> daily_signal(2026_07_10)

Microsoft turned an AI loose inside Windows to hunt its own bugs, and researchers showed how the fake packages your AI assistant invents become malware you install yourself.

PickBits Daily Signal · Friday, July 10, 2026

By Mark Pickering · 8 min read · July 10, 2026

// tl;dr

Microsoft is now running an AI system called MDASH across Windows to find its own security bugs, and it is warning IT that patch loads will keep growing. MDASH scans critical Windows binaries, validates each candidate flaw across several models, and hands the survivors to human engineers to fix. June's Patch Tuesday already hit a record of roughly 200 fixes, and Microsoft says it is on pace to break its annual vulnerability record.
Researchers weaponized a well-known AI flaw into a supply-chain attack they call HalluSquatting. Teams at Tel Aviv University, the Technion, and Intuit found that AI coding assistants invent the same fake package names over and over, up to 100% of the time on "install this skill." An attacker registers those names, hides malware inside, and waits for a developer to accept the suggestion. One hallucinated npm package, react-codeshift, had already reached 237 real projects by January 2026.
Meta cleared its first in-house AI chip, codenamed Iris, and will start production in September. Designed with Broadcom and built by TSMC, Iris is meant to supplement, not replace, the Nvidia and AMD GPUs Meta buys, and to blunt Nvidia's pricing power. Meta plans a new custom chip roughly every six months through 2027, against AI-infrastructure spending that could reach $145 billion this year.
A 17-year-old built an AI that screens for autism and ADHD from a single retinal photo, at about 89% accuracy. Edward Kang of Bergen County Academies in New Jersey paired convolutional neural networks with explainability and a genetics check, and took 2nd place and $175,000 at the 2026 Regeneron Science Talent Search. It is a prototype, not a cleared diagnostic.

Microsoft turned an AI called MDASH loose in Windows to find its own bugs before attackers do, and it is a big reason last month's Patch Tuesday hit a record of roughly 200 fixes. Days earlier, researchers showed the ugly flip side of AI writing your code: an assistant confidently invents a package name that does not exist, an attacker registers it first, and a developer installs the malware because the AI suggested it. So these tools are getting very good at finding the holes in software. They are also, it turns out, a fast way to drill new ones. Away from security, Meta cleared its first in-house chip to start weaning itself off Nvidia, a fight the whole industry has been picking for a while, and a seventeen-year-old pointed the same kind of model at a retina to screen for autism, which is the version of all this you actually want to see more of.

Today: Microsoft ran an AI called MDASH through Windows to find its own bugs, researchers showed attackers can pre-register the fake packages AI assistants invent, Meta cleared its Iris chip for September production to cut Nvidia dependence, and a teenager's retinal-image AI hit about 89% screening for autism and ADHD.

1. Microsoft set an AI loose inside Windows to hunt its own bugs, and told IT the patch pile only gets bigger.

Microsoft's new bug-hunting AI is a big reason your patch list keeps growing.

On July 9, 2026, Microsoft disclosed that it is running an in-house AI system, MDASH (its "multi-model agentic scanning harness"), to find vulnerabilities in Windows before attackers do. MDASH scans critical Windows binaries, validates each candidate flaw across multiple AI models, and hands the survivors to human engineers, who review and confirm the fixes; Microsoft says it has also moved AI-assisted threat modeling earlier into its development process. Then came the warning it buried in the same post: "As AI helps defenders discover more issues, customers will see a higher volume of security updates included in each security release." That is not hypothetical. June's Patch Tuesday set a record at roughly 200 fixed vulnerabilities, and Microsoft says it is on pace to break its annual vulnerability record as the AI-driven discovery wave builds.

Finding and fixing bugs faster than a human team could is genuinely good. The problem is who has to keep up. The discovery rate now outpaces the old monthly patch calendar, so "patch everything on Tuesday" stops being a workable plan once each release keeps setting size records. And the same automation Microsoft points at its own code is available to whoever wants to point it at yours, which is the second half of today's signal. Every Microsoft fix still passes a human, but the pace of what lands on your patch queue just jumped, with no sign of easing off.

