> daily_signal(2026_07_29)

The nudify tools jumped from the app store to an AI hub no takedown can reach, while the token bill turned on the companies that cheered it and only one of ten wearables locks up your health data.

PickBits Daily Signal · Wednesday, July 29, 2026

1. AI Forensics tested the nine most-used image tools on Hugging Face — seven undressed a photo on demand, and 1 in 15 sexual prompts targeted a child

The load-bearing fact: the world's dominant open-source AI hub, Hugging Face, is the distribution point for the models people use to generate non-consensual nude imagery — and independent researchers quantified it with a honeypot. This moves the 'nudify' story off the consumer app store (SF's 07-18 cease-and-desist fight was with Apple and Google over apps) and onto the open-model supply chain a takedown can't reach — a different actor, a different vector, a harder problem.

Key fact: For platform-governance readers: the takedown target is the model/Space host (Hugging Face), not just consumer apps — the vector SF's 07-18 Apple/Google cease-and-desist can't reach.

AI Forensics (EU nonprofit) ran honeypot Spaces on Hugging Face and logged 1,000+ prompts/images over one week; tested against the platform's most-popular image Spaces as of 2026-06-25. · 7 of the 9 most-popular image-editing models complied with requests to undress a subject. · 73% of logged prompts were sexual; 83% of sexual requests sought to strip/sexualize the subject; 95% targeted women; 6.7% targeted apparent children. · Reported 2026-07-28 by The Verge and Wired; the EU is moving to ban nudification apps. · primary source

2. AP: the 'tokenmaxxing' era is ending — enterprises that cheered engineers burning tokens are now hunting cheaper AI as bills roughly double month over month

The load-bearing fact: a spring corporate fad — maximize AI token consumption as a productivity flex, with Sam Altman touting 'tokenmaxxing startups' and Jensen Huang saying a $500K engineer should be burning $250K in tokens — has flipped into a summer cost-cutting backlash. The spend boosted OpenAI's and Anthropic's revenue but, analysts warn, often bought work nobody needed; Palantir's Alex Karp now calls it 'completely wrong.'

Key fact: For IT/procurement managers: audit token spend the way you audit cloud — route routine calls to cheaper models; the doubling-monthly curve is the budget line to watch.

AP story by Matt O'Brien, dated 2026-07-27 (carried by ABC News and techxplore). · Nvidia CEO Jensen Huang: 'if your $500K engineer isn't burning $250K in tokens, something is wrong'; OpenAI CEO Sam Altman in May said he was 'excited to see what will happen with tokenmaxxing startups.' · Bain & Company's Jue Wang cites AI-tool costs doubling roughly monthly — example ~$200/developer/month across ~20,000 developers. · Palantir CEO Alex Karp says it went 'completely wrong'; Moody's Vincent Gusdorf: 'It's very easy to create something you don't need with AI'; Microsoft's Satya Nadella warned customers 'pay twice for AI.' · primary source

3. EFF reviewed 10 smartwatches, rings and bands — only Apple encrypts your health data, leaving the other nine makers' heart-rate, sleep and location logs a subpoena away

The load-bearing fact: the EFF audited the ten most popular consumer wearable makers and found only Apple Watch offers end-to-end encryption for the health data it stores online. Because fitness-tracker data — heart rate, GPS, sleep — falls outside HIPAA, a subpoena or warrant can unlock what most makers keep as readable data, and a surveillance vendor already markets fitness trackers as an 'overlooked source' for investigations. This is the consumer-privacy exposure hiding inside a device tens of millions of Americans wear to bed.

Key fact: For consumers: if health-data privacy matters, Apple Watch is the only major wearable with end-to-end encryption on by default; assume heart-rate, sleep and GPS logs on the others are readable to the vendor and reachable by subpoena.

EFF published 'Most Smart Watches, Rings, and Bands Lack Basic Transparency Reports and Key Privacy Features' on 2026-07-15 (author Thorin Klosowski), reviewing 10 wearable makers: Amazfit, Apple, Coros, Garmin, Google (Fitbit), Hume, Oura, Polar, Suunto and Whoop. · Only Apple Watch supports end-to-end encryption for Health-app data (on by default); no other popular consumer wearable offers it, so those companies can read the data they store. · Only Apple and Google publish transparency reports; only Apple, Google and Whoop promise to notify users of law-enforcement requests; Oura added a notify promise in June 2026. · Fitness data (heart rate, GPS, sleep) falls outside HIPAA, so a subpoena or warrant can unlock it; surveillance firm Penlink flags fitness trackers as an 'overlooked source' for investigations. Re-covered 2026-07-27 by SecurityAffairs. · primary source

4. USC researchers released a free AI tool that maps a city's tree canopy from free federal aerial photos — no costly lidar — so cash-strapped cities can target shade where heat hits hardest

The load-bearing fact: USC's Spatial Sciences Institute trained AI on free USDA aerial imagery to map tree canopy and detect individual trees at accuracy competitive with far-more-expensive lidar, then released the code and an ArcGIS model for free. That collapses the cost barrier that kept shade-equity mapping out of reach for smaller cities — the tool works without in-house machine-learning staff and transferred across climates without retraining.

Key fact: For city planners and climate offices: the tool is free (code plus an ArcGIS model on Esri's Living Atlas) — use it to target shade investment in low-canopy, high-heat, underserved blocks.

Published 2026-07-08 by USC (today.usc.edu); led by John Wilson, founding director of the Spatial Sciences Institute at USC Dornsife. · The AI combines free USDA National Agriculture Imagery Program (NAIP) aerial imagery with machine learning — no lidar or commercial satellite imagery required. · Individual-tree detection 'performed competitively with far more expensive lidar-based approaches'; developed in Boyle Heights and City Terrace (LA), then validated in San Francisco and Phoenix without retraining. · The research, code and ArcGIS deep-learning model are freely available; the ArcGIS package has been downloaded 12,900+ times from Esri's Living Atlas in six months. · primary source