How would you like to read it?
Same edition, explained without the jargon — and just as faithful. It's not a quick summary: an independent check confirms the plain-language version stays true to the original, without dropping or distorting anything.
OpenAI Previews GPT-5.6 (Sol, Terra, Luna) in Limited Release: Sol Is the Strongest Cyber Model, With Access Restricted at the US Government's Request
OpenAI is opening a limited preview of the GPT-5.6 family on API and Codex. Sol is the frontier model for cybersecurity, but OpenAI states that it does not cross the 'Cyber Critical' threshold and is controlling access at the US government's request.
OpenAI has opened a limited preview of GPT-5.6, a family of three models: Sol, the frontier model for complex reasoning, coding, biology and cybersecurity; Terra, balanced for everyday work; and Luna, the fastest and cheapest. The models are reachable via API and Codex, with general availability expected in the coming weeks.
OpenAI describes Sol as its most capable cybersecurity model ever, strong at vulnerability research and long-horizon exploitation. On ExploitBench it reportedly matched Anthropic's Mythos Preview using roughly a third of the output tokens. The figure that tempers the hype, however, is stated by OpenAI itself: Sol does not cross the internal "Cyber Critical" threshold. In tests on the Chromium and Firefox codebases it identified bugs and exploitation building blocks, but did not autonomously produce a working full-chain exploit. In practice, it is more effective at finding and fixing vulnerabilities than at conducting attacks. These are OpenAI's own figures, from a preview still in testing and to be validated with independent red-teaming.
Access to Sol is limited to a small group of selected partners at the US government's request: OpenAI informed officials in advance and shared the partners' names, while arguing that the restriction should not become the long-term default. On the product side, prices range from Sol (5/30 dollars per million tokens in/out) to Terra (2.50/15, about half of GPT-5.5) and Luna (1/6 dollars). Sol will arrive in July on Cerebras hardware up to 750 tokens per second: a wafer-scale speed nearly an order of magnitude above traditional GPU clusters. For protection, there are trained refusals, real-time classifiers for biology and cyber, and over 700,000 GPU hours of automated red-teaming.
Why it matters
- ICT engineers / IT managers: Sol assists vulnerability research (discovering bugs and exploitation primitives) and is claimed to be stronger at defending than at attacking: a potentially valuable hardening tool. But it remains a dual-use capability, with controlled access and vendor-only metrics: before basing decisions on it, validation with independent red-teaming is needed.
- LLM builders / devs: The lever is cost/latency: Terra halves the price compared to GPT-5.5 and Luna drops further, while Sol aims for 750 tokens/s on Cerebras. Watch out, though, for the access bottleneck: the frontier Sol model remains in a limited preview to selected partners, so it can't be planned in the short term for production products.
Claude Sonnet 5 Becomes the Default Model for Free and Pro Users
Anthropic makes Sonnet 5 the default model for Free and Pro, and also makes it available on Max, Team, Enterprise, Claude Code and the API, with performance close to Opus 4.8 and agentic capabilities at a much lower price.
On June 30, 2026, Anthropic launched Claude Sonnet 5, presenting it as «the most agentic Sonnet model yet»: it can make plans, use tools such as browsers and terminals, and carry out tasks autonomously. The product news is the distribution: Sonnet 5 becomes the default model for the Free and Pro plans, in addition to being available on Max, Team, Enterprise, in Claude Code and via the API (claude-sonnet-5). Anthropic claims performance «close to that of Opus 4.8, but at lower prices».
On the numbers, TechCrunch reports 63.2% on agentic coding, up from the 58.1% of its predecessor Sonnet 4.6 but below the 69.2% of Opus 4.8; on knowledge work it reportedly edges out Opus 4.8 itself. Price is the lever: $2 per million input tokens and $10 for output until August 31, 2026, then $3/$15 — more expensive than Gemini 3.5 Flash but below Opus 4.8, GPT-5.5 and Gemini 3.1 Pro. A technical detail: the new tokenizer can map the same input to 1.0–1.35× more tokens.
Anthropic claims lower rates of undesirable behaviors, hallucinations and sycophancy, and better resistance to prompt injection, though without matching Opus 4.8 on misalignment metrics. On the cyber front, the company states that it did not deliberately train Sonnet 5 on cybersecurity tasks: in tests on Mozilla Firefox vulnerabilities the model did not develop fully functional exploits; it did, however, show a slightly higher rate of partial success compared to Sonnet 4.6, attributed to improvements in general intelligence. Gizmodo reads the «not too dangerous to release» framing as a political move, following the federal halt on the earlier Mythos and Fable.
Why it matters
- End users: Those who use Claude for free or with a Pro subscription get, at no additional cost, a model with performance close to the top of the range and agentic capabilities (browser, terminal, planning) previously reserved for the more expensive models. More power within reach also means more surface for errors or manipulation in sensitive tasks.
