> daily_signal(2026_07_10)

Microsoft is now running an AI system called MDASH across Windows to hunt its own security bugs — and it's warning IT that every Patch Tuesday will get bigger as a result.

PickBits Daily Signal · Friday, July 10, 2026

1. Microsoft is now running an AI system called MDASH across Windows to hunt its own security bugs — and it's warning IT that every Patch Tuesday will get bigger as a result.

On July 9, 2026, Microsoft disclosed that it has put an AI system to work finding vulnerabilities in Windows itself: MDASH, its 'multi-model agentic scanning harness,' scans critical Windows binaries, validates each candidate flaw across multiple AI models, and hands the survivors to human engineers to fix. The company's blunt warning to defenders: 'As AI helps defenders discover more issues, customers will see a higher volume of security updates included in each security release.' That's not hypothetical — June 2026's Patch Tuesday was a record with roughly 200 vulnerabilities, and Microsoft is on pace to break its annual vulnerability record as the AI-driven discovery wave takes hold. The upside is real bugs found and fixed faster than human teams could manage; the cost lands on IT, which now has to absorb steadily larger monthly patch loads.

Key fact: If you run patch management for any Windows fleet, plan for structurally larger monthly releases: revisit your maintenance windows, test/staging throughput, and reboot scheduling now, and shift toward risk-based prioritization (exploited-in-the-wild and critical RCEs first) because 'patch everything on Tuesday' stops being realistic when releases keep setting size records.

theverge.com · therecord.media · bleepingcomputer.com · primary source

2. Researchers just showed attackers can register the fake software packages that AI coding assistants routinely invent — and nine popular tools, including GitHub Copilot and Cursor, will install them and seed botnets.

On July 8, 2026, researchers at Tel Aviv University, the Technion, and Intuit disclosed 'HalluSquatting,' an attack that turns a well-known flaw of large language models — their tendency to confidently hallucinate package or repository names that don't exist — into a supply-chain weapon. The attacker's move is simple: pre-register the fake names an AI assistant is statistically likely to suggest for common prompts like 'clone this repository' or 'install this skill,' and hide malicious code inside them. When a developer follows the AI's suggestion, the assistant pulls the attacker's package and runs it — no phishing email, no direct contact with the victim required. The team found the hallucinations are consistent enough to target reliably: up to 85% of repository-cloning requests and 100% of skill-install requests produced the same made-up names across vendors, in tools including Cursor, Windsurf, GitHub Copilot, Cline, Google Gemini CLI, and the OpenClaw family. It is not theoretical — in January 2026, a security researcher found one hallucinated npm package, react-codeshift, had already spread to 237 real projects, with AI agents still trying to install it daily.

Key fact: If you or your team write code with AI assistants (Copilot, Cursor, Gemini CLI, Cline, etc.), stop auto-installing AI-suggested dependencies: verify every package, repo, or 'skill' the assistant proposes against the official registry before running it, pin and lock dependencies, and treat a package name you can't independently confirm as a red flag — HalluSquatting works precisely because developers trust the AI's suggestion without checking.

thehackernews.com · arxiv.org · arstechnica.com · primary source

3. Meta cleared its first in-house AI chip, Iris, through bug-testing and will start production in September — designed with Broadcom, built by TSMC — to cut its dependence on Nvidia.

According to an internal memo reviewed by Reuters, Meta plans to begin manufacturing Iris, its first custom AI accelerator, in September 2026 — the chip cleared its bug-testing phase in about six weeks without turning up significant problems. Iris is the newest of four planned chip generations under Meta's MTIA (Meta Training and Inference Accelerators) program, designed with Broadcom and fabricated by TSMC, and it's meant to supplement — not yet replace — the Nvidia and AMD GPUs Meta buys to run AI across Facebook and Instagram. The strategic point is diversification and cost control: Meta is also deploying up to six gigawatts of AMD Instinct GPUs under a multiyear deal, and it is doubling total compute capacity from 7 gigawatts in 2026 to 14 gigawatts in 2027 against AI-infrastructure spending that could reach $145 billion this year. Building its own silicon is how one of the largest AI buyers tries to stop the GPU bill from setting its costs — with a plan to ship a new custom processor roughly every six months through 2027.

Key fact: If you buy or budget cloud/AI compute, watch the hyperscaler-silicon shift: as Meta (and peers) bring in-house accelerators like Iris online to blunt Nvidia's pricing power, expect more heterogeneous fleets (custom chips + Nvidia + AMD) — which can mean better price/performance over time but also more fragmentation, so avoid locking your workloads to a single vendor's toolchain where portable alternatives exist.

933thedrive.com · cnbc.com · reuters.com · primary source

4. A 17-year-old built an AI that flags autism and ADHD from a single photo of your retina — at about 89% accuracy — and it just won $175,000 at the country's top high-school science fair.

Edward Kang, a 17-year-old senior at Bergen County Academies in Hackensack, New Jersey, built RetinaMind, an AI screening tool that analyzes ordinary retinal photographs to flag autism spectrum disorder and ADHD. Because the eye and brain grow from the same embryonic tissue, these conditions leave subtle signatures in the retina; Kang trained convolutional neural networks on a large public retinal-image dataset, combined several models with ensemble learning, and used Grad-CAM to show which retinal regions drive each call — reaching about 89% accuracy and producing per-condition confidence scores. He went further than a demo: building retinal cell models, he identified roughly a dozen candidate genes linking autism and retinal development, including ABCA4 (which makes a retina-detoxifying protein) that showed reduced expression in his autism cell lines. The promise is a cheap, non-invasive path to far earlier neurodevelopmental screening — which unlocks earlier support. The work took 2nd place and $175,000 at the 2026 Regeneron Science Talent Search.

Key fact: If you're a parent, pediatrician, or educator frustrated by long autism/ADHD assessment waitlists, watch this space but keep expectations grounded: RetinaMind is a science-fair prototype, not a cleared diagnostic — a cheap retinal-photo pre-screen could eventually help triage who needs a full evaluation first, but it would need clinical validation and FDA review before any real-world use, so it complements, not replaces, a formal assessment.

smithsonianmag.com · societyforscience.org · rutgers.edu · primary source