The 10 biggest things in tech, Wed, Jul 1
The ten biggest stories in tech today, scored 1–10 and ranked from 150+ engineering sources. Free, updated every morning.
Claude Sonnet 5 launches mainstream
Anthropic shipped Claude Sonnet 5 with near-Opus 4.8 performance at lower prices, directly targeting GPT-5.5 and Gemini Pro in the agentic deployment tier, while simultaneously launching Claude Science (a research workbench) and an Enterprise Gateway for AWS and Google Cloud.
#1 · ai · scored 8/10
AI agent security under attack
Researchers disclosed multiple AI agent attack vectors this week: Microsoft documented tool-poisoning attacks exfiltrating corporate data via routine-looking agent behavior, Mozilla showed indirect prompt injection in coding agents, Cursor AI editor carries two CVSS 9.8 prompt-injection CVEs, DeepSeek generated working browser ransomware, and Palo Alto Unit 42 reported AI-hallucinated domain phishing — collectively marking a sharp escalation in real-world AI agent exploitation.
#2 · ai · scored 8/10
AI agents as attack surface
Microsoft, Mozilla, and independent researchers disclosed a wave of prompt injection and tool-poisoning vulnerabilities across AI agent platforms — including Claude Desktop, Cursor AI editor, and browser-based agents — demonstrating that autonomous AI systems are becoming a primary attack vector for data exfiltration, sandbox escape, and arbitrary code execution.
#3 · security · scored 8/10
AI-generated malware goes live
DeepSeek was documented producing working browser-based ransomware exploiting Chromium APIs, while a researcher used Claude Opus 4.7 to discover a critical ticketing-system vulnerability, and Palo Alto Unit 42 tracked 'phantom squatting' attacks exploiting AI-hallucinated domains — marking a concrete inflection point where LLM-assisted exploitation moves from theoretical to active threat.
#4 · security · scored 8/10
Critical enterprise software CVEs pile up
Adobe patched seven CVSS 10.0 flaws in ColdFusion and Campaign Classic, Citrix patched six NetScaler ADC and Gateway vulnerabilities, and Progress Kemp LoadMaster's pre-auth RCE (CVSS 9.6) is already under active exploitation — a concentrated week of critical patches across widely-deployed enterprise infrastructure.
#5 · security · scored 8/10
EU-US data transfer frameworks invalidated
A US Supreme Court decision has invalidated Standard Contractual Clauses and related EU-US data transfer mechanisms, triggering an immediate compliance crisis for multinational tech companies operating across transatlantic borders.
#6 · security · scored 8/10
EU-US data transfer framework invalidated
A US Supreme Court decision has invalidated Standard Contractual Clauses and other EU-US data transfer mechanisms, triggering an immediate compliance crisis for multinational tech companies operating across transatlantic borders.
#7 · industry · scored 8/10
Anthropic export controls lifted
The Trump administration reversed export restrictions on Anthropic's Fable 5 and Mythos 5 models — following safety concessions — with Anthropic restoring global Fable 5 access beginning July 1.
#8 · ai · scored 7/10
Meta enters cloud infrastructure market
Meta is building a commercial cloud infrastructure business to monetize its excess AI compute capacity and models, directly competing with AWS, Google Cloud, and Azure in a major strategic pivot.
#9 · ai · scored 7/10
Azure under active credential attack
Huntress documented a massive ongoing password spray campaign against Azure CLI — 81M+ attempts from an LSHIY-controlled IPv6 range — compromising over 78 Microsoft accounts in what constitutes a critical, live attack on core cloud infrastructure.
#10 · security · scored 7/10