The Verge report July 9 2026 Microsoft discloses MDASH multi-model agentic scanning harness AI finding vulnerabilities in Windows binaries validated across multiple models human engineers confirm fixes warning customers will see higher volume of security updates June Patch Tuesday record roughly 200 vulnerabilities on pace to break annual vulnerability record — theverge.com · July 9, 2026

Why this matters: If you keep any Windows machines patched, the monthly job you already dread is getting structurally bigger, and it is not a one-month spike. For two years the constraint on finding software bugs was human attention; AI just removed it, which means the flow of fixes now outruns the fixed calendar everyone built their maintenance windows around. Action this week: Stop treating Patch Tuesday as one flat batch and move to risk-based patching now: deploy the exploited-in-the-wild and critical remote-code fixes first, automatically, and let the lower-severity pile follow on its own track. Revisit your maintenance windows, test throughput, and reboot scheduling for releases two to three times the size you planned for, and if you set security strategy, remember the same discovery engine is available to attackers, so shortening your exposure window matters as much as clearing the backlog. If you run a fleet, send this to whoever owns your patch cadence, because the plan they wrote last year is already undersized.

theverge.com: Microsoft warns Patch Tuesday will keep getting bigger as AI finds more bugs (July 9, 2026)
therecord.media: Microsoft on pace to break its annual vulnerability record as AI discovery ramps (July 2026)
therecord.media: Microsoft ships its largest Patch Tuesday on record (June 2026)

2. Attackers can register the fake packages your AI coding assistant makes up, and let you install the malware yourself.

No phishing, no email. Your coding assistant hands you the malware itself.

On July 8, 2026, researchers from Tel Aviv University, the Technion, and Intuit disclosed HalluSquatting, an attack that turns a familiar large-language-model flaw into a supply-chain weapon. Coding assistants routinely hallucinate package, repository, and "skill" names that do not exist, and the researchers found those inventions are consistent enough to target: the same made-up names surfaced in up to 85% of repository-cloning requests and 100% of skill-install requests, across Cursor, Windsurf, GitHub Copilot, Cline, Google Gemini CLI, and the OpenClaw family. The attacker's move is simple: pre-register the fake name the AI is likely to suggest, hide malicious code inside it, and wait. A developer who accepts the assistant's suggestion for a routine task pulls and runs the attacker's code, with no phishing email and no direct contact required.

This is not a thought experiment. In January 2026, an Aikido Security researcher found one hallucinated npm package, react-codeshift, that AI-written instructions had already spread to 237 real projects, with agents still trying to install it daily. It also rhymes with a thread we have followed for months: AI coding tools that run repository contents without verifying them, and the poisoned-repo takedowns that followed. The defense is not mysterious, which is the frustrating part. Every mitigation here is something teams already know how to do, from pinning and lockfiles to private registry proxies, and the attack works precisely because the AI's suggestion feels authoritative enough that nobody checks. An assistant's proposed dependency is now untrusted input, the same as a link in an email from a stranger.

The Hacker News report July 2026 HalluSquatting attack Tel Aviv University Technion Intuit researchers weaponize AI package hallucinations attackers pre-register fake package names AI coding assistants invent up to 85 percent repository cloning 100 percent skill install across Cursor Windsurf GitHub Copilot Cline Gemini CLI react-codeshift npm package reached 237 projects January 2026 — thehackernews.com · July 8, 2026

Why this matters: If you or your team ship code with AI help, the dependency your assistant just recommended is now a security decision, not a convenience. The attack does not need to trick you into clicking anything; it only needs you to trust a name the AI made up, which is the default behavior of nearly every developer using these tools right now. Action this week: Stop auto-installing what an assistant suggests, and treat any package, repo, or skill you cannot independently confirm in a real registry as a red flag until you have checked it. Pin and lock your dependencies, add a check for newly registered packages whose names match common AI hallucinations, and scan agent-generated install commands in CI before they run. If you run a package registry or app-sec, add hallucination-squatting to your threat model and watch for the react-codeshift pattern, a plausible-sounding package that appears in dozens of projects at once via AI-written instructions. Send this to whoever owns your build pipeline.

thehackernews.com: New HalluSquatting attack could trick AI coding assistants into installing malware (July 8, 2026)

3. Meta cleared its first in-house AI chip for production, a direct shot at Nvidia's grip.

Meta would rather build its own chip than keep paying Nvidia's bill.