- LLM builders / devs: For those building agents, the real draw is the price/performance ratio: agentic coding at 63.2% for $2/$10 per million tokens (until August 31) slashes the cost of running autonomous workflows. Two operational caveats to weigh: the new tokenizer inflates the token count (1.0–1.35×), and Sonnet 5 remains below Opus 4.8 on misalignment metrics, relevant for unattended pipelines.
ReContext: a training-free method to make LLMs actually use long context
A team at the University of Illinois Urbana-Champaign proposes rereading and 'replaying' the relevant evidence already present in the input, with no training and no context pruning. The payoff: average accuracy +24.6% at 128K; in the 64K test, a macro-average across five NQ/PopQA/InfBench MC scores of +35.0%. But only on open models up to roughly 8 billion parameters.
On July 2, 2026, Yanjun Zhao, Ruizhong Qiu, Tianxin Wei and colleagues at the University of Illinois Urbana-Champaign posted on arXiv ReContext: Recursive Evidence Replay as LLM Harness for Long-Context Reasoning, a training-free method that acts only at inference time. It tackles a known problem: LLMs with extended windows often fail to use the evidence already present in the input — the gap between access to context and its use, formalized by the work of Nelson Liu and colleagues on "lost in the middle" (2023), which showed how accuracy collapses when the relevant information sits in the middle of the prompt.
The mechanism, detailed in the full text, prunes nothing: at each round ReContext uses relevance signals internal to the model (the attention from the question tokens onto specific heads) to score the tokens, selects the top-K positions, remaps them onto the sentences that contain them, and adds them to a query-conditioned evidence pool. The pool is "replayed" before generation while the original context stays intact in the prompt: emphasis, not exclusion. It rests on an associative-memory framing (context = archive, question = retrieval cue, replay = reactivation).
On Qwen3-4B, Qwen3-8B and Llama3-8B, tested on eight datasets (NQ, TriviaQA, HotpotQA, PopQA, NarrativeQA, InfBench QA/MC, CLIPPER) up to 128K, average accuracy rises from 0.24 to 0.30 (+24.6% relative at 128K), with the best average rank across all three backbones. In the test with a shorter context budget, 64K, the relative gain reaches 35.0%. The 35.0% comes from the robustness table at 64K on three tasks (NQ, PopQA, InfBench MC) and five mixed Acc/F1 metrics, not from the full eight-dataset benchmark. The limitations stated by the authors: it needs access to the model's internal signals — so it does not work with closed-source APIs — and the reread-and-replay stage increases latency compared with direct decoding.
Why it matters
- Frontier research: It feeds the line of work on the gap between access and use of context with an associative-memory framing and an inference-time intervention that requires neither external retrieval nor pruning. Yet an open question remains: validation is on open models up to ~8B (Qwen3-8B is 8.2B total parameters according to Hugging Face), and scalability to frontier models is not demonstrated.
- LLM builders / devs: It is a zero-training-cost intervention, applicable 'as-is' to open models already in production to extract more value from the same context. The operational constraints must be weighed: it requires access to internal attention (out of reach for closed-source APIs like OpenAI or Anthropic) and adds latency for the replay stage.
DeepSeek V4 Arrives in Mid-July with the First Time-of-Day API Pricing
The Chinese lab introduces peak/off-peak rates for the first time: during Beijing's peak hours, API costs double. A 1-million-token context across the entire lineup and retirement of legacy models from July 24.
DeepSeek will release the official version of V4 in mid-July 2026, introducing time-of-day API pricing for the first time. The independent outlet TechNode reports that during peak hours — from 9 a.m. to 12 p.m. and from 2 p.m. to 6 p.m., Beijing time — rates double compared to off-peak windows. The latter remain unchanged. This is a material detail for those operating from Europe, because Beijing's afternoon block falls within the Italian working morning.
The figures are confirmed by The Next Web: the output of deepseek-v4-pro rises from 6 to 12 yuan per million tokens (roughly $0.85–$1.70), while deepseek-v4-flash goes from 2 to 4 yuan. Input also doubles during peak hours. DeepSeek justifies the move as a "better distribution of resources" and surge-pricing-style demand management, not as a way to maximize profit.
The change is contested: The Next Web reports on the debate among Chinese developers, who chose DeepSeek precisely because it was predictable and inexpensive. They now face costs that are harder to plan — an opening for rivals promising flat rates.
From the primary DeepSeek documentation alone (an April preview) come details not confirmed by the independent sources, to be treated with caution. They concern the V4-Pro (1.6T total / 49B active) and V4-Flash (284B / 13B) variants, the 1M-token context as the default across all services, and the retirement of deepseek-chat and deepseek-reasoner after July 24, 2026 (15:59 UTC).
