVSS 9.9) The highest CVSS score of the month. A use-after-free flaw allows a low-privilege attacker to escalate to full host privileges.

CVE-2026-55040 — SharePoint Authentication Bypass Discovered by Rapid7 and disclosed in coordination with Microsoft. This is the first link in a two-vulnerability chain leading to unauthenticated RCE on SharePoint Server. Patches are available for Subscription Edition, 2019 and 2016; the second vulnerability in the chain is currently under embargo, with a patch expected in the August 2026 Patch Tuesday.

Separately, CVE-2026-56164 (SharePoint, CVSS 5.3) has also been exploited in the wild — an authentication bypass flaw allowing network-based attack without user interaction, demonstrating that Moderate-level vulnerabilities still hold value for attackers. Microsoft recommends enabling AMSI and setting Request Body Scan mode to Full as a temporary measure.

Data breaches and attacks

• KDDI (Japan) confirmed a data breach affecting more than one million customers.
• Lidl disclosed a supply chain breach, affecting online store customers in Germany, Belgium and Austria.
• AssuranceAmerica confirmed a breach affecting approximately 6.99 million people.
• DHS (US Department of Homeland Security) confirmed an intrusion into the Homeland Security Information Network on 1 July — after having dismissed two separate alerts as false positives. Senator Mark Warner has called for a Department of Justice investigation, noting the platform is supporting security operations for the FIFA World Cup being held in the US.
• RabbitMQ, one of the most popular open-source message brokers, has a critical vulnerability allowing an unauthenticated attacker to steal OAuth information.
• The US Treasury has for the first time added a VPN provider to the OFAC sanctions list for enabling ransomware, following Operation Saffron — a May 2026 law enforcement action that seized 33 servers across 27 countries.

---

4. Governance and legal

• EU fines Google $1 billion under the Digital Markets Act.
• A bipartisan "kill switch" bill is being considered by the US Congress: whether Washington should have the power to shut down an advanced AI system in a crisis.
• There is a proposal to restrict Chinese models in tightly regulated industries. On the other hand, Chinese open-weight models are widely used by US developers, so an overly broad ban could deprive independent developers of a low-cost option — while also pressuring US companies to rethink their closed development strategies. The release of Kimi K3's weights on 26 July immediately escalated this debate: the following day, Anthropic CEO Dario Amodei publicly stated the company "has never advocated banning open-weight models" and called non-dangerous open models "a public good," while still maintaining support for chip export controls, addressing distillation practices, and mandating safety testing.
• China has warned it will use "all necessary measures" if the US sanctions Chinese AI companies over allegations of using US models without authorisation to train their own.
• The United Nations and ITU have established the AI for Good Global Commission, holding its first meeting on 8 July in Geneva, aiming to create a common forum before AI regulatory blocs diverge too far.
• Japan is running a sovereign AI programme centred on robotics, alongside silicon quantum projects moving from lab to production.
• The US government is reportedly in talks with AI companies about a set of voluntary standards for releasing new models, covering benchmarks, release timing, and rules on who can access advanced models.

5. Coding agents: the trend of "narrow scoping"

On 16 July, multiple providers simultaneously upgraded their coding agents. Technically, repository-level context windows and multi-step tool calling have now become standard; agent frameworks are converging on common abstractions such as system prompts, environment tools and memory layers, while costs and latency have decreased markedly compared to 2024–2025.

But the real-world lessons are more valuable than the numbers. Case studies after 16 July show that agents are most effective when scoped to specific tasks — writing tests, migration, code review — rather than being used as a general-purpose "dev in a box". Junior engineers gain a safety net for repetitive tasks, but need guidance to avoid over-reliance on agent output.

An interesting detail accompanying this trend: when Altia launched Altia AI on 21 July, the company stressed that no AI-generated code is deployed to production — the tool only assists with development and debugging.

---

Note: figures on the number of vulnerabilities in the July Patch Tuesday vary between sources due to different counting scopes. Kimi K3's benchmark scores at this point were largely self-reported by Moonshot AI, with no independent verification. Information on financial agreements and bills under review may have changed since the time of compilation.