Per an internal memo reviewed by Reuters and reported July 9, 2026, Meta plans to begin manufacturing its first in-house AI chip, codenamed Iris, in September 2026, after it cleared bug-testing in about six weeks without turning up significant problems. Iris is the newest of four planned generations under Meta's MTIA (Meta Training and Inference Accelerators) program, designed with Broadcom and fabricated by TSMC. It is meant to supplement, not yet replace, the Nvidia and AMD GPUs Meta buys to run AI across Facebook and Instagram, and Meta has also signed a multiyear deal for up to six gigawatts of AMD Instinct GPUs. It comes down to cost and not betting the whole farm on one supplier: Meta is doubling compute capacity from about 7 gigawatts in 2026 to 14 gigawatts in 2027, against AI-infrastructure spending that could reach roughly $145 billion this year, and it plans to ship a new custom processor about every six months through 2027.

Iris does not free Meta from Nvidia yet, and it is not meant to. It is a hedge, a way to keep one vendor's pricing from setting your costs when the GPU bill runs into the tens of billions. But a company that buys AI compute at Meta's scale validating its own silicon in production is a real bet against Nvidia's pricing power, and it lands inside a longer arc we have tracked, from Nvidia bankrolling AI startups to keep its grip, to OpenAI and Broadcom taping out their own inference chip, to Amazon's Trainium fleet. Every big AI operator is ending up with its own custom chips now. Execution is the open question. A chip clearing bug-testing is not the same as a chip carrying real training and inference load, and Meta still has to prove Iris earns its place next to the GPUs it is meant to relieve.

Reuters exclusive July 9 2026 internal memo Meta to put first in-house AI chip Iris into production September cleared bug-testing in six weeks MTIA Meta Training and Inference Accelerators designed with Broadcom built by TSMC supplement Nvidia and AMD GPUs six gigawatts AMD Instinct deal doubling compute 7 to 14 gigawatts 145 billion AI infrastructure spending new chip every six months through 2027 — reuters via 933thedrive.com · July 9, 2026

Why this matters: If you buy or budget cloud and AI compute, the fleet you rent from is about to get more heterogeneous, with custom chips sitting next to Nvidia and AMD, and that shift decides your price and your portability over the next two years. A hyperscaler bringing its own silicon online is the clearest signal yet that Nvidia's pricing power has a ceiling, which over time should mean better price-performance, but also more fragmentation and more vendor-specific toolchains to navigate. Action this week: Keep your workloads portable and off any single vendor's toolchain where a real alternative exists, because the lock-in risk is quietly moving from "which GPU" to "which stack." If you invest in or analyze the AI hardware supply chain, read the memo's cadence, a new MTIA chip roughly every six months, as the real tell on how fast internal accelerators are maturing against merchant GPUs, and treat Broadcom and TSMC as the names that benefit whichever hyperscaler wins.

933thedrive.com (Reuters exclusive): Meta to put AI chip into production in September as it looks to double computing capacity, memo shows (July 9, 2026)

4. A 17-year-old's AI screens for autism and ADHD from a single photo of your retina.

A high-schooler's screening tool, and he showed exactly how it works.