Why it matters
- IMPRENDITORI · LLM BUILDER/DEV: Time-of-day pricing introduces a new variable into cost estimates: the per-token cost is no longer constant over time. Those with deferrable batch workloads can schedule them during off-peak hours to halve spending, but budgeting becomes less predictable and must be modeled around time zones (the peak windows are in Beijing time).
- LLM BUILDER/DEV: The announced retirement of deepseek-chat and deepseek-reasoner after July 24 requires planning the migration to V4; since the variant names/sizes and the decommissioning date come solely from the primary docs and are not confirmed by independent sources, it's worth verifying them before wiring any cutover into production.
Schneider Electric Buys Cognite for $3.1 Billion in Cash
The French group is acquiring the Norwegian-American industrial data and AI platform to strengthen AVEVA. It is the largest software exit in Norway's history.
On June 30, 2026, Schneider Electric announced an agreement to acquire 100% of Cognite in an all-cash deal worth $3.1 billion. Founded in 2017 and headquartered in Tempe, Arizona, Cognite has more than 800 employees across the Americas, Europe, the Middle East, and Asia-Pacific. Its cloud-native platform combines a unified industrial data model and a knowledge graph (Cognite Data Fusion) with agentic AI capabilities (Atlas AI), to operationalize AI directly on plants, assets, and engineering workflows. In 2025 it surpassed $170 million in revenue, with ARR bookings growing 36%.
Cognite will be integrated into AVEVA — Schneider's software subsidiary — and consolidated within the Industrial Automation division, enhancing the AVEVA CONNECT platform with enterprise-grade data contextualization. According to the trade press, the sellers are Norway's Aker ASA and other investors: it is the largest software exit ever recorded in Norway. Closing is expected in the coming quarters, subject to regulatory approvals.
One piece of context goes beyond the vendor's press release. Forrester analyst Paul Miller frames the deal as part of a consolidation of the sector around knowledge graphs and "AI-ready" data infrastructure. The competition is with Siemens (which acquired Altair/Cambridge Semantics), AWS, Google, and Falkor. Miller stresses, however, that this is more "resurgent technology" than innovation: ontologies and semantic graphs have existed for decades but were extremely hard to make work at scale; what finally makes them useful is mature AI, which requires governed and structured data.
Why it matters
- Entrepreneurs: It signals that Industrial AI is no longer experimentation but a field for billion-dollar M&A consolidation: the major vendors are buying the data foundations (knowledge graphs, contextualized data) on which AI agents on the factory floor will rest. For the industrial entrepreneur, it matters to understand that competitive value is shifting from raw data to governed and structured data, and that the choice of data platform today shapes which AI capabilities will be available tomorrow.
JadePuffer: the First Ransomware Campaign Run End-to-End by an LLM Agent
Sysdig documents what it calls the first database extortion entirely driven by an AI agent: reconnaissance, credential theft, lateral movement and encryption, with self-correction at machine speed. But a flaw in the key makes the data unrecoverable even if you pay.
The Sysdig Threat Research team has documented what it assesses as the first agentic ransomware campaign: an extortion operation driven end-to-end by a large language model, with no human operator stringing the tools together. Initial access came through the exploitation of CVE-2025-3248, an unauthenticated RCE in Langflow's code-validation endpoint exposed on the network. From there the agent enumerated the host and harvested AI-provider API keys and cloud credentials. It then looted a MinIO instance using the default minioadmin:minioadmin credentials and installed persistence via crontab.
The agent then pivoted to a production server running MySQL and Alibaba Nacos, exploiting CVE-2021-29441 (authentication bypass) and the default JWT signing key. It encrypted 1,342 Nacos configurations with AES_ENCRYPT(), dropped the original tables and created a README_RANSOM table. The hallmark of the autonomy is in the "self-narrating" payloads, full of natural-language reasoning, and in the machine-speed correction. One telling example: a failed login diagnosed and fixed in 31 seconds; more than 600 payloads were produced in total.
The decisive detail is reported by Sysdig and picked up by BleepingComputer. The encryption key, generated as base64(uuid4+uuid4), was printed to stdout but never saved or transmitted: the data is unrecoverable even if you pay. Doubts remain about the true degree of autonomy: the origin of the MySQL root credentials is unknown (a human hand is possible) and the Bitcoin address matches an example from documentation, perhaps a model hallucination. As Sysdig puts it, "the skill floor for running ransomware has dropped to whatever it costs to run an agent."
Why it matters
- ICT engineers / IT managers: Every AI-adjacent service exposed — Langflow, MinIO, Nacos — with known CVEs or default credentials becomes an entry point that an agent exploits autonomously at machine speed, compressing the detection window. The operational priority is immediate patching of the cited CVEs, rotation of default credentials and segmentation of AI-adjacent services; and because the encryption here destroyed the data irreversibly, verified offline backups matter more than negotiation.