Edward Kang, a 17-year-old senior at Bergen County Academies in Hackensack, New Jersey, built RetinaMind, an AI tool that reads an ordinary retinal photograph to screen for autism spectrum disorder and ADHD, outputting confidence scores across neurotypical, autism, and ADHD categories. It works because the eye and the brain grow from the same embryonic tissue, so these conditions leave faint signatures in the retina. Kang trained convolutional neural networks on a large public retinal-image dataset, combined several models with ensemble learning, and used Grad-CAM to show which retinal regions drove each call, reaching about 89% accuracy. He went further than a demo: building retinal cell models, he identified roughly a dozen candidate genes linking autism to retinal development, including ABCA4, which showed reduced expression in his autism cell lines. RetinaMind took 2nd place and $175,000 at the 2026 Regeneron Science Talent Search.

Keep expectations grounded, and Kang would be the first to say so. RetinaMind is a science-fair prototype, not a cleared diagnostic, and a retinal pre-screen would need real clinical validation and regulatory review before it goes anywhere near a patient. But the promise is exactly the kind we have wanted from medical AI: a cheap, non-invasive test that could help triage who needs a full evaluation first, in a system where autism and ADHD assessments routinely carry waitlists measured in years. The accuracy number is not the impressive part. Kang paired the model with explainability and a mechanistic biology check instead of treating the network as a black box, and that is the bar any diagnostic-screening model should have to clear. Same kind of model as the ones causing trouble up top in today's brief. In a high-schooler's hands, it is doing something you actually want.

Smithsonian Magazine report Edward Kang 17-year-old Bergen County Academies Hackensack New Jersey built RetinaMind AI analyzes retinal photographs to screen autism and ADHD 89 percent accuracy convolutional neural networks ensemble learning Grad-CAM explainability candidate genes ABCA4 2nd place 175000 dollars 2026 Regeneron Science Talent Search — smithsonianmag.com · 2026

Why this matters: If you are a parent, pediatrician, or educator worn down by autism and ADHD assessment waitlists, a cheap retinal pre-screen is a genuinely hopeful idea, as long as you hold it as a triage tool that could eventually help decide who gets a full evaluation first, not a replacement for one. It is not a cleared diagnostic and cannot diagnose your child; it is a prototype pointing at a real, unmet need. Action this week: Watch the space but keep expectations honest, because a science-fair result is a starting line, not a product, and the next real milestones are peer review and clinical validation on diverse populations. If you work in medical AI or accessibility tech, copy what made this credible: pair every prediction with an interpretable signal (Grad-CAM localizing the retinal region) and a testable mechanism (candidate genes, expression changes) rather than shipping a bare accuracy score. And if you know a family stuck on a diagnostic waitlist, the useful thing today is not this tool, it is the reminder to ask your provider what actually moves them up the list.

smithsonianmag.com: This high schooler developed an AI tool to screen for autism and ADHD using the retina (2026)
societyforscience.org: Edward Kang, 2026 Regeneron Science Talent Search finalist
rutgers.edu: Internship helps a high-school senior rethink what autism diagnostics should do (2026)

» What to watch this week

Whether Microsoft's next Patch Tuesday tops June's record, and whether it starts flagging which AI-found bugs are already being exploited. The size of the release is the headline; the real tell is whether Microsoft gives defenders exploitation signals to prioritize by, because a bigger pile without triage guidance just stretches everyone's mean-time-to-remediate.
Whether npm and PyPI start monitoring for hallucination-squatted package names, and whether the AI-tool vendors named in the research ship a verification step. The fix that actually scales is upstream, in the registries and the assistants, not in every developer remembering to check; watch whether Cursor, Copilot, and Gemini CLI add a "this package could not be verified" warning.
Whether Meta hits its September production date for Iris, and whether it reports any real training or inference workloads moving onto it. Clearing bug-testing is a milestone, not proof; the number that matters next is how much of Meta's actual compute Iris carries, and whether the every-six-months cadence holds.
Whether any research group moves retinal-imaging autism screening toward a real clinical trial, on a diverse population. RetinaMind is one student's prototype, but the underlying idea, a biomarker for neurodevelopmental screening, is the thing to track, and it only becomes real with validation the science fair does not require.

Tomorrow's signal lands here.